npm - neoagent - Versions diffs - 2.4.1-beta.45 → 2.4.1-beta.47 - Mend

neoagent 2.4.1-beta.45 → 2.4.1-beta.47

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (17) hide show

package/.env.example +12 -0
package/package.json +1 -1
package/server/admin/access.js +198 -0
package/server/admin/admin.js +2 -2
package/server/admin/analytics.js +128 -0
package/server/admin/index.html +484 -1
package/server/admin/login.html +171 -45
package/server/admin/sql.js +134 -0
package/server/admin/users.js +147 -0
package/server/db/database.js +19 -0
package/server/http/static.js +20 -6
package/server/middleware/adminAuth.js +37 -0
package/server/public/.last_build_id +1 -1
package/server/public/flutter_bootstrap.js +1 -1
package/server/public/main.dart.js +4 -4
package/server/routes/admin.js +316 -5
package/server/services/account/admin_two_factor.js +132 -0

package/server/admin/login.html CHANGED Viewed

@@ -4,6 +4,7 @@
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>NeoAgent Admin</title>
+  <link rel="icon" href="/admin/logo.svg" type="image/svg+xml">
   <link rel="stylesheet" href="/admin/admin.css">
   <style>
     body {
@@ -70,62 +71,148 @@
       font-size: 14px;
       margin-top: 4px;
     }
+    /* ── Admin hero mark ────────────────────────────── */
+    .admin-hero {
+      display: flex;
+      flex-direction: column;
+      align-items: center;
+      margin-bottom: 28px;
+      gap: 14px;
+    }
+    .admin-a-mark {
+      width: 80px;
+      height: 80px;
+      border-radius: 22px;
+      background: var(--bg-secondary);
+      border: 1px solid color-mix(in srgb, var(--accent) 30%, transparent);
+      box-shadow:
+        0 0 0 4px color-mix(in srgb, var(--accent) 8%, transparent),
+        0 12px 32px rgba(0,0,0,0.45);
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      font-size: 42px;
+      font-weight: 800;
+      color: var(--accent);
+      letter-spacing: -2px;
+      font-family: var(--font-sans);
+      line-height: 1;
+      user-select: none;
+    }
+    .admin-hero .brand {
+      margin-bottom: 0;
+      justify-content: center;
+    }
   </style>
 </head>
 <body>
   <div class="login-wrap">
     <div class="login-card">
-      <div class="brand">
-        <div class="brand-mark">
-          <img src="/admin/logo.svg" width="32" height="32" alt="">
-        </div>
-        <div>
-          <div class="brand-name">NeoAgent</div>
-          <div class="brand-sub">Admin</div>
+      <div class="admin-hero">
+        <div class="admin-a-mark" aria-hidden="true">A</div>
+        <div class="brand">
+          <div class="brand-mark">
+            <img src="/admin/logo.svg" width="32" height="32" alt="">
+          </div>
+          <div>
+            <div class="brand-name">NeoAgent</div>
+            <div class="brand-sub">Admin</div>
+          </div>
         </div>
       </div>
-      <h1 class="login-heading">Sign in</h1>
-      <p class="login-sub">
-        Credentials are in your <code>.env</code> or via <code>neoagent admin</code>
-      </p>
-      <div class="alert alert-error" id="error" role="alert"></div>
-      <form id="form" novalidate>
-        <div class="field">
-          <label for="username">Username</label>
-          <input
-            id="username"
-            type="text"
-            autocomplete="username"
-            autofocus
-            required
-            spellcheck="false"
-            autocorrect="off"
-            autocapitalize="none"
-          >
-        </div>
-        <div class="field">
-          <label for="password">Password</label>
-          <input
-            id="password"
-            type="password"
-            autocomplete="current-password"
-            required
-          >
+      <!-- Step 1: credentials -->
+      <div id="step-credentials">
+        <h1 class="login-heading">Sign in</h1>
+        <p class="login-sub">
+          Credentials are in your <code>.env</code> or via <code>neoagent admin</code>
+        </p>
+        <div class="alert alert-error" id="error" role="alert"></div>
+        <form id="form" novalidate>
+          <div class="field">
+            <label for="username">Username</label>
+            <input
+              id="username"
+              type="text"
+              autocomplete="username"
+              autofocus
+              required
+              spellcheck="false"
+              autocorrect="off"
+              autocapitalize="none"
+            >
+          </div>
+          <div class="field">
+            <label for="password">Password</label>
