@pixelbyte-software/pixcode 1.51.4 → 1.51.5

package/server/middleware/auth.js

@@ -7,6 +7,7 @@ import { IS_PLATFORM } from '../constants/config.js';
 const JWT_SECRET = process.env.JWT_SECRET || appConfigDb.getOrCreateJwtSecret();
 const isPixcodeApiKey = (token) => typeof token === 'string' && (token.startsWith('px_') || token.startsWith('ck_'));
 const ADMIN_ROLES = new Set(['owner', 'admin']);
+const PLATFORM_AUTH_BYPASS_ENABLED = IS_PLATFORM && process.env.PIXCODE_ALLOW_PLATFORM_AUTH_BYPASS === '1';
 
 // Optional API key middleware
 const validateApiKey = (req, res, next) => {
@@ -25,7 +26,7 @@ const validateApiKey = (req, res, next) => {
 // JWT authentication middleware
 const authenticateToken = async (req, res, next) => {
   // Platform mode:  use single database user
-  if (IS_PLATFORM) {
+  if (PLATFORM_AUTH_BYPASS_ENABLED) {
     try {
       const user = userDb.getFirstUser();
       if (!user) {
@@ -113,8 +114,30 @@ const requireAdmin = (req, res, next) => {
     return res.status(403).json({ error: 'Admin access required.' });
   }
 
+  if (
+    req.user.api_key_id &&
+    !req.user.api_key_scopes?.includes('admin') &&
+    !req.user.api_key_scopes?.includes('system') &&
+    !req.user.api_key_scopes?.includes('*')
+  ) {
+    return res.status(403).json({ error: 'API key lacks admin scope.' });
+  }
+
   next();
 };
+
+const requireApiScope = (scope) => (req, res, next) => {
+  if (!req.user?.api_key_id) {
+    return next();
+  }
+
+  const scopes = Array.isArray(req.user.api_key_scopes) ? req.user.api_key_scopes : [];
+  if (scopes.includes('*') || scopes.includes(scope)) {
+    return next();
+  }
+
+  return res.status(403).json({ error: `API key lacks required scope: ${scope}` });
+};
 
 // Generate JWT token
 const generateToken = (user) => {
@@ -132,7 +155,7 @@ const generateToken = (user) => {
 // WebSocket authentication function
 const authenticateWebSocket = (token) => {
   // Platform mode: bypass token validation, return first user
-  if (IS_PLATFORM) {
+  if (PLATFORM_AUTH_BYPASS_ENABLED) {
     try {
       const user = userDb.getFirstUser();
       if (user) {
@@ -184,6 +207,7 @@ export {
   validateApiKey,
   authenticateToken,
   requireAdmin,
+  requireApiScope,
   generateToken,
   authenticateWebSocket,
   JWT_SECRET

package/server/modules/providers/provider.routes.ts

@@ -1,5 +1,5 @@
 /* eslint-disable import-x/order */
-import express, { type Request, type Response } from 'express';
+import express, { type NextFunction, type Request, type Response } from 'express';
 
 import { providerAuthService } from '@/modules/providers/services/provider-auth.service.js';
 import { providerMcpService } from '@/modules/providers/services/mcp.service.js';
@@ -101,7 +101,28 @@ const PROVIDER_MANUAL_INSTALL: Partial<Record<LLMProvider, {
   },
 };
 
-const router = express.Router();
+const router = express.Router();
+const ADMIN_ROLES = new Set(['owner', 'admin']);
+
+function requireProviderAdmin(req: Request, res: Response, next: NextFunction) {
+  const user = (req as Request & { user?: { role?: string; api_key_id?: number; api_key_scopes?: string[] } }).user;
+  if (!user || !ADMIN_ROLES.has(user.role || '')) {
+    res.status(403).json({ error: 'Admin access required.' });
+    return;
+  }
+
+  if (
+    user.api_key_id &&
+    !user.api_key_scopes?.includes('admin') &&
+    !user.api_key_scopes?.includes('system') &&
+    !user.api_key_scopes?.includes('*')
+  ) {
+    res.status(403).json({ error: 'API key lacks admin scope.' });
+    return;
+  }
+
+  next();
+}
 
 const readPathParam = (value: unknown, name: string): string => {
   if (typeof value === 'string') {
@@ -260,9 +281,10 @@ router.get(
   }),
 );
 
