pockcode 0.0.1 → 0.0.4

package/dist/pockcode.js

@@ -20,12 +20,12 @@ async function main() {
 	process.env.NODE_ENV ||= "production";
 	if (parsed.home) process.env.POCKCODE_HOME = parsed.home;
 	const [api, auth, socket, chatMonitor, scheduleMonitor, pluginManager] = await Promise.all([
-		import("./assets/api.server-D6ONM6ZJ.js"),
-		import("./assets/auth.server-B_P8Jm6O.js"),
+		import("./assets/api.server-Dcqq4Zzw.js"),
+		import("./assets/auth.server-ByhZCVHW.js"),
 		import("./assets/socket.server-7dC-9Fnw.js").then((n) => n.a),
-		import("./assets/chat-status-monitor.server-D2VG_D8P.js"),
-		import("./assets/message-schedule-monitor.server-C4NZg62k.js"),
-		import("./assets/manager.server-Cru4ZxHo.js").then((n) => n.r)
+		import("./assets/chat-status-monitor.server-GIsx-97a.js"),
+		import("./assets/message-schedule-monitor.server-CAxiClld.js"),
+		import("./assets/manager.server-C_G8l7U-.js").then((n) => n.r)
 	]);
 	const clientRoot = await resolveClientRoot();
 	const server = createServer((req, res) => {
@@ -60,39 +60,96 @@ async function handleAuthGate(req, res, url, auth) {
 			return true;
 		}
 		if (req.method === "GET" || req.method === "HEAD") {
-			sendSetupPage(res);
+			sendSetupPage(res, { returnTo: returnToFor(url) });
 			return true;
 		}
 		sendJson(res, 428, { error: "Pockcode password setup is required." });
 		return true;
 	}
-	if (await auth.isRequestAuthorized(req)) return false;
-	res.statusCode = 401;
-	res.setHeader("WWW-Authenticate", `Basic realm="${auth.pockcodeAuthRealm()}", charset="UTF-8"`);
-	res.setHeader("Content-Type", "text/plain; charset=utf-8");
-	res.end("Authentication required.");
+	if (url.pathname === "/auth/login" && req.method === "POST") {
+		await handlePasswordLogin(req, res, auth);
+		return true;
+	}
+	if (url.pathname === "/auth/logout" && req.method === "POST") {
+		handlePasswordLogout(req, res, auth);
+		return true;
+	}
+	if (await auth.isRequestAuthorized(req)) {
+		if (url.pathname === "/auth/login" && (req.method === "GET" || req.method === "HEAD")) {
+			redirect(res, safeReturnTo(url.searchParams.get("returnTo")));
+			return true;
+		}
+		return false;
+	}
+	if (url.pathname === "/auth/login" && (req.method === "GET" || req.method === "HEAD")) {
+		sendLoginPage(res, { returnTo: safeReturnTo(url.searchParams.get("returnTo")) });
+		return true;
+	}
+	if (url.pathname.startsWith("/api/") || requestWantsJson(req) || req.method !== "GET" && req.method !== "HEAD") {
+		sendJson(res, 401, { error: "Authentication required." });
+		return true;
+	}
+	sendLoginPage(res, { returnTo: returnToFor(url) }, 401);
 	return true;
 }
 async function handlePasswordSetup(req, res, auth) {
 	const body = await readRequestBody(req, 32e3);
-	const contentType = req.headers["content-type"] ?? "";
-	const wantsJson = req.headers.accept?.includes("application/json") || contentType.includes("application/json");
-	const password = contentType.includes("application/json") ? readJsonPassword(body) : new URLSearchParams(body).get("password") ?? "";
+	const wantsJson = requestWantsJson(req);
+	const { confirmPassword, password, returnTo } = readPasswordBody(req, body);
+	if (confirmPassword !== void 0 && password !== confirmPassword) {
+		const message = "Passwords do not match.";
+		if (wantsJson) sendJson(res, 400, { error: message });
+		else sendSetupPage(res, {
+			error: message,
+			returnTo
+		}, 400);
+		return;
+	}
 	try {
 		await auth.setupPassword(password);
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unable to configure password.";
 		if (wantsJson) sendJson(res, 400, { error: message });
-		else sendSetupPage(res, message, 400);
+		else sendSetupPage(res, {
+			error: message,
+			returnTo
+		}, 400);
 		return;
 	}
+	res.setHeader("Set-Cookie", await auth.createSessionCookie(req));
 	if (wantsJson) {
 		sendJson(res, 201, { ok: true });
 		return;
 	}
-	res.statusCode = 303;
