tinywebui 0.1.3 → 0.1.4

package/README.md

@@ -47,7 +47,7 @@ It comes pre-loaded with two TinySuite MCP servers, so a new install can already
 - **Hybrid local search** (BM25 plus a small on-device embedding model) over documents and past chats.
 - **Long chats that stay affordable.** Cache-friendly prefixes, one-time compaction of large tool results, and per-round token statistics.
 - **Automations.** Cron-scheduled prompts that run in a chat of your choice.
-- **Private by default.** Interactive first runs ask for an owner password; a team can use an SSO gateway with roles and an admin panel.
+- **Private by default.** Local starts sign in with a one-time link from the terminal, network binds need a password, and a team can use an SSO gateway with roles and an admin panel.
 - **Managed from files.** Version-controlled config that hot-reloads, refuses typos and has a fingerprint you can check against a running instance.
 - **Themes.** Fall Fairy and Cyber Grid are included. See [theme authoring](public/themes/README.md) to write your own.
 
@@ -59,7 +59,7 @@ Requires **Node.js 22.13** or later. The bundled TinySearch and TinyContext serv
 npx tinywebui
 ```
 
-The first run asks you to create an owner password of at least 15 characters. Open <http://127.0.0.1:7777>, sign in, then connect a model. Put an endpoint and key in `tinywebui.config.json` (start from `example.tinywebui.config.json`) or use the Settings panel:
+There is no password to set up. The terminal prints a sign-in link (`http://127.0.0.1:7777/#token=…`); open it and the browser stays signed in. Only someone who can read that terminal gets in. Then connect a model. Put an endpoint and key in `tinywebui.config.json` (start from `example.tinywebui.config.json`) or use the Settings panel:
 
 ```json
 {
@@ -69,7 +69,7 @@ The first run asks you to create an owner password of at least 15 characters. Op
 }
 ```
 
-`tinywebui.config.json` holds your password hash and API keys and is gitignored. Keep it that way. Use `npx tinywebui set-password` to change the password later.
+`tinywebui.config.json` holds your API keys (and password hash, if you set one) and is gitignored. Keep it that way. Run `npx tinywebui set-password` to sign in with a password instead of the link; you need one to listen on anything other than loopback.
 
 `npx tinywebui` uses keyword search until you run `npx tinywebui models pull fast` (about 90 MB) to enable hybrid search.
 

package/bin/tinywebui.js

@@ -91,16 +91,6 @@ try {
     console.error(`[tinywebui] unknown command "${args[0]}" (see --help)`);
     process.exit(1);
   }
-  const { createConfigSource } = await import('../src/config/config.js');
-  const initial = createConfigSource(opts).load({ persistSecret: false });
-  if (initial.authMode === 'single' && !initial.authPassword && !process.env.TINYWEBUI_PASSWORD) {
-    if (!process.stdin.isTTY || !process.stdout.isTTY) {
-      throw new Error('owner password required: run `tinywebui set-password` in a terminal, or set TINYWEBUI_PASSWORD before starting');
-    }
-    const { setPassword } = await import('../src/set-password.js');
-    console.log('[tinywebui] Set an owner password before the first start.');
-    await setPassword(opts);
-  }
   const { start } = await import('../src/server.js');
   // Command-line flags beat the file; the file beats the built-in defaults.
   await start({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tinywebui",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "A small, local-first chat workspace for any OpenAI-compatible model, with MCP tools.",
   "type": "module",
   "repository": {

package/public/app.js

@@ -24,12 +24,32 @@ import { initAutomations, loadAutomations } from './panels/automations.js';
 import { loadUsage } from './panels/usage.js';
 import { initAdmin, loadAdmin } from './panels/admin.js';
 
-/** 'single' mode with no session: show the password screen and stop there. */
+/**
+ * 'single' mode with no session: trade a launch link's token for a session,
+ * or show the sign-in screen and stop there.
+ */
 async function needsLogin() {
+  const token = new URLSearchParams(location.hash.slice(1)).get('token');
+  // Off the address bar first, so it isn't bookmarked or shared by accident.
