@goodandready/dsh-remote-workspace 0.3.8 → 0.3.10

package/lib/routes/files.js

@@ -1,4 +1,24 @@
-import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
+import { contentDisposition, pipeWithProgress, MAX_BYTES } from '../file-transfer.js';
+
+
+function transferTarget(req, store) {
+  const url = new URL(req.url || '/', 'http://localhost');
+  const profileId = url.searchParams.get('profileId') || '';
+  const filePath = url.searchParams.get('filePath') || '';
+  if (!filePath || filePath.length > 1024 || filePath.includes('\0')) {
+    const err = new Error('A file path is required');
+    err.status = 400;
+    throw err;
+  }
+  const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
+  if (!profile) {
+    const err = new Error('Profile not found');
+    err.status = 404;
+    throw err;
+  }
+  return { profile, filePath };
+}
 
 export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshService }) {
   // 7. POST /dsh-remote-workspace/browse
@@ -7,7 +27,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
     path: '/dsh-remote-workspace/browse',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const body = await readBody(req);
         let profile = null;
@@ -28,7 +48,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
         const entries = await remoteFs.listDir(profile, targetPath);
         writeJson(res, 200, { ok: true, entries, items: entries, currentPath: targetPath });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /browse');
@@ -39,7 +59,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
     path: '/dsh-remote-workspace/file/view',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, filePath } = await readBody(req);
         const profile = store.getProfile(profileId);
@@ -51,7 +71,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
         const buf = await remoteFs.readFile(profile, filePath);
         writeJson(res, 200, { ok: true, content: buf.toString('utf8'), size: stat.size });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /file/view');
@@ -62,7 +82,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
     path: '/dsh-remote-workspace/file/save',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, filePath, content } = await readBody(req);
         const profile = store.getProfile(profileId);
@@ -70,18 +90,73 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
         await remoteFs.writeFile(profile, filePath, Buffer.from(content, 'utf8'));
         writeJson(res, 200, { ok: true });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /file/save');
 
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/file/download',
+    handler: async (req, res) => {
+      if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
+      if (!authorizeRequest(sctx, req, res)) return;
+      try {
+        const { profile, filePath } = transferTarget(req, store);
+        const stat = await remoteFs.stat(profile, filePath);
+        if (!stat.isFile) return writeJson(res, 400, { ok: false, error: 'Only a file can be downloaded' });
+        if (stat.size > MAX_BYTES) return writeJson(res, 413, { ok: false, error: 'File exceeds the 512MB transfer limit' });
+        const stream = await remoteFs.createReadStream(profile, filePath);
+        const stop = () => { try { stream.destroy(); } catch (err) { /* best-effort cleanup */ } };
+        req.on('close', stop);
+        stream.on('error', () => stop());
+        res.writeHead(200, {
+          'Content-Type': 'application/octet-stream',
+          'Content-Length': stat.size,
+          'Content-Disposition': contentDisposition(filePath),
+          'Cache-Control': 'no-store'
+        });
+        stream.pipe(res);
+      } catch (err) {
+        if (!res.headersSent) writeJson(res, err.status || 500, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /file/download');
+
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/file/upload',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!authorizeRequest(sctx, req, res)) return;
+      let upload = null;
+      try {
+        const { profile, filePath } = transferTarget(req, store);
+        upload = await remoteFs.beginUpload(profile, filePath);
+        const bytes = await pipeWithProgress(req, upload.stream);
+        await upload.commit();
+        if (remoteFs.invalidateCache) remoteFs.invalidateCache(profile.id);
+        writeJson(res, 200, { ok: true, bytes });
+      } catch (err) {
+        if (upload) {
+          try { await upload.abort(); } catch (abortErr) { /* best-effort cleanup */ }
+        }
+        if (!res.headersSent) {
+          const status = err.code === 'ABORTED' ? 499 : (err.code === 'LIMIT' ? 413 : (err.status || 500));
+          writeJson(res, status, { ok: false, error: err.message });
+        }
+      }
+    }
+  }), 'dsh-remote-workspace: /file/upload');
+
+
   // 26. POST /dsh-remote-workspace/transfer
   sctx.effect(() => webServer.register({
     kind: 'exact',
     path: '/dsh-remote-workspace/transfer',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { sourceProfileId, sourcePath, destProfileId, destPath } = await readBody(req);
         const srcProfile = sourceProfileId ? store.getProfile(sourceProfileId) : store.getActiveProfile();
@@ -94,7 +169,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
         const result = await sshService.transferFileBetweenHosts(srcProfile, sourcePath, destProfile, destPath);
         writeJson(res, 200, { ok: result.success, ...result });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /transfer');

package/lib/routes/helpers.js

@@ -10,18 +10,54 @@ export function writeJson(res, statusCode, body) {
   res.end(JSON.stringify(body));
 }
 
