@pixelbyte-software/pixcode 1.54.0 → 1.54.2

package/server/middleware/auth.js

@@ -2,9 +2,12 @@ import jwt from 'jsonwebtoken';
 
 import { userDb, appConfigDb, apiKeysDb } from '../database/db.js';
 import { IS_PLATFORM } from '../constants/config.js';
+import { securityLog, getClientIp } from '../utils/security-log.js';
 
 // Use env var if set, otherwise auto-generate a unique secret per installation
 const JWT_SECRET = process.env.JWT_SECRET || appConfigDb.getOrCreateJwtSecret();
+const JWT_ALGORITHM = 'HS256';
+const JWT_EXPIRY = process.env.JWT_EXPIRY || '24h';
 const isPixcodeApiKey = (token) => typeof token === 'string' && (token.startsWith('px_') || token.startsWith('ck_'));
 const ADMIN_ROLES = new Set(['owner', 'admin']);
 const PLATFORM_AUTH_BYPASS_ENABLED = IS_PLATFORM && process.env.PIXCODE_ALLOW_PLATFORM_AUTH_BYPASS === '1';
@@ -18,6 +21,11 @@ const validateApiKey = (req, res, next) => {
   
   const apiKey = req.headers['x-api-key'];
   if (apiKey !== process.env.API_KEY) {
+    securityLog('api_key_validation_failed', {
+      ip: getClientIp(req),
+      endpoint: req.path,
+      method: req.method,
+    });
     return res.status(401).json({ error: 'Invalid API key' });
   }
   next();
@@ -47,12 +55,23 @@ const authenticateToken = async (req, res, next) => {
   //  - ?apiKey=<apikey>                (EventSource workaround)
   // Auth-token mode is decided by the prefix: new keys generated by Pixcode
   // start with `px_`; older `ck_` keys remain valid for existing installs.
+  // SECURITY NOTE: Query-param credentials may appear in server logs, proxy
+  // logs, and browser history. Prefer Authorization headers for new clients.
   const authHeader = req.headers['authorization'];
   const bearerToken = authHeader && authHeader.startsWith('Bearer ') ? authHeader.slice(7).trim() : null;
   const apiKeyHeader = req.headers['x-api-key'];
   const queryToken = typeof req.query.token === 'string' ? req.query.token : null;
   const queryApiKey = typeof req.query.apiKey === 'string' ? req.query.apiKey : null;
 
+  if (queryToken || queryApiKey) {
+    securityLog('query_param_credential_used', {
+      ip: getClientIp(req),
+      endpoint: req.path,
+      method: req.method,
+      userAgent: req.headers['user-agent'],
+    });
+  }
+
   // Try API-key paths first when the credential is unambiguously an API key.
   const explicitApiKey = apiKeyHeader || queryApiKey
     || (isPixcodeApiKey(bearerToken) ? bearerToken : null)
@@ -62,8 +81,21 @@ const authenticateToken = async (req, res, next) => {
     try {
       const user = apiKeysDb.validateApiKey(explicitApiKey);
       if (!user) {
+        securityLog('api_key_auth_failed', {
+          ip: getClientIp(req),
+          endpoint: req.path,
+          method: req.method,
+          userId: user?.id,
+        });
         return res.status(401).json({ error: 'Invalid or inactive API key' });
       }
+      securityLog('api_key_auth_success', {
+        ip: getClientIp(req),
+        endpoint: req.path,
+        method: req.method,
+        userId: user.id,
+        username: user.username,
+      });
       req.user = user;
       return next();
     } catch (error) {
@@ -75,15 +107,26 @@ const authenticateToken = async (req, res, next) => {
   // Otherwise fall back to JWT.
   const jwtToken = bearerToken || queryToken;
   if (!jwtToken) {
+    securityLog('auth_no_token', {
+      ip: getClientIp(req),
+      endpoint: req.path,
+      method: req.method,
+    });
     return res.status(401).json({ error: 'Access denied. No token provided.' });
   }
 
   try {
-    const decoded = jwt.verify(jwtToken, JWT_SECRET);
+    const decoded = jwt.verify(jwtToken, JWT_SECRET, { algorithms: [JWT_ALGORITHM] });
 
