@tomorrowos/sdk 1.0.1 → 1.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomorrowos/sdk",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "Server SDK for building and self-hosting digital signage CMS products with TomorrowOS players.",
   "type": "module",
   "main": "./dist/index.js",

package/templates/cms-starter/.env.example

@@ -17,3 +17,7 @@
 
 # Optional: override the default deterministic pairing-code secret.
 # PAIRING_CODE_SECRET=
+
+# Optional CMS password.
+# Leave unset for open admin (local/dev). Set later via .env or host Secrets, then restart.
+# CMS_PASSWORD=

package/templates/cms-starter/README.md

@@ -10,6 +10,18 @@ npm install
 npm run dev
 ```
 
+### Optional CMS password
+
+Set `CMS_PASSWORD` in `.env` (or host Secrets) to lock the admin UI:
+
+```env
+CMS_PASSWORD=your-strong-password
+```
+
+- **Optional:** leave unset → Control Panel stays open (dev mode).
+- **Set later:** add the env var and restart the server.
+- Sign in at `/login` when the password is enabled.
+
 By default, the starter uses SQLite at `data/tomorrowos.db`. The database is
 created by `tomorrowos init` and the server will also create missing tables on
 startup.

package/templates/cms-starter/cms-auth.ts

@@ -0,0 +1,292 @@
+/**
+ * Optional Control Panel auth for CMS starters.
+ *
+ * - CMS_PASSWORD unset → admin UI stays open (dev mode).
+ * - CMS_PASSWORD set → browser admin requires login; device paths stay public.
+ *
+ * Device-safe (always open): WebSocket upgrades (not handled here),
+ * GET /brand.json, GET /devices, GET /status, GET/HEAD /uploads/*.
+ */
+
+import { createHmac, timingSafeEqual } from "crypto";
+import type { IncomingMessage, Server, ServerResponse } from "http";
+
+const COOKIE_NAME = "tomorrowos_panel";
+const SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+
+export function getCmsPassword(): string {
+  return String(process.env.CMS_PASSWORD || "").trim();
+}
+
+export function isCmsAuthEnabled(): boolean {
+  return getCmsPassword().length > 0;
+}
+
+export function isDevicePublicPath(method: string, pathname: string): boolean {
+  const m = method.toUpperCase();
+  if (m !== "GET" && m !== "HEAD") return false;
+  if (pathname === "/brand.json") return true;
+  if (pathname === "/devices") return true;
+  if (pathname === "/status") return true;
+  if (pathname === "/uploads" || pathname.startsWith("/uploads/")) return true;
+  return false;
+}
+
+function safeEqualString(a: string, b: string): boolean {
+  const left = Buffer.from(a, "utf8");
+  const right = Buffer.from(b, "utf8");
+  if (left.length !== right.length) return false;
+  return timingSafeEqual(left, right);
+}
+
+function signSession(password: string, exp: number): string {
+  const payload = `exp=${exp}`;
+  const sig = createHmac("sha256", password).update(payload).digest("base64url");
+  return `${payload}.${sig}`;
+}
+
+function verifySession(password: string, token: string | undefined): boolean {
+  if (!token) return false;
+  const parts = token.split(".");
+  if (parts.length !== 2) return false;
+  const [payload, sig] = parts;
+  const expected = createHmac("sha256", password).update(payload).digest("base64url");
+  if (!safeEqualString(sig, expected)) return false;
+  const expMatch = /^exp=(\d+)$/.exec(payload);
+  if (!expMatch) return false;
+  const exp = Number(expMatch[1]);
+  return Number.isFinite(exp) && Date.now() <= exp;
+}
+
+function parseCookies(req: IncomingMessage): Record<string, string> {
+  const header = req.headers.cookie;
+  if (!header) return {};
+  const out: Record<string, string> = {};
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx <= 0) continue;
+    const key = part.slice(0, idx).trim();
+    const value = part.slice(idx + 1).trim();
+    out[key] = decodeURIComponent(value);
+  }
+  return out;
+}
+
+function wantsHtml(req: IncomingMessage): boolean {
