codebase-onboarder 0.6.0 → 1.0.0

package/server/apiSettings.js

@@ -6,121 +6,120 @@
 // status codes, the secret-handling rules (never read the key back out, show a
 // new one exactly once), and the restart hint — the running server bound its
 // socket at boot, so a host/port change is real but not yet in effect.
-
-import {
-  DEFAULT_SETTINGS, generateAccessKey, normalizeSettings, publicSettings,
-  readSettings, updateSettings, writeSettings, configPath,
-} from './config.js';
+import { DEFAULT_SETTINGS, generateAccessKey, normalizeSettings, publicSettings, readSettings, updateSettings, writeSettings, configPath, } from './config.js';
 import { sendError, sendJSON } from './http.js';
 import { sessionCookie } from './auth.js';
 import { tunnelStatus } from './tunnel.js';
 import { httpsStatus } from './https.js';
-
 // Where this request's settings live. The router's config object carries the
 // path when the server was booted with one; tests and a bare `createServer()`
 // get the defaults-in-memory view instead of somebody's home directory.
 function settingsFile(config) {
-  return config?.configPath || null;
+    return config?.configPath || null;
 }
-
 async function currentSettings(config) {
-  if (typeof config?.getSettings === 'function') return config.getSettings();
-  const file = settingsFile(config);
-  if (file) return readSettings(file);
-  return { ...DEFAULT_SETTINGS, account: { ...DEFAULT_SETTINGS.account }, tunnel: { ...DEFAULT_SETTINGS.tunnel } };
+    if (typeof config?.getSettings === 'function')
+        return config.getSettings();
+    const file = settingsFile(config);
+    if (file)
+        return readSettings(file);
+    return { ...DEFAULT_SETTINGS, account: { ...DEFAULT_SETTINGS.account }, tunnel: { ...DEFAULT_SETTINGS.tunnel } };
 }
-
 // The public body every read returns: settings with the secret masked, plus
 // the connection picture (URLs, tunnel status) the drawer and CLI both render.
 async function publicBody(config) {
-  const settings = await currentSettings(config);
-  return {
-    settings: publicSettings(settings),
-    configFile: settingsFile(config) || configPath(),
-    node: process.version,
-    tunnels: tunnelStatus(settings),
-    https: httpsStatus(settings, settingsFile(config) || configPath()),
-  };
+    const settings = await currentSettings(config);
+    return {
+        settings: publicSettings(settings),
+        configFile: settingsFile(config) || configPath(),
+        node: process.version,
+        tunnels: tunnelStatus(settings),
+        https: httpsStatus(settings, settingsFile(config) || configPath()),
+    };
 }
-
 export async function handleGetSettings(req, res, config) {
-  try {
-    sendJSON(res, 200, await publicBody(config));
-  } catch (err) {
-    sendError(res, 500, err.message || 'The settings could not be read.');
-  }
+    try {
+        sendJSON(res, 200, await publicBody(config));
+    }
+    catch (err) {
+        sendError(res, 500, err.message || 'The settings could not be read.');
+    }
 }
-
 // Which changes the running server cannot absorb. Access-key and tunnel flags
 // are read live per request. Host/port are bound sockets. Domain/HTTPS change
 // the managed Caddyfile and certificate, so Caddy must validate/reload too.
 function restartRequired(config, next) {
-  const boot = config?.boot;
-  if (!boot) return [];
-  const changed = [];
-  if (next.host !== boot.host) changed.push('host');
-  if (next.port !== boot.port) changed.push('port');
-  if (next.domain !== boot.domain) changed.push('domain');
-  if (next.https !== boot.https) changed.push('https');
-  return changed;
+    const boot = config?.boot;
+    if (!boot)
+        return [];
+    const changed = [];
+    if (next.host !== boot.host)
+        changed.push('host');
+    if (next.port !== boot.port)
+        changed.push('port');
+    if (next.domain !== boot.domain)
+        changed.push('domain');
+    if (next.https !== boot.https)
+        changed.push('https');
+    return changed;
 }
-
 export async function handleUpdateSettings(res, body, config) {
-  const file = settingsFile(config);
-  if (!file) {
-    return sendError(res, 400, 'This server was started without a config file, so there is nothing to save to.');
-  }
-  if (!body || typeof body !== 'object' || Array.isArray(body)) {
-    return sendError(res, 400, 'Send a JSON object of settings to change.');
-  }
