@pixelbyte-software/pixcode 1.54.0 → 1.54.1

package/server/middleware/account-lockout.js

@@ -0,0 +1,112 @@
+import { securityLog } from '../utils/security-log.js';
+
+const MAX_FAILED_ATTEMPTS = 5;
+const LOCKOUT_DURATION_MS = 15 * 60 * 1000;
+const failedAttempts = new Map();
+
+function cleanupExpired() {
+    const now = Date.now();
+    for (const [key, entry] of failedAttempts.entries()) {
+        if (entry.lockedUntil && entry.lockedUntil <= now) {
+            failedAttempts.delete(key);
+        } else if (!entry.lockedUntil && entry.lastAttempt && now - entry.lastAttempt > LOCKOUT_DURATION_MS) {
+            failedAttempts.delete(key);
+        }
+    }
+}
+
+const cleanupInterval = setInterval(cleanupExpired, 5 * 60 * 1000);
+cleanupInterval.unref();
+
+export function checkAccountLockout(username, ip) {
+    const key = `${username}:${ip}`;
+    const entry = failedAttempts.get(key);
+    if (!entry) return { locked: false };
+
+    if (entry.lockedUntil && entry.lockedUntil > Date.now()) {
+        const remainingMs = entry.lockedUntil - Date.now();
+        const remainingMin = Math.ceil(remainingMs / 60000);
+        return {
+            locked: true,
+            remainingMs,
+            message: `Account locked due to too many failed attempts. Try again in ${remainingMin} minute(s).`,
+        };
+    }
+
+    if (entry.lockedUntil && entry.lockedUntil <= Date.now()) {
+        failedAttempts.delete(key);
+        return { locked: false };
+    }
+
+    return { locked: false };
+}
+
+export function recordFailedLogin(username, ip) {
+    const key = `${username}:${ip}`;
+    let entry = failedAttempts.get(key);
+    if (!entry) {
+        entry = { count: 0, lockedUntil: null, lastAttempt: Date.now() };
+        failedAttempts.set(key, entry);
+    }
+
+    entry.count += 1;
+    entry.lastAttempt = Date.now();
+
+    if (entry.count >= MAX_FAILED_ATTEMPTS) {
+        entry.lockedUntil = Date.now() + LOCKOUT_DURATION_MS;
+        securityLog('account_locked', {
+            username,
+            ip,
+            reason: `Exceeded ${MAX_FAILED_ATTEMPTS} failed login attempts`,
+        });
+        return {
+            locked: true,
+            message: `Account locked due to too many failed attempts. Try again in 15 minutes.`,
+        };
+    }
+
+    return {
+        locked: false,
+        remaining: MAX_FAILED_ATTEMPTS - entry.count,
+    };
+}
+
+export function recordSuccessfulLogin(username, ip) {
+    const key = `${username}:${ip}`;
+    failedAttempts.delete(key);
+}
+
+export function validatePasswordPolicy(password) {
+    if (typeof password !== 'string' || password.length < 8) {
+        return { valid: false, error: 'Password must be at least 8 characters long' };
+    }
+    if (password.length > 128) {
+        return { valid: false, error: 'Password must not exceed 128 characters' };
+    }
+    if (!/[a-z]/.test(password)) {
+        return { valid: false, error: 'Password must contain at least one lowercase letter' };
+    }
+    if (!/[A-Z]/.test(password)) {
+        return { valid: false, error: 'Password must contain at least one uppercase letter' };
+    }
+    if (!/[0-9]/.test(password)) {
+        return { valid: false, error: 'Password must contain at least one number' };
+    }
+    if (!/[^a-zA-Z0-9]/.test(password)) {
+        return { valid: false, error: 'Password must contain at least one special character' };
+    }
+    return { valid: true };
+}
+
+export function validateUsername(username) {
+    if (typeof username !== 'string' || username.length < 3) {
+        return { valid: false, error: 'Username must be at least 3 characters' };
+    }
+    if (username.length > 64) {
+        return { valid: false, error: 'Username must not exceed 64 characters' };
+    }
+    if (!/^[a-zA-Z0-9_.-]+$/.test(username)) {
+        return { valid: false, error: 'Username may only contain letters, numbers, dots, hyphens, and underscores' };
+    }
+    return { valid: true };
+}

package/server/middleware/auth.js

@@ -2,9 +2,12 @@ import jwt from 'jsonwebtoken';
 
 import { userDb, appConfigDb, apiKeysDb } from '../database/db.js';
 import { IS_PLATFORM } from '../constants/config.js';
+import { securityLog, getClientIp } from '../utils/security-log.js';
 