+  const accept = String(req.headers.accept || "");
+  if (accept.includes("application/json") && !accept.includes("text/html")) {
+    return false;
+  }
+  if (accept.includes("text/html")) return true;
+  if (!accept || accept.includes("*/*")) return true;
+  return false;
+}
+
+function isHttpsRequest(req: IncomingMessage): boolean {
+  const xf = String(req.headers["x-forwarded-proto"] || "")
+    .split(",")[0]
+    .trim()
+    .toLowerCase();
+  if (xf === "https") return true;
+  return Boolean((req.socket as { encrypted?: boolean }).encrypted);
+}
+
+function sendJson(res: ServerResponse, status: number, body: Record<string, unknown>) {
+  const payload = JSON.stringify(body);
+  res.writeHead(status, {
+    "Content-Type": "application/json; charset=utf-8",
+    "Cache-Control": "no-store"
+  });
+  res.end(payload);
+}
+
+function loginPageHtml(error?: string): string {
+  const err = error
+    ? `<p style="color:#b91c1c;margin:0 0 1rem;font-size:0.95rem">${escapeHtml(error)}</p>`
+    : "";
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>TomorrowOS Control Panel — Login</title>
+  <style>
+    body { font-family: system-ui, sans-serif; background: #f4f4f5; margin: 0; min-height: 100vh; display: grid; place-items: center; }
+    .card { background: #fff; border: 1px solid #e4e4e7; border-radius: 12px; padding: 2rem; width: min(420px, 92vw); box-shadow: 0 8px 24px rgba(0,0,0,.04); }
+    h1 { font-size: 1.25rem; margin: 0 0 .35rem; }
+    p.hint { color: #71717a; font-size: .9rem; margin: 0 0 1.25rem; line-height: 1.4; }
+    label { display: block; font-size: .85rem; font-weight: 600; margin-bottom: .4rem; }
+    input[type=password] { width: 100%; box-sizing: border-box; padding: .7rem .8rem; border: 1px solid #d4d4d8; border-radius: 8px; font-size: 1rem; }
+    button { margin-top: 1rem; width: 100%; padding: .75rem 1rem; border: 0; border-radius: 8px; background: #111; color: #fff; font-weight: 600; cursor: pointer; }
+    button:hover { background: #27272a; }
+  </style>
+</head>
+<body>
+  <form class="card" method="POST" action="/login" autocomplete="current-password">
+    <h1>CMS login</h1>
+    <p class="hint">Enter your CMS password to login.</p>
+    ${err}
+    <label for="password">Password</label>
+    <input id="password" name="password" type="password" required autofocus />
+    <button type="submit">Sign in</button>
+  </form>
+</body>
+</html>`;
+}
+
+function escapeHtml(value: string): string {
+  return value
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;");
+}
+
+async function readBody(req: IncomingMessage): Promise<string> {
+  const chunks: Buffer[] = [];
+  for await (const chunk of req) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+function parseFormPassword(raw: string, contentType: string | undefined): string {
+  if ((contentType || "").includes("application/json")) {
+    try {
+      const data = JSON.parse(raw) as { password?: unknown };
+      return String(data.password || "");
+    } catch {
+      return "";
+    }
+  }
+  const params = new URLSearchParams(raw);
+  return String(params.get("password") || "");
+}
+
+function setSessionCookie(res: ServerResponse, token: string, secure: boolean) {
+  const maxAge = Math.floor(SESSION_TTL_MS / 1000);
+  const securePart = secure ? "; Secure" : "";
+  res.setHeader(
+    "Set-Cookie",
+    `${COOKIE_NAME}=${encodeURIComponent(token)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAge}${securePart}`
+  );
+}
+
+function clearSessionCookie(res: ServerResponse, secure: boolean) {
+  const securePart = secure ? "; Secure" : "";
+  res.setHeader(
+    "Set-Cookie",
+    `${COOKIE_NAME}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${securePart}`
+  );
+}
+
+/**
+ * Returns true if the request was fully handled (caller must not forward to SDK).
