@frangoteam/fuxa-min 1.2.10 → 1.3.0

package/api/auth/index.js

@@ -10,12 +10,78 @@ const authJwt = require('../jwt-helper');
 var runtime;
 var secretCode;
 var tokenExpiresIn;
+var enableRefreshCookieAuth = false;
+var refreshTokenExpiresIn = '7d';
+const refreshCookieName = 'fuxa_refresh';
+
+function parseExpiresToMs(expiresIn) {
+    if (expiresIn === undefined || expiresIn === null) {
+        return null;
+    }
+    if (typeof expiresIn === 'number') {
+        return expiresIn * 1000;
+    }
+    if (typeof expiresIn !== 'string') {
+        return null;
+    }
+    const match = expiresIn.trim().match(/^(\d+)\s*([smhd])?$/i);
+    if (!match) {
+        return null;
+    }
+    const value = Number(match[1]);
+    const unit = (match[2] || 's').toLowerCase();
+    const multipliers = { s: 1000, m: 60000, h: 3600000, d: 86400000 };
+    return value * (multipliers[unit] || 1000);
+}
+
+function getCookieValue(req, name) {
+    const cookieHeader = req.headers.cookie;
+    if (!cookieHeader) return null;
+    const cookies = cookieHeader.split(';');
+    for (const cookie of cookies) {
+        const [key, ...rest] = cookie.trim().split('=');
+        if (key === name) {
+            return decodeURIComponent(rest.join('='));
+        }
+    }
+    return null;
+}
+
+function buildAccessToken(user) {
+    return jwt.sign({ id: user.username, groups: user.groups }, secretCode, { expiresIn: tokenExpiresIn });
+}
+
+function buildRefreshToken(user) {
+    return jwt.sign({ id: user.username, groups: user.groups, type: 'refresh' }, secretCode, { expiresIn: refreshTokenExpiresIn });
+}
+
+function setRefreshCookie(res, token) {
+    const maxAge = parseExpiresToMs(refreshTokenExpiresIn);
+    const options = {
+        httpOnly: true,
+        sameSite: 'lax',
+        secure: !!runtime?.settings?.https,
+        path: '/api/refresh'
+    };
+    if (maxAge) {
+        options.maxAge = maxAge;
+    }
+    res.cookie(refreshCookieName, token, options);
+}
+
+function clearRefreshCookie(res) {
+    res.clearCookie(refreshCookieName, { path: '/api/refresh' });
+}
 
 module.exports = {
-    init: function (_runtime, _secretCode, _tokenExpires) {
+    init: function (_runtime, _secretCode, _tokenExpires, _enableRefreshCookieAuth, _refreshTokenExpires) {
         runtime = _runtime;
         secretCode = _secretCode;
         tokenExpiresIn = _tokenExpires;
+        enableRefreshCookieAuth = !!_enableRefreshCookieAuth;
+        if (_refreshTokenExpires) {
+            refreshTokenExpiresIn = _refreshTokenExpires;
+        }
     },
     app: function () {
         var authApp = express();
@@ -35,7 +101,11 @@ module.exports = {
             runtime.users.findOne(req.body).then(function (userInfo) {
                 if (userInfo && userInfo.length && userInfo[0].password) {
                     if (bcrypt.compareSync(req.body.password, userInfo[0].password)) {
-                        const token = jwt.sign({ id: userInfo[0].username, groups: userInfo[0].groups }, secretCode, { expiresIn: tokenExpiresIn });//'1h' });
+                        const token = buildAccessToken(userInfo[0]);
+                        if (enableRefreshCookieAuth) {
+                            const refreshToken = buildRefreshToken(userInfo[0]);
+                            setRefreshCookie(res, refreshToken);
+                        }
                         res.json({
                             status: 'success',
                             message: 'user found!!!',
@@ -66,6 +136,74 @@ module.exports = {
             });
         });
 
