zyket 1.2.17 → 1.2.19

package/SECURITY.md

@@ -0,0 +1,40 @@
+# Seguridad — Zyket
+
+Auditoría de seguridad del framework y estado de las correcciones.
+Leyenda: `[x]` hecho · `[ ]` pendiente · 🔴 crítico · 🟠 alto · 🟡 medio · 🔵 bajo
+
+---
+
+## ✅ Resuelto
+
+- [x] 🔴 **`.env` ignorado en git.** Añadido `.env` / `*.sqlite` al `.gitignore` para evitar fuga de `AUTH_SECRET`, claves S3 y credenciales de BD.
+- [x] 🔴 **`AUTH_SECRET` aleatorio + fail-closed.** `#addAuthEnvVariables` genera ahora un secreto con `crypto.randomBytes(32)` por proyecto y lo inyecta en `process.env` para el primer arranque. `#requireAuthSecret()` aborta el boot si el secreto falta o es uno de los valores estáticos conocidos. → [src/services/auth/index.js](src/services/auth/index.js)
+- [x] 🔴 **Autenticación en Storage realmente aplicada.** Antes los `middlewares` del constructor se guardaban pero no se usaban; ahora se aplican a todas las rutas y métodos (auth antes de multer en `upload`). La autenticación se inyecta vía `new InteractiveStorageExtension({ middlewares: [authMiddleware] })`. → [src/extensions/interactive-storage/index.js](src/extensions/interactive-storage/index.js)
+- [x] 🔴 **BullBoard fail-closed.** Si no hay `BULLBOARD_ADMIN_PASSWORD` ni `middlewares`, el panel **no se monta** (antes quedaba público). Soporta `middlewares` por constructor. → [src/extensions/bullboard/index.js](src/extensions/bullboard/index.js)
+- [x] 🟠 **Inyección de cabecera en descarga.** `Content-Disposition` ahora sanea el nombre (basename + ASCII filtrado + `filename*=UTF-8''`) evitando breakout de comillas/CRLF. → [src/extensions/interactive-storage/routes/download.js](src/extensions/interactive-storage/routes/download.js)
+- [x] 🟠 **Path traversal en `normalizePath`.** Se eliminan segmentos `..` / `.` además de normalizar slashes. → [src/extensions/interactive-storage/index.js](src/extensions/interactive-storage/index.js#L150)
+- [x] 🟡 **Límite en borrado masivo.** `delete` ahora rechaza lotes mayores a `maxDeleteBatch` (por defecto 100, configurable en el constructor de la extensión) → evita borrado masivo / agotamiento de recursos en una sola petición. → [src/extensions/interactive-storage/routes/delete.js](src/extensions/interactive-storage/routes/delete.js)
+- [x] 🟡 **`requireEmailVerification` personalizable.** Nuevo getter `requireEmailVerification` (por defecto `false`, manteniendo el comportamiento previo) sobreescribible al extender `AuthService`. → [src/services/auth/index.js](src/services/auth/index.js#L71)
+- [x] 🟡 **Límite en borrado de carpeta.** `delete-folder` rechaza prefijos con más de `maxDeleteBatch` archivos (mismo tope configurable que `delete`). → [src/extensions/interactive-storage/routes/delete-folder.js](src/extensions/interactive-storage/routes/delete-folder.js)
+- [x] 🟠 **Validación de `fileName` en `download`/`info`.** Se rechazan (`400`) claves con segmentos `..`/`.`, backslashes o que empiecen por `/` antes de llegar al cliente S3. → [download.js](src/extensions/interactive-storage/routes/download.js), [info.js](src/extensions/interactive-storage/routes/info.js)
