@wppconnect/server-cli 1.3.51 → 1.3.53

package/CHANGELOG.md

@@ -1,3 +1,11 @@
+## [1.3.53](https://github.com/wppconnect-team/server-cli/compare/v1.3.52...v1.3.53) (2026-10-18)
+
+## [1.3.52](https://github.com/wppconnect-team/server-cli/compare/v1.3.51...v1.3.52) (2026-10-17)
+
+### Bug Fixes
+
+- require a non-default secretKey and add HTTP auth regression tests ([f3859c1](https://github.com/wppconnect-team/server-cli/commit/f3859c1a9a1b8a62990a6bcba93d864a1157a921))
+
 ## [1.3.51](https://github.com/wppconnect-team/server-cli/compare/v1.3.50...v1.3.51) (2026-10-13)
 
 ### Bug Fixes

package/dist/index.js

@@ -32,7 +32,9 @@ var _program = require("./program");function _interopRequireWildcard(e, t) {if (
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
- */function run() {let serverOptions = {};_program.program.parse();const commandOptions = _program.program.opts();if (commandOptions.config) {try {const json = fs.readFileSync(commandOptions.config, { encoding: 'utf8' });const configOptions = JSON.parse(json);serverOptions = (0, _mergeDeep.default)({}, serverOptions, configOptions);} catch (error) {
+ */const DEFAULT_SECRET_KEY = 'THISISMYSECURETOKEN';function run() {let serverOptions = {};_program.program.parse();const commandOptions = _program.program.opts();if (commandOptions.config) {try {const json = fs.readFileSync(commandOptions.config, { encoding: 'utf8' });const configOptions = JSON.parse(json);
+      serverOptions = (0, _mergeDeep.default)({}, serverOptions, configOptions);
+    } catch (error) {
       console.log(error);
       process.exit(1);
     }
@@ -58,6 +60,22 @@ var _program = require("./program");function _interopRequireWildcard(e, t) {if (
 
   serverOptions = (0, _mergeDeep.default)({}, serverOptions, commandOptions);
 
+  // @wppconnect/server signs tokens with `secretKey` and otherwise falls back to
+  // the public default, which would let anyone mint valid tokens. An explicit
+  // empty/null value would also override that fallback (mergeDeep keeps it), so
+  // blank values count as unset and the validated secret is passed explicitly.
+  const isUsable = (value) => typeof value === 'string' && value.trim() !== '';
+  const secretKey = isUsable(serverOptions.secretKey) ? serverOptions.secretKey : process.env.SECRET_KEY;
+
+  if (!isUsable(secretKey) || secretKey === DEFAULT_SECRET_KEY) {
+    console.error(
+      'Erro: nenhuma "secretKey" segura foi definida. Configure --secretKey, "secretKey" no arquivo de configuração ou a variável SECRET_KEY (o valor padrão público não é aceito).'
+    );
+    process.exit(1);
+  }
+
+  serverOptions.secretKey = secretKey;
+
   const { app } = (0, _server.initServer)(serverOptions);
 
   if (commandOptions.frontend) {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["_server","require","express","_interopRequireWildcard","fs","path","_mergeDeep","_interopRequireDefault","_program","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","run","serverOptions","program","parse","commandOptions","opts","config","json","readFileSync","encoding","configOptions","JSON","mergeDeep","error","console","log","process","exit","subOptions","key","opt","find","startsWith","name","substr","length","newName","toLowerCase","slice","app","initServer","frontend","frontendPath","frontendPackage","resolve","join","dirname","use","req","res","send","static","next","accepts","sendfile","env"],"sources":["../src/index.js"],"sourcesContent":["/*\n * Copyright 2021 WPPConnect Team\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { initServer } from '@wppconnect/server';\nimport * as express from 'express';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport mergeDeep from 'merge-deep';\nimport { program } from './program';\n\nexport function run() {\n  let serverOptions = {};\n\n  program.parse();\n  const commandOptions = program.opts();\n\n  if (commandOptions.config) {\n    try {\n      const json = fs.readFileSync(commandOptions.config, { encoding: 'utf8' });\n      const configOptions = JSON.parse(json);\n\n      serverOptions = mergeDeep({}, serverOptions, configOptions);\n    } catch (error) {\n      console.log(error);\n      process.exit(1);\n    }\n\n    delete commandOptions.config;\n  }\n\n  const subOptions = ['webhook', 'archive', 'log', 'createOptions'];\n\n  for (const key in commandOptions) {\n    const opt = subOptions.find((opt) => key.startsWith(opt));\n\n    if (opt) {\n      commandOptions[opt] = commandOptions[opt] || {};\n\n      const name = key.substr(opt.length);\n      const newName = name[0].toLowerCase() + name.slice(1);\n\n      commandOptions[opt][newName] = commandOptions[key];\n      delete commandOptions[key];\n    }\n  }\n\n  serverOptions = mergeDeep({}, serverOptions, commandOptions);\n\n  const { app } = initServer(serverOptions);\n\n  if (commandOptions.frontend) {\n    let frontendPath = commandOptions.frontendPath;\n\n    if (!frontendPath) {\n      try {\n        const frontendPackage = require.resolve('@wppconnect/frontend/package.json');\n        frontendPath = path.join(path.dirname(frontendPackage), 'build');\n      } catch (error) {\n        console.error(\n          'Não foi encontrado o caminho para o frontend, por favor defina com --frontend-path ou instale o pacote @wppconnect/frontend'\n        );\n        process.exit(1);\n      }\n    }\n\n    if (frontendPath) {\n      // Requisição de configuração do frontend\n      app.use('/config.js', (req, res) => {\n        res.set({\n          'Content-Type': 'application/javascript; charset=UTF-8',\n        });\n        res.send(`\n// Arquivo gerado automaticamente\nwindow.IP_SERVER = location.protocol + \"//\" + location.host + '/api/';\nwindow.IP_SOCKET_IO = ((location.protocol === 'https:') ? 'wss:' : 'ws:') + \"//\" + location.host;\n`);\n      });\n\n      app.use(express.static(frontendPath));\n\n      app.get('*', function (req, res, next) {\n        // Força a renderização do react para requisições do browser\n        if (req.accepts('html')) {\n          return res.sendfile(path.join(frontendPath, 'index.html'));\n        }\n        next();\n      });\n    }\n  }\n}\n\nif (process.env['RUN_SERVER']) {\n  