search-rotation 0.4.9

package/dist/web/app.js

@@ -0,0 +1,155 @@
+import { Hono } from "hono";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+import { maskKey } from "../status.js";
+import { VERSION } from "../version.js";
+const staticDir = fileURLToPath(new URL("../../static/", import.meta.url));
+function publicConfig(cfg, adapters) {
+    return {
+        version: 1,
+        engines: cfg.engines.map((e) => {
+            const meta = adapters.find((a) => a.meta.id === e.id)?.meta;
+            return {
+                id: e.id,
+                enabled: e.enabled,
+                hasKey: Boolean(e.apiKey),
+                keyMasked: maskKey(e.apiKey),
+                extrasSet: Object.fromEntries((meta?.extraFields ?? []).map((f) => [f.key, Boolean(e.extra?.[f.key])])),
+            };
+        }),
+        fetchOrder: cfg.fetchOrder,
+        settings: { port: cfg.settings.port, tokenSet: Boolean(cfg.settings.token),
+            defaultNumResults: cfg.settings.defaultNumResults === undefined ? 8 : cfg.settings.defaultNumResults,
+            strictFreeMode: cfg.settings.strictFreeMode ?? false, requestTimeoutMs: cfg.settings.requestTimeoutMs ?? 60_000,
+            monthlyLimits: cfg.settings.monthlyLimits, dailyLimits: cfg.settings.dailyLimits ?? {} },
+        enginesMeta: adapters.map((a) => a.meta),
+    };
+}
+export function buildWebApp(deps) {
+    const app = new Hono();
+    const serve = (file, type) => (c) => c.body(readFileSync(path.join(staticDir, file), "utf8"), 200, {
+        "content-type": type,
+        // Lokales Dashboard: Statics immer frisch validieren — sonst sieht
+        // man nach Updates hartnäckig die alte Version aus dem Browser-Cache.
+        "cache-control": "no-cache",
+    });
+    app.get("/", serve("index.html", "text/html; charset=utf-8"));
+    app.get("/app.js", serve("app.js", "text/javascript; charset=utf-8"));
+    app.get("/i18n.js", serve("i18n.js", "text/javascript; charset=utf-8"));
+    app.get("/style.css", serve("style.css", "text/css; charset=utf-8"));
+    // Exact routes only: never use a request path to read arbitrary static files.
+    for (const id of ["tavily", "firecrawl", "parallel", "exa", "google-cse", "jina", "duckduckgo"]) {
+        app.get(`/engine-logos/${id}.png`, c => c.body(readFileSync(path.join(staticDir, "engine-logos", `${id}.png`)), 200, { "content-type": "image/png", "cache-control": "no-cache" }));
+    }
+    app.get("/api/meta", (c) => c.json({ version: VERSION, configPath: deps.configPath, month: deps.month() }));
+    app.get("/api/config", (c) => c.json(publicConfig(deps.getConfig(), deps.adapters)));
+    app.put("/api/config", async (c) => {
+        const body = await c.req.json().catch(() => null);
+        if (!body || !Array.isArray(body.engines))
+            return c.json({ error: "engines[] erwartet" }, 400);
+        const cfg = deps.getConfig();
+        const known = new Map(deps.adapters.map((a) => [a.meta.id, a]));
+        // Engines zusammenführen. apiKey: undefined/"" = unverändert, null = löschen, string = setzen.
+        const merged = body.engines
+            .filter((e) => known.has(e?.id))
+            .map((e) => {
+            const prev = cfg.engines.find((x) => x.id === e.id);
+            const next = {
+                id: e.id,
+                enabled: typeof e.enabled === "boolean" ? e.enabled : prev?.enabled ?? true,
+                apiKey: e.apiKey === null
+                    ? undefined
+                    : typeof e.apiKey === "string" && e.apiKey.trim()
+                        ? e.apiKey.trim()
+                        : prev?.apiKey,
+            };
+            const meta = known.get(e.id).meta;
+            if (meta.keyless === "no" && !next.apiKey)
+                next.enabled = false;
+            if (meta.extraFields?.length) {
+                const extra = { ...(prev?.extra ?? {}) };
+                for (const f of meta.extraFields) {
+                    const v = e.extra?.[f.key];
+                    if (v === null)
+                        delete extra[f.key];
