kanna-code 0.33.0 → 0.33.1

package/src/server/auth.test.ts

@@ -31,13 +31,14 @@ function extractCookie(response: Response) {
 }
 
 describe("password auth", () => {
-  test("redirects unauthenticated html requests to the login page", async () => {
+  test("serves the app shell to unauthenticated browser requests", async () => {
     const { server } = await startPasswordServer()
 
     try {
-      const response = await fetch(`http://localhost:${server.port}/`, { redirect: "manual", headers: { Accept: "text/html" } })
-      expect(response.status).toBe(302)
-      expect(response.headers.get("location")).toBe(`http://localhost:${server.port}/auth/login?next=%2F`)
+      const response = await fetch(`http://localhost:${server.port}/chat/demo`, { headers: { Accept: "text/html" } })
+      expect(response.status).toBe(200)
+      expect(response.headers.get("content-type")).toContain("text/html")
+      expect(await response.text()).toContain('id="root"')
     } finally {
       await server.stop()
     }
@@ -54,14 +55,13 @@ describe("password auth", () => {
     }
   })
 
-  test("serves the login page without authentication", async () => {
+  test("redirects /auth/login back into the app", async () => {
     const { server } = await startPasswordServer()
 
     try {
-      const response = await fetch(`http://localhost:${server.port}/auth/login`)
-      expect(response.status).toBe(200)
-      expect(response.headers.get("content-type")).toContain("text/html")
-      expect(await response.text()).toContain("This server is password protected")
+      const response = await fetch(`http://localhost:${server.port}/auth/login?next=%2Fchat%2Fdemo`, { redirect: "manual" })
+      expect(response.status).toBe(302)
+      expect(response.headers.get("location")).toBe(`http://localhost:${server.port}/chat/demo`)
     } finally {
       await server.stop()
     }
@@ -71,20 +71,16 @@ describe("password auth", () => {
     const { server } = await startPasswordServer()
 
     try {
-      const formData = new FormData()
-      formData.append("password", "secret")
-      formData.append("next", "/")
       const response = await fetch(`http://localhost:${server.port}/auth/login`, {
         method: "POST",
-        body: formData,
-        redirect: "manual",
+        body: JSON.stringify({ password: "secret", next: "/" }),
         headers: {
+          "Content-Type": "application/json",
           Origin: `http://localhost:${server.port}`,
         },
       })
 
-      expect(response.status).toBe(302)
-      expect(response.headers.get("location")).toBe(`http://localhost:${server.port}/`)
+      expect(response.status).toBe(200)
       expect(extractCookie(response)).toContain("kanna_session=")
     } finally {
       await server.stop()
@@ -95,19 +91,16 @@ describe("password auth", () => {
     const { server } = await startPasswordServer()
 
     try {
-      const formData = new FormData()
-      formData.append("password", "wrong")
       const response = await fetch(`http://localhost:${server.port}/auth/login`, {
         method: "POST",
-        body: formData,
-        redirect: "manual",
+        body: JSON.stringify({ password: "wrong", next: "/" }),
         headers: {
+          "Content-Type": "application/json",
           Origin: `http://localhost:${server.port}`,
         },
       })
 
-      expect(response.status).toBe(302)
-      expect(response.headers.get("location")).toContain("/auth/login?error=1")
+      expect(response.status).toBe(401)
       expect(response.headers.get("set-cookie")).toBeNull()
     } finally {
       await server.stop()
@@ -178,15 +171,14 @@ describe("password auth", () => {
     const { server } = await startPasswordServer({ port: 54321 })
 
     try {
-      const response = await fetch(`http://localhost:${server.port}/`, {
+      const response = await fetch(`http://localhost:${server.port}/auth/login?next=%2F`, {
         redirect: "manual",
         headers: {
-          Accept: "text/html",
           "X-Forwarded-Proto": "https",
         },
       })
       expect(response.status).toBe(302)
-      expect(response.headers.get("location")).toBe(`http://localhost:${server.port}/auth/login?next=%2F`)
+      expect(response.headers.get("location")).toBe(`http://localhost:${server.port}/`)
 
       const loginResponse = await fetch(`http://localhost:${server.port}/auth/login`, {
         method: "POST",
@@ -220,15 +212,14 @@ describe("password auth", () => {
     const { server } = await startPasswordServer({ port: 54322, trustProxy: true })
 
     try {
-      const redirect = await fetch(`http://localhost:${server.port}/`, {
+      const redirect = await fetch(`http://localhost:${server.port}/auth/login?next=%2F`, {
         redirect: "manual",
         headers: {
-          Accept: "text/html",
           "X-Forwarded-Proto": "https",
         },
       })
       expect(redirect.status).toBe(302)
-      expect(redirect.headers.get("location")).toBe(`https://localhost:${server.port}/auth/login?next=%2F`)
+      expect(redirect.headers.get("location")).toBe(`https://localhost:${server.port}/`)
 
