hookarmor 1.0.0 → 1.0.1

package/README.md

@@ -169,5 +169,27 @@ HookArmor solves this automatically:
 
 ---
 
+## 🔐 Production Security & Admin Authentication
+
+When running HookArmor locally on your laptop (`localhost`), management endpoints and the replay dashboard operate without authentication for fast developer onboarding.
+
+> [!WARNING]
+> **When deploying HookArmor to a public server or self-hosted cloud container (Railway, Render, VPS), you MUST set the `HOOKARMOR_API_KEY` environment variable.**
+
+```bash
+# Generate a strong 256-bit random key
+openssl rand -hex 32
+
+# Set in your production environment / Docker container:
+HOOKARMOR_API_KEY=ha_sec_your_secure_random_key_here
+```
+
+When `HOOKARMOR_API_KEY` is present:
+* Management endpoints (`/api/endpoints`, `/api/events/replay-all`, and waitlist exports) strictly reject unauthenticated requests and require an `Authorization: Bearer <key>` header.
+* Query parameter authentication (`?api_key=...`) is strictly prohibited to avoid leaking tokens into browser history and proxy access logs.
+* The web dashboard displays an **Admin Login** prompt storing your key only in ephemeral session memory.
+
+---
+
 ## 📄 License
 MIT License. Created by the HookArmor Team.

package/bin/hookarmor.js

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 
 const { Command } = require('commander');
-const chalk = require('chalk');
+const _chalk = require('chalk');
+const chalk = _chalk.default || _chalk;
 const { createServer } = require('../src/server');
 const http = require('http');
 
@@ -34,7 +35,7 @@ program
     }
 
     server.listen(port, () => {
-      console.log(chalk.bold.blue('\n🛡️  HookArmor Webhook Sentinel is LIVE!'));
+      console.log(chalk.blue.bold('\n🛡️  HookArmor Webhook Sentinel is LIVE!'));
       console.log(chalk.gray('─────────────────────────────────────────'));
       console.log(`📡 Ingress Gateway : ${chalk.cyan(`http://localhost:${port}/in/:endpointId`)}`);
       console.log(`📊 Web Dashboard   : ${chalk.green.bold(`http://localhost:${port}`)}`);
@@ -73,7 +74,7 @@ program
     });
 
     server.listen(port, () => {
-      console.log(chalk.bold.cyan(`\n⚡ HookArmor Listen Active`));
+      console.log(chalk.cyan.bold(`\n⚡ HookArmor Listen Active`));
       console.log(`Forwarding: ${chalk.yellow(`http://localhost:${port}/in/${options.endpoint}`)} ➔ ${chalk.green(targetUrl)}`);
       console.log(`Dashboard:  ${chalk.cyan(`http://localhost:${port}`)}\n`);
     });
@@ -117,7 +118,7 @@ program
     try {
       const res = await fetch(`${baseUrl}/api/stats`);
       const data = await res.json();
-      console.log(chalk.bold.blue('\n🛡️  HookArmor Metrics'));
+      console.log(chalk.blue.bold('\n🛡️  HookArmor Metrics'));
       console.log(chalk.gray('───────────────────────'));
       console.log(`Total Ingested : ${chalk.cyan(data.total)}`);
       console.log(`Delivered      : ${chalk.green(data.delivered)}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hookarmor",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Zero-loss Webhook Dead-Letter Queue (DLQ), Reliability Proxy, and Replay Gateway for Stripe, Shopify, Clerk, and B2B SaaS.",
   "main": "index.js",
   "bin": {
@@ -18,7 +18,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/pkdoddamani/hookarmor.git"
+    "url": "git+https://github.com/pkdoddamani/hookarmor.git"
   },
   "homepage": "https://hookarmour.dev",
   "bugs": {