+            <input
+              id="password"
+              type="password"
+              autocomplete="current-password"
+              required
+            >
+          </div>
+          <button type="submit" class="btn btn-primary submit-btn" id="submit-btn">
+            Sign in
+          </button>
+        </form>
+      </div>
+      <!-- Step 2: 2FA code (shown after password is accepted) -->
+      <div id="step-totp" style="display:none;">
+        <h1 class="login-heading">Two-factor authentication</h1>
+        <p class="login-sub">Enter the 6-digit code from your authenticator app, or a recovery code.</p>
+        <div class="alert alert-error" id="totp-error" role="alert"></div>
+        <form id="totp-form" novalidate>
+          <div class="field">
+            <label for="totp-code">Authenticator code</label>
+            <input
+              id="totp-code"
+              type="text"
+              inputmode="numeric"
+              autocomplete="one-time-code"
+              maxlength="11"
+              placeholder="123 456"
+              spellcheck="false"
+              autocorrect="off"
+              autocapitalize="none"
+              required
+            >
+          </div>
+          <button type="submit" class="btn btn-primary submit-btn" id="totp-btn">
+            Verify
+          </button>
+        </form>
+        <div style="margin-top:14px;text-align:center;">
+          <button type="button" class="btn btn-ghost" style="font-size:12px;padding:4px 10px;"
+            onclick="backToCredentials()">← Back</button>
         </div>
-        <button type="submit" class="btn btn-primary submit-btn" id="submit-btn">
-          Sign in
-        </button>
-      </form>
+      </div>
     </div>
   </div>
   <script>
-    const form     = document.getElementById('form');
+    const form      = document.getElementById('form');
     const submitBtn = document.getElementById('submit-btn');
-    const errorEl  = document.getElementById('error');
+    const errorEl   = document.getElementById('error');
+    const totpForm  = document.getElementById('totp-form');
+    const totpBtn   = document.getElementById('totp-btn');
+    const totpError = document.getElementById('totp-error');
+    function showStep(step) {
+      document.getElementById('step-credentials').style.display = step === 1 ? '' : 'none';
+      document.getElementById('step-totp').style.display        = step === 2 ? '' : 'none';
+      if (step === 2) setTimeout(() => document.getElementById('totp-code')?.focus(), 50);
+      if (step === 1) setTimeout(() => document.getElementById('username')?.focus(), 50);
+    }
+    function backToCredentials() { showStep(1); }
     form.addEventListener('submit', async (e) => {
       e.preventDefault();
@@ -143,12 +230,18 @@
           }),
         });
-        if (res.ok) {
-          window.location.replace('/admin');
+        const body = await res.json().catch(() => ({}));
+        if (res.ok || body.requiresTwoFactor) {
+          if (body.requiresTwoFactor) {
+            // Password accepted — go to 2FA step
+            showStep(2);
+          } else {
+            window.location.replace('/admin');
+          }
           return;
         }
-        const body = await res.json().catch(() => ({}));
         errorEl.textContent = body.error || 'Invalid credentials';
         errorEl.classList.add('visible');
       } catch {
@@ -159,6 +252,39 @@
         submitBtn.textContent = 'Sign in';
       }
     });
+    totpForm.addEventListener('submit', async (e) => {
+      e.preventDefault();
+      totpError.classList.remove('visible');
+      totpBtn.disabled = true;
+      totpBtn.textContent = 'Verifying…';
+      try {
+        const code = document.getElementById('totp-code').value.trim();
+        const res = await fetch('/admin/api/2fa/verify', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ code }),
+        });
+        if (res.ok) {
+          window.location.replace('/admin');
+          return;
+        }
+        const body = await res.json().catch(() => ({}));
+        totpError.textContent = body.error || 'Invalid code';
+        totpError.classList.add('visible');
+        document.getElementById('totp-code').value = '';
+        document.getElementById('totp-code').focus();
+      } catch {
+        totpError.textContent = 'Network error';
+        totpError.classList.add('visible');
+      } finally {
+        totpBtn.disabled = false;
+        totpBtn.textContent = 'Verify';
+      }
+    });
   </script>
 </body>
 </html>