-	res.setHeader("Location", "/");
-	res.end();
+	redirect(res, returnTo);
+}
+async function handlePasswordLogin(req, res, auth) {
+	const body = await readRequestBody(req, 32e3);
+	const wantsJson = requestWantsJson(req);
+	const { password, returnTo } = readPasswordBody(req, body);
+	if (!await auth.verifyPassword(password)) {
+		const message = "Password is not correct.";
+		if (wantsJson) sendJson(res, 401, { error: message });
+		else sendLoginPage(res, {
+			error: message,
+			returnTo
+		}, 401);
+		return;
+	}
+	res.setHeader("Set-Cookie", await auth.createSessionCookie(req));
+	if (wantsJson) {
+		sendJson(res, 200, { ok: true });
+		return;
+	}
+	redirect(res, returnTo);
+}
+function handlePasswordLogout(req, res, auth) {
+	res.setHeader("Set-Cookie", auth.clearSessionCookie());
+	if (requestWantsJson(req)) {
+		sendJson(res, 200, { ok: true });
+		return;
+	}
+	redirect(res, "/auth/login");
 }
 async function serveClientAsset(req, res, url, clientRoot) {
 	if (req.method !== "GET" && req.method !== "HEAD") {
@@ -157,14 +214,55 @@ async function readRequestBody(req, limit) {
 	}
 	return Buffer.concat(chunks).toString("utf8");
 }
-function readJsonPassword(body) {
+function readPasswordBody(req, body) {
+	if (headerIncludes(req.headers["content-type"], "application/json")) return readJsonPasswordBody(body);
+	const values = new URLSearchParams(body);
+	return {
+		confirmPassword: values.get("confirmPassword") ?? void 0,
+		password: values.get("password") ?? "",
+		returnTo: safeReturnTo(values.get("returnTo"))
+	};
+}
+function readJsonPasswordBody(body) {
 	try {
 		const value = JSON.parse(body);
-		return value && typeof value === "object" && !Array.isArray(value) && typeof value.password === "string" ? value.password : "";
+		if (!value || typeof value !== "object" || Array.isArray(value)) return {
+			password: "",
+			returnTo: "/"
+		};
+		const record = value;
+		return {
+			confirmPassword: typeof record.confirmPassword === "string" ? record.confirmPassword : void 0,
+			password: typeof record.password === "string" ? record.password : "",
+			returnTo: safeReturnTo(typeof record.returnTo === "string" ? record.returnTo : null)
+		};
 	} catch {
-		return "";
+		return {
+			password: "",
+			returnTo: "/"
+		};
 	}
 }
+function requestWantsJson(req) {
+	return headerIncludes(req.headers.accept, "application/json") || headerIncludes(req.headers["content-type"], "application/json");
+}
+function headerIncludes(value, needle) {
+	const normalizedNeedle = needle.toLowerCase();
+	return (Array.isArray(value) ? value.join(",") : value ?? "").toLowerCase().includes(normalizedNeedle);
+}
+function redirect(res, location, status = 303) {
+	res.statusCode = status;
+	res.setHeader("Location", location);
+	res.end();
+}
+function returnToFor(url) {
+	if (url.pathname === "/auth/login" || url.pathname === "/auth/setup" || url.pathname === "/auth/logout") return safeReturnTo(url.searchParams.get("returnTo"));
+	return safeReturnTo(`${url.pathname}${url.search}`);
+}
+function safeReturnTo(value) {
+	if (!value || !value.startsWith("/") || value.startsWith("//") || value.includes("\0")) return "/";
+	return value;
+}
 function parseArgs(argv) {
 	const options = {
 		host: defaultHost,
@@ -215,7 +313,31 @@ function readPort(value) {
 function invalidPort(option) {
 	throw new Error(`${option} requires a port between 1 and 65535.`);
 }
-function sendSetupPage(res, error, status = 200) {
+function sendSetupPage(res, options, status = 200) {
+	sendAuthPage(res, {
+		...options,
+		action: "/auth/setup",
+		confirmPassword: true,
+		heading: "Create local password",
+		lead: "Choose the password for this pockcode workspace.",
+		passwordAutocomplete: "new-password",
+		submitLabel: "Save and continue",
+		title: "pockcode setup"
+	}, status);
+}
+function sendLoginPage(res, options, status = 200) {
+	sendAuthPage(res, {