+        /**
+         * POST Refresh
+         * Refresh access token using HttpOnly refresh cookie
+         */
+        authApp.post('/api/refresh', async function (req, res, next) {
+            if (!runtime?.settings?.secureEnabled || !enableRefreshCookieAuth) {
+                return res.status(204).end();
+            }
+            const refreshToken = getCookieValue(req, refreshCookieName);
+            if (!refreshToken) {
+                return res.status(401).json({ status: 'error', message: 'Refresh token missing' });
+            }
+            try {
+                const decoded = jwt.verify(refreshToken, secretCode);
+                if (decoded?.type !== 'refresh') {
+                    clearRefreshCookie(res);
+                    return res.status(401).json({ status: 'error', message: 'Invalid refresh token' });
+                }
+
+                let userData = null;
+                try {
+                    const users = await runtime.users.getUsers({ username: decoded.id });
+                    if (users && users.length) {
+                        userData = users[0];
+                    }
+                } catch (err) {
+                    runtime.logger.error(`api refresh: user lookup failed ${err}`);
+                }
+
+                const user = {
+                    username: decoded.id,
+                    fullname: userData?.fullname,
+                    groups: userData?.groups || decoded.groups,
+                    info: userData?.info
+                };
+
+                const newAccessToken = buildAccessToken(user);
+                const newRefreshToken = buildRefreshToken(user);
+                setRefreshCookie(res, newRefreshToken);
+
+                res.json({
+                    status: 'success',
+                    message: 'token refreshed',
+                    data: {
+                        username: user.username,
+                        fullname: user.fullname,
+                        groups: user.groups,
+                        info: user.info,
+                        token: newAccessToken
+                    }
+                });
+            } catch (err) {
+                clearRefreshCookie(res);
+                res.status(401).json({ status: 'error', message: 'Invalid refresh token' });
+            }
+        });
+
+        /**
+         * POST SignOut
+         * Clear refresh cookie
+         */
+        authApp.post('/api/signout', function (req, res, next) {
+            if (enableRefreshCookieAuth) {
+                clearRefreshCookie(res);
+            }
+            res.status(204).end();
+        });
+
         return authApp;
     }
-}
+}

package/api/command/index.js

@@ -6,6 +6,7 @@ var express = require("express");
 const authJwt = require('../jwt-helper');
 const fs = require('fs');
 const path = require('path');
+const { resolveWithin } = require('../path-helper');
 var runtime;
 var secureFnc;
 var checkGroupsFnc;
@@ -39,11 +40,16 @@ module.exports = {
             } else {
                 if (req.query.cmd === CommanTypeEnum.reportDownload) {
                     try {
-                        const fileName = req.query.name.replace(new RegExp('../', 'g'), '');
-                        var reportPath = path.join(runtime.settings.reportsDir, fileName);
-                        if (!fs.existsSync(reportPath)) {
-                            reportPath = path.join(process.cwd(), runtime.settings.reportsDir, fileName);
+                        var reportBase = runtime.settings.reportsDir;
+                        if (!fs.existsSync(reportBase)) {
+                            reportBase = path.join(process.cwd(), runtime.settings.reportsDir);
                         }
+                        const resolvedReport = resolveWithin(reportBase, req.query.name);
+                        if (!resolvedReport) {
+                            res.status(400).json({ error: "invalid_path", message: "Invalid report file." });
+                            return;
+                        }
+                        const reportPath = resolvedReport.resolvedTarget;
                         if (fs.existsSync(reportPath)) {
                             res.sendFile(reportPath, (err) => {
                                 if (err) {

package/api/diagnose/index.js

@@ -6,6 +6,7 @@ const fs = require('fs');
 const path = require('path');
 var express = require("express");
 const authJwt = require('../jwt-helper');
+const { normalizeRelativePath, resolveWithin } = require('../path-helper');
 var runtime;
 var secureFnc;
 var checkGroupsFnc;
@@ -67,14 +68,21 @@ module.exports = {
                 runtime.logger.error("api get logs: Unauthorized!");
             } else {
                 try {
-                    const fileName = req.query.file.replace(new RegExp('../', 'g'), '');
-                    var logFileName = fileName || 'fuxa.log';
+                    const requestedName = req.query.file ? normalizeRelativePath(req.query.file) : 'fuxa.log';
+                    if (!requestedName) {
+                        res.status(400).json({ error: "invalid_path", message: "Invalid log file." });
+                        return;
+                    }
                     var logPath = runtime.logger.logDir();
                     if (!fs.existsSync(logPath)) {
                         logPath = path.join(process.cwd(), runtime.logger.logDir());
                     }
-                    var logFiles = fs.readdirSync(logPath);
-                    let logFile = path.join(logPath, logFileName);
+                    const resolvedLog = resolveWithin(logPath, requestedName);
+                    if (!resolvedLog) {
+                        res.status(400).json({ error: "invalid_path", message: "Invalid log file." });
+                        return;
+                    }
+                    let logFile = resolvedLog.resolvedTarget;
                     res.header('Content-Type', 'text/plain; charset=utf-8');
                     res.download(logFile, (err) => {
                         if (err) {

