npm - fluxy-bot - Versions diffs - 0.12.0 → 0.12.1 - Mend

fluxy-bot 0.12.0 → 0.12.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2) hide show

package/package.json +1 -1
package/supervisor/index.ts +19 -12

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "fluxy-bot",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "releaseNotes": [
     "Adding a way for users to claim their fluxies on the fluxy.bot dashboard",
     "2. ",

package/supervisor/index.ts CHANGED Viewed

@@ -18,6 +18,7 @@ import { ensureFileDirs, saveAttachment, type SavedFile } from './file-saver.js'
 import { startViteDevServers, stopViteDevServers } from './vite-dev.js';
 import { startScheduler, stopScheduler } from './scheduler.js';
 import { execSync, spawn as cpSpawn } from 'child_process';
+import crypto from 'crypto';
 const DIST_FLUXY = path.join(PKG_DIR, 'dist-fluxy');
@@ -197,6 +198,7 @@ const RECOVERING_HTML = `<!DOCTYPE html><html style="background:#222122"><head><
 export async function startSupervisor() {
   const config = loadConfig();
   const backendPort = getBackendPort(config.port);
+  const internalSecret = crypto.randomBytes(16).toString('hex');
   // Create HTTP server first (Vite needs it for HMR WebSocket)
   // The request handler is set up later via server.on('request')
@@ -232,7 +234,7 @@ export async function startSupervisor() {
   /** Call worker API endpoints (in-process via supervisor's own HTTP server) */
   async function workerApi(apiPath: string, method = 'GET', body?: any) {
-    const opts: RequestInit = { method, headers: { 'Content-Type': 'application/json' } };
+    const opts: RequestInit = { method, headers: { 'Content-Type': 'application/json', 'x-internal': internalSecret } };
     if (body) opts.body = JSON.stringify(body);
     const res = await fetch(`http://127.0.0.1:${config.port}${apiPath}`, opts);
     return res.json();
@@ -366,17 +368,22 @@ export async function startSupervisor() {
     // API routes → handled in-process by worker Express app
     if (req.url?.startsWith('/api')) {
-      // Auth check for mutation routes (POST/PUT/DELETE) — GET/HEAD are read-only, skip auth
-      const method = req.method || 'GET';
-      if (method !== 'GET' && method !== 'HEAD' && !isExemptRoute(method, req.url || '')) {
-        const needsAuth = await isAuthRequired();
-        if (needsAuth) {
-          const authHeader = req.headers['authorization'];
-          const token = authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : null;
-          if (!token || !(await validateToken(token))) {
-            res.writeHead(401, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'Unauthorized' }));
-            return;
+      // Internal supervisor calls (workerApi) bypass auth — they carry a per-process secret
+      const isInternal = req.headers['x-internal'] === internalSecret;
+      if (!isInternal) {
+        // Auth check for mutation routes (POST/PUT/DELETE) — GET/HEAD are read-only, skip auth
+        const method = req.method || 'GET';
+        if (method !== 'GET' && method !== 'HEAD' && !isExemptRoute(method, req.url || '')) {
+          const needsAuth = await isAuthRequired();
+          if (needsAuth) {
+            const authHeader = req.headers['authorization'];
+            const token = authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : null;
+            if (!token || !(await validateToken(token))) {
+              res.writeHead(401, { 'Content-Type': 'application/json' });
+              res.end(JSON.stringify({ error: 'Unauthorized' }));
+              return;
+            }
           }
         }
       }