@dutodev/cli 1.6.0 → 1.7.0

package/README.md

@@ -154,7 +154,7 @@ People get in one of these ways:
 | `curl`, Postman, scripts | `curl -u client:password https://backend-<user>.duto.dev/` (`Authorization: Basic`) |
 | An API that already uses `Authorization: Bearer` | Send `X-Duto-Auth: client:password`; the `Bearer` goes through to the app untouched |
 
-Without credentials, a browser is sent to the sign-in page and other clients get `401`. Your local app never receives Duto's credentials: the `Authorization: Basic` that matched, `X-Duto-Auth` and the tunnel cookie are stripped before the request is forwarded (other cookies pass through). An `Authorization: Bearer` from your own app passes unchanged.
+Without credentials, a browser is sent to the sign-in page and other clients get `401`. After 10 wrong passwords from one address in 5 minutes, that address is locked out for the rest of the window (the sign-in page answers `429` with `Retry-After`, other clients keep getting `401`). After 100 wrong passwords from all addresses, every password attempt is locked out the same way. A browser that already signed in keeps working. Your local app never receives Duto's credentials: the `Authorization: Basic` that matched, `X-Duto-Auth` and the tunnel cookie are stripped before the request is forwarded (other cookies pass through). An `Authorization: Bearer` from your own app passes unchanged.
 
 **Signing out and sessions.** In a browser, signing in sets a cookie that is valid for that tunnel only. To sign out, open `/__duto/logout`: it clears the cookie and returns to the sign-in page. The cookie lasts until the browser closes or the CLI stops. Restarting the CLI signs everyone out, because the key that signs the cookies is new every session. The cookie only counts on requests to the tunnel itself: a page on another origin (another tunnel, another site) that calls the tunnel has to send `X-Duto-Auth` or `Authorization: Basic`. So opening the tunnel from a link on another `*.duto.dev` address (the dashboard or another tunnel) asks for the password again; a link from outside (email, chat) or a typed URL gets straight in.
 

package/dist/{fullscreen-MSVJF43W.js → fullscreen-ZNFUDV2B.js}

@@ -15,7 +15,7 @@ import {
   tunnelColor,
   updateLine,
   validateName
-} from "./chunk-DUC4RSBW.js";
+} from "./chunk-QVJHHURM.js";
 
 // src/ui/fullscreen.tsx
 import { render } from "ink";

package/dist/index.js

@@ -27,7 +27,7 @@ import {
   statusColor,
   updateLine,
   validateName
-} from "./chunk-DUC4RSBW.js";
+} from "./chunk-QVJHHURM.js";
 
 // src/ui/brand.ts
 function colorOn(stream = process.stdout) {
@@ -57,7 +57,7 @@ import { join as join5, relative } from "path";
 import cac from "cac";
 
 // src/version.ts
-var CLI_VERSION = "1.6.0";
+var CLI_VERSION = "1.7.0";
 
 // src/api.ts
 var DutoApiError = class extends Error {
@@ -561,7 +561,7 @@ async function browserLogin(o) {
   const start = await api.startLogin({
     deviceId: o.deviceId,
     deviceName: hostname(),
-    cliVersion: "1.6.0",
+    cliVersion: "1.7.0",
     nodeVersion: process.version,
     os: process.platform,
     arch: process.arch
@@ -1749,9 +1749,12 @@ function cookieIssues(r, ctx) {
   }
   return out;
 }
+function isPublicOrigin(origin, publicHost) {
+  return publicHost !== null && absoluteUrl(origin)?.host === publicHost.toLowerCase();
+}
 function corsIssues(r, ctx) {
   const origin = r.reqHeaders.origin;
-  if (!origin || r.status === null || ctx.publicHost && origin.toLowerCase() === `https://${ctx.publicHost}`) return [];
+  if (!origin || r.status === null || r.websocket || isPublicOrigin(origin, ctx.publicHost)) return [];
   const allowed = r.resHeaders["access-control-allow-origin"];
   const ok2 = allowed === "*" || allowed === origin;
   const wanted = r.reqHeaders["access-control-request-method"];
@@ -2172,6 +2175,48 @@ async function isPortListening(port, timeoutMs = 500) {
 