 // Use env var if set, otherwise auto-generate a unique secret per installation
 const JWT_SECRET = process.env.JWT_SECRET || appConfigDb.getOrCreateJwtSecret();
+const JWT_ALGORITHM = 'HS256';
+const JWT_EXPIRY = process.env.JWT_EXPIRY || '24h';
 const isPixcodeApiKey = (token) => typeof token === 'string' && (token.startsWith('px_') || token.startsWith('ck_'));
 const ADMIN_ROLES = new Set(['owner', 'admin']);
 const PLATFORM_AUTH_BYPASS_ENABLED = IS_PLATFORM && process.env.PIXCODE_ALLOW_PLATFORM_AUTH_BYPASS === '1';
@@ -18,6 +21,11 @@ const validateApiKey = (req, res, next) => {
   
   const apiKey = req.headers['x-api-key'];
   if (apiKey !== process.env.API_KEY) {
+    securityLog('api_key_validation_failed', {
+      ip: getClientIp(req),
+      endpoint: req.path,
+      method: req.method,
+    });
     return res.status(401).json({ error: 'Invalid API key' });
   }
   next();
@@ -47,12 +55,23 @@ const authenticateToken = async (req, res, next) => {
   //  - ?apiKey=<apikey>                (EventSource workaround)
   // Auth-token mode is decided by the prefix: new keys generated by Pixcode
   // start with `px_`; older `ck_` keys remain valid for existing installs.
+  // SECURITY NOTE: Query-param credentials may appear in server logs, proxy
+  // logs, and browser history. Prefer Authorization headers for new clients.
   const authHeader = req.headers['authorization'];
   const bearerToken = authHeader && authHeader.startsWith('Bearer ') ? authHeader.slice(7).trim() : null;
   const apiKeyHeader = req.headers['x-api-key'];
   const queryToken = typeof req.query.token === 'string' ? req.query.token : null;
   const queryApiKey = typeof req.query.apiKey === 'string' ? req.query.apiKey : null;
 
+  if (queryToken || queryApiKey) {
+    securityLog('query_param_credential_used', {
+      ip: getClientIp(req),
+      endpoint: req.path,
+      method: req.method,
+      userAgent: req.headers['user-agent'],
+    });
+  }
+
   // Try API-key paths first when the credential is unambiguously an API key.
   const explicitApiKey = apiKeyHeader || queryApiKey
     || (isPixcodeApiKey(bearerToken) ? bearerToken : null)
@@ -62,8 +81,21 @@ const authenticateToken = async (req, res, next) => {
     try {
       const user = apiKeysDb.validateApiKey(explicitApiKey);
       if (!user) {
+        securityLog('api_key_auth_failed', {
+          ip: getClientIp(req),
+          endpoint: req.path,
+          method: req.method,
+          userId: user?.id,
+        });
         return res.status(401).json({ error: 'Invalid or inactive API key' });
       }
+      securityLog('api_key_auth_success', {
+        ip: getClientIp(req),
+        endpoint: req.path,
+        method: req.method,
+        userId: user.id,
+        username: user.username,
+      });
       req.user = user;
       return next();
     } catch (error) {
@@ -75,15 +107,26 @@ const authenticateToken = async (req, res, next) => {
   // Otherwise fall back to JWT.
   const jwtToken = bearerToken || queryToken;
   if (!jwtToken) {
+    securityLog('auth_no_token', {
+      ip: getClientIp(req),
+      endpoint: req.path,
+      method: req.method,
+    });
     return res.status(401).json({ error: 'Access denied. No token provided.' });
   }
 
   try {
-    const decoded = jwt.verify(jwtToken, JWT_SECRET);
+    const decoded = jwt.verify(jwtToken, JWT_SECRET, { algorithms: [JWT_ALGORITHM] });
 