package/server/admin/sql.js ADDED Viewed

@@ -0,0 +1,134 @@
+'use strict';
+// ── SQL Editor ─────────────────────────────────────────────────────────────
+const SQL_TEMPLATES = [
+  { label: '— Select a template —', query: '' },
+  { label: 'User summary',            query: `SELECT u.id, u.username, u.email,\n       u.created_at, u.last_login,\n       COUNT(DISTINCT r.id) AS runs,\n       COALESCE(SUM(r.total_tokens),0) AS tokens\nFROM users u\nLEFT JOIN agent_runs r ON r.user_id = u.id\nGROUP BY u.id\nORDER BY runs DESC\nLIMIT 50` },
+  { label: 'Recent failed runs',       query: `SELECT r.id, u.username, r.title, r.status,\n       r.error, r.created_at\nFROM agent_runs r\nJOIN users u ON u.id = r.user_id\nWHERE r.status = 'failed'\nORDER BY r.created_at DESC\nLIMIT 50` },
+  { label: 'Artifact storage by user', query: `SELECT u.username,\n       COUNT(a.id) AS files,\n       SUM(a.byte_size) AS bytes,\n       ROUND(SUM(a.byte_size) / 1048576.0, 2) AS mb\nFROM users u\nLEFT JOIN artifacts a ON a.user_id = u.id\nGROUP BY u.id\nORDER BY bytes DESC` },
+  { label: 'Active sessions',          query: `SELECT u.username, s.ip_address,\n       s.user_agent, s.created_at, s.last_seen_at\nFROM user_sessions s\nJOIN users u ON u.id = s.user_id\nWHERE s.revoked_at IS NULL\n  AND s.expires_at > datetime('now')\nORDER BY s.last_seen_at DESC\nLIMIT 50` },
+  { label: 'Runs per day (30 days)',   query: `SELECT DATE(created_at) AS day,\n       COUNT(*) AS runs,\n       COALESCE(SUM(total_tokens),0) AS tokens\nFROM agent_runs\nWHERE created_at >= datetime('now', '-30 days')\nGROUP BY day\nORDER BY day DESC` },
+  { label: 'Most used agents',         query: `SELECT a.slug, a.display_name, u.username AS owner,\n       COUNT(r.id) AS runs\nFROM agents a\nJOIN users u ON u.id = a.user_id\nLEFT JOIN agent_runs r ON r.agent_id = a.id\nGROUP BY a.id\nORDER BY runs DESC\nLIMIT 20` },
+  { label: 'Integration connections',  query: `SELECT u.username, ic.provider_key,\n       ic.status, ic.account_email, ic.last_connected_at\nFROM integration_connections ic\nJOIN users u ON u.id = ic.user_id\nORDER BY ic.last_connected_at DESC\nLIMIT 50` },
+  { label: 'All tables',               query: `SELECT name FROM sqlite_master WHERE type='table' ORDER BY name` },
+  { label: 'Table info (users)',        query: `SELECT * FROM pragma_table_info('users')` },
+];
+function loadSql() {
+  // Only initialize the editor once
+  if (document.getElementById('sql-editor')?.dataset.ready === '1') return;
+  initSqlEditor();
+}
+function initSqlEditor() {
+  const el = document.getElementById('sql-content');
+  if (!el) return;
+  const templateOptions = SQL_TEMPLATES.map((t, i) =>
+    `<option value="${i}">${esc(t.label)}</option>`).join('');
+  el.innerHTML = `
+    <div class="sql-toolbar">
+      <select id="sql-template" onchange="onSqlTemplate(this)" style="width:auto;min-width:220px;" aria-label="Query template">
+        ${templateOptions}
+      </select>
+      <span class="spacer"></span>
+      <button class="btn btn-primary" id="sql-run-btn" onclick="runSql()" style="padding:7px 16px;">
+        <svg viewBox="0 0 20 20" fill="currentColor" style="width:13px;height:13px;" aria-hidden="true">
+          <path fill-rule="evenodd" d="M10 18a8 8 0 100-16 8 8 0 000 16zM9.555 7.168A1 1 0 008 8v4a1 1 0 001.555.832l3-2a1 1 0 000-1.664l-3-2z" clip-rule="evenodd"/>
