@qodalis/cli-server-node 1.0.0-beta.5 → 1.0.0-beta.6

package/dist/src/auth/cli-server-auth.js

@@ -0,0 +1,143 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CliServerPermissions = void 0;
+exports.isOriginAllowed = isOriginAllowed;
+exports.trustedProxyHops = trustedProxyHops;
+exports.clientAddress = clientAddress;
+exports.requestOrigin = requestOrigin;
+exports.isSameOrigin = isSameOrigin;
+/** Server permissions enforced when the users plugin protects the server. */
+exports.CliServerPermissions = {
+    CommandsExecute: 'commands:execute',
+    FilesRead: 'files:read',
+    FilesWrite: 'files:write',
+    DataQuery: 'data:query',
+    JobsRead: 'jobs:read',
+    JobsManage: 'jobs:manage',
+    LogsRead: 'logs:read',
+    ShellExecute: 'shell:execute',
+    AdminAccess: 'admin:access',
+};
+/**
+ * Exact origin match. An entry ending in `:*` matches any port of that
+ * scheme+host (e.g. `http://127.0.0.1:*`).
+ */
+function isOriginAllowed(origin, allowed) {
+    if (!origin || !allowed || allowed.length === 0)
+        return false;
+    const o = origin.toLowerCase().replace(/\/+$/, '');
+    return allowed.some((entry) => {
+        const e = entry.toLowerCase().replace(/\/+$/, '');
+        if (e.endsWith(':*')) {
+            const base = e.slice(0, -2);
+            return o === base || (o.startsWith(base + ':') && /^\d+$/.test(o.slice(base.length + 1)));
+        }
+        return o === e;
+    });
+}
+/**
+ * Number of trusted reverse-proxy hops for a `trustProxy` setting:
+ * `false`/`0`/absent → 0 (untrusted), `true` → 1, a number n → n (values
+ * below 1 other than 0 count as 1).
+ */
+function trustedProxyHops(trustProxy) {
+    if (typeof trustProxy === 'number') {
+        if (trustProxy === 0)
+            return 0;
+        return trustProxy >= 1 ? Math.floor(trustProxy) : 1;
+    }
+    return trustProxy ? 1 : 0;
+}
+/**
+ * The `X-Forwarded-*` entry behind `hops` trusted proxies (for
+ * `X-Forwarded-For`: the client): index `len - hops` (with one hop, the
+ * rightmost entry, appended by the trusted proxy; leftmost entries are
+ * client-controlled). The leftmost entry when the list is shorter than `hops`;
+ * undefined when the header is absent or the selected entry is empty.
+ */
+function forwardedEntry(header, hops) {
+    if (hops <= 0 || header === undefined)
+        return undefined;
+    const entries = (Array.isArray(header) ? header.join(',') : header).split(',').map((e) => e.trim());
+    return entries[Math.max(0, entries.length - hops)] || undefined;
+}
+/**
+ * The client address: the socket address, or with `trustProxy` (a hop count,
+ * `true` = 1) the `X-Forwarded-For` entry at index `len - hops`.
+ */
+function clientAddress(req, trustProxy) {
+    return forwardedEntry(req.headers['x-forwarded-for'], trustedProxyHops(trustProxy)) ?? req.socket?.remoteAddress ?? 'unknown';
+}
+const DEFAULT_PORTS = { http: '80', https: '443' };
+function firstHeader(value) {
+    const raw = Array.isArray(value) ? value[0] : value;
+    const first = raw?.split(',')[0]?.trim();
+    return first || undefined;
+}
+/** `scheme://host:port`, lower-cased, explicit port (http:80, https:443); `ws`/`wss` map to `http`/`https`. */
+function normalizeOrigin(scheme, hostPort) {
+    let s = scheme.toLowerCase().replace(/:$/, '');
+    if (s === 'ws')
+        s = 'http';
+    if (s === 'wss')
+        s = 'https';
+    if (!DEFAULT_PORTS[s])
+        return undefined;
+    try {
+        const url = new URL(`${s}://${hostPort}`);
+        if (url.username || url.password || (url.pathname && url.pathname !== '/') || url.search || url.hash)
+            return undefined;
+        return `${s}://${url.hostname.toLowerCase()}:${url.port || DEFAULT_PORTS[s]}`;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Trusted proxy hops for the forwarded headers: from `trustProxy`, or — when it
+ * is omitted and the Express app's `trust proxy` setting trusts the socket — that
+ * setting's hop count (a number), otherwise 1.
+ */
+function proxyHops(req, trustProxy) {
+    if (trustProxy !== undefined)
+        return trustedProxyHops(trustProxy);
+    const fn = req.app?.get?.('trust proxy fn');
+    if (typeof fn !== 'function' || !fn(req.socket?.remoteAddress, 0))
+        return 0;
+    const setting = req.app?.get?.('trust proxy');
+    return typeof setting === 'number' ? trustedProxyHops(setting) || 1 : 1;
+}
+/**
+ * The request's own origin (`scheme://host:port`, normalized): the scheme from
+ * the socket (TLS or not) and the `Host` header. Behind a trusted proxy
+ * (`trustProxy`, or the Express app's `trust proxy` setting when omitted)
+ * `X-Forwarded-Proto` / `X-Forwarded-Host` win, read like `X-Forwarded-For`:
+ * the entry at index `len - hops` (the rightmost with one hop; the leftmost
+ * when the list is shorter; an empty entry is ignored).
+ */
+function requestOrigin(req, trustProxy) {
+    const hops = proxyHops(req, trustProxy);
+    const scheme = forwardedEntry(req.headers['x-forwarded-proto'], hops) || (req.socket?.encrypted ? 'https' : 'http');
+    const host = forwardedEntry(req.headers['x-forwarded-host'], hops) || firstHeader(req.headers['host']);
+    return host ? normalizeOrigin(scheme, host) : undefined;
+}
+/**
+ * True when `origin` is the request's own origin (e.g. the bundled admin
+ * dashboard served by this server). Same-origin requests are not cross-site
+ * and always pass Origin/CSRF checks. Case-insensitive; default ports normalized.
+ */
+function isSameOrigin(origin, req, trustProxy) {
+    if (!origin || origin === 'null')
+        return false;
+    let o;
+    try {
+        const url = new URL(origin);
+        o = normalizeOrigin(url.protocol, url.host);
+    }
+    catch {
+        return false;
+    }
+    const own = requestOrigin(req, trustProxy);
+    return !!o && !!own && o === own;
+}
+//# sourceMappingURL=cli-server-auth.js.map

