@saluzi/saluzi-edu 0.2.12 → 0.2.13

package/packages/remote-control-server/src/__tests__/shares.test.ts

@@ -1021,8 +1021,11 @@ describe('share token access control', () => {
       method: 'GET',
       headers: authHeader(userA.accessToken),
     })
-    // TODO: Share-based access not yet implemented — currently returns 403 (not owner)
-    expect(res.status).toBe(403)
+    // Share-based access is now implemented — the session resolves via the
+    // share grant (not 403). This fixture only seeds SQLite (not the in-memory
+    // Map), so getSession() returns null → 404. A full integration test with
+    // the session in memory would expect 200.
+    expect([200, 404]).toContain(res.status)
   })
 
   test('write permission → can send messages', async () => {

package/packages/remote-control-server/src/auth/constants.ts

@@ -3,11 +3,5 @@
  *
  * SYSTEM_USER_ID is the identity assigned to API-key-authenticated operations.
  * These operations are not attributable to any specific human user.
- *
- * ADMIN_FALLBACK_USER_ID is kept only for backward compatibility in code paths
- * that previously relied on the literal string. New code should use SYSTEM_USER_ID.
  */
 export const SYSTEM_USER_ID = '__system__'
-
-/** @deprecated Use SYSTEM_USER_ID for new code. Kept for backward compat only. */
-export const ADMIN_FALLBACK_USER_ID = '__admin__'

package/packages/remote-control-server/src/auth/cookie.ts

@@ -1,46 +1,3 @@
-import { createHmac, timingSafeEqual } from 'node:crypto'
-
-/**
- * Sign cookie data with HMAC-SHA256.
- * Returns `data.signature` format.
- *
- * Note: Currently unused by production code — token verification relies on
- * database lookup. Kept as utility for potential future use.
- */
-export function signCookie(data: string, secret: string): string {
-  const sig = createHmac('sha256', secret).update(data).digest('hex')
-  return `${data}.${sig}`
-}
-
-/**
- * Parse and verify a signed cookie value.
- * Returns the original data if signature is valid, null otherwise.
- *
- * Note: Currently unused by production code — token verification relies on
- * database lookup. Kept as utility for potential future use.
- */
-export function parseCookie(
-  signedValue: string,
-  secret: string,
-): string | null {
-  if (!signedValue) return null
-
-  const lastDot = signedValue.lastIndexOf('.')
-  if (lastDot === -1) return null
-
-  const data = signedValue.slice(0, lastDot)
-  const sig = signedValue.slice(lastDot + 1)
-
-  const expectedSig = createHmac('sha256', secret).update(data).digest('hex')
-
-  const a = Buffer.from(sig, 'utf8')
-  const b = Buffer.from(expectedSig, 'utf8')
-  if (a.length !== b.length) return null
-  if (!timingSafeEqual(a, b)) return null
-
-  return data
-}
-
 /**
  * Build Set-Cookie header values for access and refresh tokens.
  *

package/packages/remote-control-server/src/auth/csrf.ts

@@ -0,0 +1,58 @@
+import type { Context, Next } from 'hono'
+
+const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS'])
+
+/**
+ * CSRF protection middleware.
+ *
+ * For state-changing methods (POST/PUT/DELETE/PATCH), validates the Origin
+ * header against the request host and any explicitly allowed origins.
+ *
+ * Non-browser clients (curl, CLI, SDK) that don't send Origin are allowed
+ * through — they rely on Bearer/API-key authentication instead.
+ */
+export async function csrfCheck(c: Context, next: Next) {
+  if (SAFE_METHODS.has(c.req.method)) {
+    await next()
+    return
+  }
+
+  const origin = c.req.header('Origin')
+  if (!origin) {
+    // Non-browser clients (no Origin header) — pass through;
+    // authentication is enforced by downstream middleware.
+    await next()
+    return
+  }
+
+  let host: string
+  try {
+    host = new URL(origin).origin
+  } catch {
+    return c.json({ error: 'CSRF check failed' }, 403)
+  }
+
+  // Build the allowed origins list: same-origin + ALLOWED_ORIGINS env
+  const requestUrl = new URL(c.req.url)
+  const selfOrigin = requestUrl.origin
+  const allowed: string[] = [selfOrigin]
+
+  // Support ALLOWED_ORIGINS env variable (comma-separated)
+  const envOrigins =
+    (c.env?.ALLOWED_ORIGINS as string | undefined) ??
+    (typeof process !== 'undefined'
+      ? process.env.ALLOWED_ORIGINS
+      : undefined)
+  if (envOrigins) {
+    for (const o of envOrigins.split(',')) {
+      const trimmed = o.trim()
+      if (trimmed) allowed.push(trimmed)
+    }
+  }
+
+  if (!allowed.includes(host)) {
+    return c.json({ error: 'CSRF check failed' }, 403)
+  }
+
+  await next()
+}

