termdock 1.4.238 → 1.4.240

package/dist/server/cli.js

@@ -20,6 +20,7 @@ import { detectLocalSessionContext, resolveLocalCollaborationContext } from './a
 import { parseAutomationCommand, executeAutomationCommand, AUTOMATION_HELP } from './agent/automationCli.js';
 import { parseCollaborationCommand, executeCollaborationCommand, COLLAB_HELP } from './agent/collaborationCli.js';
 import fs from 'fs';
+import { getMissingCertificateNames } from './utils/certificateNames.js';
 import http from 'http';
 import https from 'https';
 import path from 'path';
@@ -417,50 +418,10 @@ function getRequiredLocalHttpsNames() {
         '::1',
     ];
 }
-async function readCertificateSans(certPath) {
-    try {
-        const { stdout } = await execFileAsync('openssl', ['x509', '-in', certPath, '-noout', '-ext', 'subjectAltName'], {
-            timeout: 5000,
-            maxBuffer: 256 * 1024,
-        });
-        return stdout
-            .split(/[\n,]/)
-            .map((part) => part.trim())
-            .filter(Boolean);
-    }
-    catch {
-        return [];
-    }
-}
-function sanMatches(required, sans) {
-    if (/^\d+\.\d+\.\d+\.\d+$/.test(required)) {
-        return sans.some((san) => san === `IP Address:${required}` || san === `IP:${required}`);
-    }
-    if (required.includes(':')) {
-        const normalizeIpv6 = (value) => {
-            const [left = '', right = ''] = value.toLowerCase().split('::');
-            const leftGroups = left ? left.split(':') : [];
-            const rightGroups = right ? right.split(':') : [];
-            const missing = Math.max(0, 8 - leftGroups.length - rightGroups.length);
-            return [...leftGroups, ...Array(missing).fill('0'), ...rightGroups]
-                .map((group) => Number.parseInt(group || '0', 16).toString(16))
-                .join(':');
-        };
-        const normalizedRequired = normalizeIpv6(required);
-        return sans.some((san) => {
-            const match = /^(?:IP Address|IP):(.+)$/.exec(san);
-            return match ? normalizeIpv6(match[1]) === normalizedRequired : false;
-        });
-    }
-    return sans.some((san) => san === `DNS:${required}`);
-}
 async function defaultCertificateNeedsRefresh() {
     if (!fileExists(defaultHttpsCertPath) || !fileExists(defaultHttpsKeyPath))
         return true;
-    const sans = await readCertificateSans(defaultHttpsCertPath);
-    if (sans.length === 0)
-        return true;
-    return getRequiredLocalHttpsNames().some((name) => !sanMatches(name, sans));
+    return (await getMissingCertificateNames(defaultHttpsCertPath, getRequiredLocalHttpsNames())).length > 0;
 }
 async function ensureDefaultHttpsCertificateFresh() {
     if (!(await defaultCertificateNeedsRefresh()))