+ * Returns false if the request should continue to TomorrowOS HTTP handling.
+ */
+export async function handleCmsAuth(
+  req: IncomingMessage,
+  res: ServerResponse
+): Promise<boolean> {
+  if (!isCmsAuthEnabled()) return false;
+
+  const password = getCmsPassword();
+  const method = String(req.method || "GET").toUpperCase();
+  const url = new URL(req.url || "/", "http://localhost");
+  let pathname = url.pathname || "/";
+  if (pathname.length > 1 && pathname.endsWith("/")) {
+    pathname = pathname.slice(0, -1);
+  }
+
+  if (isDevicePublicPath(method, pathname)) return false;
+
+  if (method === "GET" && pathname === "/login") {
+    res.writeHead(200, {
+      "Content-Type": "text/html; charset=utf-8",
+      "Cache-Control": "no-store"
+    });
+    res.end(loginPageHtml());
+    return true;
+  }
+
+  if (method === "POST" && pathname === "/logout") {
+    clearSessionCookie(res, isHttpsRequest(req));
+    res.writeHead(303, { Location: "/login" });
+    res.end();
+    return true;
+  }
+
+  if (method === "POST" && pathname === "/login") {
+    const raw = await readBody(req);
+    const submitted = parseFormPassword(raw, req.headers["content-type"]);
+    if (!safeEqualString(submitted, password)) {
+      res.writeHead(401, {
+        "Content-Type": "text/html; charset=utf-8",
+        "Cache-Control": "no-store"
+      });
+      res.end(loginPageHtml("Incorrect password."));
+      return true;
+    }
+    const token = signSession(password, Date.now() + SESSION_TTL_MS);
+    setSessionCookie(res, token, isHttpsRequest(req));
+    const acceptJson =
+      String(req.headers.accept || "").includes("application/json") ||
+      String(req.headers["content-type"] || "").includes("application/json");
+    if (acceptJson) {
+      sendJson(res, 200, { status: "success" });
+      return true;
+    }
+    res.writeHead(303, { Location: "/" });
+    res.end();
+    return true;
+  }
+
+  const cookies = parseCookies(req);
+  if (verifySession(password, cookies[COOKIE_NAME])) return false;
+
+  if (wantsHtml(req) && method === "GET") {
+    res.writeHead(303, { Location: "/login" });
+    res.end();
+    return true;
+  }
+
+  sendJson(res, 401, {
+    status: "failed",
+    error:
+      "Control Panel authentication required. Sign in at /login or set cookie after POST /login."
+  });
+  return true;
+}
+
+/** Wrap an http.Server created by TomorrowOS.listen so panel routes can require CMS_PASSWORD. */
+export function attachCmsAuth(server: Server): void {
+  const sdkRequestListeners = server.listeners("request").slice() as Array<
+    (req: IncomingMessage, res: ServerResponse) => void
+  >;
+  server.removeAllListeners("request");
+  server.on("request", (req, res) => {
+    void (async () => {
+      try {
+        if (await handleCmsAuth(req, res)) return;
+        for (const listener of sdkRequestListeners) {
+          listener.call(server, req, res);
+        }
+      } catch (err) {
+        console.error("[TomorrowOS] cms auth / request failed:", err);
+        if (!res.headersSent) {
+          res.writeHead(500, { "Content-Type": "application/json; charset=utf-8" });
