lobstakit-cloud 1.0.5 → 1.0.7

package/lib/config.js

@@ -114,7 +114,7 @@ function writeConfig({ apiKey, model, channel, telegramBotToken, telegramUserId,
     }
   };
 
-  fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), 'utf8');
+  fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), { encoding: 'utf8', mode: 0o600 });
   console.log('[config] Config written to', CONFIG_PATH);
   return config;
 }
@@ -126,7 +126,7 @@ function writeRawConfig(configObj) {
   if (!fs.existsSync(CONFIG_DIR)) {
     fs.mkdirSync(CONFIG_DIR, { recursive: true });
   }
-  fs.writeFileSync(CONFIG_PATH, JSON.stringify(configObj, null, 2), 'utf8');
+  fs.writeFileSync(CONFIG_PATH, JSON.stringify(configObj, null, 2), { encoding: 'utf8', mode: 0o600 });
   console.log('[config] Raw config written to', CONFIG_PATH);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lobstakit-cloud",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "description": "LobstaKit Cloud — Setup wizard and management for LobstaCloud gateways",
   "main": "server.js",
   "bin": {

package/server.js

@@ -301,18 +301,23 @@ app.post('/api/auth/change', (req, res) => {
 });
 
 // GET /api/provision — return provisioning data (email, subdomain, plan) if available
+// LOW-3: Only return setupToken to authenticated sessions
 app.get('/api/provision', (req, res) => {
   const provision = getProvisionData();
   if (provision) {
     const token = req.headers.authorization?.replace('Bearer ', '');
     const isAuthenticated = token && activeSessions.has(token);
-    res.json({
+    const response = {
       provisioned: true,
       email: isAuthenticated ? (provision.email || null) : maskEmail(provision.email || ''),
       subdomain: provision.subdomain || null,
       plan: provision.plan || null,
-      setupToken: provision.setupToken || null
-    });
+    };
+    // Only expose setupToken to authenticated sessions
+    if (isAuthenticated && provision.setupToken) {
+      response.setupToken = provision.setupToken;
+    }
+    res.json(response);
   } else {
     res.json({ provisioned: false });
   }