run();\n}\n"],"mappings":";;;;;;;;;;;;;;;AAeA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,OAAA,GAAAC,uBAAA,CAAAF,OAAA;AACA,IAAAG,EAAA,GAAAD,uBAAA,CAAAF,OAAA;AACA,IAAAI,IAAA,GAAAF,uBAAA,CAAAF,OAAA;AACA,IAAAK,UAAA,GAAAC,sBAAA,CAAAN,OAAA;AACA,IAAAO,QAAA,GAAAP,OAAA,cAAoC,SAAAE,wBAAAM,CAAA,EAAAC,CAAA,4BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,GAAAE,CAAA,OAAAF,OAAA,WAAAR,uBAAA,YAAAA,CAAAM,CAAA,EAAAC,CAAA,QAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,KAAAM,CAAA,CAAAC,CAAA,CAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,gBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,KAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,OAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,CAAAM,CAAA,EAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,cAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,UAAAO,CAAA,IAAAR,CAAA,EAAAC,CAAA,IApBpC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,GAQO,SAASkB,GAAGA,CAAA,EAAG,CACpB,IAAIC,aAAa,GAAG,CAAC,CAAC,CAEtBC,gBAAO,CAACC,KAAK,CAAC,CAAC,CACf,MAAMC,cAAc,GAAGF,gBAAO,CAACG,IAAI,CAAC,CAAC,CAErC,IAAID,cAAc,CAACE,MAAM,EAAE,CACzB,IAAI,CACF,MAAMC,IAAI,GAAG/B,EAAE,CAACgC,YAAY,CAACJ,cAAc,CAACE,MAAM,EAAE,EAAEG,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CACzE,MAAMC,aAAa,GAAGC,IAAI,CAACR,KAAK,CAACI,IAAI,CAAC,CAEtCN,aAAa,GAAG,IAAAW,kBAAS,EAAC,CAAC,CAAC,EAAEX,aAAa,EAAES,aAAa,CAAC,CAC7D,CAAC,CAAC,OAAOG,KAAK,EAAE;MACdC,OAAO,CAACC,GAAG,CAACF,KAAK,CAAC;MAClBG,OAAO,CAACC,IAAI,CAAC,CAAC,CAAC;IACjB;;IAEA,OAAOb,cAAc,CAACE,MAAM;EAC9B;;EAEA,MAAMY,UAAU,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,CAAC;;EAEjE,KAAK,MAAMC,GAAG,IAAIf,cAAc,EAAE;IAChC,MAAMgB,GAAG,GAAGF,UAAU,CAACG,IAAI,CAAC,CAACD,GAAG,KAAKD,GAAG,CAACG,UAAU,CAACF,GAAG,CAAC,CAAC;;IAEzD,IAAIA,GAAG,EAAE;MACPhB,cAAc,CAACgB,GAAG,CAAC,GAAGhB,cAAc,CAACgB,GAAG,CAAC,IAAI,CAAC,CAAC;;MAE/C,MAAMG,IAAI,GAAGJ,GAAG,CAACK,MAAM,CAACJ,GAAG,CAACK,MAAM,CAAC;MACnC,MAAMC,OAAO,GAAGH,IAAI,CAAC,CAAC,CAAC,CAACI,WAAW,CAAC,CAAC,GAAGJ,IAAI,CAACK,KAAK,CAAC,CAAC,CAAC;;MAErDxB,cAAc,CAACgB,GAAG,CAAC,CAACM,OAAO,CAAC,GAAGtB,cAAc,CAACe,GAAG,CAAC;MAClD,OAAOf,cAAc,CAACe,GAAG,CAAC;IAC5B;EACF;;EAEAlB,aAAa,GAAG,IAAAW,kBAAS,EAAC,CAAC,CAAC,EAAEX,aAAa,EAAEG,cAAc,CAAC;;EAE5D,MAAM,EAAEyB,GAAG,CAAC,CAAC,GAAG,IAAAC,kBAAU,EAAC7B,aAAa,CAAC;;EAEzC,IAAIG,cAAc,CAAC2B,QAAQ,EAAE;IAC3B,IAAIC,YAAY,GAAG5B,cAAc,CAAC4B,YAAY;;IAE9C,IAAI,CAACA,YAAY,EAAE;MACjB,IAAI;QACF,MAAMC,eAAe,GAAG5D,OAAO,CAAC6D,OAAO,CAAC,mCAAmC,CAAC;QAC5EF,YAAY,GAAGvD,IAAI,CAAC0D,IAAI,CAAC1D,IAAI,CAAC2D,OAAO,CAACH,eAAe,CAAC,EAAE,OAAO,CAAC;MAClE,CAAC,CAAC,OAAOpB,KAAK,EAAE;QACdC,OAAO,CAACD,KAAK;UACX;QACF,CAAC;QACDG,OAAO,CAACC,IAAI,CAAC,CAAC,CAAC;MACjB;IACF;;IAEA,IAAIe,YAAY,EAAE;MAChB;MACAH,GAAG,CAACQ,GAAG,CAAC,YAAY,EAAE,CAACC,GAAG,EAAEC,GAAG,KAAK;QAClCA,GAAG,CAAC7C,GAAG,CAAC;UACN,cAAc,EAAE;QAClB,CAAC,CAAC;QACF6C,GAAG,CAACC,IAAI,CAAC;AACjB;AACA;AACA;AACA,CAAC,CAAC;MACI,CAAC,CAAC;;MAEFX,GAAG,CAACQ,GAAG,CAAC/D,OAAO,CAACmE,MAAM,CAACT,YAAY,CAAC,CAAC;;MAErCH,GAAG,CAACpC,GAAG,CAAC,GAAG,EAAE,UAAU6C,GAAG,EAAEC,GAAG,EAAEG,IAAI,EAAE;QACrC;QACA,IAAIJ,GAAG,CAACK,OAAO,CAAC,MAAM,CAAC,EAAE;UACvB,OAAOJ,GAAG,CAACK,QAAQ,CAACnE,IAAI,CAAC0D,IAAI,CAACH,YAAY,EAAE,YAAY,CAAC,CAAC;QAC5D;QACAU,IAAI,CAAC,CAAC;MACR,CAAC,CAAC;IACJ;EACF;AACF;;AAEA,IAAI1B,OAAO,CAAC6B,GAAG,CAAC,YAAY,CAAC,EAAE;EAC7B7C,GAAG,CAAC,CAAC;AACP","ignoreList":[]}
