@lamalibre/create-portlama 1.0.21 → 1.0.23

package/LICENSE.md

@@ -98,3 +98,20 @@ The **licensor** is the individual or entity offering these terms, and the **sof
 **Your licenses** are all the licenses granted to you for the software under these terms.
 
 **Use** means anything you do with the software requiring one of your licenses.
+
+---
+
+## Disclaimer
+
+This software is provided "as is", without warranty of any kind, express or implied. The authors and contributors accept no liability for any damages, data loss, security incidents, or legal consequences arising from the use of this software.
+
+Portlama is designed for self-hosted use cases — personal projects, development environments, demos, and internal tools. It is not a substitute for production infrastructure. Production workloads require dedicated hosting, load balancing, redundancy, monitoring, and operational expertise that are beyond the scope of this project.
+
+**You are solely responsible for what you expose through Portlama.** By tunneling an application to the public internet, you grant anyone with access the ability to interact with that application as if they were on your local network. This carries inherent risks:
+
+- **Arbitrary code execution:** If the tunneled application contains vulnerabilities or backdoors, remote attackers may exploit them to execute code on your machine, access your file system, or compromise your operating system.
+- **Data exposure:** Misconfigured or insecure applications may leak sensitive data, credentials, or private files to the internet.
+- **Lateral movement:** A compromised tunneled application may be used as an entry point to attack other devices and services on your local network.
+- **Resource abuse:** Publicly accessible applications may be used for cryptocurrency mining, spam relaying, botnet hosting, or other abuse that could result in legal action against you.
+
+Portlama provides authentication and access control mechanisms, but no security measure is absolute. It is your responsibility to understand the software you expose, keep it updated, and assess the risks of making it publicly accessible. The authors of Portlama bear no responsibility for the consequences of tunneling untrusted, vulnerable, or malicious software.

package/README.md

@@ -43,6 +43,21 @@ configured through the browser-based onboarding wizard after installation.
 See the main repository for architecture, development plan, and full
 documentation: <https://github.com/lamalibre/portlama>
 
+## Disclaimer
+
+This software is provided "as is", without warranty of any kind, express or implied. The authors and contributors accept no liability for any damages, data loss, security incidents, or legal consequences arising from the use of this software.
+
+Portlama is designed for self-hosted use cases — personal projects, development environments, demos, and internal tools. It is not a substitute for production infrastructure. Production workloads require dedicated hosting, load balancing, redundancy, monitoring, and operational expertise that are beyond the scope of this project.
+
+**You are solely responsible for what you expose through Portlama.** By tunneling an application to the public internet, you grant anyone with access the ability to interact with that application as if they were on your local network. This carries inherent risks:
+
+- **Arbitrary code execution:** If the tunneled application contains vulnerabilities or backdoors, remote attackers may exploit them to execute code on your machine, access your file system, or compromise your operating system.
+- **Data exposure:** Misconfigured or insecure applications may leak sensitive data, credentials, or private files to the internet.
+- **Lateral movement:** A compromised tunneled application may be used as an entry point to attack other devices and services on your local network.
+- **Resource abuse:** Publicly accessible applications may be used for cryptocurrency mining, spam relaying, botnet hosting, or other abuse that could result in legal action against you.
+
+Portlama provides authentication and access control mechanisms, but no security measure is absolute. It is your responsibility to understand the software you expose, keep it updated, and assess the risks of making it publicly accessible. The authors of Portlama bear no responsibility for the consequences of tunneling untrusted, vulnerable, or malicious software.
+
 ## License
 
 [Polyform Noncommercial 1.0.0](./LICENSE.md) — see [LICENSE.md](./LICENSE.md) for details.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/create-portlama",
-  "version": "1.0.21",
+  "version": "1.0.23",
   "description": "One-command setup for secure reverse tunnels with a management dashboard",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE.md",