-router.get(
-  '/:provider/mcp/servers',
-  asyncHandler(async (req: Request, res: Response) => {
+router.get(
+  '/:provider/mcp/servers',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const provider = parseProvider(req.params.provider);
     const workspacePath = readOptionalQueryString(req.query.workspacePath);
     const scope = parseMcpScope(req.query.scope);
@@ -278,9 +300,10 @@ router.get(
   }),
 );
 
-router.post(
-  '/:provider/mcp/servers',
-  asyncHandler(async (req: Request, res: Response) => {
+router.post(
+  '/:provider/mcp/servers',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const provider = parseProvider(req.params.provider);
     const payload = parseMcpUpsertPayload(req.body);
     const server = await providerMcpService.upsertProviderMcpServer(provider, payload);
@@ -288,9 +311,10 @@ router.post(
   }),
 );
 
-router.delete(
-  '/:provider/mcp/servers/:name',
-  asyncHandler(async (req: Request, res: Response) => {
+router.delete(
+  '/:provider/mcp/servers/:name',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const provider = parseProvider(req.params.provider);
     const scope = parseMcpScope(req.query.scope);
     const workspacePath = readOptionalQueryString(req.query.workspacePath);
@@ -308,9 +332,10 @@ router.delete(
  * Summary for every provider (hasKey + baseUrl + updatedAt). Used by the
  * Settings UI to pre-fill the "API Key" tab.
  */
-router.get(
-  '/credentials',
-  asyncHandler(async (_req: Request, res: Response) => {
+router.get(
+  '/credentials',
+  requireProviderAdmin,
+  asyncHandler(async (_req: Request, res: Response) => {
     const summaries = await listProviderCredentialSummaries();
     res.json(createApiSuccessResponse(summaries));
   }),
@@ -322,9 +347,10 @@ router.get(
  * ~/.pixcode/provider-credentials.json and applies them to process.env
  * so the next CLI spawn/SDK call picks them up. Empty apiKey clears.
  */
-router.post(
-  '/:provider/auth/api-key',
-  asyncHandler(async (req: Request, res: Response) => {
+router.post(
+  '/:provider/auth/api-key',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const provider = parseProvider(req.params.provider);
     if (!(provider in PROVIDER_ENV_VARS)) {
       throw new AppError(`Provider "${provider}" does not accept API-key auth.`, {
@@ -357,9 +383,10 @@ router.post(
  * GET to the VPS-side 127.0.0.1:PORT so the CLI's local handler completes
  * the token exchange.
  */
-router.post(
-  '/:provider/oauth-paste',
-  asyncHandler(async (req: Request, res: Response) => {
+router.post(
+  '/:provider/oauth-paste',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     parseProvider(req.params.provider); // validate id but we don't use it further
     const body = (req.body ?? {}) as Record<string, unknown>;
     const raw = typeof body.callbackUrl === 'string' ? body.callbackUrl.trim() : '';
@@ -440,9 +467,10 @@ router.get(
   }),
 );
 
-router.delete(
-  '/:provider/models/cache',
-  asyncHandler(async (req: Request, res: Response) => {
+router.delete(
+  '/:provider/models/cache',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const provider = parseProvider(req.params.provider);
     await clearProviderModelRegistryCache(provider);
     res.json(createApiSuccessResponse({ cleared: true, provider }));
@@ -459,9 +487,10 @@ router.delete(
  * proxies, service-worker reloads, or Vite HMR and short-circuit
  * an in-flight install. The child now outlives the request.
  */
-router.post(
-  '/:provider/install',
-  asyncHandler(async (req: Request, res: Response) => {
+router.post(
+  '/:provider/install',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const parsed = parseProvider(req.params.provider);
     const packageName = PROVIDER_INSTALL_PACKAGES[parsed];
     const installCmd = PROVIDER_INSTALL_COMMANDS[parsed];
@@ -502,9 +531,10 @@ router.post(
  * ?token=... as a fallback auth channel (same pattern the search
  * endpoint uses).
  */
-router.get(
-  '/:provider/install/:jobId/stream',
-  asyncHandler(async (req: Request, res: Response) => {
+router.get(
+  '/:provider/install/:jobId/stream',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const parsed = parseProvider(req.params.provider);
     const jobId = readPathParam(req.params.jobId, 'jobId');
     const job = getInstallJob(jobId);
@@ -582,9 +612,10 @@ router.get(
   }),
 );
 
