node-red-contrib-room-tools 1.8.3 → 1.8.4

package/README.md

@@ -6,6 +6,8 @@ This package provides `ui-control-panel` for Node-RED and MUSE Automator.
 
 The page author writes ordinary HTML/CSS/Vue and pastes it into the `ui-control-panel` Template. After configuring a Dashboard page, room ID, control login, and separate editor login, save and Deploy. Reopen the node and select **Open page binding editor**. Sign in with the editor account, right-click a supported control, choose its device points, and Apply.
 
+Both logins work over HTTP on a trusted local network. HTTPS is recommended for other networks because HTTP transmits credentials without encryption. Session cookies are marked `Secure` when the connection uses HTTPS.
+
 Bindings are stored in `visualBindings` on the node. The runtime reads that mapping to authenticate commands, route feedback, and generate a native bridge. The page author does not put device paths, `data-cp-*` attributes, or device-send code in the Template. Author-provided `data-cp-*` attributes are rejected.
 
 Supported controls include native range, checkbox, semantic pressed button, select, text input, meter, progress, and simple text display. Give repeated controls distinct standard IDs. Simple top-level Vue `v-model` works; controls with existing send handlers or ambiguous dynamic behavior are rejected until a suitable adapter exists. See `CONTROL_PANEL_AI_GUIDE.md` for examples and limits.

package/gateway.cjs

@@ -292,7 +292,7 @@ function createGateway ({
   }
 
   const cookieName = 'room_panel_' + Buffer.from(room).toString('hex')
-  const cookie = (token, maxAge) => `${cookieName}=${token}; Path=${routePrefix}; HttpOnly; SameSite=Strict; Max-Age=${maxAge}${secureCookie ? '; Secure' : ''}`
+  const cookie = (token, maxAge, req) => `${cookieName}=${token}; Path=${routePrefix}; HttpOnly; SameSite=Strict; Max-Age=${maxAge}${secureCookie && req.socket.encrypted ? '; Secure' : ''}`
 
   async function handler (req, res) {
     const path = new URL(req.url, 'http://localhost').pathname
@@ -353,7 +353,7 @@ function createGateway ({
         const csrf = crypto.randomBytes(24).toString('hex')
         sessions.set(token, { csrf, expiry: now + sessionTtlMs })
         reply(res, 200, { room, username, csrf }, {
-          'Set-Cookie': cookie(token, Math.ceil(sessionTtlMs / 1000))
+          'Set-Cookie': cookie(token, Math.ceil(sessionTtlMs / 1000), req)
         })
         if (boundOnly && typeof onBoundLogin === 'function') {
           queueMicrotask(() => { if (!closed) onBoundLogin({ room, user: username }) })
@@ -405,7 +405,7 @@ function createGateway ({
       if (path === routePrefix + '/logout' && req.method === 'POST') {
         sessions.delete(token)
         closeSubscribersForToken(token)
-        reply(res, 200, { ok: true }, { 'Set-Cookie': cookie('', 0) })
+        reply(res, 200, { ok: true }, { 'Set-Cookie': cookie('', 0, req) })
         return true
       }
       if (path === routePrefix + '/bound-command' && req.method === 'POST') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-red-contrib-room-tools",
-  "version": "1.8.3",
+  "version": "1.8.4",
   "description": "Room panel message generator and authenticated region gateway for Node-RED and MUSE Automator",
   "license": "UNLICENSED",
   "keywords": [

package/panel-editor-auth.js

@@ -30,8 +30,8 @@ function createPanelEditor ({ panelId, username, password, secureCookie, getConf
     res.end(JSON.stringify(data))
   }
 
-  function cookie (value, age) {
-    return `${cookieName}=${value}; Path=${prefix}; HttpOnly; SameSite=Strict; Max-Age=${age}${secureCookie ? '; Secure' : ''}`
+  function cookie (value, age, req) {
+    return `${cookieName}=${value}; Path=${prefix}; HttpOnly; SameSite=Strict; Max-Age=${age}${secureCookie && req.socket.encrypted ? '; Secure' : ''}`
   }
 
   function sameOrigin (req) {
@@ -44,12 +44,6 @@ function createPanelEditor ({ panelId, username, password, secureCookie, getConf
     } catch (_) { return false }
   }
 
-  function localOrSecure (req) {
-    const address = String(req.socket.remoteAddress || '')
-    return ['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(address) ||
-      req.socket.encrypted === true
-  }
-
   async function jsonBody (req) {
     if (!String(req.headers['content-type'] || '').startsWith('application/json')) {
       throw new Error('JSON body required')
@@ -71,7 +65,6 @@ function createPanelEditor ({ panelId, username, password, secureCookie, getConf
     const path = new URL(req.url, 'http://localhost').pathname
     if (!path.startsWith(prefix + '/')) return false
     if (closed) { reply(res, 503, { error: 'Editor unavailable' }); return true }
-    if (!localOrSecure(req)) { reply(res, 403, { error: 'HTTPS required' }); return true }
     if (req.method === 'POST' && !sameOrigin(req)) {
       reply(res, 403, { error: 'Origin rejected' })
       return true
@@ -103,7 +96,7 @@ function createPanelEditor ({ panelId, username, password, secureCookie, getConf
         const token = crypto.randomBytes(32).toString('hex')
         const csrf = crypto.randomBytes(24).toString('hex')
         sessions.set(token, { csrf, expiry: now + ttl })
-        reply(res, 200, { csrf }, { 'Set-Cookie': cookie(token, ttl / 1000) })
+        reply(res, 200, { csrf }, { 'Set-Cookie': cookie(token, ttl / 1000, req) })
         return true
       }
       const token = String(req.headers.cookie || '').split(';').map(part => part.trim())
@@ -118,7 +111,7 @@ function createPanelEditor ({ panelId, username, password, secureCookie, getConf
         reply(res, 200, { csrf: session.csrf })
       } else if (path === prefix + '/logout' && req.method === 'POST') {
         sessions.delete(token)
-        reply(res, 200, { ok: true }, { 'Set-Cookie': cookie('', 0) })
+        reply(res, 200, { ok: true }, { 'Set-Cookie': cookie('', 0, req) })
       } else if (path === prefix + '/config' && req.method === 'GET') {
         reply(res, 200, await getConfig(req))
       } else if (path === prefix + '/devices' && req.method === 'GET') {