node-red-contrib-room-tools 1.8.3 → 1.8.8

package/panel-editor-auth.js

@@ -1,4 +1,5 @@
 const crypto = require('node:crypto')
+const { readJsonBody, replyJson: reply, sameOrigin } = require('./panel-http')
 
 function createPanelEditor ({ panelId, username, password, secureCookie, getConfig, getDevices, getTargets, apply, restoredSessions }) {
   if (!username || !password) return null
@@ -20,58 +21,14 @@ function createPanelEditor ({ panelId, username, password, secureCookie, getConf
   const ttl = 30 * 60 * 1000
   let closed = false
 
-  function reply (res, status, data, headers = {}) {
-    res.writeHead(status, {
-      'Content-Type': 'application/json; charset=utf-8',
-      'Cache-Control': 'no-store',
-      'X-Content-Type-Options': 'nosniff',
-      ...headers
-    })
-    res.end(JSON.stringify(data))
-  }
-
-  function cookie (value, age) {
-    return `${cookieName}=${value}; Path=${prefix}; HttpOnly; SameSite=Strict; Max-Age=${age}${secureCookie ? '; Secure' : ''}`
-  }
-
-  function sameOrigin (req) {
-    const origin = req.headers.origin
-    if (!origin) return false
-    try {
-      const parsed = new URL(origin)
-      return parsed.host === req.headers.host &&
-        parsed.protocol === (req.socket.encrypted ? 'https:' : 'http:')
-    } catch (_) { return false }
-  }
-
-  function localOrSecure (req) {
-    const address = String(req.socket.remoteAddress || '')
-    return ['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(address) ||
-      req.socket.encrypted === true
-  }
-
-  async function jsonBody (req) {
-    if (!String(req.headers['content-type'] || '').startsWith('application/json')) {
-      throw new Error('JSON body required')
-    }
-    if (req.body !== undefined) {
-      if (Buffer.isBuffer(req.body)) return JSON.parse(req.body.toString('utf8'))
-      if (typeof req.body === 'string') return JSON.parse(req.body)
-      if (typeof req.body === 'object' && req.body !== null && Object.keys(req.body).length) return req.body
-    }
-    let raw = ''
-    for await (const chunk of req) {
-      raw += chunk
-      if (Buffer.byteLength(raw) > 65536) throw new Error('Request too large')
-    }
-    return JSON.parse(raw)
+  function cookie (value, age, req) {
+    return `${cookieName}=${value}; Path=${prefix}; HttpOnly; SameSite=Strict; Max-Age=${age}${secureCookie && req.socket.encrypted ? '; Secure' : ''}`
   }
 
   async function handler (req, res) {
     const path = new URL(req.url, 'http://localhost').pathname
     if (!path.startsWith(prefix + '/')) return false
     if (closed) { reply(res, 503, { error: 'Editor unavailable' }); return true }
-    if (!localOrSecure(req)) { reply(res, 403, { error: 'HTTPS required' }); return true }
     if (req.method === 'POST' && !sameOrigin(req)) {
       reply(res, 403, { error: 'Origin rejected' })
       return true
@@ -89,7 +46,7 @@ function createPanelEditor ({ panelId, username, password, secureCookie, getConf
         }
         attempt.count++
         attempts.set(ip, attempt)
-        const body = await jsonBody(req)
+        const body = await readJsonBody(req, 65536)
         const supplied = String(body.password || '')
         if (supplied.length > 256) { reply(res, 401, { error: 'Invalid credentials' }); return true }
         const test = await new Promise((resolve, reject) => crypto.scrypt(supplied, salt, 32,
@@ -103,7 +60,7 @@ function createPanelEditor ({ panelId, username, password, secureCookie, getConf
         const token = crypto.randomBytes(32).toString('hex')
         const csrf = crypto.randomBytes(24).toString('hex')
         sessions.set(token, { csrf, expiry: now + ttl })
-        reply(res, 200, { csrf }, { 'Set-Cookie': cookie(token, ttl / 1000) })
+        reply(res, 200, { csrf }, { 'Set-Cookie': cookie(token, ttl / 1000, req) })
         return true
       }
       const token = String(req.headers.cookie || '').split(';').map(part => part.trim())
@@ -118,7 +75,7 @@ function createPanelEditor ({ panelId, username, password, secureCookie, getConf
         reply(res, 200, { csrf: session.csrf })
       } else if (path === prefix + '/logout' && req.method === 'POST') {
         sessions.delete(token)
-        reply(res, 200, { ok: true }, { 'Set-Cookie': cookie('', 0) })
+        reply(res, 200, { ok: true }, { 'Set-Cookie': cookie('', 0, req) })
       } else if (path === prefix + '/config' && req.method === 'GET') {
         reply(res, 200, await getConfig(req))
       } else if (path === prefix + '/devices' && req.method === 'GET') {
@@ -127,7 +84,7 @@ function createPanelEditor ({ panelId, username, password, secureCookie, getConf
         const device = new URL(req.url, 'http://localhost').searchParams.get('device')
         reply(res, 200, { targets: await getTargets(req, device) })
       } else if (path === prefix + '/apply' && req.method === 'POST') {
-        reply(res, 200, await apply(req, await jsonBody(req)))
+        reply(res, 200, await apply(req, await readJsonBody(req, 65536)))
       } else {
         reply(res, 404, { error: 'Not found' })
       }