     // Verify user still exists and is active
     const user = userDb.getUserById(decoded.userId);
     if (!user) {
+      securityLog('jwt_user_not_found', {
+        ip: getClientIp(req),
+        endpoint: req.path,
+        method: req.method,
+        userId: decoded.userId,
+      });
       return res.status(401).json({ error: 'Invalid token. User not found.' });
     }
 
@@ -100,7 +143,12 @@ const authenticateToken = async (req, res, next) => {
     req.user = user;
     next();
   } catch (error) {
-    console.error('Token verification error:', error);
+    securityLog('jwt_verification_failed', {
+      ip: getClientIp(req),
+      endpoint: req.path,
+      method: req.method,
+      reason: error.name || 'unknown',
+    });
     return res.status(403).json({ error: 'Invalid token' });
   }
 };
@@ -111,6 +159,13 @@ const requireAdmin = (req, res, next) => {
   }
 
   if (!ADMIN_ROLES.has(req.user.role)) {
+    securityLog('admin_access_denied', {
+      ip: getClientIp(req),
+      endpoint: req.path,
+      method: req.method,
+      userId: req.user.id,
+      username: req.user.username,
+    });
     return res.status(403).json({ error: 'Admin access required.' });
   }
 
@@ -120,6 +175,12 @@ const requireAdmin = (req, res, next) => {
     !req.user.api_key_scopes?.includes('system') &&
     !req.user.api_key_scopes?.includes('*')
   ) {
+    securityLog('admin_scope_denied', {
+      ip: getClientIp(req),
+      endpoint: req.path,
+      method: req.method,
+      userId: req.user.id,
+    });
     return res.status(403).json({ error: 'API key lacks admin scope.' });
   }
 
@@ -136,6 +197,13 @@ const requireApiScope = (scope) => (req, res, next) => {
     return next();
   }
 
+  securityLog('api_scope_denied', {
+    ip: getClientIp(req),
+    endpoint: req.path,
+    method: req.method,
+    userId: req.user.id,
+    reason: `Missing scope: ${scope}`,
+  });
   return res.status(403).json({ error: `API key lacks required scope: ${scope}` });
 };
 
@@ -148,7 +216,7 @@ const generateToken = (user) => {
       role: user.role || null,
     },
     JWT_SECRET,
-    { expiresIn: '7d' }
+    { expiresIn: JWT_EXPIRY, algorithm: JWT_ALGORITHM }
   );
 };
 
@@ -170,10 +238,6 @@ const authenticateWebSocket = (token) => {
 
   // Normal OSS validation — accept either an API key (`px_…` or legacy
   // `ck_…`) or a JWT.
-  // Mirrors the REST `authenticateToken` middleware so any tool that has
-  // a Pixcode API key (CI scripts, the api-tester subagent, the user's own
-  // automation, ...) can also open a WebSocket without first exchanging
-  // the key for a JWT.
   if (!token) {
     return null;
   }
@@ -190,8 +254,7 @@ const authenticateWebSocket = (token) => {
   }
 
   try {
-    const decoded = jwt.verify(token, JWT_SECRET);
-    // Verify user actually exists in database (matches REST authenticateToken behavior)
+    const decoded = jwt.verify(token, JWT_SECRET, { algorithms: [JWT_ALGORITHM] });
     const user = userDb.getUserById(decoded.userId);
     if (!user) {
       return null;