-export function readBody(req) {
+export const MAX_BODY_BYTES = 5 * 1024 * 1024; // 5 MiB
+
+export function readBody(req, maxBytes = MAX_BODY_BYTES) {
   return new Promise((resolve, reject) => {
+    const rawCl = req?.headers?.['content-length'];
+    const contentLength = rawCl !== undefined ? parseInt(Array.isArray(rawCl) ? rawCl[0] : rawCl, 10) : NaN;
+    if (!isNaN(contentLength) && contentLength > maxBytes) {
+      if (typeof req.destroy === 'function') req.destroy();
+      const error = new Error('Payload too large');
+      error.statusCode = 413;
+      return reject(error);
+    }
+
     let body = '';
-    req.on('data', (chunk) => { body += chunk.toString(); });
+    let bytesReceived = 0;
+    let exceeded = false;
+
+    function onData(chunk) {
+      if (exceeded) return;
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+      bytesReceived += buffer.length;
+      if (bytesReceived > maxBytes) {
+        exceeded = true;
+        if (typeof req.removeListener === 'function') {
+          req.removeListener('data', onData);
+        } else if (typeof req.off === 'function') {
+          req.off('data', onData);
+        }
+        if (typeof req.destroy === 'function') req.destroy();
+        const error = new Error('Payload too large');
+        error.statusCode = 413;
+        return reject(error);
+      }
+      body += buffer.toString('utf8');
+    }
+
+    req.on('data', onData);
     req.on('end', () => {
+      if (exceeded) return;
       try {
         resolve(body ? JSON.parse(body) : {});
       } catch (err) {
         reject(err);
       }
     });
-    req.on('error', reject);
+    req.on('error', (err) => {
+      if (!exceeded) reject(err);
+    });
   });
 }
 
@@ -39,16 +75,24 @@ export function parseCookies(cookieHeader) {
   return cookies;
 }
 
+export function isLoopbackAddress(address) {
+  if (!address || typeof address !== 'string') return false;
+  return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1' || address.startsWith('127.');
+}
+
 export function isTrustedSettingsRequest(req) {
-  const secFetch = req.headers['sec-fetch-site'];
+  const ip = req?.socket?.remoteAddress || '';
+  const isLoopback = isLoopbackAddress(ip);
+
+  const secFetch = req?.headers?.['sec-fetch-site'];
   // Fail-closed: unconditionally reject cross-site and cross-origin requests
   if (secFetch && secFetch !== 'same-origin') {
     return false;
   }
 
   // If origin is present, ensure it matches the request host
-  const origin = req.headers['origin'];
-  const host = req.headers['host'];
+  const origin = req?.headers?.['origin'];
+  const host = req?.headers?.['host'];
   if (origin && host) {
     try {
       const url = new URL(origin);
@@ -60,8 +104,8 @@ export function isTrustedSettingsRequest(req) {
     }
   }
 
-  const rawAuth = req.headers['authorization'];
-  const cookieHeader = req.headers['cookie'];
+  const rawAuth = req?.headers?.['authorization'];
+  const cookieHeader = req?.headers?.['cookie'];
   const expectedToken = process.env.DSH_AUTH_TOKEN || process.env.DSH_TOKEN;
 
   if (expectedToken) {
@@ -74,9 +118,53 @@ export function isTrustedSettingsRequest(req) {
       const token = cookies['token'] || cookies['dsh_token'];
       if (token && token === expectedToken) return true;
     }
+    return false;
   }
+
+  // Non-loopback requests without valid token must not pass simply on Sec-Fetch-Site: same-origin
+  if (!isLoopback) return false;
   if (secFetch === 'same-origin') return true;
-  const ip = req.socket?.remoteAddress || '';
-  if (ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1') return true;
-  return false;
+  return true;
+}
+
+export function getConnection(ctx) {
+  try {
+    return ctx?.reflect?.get ? ctx.reflect.get('connection') : (ctx?.get ? ctx.get('connection') : Reflect.get(ctx || {}, 'connection'));
+  } catch {
+    return undefined;
+  }
+}
+
+export function authorizeRequest(sctx, req, res) {
+  let connection;
+  try {
+    connection = getConnection(sctx);
+  } catch {
+    writeJson(res, 503, { ok: false, error: 'DSH browser authentication is unavailable' });
+    return false;
+  }
+
+  if (!connection || typeof connection.requestRejection !== 'function') {
+    writeJson(res, 503, { ok: false, error: 'DSH browser authentication is unavailable' });
+    return false;
+  }
+
+  let rejection;
+  try {
+    rejection = connection.requestRejection(req);
+  } catch {
+    writeJson(res, 503, { ok: false, error: 'DSH browser authentication is unavailable' });
+    return false;
+  }
+
+  if (rejection !== undefined) {
+    const status = rejection === 401 ? 401 : 403;
+    writeJson(res, status, {
+      ok: false,
+      error: status === 401 ? 'DSH browser authentication is required' : 'Forbidden'
+    });
+    return false;
+  }
+
+  return true;
 }

