npm - kanna-code - Versions diffs - 0.33.0 → 0.33.2 - Mend

kanna-code 0.33.0 → 0.33.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/README.md +1 -1
package/dist/client/assets/{index-BYzAMpzV.css → index-FQ1dOuTJ.css} +1 -1
package/dist/client/assets/{index-ab3JkqZ2.js → index-LriUBeIQ.js} +20 -20
package/dist/client/index.html +2 -2
package/package.json +1 -1
package/src/server/auth.test.ts +21 -31
package/src/server/auth.ts +7 -142
package/src/server/server.ts +3 -3

package/dist/client/index.html CHANGED Viewed

@@ -30,8 +30,8 @@
       })()
     </script>
     <title>Kanna</title>
-    <script type="module" crossorigin src="/assets/index-ab3JkqZ2.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-BYzAMpzV.css">
+    <script type="module" crossorigin src="/assets/index-LriUBeIQ.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-FQ1dOuTJ.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "name": "kanna-code",
   "type": "module",
-  "version": "0.33.0",
+  "version": "0.33.2",
   "description": "A beautiful web UI for Claude Code",
   "license": "MIT",
   "keywords": [

package/src/server/auth.test.ts CHANGED Viewed

@@ -31,13 +31,14 @@ function extractCookie(response: Response) {
 }
 describe("password auth", () => {
-  test("redirects unauthenticated html requests to the login page", async () => {
+  test("serves the app shell to unauthenticated browser requests", async () => {
     const { server } = await startPasswordServer()
     try {
-      const response = await fetch(`http://localhost:${server.port}/`, { redirect: "manual", headers: { Accept: "text/html" } })
-      expect(response.status).toBe(302)
-      expect(response.headers.get("location")).toBe(`http://localhost:${server.port}/auth/login?next=%2F`)
+      const response = await fetch(`http://localhost:${server.port}/chat/demo`, { headers: { Accept: "text/html" } })
+      expect(response.status).toBe(200)
+      expect(response.headers.get("content-type")).toContain("text/html")
+      expect(await response.text()).toContain('id="root"')
     } finally {
       await server.stop()
     }
@@ -54,14 +55,13 @@ describe("password auth", () => {
     }
   })
-  test("serves the login page without authentication", async () => {
+  test("redirects /auth/login back into the app", async () => {
     const { server } = await startPasswordServer()
     try {
-      const response = await fetch(`http://localhost:${server.port}/auth/login`)
-      expect(response.status).toBe(200)
-      expect(response.headers.get("content-type")).toContain("text/html")
-      expect(await response.text()).toContain("This server is password protected")
+      const response = await fetch(`http://localhost:${server.port}/auth/login?next=%2Fchat%2Fdemo`, { redirect: "manual" })
+      expect(response.status).toBe(302)
+      expect(response.headers.get("location")).toBe(`http://localhost:${server.port}/chat/demo`)
     } finally {
       await server.stop()
     }
@@ -71,20 +71,16 @@ describe("password auth", () => {
     const { server } = await startPasswordServer()
     try {
-      const formData = new FormData()
-      formData.append("password", "secret")
-      formData.append("next", "/")
       const response = await fetch(`http://localhost:${server.port}/auth/login`, {
         method: "POST",
-        body: formData,
-        redirect: "manual",
+        body: JSON.stringify({ password: "secret", next: "/" }),
         headers: {
+          "Content-Type": "application/json",
           Origin: `http://localhost:${server.port}`,
         },
       })
-      expect(response.status).toBe(302)
-      expect(response.headers.get("location")).toBe(`http://localhost:${server.port}/`)
+      expect(response.status).toBe(200)
       expect(extractCookie(response)).toContain("kanna_session=")
     } finally {
       await server.stop()
@@ -95,19 +91,16 @@ describe("password auth", () => {
     const { server } = await startPasswordServer()
     try {
-      const formData = new FormData()
-      formData.append("password", "wrong")
       const response = await fetch(`http://localhost:${server.port}/auth/login`, {
         method: "POST",
-        body: formData,
-        redirect: "manual",
+        body: JSON.stringify({ password: "wrong", next: "/" }),
         headers: {
+          "Content-Type": "application/json",
           Origin: `http://localhost:${server.port}`,
         },
       })
-      expect(response.status).toBe(302)
-      expect(response.headers.get("location")).toContain("/auth/login?error=1")
+      expect(response.status).toBe(401)
       expect(response.headers.get("set-cookie")).toBeNull()
     } finally {
       await server.stop()
@@ -178,15 +171,14 @@ describe("password auth", () => {
     const { server } = await startPasswordServer({ port: 54321 })
     try {
-      const response = await fetch(`http://localhost:${server.port}/`, {
+      const response = await fetch(`http://localhost:${server.port}/auth/login?next=%2F`, {
         redirect: "manual",
         headers: {
-          Accept: "text/html",
           "X-Forwarded-Proto": "https",
         },
       })
       expect(response.status).toBe(302)
-      expect(response.headers.get("location")).toBe(`http://localhost:${server.port}/auth/login?next=%2F`)
+      expect(response.headers.get("location")).toBe(`http://localhost:${server.port}/`)
       const loginResponse = await fetch(`http://localhost:${server.port}/auth/login`, {
         method: "POST",
@@ -220,15 +212,14 @@ describe("password auth", () => {
     const { server } = await startPasswordServer({ port: 54322, trustProxy: true })
     try {
-      const redirect = await fetch(`http://localhost:${server.port}/`, {
+      const redirect = await fetch(`http://localhost:${server.port}/auth/login?next=%2F`, {
         redirect: "manual",
         headers: {
-          Accept: "text/html",
           "X-Forwarded-Proto": "https",
         },
       })
       expect(redirect.status).toBe(302)
-      expect(redirect.headers.get("location")).toBe(`https://localhost:${server.port}/auth/login?next=%2F`)
+      expect(redirect.headers.get("location")).toBe(`https://localhost:${server.port}/`)
       const loginResponse = await fetch(`http://localhost:${server.port}/auth/login`, {
         method: "POST",
@@ -260,15 +251,14 @@ describe("password auth", () => {
     const { server } = await startPasswordServer({ port: 54323, trustProxy: true })
     try {
-      const redirect = await fetch(`http://localhost:${server.port}/`, {
+      const redirect = await fetch(`http://localhost:${server.port}/auth/login?next=%2F`, {
         redirect: "manual",
         headers: {
-          Accept: "text/html",
           "X-Forwarded-Proto": "ftp",
         },
       })
       expect(redirect.status).toBe(302)
-      expect(redirect.headers.get("location")).toBe(`http://localhost:${server.port}/auth/login?next=%2F`)
+      expect(redirect.headers.get("location")).toBe(`http://localhost:${server.port}/`)
       const loginResponse = await fetch(`http://localhost:${server.port}/auth/login`, {
         method: "POST",