+                    else if (typeof v === "string" && v.trim())
+                        extra[f.key] = v.trim();
+                }
+                if (Object.keys(extra).length > 0)
+                    next.extra = extra;
+            }
+            return next;
+        });
+        for (const a of deps.adapters) {
+            if (!merged.some((m) => m.id === a.meta.id)) {
+                const prev = cfg.engines.find((x) => x.id === a.meta.id);
+                merged.push(prev ?? { id: a.meta.id, enabled: a.meta.defaultEnabled ?? a.meta.keyless === "ip" });
+            }
+        }
+        const fetchCapable = new Set(deps.adapters.filter((a) => a.meta.capabilities.includes("fetch")).map((a) => a.meta.id));
+        const fo = Array.isArray(body.fetchOrder)
+            ? body.fetchOrder.filter((id) => typeof id === "string" && fetchCapable.has(id))
+            : [];
+        for (const id of cfg.fetchOrder) {
+            if (!fo.includes(id))
+                fo.push(id);
+        }
+        const settings = { ...cfg.settings };
+        if (typeof body.settings?.port === "number" &&
+            body.settings.port >= 1024 &&
+            body.settings.port <= 65535) {
+            settings.port = body.settings.port;
+        }
+        if (typeof body.settings?.strictFreeMode === "boolean")
+            settings.strictFreeMode = body.settings.strictFreeMode;
+        if (body.settings && Object.hasOwn(body.settings, "defaultNumResults")) {
+            const value = body.settings.defaultNumResults;
+            if (value !== null && !(Number.isInteger(value) && value >= 1 && value <= 20))
+                return c.json({ error: "defaultNumResults must be null (provider default) or an integer from 1 to 20" }, 400);
+            settings.defaultNumResults = value;
+        }
+        if (Number.isInteger(body.settings?.requestTimeoutMs) && body.settings.requestTimeoutMs >= 1000 && body.settings.requestTimeoutMs <= 300_000)
+            settings.requestTimeoutMs = body.settings.requestTimeoutMs;
+        for (const field of ["dailyLimits", "monthlyLimits"]) {
+            const limits = body.settings?.[field];
+            if (limits && typeof limits === "object" && !Array.isArray(limits)) {
+                settings[field] = Object.fromEntries(Object.entries(limits).filter(([, v]) => typeof v === "number" && Number.isFinite(v) && v >= 0));
+            }
+        }
+        if (body.settings?.token === null)
+            settings.token = "";
+        else if (typeof body.settings?.token === "string")
+            settings.token = body.settings.token.trim();
+        const requiresRestart = settings.token !== cfg.settings.token || settings.port !== cfg.settings.port;
+        deps.saveConfig({ version: 1, engines: merged, fetchOrder: [...new Set(fo)], settings });
+        return c.json({ ok: true, requiresRestart, config: publicConfig(deps.getConfig(), deps.adapters) });
+    });
+    app.get("/api/status", async (c) => c.json({
+        version: VERSION,
+        month: deps.month(),
+        configPath: deps.configPath,
+        engines: await deps.status(),
+    }));
+    app.get("/api/history", (c) => {
+        // Number("") wäre 0 — deshalb explizit > 0 prüfen
+        const n = Number(c.req.query("limit") ?? 50);
+        const limit = Number.isFinite(n) && n > 0 ? n : 50;
+        return c.json({ entries: deps.historyList(limit) });
+    });
+    app.delete("/api/history", (c) => {
+        deps.historyClear();
+        return c.json({ ok: true });
+    });
+    app.post("/api/test", async (c) => {
+        const body = await c.req.json().catch(() => null);
+        const id = body?.id;
+        const kind = body?.kind === "fetch" ? "fetch" : "search";
+        if (typeof id !== "string" || !deps.adapters.some((a) => a.meta.id === id)) {
+            return c.json({ error: "unbekannte Engine" }, 400);
+        }
+        const arg = String(body?.arg ?? (kind === "search" ? "model context protocol" : "https://example.com"));
+        return c.json(await deps.testEngine(id, kind, arg, c.req.raw.signal));
+    });
+    return app;
+}

