rocketdoo 3.2.1__tar.gz → 3.4.0__tar.gz

{rocketdoo-3.2.1 → rocketdoo-3.4.0}/LICENSE

@@ -57,7 +57,7 @@ If the Library as you received it specifies that a proxy can decide whether futu
 <div RKD as ROCKETDOO V3=""></div>
 
 Licencia: LGPL-3.0+
-Versión: "3.2.1"
+Versión: "3.4.0"
 Autor: Horacio Montaño
-Fecha: 13/09/2026
+Fecha: 16/09/2026
 Descripción: Framework to development Odoo

{rocketdoo-3.2.1/rocketdoo.egg-info → rocketdoo-3.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rocketdoo
-Version: 3.2.1
+Version: 3.4.0
 Summary: Framework for creating Odoo development environments with Docker and custom templates.
 Author-email: Horacio Montaño <horaciomontano@hdmsoft.com.ar>
 License: GNU LESSER GENERAL PUBLIC LICENSE
@@ -62,9 +62,9 @@ License: GNU LESSER GENERAL PUBLIC LICENSE
         <div RKD as ROCKETDOO V3=""></div>
         
         Licencia: LGPL-3.0+
-        Versión: "3.2.1"
+        Versión: "3.4.0"
         Autor: Horacio Montaño
-        Fecha: 13/09/2026
+        Fecha: 16/09/2026
         Descripción: Framework to development Odoo
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -97,7 +97,7 @@ Odoo Development Framework
    - "Horacio Montaño"
 
 ## Version: 
-   - "3.2.1"
+   - "3.4.0"
 
 ----------------------------------------------------------------------------------------------------------------------------------------------------------
 
@@ -472,6 +472,10 @@ rkd mail open    # Open http://localhost:8025 in your browser
 
 Mailpit is toggled by commenting/uncommenting its service block in `docker-compose.yaml` using special markers (`# rkd:mailpit`). When enabled, Odoo's SMTP configuration is automatically updated to route emails through Mailpit.
 
+`rkd mail on`/`off` also write a `Mailpit (rkd)` record straight into the project's `ir.mail_server` table (Odoo's technical settings, *Outgoing Mail Servers*), so emails are captured with no extra manual setup. `on` creates or reactivates that record with `sequence = 1`; `off` archives it (never deletes it), leaving any of your own mail servers untouched. With a single database this is automatic; with more than one, pass `--db NAME` to `on`, `off`, or `status` — with several databases and no `--db`, nothing is written or read and the command tells you to re-run with it. If the `db` container isn't reachable (project stopped, Docker not running), the rest of the command still runs and it reports the reason; re-running `rkd mail on` once the project is up fixes it.
+
+`rkd mail status` shows this record's state (active, archived, not created yet, or not checked, with the reason) plus any other active `ir.mail_server` in the database. **A `sequence = 1` on the Mailpit record does not guarantee it captures every email**: Odoo's server selection filters by `from_filter` before it sorts by sequence, so a server you (or a restored production dump) already have, with a `from_filter` matching the sender, can still win even with a higher sequence number. `mail status` warns loudly when another active server has `sequence <= 1` (it can win the sequence tie-break outright), and with a softer note whenever any other server is active at all, since `from_filter` can override sequence regardless.
+
 ---
 
 #### `rkd traefik` — Traefik Reverse Proxy
@@ -528,12 +532,19 @@ rkd instance status                  # Show configured environments
 Rocketdoo v3 includes a professional web-based management interface, accessible from your browser just like Odoo — no installation of additional tools required.
 
 ```bash
-rkd gui                  # Launch GUI on http://localhost:8070
-rkd gui --open           # Also open the browser automatically
+rkd gui                  # Launch GUI, prints a tokenized URL to open
+rkd gui --open           # Also open that same URL in the browser automatically
 rkd gui --port 9090      # Use a custom port
 rkd gui --cwd /my/proj   # Point to a specific project directory
 ```
 
