locadot 2.0.0 → 2.1.0-beta.1

package/dist/dashboard/api.js

@@ -38,8 +38,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ApiError = void 0;
 exports.assertTrusted = assertTrusted;
+exports.readJson = readJson;
 exports.route = route;
 const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
 const constants_1 = __importDefault(require("../constants"));
 const hosts_1 = __importStar(require("../lib/hosts"));
 const localhost_1 = require("../lib/localhost");
@@ -51,6 +55,10 @@ const logger_1 = __importDefault(require("../utils/logger"));
 const system_1 = require("../lib/system");
 const tunnel_1 = require("../proxy/tunnel");
 const urls_1 = require("../lib/urls");
+const links_1 = __importStar(require("../lib/links"));
+const hub_config_1 = __importDefault(require("../lib/hub-config"));
+const remotes_1 = __importStar(require("../lib/remotes"));
+const ui_auth_1 = __importDefault(require("../lib/ui-auth"));
 const MAX_BODY = 64 * 1024;
 class ApiError extends Error {
     constructor(status, message, hint) {
@@ -149,6 +157,163 @@ const privileged = async (action, command) => {
     }
 };
 const hostUrl = (host, ctx) => (0, urls_1.formatUrl)(host, true, ctx.proxyInfo.httpsPort);
+const ROLES = ["viewer", "editor", "admin"];
+const isRole = (value) => typeof value === "string" && ROLES.includes(value);
+const optionalString = (value, name) => {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string")
+        throw new ApiError(400, `\`${name}\` must be a string.`);
+    return value;
+};
+const optionalHosts = (value) => {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || !value.every((v) => typeof v === "string")) {
+        throw new ApiError(400, "`hosts` must be an array of strings.");
+    }
+    return value;
+};
+/** Public hostname a Cloudflare named tunnel can route to (not *.localhost, no scheme/path). */
+const isValidPublicDomain = (value) => {
+    if (typeof value !== "string")
+        return false;
+    const host = value.trim().toLowerCase();
+    if (!host || host.length > 253 || host.includes("/") || host.includes(":"))
+        return false;
+    const labels = host.split(".");
+    if (labels.length < 2 || labels[labels.length - 1] === "localhost")
+        return false;
+    return labels.every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label));
+};
+const sanitizeInvite = (invite) => ({
+    id: invite.id,
+    role: invite.role,
+    hosts: invite.hosts,
+    expiresAt: invite.expiresAt,
+});
+const sanitizePeer = (peer) => ({
+    id: peer.id,
+    name: peer.name,
+    role: peer.role,
+    hosts: peer.hosts,
+    createdAt: peer.createdAt,
+    lastSeen: peer.lastSeen,
+});
+const sanitizeRemote = (remote) => {
+    const { token, ...rest } = remote;
+    return rest;
+};
+/** Reads CONFIG_FILE as-is (whatever `locadot start --port/--https-port` last wrote), tolerating a missing/corrupt file. */
+function readConfig() {
+    try {
+        const raw = JSON.parse(fs_1.default.readFileSync(constants_1.default.paths.CONFIG_FILE, "utf8"));
+        return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+    }
+    catch {
+        return {};
+    }
+}
+const savedPorts = () => {
+    const config = readConfig();
+    return {
+        httpPort: constants_1.default.validPort(config.httpPort),
+        httpsPort: constants_1.default.validPort(config.httpsPort),
+    };
+};
+/** Settings response: what the running proxy uses, what's saved/env-overridden, and whether they've drifted apart. */
+function buildSettingsBody(ctx, warning) {
+    const saved = savedPorts();
+    const env = {
+        httpPort: constants_1.default.userEnvPort("LOCADOT_HTTP_PORT") !== undefined,
+        httpsPort: constants_1.default.userEnvPort("LOCADOT_HTTPS_PORT") !== undefined,
+        bind: Boolean(process.env.LOCADOT_BIND),
+    };
+    const nextHttpPort = constants_1.default.userEnvPort("LOCADOT_HTTP_PORT") ?? saved.httpPort ?? 80;
+    const nextHttpsPort = constants_1.default.userEnvPort("LOCADOT_HTTPS_PORT") ?? saved.httpsPort ?? 443;
+    const restartRequired = nextHttpPort !== ctx.proxyInfo.httpPort || nextHttpsPort !== ctx.proxyInfo.httpsPort;
+    return {
+        httpPort: ctx.proxyInfo.httpPort,