package/dist/web/security.js

@@ -0,0 +1,116 @@
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { bodyLimit } from 'hono/body-limit';
+import { getCookie, setCookie } from 'hono/cookie';
+const COOKIE = 'sr_session';
+const SESSION_MS = 8 * 60 * 60 * 1000;
+const publicFiles = new Set(['/app.js', '/i18n.js', '/style.css']);
+function equal(a, b) {
+    const left = Buffer.from(a), right = Buffer.from(b);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+export function mountSecurity(app, options) {
+    const origins = [...new Set([options.origin, ...(options.additionalOrigins ?? [])].map(o => new URL(o).origin))];
+    const allowedHosts = origins.map(o => new URL(o).host);
+    const tickets = new Map();
+    const sessions = new Map();
+    const failures = [];
+    const prune = (map) => {
+        for (const [key, expiry] of map)
+            if (expiry <= Date.now())
+                map.delete(key);
+    };
+    const session = (c) => {
+        prune(sessions);
+        if (sessions.size >= 100)
+            sessions.delete(sessions.keys().next().value);
+        const id = randomBytes(32).toString('base64url');
+        sessions.set(id, Date.now() + SESSION_MS);
+        setCookie(c, COOKIE, id, { httpOnly: true, sameSite: 'Strict', secure: new URL(options.origin).protocol === 'https:', path: '/', maxAge: SESSION_MS / 1000 });
+        return c.redirect('/', 303);
+    };
+    app.use('*', async (c, next) => {
+        c.header('Referrer-Policy', 'no-referrer');
+        c.header('X-Content-Type-Options', 'nosniff');
+        c.header('X-Frame-Options', 'DENY');
+        c.header('Cache-Control', 'no-store');
+        const url = new URL(c.req.url);
+        const host = c.req.header('host') ?? url.host;
+        if (!allowedHosts.includes(host) || !allowedHosts.includes(url.host))
+            return c.text('Host nicht erlaubt', 403);
+        const origin = c.req.header('origin');
+        if (origin && !origins.includes(origin))
+            return c.text('Origin nicht erlaubt', 403);
+        if (c.req.header('sec-fetch-site') === 'cross-site')
+            return c.text('Cross-site request nicht erlaubt', 403);
+        await next();
+    });
+    app.use('*', bodyLimit({ maxSize: 64 * 1024, onError: c => c.json({ error: 'Request zu groß (max. 64 KiB)' }, 413) }));
+    app.use('*', async (c, next) => {
+        const pathname = c.req.path;
+        if (options.dashboardEnabled === false && pathname !== '/mcp')
+            return c.notFound();
+        if (pathname === '/login' || publicFiles.has(pathname))
+            return next();
+        if (options.token) {
+            const bearer = c.req.header('authorization')?.match(/^Bearer\s+(.+)$/i)?.[1] ?? '';
+            prune(sessions);
+            // MCP remains bearer-only; browser sessions authorize dashboard APIs.
+            const validSession = pathname !== '/mcp' && sessions.has(getCookie(c, COOKIE) ?? '');
+            if (!equal(bearer, options.token) && !validSession) {
+                if (pathname === '/')
+                    return c.redirect('/login', 303);
+                return c.json({ error: 'Anmeldung erforderlich', login: '/login' }, 401);
+            }
+        }
+        if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(c.req.method) && (pathname.startsWith('/api/') || pathname === '/mcp')) {
+            const type = c.req.header('content-type')?.split(';')[0].trim().toLowerCase();
+            // DELETE without a body does not need a media type.
+            if (c.req.method !== 'DELETE' && type !== 'application/json')
+                return c.json({ error: 'application/json erforderlich' }, 415);
+        }
+        await next();
+    });
+    app.get('/login', c => {
+        if (!options.token)
+            return c.redirect('/', 303);
+        const ticket = c.req.query('ticket');
+        if (ticket) {
+            prune(tickets);
+            if (!tickets.delete(ticket))
+                return c.text('Anmeldelink abgelaufen oder bereits verwendet', 401);
+            return session(c);
+        }
+        return c.html('<!doctype html><html lang="de"><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>search-rotation Anmeldung</title><body><main><h1>search-rotation</h1><p>Mit dem konfigurierten Server-Token anmelden.</p><form method="post" action="/login"><label>Token <input type="password" name="token" required autocomplete="current-password" maxlength="4096"></label> <button>Anmelden</button></form></main></body></html>');
+    });
+    app.post('/login', async (c) => {
+        if (!options.token)
+            return c.redirect('/', 303);
+        if (!c.req.header('origin') || !origins.includes(c.req.header('origin')))
+            return c.text('Origin erforderlich', 403);
+        if (c.req.header('content-type')?.split(';')[0].trim() !== 'application/x-www-form-urlencoded')
+            return c.text('Formular erwartet', 415);
+        while (failures.length && failures[0] < Date.now() - 60000)
+            failures.shift();
+        if (failures.length >= 10)
+            return c.text('Zu viele Anmeldeversuche. In einer Minute erneut versuchen.', 429);
+        const body = await c.req.parseBody();
+        if (typeof body.token !== 'string' || !equal(body.token, options.token)) {
+            failures.push(Date.now());
+            return c.text('Token falsch', 401);
+        }
+        return session(c);
+    });
+    return {
+        allowedHosts, allowedOrigins: origins,
+        browserUrl: () => {
+            if (!options.token)
+                return options.origin + '/';
+            prune(tickets);
+            if (tickets.size >= 20)
+                tickets.delete(tickets.keys().next().value);
+            const ticket = randomBytes(32).toString('base64url');
+            tickets.set(ticket, Date.now() + 60000);
+            return options.origin + '/login?ticket=' + ticket;
+        },
+    };
+}