+  if (token) history.replaceState(null, '', location.pathname + location.search);
   const me = await loadAccess();
   if (me.authMode !== 'single' || me.user) return false;
+  if (token && me.login === 'link') {
+    try {
+      await api.post('/api/auth/login', { token });
+      location.reload();
+      return true;
+    } catch { /* stale link: fall through to the sign-in screen */ }
+  }
   const box = $('login');
   box.hidden = false;
+  if (me.login === 'link') {
+    $('loginForm').hidden = true;
+    $('loginLink').hidden = false;
+    // The link pasted into this same tab only changes the hash: start over.
+    addEventListener('hashchange', () => location.reload());
+    return true;
+  }
   $('loginPassword').focus();
   $('loginForm').onsubmit = async (e) => {
     e.preventDefault();

package/public/index.html

@@ -238,6 +238,10 @@
       <button class="primary" type="submit">Sign in</button>
       <div id="loginMsg" class="usage" role="alert"></div>
     </form>
+    <div id="loginLink" class="login-card" hidden>
+      <h2>TinyWebUI</h2>
+      <p>Open the sign-in link printed in the terminal where TinyWebUI is running.</p>
+    </div>
   </div>
 
   <section id="admin" aria-label="Admin">

package/public/styles.css

@@ -295,7 +295,7 @@ main { flex: 1; display: flex; flex-direction: column; min-width: 0; min-height:
 #login[hidden] { display:none; }
 .login-card { width:min(22rem,100%); display:flex; flex-direction:column; gap:.6rem; padding:1.5rem; border:1px solid var(--line); border-radius:var(--r-md); background:var(--raise); }
 .login-card h2 { margin:0 0 .5rem; }
-#loginMsg:empty { display:none; }
+#loginMsg:empty, .login-card[hidden] { display:none; }
 .admin-users { display:flex; flex-direction:column; gap:.4rem; }
 .admin-row { display:flex; flex-wrap:wrap; gap:.5rem .75rem; align-items:center; padding:.5rem 0; border-top:1px solid var(--line); font-size:var(--fs-meta); }
 .admin-row:first-child { border-top:0; }

package/src/access/policy.js

@@ -40,7 +40,7 @@ const DEFAULT_ROLES = {
 export const FILE_ONLY = new Set([
   'authMode', 'authPassword', 'sessionSecret', 'sessionTtlDays', 'trustedProxyCidrs', 'trustedUserIdHeader',
   'trustedEmailHeader', 'trustedNameHeader', 'trustedRoleHeader',
-  'logoutUrl', 'dbPath', 'access', 'allowedOrigins', 'frozen', 'autoMigrate', 'retrieval',
+  'logoutUrl', 'dbPath', 'access', 'allowedOrigins', 'allowedHosts', 'frozen', 'autoMigrate', 'retrieval',
   'googleClientId', 'googleClientSecret', 'googleRedirectUri', 'adminEmails'
 ]);
 
@@ -118,9 +118,7 @@ export function validateConfig(cfg, { env = process.env } = {}) {
   if (mode === 'single') {
     if (cfg.authPassword && !/^scrypt\$[0-9a-f]{32}\$[0-9a-f]{64}$/i.test(String(cfg.authPassword))) {
       errors.push('authPassword must be a hash: run `tinywebui set-password` or set $TINYWEBUI_PASSWORD');
-    } else if (!cfg.authPassword && !env.TINYWEBUI_PASSWORD) {
-      errors.push("authMode 'single' needs a password: run `tinywebui set-password` or set $TINYWEBUI_PASSWORD");
-    } else if (!cfg.authPassword && env.TINYWEBUI_PASSWORD.length < MIN_PASSWORD_LENGTH) {
+    } else if (!cfg.authPassword && env.TINYWEBUI_PASSWORD && env.TINYWEBUI_PASSWORD.length < MIN_PASSWORD_LENGTH) {
       errors.push(`TINYWEBUI_PASSWORD needs at least ${MIN_PASSWORD_LENGTH} characters`);
     }
   }

package/src/config/config.js

@@ -179,6 +179,9 @@ export const DEFAULTS = {
   // Extra origins allowed to send state-changing requests (e.g. an admin
   // tool on another host). The page's own origin is always allowed.
   allowedOrigins: [],
+  // Extra Host names answered when authMode is 'none' (e.g. a LAN name for a
+  // local-only install). Loopback names are always allowed.