package/lib/routes/profiles.js

@@ -1,5 +1,7 @@
-import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
 import { SshConfigParser } from '../ssh-config-parser.js';
+import { testProfileGroup } from '../profile-groups.js';
+import { filterClusterProfiles, runCluster } from '../cluster-service.js';
 
 function maskProfile(p) {
   if (!p || typeof p !== 'object') return p;
@@ -17,17 +19,19 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/state',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const profiles = store.getProfiles();
         const activeId = store.getActiveId() || (profiles[0]?.id || '');
         const tunnels = tunnelService.listActiveTunnels();
         const autoSync = store.isAutoSyncEnabled ? store.isAutoSyncEnabled() : false;
         const alerts = alertService ? alertService.getAlerts() : [];
+        const authPrompts = sshService.listKeyboardPrompts ? sshService.listKeyboardPrompts() : [];
         const sanitized = profiles.map((p) => (store.vault ? store.vault.sanitizeProfile(p) : maskProfile(p)));
-        writeJson(res, 200, { ok: true, activeId, profiles: sanitized, tunnels, autoSync, alerts });
+        const terminalFontFamily = store.getTerminalFont ? store.getTerminalFont() : '';
+        writeJson(res, 200, { ok: true, activeId, profiles: sanitized, tunnels, autoSync, alerts, authPrompts, terminalFontFamily });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /state');
@@ -38,7 +42,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/profiles/save',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const profile = await readBody(req);
         if (!profile.id || !profile.host) {
@@ -49,7 +53,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
         const sanitized = store.vault ? store.vault.sanitizeProfile(profile) : maskProfile(profile);
         writeJson(res, 200, { ok: true, profile: sanitized });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /profiles/save');
@@ -60,7 +64,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/profiles/delete',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { id } = await readBody(req);
         if (!id) return writeJson(res, 400, { ok: false, error: 'ID is required' });
@@ -68,7 +72,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
         await store.deleteProfile(id);
         writeJson(res, 200, { ok: true });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /profiles/delete');
@@ -79,14 +83,14 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/profiles/active',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { id } = await readBody(req);
         if (!id) return writeJson(res, 400, { ok: false, error: 'ID is required' });
         await store.setActiveId(id);
         writeJson(res, 200, { ok: true, activeId: id });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /profiles/active');
@@ -97,30 +101,100 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/profiles/import-ssh-config',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
-        const { content } = await readBody(req);
-        if (!content || typeof content !== 'string') {
-          return writeJson(res, 400, { ok: false, error: 'SSH config content is required' });
-        }
-        const importedProfiles = SshConfigParser.parse(content);
-        for (const p of importedProfiles) {
+        const body = await readBody(req);
+        const content = typeof body.content === 'string' && body.content.trim()
+          ? body.content
+          : SshConfigParser.readDefaultConfig();
+        if (!content) return writeJson(res, 400, { ok: false, error: 'SSH config content is required' });
+        const report = SshConfigParser.parseReport(content, { baseDir: body.baseDir });
+        for (const p of report.profiles) {
           await store.saveProfile(p);
         }
-        writeJson(res, 200, { ok: true, count: importedProfiles.length, profiles: importedProfiles });
+        writeJson(res, 200, {
+          ok: true,
+          count: report.profiles.length,
+          profiles: report.profiles,
+          skipped: report.skipped
+        });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /profiles/import-ssh-config');
 