package/dist/src/auth/cli-server-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-server-auth.js","sourceRoot":"","sources":["../../../src/auth/cli-server-auth.ts"],"names":[],"mappings":";;;AAsGA,0CAWC;AAOD,4CAMC;AAmBD,sCAKC;AAsDD,sCAKC;AAOD,oCAWC;AA9ID,6EAA6E;AAChE,QAAA,oBAAoB,GAAG;IAChC,eAAe,EAAE,kBAAkB;IACnC,SAAS,EAAE,YAAY;IACvB,UAAU,EAAE,aAAa;IACzB,SAAS,EAAE,YAAY;IACvB,QAAQ,EAAE,WAAW;IACrB,UAAU,EAAE,aAAa;IACzB,QAAQ,EAAE,WAAW;IACrB,YAAY,EAAE,eAAe;IAC7B,WAAW,EAAE,cAAc;CACrB,CAAC;AAEX;;;GAGG;AACH,SAAgB,eAAe,CAAC,MAA0B,EAAE,OAAsC;IAC9F,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1B,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5B,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,UAAwC;IACrE,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjC,IAAI,UAAU,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,MAAqC,EAAE,IAAY;IACvE,IAAI,IAAI,IAAI,CAAC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,SAAS,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CACzB,GAA2G,EAC3G,UAAwC;IAExC,OAAO,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,SAAS,CAAC;AAClI,CAAC;AAUD,MAAM,aAAa,GAA2B,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAE3E,SAAS,WAAW,CAAC,KAAoC;IACrD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACpD,MAAM,KAAK,GAAG,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACzC,OAAO,KAAK,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED,+GAA+G;AAC/G,SAAS,eAAe,CAAC,MAAc,EAAE,QAAgB;IACrD,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,IAAI;QAAE,CAAC,GAAG,MAAM,CAAC;IAC3B,IAAI,CAAC,KAAK,KAAK;QAAE,CAAC,GAAG,OAAO,CAAC;IAC7B,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC;QAC1C,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QACvH,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,GAAuB,EAAE,UAAwC;IAChF,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAClE,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,OAAO,EAAE,KAAK,UAAU,IAAI,CAAE,EAAuD,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAClI,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;IAC9C,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,aAAa,CAAC,GAAuB,EAAE,UAA6B;IAChF,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACpH,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACvG,OAAO,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,MAA0B,EAAE,GAAuB,EAAE,UAA6B;IAC3G,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAqB,CAAC;IAC1B,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;AACrC,CAAC"}

package/dist/src/auth/index.d.ts

@@ -0,0 +1,4 @@
+export { CliServerAuthContext, CliServerAuthError, CliServerAuditEntry, CliServerSessionEvent, ICliServerAuth, CliServerPermissions, isOriginAllowed, isSameOrigin, requestOrigin, clientAddress, trustedProxyHops, } from './cli-server-auth';
+export { createServerAuthGate, ServerAuthGateOptions, requiredServerPermissions, processorPermissions, normalizePath, } from './cli-server-auth-gate';
+export { authorizeWsUpgrade, rejectUpgrade, WsUpgradeAuthOptions, WsUpgradeAuthResult } from './ws-upgrade-auth';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,aAAa,EACb,aAAa,EACb,gBAAgB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,aAAa,GAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/src/auth/index.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rejectUpgrade = exports.authorizeWsUpgrade = exports.normalizePath = exports.processorPermissions = exports.requiredServerPermissions = exports.createServerAuthGate = exports.trustedProxyHops = exports.clientAddress = exports.requestOrigin = exports.isSameOrigin = exports.isOriginAllowed = exports.CliServerPermissions = void 0;
+var cli_server_auth_1 = require("./cli-server-auth");
+Object.defineProperty(exports, "CliServerPermissions", { enumerable: true, get: function () { return cli_server_auth_1.CliServerPermissions; } });
+Object.defineProperty(exports, "isOriginAllowed", { enumerable: true, get: function () { return cli_server_auth_1.isOriginAllowed; } });
+Object.defineProperty(exports, "isSameOrigin", { enumerable: true, get: function () { return cli_server_auth_1.isSameOrigin; } });
+Object.defineProperty(exports, "requestOrigin", { enumerable: true, get: function () { return cli_server_auth_1.requestOrigin; } });
+Object.defineProperty(exports, "clientAddress", { enumerable: true, get: function () { return cli_server_auth_1.clientAddress; } });
+Object.defineProperty(exports, "trustedProxyHops", { enumerable: true, get: function () { return cli_server_auth_1.trustedProxyHops; } });
+var cli_server_auth_gate_1 = require("./cli-server-auth-gate");
+Object.defineProperty(exports, "createServerAuthGate", { enumerable: true, get: function () { return cli_server_auth_gate_1.createServerAuthGate; } });
+Object.defineProperty(exports, "requiredServerPermissions", { enumerable: true, get: function () { return cli_server_auth_gate_1.requiredServerPermissions; } });
+Object.defineProperty(exports, "processorPermissions", { enumerable: true, get: function () { return cli_server_auth_gate_1.processorPermissions; } });
+Object.defineProperty(exports, "normalizePath", { enumerable: true, get: function () { return cli_server_auth_gate_1.normalizePath; } });
+var ws_upgrade_auth_1 = require("./ws-upgrade-auth");
+Object.defineProperty(exports, "authorizeWsUpgrade", { enumerable: true, get: function () { return ws_upgrade_auth_1.authorizeWsUpgrade; } });
+Object.defineProperty(exports, "rejectUpgrade", { enumerable: true, get: function () { return ws_upgrade_auth_1.rejectUpgrade; } });
+//# sourceMappingURL=index.js.map

