@moontra/moonui-pro 2.32.34 → 2.32.36

package/dist/index.mjs

@@ -100,27 +100,82 @@ var init_cli_token_reader = __esm({
         return this.instance;
       }
       /**
-       * Generate secure device fingerprint using hybrid approach
-       * Format: platform-hostname-username_hash-browser_machine_id
+       * Get real external IP address using WebRTC (browser-native method)
+       * This ensures browser and CLI use the same IP perspective
+       */
+      async getRealExternalIP() {
+        try {
+          const ip = await this.getWebRTCIP();
+          if (ip && ip !== "unknown") {
+            return ip;
+          }
+          if (typeof window !== "undefined") {
+            const currentHost = window.location.hostname;
+            if (currentHost !== "localhost" && currentHost !== "127.0.0.1") {
+              return currentHost;
+            }
+          }
+          return "192.168.1.2";
+        } catch (error) {
+          console.warn("[MoonUI Pro] External IP detection failed, using fallback");
+          return "192.168.1.2";
+        }
+      }
+      /**
+       * Get local IP address using WebRTC (no external service needed)
+       */
+      async getWebRTCIP() {
+        return new Promise((resolve) => {
+          try {
+            const pc = new RTCPeerConnection({
+              iceServers: [{ urls: "stun:stun.l.google.com:19302" }]
+            });
+            pc.createDataChannel("ip-detection");
+            pc.onicecandidate = (event) => {
+              if (event.candidate) {
+                const candidate = event.candidate.candidate;
+                const ipMatch = candidate.match(/(\d+\.\d+\.\d+\.\d+)/);
+                if (ipMatch && ipMatch[1]) {
+                  const ip = ipMatch[1];
+                  if (!ip.startsWith("127.") && !ip.startsWith("0.")) {
+                    pc.close();
+                    resolve(ip);
+                    return;
+                  }
+                }
+              }
+            };
+            pc.createOffer().then((offer) => pc.setLocalDescription(offer)).catch(() => resolve("unknown"));
+            setTimeout(() => {
+              pc.close();
+              resolve("unknown");
+            }, 3e3);
+          } catch (error) {
+            resolve("unknown");
+          }
+        });
+      }
+      /**
+       * Generate TRULY secure browser-specific device fingerprint
+       * COMPLETELY INDEPENDENT from environment variables
+       * Format: browser-hostname-browser_user_hash-machine_hash
        *
-       * SECURITY: Even if .env.local is copied, browser machine ID will be different
+       * SECURITY: Environment copying CANNOT bypass this!
        */
       async getDeviceFingerprint() {
         try {
           const platform2 = this.detectBrowserPlatform();
-          const hostname = process.env.NEXT_PUBLIC_MOONUI_HOSTNAME || "localhost";
-          const username = process.env.NEXT_PUBLIC_MOONUI_USERNAME || "dev-user";
-          const usernameHash = await this.sha256Hash(username);
+          const hostname = await this.getRealExternalIP();
+          const browserUserHash = await this.generateBrowserSpecificUserHash();
           const browserMachineId = await this.generateBrowserMachineId();
-          const fingerprint = `${platform2}-${hostname}-${usernameHash}-${browserMachineId}`;
-          console.log("[MoonUI Pro] Secure browser device fingerprint generated:", {
+          const fingerprint = `browser-${hostname}-${browserUserHash}-${browserMachineId}`;
+          console.log("[MoonUI Pro] Environment-independent browser fingerprint generated:", {
             platform: platform2,
             hostname,
-            username: username.substring(0, 3) + "***",
-            usernameHash,
+            browserUserHash: browserUserHash.substring(0, 4) + "***",
             browserMachineId: browserMachineId.substring(0, 4) + "***",
-            fingerprint: fingerprint.substring(0, 25) + "***",
-            security: "browser-machine-locked"
+            fingerprint: fingerprint.substring(0, 30) + "***",
+            security: "environment-independent"
           });
           return fingerprint;
         } catch (error) {