+		...options,
+		action: "/auth/login",
+		confirmPassword: false,
+		heading: "Sign in",
+		lead: "Enter the local password for this pockcode workspace.",
+		passwordAutocomplete: "current-password",
+		submitLabel: "Continue",
+		title: "pockcode login"
+	}, status);
+}
+function sendAuthPage(res, options, status = 200) {
 	res.statusCode = status;
 	res.setHeader("Content-Type", "text/html; charset=utf-8");
 	res.end(`<!doctype html>
@@ -223,31 +345,215 @@ function sendSetupPage(res, error, status = 200) {
 <head>
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>pockcode setup</title>
+  <title>${escapeHtml(options.title)}</title>
   <style>
-    :root { color-scheme: dark; font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
-    body { min-height: 100vh; margin: 0; display: grid; place-items: center; background: #0f1115; color: #f6f7fb; }
-    main { width: min(420px, calc(100vw - 32px)); border: 1px solid #2a2f3a; border-radius: 10px; background: #161922; padding: 24px; box-shadow: 0 24px 80px rgb(0 0 0 / 0.35); }
-    h1 { margin: 0 0 8px; font-size: 20px; }
-    p { margin: 0 0 18px; color: #aeb6c5; font-size: 14px; line-height: 1.5; }
-    label { display: grid; gap: 8px; font-size: 13px; font-weight: 600; }
-    input { height: 38px; border-radius: 8px; border: 1px solid #343b49; background: #0f1115; color: #f6f7fb; padding: 0 12px; font: inherit; }
-    button { margin-top: 16px; height: 38px; width: 100%; border: 0; border-radius: 8px; background: #f6f7fb; color: #111318; font-weight: 700; cursor: pointer; }
-    .error { margin-bottom: 14px; color: #ff9a9a; font-size: 13px; }
+    :root {
+      color-scheme: dark;
+      font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+      background: #111314;
+      color: #f3f4ef;
+    }
+    * { box-sizing: border-box; }
+    body {
+      min-height: 100vh;
+      margin: 0;
+      display: grid;
+      place-items: center;
+      background:
+        linear-gradient(90deg, rgb(255 255 255 / 0.03) 1px, transparent 1px),
+        linear-gradient(180deg, rgb(255 255 255 / 0.03) 1px, transparent 1px),
+        #111314;
+      background-size: 42px 42px;
+      color: #f3f4ef;
+    }
+    main {
+      width: min(880px, calc(100vw - 32px));
+      min-height: 520px;
+      display: grid;
+      grid-template-columns: minmax(0, 0.9fr) minmax(340px, 1fr);
+      overflow: hidden;
+      border: 1px solid #303433;
+      border-radius: 8px;
+      background: #181b1b;
+      box-shadow: 0 28px 90px rgb(0 0 0 / 0.42);
+    }
+    .brand {
+      display: flex;
+      min-height: 100%;
+      flex-direction: column;
+      justify-content: space-between;
+      border-right: 1px solid #303433;
+      background: #151716;
+      padding: 28px;
+    }
+    .mark {
+      display: grid;
+      width: 40px;
+      height: 40px;
+      place-items: center;
+      border: 1px solid #3d4641;
+      border-radius: 8px;
+      background: #d7ff6b;
+      color: #111314;
+      font-weight: 800;
+      letter-spacing: 0;
+    }
+    .brand h1 {
+      margin: 18px 0 6px;
+      font-size: 30px;
+      line-height: 1;
+      letter-spacing: 0;
+    }
+    .brand p, .panel p {
+      margin: 0;
+      color: #aeb7b1;
+      font-size: 14px;
+      line-height: 1.55;
+    }
+    .console {
+      display: grid;
+      gap: 10px;
+      margin-top: 30px;
+      color: #cfd7d1;
+      font-family: "SFMono-Regular", "Menlo", "Monaco", "Consolas", monospace;
+      font-size: 12px;
+    }
+    .console div {
+      display: flex;
+      justify-content: space-between;
+      gap: 18px;
+      border-bottom: 1px solid #2a2e2c;
+      padding-bottom: 10px;
+    }
+    .console span:last-child { color: #d7ff6b; }
+    .panel {
+      display: flex;
+      flex-direction: column;
+      justify-content: center;
+      padding: 44px;
+      background: #1c2020;
+    }
+    .eyebrow {
+      margin-bottom: 10px;
