@stacksjs/ts-cloud 0.7.19 → 0.7.21

package/dist/{chunk-nt2hrnva.js → chunk-eapb9et8.js}

@@ -11803,6 +11803,7 @@ function scopeDashboardData(data, options) {
     environment: data.environment,
     environments: data.environments,
     scoped: true,
+    server: { name: "" },
     sites,
     sitesDetail,
     workers: (data.workers ?? []).filter((w) => allowedSet.has(w.site)),
@@ -11833,6 +11834,135 @@ function scopeCloudConfig(config6, user) {
   };
 }
 
+// src/deploy/dashboard-site-settings.ts
+var MEMBER_EDITABLE_SITE_FIELDS = new Set([
+  "name",
+  "ssl",
+  "env",
+  "redirects",
+  "aliases",
+  "domain",
+  "path"
+]);
+var ADMIN_ONLY_SITE_FIELDS = {
+  build: "build runs as a shell command on the server",
+  start: "start runs as a shell command on the server",
+  root: "root is a filesystem path on the shared server",
+  port: "ports are allocated by the server owner",
+  type: "the deploy type is set by the server owner",
+  php: "the PHP runtime is set by the server owner"
+};
+function checkMemberSiteFields(body) {
+  const touched = Object.keys(body).filter((key) => body[key] !== undefined);
+  const forbidden = touched.filter((key) => (key in ADMIN_ONLY_SITE_FIELDS));
+  if (forbidden.length) {
+    const reasons = forbidden.map((key) => `${key} (${ADMIN_ONLY_SITE_FIELDS[key]})`).join(", ");
+    return { ok: false, error: `Only the server owner can change ${reasons}.` };
+  }
+  const unknown = touched.filter((key) => !MEMBER_EDITABLE_SITE_FIELDS.has(key));
+  if (unknown.length)
+    return { ok: false, error: `Only the server owner can change ${unknown.join(", ")}.` };
+  return { ok: true };
+}
+function normalizeHost(value) {
+  return String(value ?? "").trim().toLowerCase().replace(/\.$/, "");
+}
+function normalizePath(value) {
+  const path = String(value ?? "/").trim();
+  if (!path || path === "/")
+    return "/";
+  return (path.startsWith("/") ? path : `/${path}`).replace(/\/+$/, "") || "/";
+}
+function siteHosts(site) {
+  const hosts = [normalizeHost(site?.domain)];
+  if (Array.isArray(site?.aliases))
+    hosts.push(...site.aliases.map(normalizeHost));
+  return hosts.filter(Boolean);
+}
+function checkRouteConflict({ siteName, body, sites, ownSites }) {
+  const current = sites[siteName] ?? {};
+  const owned = new Set(ownSites);
+  const wantedHosts = new Set;
+  if (body.domain !== undefined)
+    wantedHosts.add(normalizeHost(body.domain));
+  if (Array.isArray(body.aliases))
+    for (const alias of body.aliases)
+      wantedHosts.add(normalizeHost(alias));
+  wantedHosts.delete("");
+  if (wantedHosts.size === 0)
+    return { ok: true };
+  const wantedPath = normalizePath(body.path !== undefined ? body.path : current.path);
+  for (const [otherName, other] of Object.entries(sites)) {
+    if (otherName === siteName || owned.has(otherName))
+      continue;
+    const otherPath = normalizePath(other?.path);
+    for (const host of siteHosts(other)) {
+      if (!wantedHosts.has(host))
+        continue;
+      if (otherPath === wantedPath) {
+        return {
+          ok: false,
+          error: `${host}${wantedPath === "/" ? "" : wantedPath} is already served by another site on this server.`
+        };
+      }
+    }
+  }
+  return { ok: true };
+}
+
+// src/deploy/dashboard-throttle.ts
+var MAX_ATTEMPTS = 8;
+var LOCKOUT_MS = 15 * 60 * 1000;
+var WINDOW_MS = 15 * 60 * 1000;
+
+class LoginThrottle {
+  maxAttempts;
+  lockoutMs;
+  windowMs;
+  attempts = new Map;
+  constructor(maxAttempts = MAX_ATTEMPTS, lockoutMs = LOCKOUT_MS, windowMs = WINDOW_MS) {
+    this.maxAttempts = maxAttempts;
+    this.lockoutMs = lockoutMs;
+    this.windowMs = windowMs;
+  }
+  key(username, address) {
+    return `${username.trim().toLowerCase()}\x00${address}`;
+  }
+  check(username, address, now = Date.now()) {
+    const entry = this.attempts.get(this.key(username, address));
+    if (!entry?.until)
+      return { allowed: true };
+    if (now >= entry.until) {
+      this.attempts.delete(this.key(username, address));