+  allowedHosts: [],
   // false: refuse to start on a database that needs migrating; run
   // `tinywebui migrate` as its own deployment step instead.
   autoMigrate: true,

package/src/http.js

@@ -75,6 +75,20 @@ export function crossSite(req, cfg) {
   return req.headers['sec-fetch-site'] === 'cross-site';
 }
 
+/**
+ * DNS-rebinding guard. With no login, a hostile site can point its own name at
+ * 127.0.0.1 and pass the same-origin check above (Origin and Host both name it),
+ * so a no-login install only answers to loopback names and allowedHosts.
+ * Logged-in modes are safe: the attacker's origin has no session cookie.
+ */
+export function badHost(req, cfg) {
+  if (cfg.authMode !== 'none') return false;
+  let hostname;
+  try { hostname = new URL(`http://${req.headers.host}`).hostname.toLowerCase(); } catch { return true; }
+  if (hostname === 'localhost' || hostname.endsWith('.localhost') || hostname === '127.0.0.1' || hostname === '[::1]') return false;
+  return !(cfg.allowedHosts || []).some((h) => h.toLowerCase() === hostname);
+}
+
 export async function serveStatic(req, res) {
   // Resolve the index BEFORE normalising: on Windows normalize('/') returns a
   // lone backslash, so a check for '/' after it never matches and the root

package/src/routes/auth.js

@@ -1,3 +1,4 @@
+import { timingSafeEqual } from 'node:crypto';
 import { json, readJson } from '../http.js';
 import { isClosed, findEntry, labelFor } from '../config/models.js';
 import { modelsFor, fingerprint, resolveAccess } from '../access/policy.js';
@@ -12,7 +13,12 @@ import { FEATURE } from '../../public/shared/features.js';
 const LOGIN_MAX = 5;
 const LOGIN_WINDOW_MS = 15 * 60_000;
 
-export function authRoutes({ config, modelFor, multiUser, passwordHash, source, store, version }) {
+const sameSecret = (given, expected) => {
+  const a = Buffer.from(String(given ?? '')), b = Buffer.from(expected);
+  return a.length === b.length && timingSafeEqual(a, b);
+};
+
+export function authRoutes({ config, modelFor, multiUser, passwordHash, launchToken, source, store, version }) {
   const loginFailures = new Map();
 
   return [
@@ -22,6 +28,8 @@ export function authRoutes({ config, modelFor, multiUser, passwordHash, source,
       const model = signedIn ? modelFor(auth.user?.id, auth.role) : null;
       return json(res, 200, {
         authMode: cfg.authMode,
+        // How 'single' signs in: a password, or the link printed at startup.
+        login: cfg.authMode === 'single' ? (passwordHash() ? 'password' : 'link') : null,
         logoutUrl: cfg.logoutUrl || '',
         isAdmin: Boolean(auth.isAdmin),
         // What this person may personalise, and their saved instructions (multi-user only).
@@ -50,11 +58,14 @@ export function authRoutes({ config, modelFor, multiUser, passwordHash, source,
       if (entry && entry.count >= LOGIN_MAX) {
         return json(res, 429, { error: 'too many attempts, try again later' });
       }
-      const { password } = await readJson(req);
-      if (!verifyPassword(password, passwordHash())) {
+      const { password, token: given } = await readJson(req);
+      const hash = passwordHash();
+      // The launch link only stands in for a password that doesn't exist.
