wiki-viewer 1.2.0 → 1.4.0

package/.next/standalone/src/app/signin/page.tsx

@@ -11,19 +11,20 @@ export default function SignInPage() {
 	const [error, setError] = useState<string | null>(null);
 	const [loading, setLoading] = useState(false);
 	const [hasGoogle, setHasGoogle] = useState(false);
+	const [passwordAuth, setPasswordAuth] = useState(true);
 	const [callbackURL, setCallbackURL] = useState("/");
 
 	useEffect(() => {
-		// Detect Google provider availability via the providers endpoint
-		fetch("/api/auth/list-providers", { credentials: "include" })
+		// Learn which auth methods to show. Public endpoint, no session needed.
+		fetch("/api/system/auth-config", { credentials: "include" })
 			.then((r) => r.json())
 			.then((data: unknown) => {
-				if (
-					data &&
-					typeof data === "object" &&
-					"google" in data
-				) {
-					setHasGoogle(true);
+				if (data && typeof data === "object") {
+					const cfg = data as { google?: boolean; passwordAuth?: boolean };
+					setHasGoogle(Boolean(cfg.google));
+					// Default to showing the password form unless told otherwise, so a
+					// failed fetch never leaves the user with no way to sign in.
+					setPasswordAuth(cfg.passwordAuth !== false);
 				}
 			})
 			.catch(() => {});
@@ -119,14 +120,24 @@ export default function SignInPage() {
 							</svg>
 							Continue with Google
 						</button>
-						<div className="my-4 flex items-center gap-3">
-							<hr className="flex-1 border-border" />
-							<span className="text-xs text-muted-foreground">or</span>
-							<hr className="flex-1 border-border" />
-						</div>
+						{passwordAuth && (
+							<div className="my-4 flex items-center gap-3">
+								<hr className="flex-1 border-border" />
+								<span className="text-xs text-muted-foreground">or</span>
+								<hr className="flex-1 border-border" />
+							</div>
+						)}
 					</>
 				)}
 
+				{!passwordAuth && !hasGoogle && (
+					<p className="rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive">
+						No sign-in method is configured. Set GOOGLE_CLIENT_ID and
+						GOOGLE_CLIENT_SECRET, or enable email/password auth.
+					</p>
+				)}
+
+				{passwordAuth && (
 				<form onSubmit={handleSubmit} className="space-y-4">
 					{mode === "signup" && (
 						<div>
@@ -197,7 +208,9 @@ export default function SignInPage() {
 								: "Sign in"}
 					</button>
 				</form>
+				)}
 
+				{passwordAuth && (
 				<p className="mt-4 text-center text-sm text-muted-foreground">
 					{mode === "signin" ? "No account?" : "Already have an account?"}{" "}
 					<button
@@ -211,6 +224,7 @@ export default function SignInPage() {
 						{mode === "signin" ? "Sign up" : "Sign in"}
 					</button>
 				</p>
+				)}
 			</div>
 		</div>
 	);

package/.next/standalone/src/lib/auth/server.ts

@@ -75,13 +75,29 @@ if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {
 		clientSecret: process.env.GOOGLE_CLIENT_SECRET,
 	};
 }
+const hasSocialProvider = Object.keys(socialProviders).length > 0;
+
+// Email/password can be turned off (AUTH_DISABLE_PASSWORD=1) so an operator can
+// require Google sign-in only. Guard against locking everyone out: if no social
+// provider is configured, password auth stays on regardless, otherwise there
+// would be no way to sign in at all.
+const passwordDisabled =
+	process.env.AUTH_DISABLE_PASSWORD === "1" || process.env.AUTH_DISABLE_PASSWORD === "true";
+export const passwordAuthEnabled = !(passwordDisabled && hasSocialProvider);
+if (passwordDisabled && !hasSocialProvider) {
+	console.warn(
+		"[wiki-viewer] AUTH_DISABLE_PASSWORD is set but no social provider is configured. " +
+			"Keeping email/password enabled so you are not locked out. Configure GOOGLE_CLIENT_ID/" +
+			"GOOGLE_CLIENT_SECRET to disable password auth.",
+	);
+}
 
 export const auth = betterAuth({
 	database: db,
 	secret: resolveSecret(),
 	baseURL: process.env.BETTER_AUTH_URL,
 	emailAndPassword: {
-		enabled: true,
+		enabled: passwordAuthEnabled,
 		requireEmailVerification: false,
 		autoSignIn: true,
 	},

package/README.md

@@ -47,7 +47,11 @@ Single-user, no-auth mode still works. Auth turns on automatically once anyone s
 ## Quick start
 
 ```bash
-# Point it at a directory
+# Guided setup: directory, host/port, HTTPS, app settings, and optional
+# install as a reboot-persistent service. Recommended for first run.
+npx wiki-viewer init
+
+# Or run directly. Point it at a directory
 npx wiki-viewer ~/notes
 
 # No directory? Pick one in the browser
@@ -57,6 +61,8 @@ npx wiki-viewer
 npx wiki-viewer ~/notes --https
 ```
 
+The wizard walks you through every option and writes `~/.wiki-viewer/config.json`, so you do not have to remember flags. You can re-run it any time, or edit the config with `wiki-viewer config set`.
+
 Open **http://localhost:3000** (or **https://localhost:3000** with `--https`).
 
 To switch the served directory later, click **Change** at the bottom of the sidebar and pick a new folder. No restart needed.
@@ -173,7 +179,18 @@ wiki-viewer uses [Better Auth](https://better-auth.com) with SQLite. State lives
 Sign-in providers:
 
 - **Google OAuth.** Enabled when both `GOOGLE_CLIENT_ID` and `GOOGLE_CLIENT_SECRET` are set.
-- **Email + password.** Always available. No verification email is sent by default.
+- **Email + password.** Enabled by default. No verification email is sent.
+
+### Require Google sign-in only
+
+To turn off email/password and force Google OAuth, set `AUTH_DISABLE_PASSWORD=1`:
+
+```bash
+wiki-viewer config set AUTH_DISABLE_PASSWORD=1
+wiki-viewer service restart
+```
+
+The sign-in page then shows only the Google button. As a safety guard, this is ignored unless a Google provider is configured, so you cannot lock yourself out: if `GOOGLE_CLIENT_ID`/`GOOGLE_CLIENT_SECRET` are missing, email/password stays on and a warning is logged.
 
 ### Email allowlist
 

package/bin/wiki-viewer.js

@@ -7,6 +7,8 @@ import { readFileSync, writeFileSync, mkdirSync, existsSync, rmSync } from "node
 import path from "node:path";
 import os from "node:os";
 import { fileURLToPath } from "node:url";
+import { createInterface } from "node:readline";
+import { stdin, stdout } from "node:process";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const appRoot = path.resolve(__dirname, "..");
@@ -34,6 +36,7 @@ function printUsage() {
   console.error("  -e, --env <KEY=VALUE>  Set an app env var (repeatable; persisted with service install)");
   console.error("");
   console.error("Commands:");
+  console.error("  init                              Interactive setup wizard (dir, host/port, https, env, service)");
   console.error("  service install [dir] [options]   Install as a user service (persists across reboot)");
   console.error("  service uninstall                 Remove the user service");
   console.error("  service status                    Show service status");
@@ -46,6 +49,7 @@ function printUsage() {
   console.error("  update                            Update wiki-viewer to the latest version and restart");
   console.error("");
   console.error("Examples:");
+  console.error("  wiki-viewer init");
   console.error("  wiki-viewer ~/notes");
   console.error("  wiki-viewer ~/notes --https");
   console.error("  wiki-viewer ~/notes -p 8080 -H 0.0.0.0");
@@ -689,6 +693,171 @@ function update() {
   console.log("Update complete.");
 }
 