package/panel-http.js

@@ -0,0 +1,69 @@
+function sameOrigin (req) {
+  if (!req.headers.origin) return false
+  try {
+    const origin = new URL(req.headers.origin)
+    return origin.host === req.headers.host &&
+      origin.protocol === (req.socket.encrypted ? 'https:' : 'http:')
+  } catch (_) { return false }
+}
+
+function replyJson (res, status, data, headers = {}) {
+  res.writeHead(status, {
+    'Content-Type': 'application/json; charset=utf-8',
+    'Cache-Control': 'no-store',
+    'X-Content-Type-Options': 'nosniff',
+    ...headers
+  })
+  res.end(JSON.stringify(data))
+}
+
+async function readJsonBody (req, maxBytes) {
+  if (String(req.headers['content-type'] || '').split(';')[0].trim().toLowerCase() !== 'application/json') {
+    throw new Error('JSON body required')
+  }
+  let raw
+  if (req.body !== undefined) {
+    // MUSE's middleware can expose an empty placeholder object while the raw
+    // JSON bytes are still on the request stream. Keep the legacy fallback so
+    // login and Apply receive the actual payload on that runtime.
+    const hasParsedObject = req.body && typeof req.body === 'object' &&
+      !Buffer.isBuffer(req.body) && !Array.isArray(req.body) &&
+      Object.keys(req.body).length > 0
+    if (Buffer.isBuffer(req.body) || typeof req.body === 'string' || hasParsedObject) {
+      raw = Buffer.isBuffer(req.body) ? req.body
+        : typeof req.body === 'string' ? Buffer.from(req.body) : Buffer.from(JSON.stringify(req.body))
+    }
+  }
+  if (raw === undefined && typeof req[Symbol.asyncIterator] === 'function') {
+    const chunks = []
+    let size = 0
+    for await (const chunk of req) {
+      const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+      size += bytes.length
+      if (size > maxBytes) throw new Error('Request too large')
+      chunks.push(bytes)
+    }
+    raw = Buffer.concat(chunks)
+  }
+  if (raw === undefined) {
+    const value = req.body === undefined ? {} : req.body
+    raw = Buffer.from(JSON.stringify(value))
+  }
+  if (raw.length > maxBytes) throw new Error('Request too large')
+  const value = JSON.parse(raw.toString('utf8'))
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('JSON object required')
+  return value
+}
+
+// Serialized into the Vue component, so keep this function browser-only and self-contained.
+async function fetchWithTimeout (url, options = {}, timeoutMs = 12000) {
+  const controller = new AbortController()
+  const timer = setTimeout(() => controller.abort(), timeoutMs)
+  try {
+    return await fetch(url, { ...options, signal: controller.signal })
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+module.exports = { sameOrigin, replyJson, readJsonBody, fetchWithTimeout }

package/panel-visual-apply.js

@@ -4,7 +4,7 @@ const { validatedVisualBindings } = require('./panel-visual-bindings')
 const { listCatalogDevices, listCatalogTargets } = require('./control-catalog')
 const { configuredRoutes } = require('./control-bound-protocol')
 const { provisionManagedBridges } = require('./managed-native-bridge')
-const { backupFlow, flowLocation, localDirectory } = require('./managed-bridge-admin')
+const { backupFlow, flowLocation, runtimeDirectory } = require('./managed-bridge-admin')
 
 function conflict (message) {
   const error = new Error(message)
@@ -12,15 +12,20 @@ function conflict (message) {
   return error
 }
 