+- [x] 🟡 **Límites de payload configurables (default 10 MB).** Body JSON vía `HTTP_JSON_LIMIT` y socket vía `SOCKET_MAX_HTTP_BUFFER_SIZE` (ambos por defecto 10 MB, incluidos en el `.env` generado). → [Express.js](src/services/express/Express.js#L32), [SocketIO.js](src/services/socketio/SocketIO.js#L32), [EnvManager.js](src/utils/EnvManager.js)
+- [x] 🟡 **Swagger protegible opcionalmente.** `SWAGGER_PASSWORD` activa HTTP Basic auth (usuario configurable con `SWAGGER_USER`, default `admin`); `DISABLE_SWAGGER=true` lo desactiva por completo. Si queda abierto se emite un warning. → [src/services/express/Express.js](src/services/express/Express.js#L44)
+- [x] 🟡 **No se filtra `error.message` al cliente.** Las 4 respuestas `500` (rutas y middlewares, en `boot` y `registerRoutes`) devuelven ahora un genérico `Internal Server Error`; el detalle (incluido el stack) queda solo en los logs del servidor. → [src/services/express/Express.js](src/services/express/Express.js)
+- [x] 🟠 **Cookies dependientes del entorno.** Ya no se fuerza `sameSite:"none"` + `secure` + cross-subdomain siempre. Por defecto `sameSite:"lax"` y `secure` solo en producción (login funciona en `http://localhost`); `AUTH_CROSS_DOMAIN=true` activa `none`+`secure`+cross-subdomain para front/back en dominios distintos (HTTPS). → [src/services/auth/index.js](src/services/auth/index.js#L126-L165)
+- [x] 🟢 **Helpers de autorización en el framework.** Nuevos `RequireAuthMiddleware`, `RequireAdminMiddleware` (rutas) y `AuthGuard` (sockets), exportados desde `zyket`, para proteger rutas/eventos con la sesión de better-auth. → [src/services/express/RequireAuthMiddleware.js](src/services/express/RequireAuthMiddleware.js), [src/services/socketio/AuthGuard.js](src/services/socketio/AuthGuard.js)
+
+---
+
+## ⏳ Pendiente
+
+### 🟠 Alto
+- [ ] **CSRF de OAuth / account linking.** `account.skipStateCookieCheck: true` junto a `accountLinking.enabled: true` desactiva la verificación de `state` → riesgo de account takeover. Quitar `skipStateCookieCheck`. → [src/services/auth/index.js](src/services/auth/index.js#L189-L191)
+- [ ] **Socket.IO CORS `origin:"*"` + guard por defecto que no bloquea.** Restringir origins (reutilizar `TRUSTED_ORIGINS`) y que el guard por defecto deniegue sin sesión válida. → [src/services/socketio/SocketIO.js](src/services/socketio/SocketIO.js#L32), [src/templates/default/src/guards/default.js](src/templates/default/src/guards/default.js)
+
+### 🟡 Medio
+- [ ] **Rate limiting** (login, reset password, upload) con `express-rate-limit`. → [src/services/express/Express.js](src/services/express/Express.js)
+- [ ] **Cabeceras de seguridad** con `helmet`. → [src/services/express/Express.js](src/services/express/Express.js)
+
+### 🔵 Bajo / Higiene
+- [ ] **Reducir superficie de drivers de BD** (`sqlite3` + `better-sqlite3` + `pg` + `mariadb`).
+- [ ] **Documentar guía de despliegue seguro** (variables obligatorias en producción, HTTPS, secretos).

