@pixelbyte-software/pixcode 1.51.4 → 1.51.6

package/server/routes/platformization.js

@@ -12,10 +12,12 @@ import {
   createTeamMember,
   detectTailscaleStatus,
   exportAuditLog,
-  getAuditLog,
-  getPlatformizationState,
-  getRemoteAccessState,
-  listSecrets,
+  getAuditLog,
+  getPlatformizationState,
+  getRemoteAccessState,
+  installTailscale,
+  loginTailscale,
+  listSecrets,
   materializeScopedEnv,
   recordUsageEvent,
   saveRemoteAccessConfig,
@@ -187,11 +189,27 @@ router.post('/remote-access/configs', (req, res) => {
   }
 });
 
-router.get('/remote-access/tailscale', async (_req, res) => {
-  res.json({ success: true, tailscale: await detectTailscaleStatus() });
-});
-
-router.post('/remote-access/health', async (req, res) => {
+router.get('/remote-access/tailscale', async (_req, res) => {
+  res.json({ success: true, tailscale: await detectTailscaleStatus() });
+});
+
+router.post('/remote-access/tailscale/install', async (req, res) => {
+  try {
+    res.json({ success: true, result: await installTailscale(userId(req)) });
+  } catch (error) {
+    handleError(res, error);
+  }
+});
+
+router.post('/remote-access/tailscale/login', async (req, res) => {
+  try {
+    res.json({ success: true, result: await loginTailscale(userId(req)) });
+  } catch (error) {
+    handleError(res, error);
+  }
+});
+
+router.post('/remote-access/health', async (req, res) => {
   try {
     res.json({ success: true, health: await checkRemoteAccessHealth(req.body || {}, userId(req)) });
   } catch (error) {

package/server/routes/projects.js

@@ -3,9 +3,10 @@ import path from 'path';
 import { spawn } from 'child_process';
 import os from 'os';
 
-import express from 'express';
-
-import { addProjectManually, extractProjectDirectory } from '../projects.js';
+import express from 'express';
+
+import { addProjectManually, extractProjectDirectory } from '../projects.js';
+import { requireAdmin } from '../middleware/auth.js';
 
 const router = express.Router();
 
@@ -302,7 +303,7 @@ async function projectHasAnySessions(workspacePath) {
  * composer and surface a "directory deleted" warning instead of letting
  * the user fire prompts into a void.
  */
-router.get('/:projectName/dir-status', async (req, res) => {
+router.get('/:projectName/dir-status', requireAdmin, async (req, res) => {
   const { projectName } = req.params;
   try {
     const actualPath = await extractProjectDirectory(projectName);
@@ -340,7 +341,7 @@ router.get('/:projectName/dir-status', async (req, res) => {
  * matches ChatGPT's "New chat" which reuses the empty canvas until the
  * user actually commits a message.
  */
-router.post('/quick-start', async (req, res) => {
+router.post('/quick-start', requireAdmin, async (req, res) => {
   try {
     await fs.mkdir(WORKSPACES_BASE, { recursive: true });
 
@@ -424,7 +425,7 @@ router.post('/quick-start', async (req, res) => {
  * - githubTokenId?: number (optional, ID of stored token)
  * - newGithubToken?: string (optional, one-time token)
  */
-router.post('/create-workspace', async (req, res) => {
+router.post('/create-workspace', requireAdmin, async (req, res) => {
   try {
     const { workspaceType, path: workspacePath, githubUrl, githubTokenId, newGithubToken, subfolderName } = req.body;
 

package/server/routes/remote.js

@@ -5,10 +5,11 @@ import {
   getPublicRemoteConnectionConfig,
   saveRemoteConnectionConfig,
 } from '../services/remote-connection.js';
-import {
-  buildControlRoomSnapshot,
-  buildMobileConsoleLayout,
-} from '../services/control-room.js';
+import {
+  buildControlRoomSnapshot,
+  buildMobileConsoleLayout,
+} from '../services/control-room.js';
+import { requireAdmin } from '../middleware/auth.js';
 
 const router = express.Router();
 
@@ -16,7 +17,7 @@ router.get('/config', (req, res) => {
   res.json({ success: true, connection: getPublicRemoteConnectionConfig() });
 });
 
