libre-webui 0.25.0 → 0.27.0

package/backend/dist/utils/resourceLimits.d.ts

@@ -1,4 +1,10 @@
 export declare const MAX_NOTES_PER_USER = 100;
+export declare const MAX_NOTE_REVISIONS_PER_NOTE = 50;
+export declare const MAX_NOTE_ATTACHMENTS_PER_NOTE = 10;
+export declare const MAX_NOTE_ATTACHMENT_BYTES: number;
+export declare const MAX_NOTE_ASSIST_INSTRUCTION_LENGTH = 4000;
+export declare const MAX_PROMPT_QUEUE_ENTRIES = 20;
+export declare const MAX_PROMPT_QUEUE_CONTENT_LENGTH = 8000;
 export declare const MAX_NOTE_TITLE_LENGTH = 200;
 export declare const MAX_NOTE_CONTENT_LENGTH = 200000;
 export declare const MAX_SESSION_FOLDERS_PER_USER = 100;
@@ -10,8 +16,61 @@ export declare const MAX_AUTOMATIONS_PER_USER = 50;
 export declare const MAX_AUTOMATION_NAME_LENGTH = 200;
 export declare const MAX_AUTOMATION_INSTRUCTIONS_LENGTH = 20000;
 export declare const MAX_AUTOMATION_TRIGGERS = 5;
+export declare const MAX_TOOL_SERVERS = 50;
+export declare const MAX_TOOL_SERVER_NAME_LENGTH = 120;
+export declare const MAX_TOOL_SERVER_DESCRIPTION_LENGTH = 2000;
+export declare const MAX_TOOL_SERVER_SPEC_BYTES = 1000000;
+export declare const MAX_TOOL_SERVER_TOOLS = 128;
+export declare const MAX_TOOL_SERVER_SECRET_LENGTH = 4096;
+export declare const MAX_PROMPTS_PER_USER = 200;
+export declare const MAX_PROMPT_SLUG_LENGTH = 64;
+export declare const MAX_PROMPT_TITLE_LENGTH = 200;
+export declare const MAX_PROMPT_DESCRIPTION_LENGTH = 2000;
+export declare const MAX_PROMPT_CONTENT_LENGTH = 50000;
+export declare const MAX_PROMPT_VARIABLES = 20;
+export declare const MAX_PROMPT_TAGS = 20;
+export declare const MAX_PROMPT_VERSIONS = 50;
+export declare const MAX_SKILLS_PER_USER = 100;
+export declare const MAX_SKILL_SLUG_LENGTH = 64;
+export declare const MAX_SKILL_NAME_LENGTH = 200;
+export declare const MAX_SKILL_DESCRIPTION_LENGTH = 1000;
+export declare const MAX_SKILL_INSTRUCTIONS_LENGTH = 100000;
+export declare const MAX_SKILL_VERSIONS = 50;
+export declare const MAX_SKILL_FILES = 32;
+export declare const MAX_SKILL_FILE_PATH_LENGTH = 200;
+export declare const MAX_SKILL_FILE_CONTENT_LENGTH = 200000;
+export declare const MAX_SKILL_FILES_TOTAL_BYTES = 1000000;
+export declare const MAX_CHANNELS_PER_USER = 50;
+export declare const MAX_CHANNELS_LISTED = 200;
+export declare const MAX_CHANNEL_NAME_LENGTH = 80;
+export declare const MAX_CHANNEL_DESCRIPTION_LENGTH = 500;
+export declare const MAX_CHANNEL_MEMBERS = 200;
+export declare const MAX_CHANNEL_MESSAGES = 50000;
+export declare const MAX_CHANNEL_MESSAGE_LENGTH = 8000;
+export declare const MAX_CHANNEL_REACTIONS_PER_MESSAGE = 200;
+export declare const MAX_CHANNEL_EMOJI_LENGTH = 16;
+export declare const MAX_CHANNEL_PAGE_SIZE = 100;
+export declare const MAX_CHANNEL_THREAD_PAGE_SIZE = 200;
+export declare const MAX_CHANNEL_PINNED_LISTED = 100;
+export declare const MAX_CHANNEL_ATTACHMENTS_PER_MESSAGE = 5;
+export declare const MAX_CHANNEL_ATTACHMENT_BYTES: number;
+export declare const MAX_CHANNEL_MENTION_CONTEXT_MESSAGES = 30;
+export declare const MAX_NOTIFICATIONS_PER_USER = 500;
+export declare const MAX_NOTIFICATION_TITLE_LENGTH = 200;
+export declare const MAX_NOTIFICATION_BODY_LENGTH = 1000;
+export declare const MAX_NOTIFICATION_PAGE_SIZE = 100;
+export declare const MAX_WEBHOOK_TARGETS = 20;
+export declare const MAX_WEBHOOK_NAME_LENGTH = 120;
+export declare const MAX_WEBHOOK_URL_LENGTH = 2000;
+export declare const MAX_WEBHOOK_SECRET_LENGTH = 256;
+export declare const MAX_CALENDARS_PER_USER = 20;
+export declare const MAX_CALENDAR_NAME_LENGTH = 80;
+export declare const MAX_CALENDAR_COLOR_LENGTH = 24;
+export declare const MAX_CALENDAR_REMINDER_MINUTES: number;
+export declare const MAX_ICS_IMPORT_BYTES = 2000000;
+export declare const MAX_ICS_IMPORT_EVENTS = 1000;
 export declare class ResourcePolicyError extends Error {
-    readonly statusCode: 400 | 409;
-    constructor(message: string, statusCode: 400 | 409);
+    readonly statusCode: 400 | 404 | 409;
+    constructor(message: string, statusCode: 400 | 404 | 409);
 }
 //# sourceMappingURL=resourceLimits.d.ts.map

