@pixelbyte-software/pixcode 1.54.10 → 1.55.0

package/server/middleware/rate-limiter.js

@@ -1,87 +1,87 @@
-import { securityLog, getClientIp } from '../utils/security-log.js';
-
-function createRateLimiter(options = {}) {
-    const {
-        windowMs = 15 * 60 * 1000,
-        max = 100,
-        keyGenerator = (req) => getClientIp(req),
-        message = 'Too many requests from this IP, please try again later.',
-        statusCode = 429,
-        skip = (_req) => false,
-    } = options;
-
-    const hits = new Map();
-
-    function cleanupExpired() {
-        const now = Date.now();
-        for (const [key, entry] of hits.entries()) {
-            if (entry.resetTime <= now) {
-                hits.delete(key);
-            }
-        }
-    }
-
-    const cleanupInterval = setInterval(cleanupExpired, windowMs);
-    cleanupInterval.unref();
-
-    return (req, res, next) => {
-        if (skip(req)) {
-            return next();
-        }
-
-        const key = keyGenerator(req);
-        const now = Date.now();
-
-        let entry = hits.get(key);
-        if (!entry || entry.resetTime <= now) {
-            entry = {
-                count: 0,
-                resetTime: now + windowMs,
-            };
-            hits.set(key, entry);
-        }
-
-        entry.count += 1;
-
-        res.setHeader('X-RateLimit-Limit', String(max));
-        res.setHeader('X-RateLimit-Remaining', String(Math.max(0, max - entry.count)));
-        res.setHeader('X-RateLimit-Reset', String(Math.ceil(entry.resetTime / 1000)));
-
-        if (entry.count > max) {
-            securityLog('rate_limit_exceeded', {
-                ip: getClientIp(req),
-                endpoint: req.path,
-                method: req.method,
-                userAgent: req.headers['user-agent'],
-            });
-            return res.status(statusCode).json({
-                success: false,
-                error: {
-                    code: 'RATE_LIMIT_EXCEEDED',
-                    message,
-                },
-            });
-        }
-
-        next();
-    };
-}
-
-export const authRateLimiter = createRateLimiter({
-    windowMs: 15 * 60 * 1000,
-    max: 10,
-    message: 'Too many authentication attempts. Please try again in 15 minutes.',
-});
-
-// API rate limiter: only limits state-changing operations (POST/PUT/DELETE/PATCH).
-// GET requests (polling, fetching sessions, file trees, update-state, etc.) are
-// exempt — the frontend polls several endpoints frequently and 120/min was
-// too low, causing false "rate limit" errors on active sessions.
-export const apiRateLimiter = createRateLimiter({
-    windowMs: 60 * 1000,
-    max: 300,
-    message: 'Too many API requests. Please slow down.',
-    skip: (req) => req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS',
-});
-
-export { createRateLimiter };
+import { securityLog, getClientIp } from '../utils/security-log.js';
+
+function createRateLimiter(options = {}) {
+    const {
+        windowMs = 15 * 60 * 1000,
+        max = 100,
+        keyGenerator = (req) => getClientIp(req),
+        message = 'Too many requests from this IP, please try again later.',
+        statusCode = 429,
+        skip = (_req) => false,
+    } = options;
+
+    const hits = new Map();
+
+    function cleanupExpired() {
+        const now = Date.now();
+        for (const [key, entry] of hits.entries()) {
+            if (entry.resetTime <= now) {
+                hits.delete(key);
+            }
+        }
+    }
+
+    const cleanupInterval = setInterval(cleanupExpired, windowMs);
+    cleanupInterval.unref();
+
+    return (req, res, next) => {
+        if (skip(req)) {
+            return next();
+        }
+
+        const key = keyGenerator(req);
+        const now = Date.now();
+
+        let entry = hits.get(key);
+        if (!entry || entry.resetTime <= now) {
+            entry = {
+                count: 0,
+                resetTime: now + windowMs,
+            };
+            hits.set(key, entry);
+        }
+
+        entry.count += 1;
+
+        res.setHeader('X-RateLimit-Limit', String(max));
+        res.setHeader('X-RateLimit-Remaining', String(Math.max(0, max - entry.count)));
+        res.setHeader('X-RateLimit-Reset', String(Math.ceil(entry.resetTime / 1000)));
+
+        if (entry.count > max) {
+            securityLog('rate_limit_exceeded', {
+                ip: getClientIp(req),
+                endpoint: req.path,
+                method: req.method,
+                userAgent: req.headers['user-agent'],
+            });
+            return res.status(statusCode).json({
+                success: false,
+                error: {
+                    code: 'RATE_LIMIT_EXCEEDED',
+                    message,
+                },
+            });
+        }
+
+        next();
+    };
+}
+
+export const authRateLimiter = createRateLimiter({
+    windowMs: 15 * 60 * 1000,
+    max: 10,
+    message: 'Too many authentication attempts. Please try again in 15 minutes.',
+});
+
+// API rate limiter: only limits state-changing operations (POST/PUT/DELETE/PATCH).