+{"version":3,"file":"index.js","names":["_server","require","express","_interopRequireWildcard","fs","path","_mergeDeep","_interopRequireDefault","_program","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","DEFAULT_SECRET_KEY","run","serverOptions","program","parse","commandOptions","opts","config","json","readFileSync","encoding","configOptions","JSON","mergeDeep","error","console","log","process","exit","subOptions","key","opt","find","startsWith","name","substr","length","newName","toLowerCase","slice","isUsable","value","trim","secretKey","env","SECRET_KEY","app","initServer","frontend","frontendPath","frontendPackage","resolve","join","dirname","use","req","res","send","static","next","accepts","sendfile"],"sources":["../src/index.js"],"sourcesContent":["/*\n * Copyright 2021 WPPConnect Team\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { initServer } from '@wppconnect/server';\nimport * as express from 'express';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport mergeDeep from 'merge-deep';\nimport { program } from './program';\n\nconst DEFAULT_SECRET_KEY = 'THISISMYSECURETOKEN';\n\nexport function run() {\n  let serverOptions = {};\n\n  program.parse();\n  const commandOptions = program.opts();\n\n  if (commandOptions.config) {\n    try {\n      const json = fs.readFileSync(commandOptions.config, { encoding: 'utf8' });\n      const configOptions = JSON.parse(json);\n\n      serverOptions = mergeDeep({}, serverOptions, configOptions);\n    } catch (error) {\n      console.log(error);\n      process.exit(1);\n    }\n\n    delete commandOptions.config;\n  }\n\n  const subOptions = ['webhook', 'archive', 'log', 'createOptions'];\n\n  for (const key in commandOptions) {\n    const opt = subOptions.find((opt) => key.startsWith(opt));\n\n    if (opt) {\n      commandOptions[opt] = commandOptions[opt] || {};\n\n      const name = key.substr(opt.length);\n      const newName = name[0].toLowerCase() + name.slice(1);\n\n      commandOptions[opt][newName] = commandOptions[key];\n      delete commandOptions[key];\n    }\n  }\n\n  serverOptions = mergeDeep({}, serverOptions, commandOptions);\n\n  // @wppconnect/server signs tokens with `secretKey` and otherwise falls back to\n  // the public default, which would let anyone mint valid tokens. An explicit\n  // empty/null value would also override that fallback (mergeDeep keeps it), so\n  // blank values count as unset and the validated secret is passed explicitly.\n  const isUsable = (value) => typeof value === 'string' && value.trim() !== '';\n  const secretKey = isUsable(serverOptions.secretKey) ? serverOptions.secretKey : process.env.SECRET_KEY;\n\n  if (!isUsable(secretKey) || secretKey === DEFAULT_SECRET_KEY) {\n    console.error(\n      'Erro: nenhuma \"secretKey\" segura foi definida. Configure --secretKey, \"secretKey\" no arquivo de configuração ou a variável SECRET_KEY (o valor padrão público não é aceito).'