package/server/middleware/rate-limiter.js

@@ -0,0 +1,82 @@
+import { securityLog, getClientIp } from '../utils/security-log.js';
+
+function createRateLimiter(options = {}) {
+    const {
+        windowMs = 15 * 60 * 1000,
+        max = 100,
+        keyGenerator = (req) => getClientIp(req),
+        message = 'Too many requests from this IP, please try again later.',
+        statusCode = 429,
+        skip = (_req) => false,
+    } = options;
+
+    const hits = new Map();
+
+    function cleanupExpired() {
+        const now = Date.now();
+        for (const [key, entry] of hits.entries()) {
+            if (entry.resetTime <= now) {
+                hits.delete(key);
+            }
+        }
+    }
+
+    const cleanupInterval = setInterval(cleanupExpired, windowMs);
+    cleanupInterval.unref();
+
+    return (req, res, next) => {
+        if (skip(req)) {
+            return next();
+        }
+
+        const key = keyGenerator(req);
+        const now = Date.now();
+
+        let entry = hits.get(key);
+        if (!entry || entry.resetTime <= now) {
+            entry = {
+                count: 0,
+                resetTime: now + windowMs,
+            };
+            hits.set(key, entry);
+        }
+
+        entry.count += 1;
+
+        res.setHeader('X-RateLimit-Limit', String(max));
+        res.setHeader('X-RateLimit-Remaining', String(Math.max(0, max - entry.count)));
+        res.setHeader('X-RateLimit-Reset', String(Math.ceil(entry.resetTime / 1000)));
+
+        if (entry.count > max) {
+            securityLog('rate_limit_exceeded', {
+                ip: getClientIp(req),
+                endpoint: req.path,
+                method: req.method,
+                userAgent: req.headers['user-agent'],
+            });
+            return res.status(statusCode).json({
+                success: false,
+                error: {
+                    code: 'RATE_LIMIT_EXCEEDED',
+                    message,
+                },
+            });
+        }
+
+        next();
+    };
+}
+
+export const authRateLimiter = createRateLimiter({
+    windowMs: 15 * 60 * 1000,
+    max: 10,
+    message: 'Too many authentication attempts. Please try again in 15 minutes.',
+});
+
+export const apiRateLimiter = createRateLimiter({
+    windowMs: 60 * 1000,
+    max: 120,
+    message: 'Too many API requests. Please slow down.',
+});
+
+export { createRateLimiter };

package/server/routes/agent.js

@@ -1412,8 +1412,8 @@ router.post('/', validateExternalApiKey, async (req, res) => {
       if (!res.writableEnded) {
         writer.send({
           type: 'error',
-          error: error.message,
-          message: `Failed: ${error.message}`
+          error: 'Failed to process agent request.',
+          message: 'Failed to process agent request.'
         });
         writer.end();
       }
@@ -1435,14 +1435,13 @@ router.post('/', validateExternalApiKey, async (req, res) => {
           if (errorText) collectedError = errorText;
         } catch { /* ignore — fall back to error.message */ }
       }
-      const failureDetails = describeProviderFailure(collectedError || error.message, provider);
+      const failureDetails = describeProviderFailure(collectedError || 'Provider returned no assistant text.', provider);
       res.status(502).json({
         success: false,
         sessionId: writer && typeof writer.getSessionId === 'function' ? writer.getSessionId() : null,
         error: failureDetails.message,
         rawError: failureDetails.rawMessage,
         errorDetails: failureDetails,
-        wrapperError: collectedError ? error.message : undefined,
         messages: collectedMessages,
       });
     }

package/server/routes/auth.js

@@ -1,12 +1,17 @@
 import express from 'express';
-// bcryptjs is a pure-JS drop-in (same hash/compare API, same output format)
-// — switching from native `bcrypt` here eliminated one C++ compile from
-// the install path. Existing $2a$/$2b$ hashes in the DB remain valid;
-// bcryptjs recognizes both prefixes so logins work across the swap.
 import bcrypt from 'bcryptjs';
 
 import { userDb, db } from '../database/db.js';
 import { generateToken, authenticateToken, requireAdmin } from '../middleware/auth.js';
+import { authRateLimiter } from '../middleware/rate-limiter.js';
+import {
+  checkAccountLockout,
+  recordFailedLogin,
+  recordSuccessfulLogin,
+  validatePasswordPolicy,
+  validateUsername,
+} from '../middleware/account-lockout.js';
+import { securityLog, getClientIp } from '../utils/security-log.js';
 import {
   consumeQrLoginToken,
   createQrLoginToken,
@@ -49,7 +54,10 @@ router.get('/connection-mode', (req, res) => {
   res.json({ success: true, connection: getPublicRemoteConnectionConfig() });
 });
 