+      const ok = hash ? verifyPassword(password, hash) : Boolean(launchToken()) && sameSecret(given, launchToken());
+      if (!ok) {
         loginFailures.set(who, { first: entry?.first ?? now, count: (entry?.count ?? 0) + 1 });
-        audit('auth.rejected', { reason: 'bad_password' });
-        return json(res, 401, { error: 'wrong password' });
+        audit('auth.rejected', { reason: hash ? 'bad_password' : 'bad_launch_token' });
+        return json(res, 401, { error: hash ? 'wrong password' : 'open the sign-in link printed in the terminal' });
       }
       loginFailures.delete(who);
       const token = createSession(store, OWNER_ID, cfg.sessionTtlDays);

package/src/server.js

@@ -1,4 +1,5 @@
 import { createServer } from 'node:http';
+import { randomBytes } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
 import { watch, existsSync } from 'node:fs';
 import { dirname } from 'node:path';
@@ -12,7 +13,7 @@ import { hashPassword, applyAccessPolicy } from './access/auth.js';
 import { audit } from './audit.js';
 import { logger } from './log.js';
 import { resolveAuth, OWNER_ID } from './access/auth_gate.js';
-import { json, HttpError, SECURITY_HEADERS, crossSite, serveStatic } from './http.js';
+import { json, HttpError, SECURITY_HEADERS, crossSite, badHost, serveStatic } from './http.js';
 import { expandToolDef, callExpand } from './tools/context_tool.js';
 import { documentToolDef, callReadDocument } from './tools/document_tool.js';
 import { askToolDef, callAskUser } from './tools/ask_tool.js';
@@ -53,7 +54,7 @@ function routeTable(app) {
   const deps = {
     store: app.store, runs: app.runs, scheduler: app.scheduler, retrieval: app.retrieval,
     source: app.source, version: app.version,
-    config: () => app.cfg, hub: () => app.hub, passwordHash: () => app.passwordHash,
+    config: () => app.cfg, hub: () => app.hub, passwordHash: () => app.passwordHash, launchToken: () => app.launchToken,
     saveConfig: (patch, by) => app.saveConfig(patch, by), refreshConfig: () => app.refreshConfig(),
     auditMcp: (by, before) => app.auditMcp(by, before), swapHub: (servers) => app.swapHub(servers),
     multiUser: () => app.multiUser(), modelFor: (userId, role) => app.modelFor(userId, role),
@@ -73,6 +74,12 @@ export const API_ROUTES = routeTable({}).map((r) => [r.method, r.path, r.feature
 // trust boundary sits.
 const ADMIN_ONLY_FIELDS = /^(apiKey|keyHint|connectors|authPassword|sessionSecret|google|baseUrl|trusted|adminEmails|models$)/;
 
+const LOOPBACK_BINDS = ['127.0.0.1', '::1', 'localhost'];
+
+// 'single': the stored hash, or one made in memory from $TINYWEBUI_PASSWORD
+// (handy for containers); null means sign-in is by launch link only.
+const ownerHash = (cfg) => cfg.authPassword || (process.env.TINYWEBUI_PASSWORD ? hashPassword(process.env.TINYWEBUI_PASSWORD) : null);
+
 /**
  * Starts an instance. Everything but port/host is optional and passed to
  * createConfigSource: `config` (keys set here win and are locked in the UI),
@@ -83,9 +90,13 @@ export async function start({ port = 7777, host = '127.0.0.1', ...sourceOpts } =
   const initial = source.load();
   const problems = configProblems(initial);
   if (problems.length) throw new Error(problems.join('\n'));
-  if (initial.authMode === 'none' && !['127.0.0.1', '::1', 'localhost'].includes(host)) {
+  const loopback = LOOPBACK_BINDS.includes(host);
+  if (initial.authMode === 'none' && !loopback) {
     throw new Error("authMode 'none' is limited to loopback; use password login or a trusted-header gateway for network access");
   }
+  if (initial.authMode === 'single' && !ownerHash(initial) && !loopback) {
+    throw new Error("authMode 'single' needs a password on a network bind: run `tinywebui set-password` or set $TINYWEBUI_PASSWORD");
+  }
 
   const store = new Store(source.dbPath(initial), { migrate: initial.autoMigrate !== false });
   // Runs live in this process, so nothing from before it can still be waiting.
