@techysy/10router 1.1.2 → 1.2.0

package/app/src/lib/db/adapters/betterSqliteAdapter.js

@@ -1,10 +1,14 @@
-import Database from "better-sqlite3";
 import { PRAGMA_SQL } from "../schema.js";
 
 // Periodic checkpoint to keep WAL file small (avoid huge -wal/-shm growth)
 const CHECKPOINT_INTERVAL_MS = 60 * 1000;
 
-export function createBetterSqliteAdapter(filePath) {
+// `Database` is injected rather than imported: the module the app should use is
+// the runtime copy under <dataDir>/runtime/node_modules, which is NOT reachable
+// from this file's location by bare specifier (that would resolve upward through
+// the global tree first). driver.js resolves it and passes it in — see
+// loadBetterSqlite() there.
+export function createBetterSqliteAdapter(filePath, Database) {
   const db = new Database(filePath);
   db.exec(PRAGMA_SQL);
   // Schema is created/synced by migrate.js after adapter init

package/app/src/lib/db/migrate.js

@@ -7,6 +7,7 @@ import { getMetaSync, setMetaSync } from "./helpers/metaStore.js";
 import { makeBackupDir, backupFile, backupDbLite, pruneOldBackups } from "./backup.js";
 import { getAppVersion } from "./version.js";
 import { stringifyJson } from "./helpers/jsonCol.js";
+import { encryptConnectionData } from "./crypto/credentialCipher.js";
 
 // Marker file: prevents re-importing legacy JSON when user wipes data.sqlite.
 const MIGRATED_MARKER = path.join(DB_DIR, ".migrated-from-json");
@@ -110,8 +111,10 @@ function syncSchemaFromTables(adapter) {
 
 // ─── Legacy JSON import (one-time) ───────────────────────────────────────
 function importLegacyMain(adapter, data) {
+  // Runs AFTER the versioned migrations (see runMigrationOnce), so migration 003
+  // has already swept the table — rows inserted here would otherwise sit in plain
+  // text forever. Encrypt on the way in.
   if (!data || typeof data !== "object") return;
-
   if (data.settings) {
     adapter.run(`INSERT INTO settings(id, data) VALUES(1, ?) ON CONFLICT(id) DO UPDATE SET data = excluded.data`, [stringifyJson(data.settings)]);
   }
@@ -120,7 +123,7 @@ function importLegacyMain(adapter, data) {
     const { id, provider, authType, name, email, priority, isActive, createdAt, updatedAt, ...rest } = c;
     adapter.run(
       `INSERT OR REPLACE INTO providerConnections(id, provider, authType, name, email, priority, isActive, data, createdAt, updatedAt) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-      [id, provider, authType || "oauth", name || null, email || null, priority || null, isActive === false ? 0 : 1, stringifyJson(rest), createdAt || new Date().toISOString(), updatedAt || new Date().toISOString()]
+      [id, provider, authType || "oauth", name || null, email || null, priority || null, isActive === false ? 0 : 1, stringifyJson(encryptConnectionData(rest)), createdAt || new Date().toISOString(), updatedAt || new Date().toISOString()]
     );
   }, (c) => ({ id: c.id ?? null, provider: c.provider ?? null, name: c.name ?? null }));
 

package/app/src/lib/oauth/services/qoder.js

@@ -52,6 +52,16 @@ async function fetchWithTimeout(url, init = {}) {
 }
 
 export class QoderService {
+  /**
+   * @param {object} [endpoints] - Endpoint overrides for the CN deployment
+   *   (qoder-cn). Defaults to the global qoder.sh hosts.
+   */
+  constructor(endpoints = {}) {
+    this.deviceTokenUrl = endpoints.deviceTokenUrl || QODER_DEVICE_TOKEN_URL;
+    this.loginUrl = endpoints.loginUrl || QODER_LOGIN_URL;
+    this.userInfoUrl = endpoints.userInfoUrl || QODER_USERINFO_URL;
+  }
+
   /**
    * Generate a PKCE verifier + S256 challenge pair.
    * Uses 32 random bytes (matches qodercli/Veria).
@@ -79,7 +89,7 @@ export class QoderService {
     });
 