package/bin/cli.js

@@ -1,202 +1,282 @@
-#!/usr/bin/env node
-const prompts = require('prompts');
-const fs = require('fs');
-const path = require('path');
-const { spawn } = require('child_process');
-const TemplateManager = require('../src/services/template-manager');
-const EnvManager = require('../src/utils/EnvManager');
-const templateManager = new TemplateManager();
-
-(async () => {
-	process.stdout.write("\u001b[2J\u001b[0;0H");
-	await templateManager.boot();
-
-	// Check for direct command (e.g., npx zyket init)
-	const args = process.argv.slice(2);
-	const directCommand = args[0];
-
-	let actionToRun = null;
-
-	if (directCommand === 'init') {
-		actionToRun = 'init-project';
-	} else {
-		// Show interactive menu
-		const response = await prompts({
-			type: 'select',
-			name: 'value',
-			message: '[ZYKET] What do you want to do?',
-			choices: [
-				{ title: 'Initialize Project', value: 'init-project', description: 'Set up a new Zyket project', disabled: false },
-				{ title: 'Install Template', value: 'install-template', description: 'Install a new template', disabled: false },
-				/*{ title: 'Remove Template', value: 'remove-template', description: 'Remove an existing template', disabled: false },*/
-			],
-			initial: 0
-		});
-		actionToRun = response.value;
-	}
-
-	if (!actionToRun) {
-		console.log('[ZYKET] No action selected. Exiting.');
-		return;
-	}
-
-  const actions = {
-		'init-project': async () => {
-			const indexPath = path.join(process.cwd(), 'index.js');
-			const envPath = path.join(process.cwd(), '.env');
-			const packageJsonPath = path.join(process.cwd(), 'package.json');
-
-			// Check if index.js already exists
-			if (fs.existsSync(indexPath)) {
-				const overwrite = await prompts({
-					type: 'confirm',
-					name: 'value',
-					message: '[ZYKET] index.js already exists. Overwrite?',
-					initial: false
-				});
-				if (!overwrite.value) {
-					console.log('[ZYKET] Initialization cancelled.');
-					return;
-				}
-			}
-
-			// Create .env file
-			console.log('[ZYKET] Creating .env file...');
-			EnvManager.createEnvFile(envPath);
-
-			// Install default backend template files (src and config)
-			console.log('[ZYKET] Installing default backend template files...');
-			const defaultTemplate = templateManager.getTemplate('default');
-			const backendFiles = defaultTemplate.filter(file => {
-				const route = file.route;
-				// Only install src and config files, not frontend
-				// Skip guards and handlers folders since socket is disabled by default
-				return (route.startsWith('default/src/') || route.startsWith('default/config/')) 
-					&& !route.startsWith('default/src/guards/')
-					&& !route.startsWith('default/src/handlers/');
-			});
-
-			for (const file of backendFiles) {
-				const fileName = file.route.split('/').slice(1).join('/');
-				const fileLocation = path.join(process.cwd(), fileName);
-				const folderLocation = path.dirname(fileLocation);
-				
-				// Create directory if it doesn't exist
-				if (!fs.existsSync(folderLocation)) {
-					fs.mkdirSync(folderLocation, { recursive: true });
-				}
-				
-				// Write file if it doesn't exist
-				if (!fs.existsSync(fileLocation)) {
-					fs.writeFileSync(fileLocation, file.content);
-				}
-			}
-			console.log('[ZYKET] ✅ Backend template files installed');
-
-			// Create index.js with boilerplate code
-			console.log('[ZYKET] Creating index.js...');
-			const indexContent = `const { Kernel } = require('zyket');
-
-const kernel = new Kernel({
-	services: [
-		['auth', require('./src/services/auth'), ["@service_container"]],
-	]
-});
-
-kernel.boot().then(() => {
-    console.log('Kernel booted successfully!');
-}).catch((error) => {
-    console.error('Error booting kernel:', error);
-});
-`;
-			fs.writeFileSync(indexPath, indexContent);
-
-			// Create package.json if it doesn't exist
-			if (!fs.existsSync(packageJsonPath)) {
-				console.log('[ZYKET] Creating package.json...');
-				const packageJson = {
-					name: path.basename(process.cwd()),
-					version: "1.0.0",
-					description: "Zyket application",
-					main: "index.js",
