@naviyra/cloud-panel 0.0.2 → 0.0.3-beta2

package/apps/panel/app/api/[...path]/route.js

@@ -3,6 +3,7 @@ import { randomUUID } from "node:crypto";
 import { cookies } from "next/headers";
 import { db } from "../../../lib/db.mjs";
 import { session, signIn } from "../../../lib/auth.mjs";
+import { originAllowed } from "../../../lib/request-origin.mjs";
 import { agent, reconcile } from "../../../lib/agent.mjs";
 import { projectInput, idSchema, MAX_ZIP_BYTES } from "@naviyra/shared";
 import {
@@ -31,7 +32,7 @@ async function handle(req, { params }) {
     const method = req.method;
     if (method !== "GET") {
       const expected = process.env.PUBLIC_ORIGIN || new URL(req.url).origin;
-      if (req.headers.get("origin") !== expected)
+      if (!originAllowed(req.headers.get("origin"), expected))
         return json({ error: "Invalid request origin" }, 403);
     }
     if (route === "auth/login" && method === "POST") {

package/apps/panel/app/globals.css

@@ -1710,26 +1710,73 @@ html[data-theme="dark"] .danger-text {
   margin-bottom: 10px;
 }
 .database-create {
-  display: flex;
-  flex-wrap: wrap;
-  align-items: flex-end;
+  display: grid;
+  grid-template-columns: minmax(240px, 340px) minmax(220px, 1fr) auto;
+  align-items: end;
   gap: 12px 16px;
   padding: 18px 23px 20px;
 }
 .database-create label {
-  flex: 1 1 220px;
-  max-width: 460px;
   margin-bottom: 0;
+  min-width: 0;
 }
 .database-create small {
   margin-top: 4px;
+  line-height: 1.45;
 }
-.database-create input {
+.database-create input,
+.database-create select {
   height: 40px;
   margin-top: 8px;
+  box-sizing: border-box;
+}
+.database-create select {
+  display: block;
+  width: 100%;
+  padding: 0 36px 0 12px;
+  border: 1px solid #dde4e7;
+  border-radius: 6px;
+  background-color: var(--surface);
+  color: #3e5360;
+  font-size: 12px;
+  appearance: none;
+  background-image:
+    linear-gradient(45deg, transparent 50%, var(--muted) 50%),
+    linear-gradient(135deg, var(--muted) 50%, transparent 50%);
+  background-position:
+    calc(100% - 18px) center,
+    calc(100% - 13px) center;
+  background-size:
+    5px 5px,
+    5px 5px;
+  background-repeat: no-repeat;
 }
 .database-create .primary {
   height: 40px;
+  min-height: 40px;
+}
+html[data-theme="dark"] .database-create select {
+  background-color: var(--surface);
+  color: var(--ink);
+  border-color: var(--line);
+  background-image:
+    linear-gradient(45deg, transparent 50%, var(--muted) 50%),
+    linear-gradient(135deg, var(--muted) 50%, transparent 50%);
+  background-position:
+    calc(100% - 18px) center,
+    calc(100% - 13px) center;
+  background-size:
+    5px 5px,
+    5px 5px;
+  background-repeat: no-repeat;
+}
+@media (max-width: 720px) {
+  .database-create {
+    grid-template-columns: 1fr;
+  }
+  .database-create .primary {
+    justify-self: start;
+  }
 }
 .mail-address {
   display: flex;

package/apps/panel/lib/request-origin.mjs

@@ -0,0 +1,29 @@
+const LOOPBACK = new Set(["localhost", "127.0.0.1", "::1"]);
+
+function parseOrigin(value) {
+  if (!value || typeof value !== "string") return null;
+  try {
+    const url = new URL(value);
+    if (url.origin === "null") return null;
+    return url;
+  } catch {
+    return null;
+  }
+}
+
+function hostname(url) {
+  return url.hostname.replace(/^\[|\]$/g, "");
+}
+
+function sameSite(left, right) {
+  if (left.origin === right.origin) return true;
+  if (left.protocol !== right.protocol || left.port !== right.port) return false;
+  return LOOPBACK.has(hostname(left)) && LOOPBACK.has(hostname(right));
+}
+
+export function originAllowed(originHeader, expected) {
+  const origin = parseOrigin(originHeader);
+  const target = parseOrigin(expected);
+  if (!origin || !target) return false;
+  return sameSite(origin, target);
+}

package/bin/naviyra.mjs

@@ -189,6 +189,11 @@ See docs/managed-runtime.md in the installed folder.`);
   // created pg already while leaving Next.js or the agent dependencies missing.
   console.log("Checking and installing dependencies…");
   await run("npm", ["install", "--omit=dev"], target);
+  const controlPath = path.join(source, "scripts", "panel-control.mjs");
+  if (await exists(controlPath)) {
+    const { linkBin } = await import(pathToFileURL(controlPath).href);
+    await linkBin(target);
+  }
   await run(process.execPath, ["scripts/setup-local.mjs"], target);
   const background = await enableBackground(target);
   if (background) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naviyra/cloud-panel",
-  "version": "0.0.2",
+  "version": "0.0.3-beta2",
   "description": "Self-hosted Naviyra panel for projects, databases, DNS, and email routing.",
   "type": "module",
   "bin": {
@@ -21,7 +21,8 @@
     "README.md"
   ],
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "tag": "beta"
   },
   "workspaces": [
     "apps/*",

package/scripts/panel-control.mjs

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { access, readFile, rm } from "node:fs/promises";
+import { access, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
 import {
   TASK_NAME,
@@ -137,6 +137,24 @@ async function readStatus(dir, taskState) {
   };
 }
 
+export async function linkBin(root) {
+  const binDir = path.join(root, "node_modules", ".bin");
+  await mkdir(binDir, { recursive: true });
+  await writeFile(
+    path.join(binDir, "cloud-panel.cmd"),
+    '@ECHO off\r\nnode "%~dp0\\..\\..\\bin\\naviyra.mjs" %*\r\n',
+  );
+  await writeFile(
+    path.join(binDir, "cloud-panel.ps1"),
+    [
+      "$node = (Get-Command node -ErrorAction Stop).Source",
+      '& $node (Join-Path $PSScriptRoot "..\\..\\bin\\naviyra.mjs") @args',
+      "exit $LASTEXITCODE",
+      "",
+    ].join("\n"),
+  );
+}
+
 export async function execute(command, options = {}) {
   const located = await locate(options);
   if (command === "status") {
@@ -186,6 +204,7 @@ export async function execute(command, options = {}) {
       throw Error("Run npx @naviyra/cloud-panel update so the newest package can replace this install.");
     await options.copy(options.source, root);
     await options.install(root);
+    await linkBin(root);
     const started = await startBootTask(run);
     if (!started.ok) throw Error(started.message || "Update copied, but Naviyra did not start.");
     console.log(`Updated Naviyra in ${root}. Check it with: npx @naviyra/cloud-panel status`);