@pixelbyte-software/pixcode 1.51.3 → 1.51.5

package/server/middleware/auth.js

@@ -4,8 +4,10 @@ import { userDb, appConfigDb, apiKeysDb } from '../database/db.js';
 import { IS_PLATFORM } from '../constants/config.js';
 
 // Use env var if set, otherwise auto-generate a unique secret per installation
-const JWT_SECRET = process.env.JWT_SECRET || appConfigDb.getOrCreateJwtSecret();
-const isPixcodeApiKey = (token) => typeof token === 'string' && (token.startsWith('px_') || token.startsWith('ck_'));
+const JWT_SECRET = process.env.JWT_SECRET || appConfigDb.getOrCreateJwtSecret();
+const isPixcodeApiKey = (token) => typeof token === 'string' && (token.startsWith('px_') || token.startsWith('ck_'));
+const ADMIN_ROLES = new Set(['owner', 'admin']);
+const PLATFORM_AUTH_BYPASS_ENABLED = IS_PLATFORM && process.env.PIXCODE_ALLOW_PLATFORM_AUTH_BYPASS === '1';
 
 // Optional API key middleware
 const validateApiKey = (req, res, next) => {
@@ -22,9 +24,9 @@ const validateApiKey = (req, res, next) => {
 };
 
 // JWT authentication middleware
-const authenticateToken = async (req, res, next) => {
+const authenticateToken = async (req, res, next) => {
   // Platform mode:  use single database user
-  if (IS_PLATFORM) {
+  if (PLATFORM_AUTH_BYPASS_ENABLED) {
     try {
       const user = userDb.getFirstUser();
       if (!user) {
@@ -101,15 +103,50 @@ const authenticateToken = async (req, res, next) => {
     console.error('Token verification error:', error);
     return res.status(403).json({ error: 'Invalid token' });
   }
-};
+};
+
+const requireAdmin = (req, res, next) => {
+  if (!req.user) {
+    return res.status(401).json({ error: 'Access denied. No authenticated user.' });
+  }
+
+  if (!ADMIN_ROLES.has(req.user.role)) {
+    return res.status(403).json({ error: 'Admin access required.' });
+  }
+
+  if (
+    req.user.api_key_id &&
+    !req.user.api_key_scopes?.includes('admin') &&
+    !req.user.api_key_scopes?.includes('system') &&
+    !req.user.api_key_scopes?.includes('*')
+  ) {
+    return res.status(403).json({ error: 'API key lacks admin scope.' });
+  }
+
+  next();
+};
+
+const requireApiScope = (scope) => (req, res, next) => {
+  if (!req.user?.api_key_id) {
+    return next();
+  }
+
+  const scopes = Array.isArray(req.user.api_key_scopes) ? req.user.api_key_scopes : [];
+  if (scopes.includes('*') || scopes.includes(scope)) {
+    return next();
+  }
+
+  return res.status(403).json({ error: `API key lacks required scope: ${scope}` });
+};
 
 // Generate JWT token
 const generateToken = (user) => {
   return jwt.sign(
     {
-      userId: user.id,
-      username: user.username
-    },
+      userId: user.id,
+      username: user.username,
+      role: user.role || null,
+    },
     JWT_SECRET,
     { expiresIn: '7d' }
   );
@@ -118,12 +155,12 @@ const generateToken = (user) => {
 // WebSocket authentication function
 const authenticateWebSocket = (token) => {
   // Platform mode: bypass token validation, return first user
-  if (IS_PLATFORM) {
+  if (PLATFORM_AUTH_BYPASS_ENABLED) {
     try {
-      const user = userDb.getFirstUser();
-      if (user) {
-        return { id: user.id, userId: user.id, username: user.username };
-      }
+      const user = userDb.getFirstUser();
+      if (user) {
+        return { id: user.id, userId: user.id, username: user.username, role: user.role || null };
+      }
       return null;
     } catch (error) {
       console.error('Platform mode WebSocket error:', error);
@@ -143,9 +180,9 @@ const authenticateWebSocket = (token) => {
 
