lobstakit-cloud 1.0.6 → 1.0.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lobstakit-cloud",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "description": "LobstaKit Cloud — Setup wizard and management for LobstaCloud gateways",
   "main": "server.js",
   "bin": {

package/server.js

@@ -301,18 +301,26 @@ app.post('/api/auth/change', (req, res) => {
 });
 
 // GET /api/provision — return provisioning data (email, subdomain, plan) if available
+// LOW-3: Only return setupToken to authenticated sessions
 app.get('/api/provision', (req, res) => {
   const provision = getProvisionData();
   if (provision) {
     const token = req.headers.authorization?.replace('Bearer ', '');
     const isAuthenticated = token && activeSessions.has(token);
-    res.json({
+    const lobstaConfig = getLobstaKitConfig();
+    const setupNotComplete = !lobstaConfig.passwordHash;
+    const response = {
       provisioned: true,
       email: isAuthenticated ? (provision.email || null) : maskEmail(provision.email || ''),
       subdomain: provision.subdomain || null,
       plan: provision.plan || null,
-      setupToken: provision.setupToken || null
-    });
+    };
+    // Return setupToken during initial setup (before password is set) OR to authenticated sessions
+    // This is safe because setupToken is only useful ONCE (to set the initial password)
+    if (provision.setupToken && (setupNotComplete || isAuthenticated)) {
+      response.setupToken = provision.setupToken;
+    }
+    res.json(response);
   } else {
     res.json({ provisioned: false });
   }