@http-client-toolkit/dashboard 1.0.1 → 2.0.1

package/lib/index.d.ts

@@ -67,6 +67,7 @@ declare const DashboardOptionsSchema: z.ZodEffects<
       >;
       basePath: z.ZodDefault<z.ZodString>;
       pollIntervalMs: z.ZodDefault<z.ZodNumber>;
+      readonly: z.ZodDefault<z.ZodBoolean>;
     },
     'strip',
     z.ZodTypeAny,
@@ -77,6 +78,7 @@ declare const DashboardOptionsSchema: z.ZodEffects<
       }[];
       basePath: string;
       pollIntervalMs: number;
+      readonly: boolean;
     },
     {
       clients: {
@@ -85,6 +87,7 @@ declare const DashboardOptionsSchema: z.ZodEffects<
       }[];
       basePath?: string | undefined;
       pollIntervalMs?: number | undefined;
+      readonly?: boolean | undefined;
     }
   >,
   {
@@ -94,6 +97,7 @@ declare const DashboardOptionsSchema: z.ZodEffects<
     }[];
     basePath: string;
     pollIntervalMs: number;
+    readonly: boolean;
   },
   {
     clients: {
@@ -102,6 +106,7 @@ declare const DashboardOptionsSchema: z.ZodEffects<
     }[];
     basePath?: string | undefined;
     pollIntervalMs?: number | undefined;
+    readonly?: boolean | undefined;
   }
 >;
 declare const StandaloneDashboardOptionsSchema: z.ZodIntersection<
@@ -139,6 +144,7 @@ declare const StandaloneDashboardOptionsSchema: z.ZodIntersection<
         >;
         basePath: z.ZodDefault<z.ZodString>;
         pollIntervalMs: z.ZodDefault<z.ZodNumber>;
+        readonly: z.ZodDefault<z.ZodBoolean>;
       },
       'strip',
       z.ZodTypeAny,
@@ -149,6 +155,7 @@ declare const StandaloneDashboardOptionsSchema: z.ZodIntersection<
         }[];
         basePath: string;
         pollIntervalMs: number;
+        readonly: boolean;
       },
       {
         clients: {
@@ -157,6 +164,7 @@ declare const StandaloneDashboardOptionsSchema: z.ZodIntersection<
         }[];
         basePath?: string | undefined;
         pollIntervalMs?: number | undefined;
+        readonly?: boolean | undefined;
       }
     >,
     {
@@ -166,6 +174,7 @@ declare const StandaloneDashboardOptionsSchema: z.ZodIntersection<
       }[];
       basePath: string;
       pollIntervalMs: number;
+      readonly: boolean;
     },
     {
       clients: {
@@ -174,6 +183,7 @@ declare const StandaloneDashboardOptionsSchema: z.ZodIntersection<
       }[];
       basePath?: string | undefined;
       pollIntervalMs?: number | undefined;
+      readonly?: boolean | undefined;
     }
   >,
   z.ZodObject<

package/lib/index.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { existsSync, readFileSync } from 'fs';
-import { join, extname, dirname } from 'path';
+import { resolve, join, extname, dirname } from 'path';
 import { fileURLToPath } from 'url';
 import { createServer } from 'http';
 
@@ -377,6 +377,7 @@ var DashboardOptionsSchema = z
       .min(1, 'At least one client is required'),
     basePath: z.string().default('/'),
     pollIntervalMs: z.number().int().positive().default(5e3),
+    readonly: z.boolean().default(false),
   })
   .refine(
     (data) => {
@@ -413,7 +414,11 @@ function parseUrl(req, basePath) {
   const raw = req.url ?? '/';
   const url = new URL(raw, 'http://localhost');
   let pathname = url.pathname;
-  if (basePath !== '/' && pathname.startsWith(basePath)) {
+  if (
+    basePath !== '/' &&
+    pathname.startsWith(basePath) &&
+    (pathname.length === basePath.length || pathname[basePath.length] === '/')
+  ) {
     pathname = pathname.slice(basePath.length) || '/';
   }
   return { pathname, query: url.searchParams };
@@ -431,15 +436,23 @@ function extractParam(pathname, pattern) {
   if (paramIndex === -1) return void 0;
   return pathParts[paramIndex];
 }
+var MAX_BODY_SIZE = 1024 * 1024;
 async function readJsonBody(req) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve3, reject) => {
     let body = '';
+    let size = 0;
     req.on('data', (chunk) => {
+      size += chunk.length;
+      if (size > MAX_BODY_SIZE) {
+        req.destroy();
+        reject(new Error('Request body too large'));
+        return;
+      }
       body += chunk.toString();
     });
     req.on('end', () => {
       try {
-        resolve(JSON.parse(body));
+        resolve3(JSON.parse(body));
       } catch {
         reject(new Error('Invalid JSON body'));
       }
@@ -467,6 +480,9 @@ function sendNotFound(res) {
 function sendMethodNotAllowed(res) {
   sendError(res, 'Method not allowed', 405);
 }
+function sendForbidden(res) {
+  sendError(res, 'Dashboard is in readonly mode', 403);
+}
 