-					scripts: {
-						dev: "node index.js"
-					},
-					keywords: [],
-					author: "",
-					license: "ISC",
-					dependencies: {
-						zyket: "^1.2.3"
-					}
-				};
-				fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, 2));
-			}
-
-			console.log('\n[ZYKET] ✅ Project initialized successfully!');
-
-			// Install dependencies automatically
-			console.log('\n[ZYKET] Installing dependencies...');
-			await new Promise((resolve, reject) => {
-				const npmInstall = spawn('npm', ['install'], {
-					cwd: process.cwd(),
-					stdio: 'inherit',
-					shell: true
-				});
-
-				npmInstall.on('close', (code) => {
-					if (code === 0) {
-						console.log('\n[ZYKET] ✅ Dependencies installed successfully!');
-						resolve();
-					} else {
-						reject(new Error(`npm install exited with code ${code}`));
-					}
-				});
-
-				npmInstall.on('error', (error) => {
-					reject(error);
-				});
-			});
-
-			// Start the project automatically
-			console.log('\n[ZYKET] Starting project...\n');
-			const nodeStart = spawn('node', ['index.js'], {
-				cwd: process.cwd(),
-				stdio: 'inherit',
-				shell: true
-			});
-
-			nodeStart.on('error', (error) => {
-				console.error('[ZYKET] Error starting project:', error);
-			});
-		},
-		'install-template': async () => {
-			const templates = templateManager.getTemplates();
-			const response = await prompts({
-				type: 'select',
-				name: 'templateToInstall',
-				message: '[ZYKET] What template would you like to install?',
-				choices: [
-					...templates.map((template) => ({ title: template.toUpperCase(), value: template, description: '', disabled: false })),
-				],
-				initial: 0
-			});
-			if(!templateManager.exists(response.templateToInstall)) throw new Error(`Template ${response.templateToInstall} not found`);
-			templateManager.installTemplate(response.templateToInstall);
-		},
-		/*'remove-template': async () => {
-			const response = await prompts({
-				type: 'select',
-				name: 'templateToRemove',
-				message: '[ZYKET] What template would you like to remove?',
-				choices: [
-					{ title: 'Auth', value: 'auth', description: 'Authentication template', disabled: false },
-					{ title: 'Chat', value: 'chat', description: 'Chat template', disabled: false },
-				],
-				initial: 0
-			});
-			console.log(`Removing template: ${response.templateToRemove}`);
-		}*/
-	};
-
-	await actions[actionToRun]();
-})();
+#!/usr/bin/env node
+const prompts = require('prompts');
+const fs = require('fs');
+const path = require('path');
+const { spawn } = require('child_process');
+const TemplateManager = require('../src/services/template-manager');
+const EnvManager = require('../src/utils/EnvManager');
+const templateManager = new TemplateManager();
+
+const ZYKET_PKG = (() => {
+	try { return require('../package.json'); } catch { return { version: '1.0.0', dependencies: {} }; }
+})();
+const ZYKET_VERSION = ZYKET_PKG.version || '1.0.0';
+
+const TEMPLATE_DESCRIPTIONS = {
+	default: 'Full-stack starter (React frontend + auth)',
+	'api-rest': 'Backend-only REST API (auth + CRUD)',
+	'saas-multitenant': 'Multi-tenant SaaS (orgs, roles) + dashboard',
+	'realtime-chat': 'Authenticated real-time chat (Socket.IO) + UI',
+};
+
+// ---- helpers ----------------------------------------------------------------
+
+function templateChoices() {
+	const all = templateManager.getTemplates();
+	// Show "default" first, then the rest.
+	const ordered = ['default', ...all.filter((t) => t !== 'default')];
+	return ordered
+		.filter((t) => templateManager.exists(t))
+		.map((t) => ({ title: t, value: t, description: TEMPLATE_DESCRIPTIONS[t] || '' }));
+}
+
+// Write every file of a template into the project, stripping the template-name
+// prefix. Existing files are left untouched. Returns whether the template ships
+// its own index.js. `exclude(rel)` can skip specific files.
+function writeTemplateFiles(templateName, { exclude = () => false } = {}) {
+	const files = templateManager.getTemplate(templateName);
+	let hasIndex = false;
+	for (const file of files) {
+		const rel = file.route.split('/').slice(1).join('/');
