agent-tower 0.5.4-beta.0 → 0.5.4-beta.1

package/dist/routes/__tests__/previews.integration.test.js

@@ -0,0 +1,269 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import http from 'node:http';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import fastifyCookie from '@fastify/cookie';
+import Fastify from 'fastify';
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it } from 'vitest';
+import { INTERNAL_API_TOKEN_ENV, INTERNAL_API_TOKEN_HEADER, } from '../../utils/internal-api-token.js';
+const testDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agent-tower-preview-routes-'));
+const dbPath = path.join(testDir, 'test.db');
+process.env.AGENT_TOWER_DATABASE_URL = `file:${dbPath}`;
+process.env.AGENT_TOWER_DATA_DIR = testDir;
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const serverRoot = path.resolve(__dirname, '../../..');
+const schemaPath = path.join(serverRoot, 'prisma/schema.prisma');
+let prisma;
+let accessAuthHook;
+let previewRoutes;
+let AccessAuthService;
+async function createPreviewFixtureApp() {
+    const upgradeUrls = [];
+    const targetServer = http.createServer((request, response) => {
+        if (request.url === '/api/echo' && request.method === 'GET') {
+            response.setHeader('content-type', 'application/json');
+            response.end(JSON.stringify({ method: 'GET', ok: true }));
+            return;
+        }
+        if (request.url === '/api/echo' && request.method === 'POST') {
+            const chunks = [];
+            request.on('data', (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));
+            request.on('end', () => {
+                response.setHeader('content-type', 'application/json');
+                response.end(JSON.stringify({
+                    method: 'POST',
+                    body: Buffer.concat(chunks).toString('utf8'),
+                    ok: true,
+                }));
+            });
+            return;
+        }
+        response.statusCode = 404;
+        response.end('not found');
+    });
+    targetServer.on('upgrade', (request, socket) => {
+        upgradeUrls.push(request.url ?? '');
+        socket.write('HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\n\r\n');
+        socket.end();
+    });
+    await new Promise((resolve) => targetServer.listen(0, '127.0.0.1', resolve));
+    const address = targetServer.address();
+    if (!address || typeof address === 'string') {
+        targetServer.close();
+        throw new Error('Failed to start preview fixture server');
+    }
+    const app = Fastify();
+    await app.register(fastifyCookie);
+    app.addHook('onRequest', accessAuthHook);
+    await app.register(previewRoutes);
+    await app.listen({ host: '127.0.0.1', port: 0 });
+    const appAddress = app.server.address();
+    if (!appAddress || typeof appAddress === 'string') {
+        await app.close();
+        targetServer.close();
+        throw new Error('Failed to start preview proxy fixture app');
+    }
+    return {
+        app,
+        appUrl: `http://127.0.0.1:${appAddress.port}`,
+        targetUrl: `http://127.0.0.1:${address.port}`,
+        upgradeUrls,
+        async close() {
+            await app.close();
+            await new Promise((resolve) => targetServer.close(() => resolve()));
+        },
+    };
+}
+async function requestWebSocketUpgrade(url, headers = {}) {
+    const parsed = new URL(url);
+    return new Promise((resolve, reject) => {
+        const request = http.request({
+            protocol: parsed.protocol,
+            hostname: parsed.hostname,
+            port: parsed.port,
+            method: 'GET',
+            path: `${parsed.pathname}${parsed.search}`,
+            headers: {
+                'connection': 'Upgrade',
+                'upgrade': 'websocket',
+                'sec-websocket-key': 'dGhlIHNhbXBsZSBub25jZQ==',
+                'sec-websocket-version': '13',
+                ...headers,
+            },
+        });
+        request.on('upgrade', (response, socket) => {
+            socket.destroy();
+            resolve({
+                statusCode: response.statusCode ?? 0,
+                statusMessage: response.statusMessage ?? '',
+            });
+        });
+        request.on('response', (response) => {
+            response.resume();
+            resolve({
+                statusCode: response.statusCode ?? 0,
+                statusMessage: response.statusMessage ?? '',
+            });
+        });
+        request.on('error', reject);
+        request.end();
+    });
+}
+async function createWorkspace(workspaceId, previewTarget) {
+    const project = await prisma.project.create({
+        data: {
+            name: `Preview project ${workspaceId}`,
+            repoPath: testDir,
+        },
+    });
+    const task = await prisma.task.create({
+        data: {
+            title: `Preview task ${workspaceId}`,
+            projectId: project.id,
+        },
+    });
+    await prisma.workspace.create({
+        data: {
+            id: workspaceId,
+            taskId: task.id,
+            branchName: `preview-${workspaceId}`,
+            worktreePath: testDir,
+            workingDir: testDir,
+            previewTarget,
+        },
+    });
+}
+describe('previewRoutes access auth integration', () => {
+    beforeAll(async () => {
+        execFileSync('pnpm', ['exec', 'prisma', 'db', 'push', '--skip-generate', `--schema=${schemaPath}`], {
+            cwd: serverRoot,
+            env: { ...process.env, AGENT_TOWER_DATABASE_URL: `file:${dbPath}` },
+            stdio: 'pipe',
+        });
+        const middlewareModule = await import('../../middleware/access-auth.js');
+        const routesModule = await import('../previews.js');
+        const serviceModule = await import('../../services/access-auth.service.js');
+        const utilsModule = await import('../../utils/index.js');
+        accessAuthHook = middlewareModule.accessAuthHook;