package/src/public/landing.html

@@ -371,13 +371,13 @@
       </div>
     </div>
 
-    <div class="terminal-box" style="flex-direction: column; align-items: flex-start; gap: 0.5rem; width: 100%; max-width: 620px;">
+    <div class="terminal-box" style="flex-direction: column; align-items: flex-start; gap: 0.5rem; width: 100%; max-width: 520px;">
       <div style="display: flex; justify-content: space-between; width: 100%; align-items: center;">
-        <span style="font-size: 0.75rem; color: #64748b; text-transform: uppercase; letter-spacing: 0.05em; font-family: var(--font-sans); font-weight: 600;">Self-Host Quickstart (Zero Dependencies)</span>
-        <button class="copy-btn" onclick="navigator.clipboard.writeText('git clone https://github.com/pkdoddamani/hookarmor.git && cd hookarmor && npm install && npm start')">Copy</button>
+        <span style="font-size: 0.75rem; color: #10b981; text-transform: uppercase; letter-spacing: 0.05em; font-family: var(--font-sans); font-weight: 700;">● Verified on npm (Zero Config)</span>
+        <button class="copy-btn" onclick="navigator.clipboard.writeText('npx hookarmor start')">Copy</button>
       </div>
-      <div style="color: #38bdf8; font-size: 0.85rem; word-break: break-all;">
-        $ git clone https://github.com/pkdoddamani/hookarmor.git && cd hookarmor && npm start
+      <div style="color: #38bdf8; font-size: 1.05rem; font-weight: 600;">
+        $ npx hookarmor start
       </div>
     </div>
 

package/src/server.js

@@ -322,39 +322,44 @@ function createServer(options = {}) {
   // SEO & Web Crawler Discovery
   app.get('/robots.txt', (req, res) => {
     res.type('text/plain');
-    res.sendFile(path.join(__dirname, 'public', 'robots.txt'));
+    res.sendFile('robots.txt', { root: path.join(__dirname, 'public') });
   });
 
   app.get('/sitemap.xml', (req, res) => {
     res.type('application/xml');
-    res.sendFile(path.join(__dirname, 'public', 'sitemap.xml'));
+    res.sendFile('sitemap.xml', { root: path.join(__dirname, 'public') });
   });
 
   app.get('/og-preview.png', (req, res) => {
     res.type('image/png');
-    res.sendFile(path.join(__dirname, 'public', 'og-preview.png'));
+    res.sendFile('og-preview.png', { root: path.join(__dirname, 'public') });
   });
 
-  // Landing Page Route
+  // Root Route: Dashboard if run locally via CLI; Landing page on cloud deployment
   app.get('/', (req, res) => {
-    res.sendFile(path.join(__dirname, 'public', 'landing.html'));
+    const isCloudProduction = Boolean(process.env.RAILWAY_ENVIRONMENT || process.env.RENDER || process.env.NODE_ENV === 'production');
+    if (!isCloudProduction) {
+      return res.sendFile('index.html', { root: path.join(__dirname, 'public') });
+    }
+    res.sendFile('landing.html', { root: path.join(__dirname, 'public') });
   });
 
   // Interactive Dashboard Routes
   app.get(['/dashboard', '/app'], (req, res) => {
-    res.sendFile(path.join(__dirname, 'public', 'index.html'));
+    res.sendFile('index.html', { root: path.join(__dirname, 'public') });
   });
 
   // Engineering Blog Routes
   app.get('/blog', (req, res) => {
-    res.sendFile(path.join(__dirname, 'public', 'blog', 'index.html'));
+    res.sendFile('index.html', { root: path.join(__dirname, 'public', 'blog') });
   });
 
   app.get('/blog/:slug', (req, res) => {
     const slug = req.params.slug.replace(/[^a-zA-Z0-9-_]/g, '');
-    const filePath = path.join(__dirname, 'public', 'blog', `${slug}.html`);
+    const fileName = `${slug}.html`;
+    const filePath = path.join(__dirname, 'public', 'blog', fileName);
     if (fs.existsSync(filePath)) {
-      return res.sendFile(filePath);
+      return res.sendFile(fileName, { root: path.join(__dirname, 'public', 'blog') });
     }
     res.redirect('/blog');
   });