     return {
-      verificationUriComplete: `${QODER_LOGIN_URL}?${params.toString()}`,
+      verificationUriComplete: `${this.loginUrl}?${params.toString()}`,
       codeVerifier: verifier,
       nonce,
       machineId,
@@ -98,7 +108,7 @@ export class QoderService {
     if (!nonce || !codeVerifier) {
       throw new Error("pollDeviceToken: missing nonce or code verifier");
     }
-    const url = `${QODER_DEVICE_TOKEN_URL}?nonce=${encodeURIComponent(nonce)}&verifier=${encodeURIComponent(codeVerifier)}&challenge_method=S256`;
+    const url = `${this.deviceTokenUrl}?nonce=${encodeURIComponent(nonce)}&verifier=${encodeURIComponent(codeVerifier)}&challenge_method=S256`;
 
     const response = await fetchWithTimeout(url, {
       method: "GET",
@@ -155,7 +165,7 @@ export class QoderService {
    */
   async fetchUserInfo(accessToken) {
     try {
-      const response = await fetchWithTimeout(QODER_USERINFO_URL, {
+      const response = await fetchWithTimeout(this.userInfoUrl, {
         method: "GET",
         headers: {
           Authorization: `Bearer ${accessToken}`,

package/app/src/lib/oauth/xiaomiIdentity.js

@@ -1,41 +1,50 @@
-// Shared identity matching for Xiaomi MiMo connections.
-//
-// MiMo has two credential families (desktop account session + sk- API key) and
-// several ways they arrive (QR import, browser authorization, manual key). All
-// of them must resolve to ONE connection per Xiaomi account, otherwise the
-// dashboard shows duplicate rows for the same uid and routing picks a row that
-// lacks the credential the requested model needs.
-//
-// Match priority (first hit wins):
-//   1. uid          — the account id the browser/desktop flow reports
-//   2. mimoUserId   — the desktop-session account id (covers uid-less payloads)
-//   3. email        — `${uid}@xiaomi` synthetic address
-//   4. accessToken  — exact key/token reuse (same file imported twice)
-//
-// Every caller must go through this so the rules cannot drift apart again.
-
-/**
- * @param {object} conn      candidate connection row
- * @param {{uid?: string|null, key?: string|null, mimoUserId?: string|null}} ident
- * @returns {boolean}
- */
-export function matchesXiaomiIdentity(conn, ident = {}) {
-  if (!conn || conn.provider !== "xiaomi-mimo") return false;
-  const { uid = null, key = null, mimoUserId = null } = ident;
-  const psd = conn.providerSpecificData || {};
-
-  if (uid && (psd.uid === uid || psd.mimoUserId === uid)) return true;
-  if (uid && conn.email === `${uid}@xiaomi`) return true;
-  if (mimoUserId && psd.mimoUserId === mimoUserId) return true;
-  if (key && conn.accessToken === key) return true;
-  return false;
-}
-
-/**
- * Find the connection that `ident` belongs to, or null.
- * @param {Array<object>} connections
- * @param {{uid?: string|null, key?: string|null, mimoUserId?: string|null}} ident
- */
-export function findXiaomiConnection(connections, ident = {}) {
-  return (connections || []).find((c) => matchesXiaomiIdentity(c, ident)) || null;
-}
+// Shared identity matching for Xiaomi MiMo connections.
+//
+// MiMo has two credential families (desktop account session + sk- API key) and
+// several ways they arrive (QR import, browser authorization, manual key). All
+// of them must resolve to ONE connection per Xiaomi account, otherwise the
+// dashboard shows duplicate rows for the same uid and routing picks a row that
+// lacks the credential the requested model needs.
+//
+// Match priority (first hit wins):
+//   1. uid          — the account id the browser/desktop flow reports
+//   2. mimoUserId   — the desktop-session account id (covers uid-less payloads)
+//   3. email        — `${uid}@xiaomi` synthetic address
+//   4. accessToken  — exact key/token reuse (same file imported twice)
+//
+// Every caller must go through this so the rules cannot drift apart again.
+
+// The two cards that share the QR/browser/key flows this matcher dedups. It only
+// ever runs over rows the caller already filtered to ONE of these providers, so
+// accepting both cannot collapse the cards; rejecting `mimo-desktop` could not
+// either — it made the Desktop import never match its own filtered rows, so every
+// re-import stacked a duplicate. `xiaomi-tokenplan` deliberately stays out: its
+// tp- keys are a different credential family that must never dedup into a mimo
+// row.
+const XIAOMI_SESSION_CARDS = new Set(["xiaomi-mimo", "mimo-desktop"]);
+
+/**
+ * @param {object} conn      candidate connection row
+ * @param {{uid?: string|null, key?: string|null, mimoUserId?: string|null}} ident
+ * @returns {boolean}
+ */
+export function matchesXiaomiIdentity(conn, ident = {}) {
+  if (!conn || !XIAOMI_SESSION_CARDS.has(conn.provider)) return false;
+  const { uid = null, key = null, mimoUserId = null } = ident;
+  const psd = conn.providerSpecificData || {};
+
+  if (uid && (psd.uid === uid || psd.mimoUserId === uid)) return true;
+  if (uid && conn.email === `${uid}@xiaomi`) return true;
+  if (mimoUserId && psd.mimoUserId === mimoUserId) return true;
+  if (key && conn.accessToken === key) return true;
+  return false;
+}
+
+/**
+ * Find the connection that `ident` belongs to, or null.
+ * @param {Array<object>} connections
+ * @param {{uid?: string|null, key?: string|null, mimoUserId?: string|null}} ident
+ */
+export function findXiaomiConnection(connections, ident = {}) {
+  return (connections || []).find((c) => matchesXiaomiIdentity(c, ident)) || null;
+}