+        httpsPort: ctx.proxyInfo.httpsPort,
+        bind: ctx.proxyInfo.bind,
+        logLevel: logger_1.default.level,
+        stateDir: ctx.proxyInfo.stateDir,
+        saved,
+        env,
+        restartRequired,
+        uiAuth: { enabled: ui_auth_1.default.enabled(), updatedAt: ui_auth_1.default.read()?.updatedAt },
+        ...(warning ? { warning } : {}),
+    };
+}
+const validPortInput = (value, name) => {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > 65535) {
+        throw new ApiError(400, `\`${name}\` must be an integer between 1 and 65535.`);
+    }
+    return value;
+};
+/** Compiled layout: dist/dashboard/api.js -> dist/index.js. Under tsx (src/dashboard) the compiled dist/index.js is still what gets spawned. */
+function resolveCliPath() {
+    const compiled = path_1.default.join(__dirname, "..", "index.js");
+    const fromSource = path_1.default.join(__dirname, "..", "..", "dist", "index.js");
+    return __filename.endsWith(".ts") ? fromSource : compiled;
+}
+const REMOTE_SYNC_TIMEOUT_MS = 5000;
+async function buildRemoteRows(ctx) {
+    const remotes = remotes_1.default.list();
+    let changed = false;
+    const rows = await Promise.all(remotes.map(async (remote) => {
+        try {
+            const timeout = new Promise((_, reject) => setTimeout(() => reject(new Error("timed out")), REMOTE_SYNC_TIMEOUT_MS));
+            const result = await Promise.race([remotes_1.default.sync(remote.name), timeout]);
+            changed = true;
+            return {
+                name: result.remote.name,
+                url: result.remote.url,
+                role: result.remote.role,
+                hosts: result.remote.hosts,
+                sender: result.remote.sender,
+                connectedAt: result.remote.connectedAt,
+                domain: result.remote.domain,
+                localhost: result.remote.localhost,
+                status: "ok",
+                available: result.hosts,
+                mapped: result.mapped,
+            };
+        }
+        catch (error) {
+            return {
+                name: remote.name,
+                url: remote.url,
+                role: remote.role,
+                hosts: remote.hosts,
+                sender: remote.sender,
+                connectedAt: remote.connectedAt,
+                domain: remote.domain,
+                localhost: remote.localhost,
+                status: "error",
+                error: clean(String(error?.message || error)),
+                available: null,
+                mapped: [],
+            };
+        }
+    }));
+    if (changed)
+        ctx.reload();
+    return rows;
+}
+function buildHubBody(ctx) {
+    const config = hub_config_1.default.read();
+    const { invites, peers } = links_1.default.list();
+    return {
+        hub: ctx.hub(),
+        config: config ?? null,
+        localhost: config?.localhost !== false,
+        invites: invites.map(sanitizeInvite),
+        peers: peers.map(sanitizePeer),
+    };
+}
 /** Routes under /api/ other than the read-only status/hosts. Returns undefined when nothing matched. */
 async function route(req, url, ctx) {
     const method = req.method || "GET";
@@ -157,15 +322,64 @@ async function route(req, url, ctx) {
         const lines = Math.min(Math.max(Number(url.searchParams.get("lines")) || 200, 1), 2000);
         return { status: 200, body: { lines: file_1.default.lastLines("LOGS", lines) } };
     }
+    if (path === "/api/hub" && (method === "GET" || method === "HEAD")) {
+        return { status: 200, body: buildHubBody(ctx) };
+    }
+    if (path === "/api/remotes" && (method === "GET" || method === "HEAD")) {
+        return { status: 200, body: { remotes: await buildRemoteRows(ctx) } };
+    }
+    if (path === "/api/settings" && (method === "GET" || method === "HEAD")) {
+        return { status: 200, body: buildSettingsBody(ctx) };
+    }
     const hostMatch = /^\/api\/hosts\/([^/]+)$/.exec(path);
+    const inviteMatch = /^\/api\/invites\/([^/]+)$/.exec(path);
+    const peerMatch = /^\/api\/peers\/([^/]+)$/.exec(path);
+    const remoteMatch = /^\/api\/remotes\/([^/]+)$/.exec(path);