+      color: #8fd0ff;
+      font-size: 12px;
+      font-weight: 700;
+      letter-spacing: 0;
+      text-transform: uppercase;
+    }
+    h2 {
+      margin: 0 0 10px;
+      font-size: 26px;
+      line-height: 1.12;
+      letter-spacing: 0;
+    }
+    form {
+      display: grid;
+      gap: 14px;
+      margin-top: 28px;
+    }
+    label {
+      display: grid;
+      gap: 8px;
+      color: #f3f4ef;
+      font-size: 13px;
+      font-weight: 650;
+    }
+    input {
+      width: 100%;
+      height: 42px;
+      border: 1px solid #3a4140;
+      border-radius: 6px;
+      background: #111314;
+      color: #f3f4ef;
+      padding: 0 12px;
+      font: inherit;
+      outline: none;
+    }
+    input:focus {
+      border-color: #8fd0ff;
+      box-shadow: 0 0 0 3px rgb(143 208 255 / 0.18);
+    }
+    button {
+      height: 42px;
+      border: 0;
+      border-radius: 6px;
+      background: #d7ff6b;
+      color: #111314;
+      cursor: pointer;
+      font: inherit;
+      font-weight: 800;
+    }
+    button:focus-visible {
+      outline: 3px solid rgb(143 208 255 / 0.38);
+      outline-offset: 2px;
+    }
+    .error {
+      margin-top: 18px;
+      border: 1px solid #8d3d3d;
+      border-radius: 6px;
+      background: #351c1e;
+      color: #ffb9b9;
+      padding: 10px 12px;
+      font-size: 13px;
+      line-height: 1.45;
+    }
+    @media (max-width: 760px) {
+      body { place-items: stretch; background-size: 34px 34px; }
+      main {
+        width: 100%;
+        min-height: 100vh;
+        grid-template-columns: 1fr;
+        border: 0;
+        border-radius: 0;
+      }
+      .brand {
+        min-height: auto;
+        border-right: 0;
+        border-bottom: 1px solid #303433;
+        padding: 24px;
+      }
+      .brand h1 { font-size: 26px; }
+      .console { display: none; }
+      .panel {
+        justify-content: start;
+        padding: 28px 24px;
+      }
+    }
   </style>
 </head>
 <body>
   <main>
-    <h1>Set up pockcode</h1>
-    <p>Create the password used for HTTP Basic authentication.</p>
-    ${error ? `<div class="error">${escapeHtml(error)}</div>` : ""}
-    <form method="post" action="/auth/setup">
+    <section class="brand" aria-label="pockcode">
+      <div>
+        <div class="mark">pc</div>
+        <h1>pockcode</h1>
+        <p>Local access for your workspace.</p>
+      </div>
+      <div class="console" aria-hidden="true">
+        <div><span>host</span><span>localhost</span></div>
+        <div><span>session</span><span>locked</span></div>
+        <div><span>auth</span><span>local</span></div>
+      </div>
+    </section>
+    <section class="panel">
+      <div class="eyebrow">Workspace auth</div>
+      <h2>${escapeHtml(options.heading)}</h2>
+      <p>${escapeHtml(options.lead)}</p>
+      ${options.error ? `<div class="error" role="alert">${escapeHtml(options.error)}</div>` : ""}
+      <form method="post" action="${escapeHtml(options.action)}">
+        <input name="returnTo" type="hidden" value="${escapeHtml(options.returnTo)}" />
       <label>
         Password
-        <input name="password" type="password" minlength="8" autocomplete="new-password" autofocus required />
+          <input name="password" type="password" minlength="8" autocomplete="${options.passwordAutocomplete}" autofocus required />
       </label>
-      <button type="submit">Save password</button>
-    </form>
+        ${options.confirmPassword ? `<label>
+          Confirm password
+          <input name="confirmPassword" type="password" minlength="8" autocomplete="new-password" required />
+        </label>` : ""}
+        <button type="submit">${escapeHtml(options.submitLabel)}</button>
+      </form>
+    </section>
   </main>
 </body>
 </html>`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pockcode",
-  "version": "0.0.1",
+  "version": "0.0.4",
   "type": "module",