-  // Only known keys may be patched — a typo like "ports" must be a loud 400,
-  // not a silently ignored write that the UI then claims it saved.
-  const allowed = new Set(['mode', 'host', 'port', 'domain', 'https', 'autoOpen', 'account', 'tunnel']);
-  const unknown = Object.keys(body).filter((k) => k !== 'accessKey' && !allowed.has(k));
-  if (unknown.length) {
-    return sendError(res, 400, `Unknown setting${unknown.length === 1 ? '' : 's'}: ${unknown.join(', ')}.`);
-  }
-  if ('accessKey' in body) {
-    return sendError(res, 400, 'The access key is rotated, not patched — POST /api/settings/access-key.');
-  }
-  try {
-    const next = await updateSettings(body, file);
-    sendJSON(res, 200, {
-      settings: publicSettings(next),
-      restartRequired: restartRequired(config, next),
-    });
-  } catch (err) {
-    sendError(res, 400, err.message || 'Those settings did not validate.');
-  }
+    const file = settingsFile(config);
+    if (!file) {
+        return sendError(res, 400, 'This server was started without a config file, so there is nothing to save to.');
+    }
+    if (!body || typeof body !== 'object' || Array.isArray(body)) {
+        return sendError(res, 400, 'Send a JSON object of settings to change.');
+    }
+    // Only known keys may be patched — a typo like "ports" must be a loud 400,
+    // not a silently ignored write that the UI then claims it saved.
+    const allowed = new Set(['mode', 'host', 'port', 'domain', 'https', 'autoOpen', 'account', 'tunnel']);
+    const unknown = Object.keys(body).filter((k) => k !== 'accessKey' && !allowed.has(k));
+    if (unknown.length) {
+        return sendError(res, 400, `Unknown setting${unknown.length === 1 ? '' : 's'}: ${unknown.join(', ')}.`);
+    }
+    if ('accessKey' in body) {
+        return sendError(res, 400, 'The access key is rotated, not patched — POST /api/settings/access-key.');
+    }
+    try {
+        const next = await updateSettings(body, file);
+        sendJSON(res, 200, {
+            settings: publicSettings(next),
+            restartRequired: restartRequired(config, next),
+        });
+    }
+    catch (err) {
+        sendError(res, 400, err.message || 'Those settings did not validate.');
+    }
 }
-
 // Rotation returns the new key in the clear, once. It is never in a GET after
 // that — `hasAccessKey`/`accessKeyMasked` are all the readback there is. The
 // person copies it from this response into the devices that need it.
 export async function handleRotateAccessKey(req, res, config) {
-  const file = settingsFile(config);
-  if (!file) {
-    return sendError(res, 400, 'This server was started without a config file, so there is nothing to save to.');
-  }
-  try {
-    const accessKey = generateAccessKey();
-    const current = await currentSettings(config);
-    const next = await writeSettings({ ...current, accessKey }, file);
-    sendJSON(res, 200, {
-      accessKey,
-      settings: publicSettings(next),
-      note: 'Shown once. This browser is signed in with the new key; update every other device.',
-    }, {
-      'cache-control': 'no-store',
-      'set-cookie': sessionCookie(req, next),
-    });
-  } catch (err) {
-    sendError(res, 400, err.message || 'The key could not be rotated.');
-  }
+    const file = settingsFile(config);
+    if (!file) {
+        return sendError(res, 400, 'This server was started without a config file, so there is nothing to save to.');
+    }
+    try {
+        const accessKey = generateAccessKey();
+        const current = await currentSettings(config);
+        const next = await writeSettings({ ...current, accessKey }, file);
+        sendJSON(res, 200, {
+            accessKey,
+            settings: publicSettings(next),
+            note: 'Shown once. This browser is signed in with the new key; update every other device.',
+        }, {
+            'cache-control': 'no-store',
+            'set-cookie': sessionCookie(req, next),
+        });
+    }
+    catch (err) {
+        sendError(res, 400, err.message || 'The key could not be rotated.');
+    }
 }
-
 // Kept exported for the tests: a patch that survives normalizeSettings is the
 // same patch the wizard and the API would both accept.
 export function validatePatch(patch) {
-  return normalizeSettings({ ...DEFAULT_SETTINGS, ...patch });
+    return normalizeSettings({ ...DEFAULT_SETTINGS, ...patch });
 }
+//# sourceMappingURL=apiSettings.js.map

package/server/apiSettings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiSettings.js","sourceRoot":"","sources":["../src/server/apiSettings.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,2EAA2E;AAC3E,+EAA+E;AAC/E,6EAA6E;AAC7E,uEAAuE;AAEvE,OAAO,EACL,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,cAAc,EACtE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,GACxD,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,6EAA6E;AAC7E,8EAA8E;AAC9E,wEAAwE;AACxE,SAAS,YAAY,CAAC,MAAM;IAC1B,OAAO,MAAM,EAAE,UAAU,IAAI,IAAI,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAM;IACnC,IAAI,OAAO,MAAM,EAAE,WAAW,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC;IAC3E,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,IAAI;QAAE,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,EAAE,GAAG,gBAAgB,EAAE,OAAO,EAAE,EAAE,GAAG,gBAAgB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;AACnH,CAAC;AAED,4EAA4E;AAC5E,+EAA+E;AAC/E,KAAK,UAAU,UAAU,CAAC,MAAM;IAC9B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO;QACL,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC;QAClC,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,UAAU,EAAE;QAChD,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC;QAC/B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM;IACtD,IAAI,CAAC;QACH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,IAAI,iCAAiC,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,SAAS,eAAe,CAAC,MAAM,EAAE,IAAI;IACnC,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,OAAO,GAAG,EAAE,CAAC;IACnB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM;IAC1D,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,gFAAgF,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,2CAA2C,CAAC,CAAC;IAC1E,CAAC;IACD,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtG,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,yEAAyE,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACjB,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC;YAC9B,eAAe,EAAE,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,IAAI,kCAAkC,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM;IAC1D,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,gFAAgF,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;QAClE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACjB,SAAS;YACT,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC;YAC9B,IAAI,EAAE,oFAAoF;SAC3F,EAAE;YACD,eAAe,EAAE,UAAU;YAC3B,YAAY,EAAE,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,IAAI,+BAA+B,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,uDAAuD;AACvD,MAAM,UAAU,aAAa,CAAC,KAAK;IACjC,OAAO,iBAAiB,CAAC,EAAE,GAAG,gBAAgB,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;AAC9D,CAAC","sourcesContent":["// The settings endpoints: read the public shape, apply a patch, rotate the key.\n//\n// All three go through `server/config.js` for validation and the atomic 0600\n// write, so the CLI wizard, `onboarder config set`, and this API can never save\n// three dialects of the same file. What lives here is only what HTTP adds:\n// status codes, the secret-handling rules (never read the key back out, show a\n// new one exactly once), and the restart hint — the running server bound its\n// socket at boot, so a host/port change is real but not yet in effect.\n\nimport {\n  DEFAULT_SETTINGS, generateAccessKey, normalizeSettings, publicSettings,\n  readSettings, updateSettings, writeSettings, configPath,\n} from './config.js';\nimport { sendError, sendJSON } from './http.js';\nimport { sessionCookie } from './auth.js';\nimport { tunnelStatus } from './tunnel.js';\nimport { httpsStatus } from './https.js';\n\n// Where this request's settings live. The router's config object carries the\n// path when the server was booted with one; tests and a bare `createServer()`\n// get the defaults-in-memory view instead of somebody's home directory.\nfunction settingsFile(config) {\n  return config?.configPath || null;\n}\n\nasync function currentSettings(config) {\n  if (typeof config?.getSettings === 'function') return config.getSettings();\n  const file = settingsFile(config);\n  if (file) return readSettings(file);\n  return { ...DEFAULT_SETTINGS, account: { ...DEFAULT_SETTINGS.account }, tunnel: { ...DEFAULT_SETTINGS.tunnel } };\n}\n\n// The public body every read returns: settings with the secret masked, plus\n// the connection picture (URLs, tunnel status) the drawer and CLI both render.\nasync function publicBody(config) {\n  const settings = await currentSettings(config);\n  return {\n    settings: publicSettings(settings),\n    configFile: settingsFile(config) || configPath(),\n    node: process.version,\n    tunnels: tunnelStatus(settings),\n    https: httpsStatus(settings, settingsFile(config) || configPath()),\n  };\n}\n\nexport async function handleGetSettings(req, res, config) {\n  try {\n    sendJSON(res, 200, await publicBody(config));\n  } catch (err) {\n    sendError(res, 500, err.message || 'The settings could not be read.');\n  }\n}\n\n// Which changes the running server cannot absorb. Access-key and tunnel flags\n// are read live per request. Host/port are bound sockets. Domain/HTTPS change\n// the managed Caddyfile and certificate, so Caddy must validate/reload too.\nfunction restartRequired(config, next) {\n  const boot = config?.boot;\n  if (!boot) return [];\n  const changed = [];\n  if (next.host !== boot.host) changed.push('host');\n  if (next.port !== boot.port) changed.push('port');\n  if (next.domain !== boot.domain) changed.push('domain');\n  if (next.https !== boot.https) changed.push('https');\n  return changed;\n}\n\nexport async function handleUpdateSettings(res, body, config) {\n  const file = settingsFile(config);\n  if (!file) {\n    return sendError(res, 400, 'This server was started without a config file, so there is nothing to save to.');\n  }\n  if (!body || typeof body !== 'object' || Array.isArray(body)) {\n    return sendError(res, 400, 'Send a JSON object of settings to change.');\n  }\n  // Only known keys may be patched — a typo like \"ports\" must be a loud 400,\n  // not a silently ignored write that the UI then claims it saved.\n  const allowed = new Set(['mode', 'host', 'port', 'domain', 'https', 'autoOpen', 'account', 'tunnel']);\n  const unknown = Object.keys(body).filter((k) => k !== 'accessKey' && !allowed.has(k));\n  if (unknown.length) {\n    return sendError(res, 400, `Unknown setting${unknown.length === 1 ? '' : 's'}: ${unknown.join(', ')}.`);\n  }\n  if ('accessKey' in body) {\n    return sendError(res, 400, 'The access key is rotated, not patched — POST /api/settings/access-key.');\n  }\n  try {\n    const next = await updateSettings(body, file);\n    sendJSON(res, 200, {\n      settings: publicSettings(next),\n      restartRequired: restartRequired(config, next),\n    });\n  } catch (err) {\n    sendError(res, 400, err.message || 'Those settings did not validate.');\n  }\n}\n\n// Rotation returns the new key in the clear, once. It is never in a GET after\n// that — `hasAccessKey`/`accessKeyMasked` are all the readback there is. The\n// person copies it from this response into the devices that need it.\nexport async function handleRotateAccessKey(req, res, config) {\n  const file = settingsFile(config);\n  if (!file) {\n    return sendError(res, 400, 'This server was started without a config file, so there is nothing to save to.');\n  }\n  try {\n    const accessKey = generateAccessKey();\n    const current = await currentSettings(config);\n    const next = await writeSettings({ ...current, accessKey }, file);\n    sendJSON(res, 200, {\n      accessKey,\n      settings: publicSettings(next),\n      note: 'Shown once. This browser is signed in with the new key; update every other device.',\n    }, {\n      'cache-control': 'no-store',\n      'set-cookie': sessionCookie(req, next),\n    });\n  } catch (err) {\n    sendError(res, 400, err.message || 'The key could not be rotated.');\n  }\n}\n\n// Kept exported for the tests: a patch that survives normalizeSettings is the\n// same patch the wizard and the API would both accept.\nexport function validatePatch(patch) {\n  return normalizeSettings({ ...DEFAULT_SETTINGS, ...patch });\n}\n"]}

package/server/apiTools.d.ts

@@ -0,0 +1,3 @@
+export declare function handleToolsStatus(res: any): void;
+export declare function handleToolsRun(res: any, body: any): Promise<void>;
+export declare function handleToolsInstall(res: any, body: any): Promise<void>;

package/server/apiTools.js

@@ -7,46 +7,42 @@
 // else. `tools.js` spawns with argument arrays and hard timeouts, so a crafted
 // path becomes an argument and a hung tool becomes a failed pass, not a stuck
 // server.
-
 import { sendError, sendJSON } from './http.js';
 import { getSession } from './sessions.js';
 import { runExternalAnalysis, toolsStatus } from './tools/scan.js';
 import { installTool, isInstalling, plansFor } from './tools/install.js';
 import { TOOL_DEFS } from './tools/registry.js';
-
 const KNOWN_TOOLS = new Set(TOOL_DEFS.map((d) => d.id));
-
 export function handleToolsStatus(res) {
-  sendJSON(res, 200, { tools: toolsStatus() });
+    sendJSON(res, 200, { tools: toolsStatus() });
 }
-
 export async function handleToolsRun(res, body) {
-  const { scanId, kinds, tools, options } = body || {};
-  if (!scanId) return sendError(res, 400, 'Missing scanId.');
-  const session = getSession(scanId);
-  if (!session) return sendError(res, 404, 'That scan is gone. Rescan the repo.');
-
-  // `kinds` narrows by purpose, `tools` to named engines. An unknown value is a
-  // typo the caller would rather hear about than have silently ignored.
-  let kindFilter = null;
-  if (Array.isArray(kinds) && kinds.length) {
-    const ok = kinds.filter((k) => k === 'security' || k === 'dead-code');
-    if (!ok.length) return sendError(res, 400, 'kinds must be "security" and/or "dead-code".');
-    kindFilter = ok;
-  }
-  let toolFilter = null;
-  if (Array.isArray(tools) && tools.length) {
-    toolFilter = tools.map((t) => String(t));
-  }
-
-  // `options` is the per-engine GUI form. Validation happens against the
-  // registry schema inside the run — the handler just passes it along.
-  const report = await runExternalAnalysis(session.root, {
-    kinds: kindFilter, tools: toolFilter, options,
-  });
-  return sendJSON(res, 200, report);
+    const { scanId, kinds, tools, options } = body || {};
+    if (!scanId)
+        return sendError(res, 400, 'Missing scanId.');
+    const session = getSession(scanId);
+    if (!session)
+        return sendError(res, 404, 'That scan is gone. Rescan the repo.');
+    // `kinds` narrows by purpose, `tools` to named engines. An unknown value is a
+    // typo the caller would rather hear about than have silently ignored.
+    let kindFilter = null;
+    if (Array.isArray(kinds) && kinds.length) {
+        const ok = kinds.filter((k) => k === 'security' || k === 'dead-code');
+        if (!ok.length)
+            return sendError(res, 400, 'kinds must be "security" and/or "dead-code".');
+        kindFilter = ok;
+    }
+    let toolFilter = null;
+    if (Array.isArray(tools) && tools.length) {
+        toolFilter = tools.map((t) => String(t));
+    }
+    // `options` is the per-engine GUI form. Validation happens against the
+    // registry schema inside the run — the handler just passes it along.
+    const report = await runExternalAnalysis(session.root, {
+        kinds: kindFilter, tools: toolFilter, options,
+    });
+    return sendJSON(res, 200, report);
 }
-
 // POST /api/tools/install — install a missing engine, streaming progress.
 //
 // This is the one endpoint that changes the machine, so it is worth spelling
@@ -61,30 +57,33 @@ export async function handleToolsRun(res, body) {
 //   * The stream is SSE in the same `data:`-framed shape the explain proxy
 //     uses, so the front end reads install progress exactly like AI output.
 export async function handleToolsInstall(res, body) {
-  const tool = String(body?.tool || '');
-  if (!KNOWN_TOOLS.has(tool)) {
-    return sendError(res, 400, `Unknown tool "${tool}". Known: ${[...KNOWN_TOOLS].join(', ')}.`);
-  }
-  if (!plansFor(tool).length) {
-    return sendError(res, 400, `Onboarder has no install plan for ${tool} on ${process.platform}.`);
-  }
-  if (isInstalling(tool)) {
-    return sendError(res, 409, `${tool} is already being installed.`);
-  }
-
-  res.writeHead(200, {
-    'content-type': 'text/event-stream; charset=utf-8',
-    'cache-control': 'no-cache',
-    connection: 'keep-alive',
-  });
-  const send = (event) => {
-    try { res.write('data: ' + JSON.stringify(event) + '\n\n'); } catch { /* client went away */ }
-  };
-
-  try {
-    await installTool(tool, send);
-  } catch (err) {
-    send({ type: 'done', ok: false, error: err.message || 'The install failed.' });
-  }
-  res.end();
+    const tool = String(body?.tool || '');
+    if (!KNOWN_TOOLS.has(tool)) {
+        return sendError(res, 400, `Unknown tool "${tool}". Known: ${[...KNOWN_TOOLS].join(', ')}.`);
+    }
+    if (!plansFor(tool).length) {
+        return sendError(res, 400, `Onboarder has no install plan for ${tool} on ${process.platform}.`);
+    }
+    if (isInstalling(tool)) {
+        return sendError(res, 409, `${tool} is already being installed.`);
+    }
+    res.writeHead(200, {
+        'content-type': 'text/event-stream; charset=utf-8',
+        'cache-control': 'no-cache',
+        connection: 'keep-alive',
+    });
+    const send = (event) => {
+        try {
+            res.write('data: ' + JSON.stringify(event) + '\n\n');
+        }
+        catch { /* client went away */ }
+    };
+    try {
+        await installTool(tool, send);
+    }
+    catch (err) {
+        send({ type: 'done', ok: false, error: err.message || 'The install failed.' });
+    }
+    res.end();
 }
+//# sourceMappingURL=apiTools.js.map

package/server/apiTools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiTools.js","sourceRoot":"","sources":["../src/server/apiTools.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,4EAA4E;AAC5E,kCAAkC;AAClC,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,UAAU;AAEV,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAExD,MAAM,UAAU,iBAAiB,CAAC,GAAG;IACnC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAG,EAAE,IAAI;IAC5C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,qCAAqC,CAAC,CAAC;IAEhF,8EAA8E;IAC9E,sEAAsE;IACtE,IAAI,UAAU,GAAG,IAAI,CAAC;IACtB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,WAAW,CAAC,CAAC;QACtE,IAAI,CAAC,EAAE,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,8CAA8C,CAAC,CAAC;QAC3F,UAAU,GAAG,EAAE,CAAC;IAClB,CAAC;IACD,IAAI,UAAU,GAAG,IAAI,CAAC;IACtB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACzC,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,uEAAuE;IACvE,qEAAqE;IACrE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE;QACrD,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO;KAC9C,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,0EAA0E;AAC1E,EAAE;AACF,6EAA6E;AAC7E,4DAA4D;AAC5D,EAAE;AACF,uEAAuE;AACvE,8EAA8E;AAC9E,gBAAgB;AAChB,6EAA6E;AAC7E,uEAAuE;AACvE,wDAAwD;AACxD,2EAA2E;AAC3E,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAG,EAAE,IAAI;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,IAAI,aAAa,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,qCAAqC,IAAI,OAAO,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,8BAA8B,CAAC,CAAC;IACpE,CAAC;IAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,kCAAkC;QAClD,eAAe,EAAE,UAAU;QAC3B,UAAU,EAAE,YAAY;KACzB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,EAAE;QACrB,IAAI,CAAC;YAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;IAChG,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,qBAAqB,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,GAAG,CAAC,GAAG,EAAE,CAAC;AACZ,CAAC","sourcesContent":["// GET /api/tools  — which analyzers this machine can run, for the engines panel.\n// POST /api/tools/run — run the available analyzers against a live scan and\n// return the normalized findings.\n//\n// The scan id is a capability the same way it is for `/api/file`: it names a\n// root the person chose, and the analyzers are run inside that root and nowhere\n// else. `tools.js` spawns with argument arrays and hard timeouts, so a crafted\n// path becomes an argument and a hung tool becomes a failed pass, not a stuck\n// server.\n\nimport { sendError, sendJSON } from './http.js';\nimport { getSession } from './sessions.js';\nimport { runExternalAnalysis, toolsStatus } from './tools/scan.js';\nimport { installTool, isInstalling, plansFor } from './tools/install.js';\nimport { TOOL_DEFS } from './tools/registry.js';\n\nconst KNOWN_TOOLS = new Set(TOOL_DEFS.map((d) => d.id));\n\nexport function handleToolsStatus(res) {\n  sendJSON(res, 200, { tools: toolsStatus() });\n}\n\nexport async function handleToolsRun(res, body) {\n  const { scanId, kinds, tools, options } = body || {};\n  if (!scanId) return sendError(res, 400, 'Missing scanId.');\n  const session = getSession(scanId);\n  if (!session) return sendError(res, 404, 'That scan is gone. Rescan the repo.');\n\n  // `kinds` narrows by purpose, `tools` to named engines. An unknown value is a\n  // typo the caller would rather hear about than have silently ignored.\n  let kindFilter = null;\n  if (Array.isArray(kinds) && kinds.length) {\n    const ok = kinds.filter((k) => k === 'security' || k === 'dead-code');\n    if (!ok.length) return sendError(res, 400, 'kinds must be \"security\" and/or \"dead-code\".');\n    kindFilter = ok;\n  }\n  let toolFilter = null;\n  if (Array.isArray(tools) && tools.length) {\n    toolFilter = tools.map((t) => String(t));\n  }\n\n  // `options` is the per-engine GUI form. Validation happens against the\n  // registry schema inside the run — the handler just passes it along.\n  const report = await runExternalAnalysis(session.root, {\n    kinds: kindFilter, tools: toolFilter, options,\n  });\n  return sendJSON(res, 200, report);\n}\n\n// POST /api/tools/install — install a missing engine, streaming progress.\n//\n// This is the one endpoint that changes the machine, so it is worth spelling\n// out why that is safe enough for a local, self-hosted app:\n//\n//   * The route is a POST, which the router's same-origin gate already\n//     refuses for any page that is not Onboarder's own — a foreign tab cannot\n//     drive it.\n//   * `tool` must name a registry entry; the install plans are fixed data in\n//     `tools/install.js`, spawned as argument arrays. Nothing from the\n//     request body ever becomes part of a command line.\n//   * The stream is SSE in the same `data:`-framed shape the explain proxy\n//     uses, so the front end reads install progress exactly like AI output.\nexport async function handleToolsInstall(res, body) {\n  const tool = String(body?.tool || '');\n  if (!KNOWN_TOOLS.has(tool)) {\n    return sendError(res, 400, `Unknown tool \"${tool}\". Known: ${[...KNOWN_TOOLS].join(', ')}.`);\n  }\n  if (!plansFor(tool).length) {\n    return sendError(res, 400, `Onboarder has no install plan for ${tool} on ${process.platform}.`);\n  }\n  if (isInstalling(tool)) {\n    return sendError(res, 409, `${tool} is already being installed.`);\n  }\n\n  res.writeHead(200, {\n    'content-type': 'text/event-stream; charset=utf-8',\n    'cache-control': 'no-cache',\n    connection: 'keep-alive',\n  });\n  const send = (event) => {\n    try { res.write('data: ' + JSON.stringify(event) + '\\n\\n'); } catch { /* client went away */ }\n  };\n\n  try {\n    await installTool(tool, send);\n  } catch (err) {\n    send({ type: 'done', ok: false, error: err.message || 'The install failed.' });\n  }\n  res.end();\n}\n"]}

package/server/auth.d.ts

@@ -0,0 +1,5 @@
+export declare const SESSION_COOKIE = "onboarder_session";
+export declare const SESSION_TTL_SECONDS: number;
+export declare function createSession(settings: any, now?: number): string;
+export declare function hasValidSession(req: any, settings: any, now?: number): boolean;
+export declare function sessionCookie(req: any, settings: any, { clear }?: Record<string, any>): string;

package/server/auth.js

@@ -4,69 +4,72 @@
 // opaque timestamp + HMAC using the configured key as the signing secret. The
 // browser gets an HttpOnly cookie, JavaScript cannot read it, and rotating the
 // access key invalidates every old session immediately.
-
 import { createHmac, timingSafeEqual } from 'node:crypto';
-
 export const SESSION_COOKIE = 'onboarder_session';
 export const SESSION_TTL_SECONDS = 7 * 24 * 60 * 60;
-
 function signature(expires, accessKey) {
-  return createHmac('sha256', accessKey)
-    .update(`onboarder-session-v1:${expires}`)
-    .digest('base64url');
+    return createHmac('sha256', accessKey)
+        .update(`onboarder-session-v1:${expires}`)
+        .digest('base64url');
 }
-
 export function createSession(settings, now = Date.now()) {
-  const key = String(settings?.accessKey || '');
-  if (!key) return '';
-  const expires = Math.floor(now / 1000) + SESSION_TTL_SECONDS;
-  return `${expires}.${signature(expires, key)}`;
+    const key = String(settings?.accessKey || '');
+    if (!key)
+        return '';
+    const expires = Math.floor(now / 1000) + SESSION_TTL_SECONDS;
+    return `${expires}.${signature(expires, key)}`;
 }
-
 function cookieValue(req, name) {
-  const header = String(req.headers?.cookie || '');
-  for (const part of header.split(';')) {
-    const at = part.indexOf('=');
-    if (at === -1) continue;
-    if (part.slice(0, at).trim() !== name) continue;
-    try { return decodeURIComponent(part.slice(at + 1).trim()); } catch { return ''; }
-  }
-  return '';
+    const header = String(req.headers?.cookie || '');
+    for (const part of header.split(';')) {
+        const at = part.indexOf('=');
+        if (at === -1)
+            continue;
+        if (part.slice(0, at).trim() !== name)
+            continue;
+        try {
+            return decodeURIComponent(part.slice(at + 1).trim());
+        }
+        catch {
+            return '';
+        }
+    }
+    return '';
 }
-
 export function hasValidSession(req, settings, now = Date.now()) {
-  const key = String(settings?.accessKey || '');
-  const token = cookieValue(req, SESSION_COOKIE);
-  const dot = token.indexOf('.');
-  if (!key || dot < 1) return false;
-
-  const expires = Number(token.slice(0, dot));
-  const supplied = token.slice(dot + 1);
-  if (!Number.isSafeInteger(expires) || expires <= Math.floor(now / 1000) || !supplied) return false;
-
-  const expected = signature(expires, key);
-  const a = Buffer.from(supplied);
-  const b = Buffer.from(expected);
-  return a.length === b.length && timingSafeEqual(a, b);
+    const key = String(settings?.accessKey || '');
+    const token = cookieValue(req, SESSION_COOKIE);
+    const dot = token.indexOf('.');
+    if (!key || dot < 1)
+        return false;
+    const expires = Number(token.slice(0, dot));
+    const supplied = token.slice(dot + 1);
+    if (!Number.isSafeInteger(expires) || expires <= Math.floor(now / 1000) || !supplied)
+        return false;
+    const expected = signature(expires, key);
+    const a = Buffer.from(supplied);
+    const b = Buffer.from(expected);
+    return a.length === b.length && timingSafeEqual(a, b);
 }
-
 function requestIsSecure(req) {
-  if (req.socket?.encrypted) return true;
-  const forwarded = String(req.headers?.['x-forwarded-proto'] || '').split(',')[0].trim().toLowerCase();
-  return forwarded === 'https';
+    if (req.socket?.encrypted)
+        return true;
+    const forwarded = String(req.headers?.['x-forwarded-proto'] || '').split(',')[0].trim().toLowerCase();
+    return forwarded === 'https';
 }
-
 export function sessionCookie(req, settings, { clear = false } = {}) {
-  const parts = [
-    `${SESSION_COOKIE}=${clear ? '' : encodeURIComponent(createSession(settings))}`,
-    'Path=/',
-    'HttpOnly',
-    'SameSite=Strict',
-    `Max-Age=${clear ? 0 : SESSION_TTL_SECONDS}`,
-  ];
-  // A direct bare-IP deployment may still be plain HTTP, where Secure would make
-  // the cookie unusable. Caddy forwards the original scheme, so domain HTTPS
-  // gets the production-safe flag automatically.
-  if (requestIsSecure(req)) parts.push('Secure');
-  return parts.join('; ');
+    const parts = [
+        `${SESSION_COOKIE}=${clear ? '' : encodeURIComponent(createSession(settings))}`,
+        'Path=/',
+        'HttpOnly',
+        'SameSite=Strict',
+        `Max-Age=${clear ? 0 : SESSION_TTL_SECONDS}`,
+    ];
+    // A direct bare-IP deployment may still be plain HTTP, where Secure would make
+    // the cookie unusable. Caddy forwards the original scheme, so domain HTTPS
+    // gets the production-safe flag automatically.
+    if (requestIsSecure(req))
+        parts.push('Secure');
+    return parts.join('; ');
 }
+//# sourceMappingURL=auth.js.map

package/server/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/server/auth.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,+EAA+E;AAC/E,wDAAwD;AAExD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAClD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEpD,SAAS,SAAS,CAAC,OAAO,EAAE,SAAS;IACnC,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC;SACnC,MAAM,CAAC,wBAAwB,OAAO,EAAE,CAAC;SACzC,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAQ,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,mBAAmB,CAAC;IAC7D,OAAO,GAAG,OAAO,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,GAAG,EAAE,IAAI;IAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS;QAChD,IAAI,CAAC;YAAC,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,EAAE,CAAC;QAAC,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAElC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEnG,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,eAAe,CAAC,GAAG;IAC1B,IAAI,GAAG,CAAC,MAAM,EAAE,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtG,OAAO,SAAS,KAAK,OAAO,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,KAAK,GAAG,KAAK,EAAE,GAAwB,EAAE;IACtF,MAAM,KAAK,GAAG;QACZ,GAAG,cAAc,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,EAAE;QAC/E,QAAQ;QACR,UAAU;QACV,iBAAiB;QACjB,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,EAAE;KAC7C,CAAC;IACF,+EAA+E;IAC/E,2EAA2E;IAC3E,+CAA+C;IAC/C,IAAI,eAAe,CAAC,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC","sourcesContent":["// Browser sessions for the self-hosted access-key gate.\n//\n// The access key itself never becomes a cookie. A successful login mints an\n// opaque timestamp + HMAC using the configured key as the signing secret. The\n// browser gets an HttpOnly cookie, JavaScript cannot read it, and rotating the\n// access key invalidates every old session immediately.\n\nimport { createHmac, timingSafeEqual } from 'node:crypto';\n\nexport const SESSION_COOKIE = 'onboarder_session';\nexport const SESSION_TTL_SECONDS = 7 * 24 * 60 * 60;\n\nfunction signature(expires, accessKey) {\n  return createHmac('sha256', accessKey)\n    .update(`onboarder-session-v1:${expires}`)\n    .digest('base64url');\n}\n\nexport function createSession(settings, now = Date.now()) {\n  const key = String(settings?.accessKey || '');\n  if (!key) return '';\n  const expires = Math.floor(now / 1000) + SESSION_TTL_SECONDS;\n  return `${expires}.${signature(expires, key)}`;\n}\n\nfunction cookieValue(req, name) {\n  const header = String(req.headers?.cookie || '');\n  for (const part of header.split(';')) {\n    const at = part.indexOf('=');\n    if (at === -1) continue;\n    if (part.slice(0, at).trim() !== name) continue;\n    try { return decodeURIComponent(part.slice(at + 1).trim()); } catch { return ''; }\n  }\n  return '';\n}\n\nexport function hasValidSession(req, settings, now = Date.now()) {\n  const key = String(settings?.accessKey || '');\n  const token = cookieValue(req, SESSION_COOKIE);\n  const dot = token.indexOf('.');\n  if (!key || dot < 1) return false;\n\n  const expires = Number(token.slice(0, dot));\n  const supplied = token.slice(dot + 1);\n  if (!Number.isSafeInteger(expires) || expires <= Math.floor(now / 1000) || !supplied) return false;\n\n  const expected = signature(expires, key);\n  const a = Buffer.from(supplied);\n  const b = Buffer.from(expected);\n  return a.length === b.length && timingSafeEqual(a, b);\n}\n\nfunction requestIsSecure(req) {\n  if (req.socket?.encrypted) return true;\n  const forwarded = String(req.headers?.['x-forwarded-proto'] || '').split(',')[0].trim().toLowerCase();\n  return forwarded === 'https';\n}\n\nexport function sessionCookie(req, settings, { clear = false }: Record<string, any> = {}) {\n  const parts = [\n    `${SESSION_COOKIE}=${clear ? '' : encodeURIComponent(createSession(settings))}`,\n    'Path=/',\n    'HttpOnly',\n    'SameSite=Strict',\n    `Max-Age=${clear ? 0 : SESSION_TTL_SECONDS}`,\n  ];\n  // A direct bare-IP deployment may still be plain HTTP, where Secure would make\n  // the cookie unusable. Caddy forwards the original scheme, so domain HTTPS\n  // gets the production-safe flag automatically.\n  if (requestIsSecure(req)) parts.push('Secure');\n  return parts.join('; ');\n}\n"]}

package/server/config.d.ts

@@ -0,0 +1,42 @@
+import type { Settings, SettingsInput, ServerUrls } from '../shared/contracts.js';
+export declare const CONFIG_VERSION = 2;
+export declare const LOOPBACK_HOSTS: Set<string>;
+export declare const DEFAULT_SETTINGS: Readonly<Settings>;
+export declare function configHome(env?: NodeJS.ProcessEnv): string;
+export declare function configPath(env?: NodeJS.ProcessEnv): string;
+export declare function isLoopbackHost(host: any): boolean;
+export declare function normalizeSettings(value?: SettingsInput): Settings;
+export declare function generateAccessKey(): string;
+export declare function serverUrls(value?: SettingsInput): ServerUrls;
+export declare function maskAccessKey(key: any): string;
+export declare function browserUrl(settings: any): string;
+export declare function publicSettings(value?: SettingsInput): {
+    version: number;
+    mode: "local" | "self-hosted";
+    host: string;
+    port: number;
+    domain: string;
+    https: boolean;
+    autoOpen: boolean;
+    hasAccessKey: boolean;
+    accessKeyMasked: string;
+    account: import("../shared/contracts.js").AccountSettings;
+    tunnel: {
+        cloudflare: boolean;
+        tailscale: boolean;
+    };
+    urls: ServerUrls;
+    security: {
+        remoteAuth: boolean;
+        loopback: boolean;
+    };
+};
+export declare function allowedHosts(value?: SettingsInput): unknown[];
+export declare function accessKeysMatch(expected: any, actual: any): boolean;
+export declare function bearerToken(req: any): string;
+export declare function requestIsLoopback(req: any): boolean;
+export declare function authReason(req: any, settings?: SettingsInput): "A valid access key is required." | "Self-hosted mode has no access key configured.";
+export declare function configExists(file?: string): Promise<boolean>;
+export declare function readSettings(file?: string): Promise<Settings>;
+export declare function writeSettings(value: any, file?: string): Promise<Settings>;
+export declare function updateSettings(patch?: SettingsInput, file?: string): Promise<Settings>;