+        previewRoutes = routesModule.previewRoutes;
+        AccessAuthService = serviceModule.AccessAuthService;
+        prisma = utilsModule.prisma;
+    });
+    beforeEach(async () => {
+        await prisma.workspace.deleteMany();
+        await prisma.task.deleteMany();
+        await prisma.project.deleteMany();
+        await prisma.accessAuthSettings.deleteMany();
+        delete process.env[INTERNAL_API_TOKEN_ENV];
+        AccessAuthService.__test.resetLoginRateLimit();
+    });
+    afterEach(() => {
+        delete process.env[INTERNAL_API_TOKEN_ENV];
+    });
+    afterAll(async () => {
+        await prisma.$disconnect();
+        fs.rmSync(testDir, { recursive: true, force: true });
+    });
+    it('requires browser auth for legacy preview paths and allows tokenized preview API proxy requests', async () => {
+        await AccessAuthService.updateSettings({ enabled: true, newPassword: 'secret-pass' });
+        const fixture = await createPreviewFixtureApp();
+        try {
+            await createWorkspace('workspace-1', fixture.targetUrl);
+            const token = await AccessAuthService.createPreviewAccessToken('workspace-1');
+            const legacyResponse = await fixture.app.inject({
+                method: 'GET',
+                url: '/view/workspace-1/api/echo',
+            });
+            expect(legacyResponse.statusCode).toBe(401);
+            const getResponse = await fixture.app.inject({
+                method: 'GET',
+                url: `/view/workspace-1/__agent_tower_preview/${token}/api/echo`,
+            });
+            expect(getResponse.statusCode).toBe(200);
+            expect(getResponse.json()).toEqual({ method: 'GET', ok: true });
+            const postResponse = await fixture.app.inject({
+                method: 'POST',
+                url: `/view/workspace-1/__agent_tower_preview/${token}/api/echo`,
+                headers: {
+                    origin: 'null',
+                    'content-type': 'application/json',
+                    'x-custom-header': 'preview',
+                },
+                payload: { value: 42 },
+            });
+            expect(postResponse.statusCode).toBe(200);
+            expect(postResponse.json()).toEqual({
+                method: 'POST',
+                body: JSON.stringify({ value: 42 }),
+                ok: true,
+            });
+            expect(postResponse.headers['access-control-allow-origin']).toBe('*');
+            expect(postResponse.headers['access-control-allow-credentials']).toBeUndefined();
+            await expect(requestWebSocketUpgrade(`${fixture.appUrl}/view/workspace-1/__agent_tower_preview/${token}/ws`)).resolves.toMatchObject({ statusCode: 101 });
+            expect(fixture.upgradeUrls).toContain('/ws');
+        }
+        finally {
+            await fixture.close();
+        }
+    });
+    it('rejects preview websocket upgrades with invalid internal token even when preview token is valid', async () => {
+        await AccessAuthService.updateSettings({ enabled: true, newPassword: 'secret-pass' });
+        process.env[INTERNAL_API_TOKEN_ENV] = 'expected-internal-token';
+        const fixture = await createPreviewFixtureApp();
+        try {
+            await createWorkspace('workspace-preview-token', fixture.targetUrl);
+            const token = await AccessAuthService.createPreviewAccessToken('workspace-preview-token');
+            await expect(requestWebSocketUpgrade(`${fixture.appUrl}/view/workspace-preview-token/__agent_tower_preview/${token}/ws`, { [INTERNAL_API_TOKEN_HEADER]: 'wrong-internal-token' })).resolves.toMatchObject({
+                statusCode: 401,
+                statusMessage: 'Invalid Internal Token',
+            });
+            expect(fixture.upgradeUrls).not.toContain('/ws');
+            await expect(requestWebSocketUpgrade(`${fixture.appUrl}/view/workspace-preview-token/__agent_tower_preview/${token}/ws`)).resolves.toMatchObject({ statusCode: 101 });
+            expect(fixture.upgradeUrls).toContain('/ws');
+        }
+        finally {
+            await fixture.close();
+        }
+    });
+    it('rejects preview websocket upgrades with invalid internal token even when access auth cookie is valid', async () => {
+        await AccessAuthService.updateSettings({ enabled: true, newPassword: 'secret-pass' });
+        const login = await AccessAuthService.login('secret-pass');
+        expect(login.sessionToken).toBeTruthy();
+        process.env[INTERNAL_API_TOKEN_ENV] = 'expected-internal-token';
+        const fixture = await createPreviewFixtureApp();
+        try {
+            await createWorkspace('workspace-cookie', fixture.targetUrl);
+            const cookie = `${AccessAuthService.cookieName}=${encodeURIComponent(login.sessionToken ?? '')}`;
+            await expect(requestWebSocketUpgrade(`${fixture.appUrl}/view/workspace-cookie/ws`, {
+                [INTERNAL_API_TOKEN_HEADER]: 'wrong-internal-token',
+                cookie,
+            })).resolves.toMatchObject({
+                statusCode: 401,
+                statusMessage: 'Invalid Internal Token',
+            });
+            expect(fixture.upgradeUrls).not.toContain('/ws');
+            await expect(requestWebSocketUpgrade(`${fixture.appUrl}/view/workspace-cookie/ws`, { cookie })).resolves.toMatchObject({ statusCode: 101 });
+            expect(fixture.upgradeUrls).toContain('/ws');
+        }
+        finally {
+            await fixture.close();
+        }
+    });
+    it('accepts preview websocket upgrades with a valid internal token without browser auth', async () => {
+        await AccessAuthService.updateSettings({ enabled: true, newPassword: 'secret-pass' });
+        process.env[INTERNAL_API_TOKEN_ENV] = 'expected-internal-token';
+        const fixture = await createPreviewFixtureApp();
+        try {