package/dist/server/routes/filesystem.js

@@ -10,7 +10,7 @@ import busboy from 'busboy';
 import { validatePreview } from '../utils/previewValidation.js';
 import { pathValidator } from '../utils/pathValidator.js';
 import { isAuthEnabled, isRequestAuthenticated } from '../utils/authProtection.js';
-import { isEncryptedRequest } from '../federation/requestContext.js';
+import { encryptedRequestSubject, isEncryptedRequest } from '../federation/requestContext.js';
 import { getImageDimensions, parseImageDimensions } from '../utils/imageDimensions.js';
 import { writeDiffTraceLog, writeErrorLog, writeJsonLog } from '../utils/serverLogger.js';
 import { clearBranchAuditRecords, clearChangeAuditRecords, listBranchAuditRecords, listChangeAuditRecords, buildChangeAuditFingerprint } from '../utils/changeAuditStore.js';
@@ -3580,20 +3580,23 @@ export function isPathWithinPreviewRoot(root, targetPath) {
     const prefix = resolvedRoot.endsWith(path.sep) ? resolvedRoot : `${resolvedRoot}${path.sep}`;
     return resolvedTarget === resolvedRoot || resolvedTarget.startsWith(prefix);
 }
-// Absolute expiration and owner-session validation prevent indefinite bearer access.
-export function validatePreviewToken(token, targetPath) {
+// Device tokens require the verified channel on every read; its runtime rechecks
+// current authorization. Legacy cookie tokens retain their session validation.
+export function validatePreviewToken(token, targetPath, subjectId) {
     const entry = previewTokens.get(token);
     if (!entry)
         return false;
-    if (entry.expiresAt <= Date.now() || (entry.ownerSession ? !isSessionValid(entry.ownerSession) : isAuthEnabled())) {
+    if (entry.expiresAt <= Date.now() || (!entry.ownerSubject && (entry.ownerSession ? !isSessionValid(entry.ownerSession) : isAuthEnabled()))) {
         previewTokens.delete(token);
         return false;
     }
+    if (entry.ownerSubject && entry.ownerSubject !== subjectId)
+        return false;
     if (!isPathWithinPreviewRoot(entry.root, targetPath))
         return false;
     return true;
 }
-export function mintPreviewToken(root, ownerSession) {
+export function mintPreviewToken(root, ownerSession, ownerSubject) {
     const now = Date.now();
     for (const [token, entry] of previewTokens) {
         if (entry.expiresAt < now)
@@ -3602,7 +3605,7 @@ export function mintPreviewToken(root, ownerSession) {
     if (previewTokens.size >= 128)
         previewTokens.delete(previewTokens.keys().next().value);
     const token = crypto.randomBytes(16).toString('hex');
-    previewTokens.set(token, { root: path.resolve(root), expiresAt: now + PREVIEW_TOKEN_TTL_MS, ownerSession });
+    previewTokens.set(token, { root: path.resolve(root), expiresAt: now + PREVIEW_TOKEN_TTL_MS, ownerSession, ownerSubject });
     return token;
 }
 function tokenizePreviewUrl(previewBaseUrl, token) {
@@ -3664,6 +3667,7 @@ router.get('/preview/*path', async (req, res) => {
         // injected <base> so it always equals the document URL.
         const previewBaseUrl = req.originalUrl.split('?', 1)[0];
         const authEnabled = isAuthEnabled();
+        const subjectId = encryptedRequestSubject(req);
         // Token requests carry their own credential in the URL. Document requests
         // must present the session cookie before we mint a token for them.
         if (!maybeToken && authEnabled && !isRequestAuthenticated(req)) {
@@ -3672,13 +3676,13 @@ router.get('/preview/*path', async (req, res) => {
         }
         if (maybeToken) {
             const entry = previewTokens.get(maybeToken);
-            if (!entry || !validatePreviewToken(maybeToken, entry.root)) {
+            if (!entry || !validatePreviewToken(maybeToken, entry.root, subjectId)) {
                 res.status(403).json({ error: 'Preview token invalid or expired', code: 'PREVIEW_TOKEN_INVALID' });
                 return;
             }
         }
         const validatedPath = await pathValidator.validatePathAsync(requestedPath);
-        if (maybeToken && !validatePreviewToken(maybeToken, validatedPath)) {
+        if (maybeToken && !validatePreviewToken(maybeToken, validatedPath, subjectId)) {
             res.status(403).json({ error: 'Preview path outside token scope', code: 'PREVIEW_TOKEN_INVALID' });
             return;
         }
@@ -3708,10 +3712,10 @@ router.get('/preview/*path', async (req, res) => {
         // relative reference the document makes.
         if ((authEnabled || isEncryptedRequest(req)) && !maybeToken) {
             const root = stat.isDirectory() ? validatedPath : path.dirname(validatedPath);
-            const tokenized = tokenizePreviewUrl(previewBaseUrl, mintPreviewToken(root, req.cookies?.[AUTH_COOKIE]));
+            const tokenized = tokenizePreviewUrl(previewBaseUrl, mintPreviewToken(root, req.cookies?.[AUTH_COOKIE], subjectId));
             redirectUrl = stat.isDirectory() && !previewBaseUrl.endsWith('/') ? `${tokenized}/` : tokenized;
         }
-        if (maybeToken && !validatePreviewToken(maybeToken, targetPath)) {
+        if (maybeToken && !validatePreviewToken(maybeToken, targetPath, subjectId)) {
             res.status(403).json({ error: 'Preview token invalid or expired', code: 'PREVIEW_TOKEN_INVALID' });
             return;
         }
@@ -3723,7 +3727,7 @@ router.get('/preview/*path', async (req, res) => {
             res.status(400).json({ error: 'Path is not a file' });
             return;
         }
-        if (maybeToken && !validatePreviewToken(maybeToken, targetPath)) {
+        if (maybeToken && !validatePreviewToken(maybeToken, targetPath, subjectId)) {
             res.status(403).json({ error: 'Preview token invalid or expired', code: 'PREVIEW_TOKEN_INVALID' });
             return;
         }

package/dist/server/utils/certificateNames.js

@@ -0,0 +1,12 @@
+import { X509Certificate } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { isIP } from 'node:net';
+// Use Node's certificate parser: the system openssl (notably LibreSSL on
+// macOS) may not support `x509 -ext`. Propagate read/parse errors so callers
+// cannot mistake an inspection failure for an empty SAN extension.
+export async function getMissingCertificateNames(certPath, required) {
+    const cert = new X509Certificate(await readFile(certPath));
+    return required.filter((name) => isIP(name)
+        ? cert.checkIP(name) === undefined
+        : cert.checkHost(name, { subject: 'never', wildcards: false }) === undefined);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "termdock",
-  "version": "1.4.238",
+  "version": "1.4.240",
   "description": "A complete web-based terminal application with modern UI",
   "type": "module",
   "main": ".desktop-dist/main.js",

package/runtime-manifest.json

@@ -1,13 +1,13 @@
 {
   "schemaVersion": 1,
   "packageName": "termdock",
-  "version": "1.4.238",
+  "version": "1.4.240",
   "runtimeProtocolVersion": 1,
   "minimumDesktopVersion": "1.4.46",
   "nodeMajor": 22,
   "dependencyHash": "sha256-K4KyYJuVoQDpZsBM8ZX1Rw3MddOxAzVdp/cPm0iGZz0=",
-  "serverBundleHash": "sha256-nRIwkH5+bg0aR08alnrQVcN5Q10duk4wtzWPNtdJAFU=",
-  "clientBundleHash": "sha256-Qcd7LDUxj1WE6Rx2N39EUwN6bFFgSHPIPtJQ/YmyeBk=",
+  "serverBundleHash": "sha256-OjLwoxfVNp7VlqCwrjCUGgjj0Yb3zlTm1sdlQGCGYIs=",
+  "clientBundleHash": "sha256-1wPbozETRlatzFMaBkX5wcha5zbSwUdAw4I0XckzdLk=",
   "entrypoint": "dist/server/cli.js",
   "clientEntrypoint": "dist/client/index.html"
 }