@lifeaitools/clauth 1.30.7 → 1.30.8

package/cli/commands/serve.js

@@ -3167,13 +3167,28 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
     "Access-Control-Allow-Headers": "Content-Type, Authorization, Mcp-Session-Id, mcp-protocol-version, mcp-session-id",
   };
-  const NO_BROWSER_CORS = {
-    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, Authorization, Mcp-Session-Id, mcp-protocol-version, mcp-session-id",
-  };
-  const studioDebugRuntime = createStudioDebugRuntime({ port, logFile: LOG_FILE });
-
-  // ── MCP SSE session tracking ──────────────────────────────
+  const NO_BROWSER_CORS = {
+    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization, Mcp-Session-Id, mcp-protocol-version, mcp-session-id",
+  };
+  const studioDebugRuntime = createStudioDebugRuntime({ port, logFile: LOG_FILE });
+  const isSupervisorPort = port === getSupervisorPort();
+  const supervisorTestNoToken = process.env.CLAUTH_SUPERVISOR_TEST_NO_TOKEN === "1";
+
+  function hasSupervisorWrite(req) {
+    if (validateWriteToken(req, writeSession)) return true;
+    return isSupervisorPort && supervisorTestNoToken;
+  }
+
+  function rejectSupervisorWrite(res) {
+    res.writeHead(403, { "Content-Type": "application/json", ...CORS });
+    return res.end(JSON.stringify({
+      error: "write_token_required",
+      hint: "Unlock clauth writes, or set CLAUTH_SUPERVISOR_TEST_NO_TOKEN=1 for temporary localhost-only supervisor tests.",
+    }));
+  }
+
+  // ── MCP SSE session tracking ──────────────────────────────
   const sseSessions = new Map(); // sessionId → { res, initialized }
   let sseCounter = 0;
 
@@ -3641,19 +3656,13 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     }
 
     if (method === "POST" && reqPath === "/v1/plugins/rescan") {
-      if (!validateWriteToken(req, writeSession)) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "write_token_required" }));
-      }
+      if (!hasSupervisorWrite(req)) return rejectSupervisorWrite(res);
       return ok(res, discoverPlugins());
     }
 
     const pluginEnableMatch = reqPath.match(/^\/v1\/plugins\/([^/]+)\/(enable|disable|test|promote)$/);
     if (method === "POST" && pluginEnableMatch) {
-      if (!validateWriteToken(req, writeSession)) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "write_token_required" }));
-      }
+      if (!hasSupervisorWrite(req)) return rejectSupervisorWrite(res);
       const pluginId = decodeURIComponent(pluginEnableMatch[1]);
       const op = pluginEnableMatch[2];
       const result = op === "enable"
@@ -3671,10 +3680,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
     const surfaceActionMatch = reqPath.match(/^\/v1\/surfaces\/([^/]+)\/actions$/);
     if (method === "POST" && surfaceActionMatch) {
-      if (!validateWriteToken(req, writeSession)) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "write_token_required" }));
-      }
+      if (!hasSupervisorWrite(req)) return rejectSupervisorWrite(res);
       let body;
       try { body = await readBody(req); } catch {
         res.writeHead(400, { "Content-Type": "application/json", ...CORS });
@@ -3695,10 +3701,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
     const tunnelRoutesMatch = reqPath.match(/^\/v1\/tunnels\/([^/]+)\/routes$/);
     if (method === "POST" && tunnelRoutesMatch) {
-      if (!validateWriteToken(req, writeSession)) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "write_token_required" }));
-      }
+      if (!hasSupervisorWrite(req)) return rejectSupervisorWrite(res);
       let body;
       try { body = await readBody(req); } catch {
         res.writeHead(400, { "Content-Type": "application/json", ...CORS });
@@ -3709,10 +3712,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
     const tunnelRouteDeleteMatch = reqPath.match(/^\/v1\/tunnels\/([^/]+)\/routes\/([^/]+)$/);
     if (method === "DELETE" && tunnelRouteDeleteMatch) {
-      if (!validateWriteToken(req, writeSession)) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "write_token_required" }));
-      }
+      if (!hasSupervisorWrite(req)) return rejectSupervisorWrite(res);
       return ok(res, removeTunnelRoute(decodeURIComponent(tunnelRouteDeleteMatch[1]), decodeURIComponent(tunnelRouteDeleteMatch[2]), "localhost"));
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.30.7",
+  "version": "1.30.8",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {