codebase-onboarder 0.2.0 → 0.3.1

package/server/index.js

@@ -21,7 +21,7 @@ import { createRouter } from './router.js';
 import { installExitCleanup } from './sessions.js';
 import { createLogger } from './logger.js';
 import { createMcpRunner } from './mcp/runner.js';
-import { configPath, isLoopbackHost, readSettings, serverUrls } from './config.js';
+import { browserUrl, configPath, isLoopbackHost, readSettings, serverUrls } from './config.js';
 import { tunnelStatus } from './tunnel.js';
 import { pidIsAlive, readPidFile, removePidFile, writePidFile } from './pidfile.js';
 
@@ -73,7 +73,17 @@ export function startupBanner(settings, { configFile } = {}) {
     : '  Mode    local — only this machine can reach it');
   lines.push('  Local   ' + urls.local);
   if (urls.network) lines.push('  Network ' + urls.network);
-  if (urls.domain) lines.push('  Domain  ' + urls.domain);
+  if (urls.domain) {
+    lines.push('  Domain  ' + urls.domain);
+    if (settings.domain && !settings.https) {
+      lines.push('  HTTPS   disabled — `onboarder setup` or `onboarder https setup` enables trusted TLS');
+    } else if (settings.https) {
+      lines.push('  HTTPS   Caddy obtains, renews, and terminates TLS for this domain');
+    }
+  }
+  if (settings.mode === 'self-hosted' && settings.accessKey) {
+    lines.push('  Remote browsers show an access-key sign-in page; the key is never put in the URL.');
+  }
   if (settings.mode === 'self-hosted' && !settings.accessKey) {
     lines.push('  WARNING self-hosted with no access key — every API call is refused until one is set.');
     lines.push('          Run `onboarder setup` or `onboarder config key rotate`.');
@@ -130,7 +140,7 @@ export async function startServer({ configFile = configPath(), openBrowser, log
     ...CONFIG,
     configPath: configFile,
     getSettings: () => readSettings(configFile),
-    boot: { host, port },
+    boot: { host, port, domain: settings.domain, https: settings.https },
   });
 
   installExitCleanup();
@@ -166,9 +176,9 @@ export async function startServer({ configFile = configPath(), openBrowser, log
   log(startupBanner(live, { configFile }));
 
   const shouldOpen = openBrowser ?? (live.autoOpen && process.stdout.isTTY && !process.env.NO_OPEN);
-  // Remote visitors still need the key; what opens locally is the loopback URL,
-  // which in local mode needs nothing and in self-hosted mode asks for the key.
-  if (shouldOpen) openInBrowser(serverUrls(live).local);
+  // Local requests never need a credential. Remote browsers are sent to the
+  // themed login page and exchange the key for an HttpOnly session cookie.
+  if (shouldOpen) openInBrowser(browserUrl(live));
   return { server, settings: live, host, port };
 }
 

package/server/router.js

@@ -1,16 +1,14 @@
-// The route table and the two gates in front of it.
+// The route table and the gates in front of it.
 //
 // Everything arrives here: one function decides whether a request is allowed to
 // be answered at all, then which handler answers it. The routes are a list rather
 // than a ladder of `if` statements so that the whole surface of the server is
-// visible in one screen — six endpoints, and everything else is a static file.
+// visible in one screen, and everything else is a static file.
 //
-// Neither gate is authentication. A local server with no accounts cannot
-// authenticate anyone; what it can do is refuse requests that a browser on some
-// other site made on the person's behalf. `server/httpGuards.js` explains both
-// attacks; the short version is that `Host` stops DNS rebinding from turning
-// `evil.com` into our own origin, and `Origin`/`Sec-Fetch-Site` stops a page the
-// person happened to have open from driving the API.
+// There are three concerns. Local mode relies on `Host`, `Origin`, and
+// `Sec-Fetch-Site` to stop another page and DNS rebinding from driving it.
+// Self-hosted mode adds real access-key authentication: local browser requests
+// stay open, remote browsers get a signed session, and API clients use Bearer.
 