@@ -121,9 +132,12 @@ export async function start({ port = 7777, host = '127.0.0.1', ...sourceOpts } =
     retrieval: new Retrieval(store, { ...initial.retrieval, mode: resolved.mode }, embedder),
     cfg: initial,
     hub: null,
-    // 'single': the stored hash, or one made in memory from $TINYWEBUI_PASSWORD
-    // (handy for containers). validateConfig already refused a plaintext one.
-    passwordHash: initial.authMode === 'single' ? initial.authPassword || hashPassword(process.env.TINYWEBUI_PASSWORD) : null,
+    passwordHash: initial.authMode === 'single' ? ownerHash(initial) : null,
+    // A passwordless loopback install signs in with this instead: printed as a
+    // link at startup, so only someone who can read this terminal gets in.
+    // Made whenever it could be needed, so a reload that drops the password
+    // still leaves a way in.
+    launchToken: initial.authMode === 'single' && loopback ? randomBytes(32).toString('hex') : null,
 
     // Every UI/API change lands in config.json (source.save) and is audited:
     // who, which keys, the new values (none of these keys are secrets), and the
@@ -321,6 +335,10 @@ export async function start({ port = 7777, host = '127.0.0.1', ...sourceOpts } =
       for (const [k, v] of Object.entries(SECURITY_HEADERS)) res.setHeader(k, v);
       const url = new URL(req.url || '/', 'http://x');
       const { pathname } = url;
+      if (badHost(req, app.cfg)) {
+        audit('request.bad_host_rejected', { host: String(req.headers.host).slice(0, 100), path: pathname });
+        return json(res, 403, { error: 'unknown host' });
+      }
       if (crossSite(req, app.cfg)) {
         audit('request.cross_site_rejected', { method: req.method, path: pathname });
         return json(res, 403, { error: 'cross-site request refused' });
@@ -358,7 +376,10 @@ export async function start({ port = 7777, host = '127.0.0.1', ...sourceOpts } =
 
   await new Promise((resolve) => server.listen(port, host, resolve));
   scheduler.arm();
-  log.info(`http://${host}:${port}`);
+  const origin = `http://${host.includes(':') ? `[${host}]` : host}:${server.address().port}`;
+  // In the fragment, so it never reaches a server log or a Referer header.
+  app.launchUrl = app.launchToken ? `${origin}/#token=${app.launchToken}` : origin;
+  log.info(app.launchToken && !app.passwordHash ? `sign in: ${app.launchUrl}` : origin);
   // Anything stored before dense retrieval was on (or under another model)
   // is embedded in the background; document queries fill in on demand too.
   retrieval.backfill((msg) => log.info(`retrieval: ${msg}`))
@@ -399,7 +420,10 @@ export async function start({ port = 7777, host = '127.0.0.1', ...sourceOpts } =
     const mcpChanged = text !== mcpText;
     if (before === after && !mcpChanged) return true; // our own write, or a no-op save
     app.cfg = next;
-    if (next.authMode === 'single') app.passwordHash = next.authPassword || hashPassword(process.env.TINYWEBUI_PASSWORD);
+    if (next.authMode === 'single') {
+      app.passwordHash = ownerHash(next);
+      if (!app.passwordHash) log.info(`sign in: ${app.launchUrl}`);
+    }
     if (next.authMode === 'trusted-header') applyAccessPolicy(store, next);
     if (mcpChanged) await app.swapHub(servers);
     scheduler.arm();
@@ -432,6 +456,7 @@ export async function start({ port = 7777, host = '127.0.0.1', ...sourceOpts } =
   const onHup = () => scheduleReload('SIGHUP');
   process.on('SIGHUP', onHup);
   server.reload = reloadFromFiles;
+  server.launchUrl = app.launchUrl;
 
   // Real teardown, reused two ways: on SIGINT/SIGTERM it exits the process, and
   // as `server.shutdown()` it does not -- which is what a test harness needs.