@saluzi/saluzi-edu 0.2.30 → 0.2.32

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saluzi/saluzi-edu",
-  "version": "0.2.30",
+  "version": "0.2.32",
   "description": "Saluzi CLI - interactive AI coding assistant in the terminal",
   "license": "MIT",
   "type": "module",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@agentclientprotocol/sdk": "^0.19.0",
-    "@saluzi/acp-link": "^0.1.4",
+    "@saluzi/acp-link": "^0.1.5",
     "@saluzi/codegraph": "^0.2.4",
     "@saluzi/sa-agent-tools": "^1.0.0",
     "@saluzi/sa-builtin-tools": "^1.0.1",

package/packages/remote-control-server/src/routes/acp/index.ts

@@ -1,4 +1,5 @@
 import { Hono } from 'hono'
+import { getCookie } from 'hono/cookie'
 import { randomUUID } from 'node:crypto'
 import type { Context } from 'hono'
 import type { UpgradeWebSocket } from 'hono/ws'
@@ -14,6 +15,8 @@ import {
 } from '../../auth/middleware'
 import { validateApiKey } from '../../auth/api-key'
 import { resolveToken } from '../../auth/token'
+import { resolveSessionToken } from '../../auth/session'
+import { getDb } from '../../db/sqlite'
 import {
   handleAcpWsOpen,
   handleAcpWsMessage,
@@ -55,9 +58,40 @@ function toAcpAgentResponse(env: ReturnType<typeof storeGetEnvironment> & {}) {
   }
 }
 
+/**
+ * Resolve a Web UI user's token (SQLite session token from cookie or
+ * Bearer) to a userId. Returns null if the token is invalid or absent.
+ *
+ * Web UI users authenticate via rct_* SQLite session tokens stored in the
+ * rcs_access cookie (or Bearer for API calls). ACP read/relay endpoints
+ * must accept these in addition to admin API keys, otherwise non-admin
+ * users can list ACP sessions (via /web/sessions with sessionAuth) but
+ * can't open them (ACP endpoints reject with 401 "unauthorized").
+ */
+function resolveWebUserToken(c: Context): string | null {
+  // Cookie (rcs_access) — primary Web UI auth path for WebSocket upgrades
+  const cookieToken = getCookie(c, 'rcs_access')
+  // Bearer — for REST calls from Web UI (Authorization header)
+  const bearerToken = extractBearerToken(c)
+  const token = cookieToken || bearerToken
+  if (!token) return null
+  // Try in-memory token (legacy issueToken flow)
+  const username = resolveToken(token)
+  if (username) return username
+  // Try SQLite session token
+  try {
+    return resolveSessionToken(token, getDb())
+  } catch {
+    return null
+  }
+}
+
 function hasAcpReadAuth(c: Context): boolean {
-  const token = extractBearerToken(c)
-  return !!token && validateApiKey(token)
+  // Admin API key (RCS_API_KEYS)
+  const bearer = extractBearerToken(c)
+  if (bearer && validateApiKey(bearer)) return true
+  // Web UI user (SQLite session token or in-memory token)
+  return !!resolveWebUserToken(c)
 }
 
 /**
@@ -68,10 +102,30 @@ function hasAcpReadAuth(c: Context): boolean {
  */
 export function hasAcpRelayAuth(c: Context): boolean {
   const token = extractWebSocketAuthToken(c)
-  if (!token) return false
-  if (validateApiKey(token)) return true
-  // Try session token resolution (in-memory issueToken tokens)
-  return !!resolveToken(token)
+  if (token) {
+    if (validateApiKey(token)) return true
+    // Try in-memory token resolution (existing issueToken flow)
+    if (resolveToken(token)) return true
+    // Try SQLite session token (rct_* from Bearer or Sec-WebSocket-Protocol)
+    try {
+      if (resolveSessionToken(token, getDb())) return true
+    } catch {
+      // DB unavailable — fall through to cookie check
+    }
+  }
+  // Cookie-based session token (rcs_access) — browser WebSocket upgrades
+  // automatically send cookies, so this works without client-side token
+  // injection.
+  const cookieToken = getCookie(c, 'rcs_access')
+  if (cookieToken) {
+    if (resolveToken(cookieToken)) return true
+    try {
+      if (resolveSessionToken(cookieToken, getDb())) return true
+    } catch {
+      return false
+    }
+  }
+  return false
 }
 
 function acpReadUnauthorized(c: Context) {