+// GET requests (polling, fetching sessions, file trees, update-state, etc.) are
+// exempt — the frontend polls several endpoints frequently and 120/min was
+// too low, causing false "rate limit" errors on active sessions.
+export const apiRateLimiter = createRateLimiter({
+    windowMs: 60 * 1000,
+    max: 300,
+    message: 'Too many API requests. Please slow down.',
+    skip: (req) => req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS',
+});
+
+export { createRateLimiter };

package/server/modules/providers/index.ts

@@ -1,2 +1,2 @@
-export { providerRegistry } from './provider.registry.js';
-export { CodexSessionsProvider } from './list/codex/codex-sessions.provider.js';
+export { providerRegistry } from './provider.registry.js';
+export { CodexSessionsProvider } from './list/codex/codex-sessions.provider.js';

package/server/modules/providers/list/claude/claude-auth.provider.ts

@@ -1,146 +1,146 @@
-/* eslint-disable import-x/order */
-import { readFile } from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-
-import spawn from 'cross-spawn';
-
-import type { IProviderAuth } from '@/shared/interfaces.js';
-import type { ProviderAuthStatus } from '@/shared/types.js';
-import { readObjectRecord, readOptionalString } from '@/shared/utils.js';
- 
-// @ts-ignore — plain-JS module
-import { getProviderCredentials } from '@/services/provider-credentials.js';
-
-type ClaudeCredentialsStatus = {
-  authenticated: boolean;
-  email: string | null;
-  method: string | null;
-  error?: string;
-};
-
-export class ClaudeProviderAuth implements IProviderAuth {
-  /**
-   * Checks whether the Claude Code CLI is available on this host.
-   *
-   * NOTE: `cross-spawn.sync` does NOT throw on ENOENT — it returns a result
-   * object with `error` populated. The try/catch alone was always returning
-   * true and every provider appeared "installed". We now require both
-   * `!result.error` and a numeric exit status (0 for `--version`) before
-   * trusting the install.
-   */
-  private checkInstalled(): boolean {
-    const cliPath = process.env.CLAUDE_CLI_PATH || 'claude';
-    try {
-      const result = spawn.sync(cliPath, ['--version'], { stdio: 'ignore', timeout: 5000 });
-      return !result.error && result.status === 0;
-    } catch {
-      return false;
-    }
-  }
-
-  /**
-   * Returns Claude installation and credential status using Claude Code's auth priority.
-   */
-  async getStatus(): Promise<ProviderAuthStatus> {
-    const installed = this.checkInstalled();
-
-    if (!installed) {
-      return {
-        installed,
-        provider: 'claude',
-        authenticated: false,
-        email: null,
-        method: null,
-        error: 'Claude Code CLI is not installed',
-      };
-    }
-
-    const credentials = await this.checkCredentials();
-
-    return {
-      installed,
-      provider: 'claude',
-      authenticated: credentials.authenticated,
-      email: credentials.authenticated ? credentials.email || 'Authenticated' : credentials.email,
-      method: credentials.method,
-      error: credentials.authenticated ? undefined : credentials.error || 'Not authenticated',
-    };
-  }
-
-  /**
-   * Reads Claude settings env values that the CLI can use even when the server process env is empty.
