@exposify/cli 0.0.5 → 0.0.6

package/dist/index.js

@@ -1232,7 +1232,7 @@ function copyToClipboard(text, deps = {}) {
 
 // src/sign-in.ts
 import { spawn } from "child_process";
-import { existsSync as existsSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { chmodSync as chmodSync2, existsSync as existsSync2, readFileSync as readFileSync6, statSync, writeFileSync as writeFileSync5 } from "fs";
 import { join as join3 } from "path";
 import { parseEnv as parseEnv2 } from "util";
 import { authStacksOf, dependencyNames } from "@exposify/core";
@@ -1265,11 +1265,16 @@ function writeKeyToEnv(root, key) {
   const path = join3(root, ".env");
   const line = `${KEY_ENV}=${key}`;
   let created = false;
+  let tightened = false;
   if (existsSync2(path)) {
     const text = readFileSync6(path, "utf8");
     const re = new RegExp(`^\\s*(export\\s+)?${KEY_ENV}\\s*=.*$`, "m");
     const next = re.test(text) ? text.replace(re, line) : `${text}${text === "" || text.endsWith("\n") ? "" : "\n"}${line}
 `;
+    if (process.platform !== "win32" && (statSync(path).mode & 63) !== 0) {
+      chmodSync2(path, 384);
+      tightened = true;
+    }
     writeFileSync5(path, next);
   } else {
     writeFileSync5(path, `${line}
@@ -1281,7 +1286,22 @@ function writeKeyToEnv(root, key) {
     ignored = readFileSync6(join3(root, ".gitignore"), "utf8").split("\n").map((l) => l.trim()).some((l) => [".env", "/.env", ".env*", "/.env*", "*.env"].includes(l));
   } catch {
   }
-  return { path, created, ignored };
+  return { path, created, tightened, ignored };
+}
+var DASHBOARD_HOSTS = ["dashboard.agemno.com"];
+function isSafeVerifyUrl(verifyUrl, apiUrl) {
+  if (/[\s&|^<>"'`%;$\\]/.test(verifyUrl)) return false;
+  let url;
+  try {
+    url = new URL(verifyUrl);
+  } catch {
+    return false;
+  }
+  const isLocal = (u) => u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "[::1]";
+  if (!(url.protocol === "https:" || url.protocol === "http:" && isLocal(url))) return false;
+  if (url.username || url.password) return false;
+  const api = new URL(apiUrl);
+  return url.host === api.host || DASHBOARD_HOSTS.includes(url.host) || isLocal(url) && isLocal(api);
 }
 async function signInToExposify(deps) {
   const fetchImpl = deps.fetchImpl ?? fetch;
@@ -1302,6 +1322,13 @@ async function signInToExposify(deps) {
   } catch (err) {
     return { ok: false, reason: "unreachable", message: `couldn't reach ${deps.apiUrl} (${err.message})` };
   }
+  if (typeof started.verifyUrl !== "string" || !isSafeVerifyUrl(started.verifyUrl, deps.apiUrl)) {
+    return {
+      ok: false,
+      reason: "unsafe",
+      message: `${deps.apiUrl} sent a sign-in link that isn't on its own host or ${DASHBOARD_HOSTS.join(", ")}, so it wasn't opened`
+    };
+  }
   const opened = (deps.openUrl ?? openInBrowser)(started.verifyUrl);
   deps.show({ userCode: started.userCode, verifyUrl: started.verifyUrl, opened });
   const deadline = Date.now() + started.expiresIn * 1e3;
@@ -1331,9 +1358,13 @@ async function signInToExposify(deps) {
   }
   return { ok: false, reason: "expired", message: "the sign-in link expired" };
 }
+function browserCommand(url, platform = process.platform) {
+  if (platform === "win32") return ["rundll32", "url.dll,FileProtocolHandler", url];
+  return platform === "darwin" ? ["open", url] : ["xdg-open", url];
+}
 function openInBrowser(url) {
   if (process.env.EXPOSIFY_NO_BROWSER === "1") return false;
-  const [cmd, ...args] = process.platform === "darwin" ? ["open", url] : process.platform === "win32" ? ["cmd", "/c", "start", "", url] : ["xdg-open", url];
+  const [cmd, ...args] = browserCommand(url);
   try {
     const child = spawn(cmd, args, { stdio: "ignore", detached: true });
     child.on("error", () => {
@@ -1984,6 +2015,7 @@ ${bold(title)} \xB7 How your users sign in`);
   const written = writeKeyToEnv(root, outcome.key);
   process.env[KEY_ENV] = outcome.key;
   console.log(green(`  \u2713 ${written.created ? "Created" : "Updated"} ${relative(cwd, written.path) || written.path} with ${KEY_ENV}`) + ` (project "${outcome.projectName}").`);
+  if (written.tightened) console.log(dim(`  .env could be read by other users on this machine; it's owner-only now.`));
   if (!written.ignored) console.log(yellow(`  ! Add .env to .gitignore: it now holds a secret.`));
   if (own) console.log(`  Your app tells Exposify about its ${sb ? "Supabase Auth" : "login"} when it starts with ${KEY_ENV}: nothing to add in the dashboard.`);
   else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/cli",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",