-router.put('/connection-mode', (req, res) => {
+// Changing the connection mode is a state-changing operation that must
+// require authentication. Without auth, any unauthenticated caller could
+// redirect the app to a malicious remote server.
+router.put('/connection-mode', authenticateToken, requireAdmin, (req, res) => {
   try {
     res.json({ success: true, connection: saveRemoteConnectionConfig(req.body || {}) });
   } catch (error) {
@@ -69,7 +77,7 @@ router.put('/qr-login/settings', authenticateToken, requireAdmin, (req, res) =>
   }
 });
 
-router.post('/qr-login/token', authenticateToken, requireAdmin, (req, res) => {
+router.post('/qr-login/token', authenticateToken, requireAdmin, authRateLimiter, (req, res) => {
   try {
     const baseUrl = typeof req.body?.baseUrl === 'string' && req.body.baseUrl.trim()
       ? req.body.baseUrl.trim()
@@ -81,11 +89,16 @@ router.post('/qr-login/token', authenticateToken, requireAdmin, (req, res) => {
   }
 });
 
-router.post('/qr-login', (req, res) => {
+router.post('/qr-login', authRateLimiter, (req, res) => {
   try {
     const user = consumeQrLoginToken(req.body?.token);
     const token = generateToken(user);
     userDb.updateLastLogin(user.id);
+    securityLog('qr_login_success', {
+      ip: getClientIp(req),
+      userId: user.id,
+      username: user.username,
+    });
     res.json({
       success: true,
       user: publicUser(user),
@@ -93,22 +106,33 @@ router.post('/qr-login', (req, res) => {
     });
   } catch (error) {
     const status = error?.code === 'QR_LOGIN_DISABLED' ? 409 : 401;
+    securityLog('qr_login_failed', {
+      ip: getClientIp(req),
+      reason: error?.code || 'unknown',
+    });
     res.status(status).json({ success: false, error: error.message });
   }
 });
 
 // User registration (setup) - only allowed if no users exist
-router.post('/register', async (req, res) => {
+router.post('/register', authRateLimiter, async (req, res) => {
   try {
     const { username, password } = req.body;
+    const clientIp = getClientIp(req);
     
     // Validate input
     if (!username || !password) {
       return res.status(400).json({ error: 'Username and password are required' });
     }
     
-    if (username.length < 3 || password.length < 6) {
-      return res.status(400).json({ error: 'Username must be at least 3 characters, password at least 6 characters' });
+    const usernameValidation = validateUsername(username);
+    if (!usernameValidation.valid) {
+      return res.status(400).json({ error: usernameValidation.error });
+    }
+
+    const passwordValidation = validatePasswordPolicy(password);
+    if (!passwordValidation.valid) {
+      return res.status(400).json({ error: passwordValidation.error });
     }
     
     // Use a transaction to prevent race conditions
@@ -136,6 +160,12 @@ router.post('/register', async (req, res) => {
       // Update last login (non-fatal, outside transaction)
       userDb.updateLastLogin(user.id);
 
+      securityLog('user_registered', {
+        ip: clientIp,
+        userId: user.id,
+        username: user.username,
+      });
+
       res.json({
         success: true,
         user: publicUser(user),
@@ -157,32 +187,72 @@ router.post('/register', async (req, res) => {
 });
 
 // User login
-router.post('/login', async (req, res) => {
+router.post('/login', authRateLimiter, async (req, res) => {
   try {
     const { username, password } = req.body;
+    const clientIp = getClientIp(req);
     
     // Validate input
     if (!username || !password) {
       return res.status(400).json({ error: 'Username and password are required' });
     }
+
+    // Check account lockout before attempting login
+    const lockoutStatus = checkAccountLockout(String(username), clientIp);
+    if (lockoutStatus.locked) {
+      securityLog('login_blocked_locked', {
+        ip: clientIp,
+        username,
+        reason: 'Account locked due to failed attempts',
+      });
+      return res.status(423).json({ error: lockoutStatus.message });
+    }
     