     // Verify user still exists and is active
     const user = userDb.getUserById(decoded.userId);
     if (!user) {
+      securityLog('jwt_user_not_found', {
+        ip: getClientIp(req),
+        endpoint: req.path,
+        method: req.method,
+        userId: decoded.userId,
+      });
       return res.status(401).json({ error: 'Invalid token. User not found.' });
     }
 
@@ -100,7 +143,12 @@ const authenticateToken = async (req, res, next) => {
     req.user = user;
     next();
   } catch (error) {
-    console.error('Token verification error:', error);
+    securityLog('jwt_verification_failed', {
+      ip: getClientIp(req),
+      endpoint: req.path,
+      method: req.method,
+      reason: error.name || 'unknown',
+    });
     return res.status(403).json({ error: 'Invalid token' });
   }
 };
@@ -111,6 +159,13 @@ const requireAdmin = (req, res, next) => {
   }
 
   if (!ADMIN_ROLES.has(req.user.role)) {
+    securityLog('admin_access_denied', {
+      ip: getClientIp(req),
+      endpoint: req.path,
+      method: req.method,
+      userId: req.user.id,
+      username: req.user.username,
+    });
     return res.status(403).json({ error: 'Admin access required.' });
   }
 
@@ -120,6 +175,12 @@ const requireAdmin = (req, res, next) => {
     !req.user.api_key_scopes?.includes('system') &&
     !req.user.api_key_scopes?.includes('*')
   ) {
+    securityLog('admin_scope_denied', {
+      ip: getClientIp(req),
+      endpoint: req.path,
+      method: req.method,
+      userId: req.user.id,
+    });
     return res.status(403).json({ error: 'API key lacks admin scope.' });
   }
 
@@ -136,6 +197,13 @@ const requireApiScope = (scope) => (req, res, next) => {
     return next();
   }
 
+  securityLog('api_scope_denied', {
+    ip: getClientIp(req),
+    endpoint: req.path,
+    method: req.method,
+    userId: req.user.id,
+    reason: `Missing scope: ${scope}`,
+  });
   return res.status(403).json({ error: `API key lacks required scope: ${scope}` });
 };
 
@@ -148,7 +216,7 @@ const generateToken = (user) => {
       role: user.role || null,
     },
     JWT_SECRET,
-    { expiresIn: '7d' }
+    { expiresIn: JWT_EXPIRY, algorithm: JWT_ALGORITHM }
   );
 };
 
@@ -170,10 +238,6 @@ const authenticateWebSocket = (token) => {
 
   // Normal OSS validation — accept either an API key (`px_…` or legacy
   // `ck_…`) or a JWT.
-  // Mirrors the REST `authenticateToken` middleware so any tool that has
-  // a Pixcode API key (CI scripts, the api-tester subagent, the user's own
-  // automation, ...) can also open a WebSocket without first exchanging
-  // the key for a JWT.
   if (!token) {
     return null;
   }
@@ -190,8 +254,7 @@ const authenticateWebSocket = (token) => {
   }
 
   try {
-    const decoded = jwt.verify(token, JWT_SECRET);
-    // Verify user actually exists in database (matches REST authenticateToken behavior)
+    const decoded = jwt.verify(token, JWT_SECRET, { algorithms: [JWT_ALGORITHM] });
     const user = userDb.getUserById(decoded.userId);
     if (!user) {
       return null;