+		if (!rel || exclude(rel)) continue;
+		if (rel === 'index.js') hasIndex = true;
+		const dest = path.join(process.cwd(), rel);
+		fs.mkdirSync(path.dirname(dest), { recursive: true });
+		if (!fs.existsSync(dest)) fs.writeFileSync(dest, file.content);
+	}
+	return { hasIndex };
+}
+
+// Merge KEY=VALUE pairs from a copied .env.example onto the generated .env so a
+// template can override defaults (e.g. DISABLE_VITE=false).
+function applyEnvOverridesFromExample(envPath) {
+	const examplePath = path.join(process.cwd(), '.env.example');
+	if (!fs.existsSync(examplePath)) return;
+	for (const line of fs.readFileSync(examplePath, 'utf-8').split(/\r?\n/)) {
+		const trimmed = line.trim();
+		if (!trimmed || trimmed.startsWith('#')) continue;
+		const eq = trimmed.indexOf('=');
+		if (eq === -1) continue;
+		const key = trimmed.slice(0, eq).trim();
+		const value = trimmed.slice(eq + 1).trim();
+		if (key) EnvManager.setEnvVariable(envPath, key, value);
+	}
+}
+
+function writeDefaultIndex() {
+	const indexContent = `const { Kernel } = require('zyket');
+
+const kernel = new Kernel({
+	services: [
+		['auth', require('./src/services/auth'), ["@service_container"]],
+	]
+});
+
+kernel.boot().then(() => {
+    console.log('Kernel booted successfully!');
+}).catch((error) => {
+    console.error('Error booting kernel:', error);
+});
+`;
+	fs.writeFileSync(path.join(process.cwd(), 'index.js'), indexContent);
+}
+
+function templateRoutes(name) {
+	return templateManager.getTemplate(name).map((f) => f.route);
+}
+
+function templateHasFrontend(name) {
+	return templateRoutes(name).some((r) => r.startsWith(`${name}/frontend/`));
+}
+
+function templateUsesAuth(name) {
+	return templateRoutes(name).some((r) => r.startsWith(`${name}/src/services/auth/`));
+}
+
+// Build the dependency set a generated project needs. The user's own code
+// (frontend configs, handlers, stores) imports these DIRECTLY, so they must be
+// real project dependencies — not just transitive deps of zyket. Versions are
+// pinned to whatever this zyket release uses.
+function depsForTemplate(template) {
+	const deps = { zyket: `^${ZYKET_VERSION}` };
+	if (template === 'default') return deps; // default init is backend-only
+
+	const copy = (names) => names.forEach((n) => {
+		const v = ZYKET_PKG.dependencies?.[n];
+		if (v) deps[n] = v;
+	});
+
+	if (templateUsesAuth(template)) copy(['better-auth']);
+	if (templateHasFrontend(template)) {
+		copy([
+			'react', 'react-dom', 'react-router-dom', 'zustand', 'prop-types',
+			'vite', '@vitejs/plugin-react', '@tailwindcss/vite', 'tailwindcss',
+		]);
+	}
+	if (template === 'realtime-chat') copy(['socket.io-client']);
+
+	return deps;
+}
+
+function ensurePackageJson(template) {
+	const packageJsonPath = path.join(process.cwd(), 'package.json');
+	if (fs.existsSync(packageJsonPath)) return;
+	const packageJson = {
+		name: path.basename(process.cwd()),
+		version: '1.0.0',
+		description: 'Zyket application',
+		main: 'index.js',
+		scripts: { dev: 'node index.js' },
+		keywords: [],
+		author: '',
+		license: 'ISC',
+		dependencies: depsForTemplate(template),
+	};
+	fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, 2));
+}
+
+function npmInstall() {
+	return new Promise((resolve, reject) => {
+		const npmInstallProcess = spawn('npm', ['install'], { cwd: process.cwd(), stdio: 'inherit', shell: true });
+		npmInstallProcess.on('close', (code) => {
+			if (code === 0) resolve();
+			else reject(new Error(`npm install exited with code ${code}`));
+		});
+		npmInstallProcess.on('error', reject);
+	});
+}
+
+// ---- main -------------------------------------------------------------------
+
+(async () => {
+	process.stdout.write("");
+	await templateManager.boot();
+
+	const args = process.argv.slice(2);
+	const directCommand = args[0];
+
+	let actionToRun = null;
+	let templateArg = null;
+
+	if (directCommand === 'init') {
+		actionToRun = 'init-project';
+		templateArg = args[1] || null; // e.g. `npx zyket init api-rest`
+	} else {
+		const response = await prompts({
+			type: 'select',
+			name: 'value',