package/api/index.js

@@ -39,8 +39,11 @@ function init(_server, _runtime) {
     return new Promise(function (resolve, reject) {
         if (runtime.settings.disableServer !== false) {
             apiApp = express();
-            apiApp.use(morgan(['combined', 'common', 'dev', 'short', 'tiny'].
-                includes(runtime.settings.logApiLevel) ? runtime.settings.logApiLevel : 'combined'));
+
+			if (runtime.settings.logApiLevel !== 'none') {
+				apiApp.use(morgan(['combined', 'common', 'dev', 'short', 'tiny'].
+				includes(runtime.settings.logApiLevel) ? runtime.settings.logApiLevel : 'combined'));
+			}
 
             var maxApiRequestSize = runtime.settings.apiMaxLength || '100mb';
             apiApp.use(bodyParser.json({limit:maxApiRequestSize}));
@@ -53,7 +56,7 @@ function init(_server, _runtime) {
             apiApp.use(usersApi.app());
             alarmsApi.init(runtime, authMiddleware, verifyGroups);
             apiApp.use(alarmsApi.app());
-            authApi.init(runtime, authJwt.secretCode, authJwt.tokenExpiresIn);
+            authApi.init(runtime, authJwt.secretCode, authJwt.tokenExpiresIn, runtime.settings.enableRefreshCookieAuth, runtime.settings.refreshTokenExpiresIn);
             apiApp.use(authApi.app());
             pluginsApi.init(runtime, authMiddleware, verifyGroups);
             apiApp.use(pluginsApi.app());
@@ -76,7 +79,9 @@ function init(_server, _runtime) {
 
             const limiter = rateLimit({
                 windowMs: 5 * 60 * 1000, // 5 minutes
-                max: 100 // limit each IP to 100 requests per windowMs
+                max: 100, // limit each IP to 100 requests per windowMs
+                // Keep lightweight health/version checks unthrottled
+                skip: (req) => req.path === '/api/version'
             });
 
             //  apply to all requests
@@ -141,18 +146,31 @@ function init(_server, _runtime) {
                         if (!req.body.secretCode && runtime.settings.secretCode) {
                             req.body.secretCode = runtime.settings.secretCode;
                         }
+                        if (req.body.secureEnabled && !req.body.secretCode) {
+                            req.body.secretCode = utils.generateSecretCode();
+                            runtime.logger.warn('Generated random JWT secret because secureEnabled=true and no secretCode was provided.');
+                        }
                         const prevAuth = {
                             secureEnabled: runtime.settings.secureEnabled,
                             tokenExpiresIn: runtime.settings.tokenExpiresIn,
+                            enableRefreshCookieAuth: runtime.settings.enableRefreshCookieAuth,
+                            refreshTokenExpiresIn: runtime.settings.refreshTokenExpiresIn,
                             secretCode: runtime.settings.secretCode
                         };
+                        if (req.body.nodeRedEnabled === true &&
+                            utils.isNullOrUndefined(req.body.nodeRedAuthMode) &&
+                            runtime.settings.nodeRedEnabled === false) {
+                            req.body.nodeRedAuthMode = 'secure';
+                        }
                         fs.writeFileSync(runtime.settings.userSettingsFile, JSON.stringify(req.body, null, 4));
                         mergeUserSettings(req.body);
                         if (prevAuth.secureEnabled !== runtime.settings.secureEnabled ||
                             prevAuth.tokenExpiresIn !== runtime.settings.tokenExpiresIn ||
+                            prevAuth.enableRefreshCookieAuth !== runtime.settings.enableRefreshCookieAuth ||
+                            prevAuth.refreshTokenExpiresIn !== runtime.settings.refreshTokenExpiresIn ||
                             prevAuth.secretCode !== runtime.settings.secretCode) {
                             authJwt.init(runtime.settings.secureEnabled, runtime.settings.secretCode, runtime.settings.tokenExpiresIn);
-                            authApi.init(runtime, authJwt.secretCode, authJwt.tokenExpiresIn);
+                            authApi.init(runtime, authJwt.secretCode, authJwt.tokenExpiresIn, runtime.settings.enableRefreshCookieAuth, runtime.settings.refreshTokenExpiresIn);
                         }
                         runtime.restart(true).then(function(result) {
                             res.end();
@@ -168,11 +186,11 @@ function init(_server, _runtime) {
              * GET Heartbeat to check token
              */
             apiApp.post('/api/heartbeat', authMiddleware, function (req, res) {
+
                 if (!runtime.settings.secureEnabled) {
-                    res.end();
-                } else if (res.statusCode === 403) {
-                    runtime.logger.error("api post heartbeat: Tocken Expired");
+                    return res.end();
                 }
+
                 if (req.body.params) {
 