-router.delete(
-  '/:provider/install/:jobId',
-  asyncHandler(async (req: Request, res: Response) => {
+router.delete(
+  '/:provider/install/:jobId',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const parsed = parseProvider(req.params.provider);
     const jobId = readPathParam(req.params.jobId, 'jobId');
     const job = getInstallJob(jobId);
@@ -599,9 +630,10 @@ router.delete(
   }),
 );
 
-router.post(
-  '/mcp/servers/global',
-  asyncHandler(async (req: Request, res: Response) => {
+router.post(
+  '/mcp/servers/global',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const payload = parseMcpUpsertPayload(req.body);
     if (payload.scope === 'local') {
       throw new AppError('Global MCP add supports only "user" or "project" scopes.', {
@@ -729,9 +761,10 @@ async function buildProviderPluginState(provider: string) {
   };
 }
 
-router.get(
-  '/plugin-state',
-  asyncHandler(async (_req: Request, res: Response) => {
+router.get(
+  '/plugin-state',
+  requireProviderAdmin,
+  asyncHandler(async (_req: Request, res: Response) => {
     const providers = await Promise.all(
       Object.keys(PROVIDER_CONFIG_FILES).map((provider) => buildProviderPluginState(provider)),
     );
@@ -739,17 +772,19 @@ router.get(
   }),
 );
 
-router.get(
-  '/plugin-state/:provider',
-  asyncHandler(async (req: Request, res: Response) => {
+router.get(
+  '/plugin-state/:provider',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const provider = parseProvider(req.params.provider);
     res.json(createApiSuccessResponse(await buildProviderPluginState(provider)));
   }),
 );
 
-router.get(
-  '/:provider/config-files',
-  asyncHandler(async (req: Request, res: Response) => {
+router.get(
+  '/:provider/config-files',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const provider = String(req.params.provider);
     const list = PROVIDER_CONFIG_FILES[provider];
     if (!list) {
@@ -795,9 +830,10 @@ router.get(
   }),
 );
 
-router.get(
-  '/:provider/config-files/:fileId',
-  asyncHandler(async (req: Request, res: Response) => {
+router.get(
+  '/:provider/config-files/:fileId',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const provider = String(req.params.provider);
     const fileId = String(req.params.fileId);
     const { descriptor, absolutePath } = resolveConfigFile(provider, fileId);
@@ -852,9 +888,10 @@ router.get(
   }),
 );
 
-router.put(
-  '/:provider/config-files/:fileId',
-  asyncHandler(async (req: Request, res: Response) => {
+router.put(
+  '/:provider/config-files/:fileId',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const provider = String(req.params.provider);
     const fileId = String(req.params.fileId);
     const { descriptor, absolutePath } = resolveConfigFile(provider, fileId);
@@ -903,9 +940,10 @@ router.put(
   }),
 );
 
-router.post(
-  '/:provider/config-files/:fileId/validate',
-  asyncHandler(async (req: Request, res: Response) => {
+router.post(
+  '/:provider/config-files/:fileId/validate',
+  requireProviderAdmin,
+  asyncHandler(async (req: Request, res: Response) => {
     const provider = String(req.params.provider);
     const fileId = String(req.params.fileId);
     const { descriptor, absolutePath } = resolveConfigFile(provider, fileId);

package/server/routes/commands.js

@@ -10,8 +10,9 @@ import {
   getProviderModelRegistryEntry,
   getStaticProviderModels,
 } from '../services/model-registry.js';
-import { parseFrontmatter } from '../utils/frontmatter.js';
-import { findAppRoot, getModuleDir } from '../utils/runtime-paths.js';
+import { parseFrontmatter } from '../utils/frontmatter.js';
+import { findAppRoot, getModuleDir } from '../utils/runtime-paths.js';
+import { isAdminUser, userHasProjectPathAccess } from '../services/platformization.js';
 
