hearth-dash 1.1.0 → 1.1.2

package/cli/commands/mcp.js

@@ -1,4 +1,4 @@
-import { readFileSync, existsSync, chmodSync } from "node:fs";
+import { readFileSync, existsSync, chmodSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { banner, bold, dim, cyan, warn, info } from "../lib/ui.js";
@@ -14,13 +14,13 @@ export default async function mcpCommand(args) {
   }
 
   const config = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
-  const mcpUrl = config.workerUrl + "/mcp";
+  const mcpUrl = config.workerUrl + "/mcp";
 
   console.log(bold("  MCP Configuration\n"));
 
-  console.log(`  ${bold("Endpoint:")} ${cyan(mcpUrl)}\n`);
-  info("Hearth uses OAuth 2.1. Your dashboard password stays out of the connector URL and Claude stores only revocable tokens.");
-  console.log();
+  console.log(`  ${bold("Endpoint:")} ${cyan(mcpUrl)}\n`);
+  info("Hearth uses OAuth 2.1. Your dashboard password stays out of the connector URL and Claude stores only revocable tokens.");
+  console.log();
 
   console.log(`  ${bold("For Claude Code")} (add to ${dim("~/.claude.json")}):\n`);
   console.log(`  {`);
@@ -31,10 +31,10 @@ export default async function mcpCommand(args) {
   console.log(`    }`);
   console.log(`  }\n`);
 
-  console.log(`  ${bold("For Claude Desktop")} (Settings > Developer > MCP):\n`);
+  console.log(`  ${bold("For Claude Desktop")} (Settings > Developer > MCP):\n`);
   console.log(`  Name:     hearth-dash`);
-  console.log(`  URL:      ${mcpUrl}\n`);
-  console.log(`  ${dim("When prompted, sign in with the Hearth dashboard password and approve access.")}\n`);
+  console.log(`  URL:      ${mcpUrl}\n`);
+  console.log(`  ${dim("When prompted, sign in with the Hearth dashboard password and approve access.")}\n`);
 
   console.log(`  ${bold("Connector URL")} (for Claude.ai mobile):`);
   console.log(`  ${cyan(mcpUrl)}\n`);
@@ -65,9 +65,9 @@ export default async function mcpCommand(args) {
       try { claudeConfig = JSON.parse(readFileSync(claudeConfigPath, "utf-8")); } catch {}
     }
     if (!claudeConfig.mcpServers) claudeConfig.mcpServers = {};
-    claudeConfig.mcpServers["hearth-dash"] = { url: mcpUrl };
-    writeFileSync(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + "\n", "utf-8");
-    try { chmodSync(claudeConfigPath, 0o600); } catch {}
-    info("MCP config written to " + claudeConfigPath);
+    claudeConfig.mcpServers["hearth-dash"] = { url: mcpUrl };
+    writeFileSync(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + "\n", "utf-8");
+    try { chmodSync(claudeConfigPath, 0o600); } catch {}
+    info("MCP config written to " + claudeConfigPath);
   }
 }

package/cli/index.js

@@ -54,7 +54,7 @@ ${bold("Quick start:")}
   ${dim("$")} npx hearth-dash mcp
 
 ${bold("Requirements:")}
-  - Node.js 22+
+  - Node.js 22+
   - Cloudflare account (free tier works)
   - OpenWeatherMap API key (free at ${dim("https://openweathermap.org/api")})
 `);

package/cli/lib/wrangler.js

@@ -9,7 +9,7 @@ function spawnCmd(cmd, args, opts) {
   return spawn(cmd, args, opts);
 }
 
-export function execWrangler(args, cwd, stdinData) {
+export function execWrangler(args, cwd, stdinData) {
   return new Promise((resolve) => {
     const proc = spawnCmd("npx", ["wrangler", ...args], {
       cwd, stdio: ["pipe", "pipe", "pipe"],
@@ -22,20 +22,20 @@ export function execWrangler(args, cwd, stdinData) {
     else { proc.stdin.end(); }
     proc.on("close", (code) => resolve({ stdout: stdout.trim(), stderr: stderr.trim(), code }));
   });
-}
-
-export function execCommand(command, args, cwd) {
-  return new Promise((resolve) => {
-    const proc = spawnCmd(command, args, {
-      cwd, stdio: ['ignore', 'pipe', 'pipe'],
-      env: { ...process.env, FORCE_COLOR: '0' },
-    });
-    let stdout = '', stderr = '';
-    proc.stdout.on('data', (data) => { stdout += data.toString(); });
-    proc.stderr.on('data', (data) => { stderr += data.toString(); });
-    proc.on('close', (code) => resolve({ stdout: stdout.trim(), stderr: stderr.trim(), code }));
-  });
-}
+}
+
+export function execCommand(command, args, cwd) {
+  return new Promise((resolve) => {
+    const proc = spawnCmd(command, args, {
+      cwd, stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, FORCE_COLOR: '0' },
+    });
+    let stdout = '', stderr = '';
+    proc.stdout.on('data', (data) => { stdout += data.toString(); });
+    proc.stderr.on('data', (data) => { stderr += data.toString(); });
+    proc.on('close', (code) => resolve({ stdout: stdout.trim(), stderr: stderr.trim(), code }));
+  });
+}
 