+        </svg>
+        Run
+      </button>
+    </div>
+    <textarea id="sql-editor" data-ready="1" class="sql-textarea" spellcheck="false" autocorrect="off" autocapitalize="off"
+      placeholder="SELECT * FROM users LIMIT 10"
+      onkeydown="onSqlKeydown(event)"
+      aria-label="SQL query editor"
+    ></textarea>
+    <div id="sql-results"></div>`;
+}
+function onSqlTemplate(sel) {
+  const idx = parseInt(sel.value, 10);
+  const q = SQL_TEMPLATES[idx]?.query || '';
+  const editor = document.getElementById('sql-editor');
+  if (editor && q) { editor.value = q; editor.focus(); }
+}
+function onSqlKeydown(e) {
+  // Ctrl+Enter / Cmd+Enter to run
+  if (e.key === 'Enter' && (e.ctrlKey || e.metaKey)) {
+    e.preventDefault();
+    runSql();
+  }
+  // Tab → insert 2 spaces
+  if (e.key === 'Tab') {
+    e.preventDefault();
+    const ta = e.target;
+    const s = ta.selectionStart, end = ta.selectionEnd;
+    ta.value = ta.value.slice(0, s) + '  ' + ta.value.slice(end);
+    ta.selectionStart = ta.selectionEnd = s + 2;
+  }
+}
+async function runSql() {
+  const query = document.getElementById('sql-editor')?.value?.trim();
+  if (!query) return;
+  const resultsEl = document.getElementById('sql-results');
+  const runBtn    = document.getElementById('sql-run-btn');
+  if (!resultsEl || !runBtn) return;
+  runBtn.disabled = true;
+  resultsEl.innerHTML = '<div class="empty"><span class="spinner"></span></div>';
+  try {
+    const res = await api('/admin/api/sql', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ query }),
+    });
+    const data = await res.json();
+    if (!res.ok) {
+      resultsEl.innerHTML = `<div class="sql-error">${esc(data.error || 'Query failed')}</div>`;
+      return;
+    }
+    if (!data.rows?.length) {
+      resultsEl.innerHTML = '<div class="empty">Query returned 0 rows</div>';
+      return;
+    }
+    resultsEl.innerHTML = `
+      <div class="sql-meta">
+        ${fmtNum(data.rows.length)}${data.truncated ? ` of ${fmtNum(data.total)}` : ''} row${data.rows.length === 1 ? '' : 's'}
+        ${data.truncated ? '<span class="badge badge-warn" style="margin-left:6px;">truncated at 500</span>' : ''}
+        <button class="btn btn-ghost" style="margin-left:auto;padding:4px 10px;font-size:11px;" onclick="copySqlResults()">Copy CSV</button>
+      </div>
+      <div class="sql-result-wrap">
+        <table class="sql-result-table">
+          <thead><tr>${data.columns.map((c) => `<th>${esc(c)}</th>`).join('')}</tr></thead>
+          <tbody>${data.rows.map((row) =>
+            `<tr>${data.columns.map((c) => `<td>${esc(row[c] == null ? 'NULL' : String(row[c]))}</td>`).join('')}</tr>`
+          ).join('')}</tbody>
+        </table>
+      </div>`;
+    // stash for copy
+    window._lastSqlData = data;
+  } catch (err) {
+    if (err.message !== 'unauthorized') {
+      resultsEl.innerHTML = `<div class="sql-error">Network error</div>`;
+    }
+  } finally {
+    runBtn.disabled = false;
+  }
+}
+function copySqlResults() {
+  const d = window._lastSqlData;
+  if (!d) return;
+  const header = d.columns.join(',');
+  const rows   = d.rows.map((r) => d.columns.map((c) => JSON.stringify(r[c] ?? '')).join(','));
+  navigator.clipboard.writeText([header, ...rows].join('\n')).catch(() => {});
+}