   if (isPixcodeApiKey(token)) {
     try {
-      const user = apiKeysDb.validateApiKey(token);
-      if (!user) return null;
-      return { userId: user.id, username: user.username };
+      const user = apiKeysDb.validateApiKey(token);
+      if (!user) return null;
+      return { id: user.id, userId: user.id, username: user.username, role: user.role || null };
     } catch (error) {
       console.error('WebSocket API key validation error:', error);
       return null;
@@ -159,7 +196,7 @@ const authenticateWebSocket = (token) => {
     if (!user) {
       return null;
     }
-    return { userId: user.id, username: user.username };
+    return { id: user.id, userId: user.id, username: user.username, role: user.role || null };
   } catch (error) {
     console.error('WebSocket token verification error:', error);
     return null;
@@ -167,9 +204,11 @@ const authenticateWebSocket = (token) => {
 };
 
 export {
-  validateApiKey,
-  authenticateToken,
-  generateToken,
+  validateApiKey,
+  authenticateToken,
+  requireAdmin,
+  requireApiScope,
+  generateToken,
   authenticateWebSocket,
   JWT_SECRET
 };

package/server/modules/providers/provider.routes.ts

@@ -1,5 +1,5 @@
 /* eslint-disable import-x/order */
-import express, { type Request, type Response } from 'express';
+import express, { type NextFunction, type Request, type Response } from 'express';
 
 import { providerAuthService } from '@/modules/providers/services/provider-auth.service.js';
 import { providerMcpService } from '@/modules/providers/services/mcp.service.js';
@@ -101,7 +101,28 @@ const PROVIDER_MANUAL_INSTALL: Partial<Record<LLMProvider, {
   },
 };
 
-const router = express.Router();
+const router = express.Router();
+const ADMIN_ROLES = new Set(['owner', 'admin']);
+
+function requireProviderAdmin(req: Request, res: Response, next: NextFunction) {
+  const user = (req as Request & { user?: { role?: string; api_key_id?: number; api_key_scopes?: string[] } }).user;
+  if (!user || !ADMIN_ROLES.has(user.role || '')) {
+    res.status(403).json({ error: 'Admin access required.' });
+    return;
+  }
+
+  if (
+    user.api_key_id &&
+    !user.api_key_scopes?.includes('admin') &&
+    !user.api_key_scopes?.includes('system') &&
+    !user.api_key_scopes?.includes('*')
+  ) {
+    res.status(403).json({ error: 'API key lacks admin scope.' });
+    return;
+  }
+
+  next();
+}
 
 const readPathParam = (value: unknown, name: string): string => {
   if (typeof value === 'string') {
@@ -260,9 +281,10 @@ router.get(
   }),
 );
 
-router.get(
-  '/:provider/mcp/servers',
-  asyncHandler(async (req: Request, res: Response) => {
+router.get(
+  '/:provider/mcp/servers',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const provider = parseProvider(req.params.provider);
     const workspacePath = readOptionalQueryString(req.query.workspacePath);
     const scope = parseMcpScope(req.query.scope);
@@ -278,9 +300,10 @@ router.get(
   }),
 );
 
-router.post(
-  '/:provider/mcp/servers',
-  asyncHandler(async (req: Request, res: Response) => {
+router.post(
+  '/:provider/mcp/servers',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const provider = parseProvider(req.params.provider);
     const payload = parseMcpUpsertPayload(req.body);
     const server = await providerMcpService.upsertProviderMcpServer(provider, payload);
@@ -288,9 +311,10 @@ router.post(
   }),
 );
 