+// ── interactive setup wizard ──────────────────────────────────────────────
+
+// Common app env vars worth offering during setup. Anything not listed can
+// still be added later with `wiki-viewer config set KEY=VALUE`.
+const WIZARD_ENV_VARS = [
+  { key: "AUTH_ALLOWED_DOMAIN", hint: "Restrict signup to an email domain, e.g. example.com" },
+  { key: "AUTH_ALLOWED_EMAILS", hint: "Restrict signup to specific emails (comma-separated)" },
+  { key: "GOOGLE_CLIENT_ID", hint: "Google OAuth client ID (enables Google sign-in)" },
+  { key: "GOOGLE_CLIENT_SECRET", hint: "Google OAuth client secret" },
+  { key: "AUTH_DISABLE_PASSWORD", hint: "Set to 1 to allow Google sign-in only (requires Google keys)" },
+  { key: "WIKI_OWNER_HOSTS", hint: "Extra hostnames trusted for the AI panel owner cookie" },
+  { key: "AGENT_RATE_LIMIT", hint: "Per-minute agent API rate limit (default 60)" },
+];
+
+// A prompt helper that survives piped (non-TTY) stdin. node:readline/promises
+// closes the stream between awaited questions when input is piped, so we buffer
+// every line via the 'line' event and hand them out one at a time instead.
+function makePrompter() {
+  const rl = createInterface({ input: stdin, output: stdout });
+  const queue = [];
+  const waiters = [];
+  let closed = false;
+
+  rl.on("line", (line) => {
+    if (waiters.length) waiters.shift()(line);
+    else queue.push(line);
+  });
+  rl.on("close", () => {
+    closed = true;
+    while (waiters.length) waiters.shift()(null);
+  });
+
+  const nextLine = () =>
+    new Promise((resolve) => {
+      if (queue.length) resolve(queue.shift());
+      else if (closed) resolve(null);
+      else waiters.push(resolve);
+    });
+
+  const prompt = async (text) => {
+    stdout.write(text);
+    const line = await nextLine();
+    return line == null ? "" : line;
+  };
+
+  return { prompt, close: () => rl.close() };
+}
+
+async function runWizard() {
+  const io = makePrompter();
+  const existing = loadConfig();
+
+  const ask = async (label, def) => {
+    const suffix = def ? ` [${def}]` : "";
+    const answer = (await io.prompt(`${label}${suffix}: `)).trim();
+    return answer || def || "";
+  };
+  const askYesNo = async (label, defYes) => {
+    const def = defYes ? "Y/n" : "y/N";
+    const answer = (await io.prompt(`${label} [${def}]: `)).trim().toLowerCase();
+    if (!answer) return defYes;
+    return answer === "y" || answer === "yes";
+  };
+
+  try {
+    console.log("\nwiki-viewer setup\n");
+    console.log("Answer a few questions. Press Enter to accept the [default].\n");
+
+    // 1. directory
+    const dirInput = await ask(
+      "Directory to serve (blank = choose later in the browser)",
+      existing.rootDir ?? process.cwd(),
+    );
+    const rootDir = dirInput ? path.resolve(dirInput) : null;
+    if (rootDir && !existsSync(rootDir)) {
+      console.log(`  Note: ${rootDir} does not exist yet; it will be served once created.`);
+    }
+