+			message: '[ZYKET] What do you want to do?',
+			choices: [
+				{ title: 'Initialize Project', value: 'init-project', description: 'Scaffold a new Zyket project from a template', disabled: false },
+				{ title: 'Install Template', value: 'install-template', description: 'Add a template into the current project', disabled: false },
+			],
+			initial: 0,
+		});
+		actionToRun = response.value;
+	}
+
+	if (!actionToRun) {
+		console.log('[ZYKET] No action selected. Exiting.');
+		return;
+	}
+
+	const actions = {
+		'init-project': async (preselectedTemplate) => {
+			// Resolve which template to scaffold.
+			let template = preselectedTemplate && templateManager.exists(preselectedTemplate) ? preselectedTemplate : null;
+			if (preselectedTemplate && !template) {
+				console.log(`[ZYKET] Template '${preselectedTemplate}' not found. Pick one:`);
+			}
+			if (!template) {
+				const response = await prompts({
+					type: 'select',
+					name: 'value',
+					message: '[ZYKET] Choose a template to initialize',
+					choices: templateChoices(),
+					initial: 0,
+				});
+				template = response.value;
+			}
+
+			if (!template) {
+				console.log('[ZYKET] No template selected. Exiting.');
+				return;
+			}
+
+			const indexPath = path.join(process.cwd(), 'index.js');
+			const envPath = path.join(process.cwd(), '.env');
+
+			if (fs.existsSync(indexPath)) {
+				const overwrite = await prompts({
+					type: 'confirm',
+					name: 'value',
+					message: '[ZYKET] index.js already exists. Continue scaffolding (existing files are kept)?',
+					initial: false,
+				});
+				if (!overwrite.value) {
+					console.log('[ZYKET] Initialization cancelled.');
+					return;
+				}
+			}
+
+			console.log(`[ZYKET] Initializing with template '${template}'...`);
+			EnvManager.createEnvFile(envPath);
+
+			if (template === 'default') {
+				// Curated default: backend files only (no frontend, no socket guards/handlers).
+				writeTemplateFiles('default', {
+					exclude: (rel) => !(
+						(rel.startsWith('src/') || rel.startsWith('config/')) &&
+						!rel.startsWith('src/guards/') &&
+						!rel.startsWith('src/handlers/')
+					),
+				});
+				writeDefaultIndex();
+			} else {
+				// Self-contained template: copy everything (incl. its index.js and frontend).
+				const { hasIndex } = writeTemplateFiles(template);
+				applyEnvOverridesFromExample(envPath);
+				if (!hasIndex) writeDefaultIndex();
+			}
+
+			ensurePackageJson(template);
+
+			console.log('\n[ZYKET] Installing dependencies...');
+			await npmInstall();
+
+			console.log(`\n[ZYKET] ✅ Project initialized with template '${template}'!`);
+
+			if (template === 'default') {
+				// Preserve previous behavior: start immediately.
+				console.log('\n[ZYKET] Starting project...\n');
+				spawn('node', ['index.js'], { cwd: process.cwd(), stdio: 'inherit', shell: true })
+					.on('error', (error) => console.error('[ZYKET] Error starting project:', error));
+				return;
+			}
+
+			// Templates that ship auth need their tables created first.
+			const usesAuth = fs.existsSync(path.join(process.cwd(), 'src', 'services', 'auth'));
+			console.log('\nNext steps:');
+			if (usesAuth) console.log('  npx @better-auth/cli migrate   # create the auth tables');
+			console.log('  node index.js\n');
+			if (fs.existsSync(path.join(process.cwd(), 'README.md'))) {
+				console.log('See README.md for template-specific details.\n');
+			}
+		},
+
+		'install-template': async () => {
+			const templates = templateManager.getTemplates();
+			const response = await prompts({
+				type: 'select',
+				name: 'templateToInstall',
+				message: '[ZYKET] What template would you like to install?',
+				choices: templates.map((template) => ({ title: template.toUpperCase(), value: template, description: TEMPLATE_DESCRIPTIONS[template] || '', disabled: false })),
+				initial: 0,
+			});
+			if (!templateManager.exists(response.templateToInstall)) throw new Error(`Template ${response.templateToInstall} not found`);
+			templateManager.installTemplate(response.templateToInstall);
+		},
+	};
+
+	await actions[actionToRun](templateArg);
+})();