package/backend/dist/utils/resourceLimits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resourceLimits.d.ts","sourceRoot":"","sources":["../../src/utils/resourceLimits.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,kBAAkB,MAAM,CAAC;AACtC,eAAO,MAAM,qBAAqB,MAAM,CAAC;AACzC,eAAO,MAAM,uBAAuB,SAAU,CAAC;AAC/C,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAChD,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAClD,eAAO,MAAM,4BAA4B,OAAO,CAAC;AACjD,eAAO,MAAM,+BAA+B,MAAM,CAAC;AACnD,eAAO,MAAM,+BAA+B,QAAS,CAAC;AACtD,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,eAAO,MAAM,kCAAkC,QAAS,CAAC;AACzD,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAEzC,qBAAa,mBAAoB,SAAQ,KAAK;IAG1C,QAAQ,CAAC,UAAU,EAAE,GAAG,GAAG,GAAG;IAFhC,YACE,OAAO,EAAE,MAAM,EACN,UAAU,EAAE,GAAG,GAAG,GAAG,EAI/B;CACF"}
+{"version":3,"file":"resourceLimits.d.ts","sourceRoot":"","sources":["../../src/utils/resourceLimits.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,kBAAkB,MAAM,CAAC;AACtC,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAC9C,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAChD,eAAO,MAAM,yBAAyB,QAAmB,CAAC;AAC1D,eAAO,MAAM,kCAAkC,OAAO,CAAC;AACvD,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,+BAA+B,OAAO,CAAC;AACpD,eAAO,MAAM,qBAAqB,MAAM,CAAC;AACzC,eAAO,MAAM,uBAAuB,SAAU,CAAC;AAC/C,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAChD,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAClD,eAAO,MAAM,4BAA4B,OAAO,CAAC;AACjD,eAAO,MAAM,+BAA+B,MAAM,CAAC;AACnD,eAAO,MAAM,+BAA+B,QAAS,CAAC;AACtD,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,eAAO,MAAM,kCAAkC,QAAS,CAAC;AACzD,eAAO,MAAM,uBAAuB,IAAI,CAAC;AACzC,eAAO,MAAM,gBAAgB,KAAK,CAAC;AACnC,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C,eAAO,MAAM,kCAAkC,OAAO,CAAC;AACvD,eAAO,MAAM,0BAA0B,UAAY,CAAC;AACpD,eAAO,MAAM,qBAAqB,MAAM,CAAC;AACzC,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAClD,eAAO,MAAM,oBAAoB,MAAM,CAAC;AACxC,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAClD,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAChD,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,eAAO,MAAM,mBAAmB,KAAK,CAAC;AACtC,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,eAAO,MAAM,qBAAqB,MAAM,CAAC;AACzC,eAAO,MAAM,4BAA4B,OAAO,CAAC;AACjD,eAAO,MAAM,6BAA6B,SAAU,CAAC;AACrD,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,eAAO,MAAM,6BAA6B,SAAU,CAAC;AACrD,eAAO,MAAM,2BAA2B,UAAY,CAAC;AACrD,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAClD,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAC3C,eAAO,MAAM,0BAA0B,OAAQ,CAAC;AAChD,eAAO,MAAM,iCAAiC,MAAM,CAAC;AACrD,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,qBAAqB,MAAM,CAAC;AACzC,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAChD,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAC7C,eAAO,MAAM,mCAAmC,IAAI,CAAC;AACrD,eAAO,MAAM,4BAA4B,QAAmB,CAAC;AAC7D,eAAO,MAAM,oCAAoC,KAAK,CAAC;AACvD,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,eAAO,MAAM,6BAA6B,MAAM,CAAC;AACjD,eAAO,MAAM,4BAA4B,OAAQ,CAAC;AAClD,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,eAAO,MAAM,mBAAmB,KAAK,CAAC;AACtC,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,sBAAsB,OAAQ,CAAC;AAC5C,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAC7C,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAC5C,eAAO,MAAM,6BAA6B,QAAe,CAAC;AAC1D,eAAO,MAAM,oBAAoB,UAAY,CAAC;AAC9C,eAAO,MAAM,qBAAqB,OAAQ,CAAC;AAE3C,qBAAa,mBAAoB,SAAQ,KAAK;IAG1C,QAAQ,CAAC,UAAU,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG;IAFtC,YACE,OAAO,EAAE,MAAM,EACN,UAAU,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,EAIrC;CACF"}

