@lamalibre/portlama-agent 1.0.22 → 1.0.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/portlama-agent",
-  "version": "1.0.22",
+  "version": "1.0.23",
   "description": "Tunnel agent for Portlama — manages Chisel tunnel client as a system service",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/lib/agent-plugins.js

@@ -21,7 +21,7 @@ import { agentDataDir, agentPluginsFile, agentPluginsDir } from './platform.js';
 const RESERVED_NAMES = [
   'health', 'onboarding', 'invite', 'enroll', 'tunnels', 'sites', 'system',
   'services', 'logs', 'users', 'certs', 'invitations', 'plugins', 'tickets',
-  'settings', 'identity', 'storage', 'agents',
+  'settings', 'identity', 'storage', 'agents', 'user-access',
 ];
 
 // --- Promise-chain mutex (serialises registry modifications) ---

package/src/lib/local-plugins.js

@@ -7,7 +7,8 @@ import { localDir, localPluginsFile, localPluginsDir } from './platform.js';
 // Reserved names that cannot be used as plugin names (matches panel-server constants).
 const RESERVED_NAMES = [
   'health', 'onboarding', 'invite', 'enroll', 'tunnels', 'sites', 'system',
-  'services', 'logs', 'users', 'certs', 'invitations', 'plugins', 'tickets', 'settings',
+  'services', 'logs', 'users', 'certs', 'invitations', 'plugins', 'tickets',
+  'settings', 'identity', 'storage', 'agents', 'user-access',
 ];
 
 // --- Promise-chain mutex (serialises registry modifications) ---

package/src/lib/panel-server.js

@@ -67,8 +67,14 @@ export async function startPanelServer(label, { port = 9393 } = {}) {
     // Allow health check without auth
     if (request.url === '/api/health') return;
 
-    // Static assets don't need API-level auth (nginx already verified mTLS)
-    if (!request.url.startsWith('/api')) return;
+    // Plugin bundles are intentionally public (loaded via <script> tag)
+    if (request.url.startsWith('/plugin-bundles/')) return;
+
+    // Auth is required for /api/* routes AND plugin server routes (/<pluginName>/api/...).
+    // Static assets (SPA files) are served by fastify-static and don't need auth.
+    const needsAuth = request.url.startsWith('/api') ||
+      /^\/[a-z0-9-]+\/api\//.test(request.url);
+    if (!needsAuth) return;
 
     const verify = request.headers['x-ssl-client-verify'];
     if (verify !== 'SUCCESS') {