 const __dirname = getModuleDir(import.meta.url);
 // This route reads the top-level package.json for the status command, so it needs the real
@@ -421,31 +422,37 @@ Custom commands can be created in:
  * POST /api/commands/list
  * List all available commands from project and user directories
  */
-router.post('/list', async (req, res) => {
-  try {
-    const { projectPath } = req.body;
-    const allCommands = [...builtInCommands];
-
-    // Scan project-level commands (.claude/commands/)
-    if (projectPath) {
-      const projectCommandsDir = path.join(projectPath, '.claude', 'commands');
-      const projectCommands = await scanCommandsDirectory(
-        projectCommandsDir,
-        projectCommandsDir,
+router.post('/list', async (req, res) => {
+  try {
+    const { projectPath } = req.body;
+    const allCommands = [...builtInCommands];
+
+    // Scan project-level commands (.claude/commands/)
+    if (projectPath) {
+      const resolvedProjectPath = path.resolve(projectPath);
+      if (!userHasProjectPathAccess(req.user, { fullPath: resolvedProjectPath, path: resolvedProjectPath, projectPath: resolvedProjectPath }, resolvedProjectPath, 'viewFiles')) {
+        return res.status(403).json({ error: 'Project access denied.' });
+      }
+      const projectCommandsDir = path.join(resolvedProjectPath, '.claude', 'commands');
+      const projectCommands = await scanCommandsDirectory(
+        projectCommandsDir,
+        projectCommandsDir,
         'project'
       );
       allCommands.push(...projectCommands);
     }
 
-    // Scan user-level commands (~/.claude/commands/)
-    const homeDir = os.homedir();
-    const userCommandsDir = path.join(homeDir, '.claude', 'commands');
-    const userCommands = await scanCommandsDirectory(
-      userCommandsDir,
-      userCommandsDir,
-      'user'
-    );
-    allCommands.push(...userCommands);
+    // User-level commands belong to the server OS account; expose them only to admins.
+    if (isAdminUser(req.user)) {
+      const homeDir = os.homedir();
+      const userCommandsDir = path.join(homeDir, '.claude', 'commands');
+      const userCommands = await scanCommandsDirectory(
+        userCommandsDir,
+        userCommandsDir,
+        'user'
+      );
+      allCommands.push(...userCommands);
+    }
 
     // Separate built-in and custom commands
     const customCommands = allCommands.filter(cmd => cmd.namespace !== 'builtin');
@@ -509,20 +516,24 @@ router.post('/execute', async (req, res) => {
       });
     }
 
-    // Load command content
-    // Security: validate commandPath is within allowed directories
-    {
-      const resolvedPath = path.resolve(commandPath);
-      const userBase = path.resolve(path.join(os.homedir(), '.claude', 'commands'));
-      const projectBase = context?.projectPath
-        ? path.resolve(path.join(context.projectPath, '.claude', 'commands'))
-        : null;
+    // Load command content
+    // Security: validate commandPath is within allowed directories
+    {
+      const resolvedPath = path.resolve(commandPath);
+      const userBase = path.resolve(path.join(os.homedir(), '.claude', 'commands'));
+      const contextProjectPath = typeof context?.projectPath === 'string' ? path.resolve(context.projectPath) : null;
+      if (contextProjectPath && !userHasProjectPathAccess(req.user, { fullPath: contextProjectPath, path: contextProjectPath, projectPath: contextProjectPath }, resolvedPath, 'viewFiles')) {
+        return res.status(403).json({ error: 'Project access denied.' });
+      }
+      const projectBase = contextProjectPath
+        ? path.resolve(path.join(contextProjectPath, '.claude', 'commands'))
+        : null;
       const isUnder = (base) => {
         const rel = path.relative(base, resolvedPath);
         return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel);
       };
-      if (!(isUnder(userBase) || (projectBase && isUnder(projectBase)))) {
-        return res.status(403).json({
+      if (!((isAdminUser(req.user) && isUnder(userBase)) || (projectBase && isUnder(projectBase)))) {
+        return res.status(403).json({
           error: 'Access denied',
           message: 'Command must be in .claude/commands directory'
         });

package/server/routes/live-view.js

@@ -5,13 +5,14 @@ import express from 'express';
 
 import { extractProjectDirectory } from '../projects.js';
 import { getTunnelState } from '../services/external-access.js';
-import {
-  getLiveViewSessionByShareId,
-  getLiveViewState,
-  restartLiveView,
-  startLiveView,
-  stopLiveView,
-} from '../services/live-view.js';
+import {
+  getLiveViewSessionByShareId,
+  getLiveViewState,
+  restartLiveView,
+  startLiveView,
+  stopLiveView,
+} from '../services/live-view.js';
+import { userHasProjectPathAccess } from '../services/platformization.js';
 
 const router = express.Router();
 