package/src/server/auth.ts CHANGED Viewed

@@ -1,5 +1,4 @@
 import { randomBytes, timingSafeEqual } from "node:crypto"
-import { APP_NAME } from "../shared/branding"
 const SESSION_COOKIE_NAME = "kanna_session"
@@ -9,17 +8,12 @@ export interface AuthStatusPayload {
 }
 export interface AuthManager {
-  readonly enabled: true
   isAuthenticated(req: Request): boolean
   validateOrigin(req: Request): boolean
-  createSessionCookie(req: Request): string
-  clearSessionCookie(req: Request): string
-  verifyPassword(candidate: string): boolean
+  redirectToApp(req: Request): Response
   handleLogin(req: Request, nextPath: string): Promise<Response>
   handleLogout(req: Request): Response
   handleStatus(req: Request): Response
-  renderLoginPage(req: Request): Response
-  unauthorizedResponse(req: Request): Response
 }
 function parseCookies(header: string | null) {
@@ -94,7 +88,6 @@ async function readLoginForm(req: Request) {
     return {
       password: typeof payload.password === "string" ? payload.password : "",
       nextPath: sanitizeNextPath(typeof payload.next === "string" ? payload.next : "/"),
-      wantsJson: true,
     }
   }
@@ -102,24 +95,9 @@ async function readLoginForm(req: Request) {
   return {
     password: String(formData.get("password") ?? ""),
     nextPath: sanitizeNextPath(String(formData.get("next") ?? "/")),
-    wantsJson: false,
   }
 }
-function requestWantsHtml(req: Request) {
-  const accept = req.headers.get("accept") ?? ""
-  return accept.includes("text/html")
-}
-function escapeHtml(value: string) {
-  return value
-    .replaceAll("&", "&amp;")
-    .replaceAll("<", "&lt;")
-    .replaceAll(">", "&gt;")
-    .replaceAll("\"", "&quot;")
-    .replaceAll("'", "&#39;")
-}
 export interface AuthManagerOptions {
   /**
    * When true, the auth layer trusts X-Forwarded-Proto to decide whether the
@@ -184,108 +162,9 @@ export function createAuthManager(password: string, options: AuthManagerOptions
     } satisfies AuthStatusPayload)
   }
-  function unauthorizedResponse(req: Request) {
-    if (req.method === "GET" && requestWantsHtml(req)) {
-      const url = new URL(req.url)
-      const loginUrl = new URL("/auth/login", effectiveOrigin(req, trustProxy))
-      loginUrl.searchParams.set("next", sanitizeNextPath(`${url.pathname}${url.search}`))
-      return Response.redirect(loginUrl, 302)
-    }
-    return Response.json({ error: "Unauthorized" }, { status: 401 })
-  }
-  function renderLoginPage(req: Request) {
-    if (isAuthenticated(req)) {
-      const currentUrl = new URL(req.url)
-      return Response.redirect(new URL(sanitizeNextPath(currentUrl.searchParams.get("next")), effectiveOrigin(req, trustProxy)), 302)
-    }
+  function redirectToApp(req: Request) {
     const currentUrl = new URL(req.url)
-    const nextPath = sanitizeNextPath(currentUrl.searchParams.get("next"))
-    const showError = currentUrl.searchParams.get("error") === "1"
-    const html = `<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>${escapeHtml(APP_NAME)} Login</title>
-    <style>
-      :root { color-scheme: dark; }
-      * { box-sizing: border-box; }
-      body {
-        margin: 0;
-        min-height: 100vh;
-        font-family: ui-sans-serif, system-ui, sans-serif;
-        background:
-          radial-gradient(circle at top, rgba(255,255,255,0.10), transparent 28%),
-          linear-gradient(160deg, #16181d 0%, #0b0d10 55%, #050608 100%);
-        color: #f4f7fb;
-        display: grid;
-        place-items: center;
-        padding: 24px;
-      }
-      .card {
-        width: min(420px, 100%);
-        border: 1px solid rgba(255,255,255,0.12);
-        background: rgba(12, 15, 20, 0.88);
-        backdrop-filter: blur(10px);
-        border-radius: 24px;
-        padding: 28px;
-        box-shadow: 0 24px 70px rgba(0,0,0,0.35);
-      }
-      h1 { margin: 0 0 8px; font-size: 28px; }
-      p { margin: 0 0 20px; color: #a6b0bd; line-height: 1.5; }
-      label { display: block; font-size: 13px; margin-bottom: 8px; color: #d7dce4; }
-      input {
-        width: 100%;
-        border-radius: 14px;
-        border: 1px solid rgba(255,255,255,0.16);
-        background: rgba(255,255,255,0.04);
-        color: inherit;
-        padding: 14px 16px;
-        font-size: 15px;