+    // 2. host
+    const host = await ask(
+      "Host to bind (localhost for this machine only, 0.0.0.0 for the network)",
+      existing.host ?? "localhost",
+    );
+
+    // 3. port
+    const port = await ask("Port", String(existing.port ?? "3000"));
+
+    // 4. https
+    const httpsDefault = existing.https ?? (!isLocalHost(host) && host !== "0.0.0.0");
+    const useHttps = await askYesNo(
+      "Enable HTTPS? (recommended for any non-localhost access)",
+      Boolean(httpsDefault),
+    );
+
+    // 5. app env vars
+    const env = { ...(existing.env ?? {}) };
+    const wantEnv = await askYesNo(
+      "\nConfigure app settings now? (OAuth, signup allowlist, rate limit)",
+      false,
+    );
+    if (wantEnv) {
+      console.log("Leave blank to skip a setting.\n");
+      for (const { key, hint } of WIZARD_ENV_VARS) {
+        const cur = env[key];
+        const val = await ask(`  ${key} — ${hint}`, cur);
+        if (val) env[key] = val;
+        else delete env[key];
+      }
+    }
+
+    // Build and preview the config.
+    const cfg = {
+      rootDir,
+      host,
+      port,
+      https: useHttps,
+      ...(Object.keys(env).length ? { env } : {}),
+    };
+
+    console.log("\nConfiguration:");
+    console.log(`  directory : ${rootDir ?? "(choose in browser)"}`);
+    console.log(`  host      : ${host}`);
+    console.log(`  port      : ${port}`);
+    console.log(`  https     : ${useHttps}`);
+    if (cfg.env) console.log(`  app env   : ${Object.keys(cfg.env).join(", ")}`);
+
+    // Secure-context guidance before committing.
+    const { warnings } = computeServerEnv({ host, port: String(port), useHttps, configEnv: cfg.env ?? {} });
+    for (const w of warnings) console.log(`\n⚠️   ${w}`);
+
+    // 6. what to do now
+    console.log("");
+    console.log("What next?");
+    console.log("  1) Install as a service (starts now and on every reboot)");
+    console.log("  2) Run once now (foreground)");
+    console.log("  3) Save config only");
+    const choice = (await io.prompt("Choose [1/2/3]: ")).trim() || "1";
+
+    saveConfig(cfg);
+    console.log(`\nSaved ${configPath}`);
+
+    io.close();
+
+    if (choice === "1") {
+      const p = platform();
+      if (!p) {
+        console.log("Service install is only supported on Linux and macOS.");
+        console.log("Run it yourself with: wiki-viewer service run");
+        return;
+      }
+      if (p === "linux") installSystemd();
+      else installLaunchd();
+    } else if (choice === "2") {
+      start(resolveRunOptions([]));
+    } else {
+      console.log("\nStart it any time with:");
+      console.log("  wiki-viewer service install   # persistent service");
+      console.log("  wiki-viewer service run       # run from this config");
+    }
+  } finally {
+    // io may already be closed; closing twice is a no-op.
+    io.close();
+  }
+}
+
 // ── dispatch ──────────────────────────────────────────────────────────────
 