@@ -210,20 +211,36 @@ function sendLiveViewDiagnostic(req, res, session, statusCode, options = {}) {
   res.json(payload);
 }
 
-async function resolveProjectPath(projectName) {
+async function resolveProjectPath(projectName) {
   const projectPath = await extractProjectDirectory(projectName);
   if (!projectPath || typeof projectPath !== 'string') {
     const error = new Error('Project path could not be resolved.');
     error.statusCode = 404;
     throw error;
   }
-  return projectPath;
-}
-
-router.get('/:projectName/status', async (req, res) => {
-  try {
-    const { projectName } = req.params;
-    const projectPath = await resolveProjectPath(projectName);
+  return projectPath;
+}
+
+function requireLiveViewProjectAccess(capability) {
+  return async (req, res, next) => {
+    try {
+      const { projectName } = req.params;
+      const projectPath = await resolveProjectPath(projectName);
+      if (!userHasProjectPathAccess(req.user, { name: projectName, projectName, fullPath: projectPath, path: projectPath }, projectPath, capability)) {
+        return res.status(403).json({ error: 'Project access denied.' });
+      }
+      req.projectPath = projectPath;
+      return next();
+    } catch (error) {
+      return res.status(error.statusCode || 500).json({ error: error.message || 'Failed to resolve project access' });
+    }
+  };
+}
+
+router.get('/:projectName/status', requireLiveViewProjectAccess('viewFiles'), async (req, res) => {
+  try {
+    const { projectName } = req.params;
+    const projectPath = req.projectPath;
     const state = await getLiveViewState(projectName, projectPath);
     const urls = buildUrls(req, state.session);
     const tunnel = getTunnelState();
@@ -238,10 +255,13 @@ router.get('/:projectName/status', async (req, res) => {
   }
 });
 
-router.post('/:projectName/start', async (req, res) => {
-  try {
-    const { projectName } = req.params;
-    const projectPath = await resolveProjectPath(projectName);
+router.post('/:projectName/start', requireLiveViewProjectAccess('useShell'), async (req, res) => {
+  try {
+    const { projectName } = req.params;
+    const projectPath = req.projectPath;
+    if (req.body?.customCommand && !['admin', 'owner'].includes(req.user?.role)) {
+      return res.status(403).json({ error: 'Custom Live View commands require admin access.' });
+    }
     const session = await startLiveView(projectName, projectPath, req.body || {});
     const state = await getLiveViewState(projectName, projectPath);
     const urls = buildUrls(req, session);
@@ -259,10 +279,13 @@ router.post('/:projectName/start', async (req, res) => {
   }
 });
 
-router.post('/:projectName/restart', async (req, res) => {
-  try {
-    const { projectName } = req.params;
-    const projectPath = await resolveProjectPath(projectName);
+router.post('/:projectName/restart', requireLiveViewProjectAccess('useShell'), async (req, res) => {
+  try {
+    const { projectName } = req.params;
+    const projectPath = req.projectPath;
+    if (req.body?.customCommand && !['admin', 'owner'].includes(req.user?.role)) {
+      return res.status(403).json({ error: 'Custom Live View commands require admin access.' });
+    }
     const session = await restartLiveView(projectName, projectPath, req.body || {});
     const state = await getLiveViewState(projectName, projectPath);
     const urls = buildUrls(req, session);
@@ -279,7 +302,7 @@ router.post('/:projectName/restart', async (req, res) => {
   }
 });
 
-router.post('/:projectName/stop', async (req, res) => {
+router.post('/:projectName/stop', requireLiveViewProjectAccess('useShell'), async (req, res) => {
   try {
     const session = await stopLiveView(req.params.projectName);
     const urls = buildUrls(req, session);

package/server/routes/messages.js

@@ -9,11 +9,30 @@
  * @module routes/messages
  */
 
-import express from 'express';
+import path from 'node:path';
+
+import express from 'express';
+
+import { sessionsService } from '../modules/providers/services/sessions.service.js';
+import { userHasProjectAccess } from '../services/platformization.js';
+import { appConfigDb } from '../database/db.js';
 