       const loginResponse = await fetch(`http://localhost:${server.port}/auth/login`, {
         method: "POST",
@@ -260,15 +251,14 @@ describe("password auth", () => {
     const { server } = await startPasswordServer({ port: 54323, trustProxy: true })
 
     try {
-      const redirect = await fetch(`http://localhost:${server.port}/`, {
+      const redirect = await fetch(`http://localhost:${server.port}/auth/login?next=%2F`, {
         redirect: "manual",
         headers: {
-          Accept: "text/html",
           "X-Forwarded-Proto": "ftp",
         },
       })
       expect(redirect.status).toBe(302)
-      expect(redirect.headers.get("location")).toBe(`http://localhost:${server.port}/auth/login?next=%2F`)
+      expect(redirect.headers.get("location")).toBe(`http://localhost:${server.port}/`)
 
       const loginResponse = await fetch(`http://localhost:${server.port}/auth/login`, {
         method: "POST",

package/src/server/auth.ts

@@ -1,5 +1,4 @@
 import { randomBytes, timingSafeEqual } from "node:crypto"
-import { APP_NAME } from "../shared/branding"
 
 const SESSION_COOKIE_NAME = "kanna_session"
 
@@ -9,17 +8,12 @@ export interface AuthStatusPayload {
 }
 
 export interface AuthManager {
-  readonly enabled: true
   isAuthenticated(req: Request): boolean
   validateOrigin(req: Request): boolean
-  createSessionCookie(req: Request): string
-  clearSessionCookie(req: Request): string
-  verifyPassword(candidate: string): boolean
+  redirectToApp(req: Request): Response
   handleLogin(req: Request, nextPath: string): Promise<Response>
   handleLogout(req: Request): Response
   handleStatus(req: Request): Response
-  renderLoginPage(req: Request): Response
-  unauthorizedResponse(req: Request): Response
 }
 
 function parseCookies(header: string | null) {
@@ -94,7 +88,6 @@ async function readLoginForm(req: Request) {
     return {
       password: typeof payload.password === "string" ? payload.password : "",
       nextPath: sanitizeNextPath(typeof payload.next === "string" ? payload.next : "/"),
-      wantsJson: true,
     }
   }
 
@@ -102,24 +95,9 @@ async function readLoginForm(req: Request) {
   return {
     password: String(formData.get("password") ?? ""),
     nextPath: sanitizeNextPath(String(formData.get("next") ?? "/")),
-    wantsJson: false,
   }
 }
 
-function requestWantsHtml(req: Request) {
-  const accept = req.headers.get("accept") ?? ""
-  return accept.includes("text/html")
-}
-
-function escapeHtml(value: string) {
-  return value
-    .replaceAll("&", "&amp;")
-    .replaceAll("<", "&lt;")
-    .replaceAll(">", "&gt;")
-    .replaceAll("\"", "&quot;")
-    .replaceAll("'", "&#39;")
-}
-
 export interface AuthManagerOptions {
   /**
    * When true, the auth layer trusts X-Forwarded-Proto to decide whether the
@@ -184,108 +162,9 @@ export function createAuthManager(password: string, options: AuthManagerOptions
     } satisfies AuthStatusPayload)
   }
 