+            await createWorkspace('workspace-internal-token', fixture.targetUrl);
+            await expect(requestWebSocketUpgrade(`${fixture.appUrl}/view/workspace-internal-token/ws`, { [INTERNAL_API_TOKEN_HEADER]: 'expected-internal-token' })).resolves.toMatchObject({ statusCode: 101 });
+            expect(fixture.upgradeUrls).toContain('/ws');
+        }
+        finally {
+            await fixture.close();
+        }
+    });
+});
+//# sourceMappingURL=previews.integration.test.js.map

package/dist/routes/__tests__/previews.integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"previews.integration.test.js","sourceRoot":"","sources":["../../../src/routes/__tests__/previews.integration.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE1F,OAAO,EACL,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAE3C,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,6BAA6B,CAAC,CAAC,CAAC;AACtF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAC7C,OAAO,CAAC,GAAG,CAAC,wBAAwB,GAAG,QAAQ,MAAM,EAAE,CAAC;AACxD,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,OAAO,CAAC;AAE3C,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AACvD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;AAEjE,IAAI,MAAoB,CAAC;AACzB,IAAI,cAA+E,CAAC;AACpF,IAAI,aAA4D,CAAC;AACjE,IAAI,iBAA2F,CAAC;AAEhG,KAAK,UAAU,uBAAuB;IACpC,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3D,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC5D,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YACvD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7D,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChG,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACrB,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBACvD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;oBAC1B,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC5C,EAAE,EAAE,IAAI;iBACT,CAAC,CAAC,CAAC;YACN,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;QAC1B,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,uFAAuF,CAAC,CAAC;QACtG,MAAM,CAAC,GAAG,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC;IACvC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,YAAY,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAClC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACzC,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAClC,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IACxC,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QAClB,YAAY,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO;QACL,GAAG;QACH,MAAM,EAAE,oBAAoB,UAAU,CAAC,IAAI,EAAE;QAC7C,SAAS,EAAE,oBAAoB,OAAO,CAAC,IAAI,EAAE;QAC7C,WAAW;QACX,KAAK,CAAC,KAAK;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,GAAW,EACX,UAAkC,EAAE;IAEpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAE5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE;YAC1C,OAAO,EAAE;gBACP,YAAY,EAAE,SAAS;gBACvB,SAAS,EAAE,WAAW;gBACtB,mBAAmB,EAAE,0BAA0B;gBAC/C,uBAAuB,EAAE,IAAI;gBAC7B,GAAG,OAAO;aACX;SACF,CAAC,CAAC;QAEH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;YACzC,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC;gBACN,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,CAAC;gBACpC,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE;YAClC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,CAAC;gBACN,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,CAAC;gBACpC,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,WAAmB,EAAE,aAAqB;IACvE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1C,IAAI,EAAE;YACJ,IAAI,EAAE,mBAAmB,WAAW,EAAE;YACtC,QAAQ,EAAE,OAAO;SAClB;KACF,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACpC,IAAI,EAAE;YACJ,KAAK,EAAE,gBAAgB,WAAW,EAAE;YACpC,SAAS,EAAE,OAAO,CAAC,EAAE;SACtB;KACF,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;QAC5B,IAAI,EAAE;YACJ,EAAE,EAAE,WAAW;YACf,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,UAAU,EAAE,WAAW,WAAW,EAAE;YACpC,YAAY,EAAE,OAAO;YACrB,UAAU,EAAE,OAAO;YACnB,aAAa;SACd;KACF,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,YAAY,CACV,MAAM,EACN,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,YAAY,UAAU,EAAE,CAAC,EAC7E;YACE,GAAG,EAAE,UAAU;YACf,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,wBAAwB,EAAE,QAAQ,MAAM,EAAE,EAAE;YACnE,KAAK,EAAE,MAAM;SACd,CACF,CAAC;QAEF,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QACzE,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;QAC5E,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACzD,cAAc,GAAG,gBAAgB,CAAC,cAAc,CAAC;QACjD,aAAa,GAAG,YAAY,CAAC,aAAa,CAAC;QAC3C,iBAAiB,GAAG,aAAa,CAAC,iBAAiB,CAAC;QACpD,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;QACpC,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC;QAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC3C,iBAAiB,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QAC3B,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gGAAgG,EAAE,KAAK,IAAI,EAAE;QAC9G,MAAM,iBAAiB,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;QACtF,MAAM,OAAO,GAAG,MAAM,uBAAuB,EAAE,CAAC;QAEhD,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC;YAE9E,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC9C,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,4BAA4B;aAClC,CAAC,CAAC;YACH,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAE5C,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC3C,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,2CAA2C,KAAK,WAAW;aACjE,CAAC,CAAC;YACH,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAEhE,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC5C,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,2CAA2C,KAAK,WAAW;gBAChE,OAAO,EAAE;oBACP,MAAM,EAAE,MAAM;oBACd,cAAc,EAAE,kBAAkB;oBAClC,iBAAiB,EAAE,SAAS;iBAC7B;gBACD,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;aACvB,CAAC,CAAC;YACH,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;gBAClC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;gBACnC,EAAE,EAAE,IAAI;aACT,CAAC,CAAC;YACH,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtE,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;YAEjF,MAAM,MAAM,CAAC,uBAAuB,CAClC,GAAG,OAAO,CAAC,MAAM,2CAA2C,KAAK,KAAK,CACvE,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/C,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iGAAiG,EAAE,KAAK,IAAI,EAAE;QAC/G,MAAM,iBAAiB,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,GAAG,yBAAyB,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,uBAAuB,EAAE,CAAC;QAEhD,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,yBAAyB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YACpE,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;YAE1F,MAAM,MAAM,CAAC,uBAAuB,CAClC,GAAG,OAAO,CAAC,MAAM,uDAAuD,KAAK,KAAK,EAClF,EAAE,CAAC,yBAAyB,CAAC,EAAE,sBAAsB,EAAE,CACxD,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACxB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,wBAAwB;aACxC,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAEjD,MAAM,MAAM,CAAC,uBAAuB,CAClC,GAAG,OAAO,CAAC,MAAM,uDAAuD,KAAK,KAAK,CACnF,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/C,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sGAAsG,EAAE,KAAK,IAAI,EAAE;QACpH,MAAM,iBAAiB,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,GAAG,yBAAyB,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,uBAAuB,EAAE,CAAC;QAEhD,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,kBAAkB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,IAAI,kBAAkB,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;YAEjG,MAAM,MAAM,CAAC,uBAAuB,CAClC,GAAG,OAAO,CAAC,MAAM,2BAA2B,EAC5C;gBACE,CAAC,yBAAyB,CAAC,EAAE,sBAAsB;gBACnD,MAAM;aACP,CACF,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACxB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,wBAAwB;aACxC,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAEjD,MAAM,MAAM,CAAC,uBAAuB,CAClC,GAAG,OAAO,CAAC,MAAM,2BAA2B,EAC5C,EAAE,MAAM,EAAE,CACX,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/C,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,MAAM,iBAAiB,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,GAAG,yBAAyB,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,uBAAuB,EAAE,CAAC;QAEhD,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,0BAA0B,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YAErE,MAAM,MAAM,CAAC,uBAAuB,CAClC,GAAG,OAAO,CAAC,MAAM,mCAAmC,EACpD,EAAE,CAAC,yBAAyB,CAAC,EAAE,yBAAyB,EAAE,CAC3D,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/C,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/routes/__tests__/previews.test.js

@@ -1,8 +1,11 @@
 import { describe, expect, it } from 'vitest';
-import { rewriteLocationHeader, rewritePreviewBody } from '../previews.js';
+import { PREVIEW_SANDBOX_CSP, previewCorsHeaders, proxyResponseHeaders, rewriteLocationHeader, rewritePreviewBody, } from '../previews.js';
+import { buildPreviewPathPrefix, parsePreviewPath } from '../../utils/preview-path.js';
 describe('rewritePreviewBody', () => {
     const workspaceId = 'workspace-1';
     const prefix = `/view/${workspaceId}`;
+    const previewToken = 'pv1.d29ya3NwYWNlLTE.123.nonce.signature';
+    const tokenPrefix = `/view/${workspaceId}/__agent_tower_preview/${previewToken}`;
     it('rewrites SPA router basename defaults without touching internal root path comparisons', () => {
         const body = [
             'function stripBasename(pathname, basename) {',
@@ -58,6 +61,18 @@ describe('rewritePreviewBody', () => {
         expect(rewritten).not.toContain(`${prefix}${prefix}`);
         expect(rewritten).not.toContain(`${prefix}/socket.io${prefix}`);
     });
+    it('rewrites preview API and WebSocket paths through the tokenized preview prefix', () => {
+        const body = [
+            'fetch("/api/echo");',
+            'new WebSocket("/ws");',
+            'const socketPath = "/socket.io/";',
+        ].join('\n');
+        const rewritten = rewritePreviewBody(body, workspaceId, 'application/javascript', previewToken);
+        expect(rewritten).toContain(`fetch("${tokenPrefix}/api/echo")`);
+        expect(rewritten).toContain(`new WebSocket("${tokenPrefix}/ws")`);
+        expect(rewritten).toContain(`const socketPath = "${tokenPrefix}/socket.io/"`);
+        expect(rewritten).not.toContain(`${tokenPrefix}${tokenPrefix}`);
+    });
     it('still rewrites HTML and CSS absolute asset paths', () => {
         const html = '<script src="/assets/app.js"></script><link href="/styles/app.css" rel="stylesheet">';
         const css = 'body { background: url("/images/bg.png"); }';
@@ -85,5 +100,92 @@ describe('rewriteLocationHeader', () => {
         const external = 'https://example.com/view/workspace-1/foo?bar=1#section';
         expect(rewriteLocationHeader(external, workspaceId, target)).toBe(external);
     });
+    it('rewrites same-origin locations into the tokenized preview prefix', () => {
+        const token = 'pv1.d29ya3NwYWNlLTE.123.nonce.signature';
+        expect(rewriteLocationHeader('/foo?bar=1#section', workspaceId, target, token))
+            .toBe(`/view/workspace-1/__agent_tower_preview/${token}/foo?bar=1#section`);
+    });
+});
+describe('parsePreviewPath', () => {
+    it('parses legacy preview paths', () => {
+        expect(parsePreviewPath('/view/workspace-1/api/echo?x=1')).toEqual({
+            workspaceId: 'workspace-1',
+            previewToken: null,
+            suffix: '/api/echo',
+            search: '?x=1',
+        });
+    });
+    it('parses tokenized preview paths and removes the token marker from the proxy suffix', () => {
+        const token = 'pv1.d29ya3NwYWNlLTE.123.nonce.signature';
+        expect(parsePreviewPath(`/view/workspace-1/__agent_tower_preview/${token}/api/echo?x=1`)).toEqual({
+            workspaceId: 'workspace-1',
+            previewToken: token,
+            suffix: '/api/echo',
+            search: '?x=1',
+        });
+    });
+    it('builds a tokenized prefix without treating normal app paths as tokens', () => {