+      return { allowed: true };
+    }
+    return { allowed: false, retryAfterSeconds: Math.ceil((entry.until - now) / 1000) };
+  }
+  recordFailure(username, address, now = Date.now()) {
+    const key = this.key(username, address);
+    const entry = this.attempts.get(key);
+    const stale = !entry || now - entry.last > this.windowMs;
+    const count = stale ? 1 : entry.count + 1;
+    const next = { count, last: now };
+    if (count >= this.maxAttempts)
+      next.until = now + this.lockoutMs;
+    this.attempts.set(key, next);
+  }
+  recordSuccess(username, address) {
+    this.attempts.delete(this.key(username, address));
+  }
+  prune(now = Date.now()) {
+    for (const [key, entry] of this.attempts) {
+      const expired = entry.until ? now >= entry.until : now - entry.last > this.windowMs;
+      if (expired)
+        this.attempts.delete(key);
+    }
+  }
+  get size() {
+    return this.attempts.size;
+  }
+}
+
 // src/deploy/firewall-config-editor.ts
 var ALWAYS_OPEN = new Set([22, 80, 443]);
 function isValidPort(port) {
@@ -12987,6 +13117,9 @@ async function startLocalDashboardServer(options = {}) {
   const authEnabled = !authDisabled;
   const secret = resolveSessionSecret(cwd);
   const guard = createDashboardGuard({ cwd, enabled: authEnabled, secret });
+  const throttle = new LoginThrottle;
+  const throttleSweep = setInterval(() => throttle.prune(), 5 * 60 * 1000);
+  throttleSweep.unref?.();
   if (authEnabled) {
     const bootstrap = ensureAdminUser(cwd, process.env.TS_CLOUD_UI_USERNAME?.trim() || "admin");
     if (bootstrap.generated) {
@@ -13039,11 +13172,19 @@ async function startLocalDashboardServer(options = {}) {
           const body = await readJsonBody(req);
           const username = String(body.username ?? "").trim();
           const password = String(body.password ?? "");
+          const address = server2.requestIP(req)?.address ?? "unknown";
+          const gate = throttle.check(username, address);
+          if (!gate.allowed) {
+            return json({ ok: false, error: `Too many failed attempts. Try again in ${Math.ceil((gate.retryAfterSeconds ?? 0) / 60)} minute(s).` }, 429, { "retry-after": String(gate.retryAfterSeconds ?? 60) });
+          }
           const user2 = findUser(loadUsers(cwd), username);
           const hash = user2?.passwordHash || DUMMY_HASH;
           const ok = verifyPassword(password, hash) && !!user2;
-          if (!ok)
+          if (!ok) {
+            throttle.recordFailure(username, address);
             return json({ ok: false, error: "Incorrect username or password." }, 401);
+          }
+          throttle.recordSuccess(username, address);
           const token = createSessionToken(user2.username, secret);
           return json({ ok: true, user: describeUser(user2) }, 200, {
             "set-cookie": serializeSessionCookie(token, { secure: cookieSecure })
@@ -13247,6 +13388,19 @@ async function startLocalDashboardServer(options = {}) {
           const existing = config6.sites?.[name];
           if (!name || !existing)
             return json({ ok: false, error: `Site '${name}' was not found.` }, 404);
+          if (user.role === "member") {
+            const fields = checkMemberSiteFields(body);
+            if (!fields.ok)
+              return json({ ok: false, error: fields.error }, 403);
+            const conflict = checkRouteConflict({
+              siteName: name,
+              body,
+              sites: config6.sites ?? {},
+              ownSites: Object.keys(user.sites)
+            });
+            if (!conflict.ok)
+              return json({ ok: false, error: conflict.error }, 409);
+          }
           if (body.port !== undefined && body.port !== null && body.port !== "" && (!Number.isInteger(Number(body.port)) || Number(body.port) < 1 || Number(body.port) > 65535))
             return json({ ok: false, error: "Port must be a number between 1 and 65535." }, 422);
           let text2 = await readFile(configPath, "utf8");