package/backend/dist/utils/resourceLimits.js

@@ -15,6 +15,12 @@
  * limitations under the License.
  */
 export const MAX_NOTES_PER_USER = 100;
+export const MAX_NOTE_REVISIONS_PER_NOTE = 50;
+export const MAX_NOTE_ATTACHMENTS_PER_NOTE = 10;
+export const MAX_NOTE_ATTACHMENT_BYTES = 10 * 1024 * 1024;
+export const MAX_NOTE_ASSIST_INSTRUCTION_LENGTH = 4000;
+export const MAX_PROMPT_QUEUE_ENTRIES = 20;
+export const MAX_PROMPT_QUEUE_CONTENT_LENGTH = 8000;
 export const MAX_NOTE_TITLE_LENGTH = 200;
 export const MAX_NOTE_CONTENT_LENGTH = 200000;
 export const MAX_SESSION_FOLDERS_PER_USER = 100;
@@ -26,6 +32,59 @@ export const MAX_AUTOMATIONS_PER_USER = 50;
 export const MAX_AUTOMATION_NAME_LENGTH = 200;
 export const MAX_AUTOMATION_INSTRUCTIONS_LENGTH = 20000;
 export const MAX_AUTOMATION_TRIGGERS = 5;
+export const MAX_TOOL_SERVERS = 50;
+export const MAX_TOOL_SERVER_NAME_LENGTH = 120;
+export const MAX_TOOL_SERVER_DESCRIPTION_LENGTH = 2000;
+export const MAX_TOOL_SERVER_SPEC_BYTES = 1000000;
+export const MAX_TOOL_SERVER_TOOLS = 128;
+export const MAX_TOOL_SERVER_SECRET_LENGTH = 4096;
+export const MAX_PROMPTS_PER_USER = 200;
+export const MAX_PROMPT_SLUG_LENGTH = 64;
+export const MAX_PROMPT_TITLE_LENGTH = 200;
+export const MAX_PROMPT_DESCRIPTION_LENGTH = 2000;
+export const MAX_PROMPT_CONTENT_LENGTH = 50000;
+export const MAX_PROMPT_VARIABLES = 20;
+export const MAX_PROMPT_TAGS = 20;
+export const MAX_PROMPT_VERSIONS = 50;
+export const MAX_SKILLS_PER_USER = 100;
+export const MAX_SKILL_SLUG_LENGTH = 64;
+export const MAX_SKILL_NAME_LENGTH = 200;
+export const MAX_SKILL_DESCRIPTION_LENGTH = 1000;
+export const MAX_SKILL_INSTRUCTIONS_LENGTH = 100000;
+export const MAX_SKILL_VERSIONS = 50;
+export const MAX_SKILL_FILES = 32;
+export const MAX_SKILL_FILE_PATH_LENGTH = 200;
+export const MAX_SKILL_FILE_CONTENT_LENGTH = 200000;
+export const MAX_SKILL_FILES_TOTAL_BYTES = 1000000;
+export const MAX_CHANNELS_PER_USER = 50;
+export const MAX_CHANNELS_LISTED = 200;
+export const MAX_CHANNEL_NAME_LENGTH = 80;
+export const MAX_CHANNEL_DESCRIPTION_LENGTH = 500;
+export const MAX_CHANNEL_MEMBERS = 200;
+export const MAX_CHANNEL_MESSAGES = 50000;
+export const MAX_CHANNEL_MESSAGE_LENGTH = 8000;
+export const MAX_CHANNEL_REACTIONS_PER_MESSAGE = 200;
+export const MAX_CHANNEL_EMOJI_LENGTH = 16;
+export const MAX_CHANNEL_PAGE_SIZE = 100;
+export const MAX_CHANNEL_THREAD_PAGE_SIZE = 200;
+export const MAX_CHANNEL_PINNED_LISTED = 100;
+export const MAX_CHANNEL_ATTACHMENTS_PER_MESSAGE = 5;
+export const MAX_CHANNEL_ATTACHMENT_BYTES = 10 * 1024 * 1024;
+export const MAX_CHANNEL_MENTION_CONTEXT_MESSAGES = 30;
+export const MAX_NOTIFICATIONS_PER_USER = 500;
+export const MAX_NOTIFICATION_TITLE_LENGTH = 200;
+export const MAX_NOTIFICATION_BODY_LENGTH = 1000;
+export const MAX_NOTIFICATION_PAGE_SIZE = 100;
+export const MAX_WEBHOOK_TARGETS = 20;
+export const MAX_WEBHOOK_NAME_LENGTH = 120;
+export const MAX_WEBHOOK_URL_LENGTH = 2000;
+export const MAX_WEBHOOK_SECRET_LENGTH = 256;
+export const MAX_CALENDARS_PER_USER = 20;
+export const MAX_CALENDAR_NAME_LENGTH = 80;
+export const MAX_CALENDAR_COLOR_LENGTH = 24;
+export const MAX_CALENDAR_REMINDER_MINUTES = 60 * 24 * 14;
+export const MAX_ICS_IMPORT_BYTES = 2000000;
+export const MAX_ICS_IMPORT_EVENTS = 1000;
 export class ResourcePolicyError extends Error {
     constructor(message, statusCode) {
         super(message);

