termdock 1.4.238 → 1.4.239

package/dist/server/routes/filesystem.js

@@ -10,7 +10,7 @@ import busboy from 'busboy';
 import { validatePreview } from '../utils/previewValidation.js';
 import { pathValidator } from '../utils/pathValidator.js';
 import { isAuthEnabled, isRequestAuthenticated } from '../utils/authProtection.js';
-import { isEncryptedRequest } from '../federation/requestContext.js';
+import { encryptedRequestSubject, isEncryptedRequest } from '../federation/requestContext.js';
 import { getImageDimensions, parseImageDimensions } from '../utils/imageDimensions.js';
 import { writeDiffTraceLog, writeErrorLog, writeJsonLog } from '../utils/serverLogger.js';
 import { clearBranchAuditRecords, clearChangeAuditRecords, listBranchAuditRecords, listChangeAuditRecords, buildChangeAuditFingerprint } from '../utils/changeAuditStore.js';
@@ -3580,20 +3580,23 @@ export function isPathWithinPreviewRoot(root, targetPath) {
     const prefix = resolvedRoot.endsWith(path.sep) ? resolvedRoot : `${resolvedRoot}${path.sep}`;
     return resolvedTarget === resolvedRoot || resolvedTarget.startsWith(prefix);
 }
-// Absolute expiration and owner-session validation prevent indefinite bearer access.
-export function validatePreviewToken(token, targetPath) {
+// Device tokens require the verified channel on every read; its runtime rechecks
+// current authorization. Legacy cookie tokens retain their session validation.
+export function validatePreviewToken(token, targetPath, subjectId) {
     const entry = previewTokens.get(token);
     if (!entry)
         return false;
-    if (entry.expiresAt <= Date.now() || (entry.ownerSession ? !isSessionValid(entry.ownerSession) : isAuthEnabled())) {
+    if (entry.expiresAt <= Date.now() || (!entry.ownerSubject && (entry.ownerSession ? !isSessionValid(entry.ownerSession) : isAuthEnabled()))) {
         previewTokens.delete(token);
         return false;
     }
+    if (entry.ownerSubject && entry.ownerSubject !== subjectId)
+        return false;
     if (!isPathWithinPreviewRoot(entry.root, targetPath))
         return false;
     return true;
 }
-export function mintPreviewToken(root, ownerSession) {
+export function mintPreviewToken(root, ownerSession, ownerSubject) {
     const now = Date.now();
     for (const [token, entry] of previewTokens) {
         if (entry.expiresAt < now)
@@ -3602,7 +3605,7 @@ export function mintPreviewToken(root, ownerSession) {
     if (previewTokens.size >= 128)
         previewTokens.delete(previewTokens.keys().next().value);
     const token = crypto.randomBytes(16).toString('hex');
-    previewTokens.set(token, { root: path.resolve(root), expiresAt: now + PREVIEW_TOKEN_TTL_MS, ownerSession });
+    previewTokens.set(token, { root: path.resolve(root), expiresAt: now + PREVIEW_TOKEN_TTL_MS, ownerSession, ownerSubject });
     return token;
 }
 function tokenizePreviewUrl(previewBaseUrl, token) {
@@ -3664,6 +3667,7 @@ router.get('/preview/*path', async (req, res) => {
         // injected <base> so it always equals the document URL.
         const previewBaseUrl = req.originalUrl.split('?', 1)[0];
         const authEnabled = isAuthEnabled();
+        const subjectId = encryptedRequestSubject(req);
         // Token requests carry their own credential in the URL. Document requests
         // must present the session cookie before we mint a token for them.
         if (!maybeToken && authEnabled && !isRequestAuthenticated(req)) {
@@ -3672,13 +3676,13 @@ router.get('/preview/*path', async (req, res) => {
         }
         if (maybeToken) {
             const entry = previewTokens.get(maybeToken);
-            if (!entry || !validatePreviewToken(maybeToken, entry.root)) {
+            if (!entry || !validatePreviewToken(maybeToken, entry.root, subjectId)) {
                 res.status(403).json({ error: 'Preview token invalid or expired', code: 'PREVIEW_TOKEN_INVALID' });
                 return;
             }
         }
         const validatedPath = await pathValidator.validatePathAsync(requestedPath);
-        if (maybeToken && !validatePreviewToken(maybeToken, validatedPath)) {
+        if (maybeToken && !validatePreviewToken(maybeToken, validatedPath, subjectId)) {
             res.status(403).json({ error: 'Preview path outside token scope', code: 'PREVIEW_TOKEN_INVALID' });
             return;
         }
@@ -3708,10 +3712,10 @@ router.get('/preview/*path', async (req, res) => {
         // relative reference the document makes.
         if ((authEnabled || isEncryptedRequest(req)) && !maybeToken) {
             const root = stat.isDirectory() ? validatedPath : path.dirname(validatedPath);
-            const tokenized = tokenizePreviewUrl(previewBaseUrl, mintPreviewToken(root, req.cookies?.[AUTH_COOKIE]));
+            const tokenized = tokenizePreviewUrl(previewBaseUrl, mintPreviewToken(root, req.cookies?.[AUTH_COOKIE], subjectId));
             redirectUrl = stat.isDirectory() && !previewBaseUrl.endsWith('/') ? `${tokenized}/` : tokenized;
         }
-        if (maybeToken && !validatePreviewToken(maybeToken, targetPath)) {
+        if (maybeToken && !validatePreviewToken(maybeToken, targetPath, subjectId)) {
             res.status(403).json({ error: 'Preview token invalid or expired', code: 'PREVIEW_TOKEN_INVALID' });
             return;
         }
@@ -3723,7 +3727,7 @@ router.get('/preview/*path', async (req, res) => {
             res.status(400).json({ error: 'Path is not a file' });
             return;
         }
-        if (maybeToken && !validatePreviewToken(maybeToken, targetPath)) {
+        if (maybeToken && !validatePreviewToken(maybeToken, targetPath, subjectId)) {
             res.status(403).json({ error: 'Preview token invalid or expired', code: 'PREVIEW_TOKEN_INVALID' });
             return;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "termdock",
-  "version": "1.4.238",
+  "version": "1.4.239",
   "description": "A complete web-based terminal application with modern UI",
   "type": "module",
   "main": ".desktop-dist/main.js",

package/runtime-manifest.json

@@ -1,13 +1,13 @@
 {
   "schemaVersion": 1,
   "packageName": "termdock",
-  "version": "1.4.238",
+  "version": "1.4.239",
   "runtimeProtocolVersion": 1,
   "minimumDesktopVersion": "1.4.46",
   "nodeMajor": 22,
   "dependencyHash": "sha256-K4KyYJuVoQDpZsBM8ZX1Rw3MddOxAzVdp/cPm0iGZz0=",
-  "serverBundleHash": "sha256-nRIwkH5+bg0aR08alnrQVcN5Q10duk4wtzWPNtdJAFU=",
-  "clientBundleHash": "sha256-Qcd7LDUxj1WE6Rx2N39EUwN6bFFgSHPIPtJQ/YmyeBk=",
+  "serverBundleHash": "sha256-b2hW5XzG58ErGFDet7CETfl7sHtPoDhHjTnL3mzU63s=",
+  "clientBundleHash": "sha256-1wPbozETRlatzFMaBkX5wcha5zbSwUdAw4I0XckzdLk=",
   "entrypoint": "dist/server/cli.js",
   "clientEntrypoint": "dist/client/index.html"
 }