package/docs/assets/brand/FONT-LICENSE.txt

@@ -0,0 +1,93 @@
+Copyright 2018 The Manrope Project Authors (https://github.com/sharanda/manrope)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

package/docs/assets/brand/README.md

@@ -0,0 +1,18 @@
+# Search Rotation identity
+
+The existing dashboard logo: an open orbit with a central dot. Geometry matches `#i-logo` in `static/index.html`; colors match the theme accents in `static/style.css`.
+
+- `icon.svg`: transparent primary symbol, using the light-background palette.
+- `icon-dark.svg` / `icon-light.svg`: solid tiles for avatars.
+- `icon-mono.svg`: single-color symbol; inherits `currentColor` when inlined.
+- `wordmark-dark.svg` / `wordmark-light.svg`: outlined lettering for dark / light backgrounds.
+- `icon-dark-128.png` / `icon-light-128.png`: transparent, theme-specific MCP server icons, embedded as data URIs during initialization.
+- Other PNG exports: 32, 128, and 512 px primary icons; 512 px tiles.
+- `preview.png`: overview with small-size samples.
+
+Dark-theme gradient: `#8b7cf7` → `#4dd8e6`.
+Light-theme gradient: `#6d5ae8` → `#0e95b3`.
+
+Preserve the open ring, central dot, orientation, and proportions. Keep clear space around the symbol. MCP clients decide whether and where server icons are displayed; providing metadata does not guarantee a visible icon in every client.
+
+The original symbol is covered by the repository's MIT license. The wordmark uses outlined Manrope lettering (SIL Open Font License; see `FONT-LICENSE.txt`); no font installation is required to display it.

package/docs/assets/brand/icon-dark.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="256" height="256" viewBox="0 0 256 256" role="img" aria-label="Search Rotation"><rect width="256" height="256" rx="58" fill="#0a0c12"/><g transform="scale(8)"><defs><linearGradient id="logo-grad" x1="0" y1="0" x2="1" y2="1"><stop stop-color="#8b7cf7"/><stop offset="1" stop-color="#4dd8e6"/></linearGradient></defs><circle cx="16" cy="16" r="12.5" fill="none" stroke="url(#logo-grad)" stroke-width="3.2" stroke-dasharray="58 21" stroke-linecap="round"/><circle cx="16" cy="16" r="4" fill="url(#logo-grad)"/></g></svg>

package/docs/assets/brand/icon-light.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="256" height="256" viewBox="0 0 256 256" role="img" aria-label="Search Rotation"><rect width="256" height="256" rx="58" fill="#f4f5fa"/><g transform="scale(8)"><defs><linearGradient id="logo-grad" x1="0" y1="0" x2="1" y2="1"><stop stop-color="#6d5ae8"/><stop offset="1" stop-color="#0e95b3"/></linearGradient></defs><circle cx="16" cy="16" r="12.5" fill="none" stroke="url(#logo-grad)" stroke-width="3.2" stroke-dasharray="58 21" stroke-linecap="round"/><circle cx="16" cy="16" r="4" fill="url(#logo-grad)"/></g></svg>

package/docs/assets/brand/icon-mono.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="256" height="256" viewBox="0 0 256 256" role="img" aria-label="Search Rotation"><g transform="scale(8)"><defs><linearGradient id="logo-grad" x1="0" y1="0" x2="1" y2="1"><stop stop-color="#8b7cf7"/><stop offset="1" stop-color="#4dd8e6"/></linearGradient></defs><circle cx="16" cy="16" r="12.5" fill="none" stroke="currentColor" stroke-width="3.2" stroke-dasharray="58 21" stroke-linecap="round"/><circle cx="16" cy="16" r="4" fill="currentColor"/></g></svg>

package/docs/assets/brand/icon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="256" height="256" viewBox="0 0 256 256" role="img" aria-label="Search Rotation"><g transform="scale(8)"><defs><linearGradient id="logo-grad" x1="0" y1="0" x2="1" y2="1"><stop stop-color="#6d5ae8"/><stop offset="1" stop-color="#0e95b3"/></linearGradient></defs><circle cx="16" cy="16" r="12.5" fill="none" stroke="url(#logo-grad)" stroke-width="3.2" stroke-dasharray="58 21" stroke-linecap="round"/><circle cx="16" cy="16" r="4" fill="url(#logo-grad)"/></g></svg>