     // Get user from database
     const user = userDb.getUserByUsername(username);
     if (!user) {
+      const failResult = recordFailedLogin(String(username), clientIp);
+      securityLog('login_failed', {
+        ip: clientIp,
+        username,
+        reason: 'User not found',
+      });
+      if (failResult.locked) {
+        return res.status(423).json({ error: failResult.message });
+      }
       return res.status(401).json({ error: 'Invalid username or password' });
     }
     
     // Verify password
     const isValidPassword = await bcrypt.compare(password, user.password_hash);
     if (!isValidPassword) {
+      const failResult = recordFailedLogin(String(username), clientIp);
+      securityLog('login_failed', {
+        ip: clientIp,
+        username,
+        userId: user.id,
+        reason: 'Invalid password',
+      });
+      if (failResult.locked) {
+        return res.status(423).json({ error: failResult.message });
+      }
       return res.status(401).json({ error: 'Invalid username or password' });
     }
+
+    // Clear failed attempts on successful login
+    recordSuccessfulLogin(String(username), clientIp);
     
     // Generate token
     const token = generateToken(user);
     
     // Update last login
     userDb.updateLastLogin(user.id);
+
+    securityLog('login_success', {
+      ip: clientIp,
+      userId: user.id,
+      username: user.username,
+    });
     
     res.json({
       success: true,
@@ -205,8 +275,11 @@ router.get('/user', authenticateToken, (req, res) => {
 
 // Logout (client-side token removal, but this endpoint can be used for logging)
 router.post('/logout', authenticateToken, (req, res) => {
-  // In a simple JWT system, logout is mainly client-side
-  // This endpoint exists for consistency and potential future logging
+  securityLog('user_logout', {
+    ip: getClientIp(req),
+    userId: req.user?.id,
+    username: req.user?.username,
+  });
   res.json({ success: true, message: 'Logged out successfully' });
 });
 

package/server/routes/codex.js

@@ -13,7 +13,7 @@ router.delete('/sessions/:sessionId', async (req, res) => {
     res.json({ success: true });
   } catch (error) {
     console.error(`Error deleting Codex session ${req.params.sessionId}:`, error);
-    res.status(500).json({ success: false, error: error.message });
+    res.status(500).json({ success: false, error: "Internal server error" });
   }
 });
 

package/server/routes/diagnostics.js

@@ -1,6 +1,7 @@
 import express from 'express';
 
 import { collectDiagnostics } from '../services/diagnostics.js';
+import { requireAdmin } from '../middleware/auth.js';
 
 const router = express.Router();
 
@@ -16,11 +17,13 @@ function buildDiagnostics(req) {
   });
 }
 
-router.get('/', (req, res) => {
+// Diagnostics expose internal system state (active sessions, errors,
+// provider health) — restrict to admins to prevent information leakage.
+router.get('/', requireAdmin, (req, res) => {
   res.json(buildDiagnostics(req));
 });
 
-router.post('/refresh', (req, res) => {
+router.post('/refresh', requireAdmin, (req, res) => {
   req.app.locals.diagnosticsCache = {
     ...(req.app.locals.diagnosticsCache || {}),
     diagnosticsUpdatedAt: new Date().toISOString(),
@@ -29,7 +32,7 @@ router.post('/refresh', (req, res) => {
   res.json(buildDiagnostics(req));
 });
 
-router.get('/bundle', (req, res) => {
+router.get('/bundle', requireAdmin, (req, res) => {
   const diagnostics = buildDiagnostics(req);
   res.json({
     generatedAt: diagnostics.timestamp,

package/server/routes/gemini.js

@@ -18,7 +18,7 @@ router.delete('/sessions/:sessionId', async (req, res) => {
         res.json({ success: true });
     } catch (error) {
         console.error(`Error deleting Gemini session ${req.params.sessionId}:`, error);
-        res.status(500).json({ success: false, error: error.message });
+        res.status(500).json({ success: false, error: "Internal server error" });
     }
 });