 // src/server/handlers/cache.ts
 async function handleCacheStats(res, adapter) {
@@ -697,7 +713,15 @@ function createApiRouter(ctx) {
         sendError(res, `Unknown client: ${clientName}`, 404);
         return true;
       }
-      return routeClientApi(req, res, client, subPath, method, query);
+      return routeClientApi(
+        req,
+        res,
+        client,
+        subPath,
+        method,
+        query,
+        ctx.readonly,
+      );
     }
     if (pathname.startsWith('/api/')) {
       sendNotFound(res);
@@ -706,7 +730,22 @@ function createApiRouter(ctx) {
     return false;
   };
 }
-async function routeClientApi(req, res, client, subPath, method, query) {
+function isMutatingMethod(method) {
+  return method === 'DELETE' || method === 'PUT' || method === 'POST';
+}
+async function routeClientApi(
+  req,
+  res,
+  client,
+  subPath,
+  method,
+  query,
+  readonly,
+) {
+  if (readonly && isMutatingMethod(method)) {
+    sendForbidden(res);
+    return true;
+  }
   if (subPath.startsWith('/cache')) {
     if (!client.cache) {
       sendError(res, 'Cache store not configured', 404);
@@ -822,7 +861,7 @@ function getCurrentDir() {
 function getClientDir() {
   if (clientDir) return clientDir;
   const currentDir = getCurrentDir();
-  clientDir = join(currentDir, '..', 'dist', 'client');
+  clientDir = resolve(currentDir, '..', 'dist', 'client');
   return clientDir;
 }
 function getIndexHtml() {
@@ -848,7 +887,12 @@ function getIndexHtml() {
 function serveStatic(res, pathname) {
   const dir = getClientDir();
   if (pathname !== '/' && pathname !== '/index.html') {
-    const filePath = join(dir, pathname);
+    const filePath = resolve(join(dir, pathname));
+    if (!filePath.startsWith(dir + '/')) {
+      res.writeHead(400, { 'Content-Type': 'text/plain' });
+      res.end('Bad request');
+      return true;
+    }
     if (existsSync(filePath)) {
       try {
         const content = readFileSync(filePath);
@@ -898,6 +942,7 @@ function createDashboard(options) {
   const ctx = {
     clients,
     pollIntervalMs: opts.pollIntervalMs,
+    readonly: opts.readonly,
   };
   const apiRouter = createApiRouter(ctx);
   return (req, res, _next) => {
@@ -947,7 +992,7 @@ function getCurrentDir2() {
 function getClientDir2() {
   if (clientDir2) return clientDir2;
   const currentDir = getCurrentDir2();
-  clientDir2 = join(currentDir, '..', 'dist', 'client');
+  clientDir2 = resolve(currentDir, '..', 'dist', 'client');
   return clientDir2;
 }
 function getIndexHtml2() {
@@ -973,7 +1018,10 @@ function getIndexHtml2() {
 function serveStaticWeb(pathname) {
   const dir = getClientDir2();
   if (pathname !== '/' && pathname !== '/index.html') {
-    const filePath = join(dir, pathname);
+    const filePath = resolve(join(dir, pathname));
+    if (!filePath.startsWith(dir + '/')) {
+      return new Response('Bad request', { status: 400 });
+    }
     if (existsSync(filePath)) {
       try {
         const content = readFileSync(filePath);
@@ -1046,14 +1094,34 @@ async function routeApi(request, pathname, query, ctx) {
     if (!client) {
       return errorResponse(`Unknown client: ${clientName}`, 404);
     }
-    return routeClientApi2(request, subPath, method, client, query);
+    return routeClientApi2(
+      request,
+      subPath,
+      method,
+      client,
+      query,
+      ctx.readonly,
+    );
   }
   if (pathname.startsWith('/api/')) {
     return errorResponse('Not found', 404);
   }
   return null;
 }
-async function routeClientApi2(request, subPath, method, client, query) {
+function isMutatingMethod2(method) {
+  return method === 'DELETE' || method === 'PUT' || method === 'POST';
+}
+async function routeClientApi2(
+  request,
+  subPath,
+  method,
+  client,
+  query,
+  readonly,
+) {
+  if (readonly && isMutatingMethod2(method)) {
+    return errorResponse('Dashboard is in readonly mode', 403);
+  }
   if (subPath.startsWith('/cache')) {
     if (!client.cache) return errorResponse('Cache store not configured', 404);
     return routeCache(subPath, method, client.cache, query);
@@ -1197,12 +1265,18 @@ function createDashboardHandler(options) {
   const ctx = {
     clients,
     pollIntervalMs: opts.pollIntervalMs,
+    readonly: opts.readonly,
   };
   return async (request) => {
     try {
       const url = new URL(request.url);
       let pathname = url.pathname;
-      if (opts.basePath !== '/' && pathname.startsWith(opts.basePath)) {
+      if (
+        opts.basePath !== '/' &&
+        pathname.startsWith(opts.basePath) &&
+        (pathname.length === opts.basePath.length ||
+          pathname[opts.basePath.length] === '/')
+      ) {
         pathname = pathname.slice(opts.basePath.length) || '/';
       }
       const apiResponse = await routeApi(
@@ -1224,14 +1298,14 @@ async function startDashboard(options) {
   const server = createServer((req, res) => {
     middleware(req, res);
   });
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve3, reject) => {
     server.on('error', reject);
     server.listen(opts.port, opts.host, () => {
       const addr = server.address();
       const url =
         typeof addr === 'string' ? addr : `http://${opts.host}:${opts.port}`;
       console.log(`Dashboard running at ${url}`);
-      resolve({
+      resolve3({
         server,
         async close() {
           return new Promise((res, rej) => {