+          res.end(JSON.stringify({ status: "failed", error: "Internal server error" }));
+        }
+      }
+    })();
+  });
+
+  if (isCmsAuthEnabled()) {
+    console.log("[TomorrowOS] CMS_PASSWORD is set — Control Panel requires /login");
+    console.log(
+      "[TomorrowOS] Device paths remain open: WebSocket, /brand.json, /devices, /uploads/*"
+    );
+  } else {
+    console.log("[TomorrowOS] CMS_PASSWORD unset — Control Panel is open (dev mode)");
+  }
+}

package/templates/cms-starter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "my-cms",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "CMS server on @tomorrowos/sdk. Add your UI (React, static files, etc.) alongside this server.",
   "private": true,
   "type": "module",
@@ -12,7 +12,7 @@
     "start": "tsx server.ts"
   },
   "dependencies": {
-    "@tomorrowos/sdk": "^1.0.1",
+    "@tomorrowos/sdk": "^1.1.0",
     "dotenv": "^17.2.3",
     "tsx": "^4.19.0"
   },

package/templates/cms-starter/public/assets/player-download/windows.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="110" width="480" fill="#0078d6" viewBox="0 0 480 110"><path d="M217.562 22.397l-17.55 62.132h-8.533l-12.783-45.407c-.547-1.935-.882-4.044-.996-6.326h-.172a32.143 32.143 0 01-1.126 6.24l-12.867 45.493h-8.45l-18.198-62.132h8.014l13.216 47.66a31.354 31.354 0 011.04 6.24h.218c.144-1.532.588-3.61 1.341-6.24l13.736-47.66h6.975l13.17 48.008c.462 1.645.807 3.582 1.04 5.805h.172c.115-1.5.505-3.493 1.172-5.978L209.675 22.4h7.887v-.003zm9.786 6.498c-1.272 0-2.355-.434-3.25-1.301s-1.341-1.962-1.341-3.293c0-1.326.449-2.434 1.341-3.317.898-.88 1.978-1.32 3.25-1.32 1.3 0 2.404.443 3.316 1.32.908.883 1.364 1.988 1.364 3.317 0 1.272-.456 2.355-1.364 3.25-.912.897-2.015 1.344-3.316 1.344zm3.466 55.634h-7.106V40.16h7.106zm47.754 0h-7.106V59.227c0-9.416-3.438-14.124-10.31-14.124-3.553 0-6.494 1.336-8.819 4.008-2.327 2.672-3.488 6.044-3.488 10.116v25.302h-7.107V40.16h7.107v7.365h.172c3.35-5.603 8.202-8.404 14.558-8.404 4.852 0 8.564 1.567 11.135 4.7 2.573 3.134 3.856 7.662 3.856 13.582v27.125h.003zm50.549 0h-7.107v-7.54h-.172c-3.293 5.72-8.38 8.58-15.252 8.58-5.575 0-10.03-1.986-13.366-5.959-3.334-3.97-5.005-9.38-5.005-16.226 0-7.337 1.848-13.216 5.547-17.632 3.697-4.422 8.62-6.63 14.776-6.63 6.092 0 10.526 2.398 13.3 7.192h.172v-27.47h7.107zm-7.104-20.06v-6.543c0-3.58-1.187-6.612-3.552-9.1-2.37-2.481-5.372-3.726-9.013-3.726-4.333 0-7.743 1.59-10.225 4.766-2.484 3.18-3.727 7.568-3.727 13.171 0 5.114 1.192 9.15 3.575 12.109 2.38 2.96 5.58 4.441 9.596 4.441 3.958 0 7.17-1.427 9.642-4.29 2.467-2.857 3.704-6.47 3.704-10.827zm38.166 21.099c-6.559 0-11.792-2.071-15.706-6.216-3.915-4.146-5.87-9.642-5.87-16.487 0-7.452 2.037-13.273 6.11-17.46 4.07-4.19 9.574-6.286 16.508-6.286 6.612 0 11.779 2.036 15.488 6.11 3.712 4.07 5.567 9.72 5.567 16.941 0 7.078-2 12.745-6 17.007-4.001 4.261-9.366 6.391-16.097 6.391zm.52-40.468c-4.566 0-8.177 1.552-10.831 4.657-2.66 3.109-3.986 7.388-3.986 12.847 0 5.258 1.342 9.4 4.032 12.435 2.684 3.03 6.282 4.548 10.787 4.548 4.594 0 8.123-1.488 10.595-4.464 2.47-2.974 3.704-7.206 3.704-12.694 0-5.548-1.235-9.82-3.704-12.826-2.472-3-6.003-4.503-10.597-4.503zm85.611-4.939l-13.3 44.368h-7.368l-9.14-31.76c-.347-1.214-.58-2.583-.692-4.114h-.172c-.086 