-function adminUrl (localPort) {
+function adminUrl (localPort, adminRoot = '/red') {
   if (!Number.isInteger(localPort) || localPort < 1 || localPort > 65535) {
-    throw new Error('Local Automator port unavailable')
+    throw new Error('Node-RED runtime port unavailable')
   }
-  return `http://127.0.0.1:${localPort}/red/flows`
+  if (typeof adminRoot !== 'string' || !adminRoot.startsWith('/') || /[?#]/.test(adminRoot)) {
+    throw new Error('Node-RED admin root unavailable')
+  }
+  const url = new URL(`http://127.0.0.1:${localPort}`)
+  url.pathname = adminRoot.replace(/\/$/, '') + '/flows'
+  return url.href
 }
 
-async function getSnapshot (localPort, fetcher = fetch) {
-  const response = await fetcher(adminUrl(localPort), {
+async function getSnapshot (localPort, fetcher = fetch, adminRoot = '/red') {
+  const response = await fetcher(adminUrl(localPort, adminRoot), {
     headers: { 'Node-RED-API-Version': 'v2' },
     signal: AbortSignal.timeout(10000)
   })
@@ -59,18 +64,19 @@ function editorConfig (snapshot, panelId) {
 }
 
 async function applyVisualBindings ({
-  panelId, rev, templateHash, entries, userDir, remoteAddress, localPort,
+  panelId, rev, templateHash, entries, userDir, localPort, adminRoot = '/red',
   catalogBase, fetcher = fetch
 }) {
-  localDirectory(userDir, remoteAddress)
+  // The editor authenticates the browser; Flow access stays on the runtime's loopback interface.
+  const directory = runtimeDirectory(userDir)
   if (!catalogBase) throw conflict('Device catalog is unavailable')
-  const snapshot = await getSnapshot(localPort, fetcher)
+  const snapshot = await getSnapshot(localPort, fetcher, adminRoot)
   if (snapshot.rev !== rev) throw conflict('Flow changed; refresh the visual editor')
   const panel = findPanel(snapshot, panelId)
   if (inspectTemplate(panel.format).templateHash !== templateHash) {
     throw conflict('Template changed; refresh the visual editor')
   }
-  const location = flowLocation(fs.realpathSync(userDir))
+  const location = flowLocation(directory)
   if (JSON.stringify(JSON.parse(fs.readFileSync(location.flowFile, 'utf8'))) !== JSON.stringify(snapshot.flows)) {
     throw conflict('Deployed Flow differs from the active project file')
   }
@@ -92,13 +98,13 @@ async function applyVisualBindings ({
   nextPanel.nativeBridge = configuredRoutes(nextPanel).size > 0
   const provisioned = provisionManagedBridges(next, { panelId })
 
-  const latest = await getSnapshot(localPort, fetcher)
+  const latest = await getSnapshot(localPort, fetcher, adminRoot)
   if (latest.rev !== snapshot.rev) throw conflict('Flow changed during validation; refresh and retry')
   if (JSON.stringify(JSON.parse(fs.readFileSync(location.flowFile, 'utf8'))) !== JSON.stringify(snapshot.flows)) {
     throw conflict('Active project changed during validation')
   }
   const backupDir = backupFlow(location, snapshot.rev, snapshot.flows)
-  const response = await fetcher(adminUrl(localPort), {
+  const response = await fetcher(adminUrl(localPort, adminRoot), {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',
@@ -112,7 +118,7 @@ async function applyVisualBindings ({
   const applied = await response.json().catch(() => ({}))
   let confirmed
   for (let attempt = 0; attempt < 5; attempt++) {
-    confirmed = await getSnapshot(localPort, fetcher)
+    confirmed = await getSnapshot(localPort, fetcher, adminRoot)
     const confirmedPanel = confirmed.flows.find(node => node.id === panelId)
     if (confirmedPanel?.visualBindings === nextPanel.visualBindings &&
       confirmedPanel.bridgeRevisionApplied === provisioned.flows.find(node => node.id === panelId)?.bridgeRevisionApplied) {