package/server/middleware/rate-limiter.js

@@ -0,0 +1,82 @@
+import { securityLog, getClientIp } from '../utils/security-log.js';
+
+function createRateLimiter(options = {}) {
+    const {
+        windowMs = 15 * 60 * 1000,
+        max = 100,
+        keyGenerator = (req) => getClientIp(req),
+        message = 'Too many requests from this IP, please try again later.',
+        statusCode = 429,
+        skip = (_req) => false,
+    } = options;
+
+    const hits = new Map();
+
+    function cleanupExpired() {
+        const now = Date.now();
+        for (const [key, entry] of hits.entries()) {
+            if (entry.resetTime <= now) {
+                hits.delete(key);
+            }
+        }
+    }
+
+    const cleanupInterval = setInterval(cleanupExpired, windowMs);
+    cleanupInterval.unref();
+
+    return (req, res, next) => {
+        if (skip(req)) {
+            return next();
+        }
+
+        const key = keyGenerator(req);
+        const now = Date.now();
+
+        let entry = hits.get(key);
+        if (!entry || entry.resetTime <= now) {
+            entry = {
+                count: 0,
+                resetTime: now + windowMs,
+            };
+            hits.set(key, entry);
+        }
+
+        entry.count += 1;
+
+        res.setHeader('X-RateLimit-Limit', String(max));
+        res.setHeader('X-RateLimit-Remaining', String(Math.max(0, max - entry.count)));
+        res.setHeader('X-RateLimit-Reset', String(Math.ceil(entry.resetTime / 1000)));
+
+        if (entry.count > max) {
+            securityLog('rate_limit_exceeded', {
+                ip: getClientIp(req),
+                endpoint: req.path,
+                method: req.method,
+                userAgent: req.headers['user-agent'],
+            });
+            return res.status(statusCode).json({
+                success: false,
+                error: {
+                    code: 'RATE_LIMIT_EXCEEDED',
+                    message,
+                },
+            });
+        }
+
+        next();
+    };
+}
+
+export const authRateLimiter = createRateLimiter({
+    windowMs: 15 * 60 * 1000,
+    max: 10,
+    message: 'Too many authentication attempts. Please try again in 15 minutes.',
+});
+
+export const apiRateLimiter = createRateLimiter({
+    windowMs: 60 * 1000,
+    max: 120,
+    message: 'Too many API requests. Please slow down.',
+});
+
+export { createRateLimiter };

package/server/routes/agent.js

@@ -1412,8 +1412,8 @@ router.post('/', validateExternalApiKey, async (req, res) => {
       if (!res.writableEnded) {
         writer.send({
           type: 'error',
-          error: error.message,
-          message: `Failed: ${error.message}`
+          error: 'Failed to process agent request.',
+          message: 'Failed to process agent request.'
         });
         writer.end();
       }
@@ -1435,14 +1435,13 @@ router.post('/', validateExternalApiKey, async (req, res) => {
           if (errorText) collectedError = errorText;
         } catch { /* ignore — fall back to error.message */ }
       }
-      const failureDetails = describeProviderFailure(collectedError || error.message, provider);
+      const failureDetails = describeProviderFailure(collectedError || 'Provider returned no assistant text.', provider);
       res.status(502).json({
         success: false,
         sessionId: writer && typeof writer.getSessionId === 'function' ? writer.getSessionId() : null,
         error: failureDetails.message,
         rawError: failureDetails.rawMessage,
         errorDetails: failureDetails,
-        wrapperError: collectedError ? error.message : undefined,
         messages: collectedMessages,
       });
     }

package/server/routes/auth.js

@@ -1,12 +1,17 @@
 import express from 'express';
-// bcryptjs is a pure-JS drop-in (same hash/compare API, same output format)
-// — switching from native `bcrypt` here eliminated one C++ compile from
-// the install path. Existing $2a$/$2b$ hashes in the DB remain valid;
-// bcryptjs recognizes both prefixes so logins work across the swap.
 import bcrypt from 'bcryptjs';
 
 import { userDb, db } from '../database/db.js';
 import { generateToken, authenticateToken, requireAdmin } from '../middleware/auth.js';
+import { authRateLimiter } from '../middleware/rate-limiter.js';
+import {
+  checkAccountLockout,
+  recordFailedLogin,
+  recordSuccessfulLogin,
+  validatePasswordPolicy,
+  validateUsername,
+} from '../middleware/account-lockout.js';
+import { securityLog, getClientIp } from '../utils/security-log.js';
 import {
   consumeQrLoginToken,
   createQrLoginToken,
@@ -49,7 +54,10 @@ router.get('/connection-mode', (req, res) => {
   res.json({ success: true, connection: getPublicRemoteConnectionConfig() });
 });
 
