@zoobbe/cli 1.1.0 → 1.1.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zoobbe/cli",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Zoobbe CLI - Manage boards, cards, and projects from the terminal",
   "main": "src/index.js",
   "bin": {

package/src/commands/auth.js

@@ -16,7 +16,16 @@ auth
   .action(async (options) => {
     try {
       if (options.url) {
-        config.set('apiUrl', options.url);
+        // Validate URL format and enforce HTTPS
+        try {
+          const parsed = new URL(options.url);
+          if (parsed.protocol !== 'https:' && !parsed.hostname.match(/^(localhost|127\.0\.0\.1)$/)) {
+            return error('API URL must use HTTPS. Only localhost is allowed over HTTP.');
+          }
+          config.set('apiUrl', options.url);
+        } catch {
+          return error('Invalid URL format.');
+        }
       }
 
       let apiKey = options.token;
@@ -107,7 +116,7 @@ auth
   .action(() => {
     const apiKey = config.get('apiKey');
     if (apiKey) {
-      success(`Authenticated (key: ${apiKey.substring(0, 16)}...)`);
+      success(`Authenticated (key: ${apiKey.substring(0, 10)}...)`);
       info(`API URL: ${config.get('apiUrl')}`);
       if (config.get('activeWorkspaceName')) {
         info(`Workspace: ${config.get('activeWorkspaceName')}`);

package/src/lib/client.js

@@ -26,6 +26,11 @@ class ZoobbeClient {
   async request(method, path, body = null) {
     this.ensureAuth();
 
+    // Reject path traversal attempts
+    if (path.includes('..') || path.includes('//')) {
+      throw new Error('Invalid request path');
+    }
+
     const url = `${this.baseUrl}/v1${path}`;
     const options = {
       method,

package/src/lib/config.js

@@ -1,10 +1,18 @@
 const Conf = require('conf');
 const path = require('path');
 const os = require('os');
+const fs = require('fs');
+
+const configDir = path.join(os.homedir(), '.zoobbe');
+
+// Ensure config directory exists with restricted permissions (owner-only)
+if (!fs.existsSync(configDir)) {
+  fs.mkdirSync(configDir, { mode: 0o700, recursive: true });
+}
 
 const config = new Conf({
   projectName: 'zoobbe',
-  cwd: path.join(os.homedir(), '.zoobbe'),
+  cwd: configDir,
   schema: {
     apiKey: { type: 'string', default: '' },
     apiUrl: { type: 'string', default: 'https://api.zoobbe.com' },
@@ -17,4 +25,11 @@ const config = new Conf({
   },
 });
 
+// Lock down the config file (owner read/write only)
+try {
+  fs.chmodSync(config.path, 0o600);
+} catch {
+  // Ignore if chmod fails (e.g., Windows)
+}
+
 module.exports = config;