package/index.js

@@ -2,8 +2,8 @@ const Kernel = require("./src/kernel");
 const Service = require("./src/services/Service");
 const EnvManager = require("./src/utils/EnvManager");
 
-const {Route, Middleware, Express} = require("./src/services/express");
-const { Handler, Guard } = require("./src/services/socketio");
+const {Route, Middleware, Express, RequireAuthMiddleware, RequireAdminMiddleware} = require("./src/services/express");
+const { Handler, Guard, AuthGuard } = require("./src/services/socketio");
 const Schedule = require("./src/services/scheduler/Schedule");
 const Event = require("./src/services/events/Event");
 const Worker = require("./src/services/bullmq/Worker");
@@ -20,7 +20,8 @@ module.exports = {
   Express,
   Kernel, Service,
   Route, Middleware,
-  Handler, Guard,
+  RequireAuthMiddleware, RequireAdminMiddleware,
+  Handler, Guard, AuthGuard,
   Schedule, Event,
   Worker,
   EnvManager,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zyket",
-  "version": "1.2.17",
+  "version": "1.2.19",
   "main": "index.js",
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1"
@@ -39,6 +39,7 @@
     "redis": "^5.11.0",
     "sequelize": "^6.37.8",
     "socket.io": "^4.8.3",
+    "socket.io-client": "^4.8.3",
     "sqlite3": "^6.0.1",
     "swagger-jsdoc": "^6.2.8",
     "swagger-ui-express": "^5.0.1",
@@ -50,5 +51,8 @@
   "optionalDependencies": {
     "@socket.io/redis-adapter": "^8.3.0",
     "ioredis": "^5.6.1"
+  },
+  "overrides": {
+    "ajv": "^8.17.1"
   }
 }

package/src/extensions/bullboard/index.js

@@ -7,14 +7,17 @@ const basicAuth = require('express-basic-auth')
 module.exports = class BullBoardExtension  extends Extension {
   path;
 
-  constructor({ path = '/bullboard', basePath = '' } = {}) {
+  constructor({ path = '/bullboard', basePath = '', middlewares = [] } = {}) {
     super("BullBoardExtension");
     this.path = path || '/bullboard';
     this.basePath = basePath;
+    // Optional Express middlewares (e.g. custom auth) applied before the board.
+    this.middlewares = middlewares || [];
   }
 
   load(container) {
-    if (!container.get('bullmq')) return container.get('logger').warn('BullBoardExtension: bullmq service not found, skipping BullBoard setup');
+    const logger = container.get('logger')
+    if (!container.get('bullmq')) return logger.warn('BullBoardExtension: bullmq service not found, skipping BullBoard setup');
     const bull = container.get('bullmq')
     const serverAdapter = new ExpressAdapter()
     serverAdapter.setBasePath(this.basePath + this.path)
@@ -25,7 +28,7 @@ module.exports = class BullBoardExtension  extends Extension {
     })
 
     const app = container.get('express').app()
-    const middlewares = []
+    const middlewares = [...this.middlewares]
 
     if (process.env.BULLBOARD_ADMIN_PASSWORD) {
       middlewares.push(basicAuth({
@@ -34,6 +37,14 @@ module.exports = class BullBoardExtension  extends Extension {
       }))
     }
 
+    // Fail closed: never expose the queue dashboard (jobs, payloads, retry/delete)
+    // without authentication. Require a password or custom auth middlewares.
+    if (middlewares.length === 0) {
+      return logger.warn(
+        `BullBoardExtension: no authentication configured. Set BULLBOARD_ADMIN_PASSWORD or pass "middlewares" to expose the dashboard. Skipping mount of ${this.path}.`
+      )
+    }
+
     app.use(this.path, ...middlewares, serverAdapter.getRouter())
   }
 }