+        const token = 'pv1.d29ya3NwYWNlLTE.123.nonce.signature';
+        expect(buildPreviewPathPrefix('workspace-1', token))
+            .toBe(`/view/workspace-1/__agent_tower_preview/${token}`);
+        expect(parsePreviewPath('/view/workspace-1/__agent_tower_preview/not-a-token/api')).toEqual({
+            workspaceId: 'workspace-1',
+            previewToken: null,
+            suffix: '/__agent_tower_preview/not-a-token/api',
+            search: '',
+        });
+    });
+});
+describe('proxyResponseHeaders', () => {
+    const workspaceId = 'workspace-1';
+    const target = {
+        target: 'http://127.0.0.1:3000',
+        origin: 'http://127.0.0.1:3000',
+        basePath: '',
+    };
+    it('adds a sandbox CSP without allow-same-origin to isolate preview pages from the main API', () => {
+        const headers = proxyResponseHeaders({
+            'content-type': 'text/html',
+            'content-security-policy': "default-src 'self'",
+        }, workspaceId, target);
+        expect(headers['content-security-policy']).toBe(PREVIEW_SANDBOX_CSP);
+        expect(String(headers['content-security-policy'])).toContain('sandbox');
+        expect(String(headers['content-security-policy'])).not.toContain('allow-same-origin');
+        expect(headers['referrer-policy']).toBe('no-referrer');
+    });
+    it('does not forward preview target CORS policy and allows sandboxed preview resources to load', () => {
+        const headers = proxyResponseHeaders({
+            'access-control-allow-origin': 'http://127.0.0.1:3000',
+            'access-control-allow-credentials': 'true',
+            'cross-origin-resource-policy': 'same-origin',
+        }, workspaceId, target, {
+            'access-control-request-headers': 'content-type, x-preview-token',
+        });
+        expect(headers['access-control-allow-origin']).toBe('*');
+        expect(headers['access-control-allow-methods']).toContain('POST');
+        expect(headers['access-control-allow-headers']).toBe('content-type, x-preview-token');
+        expect(headers['access-control-allow-credentials']).toBeUndefined();
+        expect(headers['cross-origin-resource-policy']).toBe('cross-origin');
+    });
+    it('uses default CORS allow headers when a preview request has no preflight header list', () => {
+        const headers = proxyResponseHeaders({}, workspaceId, target);
+        expect(headers['access-control-allow-origin']).toBe('*');
+        expect(headers['access-control-allow-methods']).toContain('OPTIONS');
+        expect(String(headers['access-control-allow-headers'])).toContain('Content-Type');
+        expect(headers.vary).toContain('Access-Control-Request-Headers');
+    });
+});
+describe('previewCorsHeaders', () => {
+    it('echoes requested preflight headers without enabling credentialed CORS', () => {
+        const headers = previewCorsHeaders({
+            origin: 'null',
+            'access-control-request-method': 'POST',
+            'access-control-request-headers': 'content-type, x-custom-header',
+        });
+        expect(headers['access-control-allow-origin']).toBe('*');
+        expect(headers['access-control-allow-methods']).toContain('POST');
+        expect(headers['access-control-allow-headers']).toBe('content-type, x-custom-header');
+        expect(headers['access-control-allow-credentials']).toBeUndefined();
+    });
 });
 //# sourceMappingURL=previews.test.js.map

package/dist/routes/__tests__/previews.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"previews.test.js","sourceRoot":"","sources":["../../../src/routes/__tests__/previews.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAE3E,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,MAAM,WAAW,GAAG,aAAa,CAAC;IAClC,MAAM,MAAM,GAAG,SAAS,WAAW,EAAE,CAAC;IAEtC,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAC/F,MAAM,IAAI,GAAG;YACX,8CAA8C;YAC9C,0CAA0C;YAC1C,oBAAoB;YACpB,GAAG;YACH,8CAA8C;YAC9C,oBAAoB;YACpB,GAAG;YACH,iDAAiD;YACjD,oBAAoB;YACpB,GAAG;YACH,4CAA4C;YAC5C,aAAa;YACb,GAAG;YACH,wBAAwB;YACxB,2BAA2B;YAC3B,+BAA+B;YAC/B,+BAA+B;YAC/B,eAAe;SAChB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC;QAElF,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAChD,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,eAAe,MAAM,GAAG,CAAC,CAAC;QACtD,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,yBAAyB,MAAM,GAAG,CAAC,CAAC;QAChE,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,eAAe,MAAM,GAAG,CAAC,CAAC;QACtD,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,kBAAkB,MAAM,GAAG,CAAC,CAAC;QACzD,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,qBAAqB,MAAM,GAAG,CAAC,CAAC;QAC5D,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,yBAAyB,MAAM,GAAG,CAAC,CAAC;QAChE,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,yBAAyB,MAAM,GAAG,CAAC,CAAC;QAChE,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC3F,MAAM,IAAI,GAAG,0EAA0E,CAAC;QAExF,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC;QAElF,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,IAAI,MAAM,OAAO,CAAC,CAAC;QAC/C,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC/C,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,MAAM,eAAe,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAC/F,MAAM,IAAI,GAAG;YACX,yBAAyB;YACzB,mCAAmC;YACnC,8BAA8B,MAAM,iBAAiB;YACrD,iCAAiC,MAAM,eAAe;SACvD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC;QAElF,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,UAAU,MAAM,iBAAiB,CAAC,CAAC;QAC/D,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,uBAAuB,MAAM,cAAc,CAAC,CAAC;QACzE,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,8BAA8B,MAAM,gBAAgB,CAAC,CAAC;QAClF,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,iCAAiC,MAAM,cAAc,CAAC,CAAC;QACnF,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,MAAM,aAAa,MAAM,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,IAAI,GAAG,sFAAsF,CAAC;QACpG,MAAM,GAAG,GAAG,6CAA6C,CAAC;QAE1D,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