package/app/src/lib/updater/updater.js

@@ -13,7 +13,27 @@ const os = require("os");
 // script can't import that ESM config, so the fallback is duplicated — keep it in
 // step with UPDATER_CONFIG.npmPackageName; the bare `10router` on npm belongs to
 // an unrelated fork.
-const packageName = process.env.UPDATER_PKG_NAME || "@techysy/10router";
+const EXPECTED_PACKAGE = "@techysy/10router";
+const packageName = process.env.UPDATER_PKG_NAME || EXPECTED_PACKAGE;
+
+// Issue #9, item 6: this process is spawned by an authenticated route, but it runs
+// npm as the user and used to trust UPDATER_PKG_NAME outright — one environment
+// variable could point the "update" at an arbitrary npm package. Only our own
+// package is ever installed, and the target version is pinned rather than left to
+// whatever `latest` resolves to at install time (so the thing that lands is the
+// thing the dashboard told the user about).
+const packageNameMismatch = packageName !== EXPECTED_PACKAGE;
+const targetVersion = (process.env.UPDATER_TARGET_VERSION || "").trim();
+const targetVersionValid = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.]+)?$/.test(targetVersion);
+const prereleaseAllowed = process.env.UPDATER_ALLOW_PRERELEASE === "1";
+const refusal =
+  packageNameMismatch
+    ? `refusing to update: unexpected package name ${JSON.stringify(packageName)} (expected ${EXPECTED_PACKAGE})`
+    : !targetVersionValid
+      ? "refusing to update: no valid target version was provided (set UPDATER_TARGET_VERSION)"
+      : !prereleaseAllowed && targetVersion.includes("-")
+        ? `refusing to update: ${targetVersion} is not a release version (set UPDATER_ALLOW_PRERELEASE=1 to allow pre-releases)`
+        : null;
 const port = parseInt(process.env.UPDATER_PORT || "20129", 10);
 const tailLines = parseInt(process.env.UPDATER_TAIL_LINES || "8", 10);
 const maxRetries = parseInt(process.env.UPDATER_RETRIES || "3", 10);
@@ -40,6 +60,7 @@ const logFile = path.join(updateDir, "install.log");
 const state = {
   phase: "starting",
   packageName,
+  targetVersion: targetVersionValid ? targetVersion : null,
   startedAt: Date.now(),
   finishedAt: null,
   attempt: 0,
@@ -68,9 +89,15 @@ function setPhase(phase) {
   persistStatus();
 }
 