package/dist/src/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":";;;AAAA,qDAY2B;AANvB,uHAAA,oBAAoB,OAAA;AACpB,kHAAA,eAAe,OAAA;AACf,+GAAA,YAAY,OAAA;AACZ,gHAAA,aAAa,OAAA;AACb,gHAAA,aAAa,OAAA;AACb,mHAAA,gBAAgB,OAAA;AAEpB,+DAMgC;AAL5B,4HAAA,oBAAoB,OAAA;AAEpB,iIAAA,yBAAyB,OAAA;AACzB,4HAAA,oBAAoB,OAAA;AACpB,qHAAA,aAAa,OAAA;AAEjB,qDAAiH;AAAxG,qHAAA,kBAAkB,OAAA;AAAE,gHAAA,aAAa,OAAA"}

package/dist/src/auth/ws-upgrade-auth.d.ts

@@ -0,0 +1,30 @@
+import type { IncomingMessage } from 'http';
+import type { Duplex } from 'stream';
+import { CliServerAuthContext, ICliServerAuth } from './cli-server-auth';
+export interface WsUpgradeAuthOptions {
+    auth?: ICliServerAuth;
+    allowedOrigins?: string[];
+    /** Honour `X-Forwarded-Proto`/`X-Forwarded-Host` when deciding whether the Origin is the server's own. */
+    trustProxy?: boolean | number;
+    /** Permission required on top of authentication (protected mode only). */
+    permission?: string;
+}
+export type WsUpgradeAuthResult = {
+    ok: true;
+    ctx?: CliServerAuthContext;
+} | {
+    ok: false;
+    status: 401 | 403;
+};
+/**
+ * Authorizes a WebSocket upgrade:
+ * - when `allowedOrigins` is set, a present `Origin` header must be allowed or
+ *   be the server's own origin (same-origin, e.g. the bundled dashboard) (403);
+ * - with a protecting auth provider, a valid single-use `?ticket=` is required
+ *   (401) and the optional permission is checked (403);
+ * - otherwise a ticket, when present, only attaches an identity.
+ */
+export declare function authorizeWsUpgrade(request: IncomingMessage, url: URL, options: WsUpgradeAuthOptions): Promise<WsUpgradeAuthResult>;
+/** Rejects an upgrade with a bare HTTP status response. */
+export declare function rejectUpgrade(socket: Duplex, status: number): void;
+//# sourceMappingURL=ws-upgrade-auth.d.ts.map

package/dist/src/auth/ws-upgrade-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws-upgrade-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/ws-upgrade-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAiC,MAAM,mBAAmB,CAAC;AAExG,MAAM,WAAW,oBAAoB;IACjC,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,0GAA0G;IAC1G,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC9B,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,mBAAmB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,CAAC,EAAE,oBAAoB,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE,CAAC;AAEvC;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACpC,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,oBAAoB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAyB9B;AAED,2DAA2D;AAC3D,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAQlE"}

package/dist/src/auth/ws-upgrade-auth.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authorizeWsUpgrade = authorizeWsUpgrade;
+exports.rejectUpgrade = rejectUpgrade;
+const cli_server_auth_1 = require("./cli-server-auth");
+/**
+ * Authorizes a WebSocket upgrade:
+ * - when `allowedOrigins` is set, a present `Origin` header must be allowed or
+ *   be the server's own origin (same-origin, e.g. the bundled dashboard) (403);
+ * - with a protecting auth provider, a valid single-use `?ticket=` is required
+ *   (401) and the optional permission is checked (403);
+ * - otherwise a ticket, when present, only attaches an identity.
+ */
+async function authorizeWsUpgrade(request, url, options) {
+    const origin = request.headers.origin;
+    if (options.allowedOrigins && options.allowedOrigins.length > 0 && origin !== undefined) {
+        if (!(0, cli_server_auth_1.isOriginAllowed)(origin, options.allowedOrigins) && !(0, cli_server_auth_1.isSameOrigin)(origin, request, options.trustProxy ?? false)) {
+            return { ok: false, status: 403 };
+        }
+    }
+    const auth = options.auth;
+    if (!auth) {
+        return { ok: true };
+    }
+    const ticket = url.searchParams.get('ticket');
+    const ctx = ticket ? await auth.consumeTicket(ticket).catch(() => undefined) : undefined;
+    if (!auth.protectServer) {
+        return { ok: true, ctx };
+    }
+    if (!ctx) {
+        return { ok: false, status: 401 };
+    }
+    if (options.permission && !auth.hasPermission(ctx, options.permission)) {
+        return { ok: false, status: 403 };
+    }
+    return { ok: true, ctx };
+}
+/** Rejects an upgrade with a bare HTTP status response. */
+function rejectUpgrade(socket, status) {
+    const text = status === 401 ? 'Unauthorized' : status === 403 ? 'Forbidden' : status === 404 ? 'Not Found' : 'Error';
+    try {
+        socket.write(`HTTP/1.1 ${status} ${text}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`);
+    }
+    catch {
+        // ignore
+    }
+    socket.destroy();
+}
+//# sourceMappingURL=ws-upgrade-auth.js.map