package/backend/dist/utils/resourceLimits.js.map

@@ -1 +1 @@
-{"version":3,"file":"resourceLimits.js","sourceRoot":"","sources":["../../src/utils/resourceLimits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AACtC,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AACzC,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAO,CAAC;AAC/C,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAChD,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAClD,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AACjD,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AACnD,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAM,CAAC;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAC3C,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,MAAM,CAAC,MAAM,kCAAkC,GAAG,KAAM,CAAC;AACzD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAEzC,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YACE,OAAe,EACN,UAAqB;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;0BAFN,UAAU;QAGnB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF"}
+{"version":3,"file":"resourceLimits.js","sourceRoot":"","sources":["../../src/utils/resourceLimits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AACtC,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAC9C,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAChD,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1D,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAC;AACvD,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAC3C,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;AACpD,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AACzC,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAO,CAAC;AAC/C,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAChD,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAClD,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AACjD,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AACnD,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAM,CAAC;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAC3C,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,MAAM,CAAC,MAAM,kCAAkC,GAAG,KAAM,CAAC;AACzD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AACzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAC/C,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAC;AACvD,MAAM,CAAC,MAAM,0BAA0B,GAAG,OAAS,CAAC;AACpD,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AACzC,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAClD,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACxC,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AACzC,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAC3C,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAClD,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAM,CAAC;AAChD,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AACtC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AACzC,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AACjD,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAO,CAAC;AACrD,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAO,CAAC;AACrD,MAAM,CAAC,MAAM,2BAA2B,GAAG,OAAS,CAAC;AACrD,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAC1C,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAClD,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAM,CAAC;AAC3C,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAK,CAAC;AAChD,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,CAAC;AACrD,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAC3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AACzC,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAChD,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAC7C,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC;AACrD,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7D,MAAM,CAAC,MAAM,oCAAoC,GAAG,EAAE,CAAC;AACvD,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AACjD,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAK,CAAC;AAClD,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AACtC,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAC3C,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAK,CAAC;AAC5C,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAC7C,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AACzC,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAC3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAC5C,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAS,CAAC;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAK,CAAC;AAE3C,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YACE,OAAe,EACN,UAA2B;QAEpC,KAAK,CAAC,OAAO,CAAC,CAAC;0BAFN,UAAU;QAGnB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF"}

package/backend/dist/utils/toolEgress.d.ts

@@ -0,0 +1,23 @@
+export declare class ToolEgressError extends Error {
+    constructor(message: string);
+}
+export declare const isAllowlistedPrivateHost: (hostname: string) => boolean;
+export interface ToolHttpRequest {
+    url: string;
+    method: string;
+    headers?: Record<string, string>;
+    /** Request body; binary bodies (Web Push) send as-is. */
+    body?: string | Uint8Array;
+    timeoutMs: number;
+    maxResponseBytes: number;
+    signal?: AbortSignal;
+}
+export interface ToolHttpResponse {
+    status: number;
+    headers: Record<string, string>;
+    bodyText: string;
+    truncated: boolean;
+}
+export declare const validateToolServerUrl: (rawUrl: string) => URL;
+export declare function secureToolRequest(request: ToolHttpRequest): Promise<ToolHttpResponse>;
+//# sourceMappingURL=toolEgress.d.ts.map

package/backend/dist/utils/toolEgress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolEgress.d.ts","sourceRoot":"","sources":["../../src/utils/toolEgress.ts"],"names":[],"mappings":"AAiDA,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAUD,eAAO,MAAM,wBAAwB,aAAc,MAAM,KAAG,OACR,CAAC;AAErD,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,eAAO,MAAM,qBAAqB,WAAY,MAAM,KAAG,GAgBtD,CAAC;AAgCF,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,gBAAgB,CAAC,CAsF3B"}