@@ -128,6 +183,40 @@ var init_cli_token_reader = __esm({
           return "browser-fallback-device";
         }
       }
+      /**
+       * Generate browser-specific user hash independent of environment
+       * Uses browser characteristics to create unique user identifier
+       */
+      async generateBrowserSpecificUserHash() {
+        try {
+          const characteristics = [
+            // Browser identity
+            navigator.userAgent,
+            navigator.language,
+            navigator.languages?.join(",") || "",
+            // System characteristics
+            `${screen.width}x${screen.height}x${screen.colorDepth}`,
+            `${window.devicePixelRatio || 1}`,
+            // Hardware info
+            `${navigator.hardwareConcurrency || 0}`,
+            `${navigator.maxTouchPoints || 0}`,
+            // Timezone and locale
+            Intl.DateTimeFormat().resolvedOptions().timeZone,
+            Intl.DateTimeFormat().resolvedOptions().locale,
+            // Browser capabilities
+            typeof window.WebGL2RenderingContext !== "undefined" ? "webgl2" : "webgl1",
+            typeof window.AudioContext !== "undefined" ? "audio" : "no-audio",
+            typeof navigator.serviceWorker !== "undefined" ? "sw" : "no-sw"
+          ];
+          const combined = characteristics.join("|");
+          const hash = await this.sha256Hash(combined);
+          return hash.substring(0, 8);
+        } catch (error) {
+          console.warn("[MoonUI Pro] Browser user hash generation failed, using fallback");
+          const fallback = `${navigator.userAgent.length}-${screen.width}-${Date.now() % 1e4}`;
+          return this.fallbackHash(fallback);
+        }
+      }
       /**
        * Detect platform in browser environment (CLI compatible)
        */
@@ -323,9 +412,9 @@ var init_cli_token_reader = __esm({
         }
       }
       /**
-       * Validate token with backend API
+       * Validate token with backend API using strict dual device validation
        */
-      async validateWithAPI(token, deviceId) {
+      async validateWithAPI(token, tokenDeviceId, browserDeviceId) {
         try {
           const response = await fetch("https://moonui.dev/api/cli/validate-session", {
             method: "POST",
@@ -334,8 +423,13 @@ var init_cli_token_reader = __esm({
               "Content-Type": "application/json"
             },
             body: JSON.stringify({
-              deviceId,
-              timestamp: Date.now()
+              deviceId: tokenDeviceId,
+              // CLI device ID from token
+              browserDeviceId,
+              // Current browser device ID
+              timestamp: Date.now(),
+              validationType: "hybrid-strict"
+              // New validation type
             })
           });
           if (!response.ok) {
@@ -391,7 +485,7 @@ var init_cli_token_reader = __esm({
           }
           console.log("[MoonUI Pro] Device compatibility validated successfully");
         }
-        const isValid2 = await this.validateWithAPI(tokenData.token, tokenDeviceId || currentDeviceId);
+        const isValid2 = await this.validateWithAPI(tokenData.token, tokenDeviceId, currentDeviceId);
         if (!isValid2) {
           console.error("[MoonUI Pro] Device session validation failed");
           console.log("[MoonUI Pro] This may happen if:");
@@ -399,6 +493,8 @@ var init_cli_token_reader = __esm({
           console.log("  \u2022 Device limit exceeded");
           console.log("  \u2022 Session expired");
           console.log("  \u2022 Device was revoked from dashboard");
+          console.log("  \u2022 Token was copied from another device (strict security)");
+          console.log("  \u2022 Browser fingerprint doesn't match session");
           console.log('  \u2022 Run "moonui login" to create a new session');
           return null;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@moontra/moonui-pro",
-    "version": "2.32.34",
+    "version": "2.32.36",
     "description": "Premium React components for MoonUI - Advanced UI library with 50+ pro components including performance, interactive, and gesture components",
     "type": "module",
     "main": "dist/index.mjs",