 // src/session/auth.ts
 import { createHash as createHash3, createHmac, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+
+// src/session/attempts.ts
+var ATTEMPT_WINDOW_MS = 5 * 6e4;
+var MAX_FAILURES_PER_CLIENT = 10;
+var MAX_FAILURES_TOTAL = 100;
+var SWEEP_ABOVE_CLIENTS = 1e4;
+function msUntilBelow(times, max, now) {
+  if (times.length < max) return 0;
+  return Math.max(0, times[times.length - max] + ATTEMPT_WINDOW_MS - now);
+}
+var FailedAttempts = class {
+  constructor(now) {
+    this.now = now;
+  }
+  now;
+  byClient = /* @__PURE__ */ new Map();
+  total = [];
+  lockedFor(client) {
+    const now = this.now();
+    this.total = this.fresh(this.total, now);
+    const mine = this.fresh(this.byClient.get(client) ?? [], now);
+    if (mine.length) this.byClient.set(client, mine);
+    else this.byClient.delete(client);
+    return Math.max(msUntilBelow(mine, MAX_FAILURES_PER_CLIENT, now), msUntilBelow(this.total, MAX_FAILURES_TOTAL, now));
+  }
+  record(client) {
+    const now = this.now();
+    this.total = [...this.fresh(this.total, now), now].slice(-MAX_FAILURES_TOTAL);
+    this.byClient.set(client, [...this.fresh(this.byClient.get(client) ?? [], now), now].slice(-MAX_FAILURES_PER_CLIENT));
+    if (this.byClient.size > SWEEP_ABOVE_CLIENTS) this.sweep(now);
+  }
+  fresh(times, now) {
+    return times.filter((t) => t > now - ATTEMPT_WINDOW_MS);
+  }
+  sweep(now) {
+    for (const [client, times] of this.byClient) {
+      if (!this.fresh(times, now).length) this.byClient.delete(client);
+    }
+  }
+};
+
+// src/session/auth.ts
 var TUNNEL_COOKIE = "__Host-duto_tunnel";
 var SEC_FETCH_SITE_SAME_SITE = "same-site";
 var QR_TTL_MS = 5 * 6e4;
@@ -2186,6 +2231,7 @@ function parseBasic(value) {
   return m ? splitPair(Buffer.from(m[1], "base64").toString("utf8")) : null;
 }
 var first2 = (v) => Array.isArray(v) ? v[0] : v;
+var clientOf2 = (h) => first2(h["cf-connecting-ip"]) ?? "unknown";
 var bareHost = (s) => s.replace(/:\d+$/, "").toLowerCase();
 function sameHostOrigin(h) {
   if (first2(h["sec-fetch-site"])?.toLowerCase() === SEC_FETCH_SITE_SAME_SITE) return false;
@@ -2207,6 +2253,7 @@ var TunnelAuth = class {
   now;
   secret;
   qr = null;
+  failures;
   constructor(o) {
     this.tunnel = o.tunnel;
     this.credentials = o.credentials;
@@ -2214,6 +2261,7 @@ var TunnelAuth = class {
     this.now = o.now ?? Date.now;
     this.secret = o.secret ?? randomBytes2(32);
     this.qrUser = o.credentials[0]?.user ?? "";
+    this.failures = new FailedAttempts(this.now);
   }
   access(h) {
     if (this.allow) {
@@ -2225,9 +2273,19 @@ var TunnelAuth = class {
     if (cookieUser && sameHostOrigin(h)) return { kind: "user", user: cookieUser };
     const dutoAuthHeader = first2(h["x-duto-auth"]);
     const candidate = dutoAuthHeader !== void 0 ? splitPair(dutoAuthHeader) : parseBasic(first2(h.authorization));
-    if (candidate && this.checkPassword(candidate.user, candidate.password)) return { kind: "user", user: candidate.user };
+    if (candidate && this.attemptPassword(h, candidate.user, candidate.password) === "ok") return { kind: "user", user: candidate.user };
     return { kind: "denied" };
   }
+  lockedFor(h) {
+    return this.failures.lockedFor(clientOf2(h));
+  }
+  attemptPassword(h, user, password) {
+    const client = clientOf2(h);
+    if (this.failures.lockedFor(client) > 0) return "locked";
+    if (this.checkPassword(user, password)) return "ok";
+    this.failures.record(client);