package/server/admin/users.js ADDED Viewed

@@ -0,0 +1,147 @@
+'use strict';
+// ── User Management ────────────────────────────────────────────────────────
+let _userSearchTimer = null;
+async function loadUsers() {
+  const q = document.getElementById('user-search')?.value?.trim() || '';
+  await fetchUsers(q);
+}
+async function fetchUsers(q = '') {
+  const el = document.getElementById('users-table-wrap');
+  if (!el) return;
+  el.innerHTML = '<div class="empty"><span class="spinner"></span></div>';
+  try {
+    const url = q ? `/admin/api/users?q=${encodeURIComponent(q)}` : '/admin/api/users';
+    const data = await api(url).then((r) => r.json());
+    renderUsersTable(el, data.users || []);
+    const cnt = document.getElementById('users-count');
+    if (cnt) cnt.textContent = `${(data.users || []).length} user${(data.users || []).length === 1 ? '' : 's'}`;
+  } catch (err) {
+    if (err.message !== 'unauthorized') el.innerHTML = '<div class="empty">Failed to load users</div>';
+  }
+}
+function onUserSearch() {
+  clearTimeout(_userSearchTimer);
+  _userSearchTimer = setTimeout(() => {
+    const q = document.getElementById('user-search')?.value?.trim() || '';
+    fetchUsers(q);
+  }, 300);
+}
+function renderUsersTable(el, users) {
+  if (!users.length) {
+    el.innerHTML = '<div class="empty">No users found</div>';
+    return;
+  }
+  el.innerHTML = `
+    <table class="users-table">
+      <thead><tr>
+        <th>User</th>
+        <th>Email</th>
+        <th>Joined</th>
+        <th>Last Login</th>
+        <th>Runs</th>
+        <th>Storage</th>
+        <th style="text-align:right;">Actions</th>
+      </tr></thead>
+      <tbody>${users.map((u) => `
+        <tr data-uid="${esc(u.id)}">
+          <td>
+            <div style="display:flex;align-items:center;gap:9px;">
+              <span class="user-avatar">${esc((u.display_name || u.username || '?')[0]).toUpperCase()}</span>
+              <div>
+                <div style="font-weight:600;color:var(--text);">${esc(u.display_name || u.username)}</div>
+                ${u.display_name && u.display_name !== u.username ? `<div style="font-size:11px;color:var(--text-muted);">@${esc(u.username)}</div>` : ''}
+              </div>
+            </div>
+          </td>
+          <td>
+            <span style="font-size:12px;">${esc(u.email || '—')}</span>
+            ${u.email_verified_at
+              ? '<span class="badge badge-ok" style="font-size:10px;margin-left:5px;">verified</span>'
+              : u.email ? '<span class="badge badge-warn" style="font-size:10px;margin-left:5px;">unverified</span>' : ''}
+          </td>
+          <td style="font-size:12px;color:var(--text-muted);">${fmtDate(u.created_at)}</td>
+          <td style="font-size:12px;color:var(--text-muted);">${u.last_login ? fmtDate(u.last_login) : '—'}</td>
+          <td style="font-family:var(--font-mono);font-size:12px;">${fmtNum(u.run_count)}</td>