 export function parseD1CreateOutput(output) {
   const combined = output.stdout + "\n" + output.stderr;
@@ -79,22 +79,22 @@ export async function executeSchema(dbName, schemaPath, cwd) {
   return { ok: true };
 }
 
-export async function listD1Databases(cwd) {
+export async function listD1Databases(cwd) {
   const result = await execWrangler(["d1", "list", "--json"], cwd);
   if (result.code !== 0) return [];
   try { return JSON.parse(result.stdout); } catch { return []; }
-}
-
-export async function listKvNamespaces(cwd) {
-  const result = await execWrangler(['kv', 'namespace', 'list'], cwd);
-  if (result.code !== 0) return [];
-  try { return JSON.parse(result.stdout); } catch { return []; }
-}
-
-export function parseKvCreateOutput(output) {
-  const combined = output.stdout + '\n' + output.stderr;
-  const toml = combined.match(/id\s*=\s*"([a-f0-9]{32})"/i);
-  if (toml) return toml[1];
-  const json = combined.match(/"id"\s*:\s*"([a-f0-9]{32})"/i);
-  return json ? json[1] : null;
-}
+}
+
+export async function listKvNamespaces(cwd) {
+  const result = await execWrangler(['kv', 'namespace', 'list'], cwd);
+  if (result.code !== 0) return [];
+  try { return JSON.parse(result.stdout); } catch { return []; }
+}
+
+export function parseKvCreateOutput(output) {
+  const combined = output.stdout + '\n' + output.stderr;
+  const toml = combined.match(/id\s*=\s*"([a-f0-9]{32})"/i);
+  if (toml) return toml[1];
+  const json = combined.match(/"id"\s*:\s*"([a-f0-9]{32})"/i);
+  return json ? json[1] : null;
+}

package/oauth-entry.js

@@ -1,41 +1,47 @@
-import { OAuthProvider } from '@cloudflare/workers-oauth-provider';
-import { oauthApiHandler, oauthDefaultHandler, withinRateLimit } from './worker.js';
-
-const OAUTH_SCOPES = ['hearth:read', 'hearth:write'];
-
-function createOAuthProvider(request, env) {
-  const origin = new URL(request.url).origin;
-  const resource = `${origin}/mcp`;
-  return new OAuthProvider({
-    apiRoute: '/mcp',
-    apiHandler: oauthApiHandler,
-    defaultHandler: oauthDefaultHandler,
-    authorizeEndpoint: '/authorize',
-    tokenEndpoint: '/oauth/token',
-    clientRegistrationEndpoint: '/oauth/register',
-    async clientRegistrationCallback({ request: registrationRequest }) {
-      const allowed = await withinRateLimit(env, registrationRequest, 'oauth-register', 20, 3600);
-      if (!allowed) {
-        return { code: 'access_denied', description: 'Too many client registrations. Try again later.', status: 429 };
-      }
-    },
-    clientIdMetadataDocumentEnabled: true,
-    scopesSupported: OAUTH_SCOPES,
-    accessTokenTTL: 3600,
-    refreshTokenTTL: 30 * 24 * 60 * 60,
-    clientRegistrationTTL: 90 * 24 * 60 * 60,
-    resourceMetadata: {
-      resource,
-      authorization_servers: [origin],
-      scopes_supported: ['hearth:read'],
-      bearer_methods_supported: ['header'],
-      resource_name: 'Hearth Dash',
-    },
-  });
-}
-
-export default {
-  fetch(request, env, ctx) {
-    return createOAuthProvider(request, env).fetch(request, env, ctx);
-  },
-};
+import { OAuthProvider } from '@cloudflare/workers-oauth-provider';
+import { applicationHandler, isOAuthRoute, oauthApiHandler, oauthDefaultHandler, withinRateLimit } from './worker.js';
+
+const OAUTH_SCOPES = ['hearth:read', 'hearth:write'];
+
+function createOAuthProvider(request, env) {
+  const origin = new URL(request.url).origin;
+  const resource = `${origin}/mcp`;
+  return new OAuthProvider({
+    apiRoute: '/mcp',
+    apiHandler: oauthApiHandler,
+    defaultHandler: oauthDefaultHandler,
+    authorizeEndpoint: '/authorize',
+    tokenEndpoint: '/oauth/token',
+    clientRegistrationEndpoint: '/oauth/register',
+    async clientRegistrationCallback({ request: registrationRequest }) {
+      const allowed = await withinRateLimit(env, registrationRequest, 'oauth-register', 20, 3600);
+      if (!allowed) {
+        return { code: 'access_denied', description: 'Too many client registrations. Try again later.', status: 429 };
+      }
+    },
+    clientIdMetadataDocumentEnabled: true,
+    scopesSupported: OAUTH_SCOPES,
+    accessTokenTTL: 3600,
+    refreshTokenTTL: 30 * 24 * 60 * 60,
+    clientRegistrationTTL: 90 * 24 * 60 * 60,
+    resourceMetadata: {
+      resource,
+      authorization_servers: [origin],
+      scopes_supported: ['hearth:read'],
+      bearer_methods_supported: ['header'],
+      resource_name: 'Hearth Dash',
+    },
+  });
+}
+
+export default {
+  fetch(request, env, ctx) {
+    // Keep ordinary dashboard traffic out of the OAuth provider. Besides being
+    // unnecessary, wrapping /login and /api requests can obscure the browser's
+    // public origin on some Cloudflare routes and make valid CSRF checks fail.
+    if (!isOAuthRoute(new URL(request.url).pathname)) {
+      return applicationHandler.fetch(request, env, ctx);
+    }
+    return createOAuthProvider(request, env).fetch(request, env, ctx);
+  },
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hearth-dash",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "Personal dashboard — moods, moments, food diary, weather, and more. Deploy to Cloudflare in one command.",
   "type": "module",
   "bin": {
@@ -28,8 +28,8 @@
     "type": "git",
     "url": "git+https://github.com/martusha89/hearth-dash.git"
   },
-  "engines": {
-    "node": ">=22"
+  "engines": {
+    "node": ">=22"
   },
   "files": [
     "worker.js",

