@rubytech/create-maxy-code 0.1.306 → 0.1.308

package/payload/platform/plugins/admin/PLUGIN.md

@@ -78,6 +78,7 @@ tools:
 hidden:
   - remote-auth-status
   - remote-auth-set-password
+  - remote-auth-revoke-password
   - qr-generate
   - wifi
 always: true

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -9,6 +9,7 @@ import { resolve, join } from "node:path";
 import { execFileSync } from "node:child_process";
 import { appendFileSync, cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { writeAdminEntry, removeAdminFromAccount } from "../../../../lib/admins-write/dist/index.js";
+import { setAccessPassword as setAccessPasswordHash, clearAccessPassword as clearAccessPasswordHash } from "../../../../lib/admin-access-password/dist/index.js";
 import { embed } from "../../../../lib/embed-client/dist/index.js";
 import { requirePortEnv } from "../../../../lib/require-port-env/dist/index.js";
 import { deviceUrlBlock } from "../../../../lib/device-url/dist/index.js";
@@ -181,7 +182,6 @@ async function currentEntitlement() {
             : undefined,
     });
 }
-const REMOTE_PASSWORD_FILE = resolve(CONFIG_DIR, ".remote-password");
 // Resolve account directory
 function getAccountDir() {
     if (!ACCOUNT_ID) {
@@ -2034,12 +2034,30 @@ eagerTool(server, "session-resume", "Resume a previous session. Loads the select
         return refuseNoAccount("session-resume");
     return { content: [{ type: "text", text: "resumed" }] };
 });
-server.tool("remote-auth-set-password", "Set the remote access password. Hashes with scrypt and writes to the platform's brand-specific config directory with mode 0600. " +
-    "Validates strength (8+ chars, digit, special character, no spaces anywhere). " +
-    "Protects the admin interface when exposed over the tunnel — has no effect on the public endpoint or the tunnel itself. " +
-    "Set before configuring the Cloudflare tunnel — the post-restart `curl -I https://<admin-hostname>` verification fails if remote-auth is not configured.", { password: z.string() }, async ({ password }) => {
+server.tool("remote-auth-set-password", "Set an admin's remote access password — the outer password the tunnel asks for before the PIN screen. " +
+    "Each admin has their own; setting one does not affect any other admin's password. " +
+    "Defaults to the calling admin; pass userId (from admin-list) to set another admin's. " +
+    "Hashes with scrypt at mode 0600. Validates strength (8+ chars, digit, special character, no spaces anywhere). " +
+    "Protects the admin interface when exposed over the tunnel — has no effect on the public endpoint or the tunnel itself.", {
+    password: z.string(),
+    userId: z.string().optional().describe("The admin to set the password for. Defaults to the calling admin. Use admin-list to find userIds."),
+}, async ({ password, userId }) => {
     if (!ACCOUNT_ID)
         return refuseNoAccount("remote-auth-set-password");
+    const targetUserId = userId ?? process.env.USER_ID;
+    if (!targetUserId) {
+        return { content: [{ type: "text", text: "No target admin: pass userId, or run as an identified admin." }], isError: true };
+    }
+    let users;
+    try {
+        users = readUsersJson();
+    }
+    catch (err) {
+        return { content: [{ type: "text", text: `${err instanceof Error ? err.message : String(err)}` }], isError: true };
+    }
+    if (!users.some((u) => u.userId === targetUserId)) {
+        return { content: [{ type: "text", text: `No admin with userId ${targetUserId} on this device.` }], isError: true };
+    }
     // Validate strength — same rules as the web server's validatePasswordStrength
     const checks = [
         { label: "at least 8 characters", met: password.length >= 8 },
@@ -2055,20 +2073,9 @@ server.tool("remote-auth-set-password", "Set the remote access password. Hashes
         };
     }
     try {
-        const { scrypt, randomBytes } = await import("node:crypto");
-        const salt = randomBytes(32);
-        const hash = await new Promise((res, rej) => {
-            scrypt(password, salt, 64, { N: 16384, r: 8, p: 1 }, (err, key) => {
-                if (err)
-                    rej(err);
-                else
-                    res(key);
-            });
-        });
-        const stored = `${salt.toString("hex")}:${hash.toString("hex")}`;
-        const pwPath = REMOTE_PASSWORD_FILE;
-        await writeFile(pwPath, stored, { mode: 0o600 });
-        return { content: [{ type: "text", text: "Remote access password set." }] };
+        await setAccessPasswordHash(targetUserId, password, USERS_FILE);
+        console.error(`[admin] remote-access-password set userId=${targetUserId.slice(0, 8)}`);
+        return { content: [{ type: "text", text: `Remote access password set for userId ${targetUserId}.` }] };
     }
     catch (err) {
         return {
@@ -2077,6 +2084,40 @@ server.tool("remote-auth-set-password", "Set the remote access password. Hashes
         };
     }
 });
+server.tool("remote-auth-revoke-password", "Revoke an admin's remote access password so they can no longer obtain a NEW remote session (an already-open session lapses within 24h). " +
+    "Does not affect any other admin's password and does not touch their PIN. Pass userId (from admin-list).", { userId: z.string().describe("The admin whose remote access password to revoke. Use admin-list to find userIds.") }, async ({ userId }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("remote-auth-revoke-password");
+    let users;
+    try {
+        users = readUsersJson();
+    }
+    catch (err) {
+        return { content: [{ type: "text", text: `${err instanceof Error ? err.message : String(err)}` }], isError: true };
+    }
+    const target = users.find((u) => u.userId === userId);
+    if (!target) {
+        return { content: [{ type: "text", text: `No admin with userId ${userId} on this device.` }], isError: true };
+    }
+    if (!target.accessHash) {
+        return { content: [{ type: "text", text: `userId ${userId} has no remote access password to revoke.` }] };
+    }
+    const withHash = users.filter((u) => typeof u.accessHash === "string" && u.accessHash.length > 0);
+    if (withHash.length <= 1) {
+        return { content: [{ type: "text", text: "Refusing to revoke the last remaining remote access password — the install would have no remote access. Set another admin's password first." }], isError: true };
+    }
+    try {
+        clearAccessPasswordHash(userId, USERS_FILE);
+        console.error(`[admin] remote-access-password revoked userId=${userId.slice(0, 8)}`);
+        return { content: [{ type: "text", text: `Remote access password revoked for userId ${userId}.` }] };
+    }
+    catch (err) {
+        return {
+            content: [{ type: "text", text: `Failed to revoke: ${err instanceof Error ? err.message : String(err)}` }],
+            isError: true,
+        };
+    }
+});
 // ===================================================================
 // Utility tools
 // ===================================================================