zevairouter 1.0.51 → 1.0.53

package/src/app/(dashboard)/dashboard/terminal/TerminalPageClient.js

@@ -13,17 +13,145 @@ export default function TerminalPageClient() {
   const termRef = useRef(null);
   const fitRef = useRef(null);
   const sessionIdRef = useRef("");
-  const modeRef = useRef(""); // pty | pty-python | pipe
+  const modeRef = useRef("");
   const esRef = useRef(null);
   const writeQueueRef = useRef([]);
   const flushTimerRef = useRef(null);
   const disposedRef = useRef(false);
-  const lineBufRef = useRef(""); // local line buffer for pipe mode
+  const lineBufRef = useRef("");
+
+  // gate: checking | setup | unlock | open
+  const [gate, setGate] = useState("checking");
+  const [gateError, setGateError] = useState("");
+  const [gateBusy, setGateBusy] = useState(false);
+  const [password, setPassword] = useState("");
+  const [confirm, setConfirm] = useState("");
+  const [currentTerminalPassword, setCurrentTerminalPassword] = useState("");
 
   const [status, setStatus] = useState("connecting");
   const [statusText, setStatusText] = useState("Starting shell…");
   const [meta, setMeta] = useState({ shell: "", mode: "" });
 
+  const checkGate = useCallback(async () => {
+    setGateError("");
+    try {
+      const res = await fetch("/api/terminal/auth/status", {
+        cache: "no-store",
+        credentials: "same-origin",
+      });
+      const data = await res.json().catch(() => ({}));
+      if (res.status === 403) {
+        setGateError(data?.error || "Access forbidden.");
+        setGate("unlock");
+        return;
+      }
+      if (res.status === 401) {
+        setGateError("Log in to the dashboard first.");
+        setGate("unlock");
+        return;
+      }
+      if (!data.configured) {
+        setGate("setup");
+        return;
+      }
+      if (data.unlocked) {
+        setGate("open");
+        return;
+      }
+      setGate("unlock");
+    } catch (error) {
+      setGateError(error?.message || "Failed to check terminal lock");
+      setGate("unlock");
+    }
+  }, []);
+
+  useEffect(() => {
+    checkGate();
+  }, [checkGate]);
+
+  const handleSetup = async (event) => {
+    event.preventDefault();
+    setGateBusy(true);
+    setGateError("");
+    try {
+      const res = await fetch("/api/terminal/auth/setup", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        credentials: "same-origin",
+        body: JSON.stringify({
+          password,
+          confirm,
+          currentTerminalPassword: currentTerminalPassword || undefined,
+        }),
+      });
+      const data = await res.json().catch(() => ({}));
+      if (!res.ok) {
+        setGateError(data.error || "Setup failed");
+        return;
+      }
+      setPassword("");
+      setConfirm("");
+      setCurrentTerminalPassword("");
+      setGate("open");
+    } catch (error) {
+      setGateError(error?.message || "Setup failed");
+    } finally {
+      setGateBusy(false);
+    }
+  };
+
+  const handleUnlock = async (event) => {
+    event.preventDefault();
+    setGateBusy(true);
+    setGateError("");
+    try {
+      const res = await fetch("/api/terminal/auth/unlock", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        credentials: "same-origin",
+        body: JSON.stringify({ password }),
+      });
+      const data = await res.json().catch(() => ({}));
+      if (!res.ok) {
+        setGateError(data.error || "Unlock failed");
+        return;
+      }
+      setPassword("");
+      setGate("open");
+    } catch (error) {
+      setGateError(error?.message || "Unlock failed");
+    } finally {
+      setGateBusy(false);
+    }
+  };
+
+  const handleLock = async () => {
+    try {
+      await fetch("/api/terminal/auth/unlock", {
+        method: "DELETE",
+        credentials: "same-origin",
+      });
+    } catch {
+      /* ignore */
+    }
+    // Kill live session if any
+    const sid = sessionIdRef.current;
+    sessionIdRef.current = "";
+    if (sid) {
+      fetch(`/api/terminal/session/${sid}`, {
+        method: "DELETE",
+        credentials: "same-origin",
+        keepalive: true,
+      }).catch(() => {});
+    }
+    if (esRef.current) {
+      try { esRef.current.close(); } catch { /* ignore */ }
+      esRef.current = null;
+    }
+    setPassword("");
+    setGate("unlock");
+  };
+
   const flushInput = useCallback(async () => {
     const sessionId = sessionIdRef.current;
     if (!sessionId || writeQueueRef.current.length === 0) return;
@@ -39,8 +167,10 @@ export default function TerminalPageClient() {
         credentials: "same-origin",
       });
       if (!res.ok && termRef.current) {
-        // Surface auth/local-only failures so typing doesn't feel "dead"
-        if (res.status === 403 || res.status === 401) {
+        if (res.status === 423) {
+          termRef.current.write("\r\n\x1b[31m[terminal locked]\x1b[0m\r\n");
+          setGate("unlock");
+        } else if (res.status === 403 || res.status === 401) {
           termRef.current.write(`\r\n\x1b[31m[input blocked: ${res.status}]\x1b[0m\r\n`);
         }
       }
@@ -62,10 +192,6 @@ export default function TerminalPageClient() {
     [flushInput]
   );
 