-router.put('/config', (req, res) => {
+router.put('/config', requireAdmin, (req, res) => {
   try {
     const connection = saveRemoteConnectionConfig(req.body || {});
     res.json({ success: true, connection });

package/server/services/platformization.js

@@ -1,6 +1,7 @@
-import crypto from 'node:crypto';
-import os from 'node:os';
-import { execFile } from 'node:child_process';
+import crypto from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import { execFile, spawn } from 'node:child_process';
 import { promisify } from 'node:util';
 
 import bcrypt from 'bcryptjs';
@@ -8,7 +9,7 @@ import bcrypt from 'bcryptjs';
 import { appConfigDb, userDb } from '../database/db.js';
 
 const CONFIG_KEY = 'platformization';
-const execFileAsync = promisify(execFile);
+const execFileAsync = promisify(execFile);
 
 export const TEAM_ROLES = {
   owner: [
@@ -174,6 +175,25 @@ function projectMatches(collaborator, project = {}) {
   );
 }
 
+function isPathInside(basePath, targetPath) {
+  const relative = path.relative(path.resolve(basePath), path.resolve(targetPath));
+  return relative === '' || (relative && !relative.startsWith('..') && !path.isAbsolute(relative));
+}
+
+function normalizeAllowedRoots(input) {
+  const roots = Array.isArray(input) ? input : [];
+  const normalized = roots
+    .filter((entry) => typeof entry === 'string')
+    .map((entry) => entry.trim().replace(/\\/g, '/').replace(/^\.\//, '').replace(/\/+$/g, ''))
+    .map((entry) => entry || '.')
+    .filter((entry) => !entry.includes('..'));
+  return Array.from(new Set(normalized.length > 0 ? normalized : ['.']));
+}
+
+function collaboratorAllowedRoots(collaborator) {
+  return normalizeAllowedRoots(collaborator.allowedRoots || collaborator.allowedFolders || ['.']);
+}
+
 export function userHasProjectAccess(user, project, capability = 'viewFiles') {
   if (isAdminUser(user)) return true;
   if (!user?.id && !user?.userId) return false;
@@ -198,6 +218,55 @@ export function userHasProjectAccess(user, project, capability = 'viewFiles') {
   });
 }
 