                     if (!req.isAuthenticated) {
@@ -196,6 +214,7 @@ function init(_server, _runtime) {
                         token: authJwt.getGuestToken()
                     });
                 }
+
                 return res.end();
             });
 
@@ -215,12 +234,26 @@ function mergeUserSettings(settings) {
     runtime.settings.logFull = settings.logFull;
     runtime.settings.userRole = settings.userRole;
     runtime.settings.nodeRedEnabled = settings.nodeRedEnabled;
+    if (!utils.isNullOrUndefined(settings.nodeRedAuthMode)) {
+        runtime.settings.nodeRedAuthMode = settings.nodeRedAuthMode;
+    }
+    if (!utils.isNullOrUndefined(settings.enableRefreshCookieAuth)) {
+        runtime.settings.enableRefreshCookieAuth = settings.enableRefreshCookieAuth;
+    }
+    if (!utils.isNullOrUndefined(settings.refreshTokenExpiresIn)) {
+        runtime.settings.refreshTokenExpiresIn = settings.refreshTokenExpiresIn;
+    }
+    if (!utils.isNullOrUndefined(settings.nodeRedUnsafeModules)) {
+        runtime.settings.nodeRedUnsafeModules = settings.nodeRedUnsafeModules;
+    }
     runtime.settings.swaggerEnabled = settings.swaggerEnabled;
     if (settings.secretCode) {
         runtime.settings.secretCode = settings.secretCode;
     }
     if (settings.secureEnabled) {
         runtime.settings.tokenExpiresIn = settings.tokenExpiresIn;
+        runtime.settings.enableRefreshCookieAuth = settings.enableRefreshCookieAuth;
+        runtime.settings.refreshTokenExpiresIn = settings.refreshTokenExpiresIn;
     }
     if (settings.smtp) {
         runtime.settings.smtp = settings.smtp;

package/api/jwt-helper.js

@@ -1,9 +1,11 @@
 'use strict';
 
 const jwt = require('jsonwebtoken');
+const utils = require('../runtime/utils');
 
 var secureEnabled = false;
-var secretCode = 'frangoteam751';
+// Runtime fallback secret used only when no persistent secret is configured.
+var secretCode = utils.generateSecretCode();
 var tokenExpiresIn = 60 * 60;   // 60 minutes
 const adminGroups = [-1, 255];
 