-  /**
-   * Pipe mode has no remote echo — edit a local line and only send on Enter.
-   * PTY modes stream every keystroke and rely on shell echo.
-   */
   const handleTermData = useCallback(
     (data) => {
       const term = termRef.current;
@@ -78,7 +204,6 @@ export default function TerminalPageClient() {
         return;
       }
 
-      // Ctrl+C
       if (data === "\u0003") {
         lineBufRef.current = "";
         term.write("^C\r\n");
@@ -86,7 +211,6 @@ export default function TerminalPageClient() {
         return;
       }
 
-      // Enter
       if (data === "\r" || data === "\n" || data === "\r\n") {
         const line = lineBufRef.current;
         lineBufRef.current = "";
@@ -95,7 +219,6 @@ export default function TerminalPageClient() {
         return;
       }
 
-      // Backspace / DEL
       if (data === "\u007f" || data === "\b") {
         if (lineBufRef.current.length > 0) {
           lineBufRef.current = lineBufRef.current.slice(0, -1);
@@ -104,13 +227,12 @@ export default function TerminalPageClient() {
         return;
       }
 
-      // Ignore other control / escape sequences in line mode
       if (data.charCodeAt(0) < 32 || data.startsWith("\x1b")) {
         return;
       }
 
       lineBufRef.current += data;
-      term.write(data); // local echo
+      term.write(data);
     },
     [queueInput]
   );
@@ -225,9 +347,8 @@ export default function TerminalPageClient() {
 
       if (res.status === 403) {
         setStatus("forbidden");
-        setStatusText("Localhost only");
-        term.writeln("\x1b[33mTerminal is restricted to localhost (security).\x1b[0m");
-        term.writeln("Open the dashboard on this machine (http://127.0.0.1:1997) to use the shell.");
+        setStatusText("Forbidden");
+        term.writeln("\x1b[33mTerminal access forbidden.\x1b[0m");
         return;
       }
 
@@ -238,6 +359,13 @@ export default function TerminalPageClient() {
         return;
       }
 
+      if (res.status === 423) {
+        setStatus("error");
+        setStatusText("Locked");
+        setGate("unlock");
+        return;
+      }
+
       const data = await res.json().catch(() => ({}));
       if (!res.ok || !data?.session?.id) {
         setStatus("error");
@@ -280,7 +408,10 @@ export default function TerminalPageClient() {
     await startSession(term, fit);
   }, [startSession]);
 