package/vendor/panel-server/src/lib/invite-page.js

@@ -224,14 +224,39 @@ function generateInvitePageHtml() {
       function showSuccess(result) {
         app.className = 'card success-card';
         var loginBtn = result.loginUrl
-          ? '<a href="' + escapeHtml(result.loginUrl) + '" class="btn" style="text-decoration:none;text-align:center;display:block">Go to Login</a>'
+          ? '<a href="' + escapeHtml(result.loginUrl) + '" class="btn" style="text-decoration:none;text-align:center;display:block;margin-top:1rem">Go to Login</a>'
           : '';
-        app.innerHTML =
-          '<div class="icon">\\u2705</div>' +
-          '<h1>Account Created</h1>' +
-          '<p>Your account <strong style="color:#22d3ee">' + escapeHtml(result.username) + '</strong> has been created successfully.</p>' +
-          '<p>On your first login, you will be asked to set up two-factor authentication (TOTP) using an authenticator app.</p>' +
-          loginBtn;
+
+        if (result.totpUri) {
+          app.innerHTML =
+            '<div class="icon">\\u2705</div>' +
+            '<h1>Account Created</h1>' +
+            '<p>Your account <strong style="color:#22d3ee">' + escapeHtml(result.username) + '</strong> has been created.</p>' +
+            '<p style="margin-bottom:1.5rem">Scan this QR code with your authenticator app (Google Authenticator, Authy, etc.) to set up two-factor authentication.</p>' +
+            '<div id="qr-container" style="display:flex;justify-content:center;margin-bottom:1.5rem;background:#fff;border-radius:0.5rem;padding:1rem;max-width:220px;margin-left:auto;margin-right:auto"></div>' +
+            '<p style="font-size:0.75rem;color:#52525b;margin-bottom:1rem;word-break:break-all"><strong style="color:#a1a1aa">Manual entry:</strong> ' + escapeHtml(result.totpUri.match(/secret=([^&]+)/)?.[1] || '') + '</p>' +
+            '<div class="error-msg" style="background:#0f1c1c;border-color:#134e4a;color:#5eead4;text-align:center">\\u26A0\\uFE0F Save this before navigating away — it cannot be shown again.</div>' +
+            loginBtn;
+
+          // Load QR code library and render
+          var script = document.createElement('script');
+          script.src = 'https://cdn.jsdelivr.net/npm/qrcode-generator@1.4.4/qrcode.min.js';
+          script.onload = function() {
+            var qr = qrcode(0, 'M');
+            qr.addData(result.totpUri);
+            qr.make();
+            var container = document.getElementById('qr-container');
+            if (container) container.innerHTML = qr.createSvgTag(4, 0);
+          };
+          document.head.appendChild(script);
+        } else {
+          app.innerHTML =
+            '<div class="icon">\\u2705</div>' +
+            '<h1>Account Created</h1>' +
+            '<p>Your account <strong style="color:#22d3ee">' + escapeHtml(result.username) + '</strong> has been created successfully.</p>' +
+            '<p>Contact your administrator to set up two-factor authentication.</p>' +
+            loginBtn;
+        }
       }
 
       function escapeHtml(str) {

package/vendor/panel-server/src/routes/invite.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { readInvitations, writeInvitations } from '../lib/state.js';
-import { createUserFromInvitation, hashPassword, readUsersRaw } from '../lib/authelia.js';
+import { createUserFromInvitation, hashPassword, readUsersRaw, generateTotpSecret, writeTotpToDatabase } from '../lib/authelia.js';
 import { getConfig } from '../lib/config.js';
 
 const AcceptInvitationSchema = z.object({
@@ -101,6 +101,17 @@ export default async function inviteRoutes(fastify, _opts) {
       return reply.code(500).send({ error: 'Failed to create user account' });
     }
 
+    // Generate TOTP so the user can scan the QR code immediately
+    let totpUri = null;
+    try {
+      const { secret, uri } = generateTotpSecret(invitation.username);
+      await writeTotpToDatabase(invitation.username, secret);
+      totpUri = uri;
+    } catch (err) {
+      request.log.error(err, 'Failed to generate TOTP for invited user');
+      // Non-fatal: user was created, they can have admin reset TOTP later
+    }
+
     // Mark invitation as used
     invitation.used = true;
     invitation.acceptedAt = new Date().toISOString();
@@ -118,6 +129,7 @@ export default async function inviteRoutes(fastify, _opts) {
       ok: true,
       username: invitation.username,
       loginUrl,
+      totpUri,
     };
   });
 }