package/backend/dist/utils/toolEgress.js

@@ -0,0 +1,169 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Egress guard for tool-server requests. Every request resolves the target
+ * host itself, refuses private/loopback/metadata address space, and pins the
+ * connection to the resolved address so a DNS rebind between check and use
+ * cannot redirect the call. Redirects are refused outright: a registered
+ * tool destination is exact. Response reads are size-capped and every call
+ * carries a hard timeout combined with the caller's abort signal.
+ *
+ * An administrator can allow exact internal hostnames through the
+ * TOOLS_PRIVATE_NETWORK_ALLOWLIST environment variable (comma-separated,
+ * matched case-insensitively against the URL hostname). Allowlisted hosts
+ * are still connection-pinned and capped.
+ */
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+import { Agent, fetch } from 'undici';
+import { createPinnedLookup, isPublicIpAddress } from './webpageFetcher.js';
+const ABSOLUTE_MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+const ABSOLUTE_MAX_TIMEOUT_MS = 120000;
+// Explicit comparisons, not Math.min/Math.max: a NaN request value must land
+// on the ceiling instead of propagating, and the bounds stay visible to
+// static analysis of the setTimeout below.
+const clampFinite = (value, min, max) => {
+    if (!Number.isFinite(value))
+        return max;
+    if (value < min)
+        return min;
+    if (value > max)
+        return max;
+    return value;
+};
+export class ToolEgressError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ToolEgressError';
+    }
+}
+const privateHostAllowlist = () => new Set((process.env.TOOLS_PRIVATE_NETWORK_ALLOWLIST ?? '')
+    .split(',')
+    .map(entry => entry.trim().toLowerCase())
+    .filter(Boolean));
+export const isAllowlistedPrivateHost = (hostname) => privateHostAllowlist().has(hostname.toLowerCase());
+export const validateToolServerUrl = (rawUrl) => {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        throw new ToolEgressError('Invalid tool server URL');
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new ToolEgressError('Only http and https tool servers are supported');
+    }
+    if (url.username || url.password) {
+        throw new ToolEgressError('Tool server URLs cannot contain embedded credentials');
+    }
+    return url;
+};
+const resolveTarget = async (url) => {
+    const hostname = url.hostname.replace(/^\[|\]$/g, '');
+    const literalKind = isIP(hostname);
+    const resolved = literalKind !== 0
+        ? [{ address: hostname, family: literalKind }]
+        : await lookup(hostname, { all: true });
+    if (resolved.length === 0) {
+        throw new ToolEgressError('Tool server host could not be resolved');
+    }
+    const allowPrivate = isAllowlistedPrivateHost(url.hostname);
+    for (const { address } of resolved) {
+        if (!allowPrivate && !isPublicIpAddress(address)) {
+            throw new ToolEgressError('Tool server resolves to a private or local address');
+        }
+    }
+    const [first] = resolved;
+    if (first.family !== 4 && first.family !== 6) {
+        throw new ToolEgressError('Unsupported address family');
+    }
+    return { address: first.address, family: first.family };
+};
+export async function secureToolRequest(request) {
+    const url = validateToolServerUrl(request.url);
+    const target = await resolveTarget(url);
+    const maxBytes = clampFinite(request.maxResponseBytes, 1, ABSOLUTE_MAX_RESPONSE_BYTES);
+    const timeoutMs = clampFinite(request.timeoutMs, 1000, ABSOLUTE_MAX_TIMEOUT_MS);
+    // The size cap is enforced by the read loop below, which stops at maxBytes
+    // and cancels the stream. A dispatcher-level maxResponseSize cannot do the
+    // job here: it destroys the request as soon as the limit is crossed, so an
+    // oversized body would surface as a transport failure instead of the
+    // truncated result the caller is documented to receive.
+    const dispatcher = new Agent({
+        connect: { lookup: createPinnedLookup(target) },
+    });
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(new ToolEgressError('Tool request timed out')), timeoutMs);
+    const forwardAbort = () => controller.abort(request.signal?.reason);
+    request.signal?.addEventListener('abort', forwardAbort, { once: true });
+    if (request.signal?.aborted)
+        forwardAbort();
+    try {
+        const response = await fetch(url, {
+            method: request.method,
+            redirect: 'manual',
+            signal: controller.signal,
+            dispatcher,
+            headers: {
+                'User-Agent': 'Libre-WebUI/1.0 (+tool gateway)',
+                ...request.headers,
+            },
+            ...(request.body !== undefined ? { body: request.body } : {}),
+        });
+        if (response.status >= 300 && response.status < 400) {
+            await response.body?.cancel();
+            throw new ToolEgressError('Tool server responded with a redirect; registered destinations are exact');
+        }
+        const reader = response.body?.getReader();
+        const chunks = [];
+        let received = 0;
+        let truncated = false;
+        if (reader) {
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                received += value.byteLength;
+                if (received > maxBytes) {
+                    truncated = true;
+                    const keep = value.byteLength - (received - maxBytes);
+                    if (keep > 0)
+                        chunks.push(value.subarray(0, keep));
+                    await reader.cancel();
+                    break;
+                }
+                chunks.push(value);
+            }
+        }
+        const headers = {};
+        response.headers.forEach((value, key) => {
+            headers[key] = value;
+        });
+        return {
+            status: response.status,
+            headers,
+            bodyText: Buffer.concat(chunks).toString('utf-8'),
+            truncated,
+        };
+    }
+    finally {
+        clearTimeout(timer);
+        request.signal?.removeEventListener('abort', forwardAbort);
+        await dispatcher.close();
+    }
+}
+//# sourceMappingURL=toolEgress.js.map