+  // Only mount xterm after unlock
   useEffect(() => {
+    if (gate !== "open") return undefined;
+
     disposedRef.current = false;
     const host = hostRef.current;
     if (!host) return undefined;
@@ -325,15 +456,12 @@ export default function TerminalPageClient() {
     term.loadAddon(fit);
     term.loadAddon(links);
     term.open(host);
-    // Make the terminal surface focusable / clickable
     try {
       host.tabIndex = 0;
       const ta = host.querySelector("textarea");
       if (ta) {
         ta.tabIndex = 0;
         ta.setAttribute("autocomplete", "off");
-        ta.setAttribute("autocorrect", "off");
-        ta.setAttribute("autocapitalize", "off");
         ta.setAttribute("spellcheck", "false");
       }
     } catch {
@@ -369,7 +497,6 @@ export default function TerminalPageClient() {
     ro?.observe(host);
     window.addEventListener("resize", onResize);
 
-    // Defer focus — layout may still be settling
     requestAnimationFrame(() => {
       try {
         fit.fit();
@@ -422,7 +549,7 @@ export default function TerminalPageClient() {
       termRef.current = null;
       fitRef.current = null;
     };
-  }, [handleTermData, sendResize, startSession, focusTerm]);
+  }, [gate, handleTermData, sendResize, startSession, focusTerm]);
 
   const statusColor =
     status === "ready"
@@ -433,6 +560,121 @@ export default function TerminalPageClient() {
           ? "bg-amber-500"
           : "bg-red-500";
 
+  if (gate === "checking") {
+    return (
+      <div className="flex h-full min-h-0 w-full items-center justify-center bg-[#0d0d0d] text-sm text-white/50">
+        Checking terminal lock…
+      </div>
+    );
+  }
+
+  if (gate === "setup" || gate === "unlock") {
+    const isSetup = gate === "setup";
+    return (
+      <div className="flex h-full min-h-0 w-full flex-col items-center justify-center bg-[#0d0d0d] px-4">
+        <div className="w-full max-w-md rounded-2xl border border-white/10 bg-white/[0.03] p-6 shadow-xl">
+          <div className="mb-4 flex items-center gap-3">
+            <div className="flex size-10 items-center justify-center rounded-xl bg-[color:var(--brand,#E56A4A)]/15 text-[color:var(--brand,#E56A4A)]">
+              <span className="material-symbols-outlined text-[22px]">
+                {isSetup ? "key" : "lock"}
+              </span>
+            </div>
+            <div>
+              <h1 className="text-base font-semibold text-white/95">
+                {isSetup ? "Set terminal password" : "Unlock terminal"}
+              </h1>
+              <p className="text-xs text-white/45">
+                {isSetup
+                  ? "Separate from dashboard password — double protection for the host shell."
+                  : "Dashboard login is not enough. Enter your terminal password."}
+              </p>
+            </div>
+          </div>
+
+          <form onSubmit={isSetup ? handleSetup : handleUnlock} className="space-y-3">
+            {isSetup && currentTerminalPassword !== undefined && (
+              // current only needed when rotating — hide on first setup (no configured pw)
+              null
+            )}
+            {isSetup ? (
+              <>
+                <label className="block space-y-1">
+                  <span className="text-[11px] font-medium uppercase tracking-wide text-white/40">
+                    New terminal password
+                  </span>
+                  <input
+                    type="password"
+                    autoFocus
+                    autoComplete="new-password"
+                    value={password}
+                    onChange={(e) => setPassword(e.target.value)}
+                    className="w-full rounded-lg border border-white/10 bg-black/40 px-3 py-2.5 text-sm text-white outline-none focus:border-[color:var(--brand,#E56A4A)]/60"
+                    placeholder="Min 6 characters"
+                    required
+                    minLength={6}
+                  />
+                </label>
+                <label className="block space-y-1">
+                  <span className="text-[11px] font-medium uppercase tracking-wide text-white/40">
+                    Confirm
+                  </span>
+                  <input
+                    type="password"
+                    autoComplete="new-password"
+                    value={confirm}
+                    onChange={(e) => setConfirm(e.target.value)}
+                    className="w-full rounded-lg border border-white/10 bg-black/40 px-3 py-2.5 text-sm text-white outline-none focus:border-[color:var(--brand,#E56A4A)]/60"
+                    placeholder="Repeat password"
+                    required
+                    minLength={6}
+                  />
+                </label>
+                <p className="text-[11px] leading-relaxed text-white/35">
+                  Must <strong className="text-white/55">not</strong> match the dashboard password.
+                  Cookie unlock lasts ~4 hours on this browser.
+                </p>
+              </>
+            ) : (
+              <label className="block space-y-1">
+                <span className="text-[11px] font-medium uppercase tracking-wide text-white/40">
+                  Terminal password
+                </span>
+                <input
+                  type="password"
+                  autoFocus
+                  autoComplete="current-password"
+                  value={password}
+                  onChange={(e) => setPassword(e.target.value)}
+                  className="w-full rounded-lg border border-white/10 bg-black/40 px-3 py-2.5 text-sm text-white outline-none focus:border-[color:var(--brand,#E56A4A)]/60"
+                  placeholder="••••••••"
+                  required
+                />
+              </label>
+            )}
+
+            {gateError ? (
+              <p className="rounded-lg border border-red-500/30 bg-red-500/10 px-3 py-2 text-xs text-red-300">
+                {gateError}
+              </p>
+            ) : null}
+
+            <button
+              type="submit"
+              disabled={gateBusy}
+              className="w-full rounded-lg bg-[color:var(--brand,#E56A4A)] px-3 py-2.5 text-sm font-semibold text-white transition hover:brightness-110 disabled:opacity-50"
+            >
+              {gateBusy ? "Please wait…" : isSetup ? "Save & open terminal" : "Unlock"}
+            </button>
+          </form>
+
+          <p className="mt-4 text-center text-[11px] text-white/30">
+            Protected by dashboard login + terminal password
+          </p>
+        </div>
+      </div>
+    );
+  }
+
   return (
     <div className="flex h-full min-h-0 w-full flex-col bg-[#0d0d0d]">
       <div className="flex shrink-0 items-center justify-between gap-3 border-b border-white/10 px-4 py-2.5">
@@ -448,6 +690,14 @@ export default function TerminalPageClient() {
           </span>
         </div>
         <div className="flex items-center gap-2">
+          <button
+            type="button"
+            onClick={handleLock}
+            className="rounded-lg border border-white/10 bg-white/5 px-3 py-1.5 text-xs font-medium text-white/70 transition hover:border-white/20 hover:text-white"
+            title="Lock terminal (require password again)"
+          >
+            Lock
+          </button>
           <button
             type="button"
             onClick={handleRestart}
@@ -459,15 +709,11 @@ export default function TerminalPageClient() {
       </div>
 