-router.delete(
-  '/:provider/mcp/servers/:name',
-  asyncHandler(async (req: Request, res: Response) => {
+router.delete(
+  '/:provider/mcp/servers/:name',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const provider = parseProvider(req.params.provider);
     const scope = parseMcpScope(req.query.scope);
     const workspacePath = readOptionalQueryString(req.query.workspacePath);
@@ -308,9 +332,10 @@ router.delete(
  * Summary for every provider (hasKey + baseUrl + updatedAt). Used by the
  * Settings UI to pre-fill the "API Key" tab.
  */
-router.get(
-  '/credentials',
-  asyncHandler(async (_req: Request, res: Response) => {
+router.get(
+  '/credentials',
+  requireProviderAdmin,
+  asyncHandler(async (_req: Request, res: Response) => {
     const summaries = await listProviderCredentialSummaries();
     res.json(createApiSuccessResponse(summaries));
   }),
@@ -322,9 +347,10 @@ router.get(
  * ~/.pixcode/provider-credentials.json and applies them to process.env
  * so the next CLI spawn/SDK call picks them up. Empty apiKey clears.
  */
-router.post(
-  '/:provider/auth/api-key',
-  asyncHandler(async (req: Request, res: Response) => {
+router.post(
+  '/:provider/auth/api-key',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const provider = parseProvider(req.params.provider);
     if (!(provider in PROVIDER_ENV_VARS)) {
       throw new AppError(`Provider "${provider}" does not accept API-key auth.`, {
@@ -357,9 +383,10 @@ router.post(
  * GET to the VPS-side 127.0.0.1:PORT so the CLI's local handler completes
  * the token exchange.
  */
-router.post(
-  '/:provider/oauth-paste',
-  asyncHandler(async (req: Request, res: Response) => {
+router.post(
+  '/:provider/oauth-paste',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     parseProvider(req.params.provider); // validate id but we don't use it further
     const body = (req.body ?? {}) as Record<string, unknown>;
     const raw = typeof body.callbackUrl === 'string' ? body.callbackUrl.trim() : '';
@@ -440,9 +467,10 @@ router.get(
   }),
 );
 
-router.delete(
-  '/:provider/models/cache',
-  asyncHandler(async (req: Request, res: Response) => {
+router.delete(
+  '/:provider/models/cache',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const provider = parseProvider(req.params.provider);
     await clearProviderModelRegistryCache(provider);
     res.json(createApiSuccessResponse({ cleared: true, provider }));
@@ -459,9 +487,10 @@ router.delete(
  * proxies, service-worker reloads, or Vite HMR and short-circuit
  * an in-flight install. The child now outlives the request.
  */
-router.post(
-  '/:provider/install',
-  asyncHandler(async (req: Request, res: Response) => {
+router.post(
+  '/:provider/install',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const parsed = parseProvider(req.params.provider);
     const packageName = PROVIDER_INSTALL_PACKAGES[parsed];
     const installCmd = PROVIDER_INSTALL_COMMANDS[parsed];
@@ -502,9 +531,10 @@ router.post(
  * ?token=... as a fallback auth channel (same pattern the search
  * endpoint uses).
  */
-router.get(
-  '/:provider/install/:jobId/stream',
-  asyncHandler(async (req: Request, res: Response) => {
+router.get(
+  '/:provider/install/:jobId/stream',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const parsed = parseProvider(req.params.provider);
     const jobId = readPathParam(req.params.jobId, 'jobId');
     const job = getInstallJob(jobId);
@@ -582,9 +612,10 @@ router.get(
   }),
 );
 
-router.delete(
-  '/:provider/install/:jobId',
-  asyncHandler(async (req: Request, res: Response) => {
+router.delete(
+  '/:provider/install/:jobId',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const parsed = parseProvider(req.params.provider);
     const jobId = readPathParam(req.params.jobId, 'jobId');
     const job = getInstallJob(jobId);
@@ -599,9 +630,10 @@ router.delete(
   }),
 );
 