+    return "wrong";
+  }
   checkPassword(user, password) {
     let ok2 = false;
     for (const c of this.credentials) {
@@ -2452,6 +2510,10 @@ function safeNext(raw) {
   if (!raw || !raw.startsWith("/") || raw.startsWith("//") || raw.startsWith("/\\")) return "/";
   return /^[\x21-\x7e]+$/.test(raw) ? raw : "/";
 }
+var ERROR_TEXT = {
+  wrong: "Wrong username or password.",
+  locked: "Too many wrong passwords. Wait a few minutes and try again."
+};
 function loginPage(o) {
   return pageShell(
     "Sign in \xB7 duto",
@@ -2465,7 +2527,7 @@ function loginPage(o) {
 <input id="username" name="username" autocomplete="username" autocapitalize="none" spellcheck="false" required autofocus>
 <label for="password">Password</label>
 <input id="password" name="password" type="password" autocomplete="current-password" required>
-${o.error ? `<p class="error" role="alert">Wrong username or password.</p>
+${o.error ? `<p class="error" role="alert">${ERROR_TEXT[o.error]}</p>
 ` : ""}<button type="submit">Sign in</button>
 </form>
 <div class="retry">You stay signed in until you close the browser or the tunnel closes.</div>
@@ -2581,8 +2643,8 @@ function readForm(req, max) {
 }
 async function authRoute(req, res, route, auth) {
   const url = new URL(req.url ?? "/", "http://duto");
-  const page = (status, next, error) => {
-    res.writeHead(status, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
+  const page = (status, next, error, extra = {}) => {
+    res.writeHead(status, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", ...extra });
     res.end(loginPage({ tunnel: route.tunnel, next, error }));
   };
   const go = (location, cookie) => {
@@ -2591,7 +2653,7 @@ async function authRoute(req, res, route, auth) {
   };
   const { pathname } = url;
   if (pathname === LOGIN_PATH && req.method === "GET") {
-    page(200, safeNext(url.searchParams.get("next")), false);
+    page(200, safeNext(url.searchParams.get("next")), null);
     return true;
   }
   if (pathname === LOGIN_PATH && req.method === "POST") {
@@ -2604,8 +2666,10 @@ async function authRoute(req, res, route, auth) {
     const form = new URLSearchParams(raw);
     const user = form.get("username") ?? "";
     const next = safeNext(form.get("next"));
-    if (auth.checkPassword(user, form.get("password") ?? "")) go(next, auth.loginCookie(user));
-    else page(401, next, true);
+    const attempt = auth.attemptPassword(req.headers, user, form.get("password") ?? "");
+    if (attempt === "ok") go(next, auth.loginCookie(user));
+    else if (attempt === "locked") page(429, next, "locked", { "retry-after": String(Math.ceil(auth.lockedFor(req.headers) / 1e3)) });
+    else page(401, next, "wrong");
     return true;
   }
   if (pathname === LOGOUT_PATH && req.method === "GET") {
@@ -3375,7 +3439,7 @@ async function runSession(specs, source, flags) {
   }
   const warnings = credentialWarnings(specs);
   if (wantsUi(flags)) {
-    const { runFullscreen } = await import("./fullscreen-MSVJF43W.js");
+    const { runFullscreen } = await import("./fullscreen-ZNFUDV2B.js");
     const code = await runFullscreen(session, specs, CLI_VERSION, inspector, inspectorError, update, warnings);
     await inspector?.close().catch(() => void 0);
     process.exit(code);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dutodev/cli",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "Expose a local port at https://<name>-<user>.duto.dev with one command.",
   "license": "MIT",
   "type": "module",