       <div className="relative min-h-0 flex-1" onMouseDown={focusTerm}>
-        <div
-          ref={hostRef}
-          className="absolute inset-0 px-2 py-2 outline-none"
-          // Click to focus the xterm textarea so keystrokes reach onData
-        />
+        <div ref={hostRef} className="absolute inset-0 px-2 py-2 outline-none" />
       </div>
 
       <div className="shrink-0 border-t border-white/10 px-4 py-1.5 text-[11px] text-white/35">
-        Localhost only · click the black area then type · idle sessions close after 30m
+        Dashboard login + terminal password · click the black area then type · idle sessions close after 30m
       </div>
     </div>
   );

package/src/app/api/auth/logout/route.js

@@ -1,10 +1,12 @@
 import { NextResponse } from "next/server";
 import { cookies } from "next/headers";
 import { clearDashboardAuthCookie } from "@/lib/auth/dashboardSession";
+import { clearTerminalUnlockCookie } from "@/lib/auth/terminalSession";
 
 export async function POST() {
   const cookieStore = await cookies();
   clearDashboardAuthCookie(cookieStore);
+  clearTerminalUnlockCookie(cookieStore);
   cookieStore.delete("oidc_state");
   cookieStore.delete("oidc_nonce");
   cookieStore.delete("oidc_code_verifier");

package/src/app/api/settings/route.js

@@ -14,7 +14,7 @@ const SETTINGS_RESPONSE_HEADERS = {
 export async function GET() {
   try {
     const settings = await getSettings();
-    const { password, oidcClientSecret, fiveSimApiKey, ...safeSettings } = settings;
+    const { password, oidcClientSecret, fiveSimApiKey, terminalPassword, ...safeSettings } = settings;
     safeSettings.oidcConfigured = !!(safeSettings.oidcIssuerUrl && safeSettings.oidcClientId && oidcClientSecret);
     safeSettings.fiveSimApiKeyConfigured = !!fiveSimApiKey;
     