+          <td style="font-family:var(--font-mono);font-size:12px;">${fmtBytes(u.storage_bytes)}</td>
+          <td>
+            <div style="display:flex;gap:6px;justify-content:flex-end;">
+              <button class="btn btn-ghost" style="padding:5px 10px;font-size:11px;"
+                onclick="forceLogout('${esc(u.id)}','${esc(u.username)}',this)" title="Revoke all sessions">
+                Logout
+              </button>
+              <button class="btn btn-danger" style="padding:5px 10px;font-size:11px;"
+                onclick="deleteUser('${esc(u.id)}','${esc(u.display_name || u.username)}',this)" title="GDPR: delete all user data">
+                Delete
+              </button>
+            </div>
+          </td>
+        </tr>`).join('')}
+      </tbody>
+    </table>
+    <p class="gdpr-note">
+      ⚠ <strong>Delete</strong> permanently erases all user data (runs, messages, memories, artifacts, sessions) — irreversible. Required by GDPR Art. 17 right to erasure.
+    </p>`;
+}
+async function forceLogout(id, username, btn) {
+  if (!confirm(`Force logout ${username}?\n\nThis will revoke all active sessions. They can log back in.`)) return;
+  btn.disabled = true;
+  try {
+    const res = await api(`/admin/api/users/${id}/sessions`, { method: 'DELETE' });
+    if (res.ok) {
+      btn.textContent = 'Done';
+      setTimeout(loadUsers, 800);
+    } else {
+      const b = await res.json().catch(() => ({}));
+      alert(b.error || 'Failed');
+      btn.disabled = false;
+    }
+  } catch (err) {
+    if (err.message !== 'unauthorized') alert('Network error');
+    btn.disabled = false;
+  }
+}
+async function deleteUser(id, displayName, btn) {
+  if (!confirm(
+    `⚠ GDPR Erasure — permanently delete "${displayName}"?\n\n` +
+    'This will delete the account and ALL associated data:\n' +
+    '• Agent runs, steps, and messages\n• Memories and conversations\n• Integrations and platform connections\n• Artifacts and files on disk\n• All sessions\n\n' +
+    'This action CANNOT be undone.'
+  )) return;
+  btn.disabled = true;
+  btn.textContent = 'Deleting…';
+  try {
+    const res = await api(`/admin/api/users/${id}`, { method: 'DELETE' });
+    if (res.ok) {
+      btn.closest('tr')?.remove();
+      const cnt = document.getElementById('users-count');
+      if (cnt) {
+        const n = parseInt(cnt.textContent) - 1;
+        cnt.textContent = `${n} user${n === 1 ? '' : 's'}`;
+      }
+    } else {
+      const b = await res.json().catch(() => ({}));
+      alert(b.error || 'Failed to delete user');
+      btn.disabled = false;
+      btn.textContent = 'Delete';
+    }
+  } catch (err) {
+    if (err.message !== 'unauthorized') alert('Network error');
+    btn.disabled = false;
+    btn.textContent = 'Delete';
+  }
+}
+function fmtDate(iso) {
+  if (!iso) return '—';
+  try {
+    return new Date(iso).toLocaleDateString(undefined, { year: 'numeric', month: 'short', day: 'numeric' });
+  } catch { return iso; }
+}