-        margin-bottom: 16px;
-      }
-      button {
-        width: 100%;
-        border: 0;
-        border-radius: 14px;
-        padding: 14px 16px;
-        background: linear-gradient(135deg, #f4ede0 0%, #d9c4a1 100%);
-        color: #16181d;
-        font-size: 15px;
-        font-weight: 700;
-        cursor: pointer;
-      }
-      .error {
-        margin-bottom: 16px;
-        border-radius: 14px;
-        background: rgba(255, 106, 106, 0.12);
-        border: 1px solid rgba(255, 106, 106, 0.24);
-        color: #ffb8b8;
-        padding: 12px 14px;
-        font-size: 14px;
-      }
-    </style>
-  </head>
-  <body>
-    <form class="card" method="post" action="/auth/login">
-      <h1>${escapeHtml(APP_NAME)}</h1>
-      <p>This server is password protected. Enter the launch password to continue.</p>
-      ${showError ? '<div class="error">Incorrect password. Try again.</div>' : ""}
-      <input type="hidden" name="next" value="${escapeHtml(nextPath)}" />
-      <label for="password">Password</label>
-      <input id="password" name="password" type="password" autocomplete="current-password" autofocus required />
-      <button type="submit">Unlock</button>
-    </form>
-  </body>
-</html>`
-    return new Response(html, {
-      headers: {
-        "Content-Type": "text/html; charset=utf-8",
-      },
-    })
+    return Response.redirect(new URL(sanitizeNextPath(currentUrl.searchParams.get("next")), effectiveOrigin(req, trustProxy)), 302)
   }
   async function handleLogin(req: Request, fallbackNextPath: string) {
@@ -293,21 +172,12 @@ export function createAuthManager(password: string, options: AuthManagerOptions
       return Response.json({ error: "Forbidden" }, { status: 403 })
     }
-    const { password: candidate, nextPath, wantsJson } = await readLoginForm(req)
+    const { password: candidate, nextPath } = await readLoginForm(req)
     if (!verifyPassword(candidate)) {
-      if (wantsJson) {
-        return Response.json({ error: "Invalid password" }, { status: 401 })
-      }
-      const redirectUrl = new URL("/auth/login", effectiveOrigin(req, trustProxy))
-      redirectUrl.searchParams.set("error", "1")
-      redirectUrl.searchParams.set("next", sanitizeNextPath(nextPath || fallbackNextPath))
-      return Response.redirect(redirectUrl, 302)
+      return Response.json({ error: "Invalid password" }, { status: 401 })
     }
-    const response = wantsJson
-      ? Response.json({ ok: true, nextPath: sanitizeNextPath(nextPath || fallbackNextPath) })
-      : Response.redirect(new URL(sanitizeNextPath(nextPath || fallbackNextPath), effectiveOrigin(req, trustProxy)), 302)
+    const response = Response.json({ ok: true, nextPath: sanitizeNextPath(nextPath || fallbackNextPath) })
     response.headers.set("Set-Cookie", createSessionCookie(req))
     return response
@@ -324,16 +194,11 @@ export function createAuthManager(password: string, options: AuthManagerOptions
   }
   return {
-    enabled: true,
     isAuthenticated,
     validateOrigin,
-    createSessionCookie,
-    clearSessionCookie,
-    verifyPassword,
+    redirectToApp,
     handleLogin,
     handleLogout,
     handleStatus,
-    renderLoginPage,
-    unauthorizedResponse,
   }
 }

package/src/server/server.ts CHANGED Viewed

@@ -175,7 +175,7 @@ export async function startKannaServer(options: StartKannaServerOptions = {}) {
           if (auth) {
             if (url.pathname === "/auth/login") {
               if (req.method === "GET") {
-                return auth.renderLoginPage(req)
+                return auth.redirectToApp(req)
               }
               if (req.method === "POST") {
                 return auth.handleLogin(req, "/")
@@ -190,8 +190,8 @@ export async function startKannaServer(options: StartKannaServerOptions = {}) {
               if (!auth.isAuthenticated(req)) {
                 return new Response("Unauthorized", { status: 401 })
               }
-            } else if (!auth.isAuthenticated(req)) {
-              return auth.unauthorizedResponse(req)
+            } else if ((url.pathname === "/health" || url.pathname.startsWith("/api/")) && !auth.isAuthenticated(req)) {
+              return Response.json({ error: "Unauthorized" }, { status: 401 })
             }
           }