@@ -25,7 +25,8 @@ export async function GET() {
       ...safeSettings, 
       enableRequestLogs,
       enableTranslator,
-      hasPassword: !!password
+      hasPassword: !!password,
+      hasTerminalPassword: !!terminalPassword,
     }, { headers: SETTINGS_RESPONSE_HEADERS });
   } catch (error) {
     console.log("Error getting settings:", error);
@@ -78,6 +79,10 @@ export async function PATCH(request) {
       }
     }
 
+    // Never accept raw terminal password via generic PATCH — use /api/terminal/auth/setup
+    delete body.terminalPassword;
+    delete body.hasTerminalPassword;
+
     const settings = await updateSettings(body);
 
     // Apply outbound proxy settings immediately (no restart required)
@@ -98,9 +103,10 @@ export async function PATCH(request) {
       resetComboRotation();
     }
 
-    const { password, oidcClientSecret, fiveSimApiKey, ...safeSettings } = settings;
+    const { password, oidcClientSecret, fiveSimApiKey, terminalPassword, ...safeSettings } = settings;
     safeSettings.oidcConfigured = !!(safeSettings.oidcIssuerUrl && safeSettings.oidcClientId && oidcClientSecret);
     safeSettings.fiveSimApiKeyConfigured = !!fiveSimApiKey;
+    safeSettings.hasTerminalPassword = !!terminalPassword;
     return NextResponse.json(safeSettings, { headers: SETTINGS_RESPONSE_HEADERS });
   } catch (error) {
     console.log("Error updating settings:", error);

package/src/app/api/terminal/auth/setup/route.js

@@ -0,0 +1,72 @@
+import { NextResponse } from "next/server";
+import bcrypt from "bcryptjs";
+import { cookies } from "next/headers";
+import { getSettings, updateSettings } from "@/lib/localDb";
+import { setTerminalUnlockCookie } from "@/lib/auth/terminalSession";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+async function matchesDashboardPassword(plain, settings) {
+  if (!plain) return false;
+  if (settings.password) {
+    try {
+      return await bcrypt.compare(plain, settings.password);
+    } catch {
+      return false;
+    }
+  }
+  const initial = process.env.INITIAL_PASSWORD || "123456";
+  return plain === initial;
+}
+
+/**
+ * First-time (or rotate) terminal password.
+ * Body: { password, confirm, currentTerminalPassword? }
+ * Password MUST differ from dashboard password.
+ */
+export async function POST(request) {
+  try {
+    const body = await request.json().catch(() => ({}));
+    const password = String(body?.password || "");
+    const confirm = String(body?.confirm || "");
+    const currentTerminalPassword = String(body?.currentTerminalPassword || "");
+
+    if (password.length < 6) {
+      return NextResponse.json({ error: "Terminal password must be at least 6 characters." }, { status: 400 });
+    }
+    if (password !== confirm) {
+      return NextResponse.json({ error: "Passwords do not match." }, { status: 400 });
+    }
+
+    const settings = await getSettings();
+
+    if (await matchesDashboardPassword(password, settings)) {
+      return NextResponse.json(
+        { error: "Terminal password must be different from the dashboard password." },
+        { status: 400 }
+      );
+    }
+
+    // Rotating: require current terminal password
+    if (settings.terminalPassword) {
+      if (!currentTerminalPassword) {
+        return NextResponse.json({ error: "Current terminal password required." }, { status: 400 });
+      }
+      const ok = await bcrypt.compare(currentTerminalPassword, settings.terminalPassword);
+      if (!ok) {
+        return NextResponse.json({ error: "Current terminal password is incorrect." }, { status: 401 });
+      }
+    }
+
+    const hash = await bcrypt.hash(password, 10);
+    await updateSettings({ terminalPassword: hash });
+
+    const cookieStore = await cookies();
+    await setTerminalUnlockCookie(cookieStore, request);
+
+    return NextResponse.json({ ok: true, configured: true, unlocked: true });
+  } catch (error) {
+    return NextResponse.json({ error: error.message || "setup failed" }, { status: 500 });
+  }
+}