 import { handleDocs } from './apiDocs.js';
 import { handleFile } from './apiFile.js';
@@ -25,7 +23,9 @@ import { handleDiff, handleDiffRefs } from './apiDiff.js';
 import { handleToolsInstall, handleToolsRun, handleToolsStatus } from './apiTools.js';
 import { handleMcpStart, handleMcpStatus, handleMcpStop, handleMcpCommand } from './apiMcp.js';
 import { handleGetSettings, handleRotateAccessKey, handleUpdateSettings } from './apiSettings.js';
-import { allowedHosts, authReason, DEFAULT_SETTINGS } from './config.js';
+import { handleAuthStatus, handleLogin, handleLogout } from './apiAuth.js';
+import { accessKeysMatch, allowedHosts, authReason, bearerToken, DEFAULT_SETTINGS } from './config.js';
+import { hasValidSession } from './auth.js';
 
 const ROUTES = [
   {
@@ -110,6 +110,18 @@ const ROUTES = [
     method: 'GET', path: '/api/health',
     run: ({ res }) => sendJSON(res, 200, { ok: true }),
   },
+  {
+    method: 'GET', path: '/api/auth/status', sameOrigin: true,
+    run: ({ req, res, settings }) => handleAuthStatus(req, res, settings),
+  },
+  {
+    method: 'POST', path: '/api/auth/login', body: true, sameOrigin: true,
+    run: ({ req, res, body, settings }) => handleLogin(req, res, body, settings),
+  },
+  {
+    method: 'POST', path: '/api/auth/logout', body: true, sameOrigin: true,
+    run: ({ req, res }) => handleLogout(req, res),
+  },
   {
     // The settings drawer and the CLI read the same public shape: everything
     // about the configuration except the access key itself.
@@ -128,7 +140,7 @@ const ROUTES = [
     // this response, never readable again. In self-hosted mode this endpoint
     // is itself behind the current key, so rotation requires possession.
     method: 'POST', path: '/api/settings/access-key', body: true,
-    run: ({ res, config }) => handleRotateAccessKey(res, config),
+    run: ({ req, res, config }) => handleRotateAccessKey(req, res, config),
   },
 ];
 
@@ -184,6 +196,7 @@ export function createRouter(config) {
       }
 
       const found = matchRoute(req.method, url.pathname);
+      const publicAuthRoute = ['/api/health', '/api/auth/status', '/api/auth/login', '/api/auth/logout'].includes(url.pathname);
       if (req.method !== 'GET' || found?.route.sameOrigin) {
         const foreign = crossOriginReason(req);
         if (foreign) {
@@ -191,18 +204,34 @@ export function createRouter(config) {
         }
       }
 
-      // The self-hosted gate. It is authentication, unlike the two guards
-      // above: the mode says the network can reach us, so every API call
-      // proves it holds the access key. `/api/health` stays open — a tunnel
-      // or uptime check has no key and tells an attacker nothing.
-      if (found && url.pathname.startsWith('/api/') && url.pathname !== '/api/health') {
-        const denied = authReason(req, settings);
-        if (denied) return sendError(res, 401, denied);
+      // Bearer clients keep their existing API contract. A browser gets a signed,
+      // HttpOnly session from the login form instead of storing the raw key.
+      const bearerClient = accessKeysMatch(settings.accessKey, bearerToken(req));
+      const browserAuthenticated = hasValidSession(req, settings);
+      const authDenied = authReason(req, settings);
+      const locallyExempt = !authDenied;
+      const authenticated = bearerClient || browserAuthenticated || locallyExempt;
+      const remoteSelfHosted = settings.mode === 'self-hosted' && Boolean(authDenied);
+
+      if (remoteSelfHosted && !authenticated && !publicAuthRoute) {
+        // API callers keep a machine-readable 401. A browser navigation gets the
+        // themed sign-in document so the user never has to paste JSON into a tab.
+        const accepts = String(req.headers?.accept || '');
+        if (req.method === 'GET' && (url.pathname === '/' || accepts.includes('text/html'))) {
+          res.statusCode = 200;
+          return await serveStatic(res, '/login.html', config);
+        }
+        return sendError(res, 401, authDenied || 'Sign in with the Onboarder access key first.');
+      }
+
+      if (url.pathname === '/api/auth/logout') {
+        // Always clear the browser cookie, even if it had already expired.
+        return handleLogout(req, res);
       }
 
       if (found) {
         const body = found.route.body ? await readBody(req) : null;
-        return await found.route.run({ req, res, url, body, rest: found.rest, config });
+        return await found.route.run({ req, res, url, body, rest: found.rest, config, settings });
       }
 
       if (req.method === 'GET') return await serveStatic(res, url.pathname, config);

package/server/tunnel.js

@@ -50,6 +50,11 @@ export function tailscaleCommand(settings) {
 }
 
 export function installHint(name) {
+  if (name === 'caddy') {
+    return process.platform === 'darwin'
+      ? 'brew install caddy'
+      : 'Install Caddy with: sudo apt install caddy';
+  }
   if (name === 'cloudflared') {
     return process.platform === 'darwin'
       ? 'brew install cloudflared  (or see https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/)'