   "repository": {
     "type": "git",
@@ -35,7 +35,7 @@
     "@base-ui/react": "^1.6.0",
     "@fontsource-variable/geist": "^5.2.9",
     "@monaco-editor/react": "^4.7.0",
-    "@openai/codex": "^0.130.0",
+    "@openai/codex": "^0.142.5",
     "@prisma/client": "^6.19.3",
     "@react-router/dev": "^7.15.1",
     "@xterm/addon-fit": "^0.11.0",

package/dist/assets/auth.server-B_P8Jm6O.js

@@ -1,87 +0,0 @@
-import { r as resolvePockcodeAuthPath, t as ensureParentDirectory } from "./runtime-paths.server-D6rRjGVb.js";
-import { readFile, rename, writeFile } from "node:fs/promises";
-import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
-import { promisify } from "node:util";
-//#region app/server/auth.server.ts
-var scrypt$1 = promisify(scrypt);
-var passwordKeyLength = 64;
-var passwordMinLength = 8;
-var scryptOptions = {
-	N: 16384,
-	maxmem: 64 * 1024 * 1024,
-	p: 1,
-	r: 8
-};
-var authConfigCache;
-async function hasConfiguredPassword() {
-	return Boolean(await readAuthConfig());
-}
-async function setupPassword(password) {
-	const normalized = password.trim();
-	if (normalized.length < passwordMinLength) throw new Error(`Password must be at least ${passwordMinLength} characters.`);
-	if (await readAuthConfig()) throw new Error("Pockcode password is already configured.");
-	const salt = randomBytes(16);
-	const key = await scrypt$1(normalized, salt, passwordKeyLength, scryptOptions);
-	const config = {
-		version: 1,
-		password: {
-			algorithm: "scrypt",
-			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-			key: key.toString("base64"),
-			keyLength: passwordKeyLength,
-			salt: salt.toString("base64"),
-			scrypt: scryptOptions
-		}
-	};
-	const authPath = resolvePockcodeAuthPath();
-	ensureParentDirectory(authPath);
-	const tmpPath = `${authPath}.${process.pid}.${Date.now()}.tmp`;
-	await writeFile(tmpPath, `${JSON.stringify(config, null, 2)}\n`, { mode: 384 });
-	await rename(tmpPath, authPath);
-	authConfigCache = config;
-}
-async function verifyBasicAuthorization(header) {
-	const value = Array.isArray(header) ? header[0] : header;
-	if (!value?.startsWith("Basic ")) return false;
-	let decoded = "";
-	try {
-		decoded = Buffer.from(value.slice(6), "base64").toString("utf8");
-	} catch {
-		return false;
-	}
-	const separatorIndex = decoded.indexOf(":");
-	if (separatorIndex < 0) return false;
-	return verifyPassword(decoded.slice(separatorIndex + 1));
-}
-function pockcodeAuthRealm() {
-	return "pockcode";
-}
-async function isRequestAuthorized(req) {
-	return verifyBasicAuthorization(req.headers.authorization);
-}
-async function verifyPassword(password) {
-	const config = await readAuthConfig();
-	if (!config) return false;
-	const expectedKey = Buffer.from(config.password.key, "base64");
-	const key = await scrypt$1(password, Buffer.from(config.password.salt, "base64"), config.password.keyLength, config.password.scrypt);
-	return key.length === expectedKey.length && timingSafeEqual(key, expectedKey);
-}
-async function readAuthConfig() {
-	if (authConfigCache !== void 0) return authConfigCache;
-	const authPath = resolvePockcodeAuthPath();
-	try {
-		authConfigCache = readConfig(JSON.parse(await readFile(authPath, "utf8")));
-	} catch {
-		authConfigCache = null;
-	}
-	return authConfigCache;
-}
-function readConfig(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = value;
-	const password = record.password;
-	if (record.version !== 1 || !password || password.algorithm !== "scrypt" || typeof password.key !== "string" || typeof password.salt !== "string" || typeof password.keyLength !== "number" || !password.scrypt || typeof password.scrypt.N !== "number" || typeof password.scrypt.r !== "number" || typeof password.scrypt.p !== "number") return null;
-	return record;
-}
-//#endregion
-export { hasConfiguredPassword, isRequestAuthorized, pockcodeAuthRealm, setupPassword, verifyBasicAuthorization };