+
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/auth/keyboard',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!authorizeRequest(sctx, req, res)) return;
+      try {
+        const body = await readBody(req);
+        const answers = Array.isArray(body.answers) ? body.answers.slice(0, 20).map((item) => String(item ?? '').slice(0, 256)) : [];
+        const accepted = sshService.submitKeyboardPrompt(body.id || '', answers);
+        if (!accepted) return writeJson(res, 404, { ok: false, error: 'No authentication prompt is waiting' });
+        writeJson(res, 200, { ok: true });
+      } catch (err) {
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /auth/keyboard');
+
+
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/profiles/test-group',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!authorizeRequest(sctx, req, res)) return;
+      try {
+        const body = await readBody(req);
+        const ids = Array.isArray(body.ids) ? body.ids.map((item) => String(item)) : [];
+        const selected = ids.map((id) => store.getProfile(id)).filter(Boolean);
+        const results = await testProfileGroup(selected, (profile) => sshService.testConnection(profile));
+        writeJson(res, 200, { ok: true, results });
+      } catch (err) {
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /profiles/test-group');
+
+
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/cluster',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!authorizeRequest(sctx, req, res)) return;
+      try {
+        const body = await readBody(req);
+        if (!body.command || typeof body.command !== 'string') return writeJson(res, 400, { ok: false, error: 'Command is required' });
+        const selected = filterClusterProfiles(store.getProfiles(), {
+          environment: body.environment,
+          tags: Array.isArray(body.tags) ? body.tags : [],
+          aliases: Array.isArray(body.aliases) ? body.aliases : []
+        });
+        const results = await runCluster(selected, body.command, {
+          maxWorkers: body.maxWorkers,
+          exec: (profile, command) => sshService.exec(profile, command, { timeout: 60, cleanAnsi: true })
+        });
+        writeJson(res, 200, { ok: true, results });
+      } catch (err) {
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /cluster');
+
   // 6. POST /dsh-remote-workspace/test
   sctx.effect(() => webServer.register({
     kind: 'exact',
     path: '/dsh-remote-workspace/test',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const profile = await readBody(req);
         if (!profile.host) return writeJson(res, 400, { ok: false, error: 'Host is required' });

package/lib/routes/sync.js

@@ -1,4 +1,4 @@
-import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
 
 export function registerSyncRoutes(sctx, webServer, { mirrorSync, tarSyncService, watcherService, store }) {
   // 17. POST /dsh-remote-workspace/sync
@@ -7,7 +7,7 @@ export function registerSyncRoutes(sctx, webServer, { mirrorSync, tarSyncService
     path: '/dsh-remote-workspace/sync',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, direction, force, mode } = await readBody(req);
         const profile = (profileId ? store.getProfile(profileId) : null) || store.getActiveProfile();
@@ -28,7 +28,7 @@ export function registerSyncRoutes(sctx, webServer, { mirrorSync, tarSyncService
           : await mirrorSync.pull(profile, profile.remoteWorkspace, profile.localMirrorPath);
         writeJson(res, 200, { ok: resSync.success, ...resSync });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /sync');
@@ -39,13 +39,13 @@ export function registerSyncRoutes(sctx, webServer, { mirrorSync, tarSyncService
     path: '/dsh-remote-workspace/watcher/toggle',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { enabled } = await readBody(req);
         await store.setAutoSyncEnabled(Boolean(enabled));
         writeJson(res, 200, { ok: true, autoSync: store.isAutoSyncEnabled() });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /watcher/toggle');

package/lib/routes/terminal.js

@@ -1,13 +1,32 @@
-import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
+import { normalizeTerminalFont } from '../terminal-font.js';
 
 export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
+
+  sctx.effect(() => webServer.register({
+    kind: 'exact',
+    path: '/dsh-remote-workspace/terminal/font',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+      if (!authorizeRequest(sctx, req, res)) return;
+      try {
+        const body = await readBody(req);
+        const fontFamily = await store.setTerminalFont(body.fontFamily);
+        writeJson(res, 200, { ok: true, terminalFontFamily: fontFamily });
+      } catch (err) {
+        const status = err.code === 'INVALID_FONT' ? 400 : 500;
+        writeJson(res, status, { ok: false, error: err.message });
+      }
+    }
+  }), 'dsh-remote-workspace: /terminal/font');
+
   // 13. POST /dsh-remote-workspace/terminal/create
   sctx.effect(() => webServer.register({
     kind: 'exact',
     path: '/dsh-remote-workspace/terminal/create',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, cols, rows } = await readBody(req);
         const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
@@ -15,7 +34,7 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
         const session = await sshService.createTerminalSession(profile, { cols: cols || 80, rows: rows || 24 });
         writeJson(res, 200, { ok: true, sessionId: session.id });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /terminal/create');
@@ -26,7 +45,7 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
     path: '/dsh-remote-workspace/terminal/input',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { sessionId, data, resize } = await readBody(req);
         const session = sshService.getTerminalSession(sessionId);
@@ -39,7 +58,7 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
         }
         writeJson(res, 200, { ok: true });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /terminal/input');
@@ -50,7 +69,7 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
     path: '/dsh-remote-workspace/terminal/stream',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const url = new URL(req.url, 'http://localhost');
         const sessionId = url.searchParams.get('sessionId');
@@ -80,7 +99,7 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
           session.subscribers.delete(sub);
         });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /terminal/stream');
@@ -91,13 +110,13 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
     path: '/dsh-remote-workspace/terminal/close',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { sessionId } = await readBody(req);
         sshService.closeTerminalSession(sessionId);
         writeJson(res, 200, { ok: true });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /terminal/close');