package/dist/src/auth/ws-upgrade-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws-upgrade-auth.js","sourceRoot":"","sources":["../../../src/auth/ws-upgrade-auth.ts"],"names":[],"mappings":";;AAyBA,gDA6BC;AAGD,sCAQC;AA/DD,uDAAwG;AAexG;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CACpC,OAAwB,EACxB,GAAQ,EACR,OAA6B;IAE7B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;IACtC,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACtF,IAAI,CAAC,IAAA,iCAAe,EAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,IAAA,8BAAY,EAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC,EAAE,CAAC;YAClH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACtC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzF,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC7B,CAAC;AAED,2DAA2D;AAC3D,SAAgB,aAAa,CAAC,MAAc,EAAE,MAAc;IACxD,MAAM,IAAI,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;IACrH,IAAI,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,YAAY,MAAM,IAAI,IAAI,oDAAoD,CAAC,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACL,SAAS;IACb,CAAC;IACD,MAAM,CAAC,OAAO,EAAE,CAAC;AACrB,CAAC"}

package/dist/src/controllers/cli-controller.d.ts

@@ -1,10 +1,11 @@
 import { Router } from 'express';
 import { ICliCommandRegistry, ICliCommandExecutorService } from '../services';
+import { CapabilitiesOptions } from './cli-version-controller';
 /**
  * Creates an Express router for the v1 CLI API with version, capabilities, commands, and execute endpoints.
  * @param registry - Command registry to list available processors.
  * @param executor - Service that dispatches commands to processors.
  * @returns Configured Express router.
  */
-export declare function createCliController(registry: ICliCommandRegistry, executor: ICliCommandExecutorService): Router;
+export declare function createCliController(registry: ICliCommandRegistry, executor: ICliCommandExecutorService, options?: CapabilitiesOptions): Router;
 //# sourceMappingURL=cli-controller.d.ts.map

package/dist/src/controllers/cli-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-controller.d.ts","sourceRoot":"","sources":["../../../src/controllers/cli-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAIjC,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAM9E;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAC/B,QAAQ,EAAE,mBAAmB,EAC7B,QAAQ,EAAE,0BAA0B,GACrC,MAAM,CA+GR"}
+{"version":3,"file":"cli-controller.d.ts","sourceRoot":"","sources":["../../../src/controllers/cli-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAIjC,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAE9E,OAAO,EAAE,mBAAmB,EAA4B,MAAM,0BAA0B,CAAC;AAKzF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAC/B,QAAQ,EAAE,mBAAmB,EAC7B,QAAQ,EAAE,0BAA0B,EACpC,OAAO,CAAC,EAAE,mBAAmB,GAC9B,MAAM,CAmHR"}

package/dist/src/controllers/cli-controller.js

@@ -38,6 +38,7 @@ const express_1 = require("express");
 const os = __importStar(require("os"));
 const abstractions_1 = require("../abstractions");
 const logger_1 = require("../utils/logger");
+const cli_version_controller_1 = require("./cli-version-controller");
 const logger = (0, logger_1.createLogger)('CliController');
 const SERVER_VERSION = '1.0.0';
 /**
@@ -46,7 +47,7 @@ const SERVER_VERSION = '1.0.0';
  * @param executor - Service that dispatches commands to processors.
  * @returns Configured Express router.
  */
-function createCliController(registry, executor) {
+function createCliController(registry, executor, options) {
     const router = (0, express_1.Router)();
     router.get('/version', (_req, res) => {
         res.json({ version: SERVER_VERSION });
@@ -62,7 +63,7 @@ function createCliController(registry, executor) {
             ? 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'
             : '/bin/bash';
         res.json({
-            shell: true,
+            ...(0, cli_version_controller_1.resolveShellCapabilities)(options),
             os: detectedOs,
             shellPath,
             version: SERVER_VERSION,
@@ -75,6 +76,10 @@ function createCliController(registry, executor) {
     });
     router.post('/execute', async (req, res) => {
         const command = req.body;
+        if (typeof command?.command !== 'string') {
+            res.status(400).json({ error: 'command is required' });
+            return;
+        }
         logger.debug('Executing command: %s', command.command);
         const abortController = new AbortController();
         req.on('close', () => abortController.abort());