package/server/db/database.js CHANGED Viewed

@@ -1074,6 +1074,25 @@ try {
   // Ignore cleanup failures for obsolete wearable tables.
 }
+// Admin 2FA tables (singleton — no foreign key, no user_id)
+db.exec(`
+  CREATE TABLE IF NOT EXISTS admin_two_factor (
+    id              INTEGER PRIMARY KEY CHECK (id = 1),
+    enabled         INTEGER NOT NULL DEFAULT 0,
+    secret          TEXT,
+    pending_secret  TEXT,
+    enabled_at      TEXT,
+    created_at      TEXT NOT NULL DEFAULT (datetime('now')),
+    updated_at      TEXT NOT NULL DEFAULT (datetime('now'))
+  );
+  CREATE TABLE IF NOT EXISTS admin_recovery_codes (
+    id          INTEGER PRIMARY KEY AUTOINCREMENT,
+    code_hash   TEXT NOT NULL,
+    created_at  TEXT NOT NULL DEFAULT (datetime('now')),
+    used_at     TEXT
+  );
+`);
 // Migrations for existing databases
 for (const col of [
   "ALTER TABLE agent_runs ADD COLUMN agent_id TEXT",

package/server/http/static.js CHANGED Viewed

@@ -7,6 +7,7 @@ const { DATA_DIR } = require('../../runtime/paths');
 const { requireAuth } = require('../middleware/auth');
 const FLUTTER_WEB_DIR = path.join(__dirname, '..', 'public');
+const LANDING_DIR = path.join(__dirname, '..', '..', 'landing');
 const BUILD_ID_PATH = path.join(FLUTTER_WEB_DIR, '.last_build_id');
 function setNoStoreHeaders(res) {
@@ -66,11 +67,20 @@ function registerStaticRoutes(app) {
   const adminRouter = require('../routes/admin');
   app.use('/admin', adminRouter);
-  app.use(express.static(FLUTTER_WEB_DIR, {
-    index: false,
-    setHeaders: setFlutterStaticHeaders,
-  }));
-  app.get(/^\/(?!api|admin|screenshots|telnyx-audio).*/, serveFlutterApp);
+  // Flutter app at /app
+  app.use(
+    '/app',
+    express.static(FLUTTER_WEB_DIR, {
+      index: false,
+      setHeaders: setFlutterStaticHeaders,
+    })
+  );
+  app.get(/^\/app(\/.*)?$/, serveFlutterApp);
+  // Landing page at /
+  app.use(express.static(LANDING_DIR));
+  app.get('/', (req, res) => res.sendFile(path.join(LANDING_DIR, 'index.html')));
+  app.get('/legal.html', (req, res) => res.sendFile(path.join(LANDING_DIR, 'legal.html')));
 }
 function serveFlutterApp(req, res) {
@@ -83,11 +93,15 @@ function serveFlutterApp(req, res) {
       );
   }
   setNoStoreHeaders(res);
-  return res.sendFile(entry);
+  // Rewrite <base href="/"> to <base href="/app/"> so Flutter asset paths resolve correctly
+  const html = fs.readFileSync(entry, 'utf8').replace('<base href="/">', '<base href="/app/">');
+  res.set('Content-Type', 'text/html');
+  return res.send(html);
 }
 module.exports = {
   FLUTTER_WEB_DIR,
+  LANDING_DIR,
   registerStaticRoutes,
   serveFlutterApp
 };

package/server/middleware/adminAuth.js CHANGED Viewed

@@ -1,7 +1,44 @@
 'use strict';
+const crypto = require('crypto');
+/**
+ * Constant-time string comparison — prevents timing attacks on API key checks.
+ */
+function safeEqual(a, b) {
+  if (!a || !b) return false;
+  const bufA = Buffer.from(String(a));
+  const bufB = Buffer.from(String(b));
+  if (bufA.length !== bufB.length) {
+    // Lengths differ — do a dummy compare anyway to keep timing consistent
+    crypto.timingSafeEqual(bufA, Buffer.alloc(bufA.length));
+    return false;
+  }
+  return crypto.timingSafeEqual(bufA, bufB);
+}
+/**
+ * Allows admin access via either:
+ *   1. Browser session  (`req.session.isAdmin === true`)
+ *   2. API key          (`Authorization: Bearer <ADMIN_API_KEY>`)
+ *
+ * When ADMIN_API_KEY is absent or empty, Bearer auth is disabled entirely.
+ */
 function requireAdminAuth(req, res, next) {
+  // 1. Session-based auth (admin web dashboard)
   if (req.session?.isAdmin === true) return next();
+  // 2. API key auth (programmatic / scripts)
+  const configuredKey = process.env.ADMIN_API_KEY;
+  if (configuredKey) {
+    const authHeader = String(req.headers.authorization || '');
+    if (authHeader.startsWith('Bearer ')) {
+      const provided = authHeader.slice(7).trim();
+      if (safeEqual(provided, configuredKey)) return next();
+    }
+  }
+  // 3. Reject
   if (req.path.startsWith('/api/')) {
     return res.status(401).json({ error: 'Admin authentication required' });
   }

package/server/public/.last_build_id CHANGED Viewed

	@@ -1 +1 @@
1	- ~~8518f61f8e30cec23dd6f87e3ba20ac3~~
1	+ 1a8195f0cf8ff4ea724469829b5dfbbb