,MAAM,gBAAgB,CAAC,CAAC;QAChG,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,MAAM,iBAAiB,CAAC,CAAC;QACjG,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,MAAM,kBAAkB,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,MAAM,WAAW,GAAG,aAAa,CAAC;IAClC,MAAM,MAAM,GAA4B;QACtC,MAAM,EAAE,uBAAuB;QAC/B,MAAM,EAAE,uBAAuB;QAC/B,QAAQ,EAAE,EAAE;KACb,CAAC;IAEF,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,CAAC,qBAAqB,CAAC,oBAAoB,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;aACrE,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,qBAAqB,CAAC,qCAAqC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;aACtF,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kGAAkG,EAAE,GAAG,EAAE;QAC1G,MAAM,QAAQ,GAAG,wDAAwD,CAAC;QAE1E,MAAM,CAAC,qBAAqB,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"previews.test.js","sourceRoot":"","sources":["../../../src/routes/__tests__/previews.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEvF,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,MAAM,WAAW,GAAG,aAAa,CAAC;IAClC,MAAM,MAAM,GAAG,SAAS,WAAW,EAAE,CAAC;IACtC,MAAM,YAAY,GAAG,yCAAyC,CAAC;IAC/D,MAAM,WAAW,GAAG,SAAS,WAAW,0BAA0B,YAAY,EAAE,CAAC;IAEjF,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAC/F,MAAM,IAAI,GAAG;YACX,8CAA8C;YAC9C,0CAA0C;YAC1C,oBAAoB;YACpB,GAAG;YACH,8CAA8C;YAC9C,oBAAoB;YACpB,GAAG;YACH,iDAAiD;YACjD,oBAAoB;YACpB,GAAG;YACH,4CAA4C;YAC5C,aAAa;YACb,GAAG;YACH,wBAAwB;YACxB,2BAA2B;YAC3B,+BAA+B;YAC/B,+BAA+B;YAC/B,eAAe;SAChB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC;QAElF,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAChD,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,eAAe,MAAM,GAAG,CAAC,CAAC;QACtD,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,yBAAyB,MAAM,GAAG,CAAC,CAAC;QAChE,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,eAAe,MAAM,GAAG,CAAC,CAAC;QACtD,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,kBAAkB,MAAM,GAAG,CAAC,CAAC;QACzD,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,qBAAqB,MAAM,GAAG,CAAC,CAAC;QAC5D,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,yBAAyB,MAAM,GAAG,CAAC,CAAC;QAChE,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,yBAAyB,MAAM,GAAG,CAAC,CAAC;QAChE,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC3F,MAAM,IAAI,GAAG,0EAA0E,CAAC;QAExF,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC;QAElF,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,IAAI,MAAM,OAAO,CAAC,CAAC;QAC/C,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC/C,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,MAAM,eAAe,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAC/F,MAAM,IAAI,GAAG;YACX,yBAAyB;YACzB,mCAAmC;YACnC,8BAA8B,MAAM,iBAAiB;YACrD,iCAAiC,MAAM,eAAe;SACvD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC;QAElF,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,UAAU,MAAM,iBAAiB,CAAC,CAAC;QAC/D,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,uBAAuB,MAAM,cAAc,CAAC,CAAC;QACzE,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,8BAA8B,MAAM,gBAAgB,CAAC,CAAC;QAClF,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,iCAAiC,MAAM,cAAc,CAAC,CAAC;QACnF,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,MAAM,aAAa,MAAM,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,IAAI,GAAG;YACX,qBAAqB;YACrB,uBAAuB;YACvB,mCAAmC;SACpC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,wBAAwB,EAAE,YAAY,CAAC,CAAC;QAEhG,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,UAAU,WAAW,aAAa,CAAC,CAAC;QAChE,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,kBAAkB,WAAW,OAAO,CAAC,CAAC;QAClE,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,uBAAuB,WAAW,cAAc,CAAC,CAAC;QAC9E,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,WAAW,GAAG,WAAW,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,IAAI,GAAG,sFAAsF,CAAC;QACpG,MAAM,GAAG,GAAG,6CAA6C,CAAC;QAE1D,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,MAAM,gBAAgB,CAAC,CAAC;QAChG,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,MAAM,iBAAiB,CAAC,CAAC;QACjG,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,MAAM,kBAAkB,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,MAAM,WAAW,GAAG,aAAa,CAAC;IAClC,MAAM,MAAM,GAA4B;QACtC,MAAM,EAAE,uBAAuB;QAC/B,MAAM,EAAE,uBAAuB;QAC/B,QAAQ,EAAE,EAAE;KACb,CAAC;IAEF,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,CAAC,qBAAqB,CAAC,oBAAoB,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;aACrE,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,qBAAqB,CAAC,qCAAqC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;aACtF,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kGAAkG,EAAE,GAAG,EAAE;QAC1G,MAAM,QAAQ,GAAG,wDAAwD,CAAC;QAE1E,MAAM,CAAC,qBAAqB,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,KAAK,GAAG,yCAAyC,CAAC;QAExD,MAAM,CAAC,qBAAqB,CAAC,oBAAoB,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;aAC5E,IAAI,CAAC,2CAA2C,KAAK,oBAAoB,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,gBAAgB,CAAC,gCAAgC,CAAC,CAAC,CAAC,OAAO,CAAC;YACjE,WAAW,EAAE,aAAa;YAC1B,YAAY,EAAE,IAAI;YAClB,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC3F,MAAM,KAAK,GAAG,yCAAyC,CAAC;QAExD,MAAM,CAAC,gBAAgB,CAAC,2CAA2C,KAAK,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC;YAChG,WAAW,EAAE,aAAa;YAC1B,YAAY,EAAE,KAAK;YACnB,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,KAAK,GAAG,yCAAyC,CAAC;QAExD,MAAM,CAAC,sBAAsB,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;aACjD,IAAI,CAAC,2CAA2C,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,gBAAgB,CAAC,yDAAyD,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1F,WAAW,EAAE,aAAa;YAC1B,YAAY,EAAE,IAAI;YAClB,MAAM,EAAE,wCAAwC;YAChD,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,MAAM,WAAW,GAAG,aAAa,CAAC;IAClC,MAAM,MAAM,GAA4B;QACtC,MAAM,EAAE,uBAAuB;QAC/B,MAAM,EAAE,uBAAuB;QAC/B,QAAQ,EAAE,EAAE;KACb,CAAC;IAEF,EAAE,CAAC,yFAAyF,EAAE,GAAG,EAAE;QACjG,MAAM,OAAO,GAAG,oBAAoB,CAAC;YACnC,cAAc,EAAE,WAAW;YAC3B,yBAAyB,EAAE,oBAAoB;SAChD,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAExB,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACtF,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4FAA4F,EAAE,GAAG,EAAE;QACpG,MAAM,OAAO,GAAG,oBAAoB,CAAC;YACnC,6BAA6B,EAAE,uBAAuB;YACtD,kCAAkC,EAAE,MAAM;YAC1C,8BAA8B,EAAE,aAAa;SAC9C,EAAE,WAAW,EAAE,MAAM,EAAE;YACtB,gCAAgC,EAAE,+BAA+B;SAClE,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClE,MAAM,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QACtF,MAAM,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACpE,MAAM,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;QAC7F,MAAM,OAAO,GAAG,oBAAoB,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAE9D,MAAM,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAClF,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,OAAO,GAAG,kBAAkB,CAAC;YACjC,MAAM,EAAE,MAAM;YACd,+BAA+B,EAAE,MAAM;YACvC,gCAAgC,EAAE,+BAA+B;SAClE,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClE,MAAM,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QACtF,MAAM,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/routes/access-auth.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from 'fastify';
+export declare function accessAuthRoutes(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=access-auth.d.ts.map

package/dist/routes/access-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-auth.d.ts","sourceRoot":"","sources":["../../src/routes/access-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAyC7D,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,eAAe,iBAoE1D"}

package/dist/routes/access-auth.js

@@ -0,0 +1,89 @@
+import { z, ZodError } from 'zod';
+import { ServiceError } from '../errors.js';
+import { AccessAuthService } from '../services/access-auth.service.js';
+const loginSchema = z.object({
+    password: z.string().min(1),
+});
+const updateSettingsSchema = z.object({
+    enabled: z.boolean().optional(),
+    currentPassword: z.string().optional(),
+    newPassword: z.string().optional(),
+});
+function handleError(error, reply) {
+    if (error instanceof ZodError) {
+        reply.code(400);
+        return {
+            error: 'Validation failed',
+            code: 'VALIDATION_ERROR',
+            details: error.errors,
+        };
+    }
+    if (error instanceof ServiceError) {
+        reply.code(error.statusCode);
+        return {
+            error: error.message,
+            code: error.code,
+        };
+    }
+    reply.log.error(error);
+    reply.code(500);
+    return {
+        error: 'Internal server error',
+        code: 'INTERNAL_ERROR',
+    };
+}
+export async function accessAuthRoutes(app) {
+    app.get('/access-auth/status', async (request) => {
+        const cookieToken = request.cookies[AccessAuthService.cookieName]
+            ?? AccessAuthService.extractCookieFromHeader(request.headers.cookie);
+        return AccessAuthService.getPublicStatus(cookieToken);
+    });
+    app.post('/access-auth/login', async (request, reply) => {
+        try {
+            const { password } = loginSchema.parse(request.body);
+            const result = await AccessAuthService.login(password, request.ip);
+            if (result.sessionToken) {
+                reply.setCookie(AccessAuthService.cookieName, result.sessionToken, AccessAuthService.getCookieOptions(request));
+            }
+            return result.status;
+        }
+        catch (error) {
+            return handleError(error, reply);
+        }
+    });
+    app.post('/access-auth/logout', async (request, reply) => {
+        reply.clearCookie(AccessAuthService.cookieName, AccessAuthService.getClearCookieOptions(request));
+        const cookieToken = request.cookies[AccessAuthService.cookieName]
+            ?? AccessAuthService.extractCookieFromHeader(request.headers.cookie);
+        const status = await AccessAuthService.getPublicStatus(cookieToken);
+        return {
+            enabled: status.enabled,
+            authenticated: !status.enabled,
+        };
+    });
+    app.get('/access-auth/settings', async (_request, reply) => {
+        try {
+            return await AccessAuthService.getSettings();
+        }
+        catch (error) {
+            return handleError(error, reply);
+        }
+    });
+    app.put('/access-auth/settings', async (request, reply) => {
+        try {
+            const data = updateSettingsSchema.parse(request.body);
+            const result = await AccessAuthService.updateSettings(data);
+            if (result.clearSession) {
+                reply.clearCookie(AccessAuthService.cookieName, AccessAuthService.getClearCookieOptions(request));
+            }
+            else if (result.sessionToken) {
+                reply.setCookie(AccessAuthService.cookieName, result.sessionToken, AccessAuthService.getCookieOptions(request));
+            }
+            return result.settings;
+        }
+        catch (error) {
+            return handleError(error, reply);
+        }
+    });
+}
+//# sourceMappingURL=access-auth.js.map

package/dist/routes/access-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-auth.js","sourceRoot":"","sources":["../../src/routes/access-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAEvE,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,KAAc,EAAE,KAAmB;IACtD,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO;YACL,KAAK,EAAE,mBAAmB;YAC1B,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,KAAK,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,OAAO;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,OAAO;QACL,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,gBAAgB;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAoB;IACzD,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/C,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC;eAC5D,iBAAiB,CAAC,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvE,OAAO,iBAAiB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACtD,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACnE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACxB,KAAK,CAAC,SAAS,CACb,iBAAiB,CAAC,UAAU,EAC5B,MAAM,CAAC,YAAY,EACnB,iBAAiB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAC5C,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvD,KAAK,CAAC,WAAW,CACf,iBAAiB,CAAC,UAAU,EAC5B,iBAAiB,CAAC,qBAAqB,CAAC,OAAO,CAAC,CACjD,CAAC;QAEF,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC;eAC5D,iBAAiB,CAAC,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QACpE,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,aAAa,EAAE,CAAC,MAAM,CAAC,OAAO;SAC/B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QACzD,IAAI,CAAC;YACH,OAAO,MAAM,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC5D,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACxB,KAAK,CAAC,WAAW,CACf,iBAAiB,CAAC,UAAU,EAC5B,iBAAiB,CAAC,qBAAqB,CAAC,OAAO,CAAC,CACjD,CAAC;YACJ,CAAC;iBAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBAC/B,KAAK,CAAC,SAAS,CACb,iBAAiB,CAAC,UAAU,EAC5B,MAAM,CAAC,YAAY,EACnB,iBAAiB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAC5C,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/routes/files.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAwK/C,wBAAsB,WAAW,CAAC,GAAG,EAAE,eAAe,iBA0KrD"}
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/routes/files.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAoN/C,wBAAsB,WAAW,CAAC,GAAG,EAAE,eAAe,iBA+KrD"}

package/dist/routes/files.js

@@ -2,6 +2,7 @@ import { z, ZodError } from 'zod';
 import * as fs from 'node:fs/promises';
 import * as fssync from 'node:fs';
 import * as path from 'node:path';
+import { resolveDataDir } from '../utils/data-dir.js';
 const IMAGE_EXTENSIONS = new Set([
     '.png', '.jpg', '.jpeg', '.gif', '.bmp', '.webp', '.svg', '.ico', '.avif',
 ]);
@@ -36,6 +37,10 @@ function handleError(error, reply) {
     }
     if (error && typeof error === 'object' && 'code' in error) {
         const code = error.code;
+        if (code === 'INTERNAL_PATH_FORBIDDEN') {
+            reply.code(403);
+            return { error: 'Internal Agent Tower files are not accessible', code: 'INTERNAL_PATH_FORBIDDEN' };
+        }
         if (code === 'ENOENT') {
             reply.code(404);
             return { error: 'Not found', code: 'NOT_FOUND' };
@@ -69,8 +74,44 @@ function assertNoTraversalSegments(relPath) {
         ]);
     }
 }
+function isSameOrChildPath(candidate, base) {
+    const relative = path.relative(base, candidate);
+    return relative === '' || (!!relative && !relative.startsWith('..') && !path.isAbsolute(relative));
+}
+async function resolveExistingPath(candidate) {
+    try {
+        return await fs.realpath(candidate);
+    }
+    catch {
+        return null;
+    }
+}
+async function getProtectedInternalRoots() {
+    const configuredDataDir = path.resolve(resolveDataDir());
+    const roots = [configuredDataDir];
+    const realDataDir = await resolveExistingPath(configuredDataDir);
+    if (realDataDir && realDataDir !== configuredDataDir)
+        roots.push(realDataDir);
+    return roots;
+}
+async function assertNotInternalPath(...candidates) {
+    const roots = await getProtectedInternalRoots();
+    for (const candidate of candidates) {
+        if (!candidate)
+            continue;
+        const resolved = path.resolve(candidate);
+        const real = await resolveExistingPath(resolved);
+        const paths = real && real !== resolved ? [resolved, real] : [resolved];
+        if (paths.some((item) => roots.some((root) => isSameOrChildPath(item, root)))) {
+            const err = new Error('Internal Agent Tower files are not accessible');
+            err.code = 'INTERNAL_PATH_FORBIDDEN';
+            throw err;
+        }
+    }
+}
 async function resolveInWorkingDir(workingDir, userPath) {
     const baseReal = await fs.realpath(workingDir);
+    await assertNotInternalPath(baseReal);
     const rel = normalizeUserPath(userPath);
     assertNoTraversalSegments(rel);
     const abs = path.resolve(baseReal, rel);
@@ -164,6 +205,7 @@ export async function filesRoutes(app) {
             }
             const { baseReal, abs } = await resolveInWorkingDir(workingDir, userPath);
             const dirReal = await fs.realpath(abs);
+            await assertNotInternalPath(dirReal);
             const relative = path.relative(baseReal, dirReal);
             if (relative.startsWith('..') || path.isAbsolute(relative)) {
                 reply.code(400);
@@ -216,6 +258,7 @@ export async function filesRoutes(app) {
             }
             const { baseReal, abs } = await resolveInWorkingDir(workingDir, userFilePath);
             const fileReal = await fs.realpath(abs);
+            await assertNotInternalPath(fileReal);
             const relative = path.relative(baseReal, fileReal);
             if (relative.startsWith('..') || path.isAbsolute(relative)) {
                 reply.code(400);
@@ -252,6 +295,8 @@ export async function filesRoutes(app) {
             // Ensure parent dir exists and is within workingDir (mitigate symlink escapes)
             const parent = path.dirname(abs);
             const parentReal = await fs.realpath(parent);
+            const targetReal = await resolveExistingPath(abs);
+            await assertNotInternalPath(parentReal, targetReal, abs);
             const parentRel = path.relative(baseReal, parentReal);
             if (parentRel.startsWith('..') || path.isAbsolute(parentRel)) {
                 reply.code(400);
@@ -281,6 +326,7 @@ export async function filesRoutes(app) {
             }
             const { baseReal, abs } = await resolveInWorkingDir(workingDir, userFilePath);
             const fileReal = await fs.realpath(abs);
+            await assertNotInternalPath(fileReal);
             const relative = path.relative(baseReal, fileReal);
             if (relative.startsWith('..') || path.isAbsolute(relative)) {
                 reply.code(400);