+    const remoteSyncMatch = /^\/api\/remotes\/([^/]+)\/sync$/.exec(path);
+    const remoteAliasMatch = /^\/api\/remotes\/([^/]+)\/aliases$/.exec(path);
+    const remoteHostsMatch = /^\/api\/remotes\/([^/]+)\/hosts$/.exec(path);
+    const remoteHostMatch = /^\/api\/remotes\/([^/]+)\/hosts\/([^/]+)$/.exec(path);
     const known = (path === "/api/hosts" && method === "POST") ||
         (hostMatch && (method === "PUT" || method === "DELETE")) ||
-        (["/api/startup", "/api/trust", "/api/logs/clear", "/api/proxy/stop", "/api/cloudflared/install"].includes(path) && method === "POST");
+        (["/api/startup", "/api/trust", "/api/logs/clear", "/api/proxy/stop", "/api/proxy/restart", "/api/cloudflared/install", "/api/hub", "/api/invites", "/api/remotes"].includes(path) &&
+            method === "POST") ||
+        (path === "/api/hub/localhost" && method === "PUT") ||
+        (path === "/api/settings" && method === "PUT") ||
+        (inviteMatch && method === "DELETE") ||
+        (peerMatch && (method === "PUT" || method === "DELETE")) ||
+        (remoteMatch && (method === "PUT" || method === "DELETE")) ||
+        (remoteSyncMatch && method === "POST") ||
+        (remoteAliasMatch && method === "POST") ||
+        (remoteHostsMatch && method === "POST") ||
+        (remoteHostMatch && (method === "PUT" || method === "DELETE"));
     if (!known)
         return undefined;
     assertTrusted(req, ctx);
     const body = await readJson(req);
     try {
+        if (path === "/api/settings" && method === "PUT") {
+            const newHttp = validPortInput(body.httpPort, "httpPort");
+            const newHttps = validPortInput(body.httpsPort, "httpsPort");
+            if (newHttp === undefined && newHttps === undefined)
+                throw new ApiError(400, "Provide `httpPort` and/or `httpsPort`.");
+            const config = readConfig();
+            const saved = savedPorts();
+            const finalHttp = newHttp ?? saved.httpPort ?? ctx.proxyInfo.httpPort;
+            const finalHttps = newHttps ?? saved.httpsPort ?? ctx.proxyInfo.httpsPort;
+            if (finalHttp === finalHttps)
+                throw new ApiError(400, "`httpPort` and `httpsPort` can't be the same.");
+            file_1.default.ensureDir();
+            fs_1.default.writeFileSync(constants_1.default.paths.CONFIG_FILE, JSON.stringify({ ...config, httpPort: finalHttp, httpsPort: finalHttps }, null, 2) + "\n");
+            logger_1.default.info(`⚙️ dashboard: settings saved → http ${finalHttp}, https ${finalHttps}`);
+            const warnings = [];
+            if (newHttp !== undefined && constants_1.default.userEnvPort("LOCADOT_HTTP_PORT") !== undefined) {
+                warnings.push("LOCADOT_HTTP_PORT is set and overrides this");
+            }
+            if (newHttps !== undefined && constants_1.default.userEnvPort("LOCADOT_HTTPS_PORT") !== undefined) {
+                warnings.push("LOCADOT_HTTPS_PORT is set and overrides this");
+            }
+            return { status: 200, body: buildSettingsBody(ctx, warnings.length ? warnings.join("; ") : undefined) };
+        }
         if (path === "/api/hosts") {
             const { host, entry } = await hosts_1.default.add({ host: body.host, target: body.target, insecure: optionalBool(body.insecure, "insecure"), cors: optionalBool(body.cors, "cors") });
             ctx.reload();
@@ -196,6 +410,150 @@ async function route(req, url, ctx) {
             const { host: name, entry } = updated;
             return { status: 200, body: { ok: true, host: name, ...entry, url: hostUrl(name, ctx), tunnel: ctx.tunnel(name) } };
         }
+        if (path === "/api/hub" && method === "POST") {
+            const mode = body.mode;
+            if (mode === "named") {
+                if (!isValidPublicDomain(body.domain))
+                    throw new ApiError(400, "`domain` must be a valid public hostname.");
+                const tunnel = body.tunnel === undefined ? undefined : String(body.tunnel);
+                ctx.setupNamedHub(String(body.domain).trim().toLowerCase(), tunnel);
+            }
+            else if (mode === "quick") {
+                hub_config_1.default.write({ mode: "quick" });