1.039-.39 2.38-.91 4.03l-9.92 31.846H397.7l-13.432-44.367h7.451l9.183 33.359c.287 1.012.49 2.34.606 3.985h.347c.087-1.27.348-2.626.781-4.071l10.225-33.276h6.498l9.185 33.448c.287 1.07.505 2.399.652 3.986h.347c.056-1.126.302-2.454.735-3.986l9.013-33.448zm3.293 42.763v-7.626c3.87 2.862 8.13 4.29 12.78 4.29 6.24 0 9.358-2.08 9.358-6.24 0-1.184-.266-2.188-.798-3.012-.533-.824-1.258-1.551-2.166-2.188-.91-.634-1.98-1.207-3.204-1.711a231.663 231.663 0 00-3.965-1.582c-1.965-.781-3.692-1.567-5.177-2.363-1.488-.794-2.728-1.689-3.727-2.687a10.01 10.01 0 01-2.254-3.403c-.505-1.27-.758-2.756-.758-4.462 0-2.079.477-3.922 1.427-5.524.956-1.605 2.226-2.946 3.813-4.031 1.59-1.083 3.403-1.9 5.441-2.45a24.143 24.143 0 016.3-.82c3.841 0 7.279.666 10.314 1.992v7.192c-3.268-2.137-7.023-3.207-11.267-3.207-1.329 0-2.525.152-3.595.457-1.07.301-1.985.73-2.75 1.277-.766.55-1.357 1.207-1.776 1.97a5.185 5.185 0 00-.628 2.536c0 1.156.208 2.122.628 2.905.419.778 1.032 1.47 1.841 2.079.811.603 1.793 1.154 2.946 1.643 1.159.492 2.472 1.027 3.948 1.605 1.96.753 3.724 1.526 5.283 2.317 1.56.794 2.888 1.691 3.985 2.687a10.576 10.576 0 012.536 3.443c.59 1.303.887 2.847.887 4.637 0 2.196-.48 4.102-1.45 5.72a12.403 12.403 0 01-3.877 4.028c-1.62 1.07-3.48 1.864-5.59 2.384-2.104.52-4.315.78-6.627.78-4.571.008-8.529-.874-11.878-2.636zM105.79 0L46.907 8.592v42.669h58.881zM0 15.432v35.829h42.757V9.195zm0 76.261l42.757 6.308V55.408H0zM105.79 107.3V55.408H46.907v43.207z"/></svg>

package/templates/cms-starter/public/index.html

@@ -270,6 +270,16 @@
             </a>
             <p class="player-platform-caption">Supported Tizen 6.5 and 7.0</p>
           </div>
+          <div class="player-platform-cell">
+            <a
+              href="https://tmr.sh/app/windows/TomorrowOS-Windows-Setup.exe"
+              class="player-platform-link"
+              rel="noopener noreferrer"
+            >
+              <img src="./assets/player-download/windows.svg" alt="Windows" class="player-platform-logo player-platform-logo--wide" />
+            </a>
+            <p class="player-platform-caption">Supported Windows 11</p>
+          </div>
           <div class="player-platform-cell">
             <img src="./assets/player-download/android.svg" alt="Android" class="player-platform-logo player-platform-logo--wide" />
             <p class="player-platform-caption player-platform-caption--muted">Planned</p>

package/templates/cms-starter/public/panel.css

@@ -1068,7 +1068,7 @@ button.danger {
 
 .player-platform-grid {
   display: grid;
-  padding:1.5rem;
+  padding: 1.5rem 1.5rem 0.5rem;
  
   grid-template-columns: 1fr 1fr;
   gap: 1.75rem 2rem;
@@ -1080,7 +1080,7 @@ button.danger {
   flex-direction: column;
   align-items: center;
   gap: 0.45rem;
-  min-height: 5.5rem;
+  min-height: 4.25rem;
 }
 
 .player-platform-link {
@@ -1124,8 +1124,8 @@ button.danger {
 }
 
 .player-platform-diy {
-  margin-top: 1.35rem;
-  padding-top: 1.35rem;
+  margin-top: 0.55rem;
+  padding-top: 1.15rem;
   border-top: 1px solid #e4e1dc;
   display: flex;
   flex-direction: column;

package/templates/cms-starter/server.ts

@@ -1,6 +1,9 @@
 /**
  * TomorrowOS CMS server — minimal starter.