@@ -132,6 +134,16 @@ function getGuestToken() {
     return token;
 }
 
+function isGuestUser(userId, userGroups) {
+    if (userId === 'guest') {
+        return true;
+    }
+    if (Array.isArray(userGroups) && userGroups.includes('guest')) {
+        return true;
+    }
+    return false;
+}
+
 function haveAdminPermission(permission) {
     if (permission === null || permission === undefined) {
         return false;
@@ -156,5 +168,6 @@ module.exports = {
     get secretCode() { return secretCode },
     get tokenExpiresIn() { return tokenExpiresIn },
     haveAdminPermission: haveAdminPermission,
-    adminGroups: adminGroups
+    adminGroups: adminGroups,
+    isGuestUser: isGuestUser
 };

package/api/path-helper.js

@@ -0,0 +1,41 @@
+const path = require('path');
+
+function normalizeRelativePath(input) {
+    if (typeof input !== 'string' || !input) {
+        return null;
+    }
+    if (input.indexOf('\0') !== -1) {
+        return null;
+    }
+    if (path.isAbsolute(input)) {
+        return null;
+    }
+    const normalized = path.normalize(input).replace(/^[\\/]+/, '');
+    if (!normalized || normalized === '.' || normalized === path.sep) {
+        return null;
+    }
+    const parts = normalized.split(path.sep);
+    if (parts.includes('..')) {
+        return null;
+    }
+    return normalized;
+}
+
+function resolveWithin(baseDir, targetPath) {
+    const normalized = normalizeRelativePath(targetPath);
+    if (!normalized) {
+        return null;
+    }
+    const resolvedBase = path.resolve(baseDir);
+    const resolvedTarget = path.resolve(resolvedBase, normalized);
+    const relative = path.relative(resolvedBase, resolvedTarget);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+        return null;
+    }
+    return { resolvedTarget, normalized };
+}
+
+module.exports = {
+    normalizeRelativePath,
+    resolveWithin
+};

package/api/projects/index.js

@@ -7,6 +7,7 @@ const authJwt = require('../jwt-helper');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const { normalizeRelativePath, resolveWithin } = require('../path-helper');
 
 var runtime;
 var secureFnc;
@@ -207,41 +208,53 @@ module.exports = {
                 let encoding = {};
                 // let basedata = file.data.replace(/^data:.*,/, '');
                 // let basedata = file.data.replace(/^data:image\/png;base64,/, "");
-                let fileName = file.name.replace(new RegExp('../', 'g'), '');
-                let fullPath = file.fullPath || file.name;
-                fullPath = fullPath.replace(/(\.\.[/\\])/g, '');
-                fullPath = path.normalize(fullPath).replace(/^(\.\.[/\\])+/, '');
+                const rawFileName = typeof file.name === 'string' ? file.name : '';
+                const safeFileName = normalizeRelativePath(rawFileName);
+                const safeFullPath = normalizeRelativePath(file.fullPath || rawFileName);
+                const relativePath = safeFullPath || safeFileName;
+                if (!relativePath) {
+                    res.status(400).json({error:"invalid_path", message: "Invalid upload path."});
+                    return;
+                }
 
                 if (file.type !== 'svg') {
                     basedata = file.data.replace(/^data:.*,/, '');
                     encoding = {encoding: 'base64'};
                 }
-                let filePath = path.join(runtime.settings.uploadFileDir, fullPath || fileName);
+                const resolvedUpload = resolveWithin(runtime.settings.uploadFileDir, relativePath);
+                if (!resolvedUpload) {
+                    res.status(400).json({error:"invalid_path", message: "Invalid upload path."});
+                    return;
+                }
+                let filePath = resolvedUpload.resolvedTarget;
                 if (destination) {
                     const baseDir = process.versions.electron
                         ? (process.env.userDir || path.join(os.homedir(), '.fuxa'))
                         : runtime.settings.appDir;
-                    const normalizedDestination = path.normalize(destination).replace(/^([/\\])+/, '');
-                    const destinationParts = normalizedDestination.split(path.sep);
-                    const hasTraversal = destinationParts.includes('..');
-                    if (!normalizedDestination || hasTraversal || path.isAbsolute(destination)) {
+                    const normalizedDestination = normalizeRelativePath(destination);
+                    if (!normalizedDestination) {
                         res.status(400).json({error:"invalid_destination", message: "Invalid destination path."});
                         return;
                     }
-                    const destinationDir = path.resolve(baseDir, `_${normalizedDestination}`);
-                    const resolvedBase = path.resolve(baseDir);
-                    if (destinationDir !== resolvedBase && !destinationDir.startsWith(resolvedBase + path.sep)) {
+                    const resolvedDestination = resolveWithin(baseDir, `_${normalizedDestination}`);
+                    if (!resolvedDestination) {
                         res.status(400).json({error:"invalid_destination", message: "Invalid destination path."});
                         return;
                     }
-                    filePath = path.join(destinationDir, fullPath || fileName);
+                    const destinationDir = resolvedDestination.resolvedTarget;
+                    const resolvedFile = resolveWithin(destinationDir, relativePath);
+                    if (!resolvedFile) {
+                        res.status(400).json({error:"invalid_path", message: "Invalid upload path."});
+                        return;
+                    }
+                    filePath = resolvedFile.resolvedTarget;
                     const dir = path.dirname(filePath);
                     if (!fs.existsSync(dir)) {
                         fs.mkdirSync(dir, { recursive: true });
                     }
                 }
                 fs.writeFileSync(filePath, basedata, encoding);
-                let result = {'location': '/' + runtime.settings.httpUploadFileStatic + '/' + fullPath || fileName };
+                let result = {'location': '/' + runtime.settings.httpUploadFileStatic + '/' + relativePath };
                 res.json(result);
             } catch (err) {
                 if (err && err.code) {