package/dist/src/controllers/cli-controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-controller.js","sourceRoot":"","sources":["../../../src/controllers/cli-controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBA,kDAkHC;AAlID,qCAAiC;AACjC,uCAAyB;AACzB,kDAA6F;AAG7F,4CAA+C;AAE/C,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,eAAe,CAAC,CAAC;AAC7C,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B;;;;;GAKG;AACH,SAAgB,mBAAmB,CAC/B,QAA6B,EAC7B,QAAoC;IAEpC,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IAExB,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACjC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,UAAU,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO;YACxC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,QAAQ;gBACxB,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,OAAO,CAAC;QAElB,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QAChE,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO;YACvC,CAAC,CAAC,gEAAgE;YAClE,CAAC,CAAC,WAAW,CAAC;QAElB,GAAG,CAAC,IAAI,CAAC;YACL,KAAK,EAAE,IAAI;YACX,EAAE,EAAE,UAAU;YACd,SAAS;YACT,OAAO,EAAE,cAAc;YACvB,SAAS,EAAE,IAAI;SAClB,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAEvD,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC;QAE/C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;QAC9E,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAE9D,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC;QAEtC,cAAc;QACd,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAC1C,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;QACzC,GAAG,CAAC,YAAY,EAAE,CAAC;QAEnB,MAAM,IAAI,GAAG,CAAC,MAA2B,EAAE,EAAE;YACzC,GAAG,CAAC,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC,CAAC;QAEF,IAAI,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,CAAC,aAAa,CACpC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CACpE,CAAC;YAEF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,GAAG,CAAC,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,oBAAoB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;gBAC3G,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACX,CAAC;YAED,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChC,GAAG,CAAC,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,YAAY,OAAO,CAAC,OAAO,0BAA0B,EAAE,CAAC,MAAM,CAAC,CAAC;gBAC3H,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACX,CAAC;YAED,IAAI,QAAgB,CAAC;YAErB,IAAI,IAAA,8BAAe,EAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,QAAQ,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACxE,CAAC;iBAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE,CAAC;gBACzC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACxE,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACpC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACjB,CAAC;gBACD,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC5D,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBACtC,QAAQ,GAAG,CAAC,CAAC;YACjB,CAAC;YAED,GAAG,CAAC,KAAK,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACJ,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;gBACtF,GAAG,CAAC,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,4BAA4B,GAAG,CAAC,OAAO,IAAI,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;YAC1H,CAAC;QACL,CAAC;QAED,GAAG,CAAC,GAAG,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,mFAAmF;AACnF,SAAS,eAAe,CAAC,SAA+B;IACpD,MAAM,UAAU,GAA+B;QAC3C,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,OAAO,EAAE,SAAS,CAAC,OAAO;KAC7B,CAAC;IAEF,IAAI,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC/B,UAAU,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAC5C,CAAC,CAAC,EAA0C,EAAE,CAAC,CAAC;YAC5C,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,YAAY,EAAE,CAAC,CAAC,YAAY;SAC/B,CAAC,CACL,CAAC;IACN,CAAC;IAED,IAAI,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC/B,UAAU,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC"}
+{"version":3,"file":"cli-controller.js","sourceRoot":"","sources":["../../../src/controllers/cli-controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,kDAuHC;AAxID,qCAAiC;AACjC,uCAAyB;AACzB,kDAA6F;AAG7F,4CAA+C;AAC/C,qEAAyF;AAEzF,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,eAAe,CAAC,CAAC;AAC7C,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B;;;;;GAKG;AACH,SAAgB,mBAAmB,CAC/B,QAA6B,EAC7B,QAAoC,EACpC,OAA6B;IAE7B,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IAExB,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACjC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,UAAU,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO;YACxC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,QAAQ;gBACxB,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,OAAO,CAAC;QAElB,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QAChE,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO;YACvC,CAAC,CAAC,gEAAgE;YAClE,CAAC,CAAC,WAAW,CAAC;QAElB,GAAG,CAAC,IAAI,CAAC;YACL,GAAG,IAAA,iDAAwB,EAAC,OAAO,CAAC;YACpC,EAAE,EAAE,UAAU;YACd,SAAS;YACT,OAAO,EAAE,cAAc;YACvB,SAAS,EAAE,IAAI;SAClB,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;QACzB,IAAI,OAAO,OAAO,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACvD,OAAO;QACX,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAEvD,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC;QAE/C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;QAC9E,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAE9D,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC;QAEtC,cAAc;QACd,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAC1C,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;QACzC,GAAG,CAAC,YAAY,EAAE,CAAC;QAEnB,MAAM,IAAI,GAAG,CAAC,MAA2B,EAAE,EAAE;YACzC,GAAG,CAAC,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC,CAAC;QAEF,IAAI,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,CAAC,aAAa,CACpC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CACpE,CAAC;YAEF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,GAAG,CAAC,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,oBAAoB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;gBAC3G,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACX,CAAC;YAED,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChC,GAAG,CAAC,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,YAAY,OAAO,CAAC,OAAO,0BAA0B,EAAE,CAAC,MAAM,CAAC,CAAC;gBAC3H,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACX,CAAC;YAED,IAAI,QAAgB,CAAC;YAErB,IAAI,IAAA,8BAAe,EAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,QAAQ,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACxE,CAAC;iBAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE,CAAC;gBACzC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACxE,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACpC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACjB,CAAC;gBACD,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC5D,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBACtC,QAAQ,GAAG,CAAC,CAAC;YACjB,CAAC;YAED,GAAG,CAAC,KAAK,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACJ,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;gBACtF,GAAG,CAAC,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,4BAA4B,GAAG,CAAC,OAAO,IAAI,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;YAC1H,CAAC;QACL,CAAC;QAED,GAAG,CAAC,GAAG,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,mFAAmF;AACnF,SAAS,eAAe,CAAC,SAA+B;IACpD,MAAM,UAAU,GAA+B;QAC3C,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,OAAO,EAAE,SAAS,CAAC,OAAO;KAC7B,CAAC;IAEF,IAAI,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC/B,UAAU,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAC5C,CAAC,CAAC,EAA0C,EAAE,CAAC,CAAC;YAC5C,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,YAAY,EAAE,CAAC,CAAC,YAAY;SAC/B,CAAC,CACL,CAAC;IACN,CAAC;IAED,IAAI,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC/B,UAAU,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC"}