package/backend/dist/utils/toolEgress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolEgress.js","sourceRoot":"","sources":["../../src/utils/toolEgress.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE5E,MAAM,2BAA2B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACpD,MAAM,uBAAuB,GAAG,MAAO,CAAC;AAExC,6EAA6E;AAC7E,wEAAwE;AACxE,2CAA2C;AAC3C,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,GAAW,EAAU,EAAE;IACtE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,KAAK,GAAG,GAAG;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,GAAG,GAAG;QAAE,OAAO,GAAG,CAAC;IAC5B,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,oBAAoB,GAAG,GAAgB,EAAE,CAC7C,IAAI,GAAG,CACL,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,EAAE,CAAC;KAChD,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;KACxC,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;AAEJ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,QAAgB,EAAW,EAAE,CACpE,oBAAoB,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;AAoBrD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAc,EAAO,EAAE;IAC3D,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,eAAe,CAAC,gDAAgD,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,eAAe,CACvB,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAOF,MAAM,aAAa,GAAG,KAAK,EAAE,GAAQ,EAA2B,EAAE;IAChE,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,QAAQ,GACZ,WAAW,KAAK,CAAC;QACf,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAoB,EAAE,CAAC;QACvD,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CAAC,wCAAwC,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,YAAY,GAAG,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5D,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;QACnC,IAAI,CAAC,YAAY,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,eAAe,CACvB,oDAAoD,CACrD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC;IACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,eAAe,CAAC,4BAA4B,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAe,EAAE,CAAC;AACnE,CAAC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAwB;IAExB,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,WAAW,CAC1B,OAAO,CAAC,gBAAgB,EACxB,CAAC,EACD,2BAA2B,CAC5B,CAAC;IACF,MAAM,SAAS,GAAG,WAAW,CAC3B,OAAO,CAAC,SAAS,EACjB,IAAI,EACJ,uBAAuB,CACxB,CAAC;IAEF,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,wDAAwD;IACxD,MAAM,UAAU,GAAG,IAAI,KAAK,CAAC;QAC3B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE;KAChD,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,wBAAwB,CAAC,CAAC,EACrE,SAAS,CACV,CAAC;IACF,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpE,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,YAAY,EAAE,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,UAAU;YACV,OAAO,EAAE;gBACP,YAAY,EAAE,iCAAiC;gBAC/C,GAAG,OAAO,CAAC,OAAO;aACnB;YACD,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CACvB,0EAA0E,CAC3E,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,MAAM,EAAE,CAAC;YACX,SAAS,CAAC;gBACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI;oBAAE,MAAM;gBAChB,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC;gBAC7B,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;oBACxB,SAAS,GAAG,IAAI,CAAC;oBACjB,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAAC;oBACtD,IAAI,IAAI,GAAG,CAAC;wBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;oBACnD,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;oBACtB,MAAM;gBACR,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACtC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO;YACP,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACjD,SAAS;SACV,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC3D,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC"}

package/backend/dist/utils/totp.d.ts

@@ -0,0 +1,19 @@
+export declare const TOTP_STEP_SECONDS = 30;
+export declare const TOTP_DIGITS = 6;
+/** Accept the previous/next step to absorb clock skew. */
+export declare const TOTP_SKEW_STEPS = 1;
+export declare const encodeBase32: (bytes: Buffer) => string;
+export declare const decodeBase32: (encoded: string) => Buffer;
+/** Generate a new 160-bit shared secret, base32-encoded for authenticator apps. */
+export declare const generateTotpSecret: () => string;
+/** The otpauth:// provisioning URI understood by authenticator apps. */
+export declare const buildOtpauthUrl: (secret: string, accountName: string, issuer: string) => string;
+export declare const totpCodeForStep: (secret: string, step: number) => string;
+export declare const currentTotpStep: (nowMs?: number) => number;
+/**
+ * Verify a submitted code within the skew window. Returns the matched
+ * timestep so the caller can persist it and refuse replays; null when the
+ * code does not match any step in the window.
+ */
+export declare const verifyTotpCode: (secret: string, submitted: string, nowMs?: number) => number | null;
+//# sourceMappingURL=totp.d.ts.map

package/backend/dist/utils/totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../src/utils/totp.ts"],"names":[],"mappings":"AA2BA,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,eAAO,MAAM,WAAW,IAAI,CAAC;AAC7B,0DAA0D;AAC1D,eAAO,MAAM,eAAe,IAAI,CAAC;AAEjC,eAAO,MAAM,YAAY,UAAW,MAAM,KAAG,MAgB5C,CAAC;AAEF,eAAO,MAAM,YAAY,YAAa,MAAM,KAAG,MAkB9C,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,kBAAkB,QAAO,MAAuC,CAAC;AAE9E,wEAAwE;AACxE,eAAO,MAAM,eAAe,WAClB,MAAM,eACD,MAAM,UACX,MAAM,KACb,MAUF,CAAC;AAEF,eAAO,MAAM,eAAe,WAAY,MAAM,QAAQ,MAAM,KAAG,MAY9D,CAAC;AAEF,eAAO,MAAM,eAAe,sBAAyB,MACP,CAAC;AAW/C;;;;GAIG;AACH,eAAO,MAAM,cAAc,WACjB,MAAM,aACH,MAAM,qBAEhB,MAAM,GAAG,IAYX,CAAC"}