package/api/reports/reports.service.ts

@@ -2,6 +2,7 @@
 const authJwt = require('../api/jwt-helper');
 const fs = require('fs');
 const path = require('path');
+const { resolveWithin } = require('../api/path-helper');
 import express, { Request, Response } from 'express';
 
 export class ReportsApiService {
@@ -121,7 +122,16 @@ export class ReportsApiService {
                     if (!fs.existsSync(reportPath)) {
                         reportPath = path.join(process.cwd(), this.runtime.settings.reportsDir, req.params);
                     }
-                    const filePath = path.join(reportPath, req.body.params?.fileName);
+                    const resolvedFile = resolveWithin(reportPath, req.body.params?.fileName);
+                    if (!resolvedFile) {
+                        res.status(400).json({ error: "invalid_path", message: "Invalid report file." });
+                        return;
+                    }
+                    const filePath = resolvedFile.resolvedTarget;
+                    if (!fs.existsSync(filePath)) {
+                        res.status(404).json({ error: "not_found", message: "Report file not found!" });
+                        return;
+                    }
                     fs.unlinkSync(filePath);
                     this.runtime.logger.info(`Report file '${filePath}' deleted!`, true);
                     res.end();
@@ -170,4 +180,4 @@ export interface ReportFile {
     fileName: string;
     reportName: string;
     created: Date;
-}
+}

package/api/resources/index.js

@@ -9,6 +9,7 @@ const authJwt = require('../jwt-helper');
 const Report = require('../../runtime/jobs/report');
 const fontkit = require('fontkit');
 const os = require('os');
+const { resolveWithin } = require('../path-helper');
 