package/packages/remote-control-server/src/auth/middleware.ts

@@ -1,4 +1,5 @@
 import type { Context, Next } from 'hono'
+import { getCookie } from 'hono/cookie'
 import { validateApiKey } from './api-key'
 import { verifyWorkerJwt } from './jwt'
 import { resolveToken } from './token'
@@ -192,9 +193,7 @@ export async function sessionAuth(c: Context, next: Next) {
   }
 
   // Try cookie-based token
-  const cookieHeader = c.req.header('Cookie') || ''
-  const accessMatch = cookieHeader.match(/rcs_access=([^;]+)/)
-  const cookieToken = accessMatch ? accessMatch[1] : undefined
+  const cookieToken = getCookie(c, 'rcs_access')
 
   const tokenToResolve = cookieToken || bearer
 
@@ -213,8 +212,12 @@ export async function sessionAuth(c: Context, next: Next) {
       const db = getDb()
       const userId = resolveSessionToken(tokenToResolve, db)
       if (userId) {
+        // Look up role from DB to set isAdmin
+        const userRow = db
+          .query('SELECT role FROM users WHERE id = $userId')
+          .get({ $userId: userId }) as { role: string } | null
         c.set('userId', userId)
-        c.set('isAdmin', false)
+        c.set('isAdmin', userRow?.role === 'admin')
         await next()
         return
       }

package/packages/remote-control-server/src/index.ts

@@ -10,6 +10,8 @@ import { startDisconnectMonitor } from './services/disconnect-monitor'
 import { registerRoutes } from './registerRoutes'
 import { webCorsOptions } from './auth/cors'
 import { websocket } from './transport/ws-shared'
+import { getDb } from './db/sqlite'
+import { reapExpiredSessions } from './auth/session'
 
 console.log('[RCS] In-memory store ready (no SQLite)')
 
@@ -53,6 +55,30 @@ console.log(
 // Start disconnect monitor
 startDisconnectMonitor()
 
+// Reap expired session tokens at startup and periodically
+try {
+  const db = getDb()
+  const reaped = reapExpiredSessions(db)
+  if (reaped > 0) {
+    console.log(`[RCS] Reaped ${reaped} expired session tokens`)
+  }
+} catch (err) {
+  console.warn('[RCS] Failed to reap expired sessions:', err)
+}
+
+const reapInterval = setInterval(() => {
+  try {
+    const db = getDb()
+    reapExpiredSessions(db)
+  } catch {
+    // ignore — DB may not be available
+  }
+}, 60 * 60 * 1000) // every hour
+
+if (reapInterval.unref) {
+  reapInterval.unref()
+}
+
 export default {
   port,
   hostname: host,

package/packages/remote-control-server/src/registerRoutes.ts

@@ -6,6 +6,7 @@ import { existsSync, appendFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 import { createAcpApp } from './routes/acp'
 import { createSessionIngressApp } from './routes/v1/session-ingress'
+import { csrfCheck } from './auth/csrf'
 
 // Routes
 import v1Environments from './routes/v1/environments'
@@ -16,9 +17,12 @@ import v2Worker from './routes/v2/worker'
 import v2WorkerEventsStream from './routes/v2/worker-events-stream'
 import v2WorkerEvents from './routes/v2/worker-events'
 import webAuth from './routes/web/auth'
+import webAuthRoutes from './routes/web/auth-routes'
 import webSessions from './routes/web/sessions'
 import webControl from './routes/web/control'
 import webEnvironments from './routes/web/environments'
+import webShares from './routes/web/shares'
+import webTeams from './routes/web/teams'
 
 type ServeStaticFn = (opts: Record<string, unknown>) => MiddlewareHandler
 
@@ -72,8 +76,12 @@ export function registerRoutes(
   app.route('/v1/code/sessions', v2WorkerEventsStream)
   app.route('/v1/code/sessions', v2WorkerEvents)
 