+                ctx.reloadHub();
+            }
+            else if (mode === "manual") {
+                if (typeof body.url !== "string" || !body.url.trim())
+                    throw new ApiError(400, "`url` is required for manual mode.");
+                let parsed;
+                try {
+                    parsed = new URL(body.url.trim());
+                }
+                catch {
+                    throw new ApiError(400, "`url` must be a valid http(s) URL.");
+                }
+                if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+                    throw new ApiError(400, "`url` must be http or https.");
+                const config = { mode: "manual", url: body.url.trim().replace(/\/+$/, "") };
+                hub_config_1.default.write(config);
+                ctx.reloadHub();
+            }
+            else if (mode === "off") {
+                hub_config_1.default.clear();
+                ctx.reloadHub();
+            }
+            else {
+                throw new ApiError(400, "`mode` must be one of named, quick, manual, off.");
+            }
+            return { status: 200, body: { hub: ctx.hub() } };
+        }
+        if (path === "/api/hub/localhost" && method === "PUT") {
+            const enabled = requiredBool(body.enabled, "enabled");
+            const config = hub_config_1.default.read();
+            if (!config)
+                throw new ApiError(400, "The hub isn't configured yet. Set it up first: locadot hub:setup / hub:quick / hub:manual.");
+            hub_config_1.default.write({ ...config, localhost: enabled });
+            ctx.reloadHub();
+            return { status: 200, body: { localhost: enabled } };
+        }
+        if (path === "/api/invites" && method === "POST") {
+            if (!isRole(body.role))
+                throw new ApiError(400, "`role` must be viewer, editor or admin.");
+            const hosts = optionalHosts(body.hosts);
+            if (ctx.hub().status !== "up") {
+                throw new ApiError(409, "The hub isn't up. Start sharing first.", "locadot hub:quick");
+            }
+            const { invite, code } = links_1.default.createInvite({ role: body.role, hosts });
+            const string = links_1.default.inviteString(ctx.hub().url, code);
+            return { status: 200, body: { id: invite.id, code, string, role: invite.role, hosts: invite.hosts, expiresAt: invite.expiresAt } };
+        }
+        if (inviteMatch && method === "DELETE") {
+            links_1.default.revokeInvite(decodeURIComponent(inviteMatch[1]));
+            return { status: 200, body: { ok: true } };
+        }
+        if (peerMatch && method === "PUT") {
+            const id = decodeURIComponent(peerMatch[1]);
+            if (!isRole(body.role))
+                throw new ApiError(400, "`role` must be viewer, editor or admin.");
+            const hosts = optionalHosts(body.hosts);
+            const peer = links_1.default.setRole(id, body.role, hosts);
+            return { status: 200, body: { peer: sanitizePeer(peer) } };
+        }
+        if (peerMatch && method === "DELETE") {
+            links_1.default.revoke(decodeURIComponent(peerMatch[1]));
+            return { status: 200, body: { ok: true } };
+        }
+        if (path === "/api/remotes" && method === "POST") {
+            if (typeof body.string !== "string" || !body.string.trim())
+                throw new ApiError(400, "`string` is required.");
+            const name = typeof body.name === "string" && body.name.trim() ? body.name.trim() : undefined;
+            const domain = optionalString(body.domain, "domain");
+            const result = await remotes_1.default.connect(body.string.trim(), { name, domain });
+            ctx.reload();
+            return { status: 200, body: { ...result, remote: sanitizeRemote(result.remote) } };
+        }
+        if (remoteMatch && method === "PUT" && "domain" in body) {
+            const domain = body.domain;
+            if (domain !== null && domain !== "random" && typeof domain !== "string") {
+                throw new ApiError(400, '`domain` must be a string, "random" or null.');
+            }