  * Uses SQLite by default so pairings/playlists survive server restarts.
+ *
+ * Optional Control Panel lock: set CMS_PASSWORD in env / .env / host Secrets.
+ * Device WebSocket + brand.json + /devices + /uploads stay reachable without it.
  */
 
 import "dotenv/config";
@@ -8,6 +11,7 @@ import { readFileSync } from "fs";
 import { fileURLToPath } from "url";
 import { dirname, join } from "path";
 import { createTomorrowOSStore, TomorrowOS } from "@tomorrowos/sdk";
+import { attachCmsAuth } from "./cms-auth.js";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const brand = JSON.parse(readFileSync(join(__dirname, "brand.json"), "utf8"));
@@ -19,10 +23,21 @@ const store = createTomorrowOSStore({
 
 const tomorrowos = new TomorrowOS({ brand, store });
 
+const port = Number(process.env.PORT) || 3000;
+const host = "0.0.0.0";
+
 const server = tomorrowos.listen({
-  port: Number(process.env.PORT) || 3000,
-  host: "0.0.0.0",
+  port,
+  host,
   staticRoot: join(__dirname, "public"),
+  // Wrap `request` for optional CMS auth, then listen ourselves.
+  autoListen: false
+});
+
+attachCmsAuth(server);
+
+server.listen(port, host, () => {
+  console.log(`[TomorrowOS] listening on http://${host}:${port}`);
 });
 
 tomorrowos.on("device.paired", (event) => {

package/templates/cms-starter-v0/.env.example

@@ -17,3 +17,7 @@
 
 # Optional: override the default deterministic pairing-code secret.
 # PAIRING_CODE_SECRET=
+
+# Optional CMS password.
+# Leave unset for open admin (local/dev). Set later via .env or host Secrets, then restart.
+# CMS_PASSWORD=

package/templates/cms-starter-v0/README.md

@@ -25,6 +25,10 @@ npm run dev
 
 Open `http://localhost:3000`. Pairing uses `ws://localhost:3000/` (root path).
 
+### Optional CMS password
+
+Set `CMS_PASSWORD` in `.env` or Vercel/Replit Secrets to lock the admin UI. Leave unset for open admin. Sign in at `/login` when enabled.
+
 ### v0-style Preview
 
 ```bash

package/templates/cms-starter-v0/cms-app.ts

@@ -10,6 +10,7 @@ import { readFileSync } from "fs";
 import { fileURLToPath } from "url";
 import { dirname, join } from "path";
 import { createTomorrowOSStore, TomorrowOS } from "@tomorrowos/sdk";
+import { attachCmsAuth } from "./cms-auth.js";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const brand = JSON.parse(readFileSync(join(__dirname, "brand.json"), "utf8"));
@@ -34,6 +35,8 @@ export const server = tomorrowos.listen({
   // autoListen defaults to false when process.env.VERCEL is set
 });
 
+// Optional CMS_PASSWORD lock for Control Panel (device paths stay open).
+attachCmsAuth(server);
 tomorrowos.on("device.paired", (event) => {
   console.log(`[TomorrowOS] device paired: ${event.deviceId}`);
   void tomorrowos.pushLatestPolicyToDevice(event.deviceId).then((r) => {