@manny-est/node-red-flowpilot 0.4.0 → 0.4.1

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to FlowPilot are documented here.
 
+## [0.4.1] - 2026-06-29
+
+### Fixed
+- **Critical**: the editor hung at "Loading plugins" on any Node-RED instance with `adminAuth` enabled, due to a 401 on `/flowpilot/core.js`. 0.4.0's pop-out refactor moved FlowPilot's frontend into a separately-served script, but the route serving it (along with `core.css` and the pop-out's `view.html`) was gated behind `RED.auth.needsPermission(...)` — a check that requires an `Authorization` header, which a plain `<script src>`/`<link>`/`window.open` request can never carry. These three static client-asset routes are no longer gated (they contain no secrets); every data/action route is unaffected and still requires authentication exactly as before.
+- **Critical**, found while verifying the fix above: every settings/chat/generate/document/modify/build request (anything going through the shared `ajaxJson` helper) also failed with "Unauthorized" on `adminAuth` instances, for the same root cause — these requests use an absolute URL (needed for the pop-out to resolve correctly), and Node-RED's editor only auto-attaches the admin auth token to relative URLs. The SSE-streaming `fetch()` calls already worked around this (`fetchHeaders()`); `ajaxJson` now attaches the same bearer token itself.
+
 ## [0.4.0] - 2026-06-27
 
 ### Added

package/flowpilot-core.js

@@ -1273,11 +1273,16 @@
     // Note: no leading slash. Node-RED serves admin endpoints under a base
     // path (httpAdminRoot) that may not be "/". A relative URL respects it.
 
-    // jQuery's $.ajax (used by ajaxJson) gets the admin-API auth token
-    // attached automatically by Node-RED's editor via $.ajaxSetup, but raw
-    // fetch() calls (used for SSE streaming below) do not. On instances with
-    // adminAuth enabled, an unauthenticated fetch() gets a 401 even though
-    // ajaxJson() calls (preflight, models, settings) succeed.
+    // Node-RED's editor auto-attaches the admin-API auth token to $.ajax
+    // calls via a global $.ajaxSetup beforeSend (red.js) — but ONLY for a
+    // bare relative URL ("flowpilot/settings"); it explicitly skips any
+    // URL starting with "/", "http(s):", or ".". flowpilotUrl() below
+    // always returns a leading-slash absolute path (needed so the pop-out's
+    // nested route still resolves correctly), which means neither $.ajax
+    // (ajaxJson, below) nor raw fetch() (SSE streaming) ever got the token
+    // attached automatically — confirmed live as "Unable to load FlowPilot
+    // settings: Unauthorized" on an adminAuth-enabled instance (v0.4.1).
+    // Both attach it themselves instead, via this same lookup.
     function fetchHeaders() {
         var headers = { "Content-Type": "application/json" };
         var tokens = RED.settings.get("auth-tokens");
@@ -1308,6 +1313,12 @@
             method: method,
             contentType: "application/json",
             data: payload ? JSON.stringify(payload) : undefined,
+            beforeSend: function (jqXHR) {
+                var tokens = RED.settings.get("auth-tokens");
+                if (tokens && tokens.access_token) {
+                    jqXHR.setRequestHeader("Authorization", "Bearer " + tokens.access_token);
+                }
+            },
             success: onSuccess,
             error: function (xhr) {
                 var msg = (xhr.responseJSON && xhr.responseJSON.error) ||

package/flowpilot.js

@@ -623,18 +623,30 @@ module.exports = function flowPilotRuntime(RED) {
   // pop-out's own minimal page — mirroring core Node-RED's debug-node
   // pattern (RED.httpAdmin.get("/debug/view/view.html", ...) serving a
   // static lib/debug/view.html that loads the SAME debug-utils.js the
-  // sidebar uses). Gated the same as every other FlowPilot route, unlike
-  // NR5's own debug view route, which has no permission check at all.
-
-  RED.httpAdmin.get("/flowpilot/core.js", RED.auth.needsPermission("settings.read"), function (req, res) {
+  // sidebar uses).
+  //
+  // INTENTIONALLY UNGATED (fixed in 0.4.1 — was needsPermission("settings.
+  // read") in 0.4.0, which broke the editor on every adminAuth-enabled
+  // instance): these are static client assets, fetched via plain <script
+  // src>/<link>/window.open — none of which can carry the admin auth
+  // bearer token (that only gets attached to FlowPilot's own ajax/fetch
+  // calls, via Node-RED's editor-side request wrapper). needsPermission's
+  // bearer/tokens/anon strategies have no fallback for a request with no
+  // Authorization header, so the gate 401's unconditionally for this kind
+  // of request — confirmed against @node-red/editor-api's auth middleware.
+  // This is the same reason NR5's own debug-view route has no permission
+  // check either. No secrets live in these files; the real data/action
+  // routes (settings, chat, generate, modify, etc. below) stay gated.
+
+  RED.httpAdmin.get("/flowpilot/core.js", function (req, res) {
     res.sendFile(path.join(__dirname, "flowpilot-core.js"));
   });
 
-  RED.httpAdmin.get("/flowpilot/core.css", RED.auth.needsPermission("settings.read"), function (req, res) {
+  RED.httpAdmin.get("/flowpilot/core.css", function (req, res) {
     res.sendFile(path.join(__dirname, "flowpilot-core.css"));
   });
 
-  RED.httpAdmin.get("/flowpilot/popout/view.html", RED.auth.needsPermission("settings.read"), function (req, res) {
+  RED.httpAdmin.get("/flowpilot/popout/view.html", function (req, res) {
     res.sendFile(path.join(__dirname, "lib", "popout", "view.html"));
   });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@manny-est/node-red-flowpilot",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "FlowPilot for Node-RED - an AI-powered development assistant sidebar",
   "main": "flowpilot.js",
   "keywords": [