-router.put('/connection-mode', (req, res) => {
+// Changing the connection mode is a state-changing operation that must
+// require authentication. Without auth, any unauthenticated caller could
+// redirect the app to a malicious remote server.
+router.put('/connection-mode', authenticateToken, requireAdmin, (req, res) => {
   try {
     res.json({ success: true, connection: saveRemoteConnectionConfig(req.body || {}) });
   } catch (error) {
@@ -69,7 +77,7 @@ router.put('/qr-login/settings', authenticateToken, requireAdmin, (req, res) =>
   }
 });
 
-router.post('/qr-login/token', authenticateToken, requireAdmin, (req, res) => {
+router.post('/qr-login/token', authenticateToken, requireAdmin, authRateLimiter, (req, res) => {
   try {
     const baseUrl = typeof req.body?.baseUrl === 'string' && req.body.baseUrl.trim()
       ? req.body.baseUrl.trim()
@@ -81,11 +89,16 @@ router.post('/qr-login/token', authenticateToken, requireAdmin, (req, res) => {
   }
 });
 
-router.post('/qr-login', (req, res) => {
+router.post('/qr-login', authRateLimiter, (req, res) => {
   try {
     const user = consumeQrLoginToken(req.body?.token);
     const token = generateToken(user);
     userDb.updateLastLogin(user.id);
+    securityLog('qr_login_success', {
+      ip: getClientIp(req),
+      userId: user.id,
+      username: user.username,
+    });
     res.json({
       success: true,
       user: publicUser(user),
@@ -93,22 +106,33 @@ router.post('/qr-login', (req, res) => {
     });
   } catch (error) {
     const status = error?.code === 'QR_LOGIN_DISABLED' ? 409 : 401;
+    securityLog('qr_login_failed', {
+      ip: getClientIp(req),
+      reason: error?.code || 'unknown',
+    });
     res.status(status).json({ success: false, error: error.message });
   }
 });
 
 // User registration (setup) - only allowed if no users exist
-router.post('/register', async (req, res) => {
+router.post('/register', authRateLimiter, async (req, res) => {
   try {
     const { username, password } = req.body;
+    const clientIp = getClientIp(req);
     
     // Validate input
     if (!username || !password) {
       return res.status(400).json({ error: 'Username and password are required' });
     }
     
-    if (username.length < 3 || password.length < 6) {
-      return res.status(400).json({ error: 'Username must be at least 3 characters, password at least 6 characters' });
+    const usernameValidation = validateUsername(username);
+    if (!usernameValidation.valid) {
+      return res.status(400).json({ error: usernameValidation.error });
+    }
+
+    const passwordValidation = validatePasswordPolicy(password);
+    if (!passwordValidation.valid) {
+      return res.status(400).json({ error: passwordValidation.error });
     }
     
     // Use a transaction to prevent race conditions
@@ -136,6 +160,12 @@ router.post('/register', async (req, res) => {
       // Update last login (non-fatal, outside transaction)
       userDb.updateLastLogin(user.id);
 
+      securityLog('user_registered', {
+        ip: clientIp,
+        userId: user.id,
+        username: user.username,
+      });
+
       res.json({
         success: true,
         user: publicUser(user),
@@ -157,32 +187,72 @@ router.post('/register', async (req, res) => {
 });
 
 // User login
-router.post('/login', async (req, res) => {
+router.post('/login', authRateLimiter, async (req, res) => {
   try {
     const { username, password } = req.body;
+    const clientIp = getClientIp(req);
     