\n    );\n    process.exit(1);\n  }\n\n  serverOptions.secretKey = secretKey;\n\n  const { app } = initServer(serverOptions);\n\n  if (commandOptions.frontend) {\n    let frontendPath = commandOptions.frontendPath;\n\n    if (!frontendPath) {\n      try {\n        const frontendPackage = require.resolve('@wppconnect/frontend/package.json');\n        frontendPath = path.join(path.dirname(frontendPackage), 'build');\n      } catch (error) {\n        console.error(\n          'Não foi encontrado o caminho para o frontend, por favor defina com --frontend-path ou instale o pacote @wppconnect/frontend'\n        );\n        process.exit(1);\n      }\n    }\n\n    if (frontendPath) {\n      // Requisição de configuração do frontend\n      app.use('/config.js', (req, res) => {\n        res.set({\n          'Content-Type': 'application/javascript; charset=UTF-8',\n        });\n        res.send(`\n// Arquivo gerado automaticamente\nwindow.IP_SERVER = location.protocol + \"//\" + location.host + '/api/';\nwindow.IP_SOCKET_IO = ((location.protocol === 'https:') ? 'wss:' : 'ws:') + \"//\" + location.host;\n`);\n      });\n\n      app.use(express.static(frontendPath));\n\n      app.get('*', function (req, res, next) {\n        // Força a renderização do react para requisições do browser\n        if (req.accepts('html')) {\n          return res.sendfile(path.join(frontendPath, 'index.html'));\n        }\n        next();\n      });\n    }\n  }\n}\n\nif (process.env['RUN_SERVER']) {\n  run();\n}\n"],"mappings":";;;;;;;;;;;;;;;AAeA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,OAAA,GAAAC,uBAAA,CAAAF,OAAA;AACA,IAAAG,EAAA,GAAAD,uBAAA,CAAAF,OAAA;AACA,IAAAI,IAAA,GAAAF,uBAAA,CAAAF,OAAA;AACA,IAAAK,UAAA,GAAAC,sBAAA,CAAAN,OAAA;AACA,IAAAO,QAAA,GAAAP,OAAA,cAAoC,SAAAE,wBAAAM,CAAA,EAAAC,CAAA,4BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,GAAAE,CAAA,OAAAF,OAAA,WAAAR,uBAAA,YAAAA,CAAAM,CAAA,EAAAC,CAAA,QAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,KAAAM,CAAA,CAAAC,CAAA,CAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,gBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,KAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,OAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,CAAAM,CAAA,EAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,cAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,UAAAO,CAAA,IAAAR,CAAA,EAAAC,CAAA,IApBpC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,GAQA,MAAMkB,kBAAkB,GAAG,qBAAqB,CAEzC,SAASC,GAAGA,CAAA,EAAG,CACpB,IAAIC,aAAa,GAAG,CAAC,CAAC,CAEtBC,gBAAO,CAACC,KAAK,CAAC,CAAC,CACf,MAAMC,cAAc,GAAGF,gBAAO,CAACG,IAAI,CAAC,CAAC,CAErC,IAAID,cAAc,CAACE,MAAM,EAAE,CACzB,IAAI,CACF,MAAMC,IAAI,GAAGhC,EAAE,CAACiC,YAAY,CAACJ,cAAc,CAACE,MAAM,EAAE,EAAEG,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CACzE,MAAMC,aAAa,GAAGC,IAAI,CAACR,KAAK,CAACI,IAAI,CAAC;MAEtCN,aAAa,GAAG,IAAAW,kBAAS,EAAC,CAAC,CAAC,EAAEX,aAAa,EAAES,aAAa,CAAC;IAC7D,CAAC,CAAC,OAAOG,KAAK,EAAE;MACdC,OAAO,CAACC,GAAG,CAACF,KAAK,CAAC;MAClBG,OAAO,CAACC,IAAI,CAAC,CAAC,CAAC;IACjB;;IAEA,OAAOb,cAAc,CAACE,MAAM;EAC9B;;EAEA,MAAMY,UAAU,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,CAAC;;EAEjE,KAAK,MAAMC,GAAG,IAAIf,cAAc,EAAE;IAChC,MAAMgB,GAAG,GAAGF,UAAU,CAACG,IAAI,CAAC,CAACD,GAAG,KAAKD,GAAG,CAACG,UAAU,CAACF,GAAG,CAAC,CAAC;;IAEzD,IAAIA,GAAG,EAAE;MACPhB,cAAc,CAACgB,GAAG,CAAC,GAAGhB,cAAc,CAACgB,GAAG,CAAC,IAAI,CAAC,CAAC;;MAE/C,MAAMG,IAAI,GAAGJ,GAAG,CAACK,MAAM,CAACJ,GAAG,CAACK,MAAM,CAAC;MACnC,MAAMC,OAAO,GAAGH,IAAI,CAAC,CAAC,CAAC,CAACI,WAAW,CAAC,CAAC,GAAGJ,IAAI,CAACK,KAAK,CAAC,CAAC,CAAC;;MAErDxB,cAAc,CAACgB,GAAG,CAAC,CAACM,OAAO,CAAC,GAAGtB,cAAc,CAACe,GAAG,CAAC;MAClD,OAAOf,cAAc,CAACe,GAAG,CAAC;IAC5B;EACF;;EAEAlB,aAAa,GAAG,IAAAW,kBAAS,EAAC,CAAC,CAAC,EAAEX,aAAa,EAAEG,cAAc,CAAC;;EAE5D;EACA;EACA;EACA;EACA,MAAMyB,QAAQ,GAAGA,CAACC,KAAK,KAAK,OAAOA,KAAK,KAAK,QAAQ,IAAIA,KAAK,CAACC,IAAI,CAAC,CAAC,KAAK,EAAE;EAC5E,MAAMC,SAAS,GAAGH,QAAQ,CAAC5B,aAAa,CAAC+B,SAAS,CAAC,GAAG/B,aAAa,CAAC+B,SAAS,GAAGhB,OAAO,CAACiB,GAAG,CAACC,UAAU;;EAEtG,IAAI,CAACL,QAAQ,CAACG,SAAS,CAAC,IAAIA,SAAS,KAAKjC,kBAAkB,EAAE;IAC5De,OAAO,CAACD,KAAK;MACX;IACF,CAAC;IACDG,OAAO,CAACC,IAAI,CAAC,CAAC,CAAC;EACjB;;EAEAhB,aAAa,CAAC+B,SAAS,GAAGA,SAAS;;EAEnC,MAAM,EAAEG,GAAG,CAAC,CAAC,GAAG,IAAAC,kBAAU,EAACnC,aAAa,CAAC;;EAEzC,IAAIG,cAAc,CAACiC,QAAQ,EAAE;IAC3B,IAAIC,YAAY,GAAGlC,cAAc,CAACkC,YAAY;;IAE9C,IAAI,CAACA,YAAY,EAAE;MACjB,IAAI;QACF,MAAMC,eAAe,GAAGnE,OAAO,CAACoE,OAAO,CAAC,mCAAmC,CAAC;QAC5EF,YAAY,GAAG9D,IAAI,CAACiE,IAAI,CAACjE,IAAI,CAACkE,OAAO,CAACH,eAAe,CAAC,EAAE,OAAO,CAAC;MAClE,CAAC,CAAC,OAAO1B,KAAK,EAAE;QACdC,OAAO,CAACD,KAAK;UACX;QACF,CAAC;QACDG,OAAO,CAACC,IAAI,CAAC,CAAC,CAAC;MACjB;IACF;;IAEA,IAAIqB,YAAY,EAAE;MAChB;MACAH,GAAG,CAACQ,GAAG,CAAC,YAAY,EAAE,CAACC,GAAG,EAAEC,GAAG,KAAK;QAClCA,GAAG,CAACpD,GAAG,CAAC;UACN,cAAc,EAAE;QAClB,CAAC,CAAC;QACFoD,GAAG,CAACC,IAAI,CAAC;AACjB;AACA;AACA;AACA,CAAC,CAAC;MACI,CAAC,CAAC;;MAEFX,GAAG,CAACQ,GAAG,CAACtE,OAAO,CAAC0E,MAAM,CAACT,YAAY,CAAC,CAAC;;MAErCH,GAAG,CAAC3C,GAAG,CAAC,GAAG,EAAE,UAAUoD,GAAG,EAAEC,GAAG,EAAEG,IAAI,EAAE;QACrC;QACA,IAAIJ,GAAG,CAACK,OAAO,CAAC,MAAM,CAAC,EAAE;UACvB,OAAOJ,GAAG,CAACK,QAAQ,CAAC1E,IAAI,CAACiE,IAAI,CAACH,YAAY,EAAE,YAAY,CAAC,CAAC;QAC5D;QACAU,IAAI,CAAC,CAAC;MACR,CAAC,CAAC;IACJ;EACF;AACF;;AAEA,IAAIhC,OAAO,CAACiB,GAAG,CAAC,YAAY,CAAC,EAAE;EAC7BjC,GAAG,CAAC,CAAC;AACP","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wppconnect/server-cli",
-  "version": "1.3.51",
+  "version": "1.3.53",
   "description": "Servidor de WPPConnect com frontend para ser executado a partir de uma linha de comando",
   "repository": {
     "type": "git",
@@ -24,7 +24,8 @@
     "prepare": "husky",
     "release": "release-it",
     "start": "cross-env RUN_SERVER=1 babel-node src",
-    "watch": "nodemon -w src --exec \"babel-node src\""
+    "watch": "nodemon -w src --exec \"babel-node src\"",
+    "test": "node --require @babel/register --test --test-force-exit \"test/**/*.test.js\""
   },
   "config": {
     "commitizen": {
@@ -39,7 +40,7 @@
     "prom-client": "^15.1.3"
   },
   "devDependencies": {
-    "@aws-sdk/client-s3": "^3.1141.0",
+    "@aws-sdk/client-s3": "^3.1152.0",
     "@babel/cli": "^7.29.7",
     "@babel/core": "^7.29.7",
     "@babel/eslint-parser": "^7.29.9",
@@ -92,7 +93,7 @@
     "@wppconnect/server/**/form-data": "4.0.6",
     "@wppconnect/server/**/multer": "2.4.0",
     "@wppconnect/server/**/path-to-regexp": "0.2.5",
-    "@wppconnect/server/**/qs": "6.16.0",
+    "@wppconnect/server/**/qs": "6.16.1",
     "@wppconnect/server/**/tmp": "0.2.7",
     "@wppconnect/server/**/ws": "8.21.3",
     "**/package-json/got": "11.8.6",

package/test/auth.test.js

@@ -0,0 +1,247 @@
+import { after, describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import fs from 'node:fs';
+import net from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+
+// bcrypt is a dependency of @wppconnect/server; resolve it from there instead of
+// declaring a dependency of our own. It is what verifyToken uses to check tokens.