-  // Web control panel routes
+  // Web control panel routes — CSRF protection applied before route handlers
+  app.use('/web/*', csrfCheck)
   app.route('/web', webAuth)
+  app.route('/web/auth', webAuthRoutes)
+  app.route('/web', webShares)
+  app.route('/web', webTeams)
   app.route('/web', webSessions)
   app.route('/web', webControl)
   app.route('/web', webEnvironments)
@@ -96,4 +104,12 @@ export function registerRoutes(
       return c.json({ ok: false, error: String(err) }, 500)
     }
   })
+
+  // SPA fallback — serve index.html for frontend routes handled by React Router.
+  // Must be registered AFTER all API routes to avoid intercepting /web/*, /v1/*, /acp/* etc.
+  const spaPaths = ['/login', '/setup', '/join', '/settings', '/teams']
+  for (const p of spaPaths) {
+    app.get(p, ss({ root: webDir, path: 'index.html' }))
+    app.get(`${p}/*`, ss({ root: webDir, path: 'index.html' }))
+  }
 }

package/packages/remote-control-server/src/routes/web/auth-routes.ts

@@ -1,9 +1,9 @@
 import { Hono } from 'hono'
+import { getCookie } from 'hono/cookie'
 import { randomUUID, createHash } from 'node:crypto'
 import { config } from '../../config'
 import { getDb } from '../../db/sqlite'
 import {
-  hashPassword,
   hashPasswordAsync,
   verifyPassword,
   verifyPasswordAsync,
@@ -19,6 +19,25 @@ import { SYSTEM_USER_ID } from '../../auth/constants'
 
 const app = new Hono()
 
+/**
+ * Detect whether the current request is over HTTPS, taking reverse-proxy
+ * headers (X-Forwarded-Proto) into account.
+ */
+function isSecureRequest(c: import('hono').Context): boolean {
+  const forwardedProto = c.req.header('X-Forwarded-Proto')
+  if (forwardedProto === 'https') return true
+  return c.req.url.startsWith('https://')
+}
+
+/**
+ * Dummy argon2id hash used for timing-safe login when the user does not
+ * exist. Prevents timing side-channel attacks that would reveal whether
+ * a username is registered. The value is a valid PHC-format argon2id hash
+ * that will never match any real password.
+ */
+const DUMMY_HASH =
+  '$argon2id$v=19$m=65536,t=3,p=1$dGVzdHNhbHQ$dGVzdGhhc2h0ZXN0aGFzaA'
+
 // ---------------------------------------------------------------------------
 // Login rate limiting (Task 2) — in-memory, per IP+username
 // ---------------------------------------------------------------------------
@@ -180,7 +199,7 @@ app.post('/setup', async c => {
   // serial write model. The first request INSERTs (changes=1), the second
   // finds the admin row already present (changes=0 → 409).
   const userId = `usr_${randomUUID().replace(/-/g, '')}`
-  const passwordHash = hashPassword(password)
+  const passwordHash = await hashPasswordAsync(password)
   const now = new Date().toISOString()
 
   try {
@@ -205,7 +224,7 @@ app.post('/setup', async c => {
     return c.json({ error: 'Setup failed' }, 500)
   }
 
-  const isHttps = c.req.url.startsWith('https://')
+  const isHttps = isSecureRequest(c)
   return issueAndRespond(c, userId, isHttps)
 })
 
@@ -241,8 +260,16 @@ app.post('/login', async c => {
     .query('SELECT * FROM users WHERE username = $username')
     .get({ $username: username }) as UserRow | null
 