+            const remote = remotes_1.default.setDomain(decodeURIComponent(remoteMatch[1]), domain);
+            ctx.reload();
+            return { status: 200, body: { remote: sanitizeRemote(remote) } };
+        }
+        if (remoteMatch && method === "PUT") {
+            if (typeof body.url !== "string" || !body.url.trim())
+                throw new ApiError(400, "`url` is required.");
+            remotes_1.default.setUrl(decodeURIComponent(remoteMatch[1]), body.url.trim());
+            return { status: 200, body: { ok: true } };
+        }
+        if (remoteMatch && method === "DELETE") {
+            await remotes_1.default.disconnect(decodeURIComponent(remoteMatch[1]));
+            ctx.reload();
+            return { status: 200, body: { ok: true } };
+        }
+        if (remoteSyncMatch && method === "POST") {
+            const result = await remotes_1.default.sync(decodeURIComponent(remoteSyncMatch[1]));
+            ctx.reload();
+            return { status: 200, body: { ...result, remote: sanitizeRemote(result.remote) } };
+        }
+        if (remoteAliasMatch && method === "POST") {
+            if (typeof body.host !== "string" || typeof body.local !== "string") {
+                throw new ApiError(400, "`host` and `local` are required.");
+            }
+            await remotes_1.default.alias(decodeURIComponent(remoteAliasMatch[1]), body.host, body.local);
+            ctx.reload();
+            return { status: 200, body: { ok: true } };
+        }
+        if (remoteHostsMatch && method === "POST") {
+            if (typeof body.host !== "string" || typeof body.target !== "string") {
+                throw new ApiError(400, "`host` and `target` are required.");
+            }
+            const host = await remotes_1.default.addHost(decodeURIComponent(remoteHostsMatch[1]), {
+                host: body.host,
+                target: body.target,
+                insecure: optionalBool(body.insecure, "insecure"),
+                cors: optionalBool(body.cors, "cors"),
+            });
+            ctx.reload();
+            return { status: 201, body: { host } };
+        }
+        if (remoteHostMatch) {
+            const name = decodeURIComponent(remoteHostMatch[1]);
+            const hostName = decodeURIComponent(remoteHostMatch[2]);
+            if (method === "DELETE") {
+                await remotes_1.default.removeHost(name, hostName);
+                ctx.reload();
+                return { status: 200, body: { ok: true } };
+            }
+            const host = await remotes_1.default.updateHost(name, hostName, {
+                target: optionalString(body.target, "target"),
+                insecure: optionalBool(body.insecure, "insecure"),
+                cors: optionalBool(body.cors, "cors"),
+                tunnel: optionalBool(body.tunnel, "tunnel"),
+            });
+            return { status: 200, body: { host } };
+        }
     }
     catch (error) {
         if (error instanceof hosts_1.NotFoundError)
@@ -206,6 +564,12 @@ async function route(req, url, ctx) {
             throw new ApiError(400, clean(error.message));
         if (error instanceof registry_1.RegistryError)
             throw new ApiError(500, clean(error.message));
+        if (error instanceof links_1.LinkError)
+            throw new ApiError(error.status, clean(error.message));
+        if (error instanceof remotes_1.RemoteError)
+            throw new ApiError(error.status || 502, clean(error.message));
+        if (error instanceof ApiError)
+            throw error;
         throw error;
     }
     switch (path) {
@@ -239,6 +603,22 @@ async function route(req, url, ctx) {
         case "/api/proxy/stop":
             setTimeout(() => ctx.shutdown("dashboard stop"), 100);
             return { status: 200, body: { ok: true, hint: "locadot start" } };
+        case "/api/proxy/restart": {
+            const cli = resolveCliPath();
+            if (!fs_1.default.existsSync(cli)) {
+                throw new ApiError(500, `❌ ${cli} not found. Run \`pnpm build\` first.`, "locadot restart");
+            }
+            // Drop the CLI's pinned port copies so the child re-reads CONFIG_FILE; keep genuine user overrides.
+            const restartEnv = { ...process.env };
+            delete restartEnv.LOCADOT_USER_PORTS;
+            for (const name of ["LOCADOT_HTTP_PORT", "LOCADOT_HTTPS_PORT"]) {
+                if (constants_1.default.userEnvPort(name) === undefined)
+                    delete restartEnv[name];
+            }
+            (0, child_process_1.spawn)(process.execPath, [cli, "restart"], { detached: true, stdio: "ignore", env: restartEnv, windowsHide: true }).unref();
+            logger_1.default.info("🔁 dashboard: restarting proxy");
+            return { status: 200, body: { ok: true, hint: "locadot restart" } };
+        }
     }
     return undefined;
 }

package/dist/dashboard/index.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -7,9 +40,23 @@ exports.handleDashboardRequest = handleDashboardRequest;
 const crypto_1 = __importDefault(require("crypto"));
 const page_1 = require("./page");
 const api_1 = require("./api");
+const login_1 = require("./login");
+const ui_auth_1 = __importStar(require("../lib/ui-auth"));
 const system_1 = require("../lib/system");
 const tunnel_1 = require("../proxy/tunnel");
 const urls_1 = require("../lib/urls");
+const localhost_1 = __importDefault(require("../lib/localhost"));
+const remote_1 = require("../proxy/remote");
+const remotes_1 = __importDefault(require("../lib/remotes"));
+/** A remote mapping is only reachable through its sender, with the peer's credentials. */
+function probeEntry(ctx, entry) {
+    if (!entry.remote)
+        return ctx.probe(entry.target);
+    const remote = (0, remote_1.remoteFor)(entry.remote.name);
+    if (!remote)
+        return Promise.resolve({ up: false, error: "disconnected" });
+    return localhost_1.default.probe(remote.url, 3000, false, { "X-Locadot-Peer": remote.token, "X-Locadot-Host": entry.remote.host });
+}
 function hostUrls(host, httpPort, httpsPort) {
     return { https: (0, urls_1.formatUrl)(host, true, httpsPort), http: (0, urls_1.formatUrl)(host, false, httpPort) };
 }
@@ -37,7 +84,7 @@ async function buildHosts(ctx) {
     const { httpPort, httpsPort } = ctx.proxyInfo;
     const entries = Object.entries(registry.hosts);
     const rows = await Promise.all(entries.map(async ([host, entry]) => {
-        const probe = await ctx.probe(entry.target);
+        const probe = await probeEntry(ctx, entry);
         return {
             host,
             target: entry.target,
@@ -49,6 +96,9 @@ async function buildHosts(ctx) {
             stats: stats[host] ?? null,
             probe,
             tunnel: ctx.tunnel(host),
+            remote: entry.remote
+                ? { name: entry.remote.name, host: entry.remote.host, role: remotes_1.default.get(entry.remote.name)?.role ?? "viewer" }
+                : undefined,
         };
     }));
     return rows.sort((a, b) => a.host.localeCompare(b.host));
@@ -69,6 +119,12 @@ function handleDashboardRequest(req, res, ctx) {
             sendJson(res, method, 500, { error: String(error?.message || error) });
         }
     };
+    if ((0, login_1.gate)(req, res, url, ctx.token, nonce))
+        return;
+    if (url.pathname === "/api/settings/ui-password" && method === "PUT") {