package/dist/src/controllers/cli-version-controller.d.ts

@@ -1,7 +1,18 @@
 import { Router } from 'express';
+/** Shell part of `/capabilities`: `shellAuth` only when the shell is enabled. */
+export interface ShellCapabilities {
+    shell: boolean;
+    shellAuth?: 'users' | 'token' | 'custom' | 'anonymous' | 'locked';
+}
+export interface CapabilitiesOptions {
+    /** Live shell state; when omitted `/capabilities` reports `shell: true` (legacy). */
+    shellCapabilities?: () => ShellCapabilities;
+}
+/** Resolves the shell fields of `/capabilities`. */
+export declare function resolveShellCapabilities(options?: CapabilitiesOptions): ShellCapabilities;
 /**
  * Creates an Express router for API version discovery and server capabilities.
  * @returns Router with `/versions` and `/capabilities` endpoints.
  */
-export declare function createCliVersionController(): Router;
+export declare function createCliVersionController(options?: CapabilitiesOptions): Router;
 //# sourceMappingURL=cli-version-controller.d.ts.map

package/dist/src/controllers/cli-version-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-version-controller.d.ts","sourceRoot":"","sources":["../../../src/controllers/cli-version-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAMjC;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAqCnD"}
+{"version":3,"file":"cli-version-controller.d.ts","sourceRoot":"","sources":["../../../src/controllers/cli-version-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAMjC,iFAAiF;AACjF,MAAM,WAAW,iBAAiB;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAC;CACrE;AAED,MAAM,WAAW,mBAAmB;IAChC,qFAAqF;IACrF,iBAAiB,CAAC,EAAE,MAAM,iBAAiB,CAAC;CAC/C;AAED,oDAAoD;AACpD,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,iBAAiB,CAEzF;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,MAAM,CAqChF"}

package/dist/src/controllers/cli-version-controller.js

@@ -33,15 +33,20 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveShellCapabilities = resolveShellCapabilities;
 exports.createCliVersionController = createCliVersionController;
 const express_1 = require("express");
 const os = __importStar(require("os"));
 const SERVER_VERSION = '2.0.0';
+/** Resolves the shell fields of `/capabilities`. */
+function resolveShellCapabilities(options) {
+    return options?.shellCapabilities ? options.shellCapabilities() : { shell: true };
+}
 /**
  * Creates an Express router for API version discovery and server capabilities.
  * @returns Router with `/versions` and `/capabilities` endpoints.
  */
-function createCliVersionController() {
+function createCliVersionController(options) {
     const router = (0, express_1.Router)();
     router.get('/versions', (_req, res) => {
         res.json({
@@ -64,7 +69,7 @@ function createCliVersionController() {
             ? 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'
             : '/bin/bash';
         res.json({
-            shell: true,
+            ...resolveShellCapabilities(options),
             os: detectedOs,
             shellPath,
             version: SERVER_VERSION,

package/dist/src/controllers/cli-version-controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-version-controller.js","sourceRoot":"","sources":["../../../src/controllers/cli-version-controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,gEAqCC;AA/CD,qCAAiC;AACjC,uCAAyB;AAGzB,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B;;;GAGG;AACH,SAAgB,0BAA0B;IACtC,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IAExB,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAClC,GAAG,CAAC,IAAI,CAAC;YACL,iBAAiB,EAAE,CAAC,CAAC,CAAC;YACtB,gBAAgB,EAAE,CAAC;YACnB,aAAa,EAAE,cAAc;SAChC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACjC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,UAAU,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO;YACxC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,QAAQ;gBACxB,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,OAAO,CAAC;QAElB,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QAChE,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO;YACvC,CAAC,CAAC,gEAAgE;YAClE,CAAC,CAAC,WAAW,CAAC;QAElB,GAAG,CAAC,IAAI,CAAC;YACL,KAAK,EAAE,IAAI;YACX,EAAE,EAAE,UAAU;YACd,SAAS;YACT,OAAO,EAAE,cAAc;YACvB,SAAS,EAAE,IAAI;SAClB,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC"}
+{"version":3,"file":"cli-version-controller.js","sourceRoot":"","sources":["../../../src/controllers/cli-version-controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,4DAEC;AAMD,gEAqCC;AA/DD,qCAAiC;AACjC,uCAAyB;AAGzB,MAAM,cAAc,GAAG,OAAO,CAAC;AAa/B,oDAAoD;AACpD,SAAgB,wBAAwB,CAAC,OAA6B;IAClE,OAAO,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACtF,CAAC;AAED;;;GAGG;AACH,SAAgB,0BAA0B,CAAC,OAA6B;IACpE,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IAExB,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAClC,GAAG,CAAC,IAAI,CAAC;YACL,iBAAiB,EAAE,CAAC,CAAC,CAAC;YACtB,gBAAgB,EAAE,CAAC;YACnB,aAAa,EAAE,cAAc;SAChC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACjC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,UAAU,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO;YACxC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,QAAQ;gBACxB,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,OAAO,CAAC;QAElB,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QAChE,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO;YACvC,CAAC,CAAC,gEAAgE;YAClE,CAAC,CAAC,WAAW,CAAC;QAElB,GAAG,CAAC,IAAI,CAAC;YACL,GAAG,wBAAwB,CAAC,OAAO,CAAC;YACpC,EAAE,EAAE,UAAU;YACd,SAAS;YACT,OAAO,EAAE,cAAc;YACvB,SAAS,EAAE,IAAI;SAClB,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/src/create-cli-server.d.ts