+const bcrypt = require(require.resolve('bcrypt', {
+  paths: [require.resolve('@wppconnect/server')],
+}));
+
+// @wppconnect/server falls back to this public secret when none is configured,
+// which lets anyone mint valid tokens through POST /api/:session/:secretkey/generate-token.
+const DEFAULT_SECRET = 'THISISMYSECURETOKEN';
+const SESSION = 'regression';
+const ROOT = path.resolve(__dirname, '..');
+const BABEL_NODE = path.join(ROOT, 'node_modules', '.bin', 'babel-node');
+
+const children = new Set();
+const tmpDirs = new Set();
+
+after(() => {
+  for (const child of children) child.kill('SIGKILL');
+  for (const dir of tmpDirs) fs.rmSync(dir, { recursive: true, force: true });
+});
+
+function freePort() {
+  return new Promise((resolve, reject) => {
+    const srv = net.createServer();
+    srv.once('error', reject);
+    srv.listen(0, () => {
+      const { port } = srv.address();
+      srv.close(() => resolve(port));
+    });
+  });
+}
+
+// Runs the real CLI entrypoint, so the effective configuration (flags, config
+// file, SECRET_KEY env) is what the HTTP assertions below are made against.
+// `config`, when given, is written to a temp file and passed as --config.
+async function startCli(args = [], env = {}, config) {
+  const port = await freePort();
+  if (config) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'wpp-cli-test-'));
+    tmpDirs.add(dir);
+    const file = path.join(dir, 'config.json');
+    fs.writeFileSync(file, JSON.stringify(config));
+    args = [...args, '--config', file];
+  }
+  const childEnv = { ...process.env, RUN_SERVER: '1', PORT: String(port), ...env };
+  for (const key of Object.keys(childEnv)) {
+    if (childEnv[key] === undefined) delete childEnv[key];
+  }
+
+  const child = spawn(BABEL_NODE, ['src', '--port', String(port), '--no-startAllSession', ...args], {
+    cwd: ROOT,
+    env: childEnv,
+  });
+  children.add(child);
+
+  let output = '';
+  child.stdout.on('data', (d) => (output += d));
+  child.stderr.on('data', (d) => (output += d));
+
+  const exited = new Promise((resolve) => child.once('exit', (code) => resolve(code)));
+
+  const outcome = await new Promise((resolve) => {
+    const timer = setTimeout(() => resolve({ listening: false }), 60000);
+    const poll = setInterval(() => {
+      if (output.includes('Server is running on port')) {
+        clearTimeout(timer);
+        clearInterval(poll);
+        resolve({ listening: true });
+      }
+    }, 100);
+    exited.then((code) => {
+      clearTimeout(timer);
+      clearInterval(poll);
+      resolve({ listening: false, code });
+    });
+  });
+
+  return {
+    ...outcome,
+    port,
+    output: () => output,
+    stop: () => child.kill('SIGKILL'),
+    url: (p) => `http://127.0.0.1:${port}${p}`,
+  };
+}
+
+async function generateToken(server, secret) {
+  const res = await fetch(server.url(`/api/${SESSION}/${secret}/generate-token`), { method: 'POST' });
+  return { status: res.status, body: await res.json() };
+}
+
+// verifyToken accepts bcrypt(session + secretKey), so a server that ends up with
+// an empty/null secret accepts hashes anyone can compute without knowing a secret.
+function forgedToken(secretSuffix) {
+  return bcrypt
+    .hashSync(SESSION + secretSuffix, 4)
+    .replace(/\//g, '_')
+    .replace(/\+/g, '-');
+}
+
+async function connectionStatus(server, token) {
+  const res = await fetch(server.url(`/api/${SESSION}/check-connection-session`), {
+    headers: { Authorization: `Bearer ${token}` },
+  });
+  return res.status;
+}
+
+// Only `secret` may work: it mints a token that is accepted; the public default
+// cannot mint one; tokens forged for an empty/null/undefined secret are rejected.