+        uiPassword(req, res, ctx).catch(fail);
+        return;
+    }
     if (url.pathname.startsWith("/api/") && !(["/api/status", "/api/hosts"].includes(url.pathname) && (method === "GET" || method === "HEAD"))) {
         (0, api_1.route)(req, url, ctx)
             .then((result) => {
@@ -85,7 +141,7 @@ function handleDashboardRequest(req, res, ctx) {
     }
     switch (url.pathname) {
         case "/":
-            sendBody(res, method, 200, "text/html; charset=utf-8", (0, page_1.renderPage)(nonce, ctx.token));
+            sendBody(res, method, 200, "text/html; charset=utf-8", (0, page_1.renderPage)(nonce, ctx.token, ui_auth_1.default.enabled()));
             return;
         case "/favicon.ico":
             res.statusCode = 204;
@@ -97,7 +153,13 @@ function handleDashboardRequest(req, res, ctx) {
         case "/api/status": {
             const uptimeSec = Math.max(0, Math.round((Date.now() - new Date(ctx.proxyInfo.startedAt).getTime()) / 1000));
             (0, system_1.systemStatus)(ctx.proxyInfo.caTrusted)
-                .then((system) => sendJson(res, method, 200, { proxy: ctx.proxyInfo, uptimeSec, hosts: Object.keys(ctx.getRegistry().hosts).length, system: { ...system, cloudflared: (0, tunnel_1.cloudflaredInfo)() } }))
+                .then((system) => sendJson(res, method, 200, {
+                proxy: ctx.proxyInfo,
+                uptimeSec,
+                hosts: Object.keys(ctx.getRegistry().hosts).length,
+                system: { ...system, cloudflared: (0, tunnel_1.cloudflaredInfo)() },
+                hub: ctx.hub(),
+            }))
                 .catch(fail);
             return;
         }
@@ -110,3 +172,32 @@ function handleDashboardRequest(req, res, ctx) {
             sendJson(res, method, 404, { error: "not found" });
     }
 }
+/** Set, change or remove the dashboard password from the dashboard; once one is set, the current one is required. */
+async function uiPassword(req, res, ctx) {
+    (0, api_1.assertTrusted)(req, ctx);
+    const body = await (0, api_1.readJson)(req);
+    const ip = req.socket.remoteAddress || "";
+    if (ui_auth_1.default.enabled()) {
+        if (ui_auth_1.default.limited(ip))
+            throw new api_1.ApiError(429, "Too many wrong passwords. Wait a few minutes and try again.");
+        if (!ui_auth_1.default.verify(body.current)) {
+            ui_auth_1.default.fail(ip);
+            throw new api_1.ApiError(403, "The current password is wrong.", "Forgot it? Run `locadot ui:password` in a terminal.");
+        }
+        ui_auth_1.default.succeed(ip);
+    }
+    if (body.enabled === false) {
+        ui_auth_1.default.clear();
+        res.setHeader("Set-Cookie", `${ui_auth_1.SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0`);
+        sendJson(res, req.method || "PUT", 200, { uiAuth: { enabled: false } });
+        return;
+    }
+    try {
+        ui_auth_1.default.set(body.password);
+    }
+    catch (err) {
+        throw new api_1.ApiError(400, err.message);
+    }
+    res.setHeader("Set-Cookie", (0, login_1.sessionCookie)(req));
+    sendJson(res, req.method || "PUT", 200, { uiAuth: { enabled: true } });
+}