     // Validate input
     if (!username || !password) {
       return res.status(400).json({ error: 'Username and password are required' });
     }
+
+    // Check account lockout before attempting login
+    const lockoutStatus = checkAccountLockout(String(username), clientIp);
+    if (lockoutStatus.locked) {
+      securityLog('login_blocked_locked', {
+        ip: clientIp,
+        username,
+        reason: 'Account locked due to failed attempts',
+      });
+      return res.status(423).json({ error: lockoutStatus.message });
+    }
     
     // Get user from database
     const user = userDb.getUserByUsername(username);
     if (!user) {
+      const failResult = recordFailedLogin(String(username), clientIp);
+      securityLog('login_failed', {
+        ip: clientIp,
+        username,
+        reason: 'User not found',
+      });
+      if (failResult.locked) {
+        return res.status(423).json({ error: failResult.message });
+      }
       return res.status(401).json({ error: 'Invalid username or password' });
     }
     
     // Verify password
     const isValidPassword = await bcrypt.compare(password, user.password_hash);
     if (!isValidPassword) {
+      const failResult = recordFailedLogin(String(username), clientIp);
+      securityLog('login_failed', {
+        ip: clientIp,
+        username,
+        userId: user.id,
+        reason: 'Invalid password',
+      });
+      if (failResult.locked) {
+        return res.status(423).json({ error: failResult.message });
+      }
       return res.status(401).json({ error: 'Invalid username or password' });
     }
+
+    // Clear failed attempts on successful login
+    recordSuccessfulLogin(String(username), clientIp);
     
     // Generate token
     const token = generateToken(user);
     
     // Update last login
     userDb.updateLastLogin(user.id);
+
+    securityLog('login_success', {
+      ip: clientIp,
+      userId: user.id,
+      username: user.username,
+    });
     
     res.json({
       success: true,
@@ -205,8 +275,11 @@ router.get('/user', authenticateToken, (req, res) => {
 
 // Logout (client-side token removal, but this endpoint can be used for logging)
 router.post('/logout', authenticateToken, (req, res) => {
-  // In a simple JWT system, logout is mainly client-side
-  // This endpoint exists for consistency and potential future logging
+  securityLog('user_logout', {
+    ip: getClientIp(req),
+    userId: req.user?.id,
+    username: req.user?.username,
+  });
   res.json({ success: true, message: 'Logged out successfully' });
 });
 

package/server/routes/codex.js

@@ -13,7 +13,7 @@ router.delete('/sessions/:sessionId', async (req, res) => {
     res.json({ success: true });
   } catch (error) {
     console.error(`Error deleting Codex session ${req.params.sessionId}:`, error);
-    res.status(500).json({ success: false, error: error.message });
+    res.status(500).json({ success: false, error: "Internal server error" });
   }
 });
 

package/server/routes/diagnostics.js

@@ -1,6 +1,7 @@
 import express from 'express';
 
 import { collectDiagnostics } from '../services/diagnostics.js';
+import { requireAdmin } from '../middleware/auth.js';
 
 const router = express.Router();
 
@@ -16,11 +17,13 @@ function buildDiagnostics(req) {
   });
 }
 
-router.get('/', (req, res) => {
+// Diagnostics expose internal system state (active sessions, errors,
+// provider health) — restrict to admins to prevent information leakage.
+router.get('/', requireAdmin, (req, res) => {
   res.json(buildDiagnostics(req));
 });
 
-router.post('/refresh', (req, res) => {
+router.post('/refresh', requireAdmin, (req, res) => {
   req.app.locals.diagnosticsCache = {
     ...(req.app.locals.diagnosticsCache || {}),
     diagnosticsUpdatedAt: new Date().toISOString(),
@@ -29,7 +32,7 @@ router.post('/refresh', (req, res) => {
   res.json(buildDiagnostics(req));
 });
 