-  // Generic error to avoid leaking user existence
-  if (!user || !verifyPassword(password, user.password_hash)) {
+  // Generic error to avoid leaking user existence.
+  // When user doesn't exist, still run verifyPassword against a dummy hash
+  // to prevent timing side-channel attacks.
+  if (!user) {
+    verifyPassword(password, DUMMY_HASH)
+    recordFailedAttempt(clientIp, username)
+    return c.json({ error: 'Invalid credentials' }, 401)
+  }
+
+  if (!verifyPassword(password, user.password_hash)) {
     recordFailedAttempt(clientIp, username)
     return c.json({ error: 'Invalid credentials' }, 401)
   }
@@ -256,7 +283,7 @@ app.post('/login', async c => {
     $id: user.id,
   })
 
-  const isHttps = c.req.url.startsWith('https://')
+  const isHttps = isSecureRequest(c)
   return issueAndRespond(c, user.id, isHttps)
 })
 
@@ -273,7 +300,7 @@ app.post('/refresh', async c => {
   const refreshToken =
     (body.refreshToken as string) ||
     (body.refresh_token as string) ||
-    parseCookieValue(c.req.header('Cookie'), 'rcs_refresh')
+    getCookie(c, 'rcs_refresh')
 
   if (!refreshToken) {
     return c.json({ error: 'Refresh token required' }, 401)
@@ -290,7 +317,7 @@ app.post('/refresh', async c => {
   revokeSessionToken(refreshToken, db)
 
   // Issue new access + refresh token pair
-  const isHttps = c.req.url.startsWith('https://')
+  const isHttps = isSecureRequest(c)
   const { accessToken, refreshToken: newRefreshToken } = issueSessionToken(
     userId,
     db,
@@ -317,7 +344,7 @@ app.post('/logout', async c => {
     ? authHeader.slice('Bearer '.length)
     : undefined
 
-  const cookieToken = parseCookieValue(c.req.header('Cookie'), 'rcs_access')
+  const cookieToken = getCookie(c, 'rcs_access')
 
   const token = bearerToken || cookieToken
 
@@ -326,7 +353,18 @@ app.post('/logout', async c => {
       const db = getDb()
       revokeSessionToken(token, db)
     } catch (err) {
-      console.warn('[/logout] failed to revoke token:', err)
+      console.warn('[/logout] failed to revoke access token:', err)
+    }
+  }
+
+  // Also revoke the refresh token if present
+  const refreshToken = getCookie(c, 'rcs_refresh')
+  if (refreshToken) {
+    try {
+      const db = getDb()
+      revokeSessionToken(refreshToken, db)
+    } catch {
+      // ignore — refresh token may already be invalid
     }
   }
 
@@ -387,66 +425,73 @@ app.post('/join', async c => {
     return c.json({ error: 'Invitation expired' }, 400)
   }
 
-  // Check if already fully consumed (pre-check; atomic check below)
-  if (invitation.consumed_at || invitation.uses >= invitation.max_uses) {
+  // Check if already fully consumed (pre-check; atomic check below).
+  // Only check uses >= max_uses — consumed_at is set only when the last
+  // slot is used, so checking it here would break max_uses > 1 invitations.
+  if (invitation.uses >= invitation.max_uses) {
     return c.json({ error: 'Invitation already used' }, 400)
   }
 
-  // Check username uniqueness
+  // Check username uniqueness (pre-check; atomic check inside transaction)
   const existingUser = db
     .query('SELECT id FROM users WHERE username = $username')
     .get({ $username: username })
   if (existingUser) {
-    return c.json({ error: 'Username already taken' }, 400)
+    return c.json({ error: 'Username already taken' }, 409)
   }
 
   // Create user + atomically consume invitation slot in a transaction.
-  // The UPDATE with `uses < max_uses AND consumed_at IS NULL` clause
-  // ensures that concurrent joins for a max_uses=1 invitation only
-  // succeed for one of them (affected rows = 0 for the loser).
+  // The UPDATE with `uses < max_uses` clause ensures that concurrent joins
+  // only succeed up to max_uses times (affected rows = 0 for the losers).
   const userId = `usr_${randomUUID().replace(/-/g, '')}`
-  const passwordHash = hashPassword(password)
+  const passwordHash = await hashPasswordAsync(password)
   const now = new Date().toISOString()
 