@@ -2,6 +2,8 @@ import { Express, Router } from 'express';
 import cors from 'cors';
 import { CliCommandRegistry, CliCommandExecutorService, CliEventSocketManager, CliLogSocketManager } from './services';
 import { CliBuilder } from './extensions';
+import { ICliServerAuth } from './auth/cli-server-auth';
+import { CliShellOptions } from './services/cli-shell-options';
 /**
  * Generic interface for plugin results that can be auto-mounted.
  * Plugins expose a `prefix` and `router`; some also have a
@@ -12,13 +14,53 @@ export interface MountablePlugin {
     router: Router;
     dashboardPrefix?: string;
     dashboardRouter?: Router;
+    /**
+     * Auth provider exposed by the users plugin. Mounting such a plugin
+     * installs it: when `protectServer` is on, every server route and socket
+     * then requires a users session.
+     */
+    serverAuth?: ICliServerAuth;
+    /** Routes that stay public under server protection, as `"METHOD /path"` (e.g. a plugin's login). */
+    publicRoutes?: string[];
 }
 /** Options for creating a standalone CLI server instance. */
 export interface CliServerOptions {
     /** Base path for CLI routes. Defaults to '/api/qcli'. */
     basePath?: string;
-    /** CORS configuration. Pass `true` for permissive, `false` to disable, or a cors options object. */
+    /**
+     * CORS configuration. `true` = permissive (any origin, no credentials),
+     * `false` = disabled, or a cors options object. When omitted, CORS is
+     * enabled only for `allowedOrigins` (disabled if none are set).
+     */
     cors?: boolean | cors.CorsOptions;
+    /**
+     * Origins allowed for CORS and WebSocket upgrades (exact match; `http://host:*`
+     * matches any port). Every WS upgrade with an `Origin` header is checked.
+     */
+    allowedOrigins?: string[];
+    /**
+     * Accept interactive shell WebSocket sessions (default false). When enabled,
+     * access is decided by one mode: users plugin mounted (ticket +
+     * `shell:execute`), `shell.token`, `shell.authorize` or `shell.allowAnonymous`.
+     * With none of them the shell is locked (every connection closed with 4401).
+     */
+    enableShell?: boolean;
+    /** Remote shell security: access mode, limits, timeouts, cwd, shell binary, environment. */
+    shell?: CliShellOptions;
+    /**
+     * Behind reverse proxies: the number of trusted proxy hops (`true` = 1,
+     * `false`/0 = none, the default). The client IP (Express `req.ip`, the
+     * shell's per-address limits) is the `X-Forwarded-For` entry at index
+     * `len - hops` (with one hop, the rightmost entry, appended by the trusted
+     * proxy); the leftmost entry when the list is shorter, the socket address
+     * when the header is absent. `X-Forwarded-Proto`/`-Host` are honoured too.
+     */
+    trustProxy?: boolean | number;
+    /**
+     * Auth provider protecting the whole server (e.g. `usersPlugin.serverAuth`).
+     * Can also be installed later with `setAuth()` or by `mountPlugin(usersPlugin)`.
+     */
+    auth?: ICliServerAuth;
     /** Configure processors via the builder. */
     configure?: (builder: CliBuilder) => void;
 }
@@ -48,6 +90,8 @@ export interface CliServerResult {
      * ```
      */
     mountPlugin(plugin: MountablePlugin): void;
+    /** Installs (or removes) the auth provider protecting server routes and sockets. */
+    setAuth(auth: ICliServerAuth | undefined): void;
 }
 export declare function createCliServer(options?: CliServerOptions): CliServerResult;
 //# sourceMappingURL=create-cli-server.d.ts.map

package/dist/src/create-cli-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-cli-server.d.ts","sourceRoot":"","sources":["../../src/create-cli-server.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACvH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAQ1C;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC5B;AAID,6DAA6D;AAC7D,MAAM,WAAW,gBAAgB;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC;IAClC,4CAA4C;IAC5C,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,IAAI,CAAC;CAC7C;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC5B,GAAG,EAAE,OAAO,CAAC;IACb,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,QAAQ,EAAE,yBAAyB,CAAC;IACpC,kBAAkB,EAAE,qBAAqB,CAAC;IAC1C,gBAAgB,EAAE,mBAAmB,CAAC;IACtC;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;CAC9C;AAED,wBAAgB,eAAe,CAAC,OAAO,GAAE,gBAAqB,GAAG,eAAe,CA6D/E"}
+{"version":3,"file":"create-cli-server.d.ts","sourceRoot":"","sources":["../../src/create-cli-server.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACvH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAO1C,OAAO,EAAE,cAAc,EAAmD,MAAM,wBAAwB,CAAC;AAEzG,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAG/D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,oGAAoG;IACpG,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAID,6DAA6D;AAC7D,MAAM,WAAW,gBAAgB;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC;IAClC;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC9B;;;OAGG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,IAAI,CAAC;CAC7C;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC5B,GAAG,EAAE,OAAO,CAAC;IACb,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,QAAQ,EAAE,yBAAyB,CAAC;IACpC,kBAAkB,EAAE,qBAAqB,CAAC;IAC1C,gBAAgB,EAAE,mBAAmB,CAAC;IACtC;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;IAC3C,oFAAoF;IACpF,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,SAAS,GAAG,IAAI,CAAC;CACnD;AAED,wBAAgB,eAAe,CAAC,OAAO,GAAE,gBAAqB,GAAG,eAAe,CA6H/E"}