package/src/app/api/terminal/auth/status/route.js

@@ -0,0 +1,27 @@
+import { NextResponse } from "next/server";
+import { cookies } from "next/headers";
+import { getSettings } from "@/lib/localDb";
+import { verifyTerminalUnlockToken } from "@/lib/auth/terminalSession";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export async function GET() {
+  try {
+    const settings = await getSettings();
+    const configured = !!settings.terminalPassword;
+    const cookieStore = await cookies();
+    const unlocked = configured
+      ? await verifyTerminalUnlockToken(cookieStore.get("terminal_token")?.value)
+      : false;
+
+    return NextResponse.json({
+      configured,
+      unlocked,
+      // Always required once feature is present — setup first, then unlock
+      required: true,
+    });
+  } catch (error) {
+    return NextResponse.json({ error: error.message || "status failed" }, { status: 500 });
+  }
+}

package/src/app/api/terminal/auth/unlock/route.js

@@ -0,0 +1,69 @@
+import { NextResponse } from "next/server";
+import bcrypt from "bcryptjs";
+import { cookies } from "next/headers";
+import { getSettings } from "@/lib/localDb";
+import {
+  setTerminalUnlockCookie,
+  clearTerminalUnlockCookie,
+} from "@/lib/auth/terminalSession";
+import { checkLock, recordFail, recordSuccess, getClientIp } from "@/lib/auth/loginLimiter";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export async function POST(request) {
+  try {
+    const ip = getClientIp(request);
+    const lock = checkLock(ip);
+    if (lock.locked) {
+      return NextResponse.json(
+        { error: `Too many failed attempts. Try again in ${lock.retryAfter}s.`, retryAfter: lock.retryAfter },
+        { status: 429, headers: { "Retry-After": String(lock.retryAfter) } }
+      );
+    }
+
+    const body = await request.json().catch(() => ({}));
+    const password = String(body?.password || "");
+    const settings = await getSettings();
+
+    if (!settings.terminalPassword) {
+      return NextResponse.json(
+        { error: "Terminal password not configured. Set one first.", code: "NOT_CONFIGURED" },
+        { status: 400 }
+      );
+    }
+
+    const ok = await bcrypt.compare(password, settings.terminalPassword);
+    if (!ok) {
+      const { remainingBeforeLock } = recordFail(ip);
+      const postLock = checkLock(ip);
+      if (postLock.locked) {
+        return NextResponse.json(
+          { error: `Too many failed attempts. Try again in ${postLock.retryAfter}s.`, retryAfter: postLock.retryAfter },
+          { status: 429, headers: { "Retry-After": String(postLock.retryAfter) } }
+        );
+      }
+      return NextResponse.json(
+        { error: `Invalid terminal password. ${remainingBeforeLock} attempt(s) left.`, remainingBeforeLock },
+        { status: 401 }
+      );
+    }
+
+    recordSuccess(ip);
+    const cookieStore = await cookies();
+    await setTerminalUnlockCookie(cookieStore, request);
+    return NextResponse.json({ ok: true, unlocked: true });
+  } catch (error) {
+    return NextResponse.json({ error: error.message || "unlock failed" }, { status: 500 });
+  }
+}
+
+export async function DELETE() {
+  try {
+    const cookieStore = await cookies();
+    clearTerminalUnlockCookie(cookieStore);
+    return NextResponse.json({ ok: true, unlocked: false });
+  } catch (error) {
+    return NextResponse.json({ error: error.message || "lock failed" }, { status: 500 });
+  }
+}