@runeya/runeya 2.0.84 → 2.0.85

package/index.js

@@ -279,7 +279,7 @@ async function main() {
   ensureNodeBinOnPath();
   await ensureUserBinsOnPath();
   if (!isPullEnv) stampConsole();
-  const { createLocalServer, pullEnv, PullEnvError, registerInstance } = await import("./src-BWQ4J4D5.js");
+  const { createLocalServer, pullEnv, PullEnvError, registerInstance } = await import("./src-URY4IL2E.js");
   if (isPullEnv) {
     if (!serviceArg) {
       console.error("Error: --service (-s) is required with --pull-env");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runeya/runeya",
-  "version": "2.0.84",
+  "version": "2.0.85",
   "type": "module",
   "bin": {
     "runeya": "./index.js"

package/{src-BWQ4J4D5.js → src-URY4IL2E.js}

@@ -408,9 +408,20 @@ var authMiddleware = t.middleware(async ({ ctx, next }) => {
 });
 var protectedProcedure = t.procedure.use(authMiddleware);
 var LOOPBACK = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
-function requireLoopback(ctx) {
-  if (!ctx.remoteAddress || !LOOPBACK.has(ctx.remoteAddress)) {
-    throw new TRPCError({ code: "FORBIDDEN", message: "This route only answers the local machine." });
+async function requireLoopbackOrToken(ctx) {
+  if (ctx.remoteAddress && LOOPBACK.has(ctx.remoteAddress)) return;
+  if (isCiMode()) return;
+  const authorization = ctx.authorization;
+  if (!authorization?.startsWith("Bearer ")) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "This route answers the local machine, or a signed-in app."
+    });
+  }
+  try {
+    await verifyJwt(authorization.slice(7));
+  } catch {
+    throw new TRPCError({ code: "UNAUTHORIZED", message: "Invalid or expired token" });
   }
 }
 function requireServiceAction(ctx, serviceId, action) {
@@ -603,7 +614,7 @@ var appUpdateRouter = router({
       ready: z2.boolean()
     })
   ).query(async ({ ctx }) => {
-    requireLoopback(ctx);
+    await requireLoopbackOrToken(ctx);
     const npmPath = resolveNpm();
     const npmVersion = await probeVersion(npmPath, ["--version"]);
     const globalPrefix = npmVersion ? await probeVersion(npmPath, ["prefix", "-g"]) : null;
@@ -630,7 +641,7 @@ var appUpdateRouter = router({
       installedVersion: z2.string().nullable()
     })
   ).mutation(async ({ ctx }) => {
-    requireLoopback(ctx);
+    await requireLoopbackOrToken(ctx);
     requireDesktop();
     const npmPath = resolveNpm();
     try {
@@ -655,8 +666,8 @@ var appUpdateRouter = router({
    * quelques instants — le démarrage réessaie déjà sur EADDRINUSE, c'est ce qui
    * rend ce relais possible sans temporisation ici.
    */
-  restart: publicProcedure.output(z2.object({ restarting: z2.literal(true), version: z2.string() })).mutation(({ ctx }) => {
-    requireLoopback(ctx);
+  restart: publicProcedure.output(z2.object({ restarting: z2.literal(true), version: z2.string() })).mutation(async ({ ctx }) => {
+    await requireLoopbackOrToken(ctx);
     requireDesktop();
     const child = spawn(process.execPath, process.argv.slice(1), {
       detached: true,
@@ -18266,4 +18277,4 @@ export {
   pullEnv,
   registerInstance
 };
-//# sourceMappingURL=src-BWQ4J4D5.js.map
+//# sourceMappingURL=src-URY4IL2E.js.map