package/backend/dist/utils/totp.js

@@ -0,0 +1,117 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * RFC 6238 TOTP over RFC 4226 HOTP, implemented directly on node:crypto.
+ * Authenticator apps expect HMAC-SHA1, 30-second steps, and 6 digits; those
+ * are protocol constants here, not options.
+ */
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+const BASE32_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+export const TOTP_STEP_SECONDS = 30;
+export const TOTP_DIGITS = 6;
+/** Accept the previous/next step to absorb clock skew. */
+export const TOTP_SKEW_STEPS = 1;
+export const encodeBase32 = (bytes) => {
+    let bits = 0;
+    let value = 0;
+    let output = '';
+    for (const byte of bytes) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            output += BASE32_ALPHABET[(value >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+    }
+    if (bits > 0) {
+        output += BASE32_ALPHABET[(value << (5 - bits)) & 31];
+    }
+    return output;
+};
+export const decodeBase32 = (encoded) => {
+    const normalized = encoded.toUpperCase().replace(/[\s=-]/g, '');
+    let bits = 0;
+    let value = 0;
+    const bytes = [];
+    for (const character of normalized) {
+        const index = BASE32_ALPHABET.indexOf(character);
+        if (index === -1) {
+            throw new Error('Invalid base32 character');
+        }
+        value = (value << 5) | index;
+        bits += 5;
+        if (bits >= 8) {
+            bytes.push((value >>> (bits - 8)) & 0xff);
+            bits -= 8;
+        }
+    }
+    return Buffer.from(bytes);
+};
+/** Generate a new 160-bit shared secret, base32-encoded for authenticator apps. */
+export const generateTotpSecret = () => encodeBase32(randomBytes(20));
+/** The otpauth:// provisioning URI understood by authenticator apps. */
+export const buildOtpauthUrl = (secret, accountName, issuer) => {
+    const label = `${encodeURIComponent(issuer)}:${encodeURIComponent(accountName)}`;
+    const query = new URLSearchParams({
+        secret,
+        issuer,
+        algorithm: 'SHA1',
+        digits: String(TOTP_DIGITS),
+        period: String(TOTP_STEP_SECONDS),
+    });
+    return `otpauth://totp/${label}?${query.toString()}`;
+};
+export const totpCodeForStep = (secret, step) => {
+    const key = decodeBase32(secret);
+    const counter = Buffer.alloc(8);
+    counter.writeBigUInt64BE(BigInt(step));
+    const digest = createHmac('sha1', key).update(counter).digest();
+    const offset = digest[digest.length - 1] & 0x0f;
+    const binary = ((digest[offset] & 0x7f) << 24) |
+        (digest[offset + 1] << 16) |
+        (digest[offset + 2] << 8) |
+        digest[offset + 3];
+    return String(binary % 10 ** TOTP_DIGITS).padStart(TOTP_DIGITS, '0');
+};
+export const currentTotpStep = (nowMs = Date.now()) => Math.floor(nowMs / 1000 / TOTP_STEP_SECONDS);
+const codesEqual = (left, right) => {
+    const leftBuffer = Buffer.from(left, 'utf8');
+    const rightBuffer = Buffer.from(right, 'utf8');
+    return (leftBuffer.length === rightBuffer.length &&
+        timingSafeEqual(leftBuffer, rightBuffer));
+};
+/**
+ * Verify a submitted code within the skew window. Returns the matched
+ * timestep so the caller can persist it and refuse replays; null when the
+ * code does not match any step in the window.
+ */
+export const verifyTotpCode = (secret, submitted, nowMs = Date.now()) => {
+    const normalized = submitted.replace(/\s/g, '');
+    if (!/^\d{6}$/.test(normalized))
+        return null;
+    const current = currentTotpStep(nowMs);
+    for (let offset = -TOTP_SKEW_STEPS; offset <= TOTP_SKEW_STEPS; offset++) {
+        const step = current + offset;
+        if (step < 0)
+            continue;
+        if (codesEqual(totpCodeForStep(secret, step), normalized)) {
+            return step;
+        }
+    }
+    return null;
+};
+//# sourceMappingURL=totp.js.map