 const argv = process.argv.slice(2);
@@ -720,10 +889,23 @@ switch (cmd) {
   case "config":
     configCommand(rest);
     break;
+  case "init":
+  case "setup":
+    runWizard();
+    break;
   case "update":
     update();
     break;
   default:
+    if (argv.includes("--setup") || argv.includes("--init")) {
+      runWizard();
+      break;
+    }
     // No recognized command → ad-hoc serve (directory + flags only).
+    // On a bare interactive run, point users at the guided setup first.
+    if (argv.length === 0 && stdin.isTTY) {
+      console.log("Tip: run `wiki-viewer init` for guided setup (directory, host/port, HTTPS,");
+      console.log("     app settings, and optional install as a reboot-persistent service).\n");
+    }
     start(resolveServeOptions(argv));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wiki-viewer",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "description": "Local file viewer and wiki — view markdown, HTML, PDFs, notebooks, office docs, and more from any directory",
   "license": "MIT",
   "type": "module",

package/.next/standalone/.next/static/chunks/0jf_r0h67nbyh.js

@@ -1 +0,0 @@
-(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,897339,e=>{"use strict";var t=e.i(44501),r=e.i(101685),n=e.i(199075);e.s(["default",0,function(){let[e,s]=(0,r.useState)("signin"),[i,a]=(0,r.useState)(""),[o,l]=(0,r.useState)(""),[d,c]=(0,r.useState)(""),[u,m]=(0,r.useState)(null),[g,x]=(0,r.useState)(!1),[f,p]=(0,r.useState)(!1),[h,b]=(0,r.useState)("/");async function j(t){t.preventDefault(),m(null),x(!0);try{if("signup"===e){let e=await n.authClient.signUp.email({email:i,password:o,name:d,callbackURL:h});e.error?m(e.error.message??"Sign-up failed"):window.location.href=h}else{let e=await n.authClient.signIn.email({email:i,password:o,callbackURL:h});if(e.error){let t=e.error.status;429===t?m("Too many sign-in attempts. Wait a minute and try again."):m(e.error.message??"Sign-in failed")}else window.location.href=h}}catch(e){m(e instanceof Error?e.message:"Unexpected error")}finally{x(!1)}}async function y(){m(null),x(!0);try{await n.authClient.signIn.social({provider:"google",callbackURL:h})}catch(e){m(e instanceof Error?e.message:"Google sign-in failed"),x(!1)}}return(0,r.useEffect)(()=>{fetch("/api/auth/list-providers",{credentials:"include"}).then(e=>e.json()).then(e=>{e&&"object"==typeof e&&"google"in e&&p(!0)}).catch(()=>{});let e=new URLSearchParams(window.location.search).get("next");e&&e.startsWith("/")&&b(e)},[]),(0,t.jsx)("div",{className:"min-h-screen flex items-center justify-center bg-background",children:(0,t.jsxs)("div",{className:"w-full max-w-sm rounded-lg border border-border bg-card p-8 shadow-sm",children:[(0,t.jsx)("h1",{className:"mb-6 text-xl font-semibold text-foreground",children:"Sign in to wiki-viewer"}),f&&(0,t.jsxs)(t.Fragment,{children:[(0,t.jsxs)("button",{type:"button",onClick:y,disabled:g,className:"flex w-full items-center justify-center gap-2 rounded-md border border-border px-4 py-2 text-sm font-medium hover:bg-accent disabled:opacity-50",children:[(0,t.jsxs)("svg",{viewBox:"0 0 24 24",className:"h-4 w-4","aria-hidden":"true",children:[(0,t.jsx)("path",{fill:"#4285F4",d:"M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"}),(0,t.jsx)("path",{fill:"#34A853",d:"M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"}),(0,t.jsx)("path",{fill:"#FBBC05",d:"M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l3.66-2.84z"}),(0,t.jsx)("path",{fill:"#EA4335",d:"M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"})]}),"Continue with Google"]}),(0,t.jsxs)("div",{className:"my-4 flex items-center gap-3",children:[(0,t.jsx)("hr",{className:"flex-1 border-border"}),(0,t.jsx)("span",{className:"text-xs text-muted-foreground",children:"or"}),(0,t.jsx)("hr",{className:"flex-1 border-border"})]})]}),(0,t.jsxs)("form",{onSubmit:j,className:"space-y-4",children:["signup"===e&&(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"mb-1 block text-sm font-medium text-foreground",htmlFor:"name",children:"Name"}),(0,t.jsx)("input",{id:"name",type:"text",autoComplete:"name",value:d,onChange:e=>c(e.target.value),required:!0,className:"w-full rounded-md border border-border bg-background px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-ring"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"mb-1 block text-sm font-medium text-foreground",htmlFor:"email",children:"Email"}),(0,t.jsx)("input",{id:"email",type:"email",autoComplete:"email",value:i,onChange:e=>a(e.target.value),required:!0,className:"w-full rounded-md border border-border bg-background px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-ring"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"mb-1 block text-sm font-medium text-foreground",htmlFor:"password",children:"Password"}),(0,t.jsx)("input",{id:"password",type:"password",autoComplete:"signup"===e?"new-password":"current-password",value:o,onChange:e=>l(e.target.value),required:!0,minLength:8,className:"w-full rounded-md border border-border bg-background px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-ring"})]}),u&&(0,t.jsx)("p",{className:"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive",children:u}),(0,t.jsx)("button",{type:"submit",disabled:g,className:"w-full rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-50",children:g?"signup"===e?"Creating account...":"Signing in...":"signup"===e?"Create account":"Sign in"})]}),(0,t.jsxs)("p",{className:"mt-4 text-center text-sm text-muted-foreground",children:["signin"===e?"No account?":"Already have an account?"," ",(0,t.jsx)("button",{type:"button",onClick:()=>{s("signin"===e?"signup":"signin"),m(null)},className:"font-medium text-foreground underline-offset-4 hover:underline",children:"signin"===e?"Sign up":"Sign in"})]})]})})}])}]);