package/schema.sql

@@ -1,14 +1,14 @@
 -- Hearth Dash — Database Schema
 -- Deploy: npx wrangler d1 execute hearth-dash-db --file schema.sql
 
-CREATE TABLE IF NOT EXISTS config (
-  key TEXT PRIMARY KEY,
-  value TEXT NOT NULL
-);
-
--- v1.0.1's first-visit setup stored the dashboard password as plaintext.
--- Authentication now uses Cloudflare Worker secrets; remove any legacy copy.
-DELETE FROM config WHERE key = 'password';
+CREATE TABLE IF NOT EXISTS config (
+  key TEXT PRIMARY KEY,
+  value TEXT NOT NULL
+);
+
+-- v1.0.1's first-visit setup stored the dashboard password as plaintext.
+-- Authentication now uses Cloudflare Worker secrets; remove any legacy copy.
+DELETE FROM config WHERE key = 'password';
 
 CREATE TABLE IF NOT EXISTS moods (
   id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -77,19 +77,19 @@ CREATE TABLE IF NOT EXISTS water_log (
 );
 CREATE INDEX IF NOT EXISTS idx_water_log_date ON water_log(date);
 
-CREATE TABLE IF NOT EXISTS food_reviews (
+CREATE TABLE IF NOT EXISTS food_reviews (
   id INTEGER PRIMARY KEY AUTOINCREMENT,
   date TEXT UNIQUE NOT NULL,
   review TEXT NOT NULL,
   reviewer TEXT NOT NULL DEFAULT 'AI',
   created_at TEXT DEFAULT (datetime('now'))
 );
-CREATE INDEX IF NOT EXISTS idx_food_reviews_date ON food_reviews(date);
-
--- Coarse per-IP request buckets. IP addresses are hashed before storage.
-CREATE TABLE IF NOT EXISTS rate_limits (
-  bucket_key TEXT PRIMARY KEY,
-  count INTEGER NOT NULL DEFAULT 1,
-  expires_at INTEGER NOT NULL
-);
-CREATE INDEX IF NOT EXISTS idx_rate_limits_expires ON rate_limits(expires_at);
+CREATE INDEX IF NOT EXISTS idx_food_reviews_date ON food_reviews(date);
+
+-- Coarse per-IP request buckets. IP addresses are hashed before storage.
+CREATE TABLE IF NOT EXISTS rate_limits (
+  bucket_key TEXT PRIMARY KEY,
+  count INTEGER NOT NULL DEFAULT 1,
+  expires_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_rate_limits_expires ON rate_limits(expires_at);