package/backend/dist/utils/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../src/utils/totp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAE3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC;AAC7B,0DAA0D;AAC1D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AAEjC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAa,EAAU,EAAE;IACpD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC5B,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YACvD,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAU,EAAE;IACtD,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAChE,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;QAC7B,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1C,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC,CAAC;AAEF,mFAAmF;AACnF,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAW,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AAE9E,wEAAwE;AACxE,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,MAAc,EACd,WAAmB,EACnB,MAAc,EACN,EAAE;IACV,MAAM,KAAK,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;IACjF,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;QAChC,MAAM;QACN,MAAM;QACN,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC;QAC3B,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC;KAClC,CAAC,CAAC;IACH,OAAO,kBAAkB,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;AACvD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE;IACtE,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;IAChD,MAAM,MAAM,GACV,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrB,OAAO,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AACvE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EAAU,EAAE,CAC5D,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,GAAG,iBAAiB,CAAC,CAAC;AAE/C,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,KAAa,EAAW,EAAE;IAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,OAAO,CACL,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QACxC,eAAe,CAAC,UAAU,EAAE,WAAW,CAAC,CACzC,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,MAAc,EACd,SAAiB,EACjB,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EACH,EAAE;IACjB,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACvC,KAAK,IAAI,MAAM,GAAG,CAAC,eAAe,EAAE,MAAM,IAAI,eAAe,EAAE,MAAM,EAAE,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,OAAO,GAAG,MAAM,CAAC;QAC9B,IAAI,IAAI,GAAG,CAAC;YAAE,SAAS;QACvB,IAAI,UAAU,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}

package/backend/dist/utils/webauthn.d.ts

@@ -0,0 +1,43 @@
+export declare class WebAuthnError extends Error {
+}
+type CborValue = number | string | Buffer | CborValue[] | Map<number | string, CborValue> | boolean | null;
+/** Decode one CBOR item and report how many bytes it consumed. */
+export declare const decodeCbor: (buffer: Buffer) => {
+    value: CborValue;
+    bytesRead: number;
+};
+export interface ParsedAuthenticatorData {
+    rpIdHash: Buffer;
+    userPresent: boolean;
+    userVerified: boolean;
+    signCount: number;
+    credentialId: Buffer | null;
+    /** COSE public key map, present only with attested credential data. */
+    publicKey: Map<number | string, CborValue> | null;
+}
+export declare const parseAuthenticatorData: (authData: Buffer) => ParsedAuthenticatorData;
+export interface StoredPublicKey {
+    /** COSE algorithm: -7 = ES256, -8 = EdDSA (Ed25519). */
+    alg: number;
+    /** base64url key parameters. */
+    x: string;
+    y?: string;
+}
+/** Extract the supported key material from a COSE public-key map. */
+export declare const extractPublicKey: (cose: Map<number | string, CborValue>) => StoredPublicKey;
+/** Verify a WebAuthn assertion signature over authData || sha256(clientData). */
+export declare const verifyAssertionSignature: (stored: StoredPublicKey, authData: Buffer, clientDataJson: Buffer, signature: Buffer) => boolean;
+export interface ParsedClientData {
+    type: string;
+    challenge: string;
+    origin: string;
+}
+export declare const parseClientDataJson: (clientDataJson: Buffer) => ParsedClientData;
+/** The registrable-domain rule: the origin's hostname must equal the RP id
+ * or be a subdomain of it. */
+export declare const originMatchesRpId: (origin: string, rpId: string) => boolean;
+/** Parse an attestation object far enough to reach authData ('none' policy). */
+export declare const parseAttestationObject: (attestationObject: Buffer) => Buffer;
+export declare const sha256: (input: string | Buffer) => Buffer;
+export {};
+//# sourceMappingURL=webauthn.d.ts.map

package/backend/dist/utils/webauthn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../../src/utils/webauthn.ts"],"names":[],"mappings":"AAkCA,qBAAa,aAAc,SAAQ,KAAK;CAAG;AAI3C,KAAK,SAAS,GACV,MAAM,GACN,MAAM,GACN,MAAM,GACN,SAAS,EAAE,GACX,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,CAAC,GAC/B,OAAO,GACP,IAAI,CAAC;AAyGT,kEAAkE;AAClE,eAAO,MAAM,UAAU,WACb,MAAM,KACb;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAA4B,CAAC;AAIrE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,uEAAuE;IACvE,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC;CACnD;AAED,eAAO,MAAM,sBAAsB,aACvB,MAAM,KACf,uBAuCF,CAAC;AAIF,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ,gCAAgC;IAChC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,CAAC,EAAE,MAAM,CAAC;CACZ;AASD,qEAAqE;AACrE,eAAO,MAAM,gBAAgB,SACrB,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,CAAC,KACpC,eA6BF,CAAC;AAkBF,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,WAC3B,eAAe,YACb,MAAM,kBACA,MAAM,aACX,MAAM,KAChB,OAmBF,CAAC;AAIF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,mBAAmB,mBACd,MAAM,KACrB,gBAoBF,CAAC;AAEF;8BAC8B;AAC9B,eAAO,MAAM,iBAAiB,WAAY,MAAM,QAAQ,MAAM,KAAG,OAQhE,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,sBAAsB,sBAAuB,MAAM,KAAG,MAUlE,CAAC;AAEF,eAAO,MAAM,MAAM,UAAW,MAAM,GAAG,MAAM,KAAG,MACH,CAAC"}