-// HTTP server exposing status (browser polls this while Next server is dead)
+// HTTP server exposing status on loopback (issue #9, item 6).
+//
+// It used to answer with `Access-Control-Allow-Origin: *`, which let any web page
+// the operator happened to visit read this endpoint (package name, version,
+// phase, log tail) — a free fingerprint of the install. Nothing needs the wide
+// header any more: the dashboard's legacy status poll was replaced by the
+// "copy install command + shutdown" flow, so the only readers left are the
+// updater's own status.json and a human curling 127.0.0.1.
 const server = http.createServer((req, res) => {
-  res.setHeader("Access-Control-Allow-Origin", "*");
   res.setHeader("Cache-Control", "no-store");
   if (req.url === "/update/status" || req.url === "/") {
     res.setHeader("Content-Type", "application/json");
@@ -132,14 +159,30 @@ function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
 
+// What actually gets installed: our package at the pinned version.
+const installSpec = `${packageName}@${targetVersion}`;
+
 function runInstall() {
+  if (refusal) {
+    // Refuse before touching npm. The dashboard surfaces state.error, so the
+    // operator sees why nothing happened instead of a silent no-op.
+    pushLog(`[updater] ${refusal}`);
+    state.phase = "refused";
+    state.error = refusal;
+    state.done = true;
+    state.success = false;
+    state.finishedAt = Date.now();
+    persistStatus();
+    return;
+  }
+
   state.attempt += 1;
   setPhase("installing");
-  pushLog(`[updater] attempt ${state.attempt}/${maxRetries} — npm i -g ${packageName} --prefer-online`);
+  pushLog(`[updater] attempt ${state.attempt}/${maxRetries} — npm i -g ${installSpec} --prefer-online`);
 
   const isWin = process.platform === "win32";
   const cmd = isWin ? "npm.cmd" : "npm";
-  const args = ["i", "-g", packageName, "--prefer-online"];
+  const args = ["i", "-g", installSpec, "--prefer-online"];
 
   const child = spawn(cmd, args, {
     stdio: ["ignore", "pipe", "pipe"],
@@ -164,6 +207,25 @@ function runInstall() {
   child.on("close", (code) => {
     pushLog(`[updater] npm exited with code ${code}`);
     if (code === 0) {
+      const installed = readInstalledVersion();
+      if (installed && installed !== targetVersion) {
+        // npm succeeded but a different version is on disk: never report success
+        // for something we cannot name. This is the "installed 1.2.0, reported
+        // 1.2.1" class of surprise, now loud.
+        const message = `installed ${installed}, expected ${targetVersion}`;
+        pushLog(`[updater] ${message}`);
+        finalize(false, code, message);
+        return;
+      }
+      if (installed) {
+        pushLog(`[updater] verified installed version: ${installed}`);
+      } else {
+        // npm exited 0 but readInstalledVersion() came back null — the install
+        // command succeeded, so report success, but do NOT claim a verification
+        // we did not actually perform (it used to print the TARGET version as if
+        // confirmed on disk).
+        pushLog(`[updater] npm exited 0 but the installed version could not be verified on disk`);
+      }
       finalize(true, code, null);
       return;
     }
@@ -176,6 +238,34 @@ function runInstall() {
   });
 }
 
+// Read back what npm actually put on disk. Best effort: an unreadable answer
+// (unusual global prefix, npm missing) is not treated as a mismatch — the
+// version is logged as unknown rather than failing an install that worked.
+function readInstalledVersion() {
+  try {
+    const { execFileSync } = require("child_process");
+    const isWin = process.platform === "win32";
+    const out = execFileSync(isWin ? "npm.cmd" : "npm", ["ls", "-g", packageName, "--json", "--depth=0"], {
+      encoding: "utf8",
+      windowsHide: true,
+      shell: isWin,
+      timeout: 20000,
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+    const parsed = JSON.parse(out);
+    return parsed?.dependencies?.[packageName]?.version || null;
+  } catch (e) {
+    // npm ls exits non-zero when the tree is odd; its stdout may still parse.
+    const stdout = e && typeof e.stdout === "string" ? e.stdout : "";
+    try {
+      const parsed = JSON.parse(stdout);
+      return parsed?.dependencies?.[packageName]?.version || null;
+    } catch {
+      return null;
+    }
+  }
+}
+
 function openBrowser(url) {
   const platform = process.platform;
   const cmd = platform === "darwin" ? `open "${url}"`