+async function assertOnlySecretWorks(server, secret) {
+  for (const suffix of ['', 'null', 'undefined']) {
+    assert.equal(
+      await connectionStatus(server, forgedToken(suffix)),
+      401,
+      `token forged for secret "${suffix}" must be rejected`
+    );
+  }
+
+  assert.equal((await generateToken(server, DEFAULT_SECRET)).status, 400);
+
+  const minted = await generateToken(server, secret);
+  assert.equal(minted.status, 201);
+  assert.equal(await connectionStatus(server, minted.body.token), 200);
+}
+
+describe('API authentication (real CLI, real HTTP)', () => {
+  describe('with a configured secretKey', () => {
+    const SECRET = 'a-unique-test-secret-0123456789';
+    let server;
+
+    it('starts', async () => {
+      server = await startCli(['--secretKey', SECRET]);
+      assert.equal(server.listening, true, server.output());
+    });
+
+    for (const route of ['check-connection-session', 'status-session']) {
+      it(`rejects ${route} without credentials`, async () => {
+        const res = await fetch(server.url(`/api/${SESSION}/${route}`));
+        assert.ok([401, 403].includes(res.status), `got ${res.status}`);
+      });
+
+      it(`rejects ${route} with an invalid token`, async () => {
+        const res = await fetch(server.url(`/api/${SESSION}/${route}`), {
+          headers: { Authorization: 'Bearer not-a-valid-token' },
+        });
+        assert.ok([401, 403].includes(res.status), `got ${res.status}`);
+      });
+    }
+
+    it('rejects a token minted from the well-known default secret', async () => {
+      const res = await fetch(server.url(`/api/${SESSION}/${DEFAULT_SECRET}/generate-token`), { method: 'POST' });
+      assert.equal(res.status, 400);
+    });
+
+    it('accepts a token minted with the configured secret', async () => {
+      const { status, body } = await generateToken(server, SECRET);
+      assert.equal(status, 201);
+
+      const res = await fetch(server.url(`/api/${SESSION}/check-connection-session`), {
+        headers: { Authorization: `Bearer ${body.token}` },
+      });
+      assert.equal(res.status, 200);
+    });
+
+    it('stops', () => server.stop());
+  });
+
+  describe('without a secretKey (falls back to the public default)', () => {
+    it('refuses to start, so no token can be minted with the default', async () => {
+      const server = await startCli([], { SECRET_KEY: undefined });
+      try {
+        assert.equal(server.listening, false, 'server must not listen');
+        assert.notEqual(server.code, 0);
+        assert.match(server.output(), /secretKey/);
+      } finally {
+        server.stop();
+      }
+    });
+
+    it('refuses an explicit --secretKey equal to the public default', async () => {
+      const server = await startCli(['--secretKey', DEFAULT_SECRET], {
+        SECRET_KEY: undefined,
+      });
+      try {
+        assert.equal(server.listening, false, 'server must not listen');
+        assert.notEqual(server.code, 0);
+      } finally {
+        server.stop();
+      }
+    });
+  });
+
+  describe('secret supplied through the SECRET_KEY environment variable', () => {
+    it('starts and enforces that secret', async () => {
+      const SECRET = 'env-provided-secret-0123456789';
+      const server = await startCli([], { SECRET_KEY: SECRET });
+      try {
+        assert.equal(server.listening, true, server.output());
+        await assertOnlySecretWorks(server, SECRET);
+      } finally {
+        server.stop();
+      }
+    });
+  });
+
+  // merge-deep lets an explicit empty/null value override the server default, so
+  // the secret the CLI validates must be the one handed to initServer.
+  describe('explicitly empty secretKey combined with SECRET_KEY', () => {
+    const SECRET = 'env-provided-secret-0123456789';
+    const cases = [
+      { name: 'config file ""', args: [], config: { secretKey: '' } },
+      { name: 'config file null', args: [], config: { secretKey: null } },
+      { name: 'config file whitespace', args: [], config: { secretKey: '  ' } },
+      { name: 'flag ""', args: ['--secretKey', ''], config: undefined },
+    ];
+
+    for (const { name, args, config } of cases) {
+      it(`uses the environment secret (${name})`, async () => {
+        const server = await startCli(args, { SECRET_KEY: SECRET }, config);
+        try {
+          assert.equal(server.listening, true, server.output());
+          await assertOnlySecretWorks(server, SECRET);
+        } finally {
+          server.stop();
+        }
+      });
+
+      it(`refuses to start without an environment secret (${name})`, async () => {
+        const server = await startCli(args, { SECRET_KEY: undefined }, config);
+        try {
+          assert.equal(server.listening, false, 'server must not listen');
+          assert.notEqual(server.code, 0);
+        } finally {
+          server.stop();
+        }
+      });
+    }
+  });
+});