-import { sessionsService } from '../modules/providers/services/sessions.service.js';
-
-const router = express.Router();
+const router = express.Router();
+const SESSION_OWNERSHIP_KEY = 'session_ownership';
+
+function readSessionOwnership() {
+  try {
+    return JSON.parse(appConfigDb.get(SESSION_OWNERSHIP_KEY) || '{}');
+  } catch {
+    return {};
+  }
+}
+
+function canUserReadSession(user, provider, sessionId) {
+  if (['admin', 'owner'].includes(user?.role)) return true;
+  const owner = readSessionOwnership()[`${provider || 'claude'}:${sessionId}`];
+  return Boolean(owner?.userId && Number(owner.userId) === Number(user?.id ?? user?.userId));
+}
 
 /**
  * GET /api/sessions/:sessionId/messages
@@ -31,8 +50,8 @@ router.get('/:sessionId/messages', async (req, res) => {
   try {
     const { sessionId } = req.params;
     const provider = String(req.query.provider || 'claude').trim().toLowerCase();
-    const projectName = req.query.projectName || '';
-    const projectPath = req.query.projectPath || '';
+    const projectName = req.query.projectName || '';
+    const projectPath = req.query.projectPath || '';
     const limitParam = req.query.limit;
     const limit = limitParam !== undefined && limitParam !== null && limitParam !== ''
       ? parseInt(limitParam, 10)
@@ -40,12 +59,28 @@ router.get('/:sessionId/messages', async (req, res) => {
     const offset = parseInt(req.query.offset || '0', 10);
 
     const availableProviders = sessionsService.listProviderIds();
-    if (!availableProviders.includes(provider)) {
-      const available = availableProviders.join(', ');
-      return res.status(400).json({ error: `Unknown provider: ${provider}. Available: ${available}` });
-    }
-
-    const result = await sessionsService.fetchHistory(provider, sessionId, {
+    if (!availableProviders.includes(provider)) {
+      const available = availableProviders.join(', ');
+      return res.status(400).json({ error: `Unknown provider: ${provider}. Available: ${available}` });
+    }
+
+    if (!projectName && !projectPath) {
+      return res.status(400).json({ error: 'projectName or projectPath is required' });
+    }
+
+    const projectRef = projectName
+      ? { name: String(projectName), projectName: String(projectName) }
+      : { fullPath: path.resolve(String(projectPath)), path: path.resolve(String(projectPath)), projectPath: path.resolve(String(projectPath)) };
+
+    if (!userHasProjectAccess(req.user, projectRef, 'viewFiles')) {
+      return res.status(403).json({ error: 'Project access denied.' });
+    }
+
+    if (!canUserReadSession(req.user, provider, sessionId)) {
+      return res.status(403).json({ error: 'Session access denied.' });
+    }
+
+    const result = await sessionsService.fetchHistory(provider, sessionId, {
       projectName,
       projectPath,
       limit,

package/server/routes/network.js

@@ -2,12 +2,13 @@ import os from 'os';
 
 import express from 'express';
 
-import {
-  getTunnelState,
-  getUpnpState,
-  startTunnel,
-  stopTunnel,
-} from '../services/external-access.js';
+import {
+  getTunnelState,
+  getUpnpState,
+  startTunnel,
+  stopTunnel,
+} from '../services/external-access.js';
+import { requireAdmin } from '../middleware/auth.js';
 
 const router = express.Router();
 
@@ -93,7 +94,7 @@ router.delete('/upnp', (_req, res) => {
   });
 });
 
-router.post('/tunnel', async (req, res) => {
+router.post('/tunnel', requireAdmin, async (req, res) => {
   const port = resolveServerPort();
   try {
     const state = await startTunnel({ port, persistPreference: true });
@@ -112,7 +113,7 @@ router.post('/tunnel', async (req, res) => {
   }
 });
 
-router.delete('/tunnel', async (req, res) => {
+router.delete('/tunnel', requireAdmin, async (req, res) => {
   try {
     const state = await stopTunnel({ persistPreference: true });
     res.json({ success: true, tunnel: state });