package/dist/deploy/dashboard-site-settings.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Which site settings a member may change, and route-conflict checks.
+ *
+ * `site:settings` lets a site owner edit their own site — but a site's config
+ * is not all equally harmless on a box shared with other tenants:
+ *
+ * - `build` and `start` are **shell commands run on the box at deploy time**,
+ *   as root. A member who could set them would own the whole server, and every
+ *   other tenant's site with it.
+ * - `root` is a filesystem path. Pointed at another site's directory (or `/`),
+ *   it serves someone else's files to the internet.
+ * - `port`, `type` and `php` pick runtime and bind ports, which are the box's
+ *   to allocate, not one tenant's.
+ *
+ * Those stay with the box owner. What is left is genuinely the tenant's own:
+ * TLS, their app's env, their redirects, and their routing — and routing is
+ * still checked against other tenants, since claiming `example.com` when
+ * someone else already serves it is hijacking their traffic.
+ *
+ * An allowlist, not a blocklist: a site field added later is admin-only until
+ * someone decides it is safe to hand over.
+ */
+/** Fields a member holding `site:settings` on the site may change. */
+export declare const MEMBER_EDITABLE_SITE_FIELDS: ReadonlySet<string>;
+/**
+ * Fields only the box owner may change, with why — used to explain the refusal
+ * rather than a bare 403.
+ */
+export declare const ADMIN_ONLY_SITE_FIELDS: Readonly<Record<string, string>>;
+export interface FieldCheck {
+    ok: boolean;
+    error?: string;
+}
+/**
+ * Whether a member may apply `body` to a site. Refuses the whole request if it
+ * touches any admin-only field, rather than silently applying the safe subset —
+ * a caller who asked to set `start` should be told it did not happen.
+ */
+export declare function checkMemberSiteFields(body: Record<string, any>): FieldCheck;
+export interface RouteConflictInput {
+    /** The site being edited. */
+    siteName: string;
+    /** The requested changes (domain / path / aliases). */
+    body: Record<string, any>;
+    /** All sites on the box, by name. */
+    sites: Record<string, any>;
+    /** Site names the editor holds a grant on — conflicts with these are theirs. */
+    ownSites: string[];
+}
+/**
+ * Refuse a routing change that would claim a host another tenant already
+ * serves. Conflicts with the editor's own sites are allowed: moving a domain
+ * between two sites you control is your business.
+ */
+export declare function checkRouteConflict({ siteName, body, sites, ownSites }: RouteConflictInput): FieldCheck;

package/dist/deploy/dashboard-site-settings.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-throttle.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Login throttling.
+ *
+ * The dashboard's login is internet-facing, and it is the door to a box that
+ * hosts other people's sites. scrypt makes each guess cost ~50ms, which slows
+ * an attacker but does not stop one — and while generated passwords are strong,
+ * an operator can set their own via `TS_CLOUD_UI_PASSWORD`.
+ *
+ * Failures are counted per key (username + client address) and lock that key
+ * out for a window once they pass a threshold. In-memory on purpose: the
+ * dashboard is a single process per box, and a restart clearing the counters is
+ * an acceptable trade for having no store to keep.
+ *
+ * Keyed on username *and* address so one attacker cannot lock a legitimate
+ * operator out of their own box by failing logins against their username
+ * (a denial of service dressed up as a security control).
+ */
+/** Failures before a key is locked out. */
+export declare const MAX_ATTEMPTS: number;
+/** How long a locked key stays locked. */
+export declare const LOCKOUT_MS: number;
+/** Failures older than this stop counting, so occasional typos never lock. */
+export declare const WINDOW_MS: number;
+export interface ThrottleDecision {
+    allowed: boolean;
+    /** Seconds until the caller may try again. Only set when blocked. */
+    retryAfterSeconds?: number;
+}
+export declare class LoginThrottle {
+    private readonly maxAttempts;
+    private readonly lockoutMs;
+    private readonly windowMs;
+    private attempts;
+    constructor(maxAttempts?: number, lockoutMs?: number, windowMs?: number);
+    private key;
+    /** Whether a login attempt for this key may proceed. */
+    check(username: string, address: string, now?: number): ThrottleDecision;
+    /** Record a failed attempt, locking the key once it passes the threshold. */
+    recordFailure(username: string, address: string, now?: number): void;
+    /** Clear the counter for a key after a successful login. */
+    recordSuccess(username: string, address: string): void;
+    /** Drop expired entries so the map cannot grow without bound. */
+    prune(now?: number): void;
+    /** Tracked keys. For tests and diagnostics. */
+    get size(): number;
+}

package/dist/deploy/dashboard-throttle.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/index.js

@@ -12,7 +12,7 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "../chunk-nt2hrnva.js";
+} from "../chunk-eapb9et8.js";
 import {
   buildAndPushServerlessImage
 } from "../chunk-qgnyzfmx.js";

package/dist/index.js

@@ -55,7 +55,7 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "./chunk-nt2hrnva.js";
+} from "./chunk-eapb9et8.js";
 import {
   buildAndPushServerlessImage
 } from "./chunk-qgnyzfmx.js";