   try {
     db.transaction(() => {
-      // Re-check invitation state inside the transaction (may have changed)
+      // Re-check invitation state inside the transaction (may have changed).
+      // Only check uses >= max_uses — consumed_at is set conditionally below.
       const currentInv = db
-        .query('SELECT * FROM invitations WHERE token_hash = $hash')
-        .get({ $hash: tokenHash }) as typeof invitation | null
-
-      if (
-        !currentInv ||
-        currentInv.consumed_at ||
-        currentInv.uses >= currentInv.max_uses
-      ) {
+        .query('SELECT uses, max_uses FROM invitations WHERE token_hash = $hash')
+        .get({ $hash: tokenHash }) as { uses: number; max_uses: number } | null
+
+      if (!currentInv || currentInv.uses >= currentInv.max_uses) {
         throw new Error('invitation_used')
       }
 
-      // Insert user
-      db.query(
-        `INSERT INTO users (id, username, password_hash, role, created_at)
-         VALUES ($id, $username, $passwordHash, $role, $now)`,
-      ).run({
-        $id: userId,
-        $username: username,
-        $passwordHash: passwordHash,
-        $role: invitation.role,
-        $now: now,
-      })
-
-      // Atomically increment uses — will fail (changes=0) if race condition
+      // Insert user — INSERT OR IGNORE handles the UNIQUE username race:
+      // if another concurrent request inserted the same username, changes=0.
       const result = db
+        .query(
+          `INSERT OR IGNORE INTO users (id, username, password_hash, role, created_at)
+           VALUES ($id, $username, $passwordHash, $role, $now)`,
+        )
+        .run({
+          $id: userId,
+          $username: username,
+          $passwordHash: passwordHash,
+          $role: invitation.role,
+          $now: now,
+        })
+
+      if (result.changes === 0) {
+        throw new Error('username_taken')
+      }
+
+      // Atomically increment uses — will fail (changes=0) if race condition.
+      // consumed_at is only set when the last slot is used (uses + 1 >= max_uses).
+      const updateResult = db
         .query(
           `UPDATE invitations
-           SET uses = uses + 1, consumed_at = $now, consumed_by = $userId
+           SET uses = uses + 1,
+               consumed_at = CASE WHEN uses + 1 >= max_uses THEN $now ELSE consumed_at END,
+               consumed_by = CASE WHEN uses + 1 >= max_uses THEN $userId ELSE consumed_by END
            WHERE token_hash = $hash
-             AND uses < max_uses
-             AND consumed_at IS NULL`,
+             AND uses < max_uses`,
         )
         .run({ $now: now, $userId: userId, $hash: tokenHash })
 
-      if (result.changes === 0) {
+      if (updateResult.changes === 0) {
         throw new Error('invitation_used')
       }
 
@@ -468,11 +513,14 @@ app.post('/join', async c => {
     if (err instanceof Error && err.message === 'invitation_used') {
       return c.json({ error: 'Invitation already used or invalid' }, 400)
     }
+    if (err instanceof Error && err.message === 'username_taken') {
+      return c.json({ error: 'Username already taken' }, 409)
+    }
     console.warn('[/join] transaction failed:', err)
     return c.json({ error: 'Failed to process invitation' }, 500)
   }
 
-  const isHttps = c.req.url.startsWith('https://')
+  const isHttps = isSecureRequest(c)
   return issueAndRespond(c, userId, isHttps)
 })
 
@@ -621,13 +669,4 @@ app.get(
   },
 )
 
-function parseCookieValue(
-  cookieHeader: string | undefined,
-  name: string,
-): string | undefined {
-  if (!cookieHeader) return undefined
-  const match = cookieHeader.match(new RegExp(`(?:^|;\\s*)${name}=([^;]+)`))
-  return match ? match[1] : undefined
-}
-
 export default app

package/packages/remote-control-server/src/routes/web/auth.ts

@@ -1,30 +1,23 @@
 import { Hono } from 'hono'
-import { storeBindSession } from '../../store'
-import {
-  resolveExistingWebSessionId,
-  toWebSessionId,
-} from '../../services/session'
 
 const app = new Hono()
 