-   */
-  private async loadSettingsEnv(): Promise<Record<string, unknown>> {
-    try {
-      const settingsPath = path.join(os.homedir(), '.claude', 'settings.json');
-      const content = await readFile(settingsPath, 'utf8');
-      const settings = readObjectRecord(JSON.parse(content));
-      return readObjectRecord(settings?.env) ?? {};
-    } catch {
-      return {};
-    }
-  }
-
-  /**
-   * Checks Claude credentials in the same priority order used by Claude Code.
-   */
-  private async checkCredentials(): Promise<ClaudeCredentialsStatus> {
-    // Pixcode-UI-saved credentials win. Users who paste a key into our
-    // Settings > Agents form expect authenticated status immediately,
-    // regardless of env var timing.
-    try {
-      const creds = await getProviderCredentials('claude');
-      if (creds?.apiKey) {
-        const label = creds.baseUrl
-          ? `API Key · ${(() => { try { return new URL(creds.baseUrl).host; } catch { return creds.baseUrl; } })()}`
-          : 'API Key Auth';
-        return { authenticated: true, email: label, method: 'pixcode_store' };
-      }
-    } catch { /* fall through */ }
-
-    if (process.env.ANTHROPIC_API_KEY?.trim()) {
-      return { authenticated: true, email: 'API Key Auth', method: 'api_key' };
-    }
-
-    const settingsEnv = await this.loadSettingsEnv();
-    if (readOptionalString(settingsEnv.ANTHROPIC_API_KEY)) {
-      return { authenticated: true, email: 'API Key Auth', method: 'api_key' };
-    }
-
-    if (readOptionalString(settingsEnv.ANTHROPIC_AUTH_TOKEN)) {
-      return { authenticated: true, email: 'Configured via settings.json', method: 'api_key' };
-    }
-
-    try {
-      const credPath = path.join(os.homedir(), '.claude', '.credentials.json');
-      const content = await readFile(credPath, 'utf8');
-      const creds = readObjectRecord(JSON.parse(content)) ?? {};
-      const oauth = readObjectRecord(creds.claudeAiOauth);
-      const accessToken = readOptionalString(oauth?.accessToken);
-
-      if (accessToken) {
-        const expiresAt = typeof oauth?.expiresAt === 'number' ? oauth.expiresAt : undefined;
-        const email = readOptionalString(creds.email) ?? readOptionalString(creds.user) ?? null;
-        if (!expiresAt || Date.now() < expiresAt) {
-          return {
-            authenticated: true,
-            email,
-            method: 'credentials_file',
-          };
-        }
-
-        return {
-          authenticated: false,
-          email,
-          method: 'credentials_file',
-          error: 'OAuth token has expired. Please re-authenticate with claude login',
-        };
-      }
-
-      return { authenticated: false, email: null, method: null };
-    } catch {
-      return { authenticated: false, email: null, method: null };
-    }
-  }
-}
+/* eslint-disable import-x/order */
+import { readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import spawn from 'cross-spawn';
+
+import type { IProviderAuth } from '@/shared/interfaces.js';
+import type { ProviderAuthStatus } from '@/shared/types.js';
+import { readObjectRecord, readOptionalString } from '@/shared/utils.js';
+ 
+// @ts-ignore — plain-JS module
+import { getProviderCredentials } from '@/services/provider-credentials.js';
+
+type ClaudeCredentialsStatus = {
+  authenticated: boolean;
+  email: string | null;
+  method: string | null;
+  error?: string;
+};
+
+export class ClaudeProviderAuth implements IProviderAuth {
+  /**
+   * Checks whether the Claude Code CLI is available on this host.
+   *
+   * NOTE: `cross-spawn.sync` does NOT throw on ENOENT — it returns a result
+   * object with `error` populated. The try/catch alone was always returning
+   * true and every provider appeared "installed". We now require both
+   * `!result.error` and a numeric exit status (0 for `--version`) before
+   * trusting the install.