-  function unauthorizedResponse(req: Request) {
-    if (req.method === "GET" && requestWantsHtml(req)) {
-      const url = new URL(req.url)
-      const loginUrl = new URL("/auth/login", effectiveOrigin(req, trustProxy))
-      loginUrl.searchParams.set("next", sanitizeNextPath(`${url.pathname}${url.search}`))
-      return Response.redirect(loginUrl, 302)
-    }
-
-    return Response.json({ error: "Unauthorized" }, { status: 401 })
-  }
-
-  function renderLoginPage(req: Request) {
-    if (isAuthenticated(req)) {
-      const currentUrl = new URL(req.url)
-      return Response.redirect(new URL(sanitizeNextPath(currentUrl.searchParams.get("next")), effectiveOrigin(req, trustProxy)), 302)
-    }
-
+  function redirectToApp(req: Request) {
     const currentUrl = new URL(req.url)
-    const nextPath = sanitizeNextPath(currentUrl.searchParams.get("next"))
-    const showError = currentUrl.searchParams.get("error") === "1"
-    const html = `<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>${escapeHtml(APP_NAME)} Login</title>
-    <style>
-      :root { color-scheme: dark; }
-      * { box-sizing: border-box; }
-      body {
-        margin: 0;
-        min-height: 100vh;
-        font-family: ui-sans-serif, system-ui, sans-serif;
-        background:
-          radial-gradient(circle at top, rgba(255,255,255,0.10), transparent 28%),
-          linear-gradient(160deg, #16181d 0%, #0b0d10 55%, #050608 100%);
-        color: #f4f7fb;
-        display: grid;
-        place-items: center;
-        padding: 24px;
-      }
-      .card {
-        width: min(420px, 100%);
-        border: 1px solid rgba(255,255,255,0.12);
-        background: rgba(12, 15, 20, 0.88);
-        backdrop-filter: blur(10px);
-        border-radius: 24px;
-        padding: 28px;
-        box-shadow: 0 24px 70px rgba(0,0,0,0.35);
-      }
-      h1 { margin: 0 0 8px; font-size: 28px; }
-      p { margin: 0 0 20px; color: #a6b0bd; line-height: 1.5; }
-      label { display: block; font-size: 13px; margin-bottom: 8px; color: #d7dce4; }
-      input {
-        width: 100%;
-        border-radius: 14px;
-        border: 1px solid rgba(255,255,255,0.16);
-        background: rgba(255,255,255,0.04);
-        color: inherit;
-        padding: 14px 16px;
-        font-size: 15px;
-        margin-bottom: 16px;
-      }
-      button {
-        width: 100%;
-        border: 0;
-        border-radius: 14px;
-        padding: 14px 16px;
-        background: linear-gradient(135deg, #f4ede0 0%, #d9c4a1 100%);
-        color: #16181d;
-        font-size: 15px;
-        font-weight: 700;
-        cursor: pointer;
-      }
-      .error {
-        margin-bottom: 16px;
-        border-radius: 14px;
-        background: rgba(255, 106, 106, 0.12);
-        border: 1px solid rgba(255, 106, 106, 0.24);
-        color: #ffb8b8;
-        padding: 12px 14px;
-        font-size: 14px;
-      }
-    </style>
-  </head>
-  <body>
-    <form class="card" method="post" action="/auth/login">
-      <h1>${escapeHtml(APP_NAME)}</h1>
-      <p>This server is password protected. Enter the launch password to continue.</p>
-      ${showError ? '<div class="error">Incorrect password. Try again.</div>' : ""}
-      <input type="hidden" name="next" value="${escapeHtml(nextPath)}" />
-      <label for="password">Password</label>
-      <input id="password" name="password" type="password" autocomplete="current-password" autofocus required />
-      <button type="submit">Unlock</button>
-    </form>
-  </body>
-</html>`
-    return new Response(html, {
-      headers: {
-        "Content-Type": "text/html; charset=utf-8",
-      },
-    })
+    return Response.redirect(new URL(sanitizeNextPath(currentUrl.searchParams.get("next")), effectiveOrigin(req, trustProxy)), 302)
   }
 
   async function handleLogin(req: Request, fallbackNextPath: string) {
@@ -293,21 +172,12 @@ export function createAuthManager(password: string, options: AuthManagerOptions
       return Response.json({ error: "Forbidden" }, { status: 403 })
     }
 
-    const { password: candidate, nextPath, wantsJson } = await readLoginForm(req)
+    const { password: candidate, nextPath } = await readLoginForm(req)
     if (!verifyPassword(candidate)) {
-      if (wantsJson) {
-        return Response.json({ error: "Invalid password" }, { status: 401 })
-      }
-
-      const redirectUrl = new URL("/auth/login", effectiveOrigin(req, trustProxy))
-      redirectUrl.searchParams.set("error", "1")
-      redirectUrl.searchParams.set("next", sanitizeNextPath(nextPath || fallbackNextPath))
-      return Response.redirect(redirectUrl, 302)
+      return Response.json({ error: "Invalid password" }, { status: 401 })
     }
 
-    const response = wantsJson
-      ? Response.json({ ok: true, nextPath: sanitizeNextPath(nextPath || fallbackNextPath) })
-      : Response.redirect(new URL(sanitizeNextPath(nextPath || fallbackNextPath), effectiveOrigin(req, trustProxy)), 302)
+    const response = Response.json({ ok: true, nextPath: sanitizeNextPath(nextPath || fallbackNextPath) })
 
     response.headers.set("Set-Cookie", createSessionCookie(req))
     return response
@@ -324,16 +194,11 @@ export function createAuthManager(password: string, options: AuthManagerOptions
   }
 
   return {
-    enabled: true,
     isAuthenticated,
     validateOrigin,
-    createSessionCookie,
-    clearSessionCookie,
-    verifyPassword,
+    redirectToApp,
     handleLogin,
     handleLogout,
     handleStatus,
-    renderLoginPage,
-    unauthorizedResponse,
   }
 }

package/src/server/server.ts

@@ -175,7 +175,7 @@ export async function startKannaServer(options: StartKannaServerOptions = {}) {
           if (auth) {
             if (url.pathname === "/auth/login") {
               if (req.method === "GET") {
-                return auth.renderLoginPage(req)
+                return auth.redirectToApp(req)
               }
               if (req.method === "POST") {
                 return auth.handleLogin(req, "/")
@@ -190,8 +190,8 @@ export async function startKannaServer(options: StartKannaServerOptions = {}) {
               if (!auth.isAuthenticated(req)) {
                 return new Response("Unauthorized", { status: 401 })
               }
-            } else if (!auth.isAuthenticated(req)) {
-              return auth.unauthorizedResponse(req)
+            } else if ((url.pathname === "/health" || url.pathname.startsWith("/api/")) && !auth.isAuthenticated(req)) {
+              return Response.json({ error: "Unauthorized" }, { status: 401 })
             }
           }