+export function getProjectAccessForUser(user, project, capability = 'viewFiles') {
+  if (isAdminUser(user)) {
+    return { unrestricted: true, allowedRoots: ['.'] };
+  }
+  if (!user?.id && !user?.userId) return { unrestricted: false, allowedRoots: [] };
+
+  const userId = Number(user.id ?? user.userId);
+  const username = String(user.username || '').toLowerCase();
+  const store = readStore();
+  const allowedRoots = [];
+
+  for (const collaborator of store.projectCollaborators) {
+    if (collaborator.status === 'disabled') continue;
+    if (!projectMatches(collaborator, project)) continue;
+    const sameUser = Number(collaborator.userId) === userId ||
+      String(collaborator.userRef || '').toLowerCase() === username;
+    if (!sameUser) continue;
+    const capabilityAllowed = capability === 'viewFiles'
+      ? collaborator.capabilities?.viewFiles !== false
+      : collaborator.capabilities?.[capability] === true;
+    if (!capabilityAllowed) continue;
+    allowedRoots.push(...collaboratorAllowedRoots(collaborator));
+  }
+
+  return { unrestricted: false, allowedRoots: Array.from(new Set(allowedRoots)) };
+}
+
+export function userHasProjectPathAccess(user, project, targetPath, capability = 'viewFiles') {
+  if (isAdminUser(user)) return true;
+  const projectPath = project?.fullPath || project?.path || project?.projectPath;
+  if (!projectPath || !targetPath) return false;
+  const access = getProjectAccessForUser(user, project, capability);
+  return access.allowedRoots.some((root) => {
+    const allowedPath = root === '.' ? projectPath : path.resolve(projectPath, root);
+    return isPathInside(allowedPath, targetPath);
+  });
+}
+
+export function filterFileTreeForUser(files = [], user, project, capability = 'viewFiles') {
+  if (isAdminUser(user)) return files;
+  const projectPath = project?.fullPath || project?.path || project?.projectPath;
+  if (!projectPath) return [];
+  return files.filter((entry) => {
+    const entryPath = entry?.path || entry?.fullPath || entry?.relativePath || '';
+    const absoluteEntryPath = path.isAbsolute(entryPath) ? entryPath : path.resolve(projectPath, entryPath);
+    return userHasProjectPathAccess(user, { ...project, fullPath: projectPath }, absoluteEntryPath, capability);
+  });
+}
+
 export function filterProjectsForUser(projects = [], user) {
   if (isAdminUser(user)) return projects;
   return projects.filter((project) => userHasProjectAccess(user, project, 'viewFiles'));
@@ -427,11 +496,12 @@ export function createProjectCollaborator(input = {}, actorId = null) {
     userId: targetUser.id,
     userRef,
     role,
-    capabilities: {
-      ...capabilities,
-      ...(input.capabilities && typeof input.capabilities === 'object' ? input.capabilities : {}),
-    },
-    status: input.status || 'active',
+    capabilities: {
+      ...capabilities,
+      ...(input.capabilities && typeof input.capabilities === 'object' ? input.capabilities : {}),
+    },
+    allowedRoots: normalizeAllowedRoots(input.allowedRoots || input.allowedFolders || ['.']),
+    status: input.status || 'active',
     createdAt: nowIso(),
     updatedAt: nowIso(),
   };
@@ -451,11 +521,14 @@ export function updateProjectCollaborator(collaboratorId, patch = {}, actorId =
       ...collaborator,
       ...patch,
       id: collaborator.id,
-      capabilities: {
-        ...collaborator.capabilities,
-        ...(patch.capabilities && typeof patch.capabilities === 'object' ? patch.capabilities : {}),
-      },
-      updatedAt: nowIso(),
+      capabilities: {
+        ...collaborator.capabilities,
+        ...(patch.capabilities && typeof patch.capabilities === 'object' ? patch.capabilities : {}),
+      },
+      allowedRoots: patch.allowedRoots || patch.allowedFolders
+        ? normalizeAllowedRoots(patch.allowedRoots || patch.allowedFolders)
+        : collaboratorAllowedRoots(collaborator),
+      updatedAt: nowIso(),
     };
     return updated;
   });
@@ -730,9 +803,66 @@ export function exportAuditLog(format = 'json', filters = {}) {
   return JSON.stringify(entries, null, 2);
 }
 
-function normalizeAccessMode(mode) {
-  return ['lan', 'tailscale', 'cloudflare_tunnel', 'custom_domain'].includes(mode) ? mode : 'lan';
-}
+function normalizeAccessMode(mode) {
+  return ['lan', 'tailscale', 'cloudflare_tunnel', 'custom_domain'].includes(mode) ? mode : 'lan';
+}
+
+function resolveTailscaleInstallPlan() {
+  const platform = os.platform();
+  if (platform === 'darwin') {
+    return {
+      platform,
+      command: 'brew',
+      args: ['install', 'tailscale'],
+      displayCommand: 'brew install tailscale',
+      docsUrl: 'https://tailscale.com/download/mac',
+      note: 'If Homebrew is not installed, open the download page and install the macOS app.',
+    };
+  }
+  if (platform === 'win32') {
+    return {
+      platform,
+      command: 'winget',
+      args: ['install', '--id', 'Tailscale.Tailscale', '-e', '--silent'],
+      displayCommand: 'winget install --id Tailscale.Tailscale -e --silent',
+      docsUrl: 'https://tailscale.com/download/windows',
+      note: 'If winget is unavailable, install from the Tailscale download page.',
+    };
+  }
+  return {
+    platform,
+    command: 'sh',
+    args: ['-c', 'curl -fsSL https://tailscale.com/install.sh | sh'],
+    displayCommand: 'curl -fsSL https://tailscale.com/install.sh | sh',
+    docsUrl: 'https://tailscale.com/download/linux',
+    note: 'Linux install may require root privileges. If this fails, run the command with sudo in a terminal.',
+  };
+}
+
+function extractFirstUrl(text = '') {
+  return String(text).match(/https?:\/\/[^\s]+/i)?.[0] || null;
+}
+
+function runTailscaleCommand(command, args, options = {}) {
+  return new Promise((resolve) => {
+    const child = spawn(command, args, {
+      shell: false,
+      windowsHide: true,
+      env: process.env,
+      ...options,
+    });
+    let stdout = '';
+    let stderr = '';
+    child.stdout?.on('data', (chunk) => { stdout += chunk.toString(); });
+    child.stderr?.on('data', (chunk) => { stderr += chunk.toString(); });
+    child.on('error', (error) => {
+      resolve({ ok: false, code: null, stdout, stderr, error: error.message });
+    });
+    child.on('close', (code) => {
+      resolve({ ok: code === 0, code, stdout, stderr, error: code === 0 ? null : `${command} exited with code ${code}` });
+    });
+  });
+}
 