+   */
+  private checkInstalled(): boolean {
+    const cliPath = process.env.CLAUDE_CLI_PATH || 'claude';
+    try {
+      const result = spawn.sync(cliPath, ['--version'], { stdio: 'ignore', timeout: 5000 });
+      return !result.error && result.status === 0;
+    } catch {
+      return false;
+    }
+  }
+
+  /**
+   * Returns Claude installation and credential status using Claude Code's auth priority.
+   */
+  async getStatus(): Promise<ProviderAuthStatus> {
+    const installed = this.checkInstalled();
+
+    if (!installed) {
+      return {
+        installed,
+        provider: 'claude',
+        authenticated: false,
+        email: null,
+        method: null,
+        error: 'Claude Code CLI is not installed',
+      };
+    }
+
+    const credentials = await this.checkCredentials();
+
+    return {
+      installed,
+      provider: 'claude',
+      authenticated: credentials.authenticated,
+      email: credentials.authenticated ? credentials.email || 'Authenticated' : credentials.email,
+      method: credentials.method,
+      error: credentials.authenticated ? undefined : credentials.error || 'Not authenticated',
+    };
+  }
+
+  /**
+   * Reads Claude settings env values that the CLI can use even when the server process env is empty.
+   */
+  private async loadSettingsEnv(): Promise<Record<string, unknown>> {
+    try {
+      const settingsPath = path.join(os.homedir(), '.claude', 'settings.json');
+      const content = await readFile(settingsPath, 'utf8');
+      const settings = readObjectRecord(JSON.parse(content));
+      return readObjectRecord(settings?.env) ?? {};
+    } catch {
+      return {};
+    }
+  }
+
+  /**
+   * Checks Claude credentials in the same priority order used by Claude Code.
+   */
+  private async checkCredentials(): Promise<ClaudeCredentialsStatus> {
+    // Pixcode-UI-saved credentials win. Users who paste a key into our
+    // Settings > Agents form expect authenticated status immediately,
+    // regardless of env var timing.
+    try {
+      const creds = await getProviderCredentials('claude');
+      if (creds?.apiKey) {
+        const label = creds.baseUrl
+          ? `API Key · ${(() => { try { return new URL(creds.baseUrl).host; } catch { return creds.baseUrl; } })()}`
+          : 'API Key Auth';
+        return { authenticated: true, email: label, method: 'pixcode_store' };
+      }
+    } catch { /* fall through */ }
+
+    if (process.env.ANTHROPIC_API_KEY?.trim()) {
+      return { authenticated: true, email: 'API Key Auth', method: 'api_key' };
+    }
+
+    const settingsEnv = await this.loadSettingsEnv();
+    if (readOptionalString(settingsEnv.ANTHROPIC_API_KEY)) {
+      return { authenticated: true, email: 'API Key Auth', method: 'api_key' };
+    }
+
+    if (readOptionalString(settingsEnv.ANTHROPIC_AUTH_TOKEN)) {
+      return { authenticated: true, email: 'Configured via settings.json', method: 'api_key' };
+    }
+
+    try {
+      const credPath = path.join(os.homedir(), '.claude', '.credentials.json');
+      const content = await readFile(credPath, 'utf8');
+      const creds = readObjectRecord(JSON.parse(content)) ?? {};
+      const oauth = readObjectRecord(creds.claudeAiOauth);
+      const accessToken = readOptionalString(oauth?.accessToken);
+
+      if (accessToken) {
+        const expiresAt = typeof oauth?.expiresAt === 'number' ? oauth.expiresAt : undefined;
+        const email = readOptionalString(creds.email) ?? readOptionalString(creds.user) ?? null;
+        if (!expiresAt || Date.now() < expiresAt) {
+          return {
+            authenticated: true,
+            email,
+            method: 'credentials_file',
+          };
+        }
+
+        return {
+          authenticated: false,
+          email,
+          method: 'credentials_file',
+          error: 'OAuth token has expired. Please re-authenticate with claude login',
+        };
+      }
+
+      return { authenticated: false, email: null, method: null };
+    } catch {
+      return { authenticated: false, email: null, method: null };
+    }
+  }
+}