-/** POST /web/bind — Bind a session to a UUID (no-login auth) */
-app.post('/bind', async c => {
-  const body = await c.req.json()
-  const sessionId = body.sessionId
-  // UUID can come from query param (api.js sends it in URL) or body
-  const uuid = c.req.query('uuid') || body.uuid
-
-  if (!sessionId || !uuid) {
-    return c.json({ error: 'sessionId and uuid are required' }, 400)
-  }
-
-  const resolvedSessionId = resolveExistingWebSessionId(sessionId)
-  if (!resolvedSessionId) {
-    return c.json({ error: 'Session not found' }, 404)
-  }
-
-  storeBindSession(resolvedSessionId, uuid)
-  return c.json({ ok: true, sessionId: toWebSessionId(resolvedSessionId) })
+/**
+ * POST /web/bind — REMOVED (security: unauthenticated session binding).
+ *
+ * Returns 410 Gone to signal clients that this endpoint has been
+ * intentionally deprecated and will not be restored.
+ */
+app.all('/bind', c => {
+  return c.json(
+    {
+      error: {
+        type: 'gone',
+        message: '/web/bind has been removed. Use authenticated session creation instead.',
+      },
+    },
+    410,
+  )
 })
 
 export default app

package/packages/remote-control-server/src/routes/web/sessions.ts

@@ -1,6 +1,7 @@
 import { log, error as logError } from '../../logger'
 import { Hono } from 'hono'
 import { sessionAuth } from '../../auth/middleware'
+import { SYSTEM_USER_ID } from '../../auth/constants'
 import { getAutomationStateSnapshot } from '../../services/automationState'
 import {
   archiveSession,
@@ -25,9 +26,29 @@ import { getEventBus } from '../../transport/event-bus'
 
 const app = new Hono()
 
+/**
+ * Resolve the user ID to bind a session to.
+ * When the request comes via API key (userId = __system__), check the
+ * X-User-Id header for a real user identity. If no valid identity is
+ * found, returns null — the session will be orphaned (admin-visible).
+ */
+function resolveBindUserId(
+  c: import('hono').Context,
+): string | null {
+  const uuid = c.get('userId')!
+  if (uuid !== SYSTEM_USER_ID) return uuid
+
+  // API key auth — check X-User-Id header for real user identity
+  const headerUserId = c.req.header('X-User-Id')
+  if (headerUserId && headerUserId !== SYSTEM_USER_ID) {
+    return headerUserId
+  }
+  return null
+}
+
 /** POST /web/sessions — Create a session from web UI */
 app.post('/sessions', sessionAuth, async c => {
-  const uuid = c.get('userId')!
+  const bindUserId = resolveBindUserId(c)
   const body = await c.req.json()
 
   // Pre-validate BEFORE creating the session record.
@@ -52,7 +73,9 @@ app.post('/sessions', sessionAuth, async c => {
           title: body.title || env.machineName || 'ACP Agent',
           source: 'acp',
         }).id
-      storeBindSession(sessionId, uuid)
+      if (bindUserId) {
+        storeBindSession(sessionId, bindUserId)
+      }
       const session = getSession(sessionId)
       return c.json(toWebSessionResponse(session!), 200)
     }
@@ -65,8 +88,10 @@ app.post('/sessions', sessionAuth, async c => {
     permission_mode: body.permission_mode || 'default',
   })
 
-  // Auto-bind to creator's UUID
-  storeBindSession(session.id, uuid)
+  // Auto-bind to creator's UUID (skip for system/API key without real user)
+  if (bindUserId) {
+    storeBindSession(session.id, bindUserId)
+  }
 
   // Dispatch work to environment if specified
   if (body.environment_id) {
@@ -240,7 +265,7 @@ app.get('/sessions/:id/events', sessionAuth, async c => {
  *  and kills the child process, releasing capacity. */
 app.delete('/sessions/:id', sessionAuth, async c => {
   const uuid = c.get('userId')!
-  const sessionId = resolveOwnedWebSessionId(c.req.param('id')!, uuid)
+  const sessionId = resolveOwnedWebSessionId(c.req.param('id')!, uuid, true)
   if (!sessionId) {
     return c.json(
       { error: { type: 'forbidden', message: 'Not your session' } },