-router.post(
-  '/mcp/servers/global',
-  asyncHandler(async (req: Request, res: Response) => {
+router.post(
+  '/mcp/servers/global',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const payload = parseMcpUpsertPayload(req.body);
     if (payload.scope === 'local') {
       throw new AppError('Global MCP add supports only "user" or "project" scopes.', {
@@ -729,9 +761,10 @@ async function buildProviderPluginState(provider: string) {
   };
 }
 
-router.get(
-  '/plugin-state',
-  asyncHandler(async (_req: Request, res: Response) => {
+router.get(
+  '/plugin-state',
+  requireProviderAdmin,
+  asyncHandler(async (_req: Request, res: Response) => {
     const providers = await Promise.all(
       Object.keys(PROVIDER_CONFIG_FILES).map((provider) => buildProviderPluginState(provider)),
     );
@@ -739,17 +772,19 @@ router.get(
   }),
 );
 
-router.get(
-  '/plugin-state/:provider',
-  asyncHandler(async (req: Request, res: Response) => {
+router.get(
+  '/plugin-state/:provider',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const provider = parseProvider(req.params.provider);
     res.json(createApiSuccessResponse(await buildProviderPluginState(provider)));
   }),
 );
 
-router.get(
-  '/:provider/config-files',
-  asyncHandler(async (req: Request, res: Response) => {
+router.get(
+  '/:provider/config-files',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const provider = String(req.params.provider);
     const list = PROVIDER_CONFIG_FILES[provider];
     if (!list) {
@@ -795,9 +830,10 @@ router.get(
   }),
 );
 
-router.get(
-  '/:provider/config-files/:fileId',
-  asyncHandler(async (req: Request, res: Response) => {
+router.get(
+  '/:provider/config-files/:fileId',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const provider = String(req.params.provider);
     const fileId = String(req.params.fileId);
     const { descriptor, absolutePath } = resolveConfigFile(provider, fileId);
@@ -852,9 +888,10 @@ router.get(
   }),
 );
 
-router.put(
-  '/:provider/config-files/:fileId',
-  asyncHandler(async (req: Request, res: Response) => {
+router.put(
+  '/:provider/config-files/:fileId',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const provider = String(req.params.provider);
     const fileId = String(req.params.fileId);
     const { descriptor, absolutePath } = resolveConfigFile(provider, fileId);
@@ -903,9 +940,10 @@ router.put(
   }),
 );
 
-router.post(
-  '/:provider/config-files/:fileId/validate',
-  asyncHandler(async (req: Request, res: Response) => {
+router.post(
+  '/:provider/config-files/:fileId/validate',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const provider = String(req.params.provider);
     const fileId = String(req.params.fileId);
     const { descriptor, absolutePath } = resolveConfigFile(provider, fileId);

package/server/routes/auth.js

@@ -12,7 +12,15 @@ import {
   saveRemoteConnectionConfig,
 } from '../services/remote-connection.js';
 
-const router = express.Router();
+const router = express.Router();
+
+function publicUser(user) {
+  return {
+    id: user.id,
+    username: user.username,
+    role: user.role || 'member',
+  };
+}
 
 // Check auth status and setup requirements
 router.get('/status', async (req, res) => {
@@ -60,19 +68,19 @@ router.post('/register', async (req, res) => {
     // Use a transaction to prevent race conditions
     db.prepare('BEGIN').run();
     try {
-      // Check if users already exist (only allow one user)
-      const hasUsers = userDb.hasUsers();
-      if (hasUsers) {
-        db.prepare('ROLLBACK').run();
-        return res.status(403).json({ error: 'User already exists. This is a single-user system.' });
-      }
+      // Check if users already exist. Additional accounts are created by admins.
+      const hasUsers = userDb.hasUsers();
+      if (hasUsers) {
+        db.prepare('ROLLBACK').run();
+        return res.status(403).json({ error: 'Initial admin already exists. Ask an admin to create another account.' });
+      }
       
       // Hash password
       const saltRounds = 12;
       const passwordHash = await bcrypt.hash(password, saltRounds);
       