-router.get('/bundle', (req, res) => {
+router.get('/bundle', requireAdmin, (req, res) => {
   const diagnostics = buildDiagnostics(req);
   res.json({
     generatedAt: diagnostics.timestamp,

package/server/routes/gemini.js

@@ -18,7 +18,7 @@ router.delete('/sessions/:sessionId', async (req, res) => {
         res.json({ success: true });
     } catch (error) {
         console.error(`Error deleting Gemini session ${req.params.sessionId}:`, error);
-        res.status(500).json({ success: false, error: error.message });
+        res.status(500).json({ success: false, error: "Internal server error" });
     }
 });
 

package/server/routes/git.js

@@ -887,7 +887,7 @@ router.post('/initial-commit', async (req, res) => {
       });
     }
 
-    res.status(500).json({ error: error.message });
+    res.status(500).json({ error: "Internal server error" });
   }
 });
 
@@ -918,7 +918,7 @@ router.post('/commit', async (req, res) => {
     res.json({ success: true, output: stdout });
   } catch (error) {
     console.error('Git commit error:', error);
-    res.status(500).json({ error: error.message });
+    res.status(500).json({ error: "Internal server error" });
   }
 });
 
@@ -965,7 +965,7 @@ router.post('/revert-local-commit', async (req, res) => {
     });
   } catch (error) {
     console.error('Git revert local commit error:', error);
-    res.status(500).json({ error: error.message });
+    res.status(500).json({ error: "Internal server error" });
   }
 });
 
@@ -1031,7 +1031,7 @@ router.post('/checkout', async (req, res) => {
     res.json({ success: true, output: stdout });
   } catch (error) {
     console.error('Git checkout error:', error);
-    res.status(500).json({ error: error.message });
+    res.status(500).json({ error: "Internal server error" });
   }
 });
 
@@ -1053,7 +1053,7 @@ router.post('/create-branch', async (req, res) => {
     res.json({ success: true, output: stdout });
   } catch (error) {
     console.error('Git create branch error:', error);
-    res.status(500).json({ error: error.message });
+    res.status(500).json({ error: "Internal server error" });
   }
 });
 
@@ -1079,7 +1079,7 @@ router.post('/delete-branch', async (req, res) => {
     res.json({ success: true, output: stdout });
   } catch (error) {
     console.error('Git delete branch error:', error);
-    res.status(500).json({ error: error.message });
+    res.status(500).json({ error: "Internal server error" });
   }
 });
 
@@ -1234,7 +1234,7 @@ router.post('/generate-commit-message', async (req, res) => {
     res.json({ message });
   } catch (error) {
     console.error('Generate commit message error:', error);
-    res.status(500).json({ error: error.message });
+    res.status(500).json({ error: "Internal server error" });
   }
 });
 
@@ -1764,7 +1764,7 @@ router.post('/discard', async (req, res) => {
     res.json({ success: true, message: `Changes discarded for ${repositoryRelativeFilePath}` });
   } catch (error) {
     console.error('Git discard error:', error);
-    res.status(500).json({ error: error.message });
+    res.status(500).json({ error: "Internal server error" });
   }
 });
 
@@ -1815,7 +1815,7 @@ router.post('/delete-untracked', async (req, res) => {
     }
   } catch (error) {
     console.error('Git delete untracked error:', error);
-    res.status(500).json({ error: error.message });
+    res.status(500).json({ error: "Internal server error" });
   }
 });
 

package/server/routes/live-view.js

@@ -298,7 +298,7 @@ router.post('/:projectName/restart', requireLiveViewProjectAccess('useShell'), a
       environment: attachEnvironmentRuntimeState(state.environment, urls, tunnel),
     });
   } catch (error) {
-    res.status(500).json({ error: error.message || 'Failed to restart Live View' });
+    res.status(500).json({ error: 'Failed to restart Live View' });
   }
 });
 
@@ -315,7 +315,7 @@ router.post('/:projectName/stop', requireLiveViewProjectAccess('useShell'), asyn
       environment: attachEnvironmentRuntimeState(null, urls, tunnel),
     });
   } catch (error) {
-    res.status(500).json({ error: error.message || 'Failed to stop Live View' });
+    res.status(500).json({ error: 'Failed to stop Live View' });
   }
 });