 var runtime;
 var secureFnc;
@@ -116,8 +117,12 @@ module.exports = {
                 runtime.logger.error("api post remove resource: Unauthorized");
             } else {
                 try {
-                    let fileName = req.body.file.replace(new RegExp('../', 'g'), '');
-                    const filePath = path.join(runtime.settings.resourcesFileDir, fileName);
+                    const resolvedFile = resolveWithin(runtime.settings.resourcesFileDir, req.body.file);
+                    if (!resolvedFile) {
+                        res.status(400).json({ error: "invalid_path", message: "Invalid resource path." });
+                        return;
+                    }
+                    const filePath = resolvedFile.resolvedTarget;
                     if (fs.existsSync(filePath)) {
                         fs.unlinkSync(filePath);
                     }
@@ -270,10 +275,13 @@ module.exports = {
                         var group = { name: resourcesDirs[i], items: [] };
                         var dirPath = path.resolve(runtime.settings.widgetsFileDir, resourcesDirs[i]);
                         var wwwSubDir = path.join('_widgets', resourcesDirs[i]);
-                        var files = getFiles(dirPath, ['.svg']);
+                        var files = getFilesRecursive(dirPath, ['.svg']);
                         for (var x = 0; x < files.length; x++) {
                             var filename = files[x];
-                            group.items.push({ path: path.join(wwwSubDir, files[x]).split(path.sep).join(path.posix.sep), name: filename });
+                            group.items.push({
+                                path: path.join(wwwSubDir, files[x]).split(path.sep).join(path.posix.sep),
+                                name: filename
+                            });
                         }
                         result.groups.push(group);
                     }
@@ -302,7 +310,6 @@ module.exports = {
             }
             try {
                 let relPath = req.body?.path;
-                relPath = relPath.replace(new RegExp('\\.\\.\/', 'g'), '');
                 if (!relPath || typeof relPath !== 'string') {
                     return res.status(400).json({ error: "invalid_path", message: "Missing or invalid widget path." });
                 }
@@ -310,12 +317,12 @@ module.exports = {
                 if (process.versions.electron) {
                     basePath = process.env.userDir || path.join(os.homedir(), '.fuxa');
                 }
-                const fullPath = path.resolve(basePath, relPath);
-
-                if (!fullPath.startsWith(basePath)) {
-                    runtime.logger.error("api resources/widgets: security_violation " + fullPath);
+                const resolvedWidget = resolveWithin(basePath, relPath);
+                if (!resolvedWidget) {
+                    runtime.logger.error("api resources/widgets: security_violation " + relPath);
                     return res.status(403).json({ error: 'security_violation', message: 'Invalid path' });
                 }
+                const fullPath = resolvedWidget.resolvedTarget;
 
                 if (!fs.existsSync(fullPath)) {
                     return res.status(404).json({ error: "not_found", message: "Widget file not found." });
@@ -354,3 +361,17 @@ function getFiles(pathDir, extensions) {
         .filter((item) => extensions.indexOf(path.extname(item).toLowerCase()) !== -1);
     return filesInDIrectory;
 }
+
+function getFilesRecursive(pathDir, extensions, baseDir = pathDir) {
+    const entries = fs.readdirSync(pathDir, { withFileTypes: true });
+    const files = [];
+    for (const entry of entries) {
+        const entryPath = path.join(pathDir, entry.name);
+        if (entry.isDirectory()) {
+            files.push(...getFilesRecursive(entryPath, extensions, baseDir));
+        } else if (extensions.indexOf(path.extname(entry.name).toLowerCase()) !== -1) {
+            files.push(path.relative(baseDir, entryPath));
+        }
+    }
+    return files;
+}

package/api/scheduler/index.js

@@ -51,6 +51,16 @@ module.exports = {
 
         // POST scheduler data
         schedulerApp.post("/api/scheduler", secureFnc, function(req, res) {
+            if (res.statusCode === 403) {
+                runtime.logger.error("api post scheduler: Tocken Expired");
+                return;
+            }
+            const isGuest = authJwt.isGuestUser(req.userId, req.userGroups);
+            if (runtime.settings?.secureEnabled && isGuest) {
+                res.status(401).json({error:"unauthorized_error", message: "Unauthorized!"});
+                runtime.logger.error("api post scheduler: Unauthorized guest");
+                return;
+            }
             try {
                 if (req.body && req.body.id && req.body.data !== undefined) {
                     var schedulerId = req.body.id;
@@ -90,6 +100,16 @@ module.exports = {
 
         // DELETE scheduler data
         schedulerApp.delete("/api/scheduler", secureFnc, function(req, res) {
+            if (res.statusCode === 403) {
+                runtime.logger.error("api delete scheduler: Tocken Expired");
+                return;
+            }
+            const isGuest = authJwt.isGuestUser(req.userId, req.userGroups);
+            if (runtime.settings?.secureEnabled && isGuest) {
+                res.status(401).json({error:"unauthorized_error", message: "Unauthorized!"});
+                runtime.logger.error("api delete scheduler: Unauthorized guest");
+                return;
+            }
             try {
                 if (req.query && req.query.id) {
                     var schedulerId = req.query.id;
@@ -181,4 +201,4 @@ function validateSchedulerData(data) {
     }
     
     return { valid: true };
-}
+}