       // Create user
-      const user = userDb.createUser(username, passwordHash);
+      const user = userDb.createUser(username, passwordHash, { role: 'admin' });
       
       // Generate token
       const token = generateToken(user);
@@ -83,10 +91,10 @@ router.post('/register', async (req, res) => {
       userDb.updateLastLogin(user.id);
 
       res.json({
-        success: true,
-        user: { id: user.id, username: user.username },
-        token
-      });
+        success: true,
+        user: publicUser(user),
+        token
+      });
     } catch (error) {
       db.prepare('ROLLBACK').run();
       throw error;
@@ -130,11 +138,11 @@ router.post('/login', async (req, res) => {
     // Update last login
     userDb.updateLastLogin(user.id);
     
-    res.json({
-      success: true,
-      user: { id: user.id, username: user.username },
-      token
-    });
+    res.json({
+      success: true,
+      user: publicUser(user),
+      token
+    });
     
   } catch (error) {
     console.error('Login error:', error);

package/server/routes/commands.js

@@ -10,8 +10,9 @@ import {
   getProviderModelRegistryEntry,
   getStaticProviderModels,
 } from '../services/model-registry.js';
-import { parseFrontmatter } from '../utils/frontmatter.js';
-import { findAppRoot, getModuleDir } from '../utils/runtime-paths.js';
+import { parseFrontmatter } from '../utils/frontmatter.js';
+import { findAppRoot, getModuleDir } from '../utils/runtime-paths.js';
+import { isAdminUser, userHasProjectPathAccess } from '../services/platformization.js';
 
 const __dirname = getModuleDir(import.meta.url);
 // This route reads the top-level package.json for the status command, so it needs the real
@@ -421,31 +422,37 @@ Custom commands can be created in:
  * POST /api/commands/list
  * List all available commands from project and user directories
  */
-router.post('/list', async (req, res) => {
-  try {
-    const { projectPath } = req.body;
-    const allCommands = [...builtInCommands];
-
-    // Scan project-level commands (.claude/commands/)
-    if (projectPath) {
-      const projectCommandsDir = path.join(projectPath, '.claude', 'commands');
-      const projectCommands = await scanCommandsDirectory(
-        projectCommandsDir,
-        projectCommandsDir,
+router.post('/list', async (req, res) => {
+  try {
+    const { projectPath } = req.body;
+    const allCommands = [...builtInCommands];
+
+    // Scan project-level commands (.claude/commands/)
+    if (projectPath) {
+      const resolvedProjectPath = path.resolve(projectPath);
+      if (!userHasProjectPathAccess(req.user, { fullPath: resolvedProjectPath, path: resolvedProjectPath, projectPath: resolvedProjectPath }, resolvedProjectPath, 'viewFiles')) {
+        return res.status(403).json({ error: 'Project access denied.' });
+      }
+      const projectCommandsDir = path.join(resolvedProjectPath, '.claude', 'commands');
+      const projectCommands = await scanCommandsDirectory(
+        projectCommandsDir,
+        projectCommandsDir,
         'project'
       );
       allCommands.push(...projectCommands);
     }
 
-    // Scan user-level commands (~/.claude/commands/)
-    const homeDir = os.homedir();
-    const userCommandsDir = path.join(homeDir, '.claude', 'commands');
-    const userCommands = await scanCommandsDirectory(
-      userCommandsDir,
-      userCommandsDir,
-      'user'
-    );
-    allCommands.push(...userCommands);
+    // User-level commands belong to the server OS account; expose them only to admins.
+    if (isAdminUser(req.user)) {
+      const homeDir = os.homedir();
+      const userCommandsDir = path.join(homeDir, '.claude', 'commands');
+      const userCommands = await scanCommandsDirectory(
+        userCommandsDir,
+        userCommandsDir,
+        'user'
+      );
+      allCommands.push(...userCommands);
+    }
 