package/dist/src/create-cli-server.js

@@ -14,27 +14,71 @@ const filesystem_controller_1 = require("./controllers/filesystem-controller");
 const cli_server_plugin_filesystem_1 = require("@qodalis/cli-server-plugin-filesystem");
 const cli_server_plugin_data_explorer_1 = require("@qodalis/cli-server-plugin-data-explorer");
 const logger_1 = require("./utils/logger");
+const cli_server_auth_1 = require("./auth/cli-server-auth");
+const cli_server_auth_gate_1 = require("./auth/cli-server-auth-gate");
 const logger = (0, logger_1.createLogger)('Server');
 function createCliServer(options = {}) {
-    const { basePath = '/api/qcli', cors: corsOption = true, configure } = options;
+    const { basePath = '/api/qcli', cors: corsOption, configure, allowedOrigins, enableShell = false, shell, trustProxy = false } = options;
+    if (shell && !enableShell) {
+        logger.warn('shell options are set but enableShell is false: the shell stays disabled');
+    }
     const app = (0, express_1.default)();
-    if (corsOption !== false) {
-        app.use((0, cors_1.default)(corsOption === true ? undefined : corsOption));
+    const proxyHops = (0, cli_server_auth_1.trustedProxyHops)(trustProxy);
+    if (proxyHops > 0) {
+        app.set('trust proxy', proxyHops);
+    }
+    if (corsOption === true) {
+        app.use((0, cors_1.default)());
+    }
+    else if (corsOption && typeof corsOption === 'object') {
+        app.use((0, cors_1.default)(corsOption));
     }
-    app.use(express_1.default.json());
+    else if (corsOption === undefined && allowedOrigins && allowedOrigins.length > 0) {
+        // Same-origin requests (e.g. the bundled admin dashboard) are always allowed.
+        app.use((0, cors_1.default)((req, callback) => {
+            const origin = req.headers.origin;
+            callback(null, {
+                origin: (0, cli_server_auth_1.isOriginAllowed)(origin, allowedOrigins) || (0, cli_server_auth_1.isSameOrigin)(origin, req),
+            });
+        }));
+    }
+    app.use(express_1.default.json({ limit: '1mb' }));
+    // Render body-parser failures (malformed JSON, too large) as JSON `{ error }`
+    app.use((err, _req, res, next) => {
+        if (err && (err.type === 'entity.parse.failed' || err.type === 'entity.too.large')) {
+            const status = err.type === 'entity.too.large' ? 413 : 400;
+            res.status(status).json({ error: status === 413 ? 'request body too large' : 'invalid JSON body' });
+            return;
+        }
+        next(err);
+    });
     const registry = new services_1.CliCommandRegistry();
     const builder = new extensions_1.CliBuilder(registry);
+    // Server-wide auth gate (no-op until an auth provider is installed)
+    let serverAuth;
+    const publicRoutes = new Set();
+    app.use((0, cli_server_auth_gate_1.createServerAuthGate)(() => serverAuth, {
+        registry,
+        cliPrefixes: Array.from(new Set(['/api/v1/qcli', (0, cli_server_auth_gate_1.normalizePath)(basePath)])),
+        publicRoutes,
+    }));
     if (configure) {
         configure(builder);
     }
     const executor = new services_1.CliCommandExecutorService(registry);
+    const eventSocketManager = new services_1.CliEventSocketManager({ enableShell, shell, allowedOrigins, trustProxy });
+    const logSocketManager = new services_1.CliLogSocketManager({ allowedOrigins, trustProxy });
+    const shellCapabilities = () => {
+        const mode = eventSocketManager.shellAuthMode;
+        return mode ? { shell: true, shellAuth: mode } : { shell: false };
+    };
     // Version discovery endpoint
-    app.use('/api/qcli', (0, cli_version_controller_1.createCliVersionController)());
+    app.use('/api/qcli', (0, cli_version_controller_1.createCliVersionController)({ shellCapabilities }));
     // API v1 routes
-    app.use('/api/v1/qcli', (0, cli_controller_1.createCliController)(registry, executor));
+    app.use('/api/v1/qcli', (0, cli_controller_1.createCliController)(registry, executor, { shellCapabilities }));
     // Custom basePath fallback (when user overrides the default)
     if (basePath !== '/api/v1/qcli') {
-        app.use(basePath, (0, cli_controller_1.createCliController)(registry, executor));
+        app.use(basePath, (0, cli_controller_1.createCliController)(registry, executor, { shellCapabilities }));
     }
     // Filesystem API — provider-based
     let fsProvider = builder.fileStorageProvider;
@@ -51,15 +95,32 @@ function createCliServer(options = {}) {
         const deExecutor = new cli_server_plugin_data_explorer_1.DataExplorerExecutor(deBuilder.registry);
         app.use('/api/qcli/data-explorer', (0, cli_server_plugin_data_explorer_1.createDataExplorerController)(deBuilder.registry, deExecutor));
     }
-    const eventSocketManager = new services_1.CliEventSocketManager();
-    const logSocketManager = new services_1.CliLogSocketManager();
     logger.info('CLI server created with %d processors', registry.processors.length);
+    const setAuth = (auth) => {
+        serverAuth = auth;
+        eventSocketManager.setAuth(auth);
+        logSocketManager.setAuth(auth);
+        auth?.attachToServer?.({
+            allowedOrigins,
+            broadcast: (msg) => eventSocketManager.broadcastMessage(msg),
+        });
+    };
+    if (options.auth) {
+        setAuth(options.auth);
+    }
     const mountPlugin = (plugin) => {
+        for (const route of plugin.publicRoutes ?? []) {
+            const [method, ...rest] = route.trim().split(/\s+/);
+            publicRoutes.add(`${method.toUpperCase()} ${(0, cli_server_auth_gate_1.normalizePath)(rest.join(' '))}`);
+        }
+        if (plugin.serverAuth && plugin.serverAuth !== serverAuth) {
+            setAuth(plugin.serverAuth);
+        }
         app.use(plugin.prefix, plugin.router);
         if (plugin.dashboardPrefix && plugin.dashboardRouter) {
             app.use(plugin.dashboardPrefix, plugin.dashboardRouter);
         }
     };
-    return { app, registry, builder, executor, eventSocketManager, logSocketManager, mountPlugin };
+    return { app, registry, builder, executor, eventSocketManager, logSocketManager, mountPlugin, setAuth };
 }
 //# sourceMappingURL=create-cli-server.js.map