 function normalizePublicUrl(value) {
   const raw = typeof value === 'string' ? value.trim() : '';
@@ -799,8 +929,9 @@ export function getRemoteAccessState() {
   };
 }
 
-export async function detectTailscaleStatus() {
-  try {
+export async function detectTailscaleStatus() {
+  const installPlan = resolveTailscaleInstallPlan();
+  try {
     const { stdout } = await execFileAsync('tailscale', ['status', '--json'], { timeout: 5000 });
     const status = JSON.parse(stdout || '{}');
     const self = status.Self || {};
@@ -813,7 +944,8 @@ export async function detectTailscaleStatus() {
       magicDnsName: self.DNSName || null,
       tailscaleIp: tailscaleIps[0] || null,
       pixcodeUrl: tailscaleIps[0] ? `http://${tailscaleIps[0]}:${process.env.SERVER_PORT || 3001}` : null,
-      installUrl: 'https://tailscale.com/download',
+      installUrl: 'https://tailscale.com/download',
+      installPlan,
       checkedAt: nowIso(),
       message: tailscaleIps[0] ? 'Tailscale is ready for private Pixcode access.' : 'Tailscale CLI is installed but no device IP was detected.',
     };
@@ -827,14 +959,54 @@ export async function detectTailscaleStatus() {
       magicDnsName: null,
       tailscaleIp: null,
       pixcodeUrl: null,
-      installUrl: 'https://tailscale.com/download',
+      installUrl: 'https://tailscale.com/download',
+      installPlan,
       checkedAt: nowIso(),
       message: isMissing
         ? 'Tailscale is optional. Use the LAN links now, or install Tailscale from Settings > Access for private team access without a public domain.'
         : (error?.message || 'Tailscale status could not be read.'),
-    };
-  }
-}
+    };
+  }
+}
+
+export async function installTailscale(actorId = null) {
+  const plan = resolveTailscaleInstallPlan();
+  const result = await runTailscaleCommand(plan.command, plan.args);
+  const store = readStore();
+  addAudit(store, 'remote.access.tailscale.install', actorId, {
+    platform: plan.platform,
+    ok: result.ok,
+    command: plan.displayCommand,
+  });
+  writeStore(store);
+  return {
+    ...result,
+    plan,
+    message: result.ok
+      ? 'Tailscale install command completed. Run login/connect next.'
+      : `Install command failed. ${plan.note}`,
+  };
+}
+
+export async function loginTailscale(actorId = null) {
+  const result = await runTailscaleCommand('tailscale', ['up']);
+  const combinedOutput = `${result.stdout || ''}\n${result.stderr || ''}`;
+  const authUrl = extractFirstUrl(combinedOutput);
+  const store = readStore();
+  addAudit(store, 'remote.access.tailscale.login', actorId, {
+    ok: result.ok,
+    authUrl: Boolean(authUrl),
+  });
+  writeStore(store);
+  return {
+    ...result,
+    authUrl,
+    message: result.ok
+      ? 'Tailscale is connected.'
+      : (authUrl ? 'Open the login URL to finish connecting this device.' : 'Tailscale login command failed.'),
+    tailscale: await detectTailscaleStatus(),
+  };
+}
 
 export async function checkRemoteAccessHealth(input = {}, actorId = null) {
   const url = normalizePublicUrl(input.url || input.remoteUrl || '');