     // Separate built-in and custom commands
     const customCommands = allCommands.filter(cmd => cmd.namespace !== 'builtin');
@@ -509,20 +516,24 @@ router.post('/execute', async (req, res) => {
       });
     }
 
-    // Load command content
-    // Security: validate commandPath is within allowed directories
-    {
-      const resolvedPath = path.resolve(commandPath);
-      const userBase = path.resolve(path.join(os.homedir(), '.claude', 'commands'));
-      const projectBase = context?.projectPath
-        ? path.resolve(path.join(context.projectPath, '.claude', 'commands'))
-        : null;
+    // Load command content
+    // Security: validate commandPath is within allowed directories
+    {
+      const resolvedPath = path.resolve(commandPath);
+      const userBase = path.resolve(path.join(os.homedir(), '.claude', 'commands'));
+      const contextProjectPath = typeof context?.projectPath === 'string' ? path.resolve(context.projectPath) : null;
+      if (contextProjectPath && !userHasProjectPathAccess(req.user, { fullPath: contextProjectPath, path: contextProjectPath, projectPath: contextProjectPath }, resolvedPath, 'viewFiles')) {
+        return res.status(403).json({ error: 'Project access denied.' });
+      }
+      const projectBase = contextProjectPath
+        ? path.resolve(path.join(contextProjectPath, '.claude', 'commands'))
+        : null;
       const isUnder = (base) => {
         const rel = path.relative(base, resolvedPath);
         return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel);
       };
-      if (!(isUnder(userBase) || (projectBase && isUnder(projectBase)))) {
-        return res.status(403).json({
+      if (!((isAdminUser(req.user) && isUnder(userBase)) || (projectBase && isUnder(projectBase)))) {
+        return res.status(403).json({
           error: 'Access denied',
           message: 'Command must be in .claude/commands directory'
         });

package/server/routes/git.js

@@ -4,16 +4,17 @@ import { promises as fs } from 'fs';
 
 import express from 'express';
 
-import { extractProjectDirectory } from '../projects.js';
-import { queryClaudeSDK } from '../claude-sdk.js';
-import { spawnCursor } from '../cursor-cli.js';
+import { extractProjectDirectory } from '../projects.js';
+import { queryClaudeSDK } from '../claude-sdk.js';
+import { spawnCursor } from '../cursor-cli.js';
+import { userHasProjectAccess } from '../services/platformization.js';
 
-const router = express.Router();
+const router = express.Router();
 const COMMIT_DIFF_CHARACTER_LIMIT = 500_000;
 const FILESYSTEM_SCAN_MAX_FILES = 5_000;
 const FILESYSTEM_SCAN_MAX_DEPTH = 10;
-const filesystemChangeSnapshots = new Map();
-const FILESYSTEM_SCAN_EXCLUDED_DIRS = new Set([
+const filesystemChangeSnapshots = new Map();
+const FILESYSTEM_SCAN_EXCLUDED_DIRS = new Set([
   '.git',
   '.hg',
   '.svn',
@@ -28,9 +29,23 @@ const FILESYSTEM_SCAN_EXCLUDED_DIRS = new Set([
   '.turbo',
   '.cache',
   '.pixcode-dev',
-]);
-
-function isNotGitRepositoryMessage(message = '') {
+]);
+
+router.use((req, res, next) => {
+  const project = req.query.project || req.body?.project;
+  if (!project) {
+    return next();
+  }
+
+  const capability = req.method === 'GET' ? 'viewFiles' : 'editFiles';
+  if (!userHasProjectAccess(req.user, { name: String(project), projectName: String(project) }, capability)) {
+    return res.status(403).json({ error: 'Project access denied.' });
+  }
+
+  next();
+});
+
+function isNotGitRepositoryMessage(message = '') {
   return message.includes('Not a git repository')
     || message.includes('not a git repository')
     || message.includes('Project directory is not a git repository');