+`rkd gui` prints a URL of the form `http://127.0.0.1:8070/?token=<session-token>` —
+use that exact URL, not a bare `http://localhost:8070`. Every API and WebSocket
+call requires this session token (generated fresh on each `rkd gui` start), so
+opening the GUI without it shows a message asking you to use the printed URL
+instead of the project's data. `--open` already opens the correct, tokenized
+URL for you.
+
 The GUI provides a complete visual interface for all Rocketdoo v3 features:
 
 | Section | What you can do |
@@ -551,7 +562,10 @@ Additional interface features:
 - Real-time log streaming via WebSocket
 - Runs entirely from the installed package — no Node.js or build step required
 
-> The GUI server runs locally and is bound to `127.0.0.1` by default, so it is only accessible from your own machine.
+> The GUI server runs locally and is bound to `127.0.0.1` by default, so it is only accessible
+> from your own machine. The session token adds a second layer on top of that: even another
+> process running as your own user on the same machine cannot call the API without it. See
+> [SECURITY.md](SECURITY.md) for the full threat model.
 
 ---
 
@@ -611,6 +625,15 @@ deploy — no manual step needed.
 
 ---
 
+### Security
+
+Rocketdoo is a local, single-user development tool, not a hardened multi-user
+service. See [SECURITY.md](SECURITY.md) for the threat model: what the GUI
+exposes, where credentials live on disk, and the residual risks that are
+accepted rather than solved.
+
+---
+
 ### Technical Support
 
 - If you have any questions or issues with our development environment, you can contact us and submit your inquiry or support ticket by clicking on the link below.

{rocketdoo-3.2.1 → rocketdoo-3.4.0}/README.md

@@ -15,7 +15,7 @@ Odoo Development Framework
    - "Horacio Montaño"
 
 ## Version: 
-   - "3.2.1"
+   - "3.4.0"
 
 ----------------------------------------------------------------------------------------------------------------------------------------------------------
 
@@ -390,6 +390,10 @@ rkd mail open    # Open http://localhost:8025 in your browser
 
 Mailpit is toggled by commenting/uncommenting its service block in `docker-compose.yaml` using special markers (`# rkd:mailpit`). When enabled, Odoo's SMTP configuration is automatically updated to route emails through Mailpit.
 
+`rkd mail on`/`off` also write a `Mailpit (rkd)` record straight into the project's `ir.mail_server` table (Odoo's technical settings, *Outgoing Mail Servers*), so emails are captured with no extra manual setup. `on` creates or reactivates that record with `sequence = 1`; `off` archives it (never deletes it), leaving any of your own mail servers untouched. With a single database this is automatic; with more than one, pass `--db NAME` to `on`, `off`, or `status` — with several databases and no `--db`, nothing is written or read and the command tells you to re-run with it. If the `db` container isn't reachable (project stopped, Docker not running), the rest of the command still runs and it reports the reason; re-running `rkd mail on` once the project is up fixes it.
+
+`rkd mail status` shows this record's state (active, archived, not created yet, or not checked, with the reason) plus any other active `ir.mail_server` in the database. **A `sequence = 1` on the Mailpit record does not guarantee it captures every email**: Odoo's server selection filters by `from_filter` before it sorts by sequence, so a server you (or a restored production dump) already have, with a `from_filter` matching the sender, can still win even with a higher sequence number. `mail status` warns loudly when another active server has `sequence <= 1` (it can win the sequence tie-break outright), and with a softer note whenever any other server is active at all, since `from_filter` can override sequence regardless.
+
 ---
 
 #### `rkd traefik` — Traefik Reverse Proxy
@@ -446,12 +450,19 @@ rkd instance status                  # Show configured environments
 Rocketdoo v3 includes a professional web-based management interface, accessible from your browser just like Odoo — no installation of additional tools required.
 
 ```bash
-rkd gui                  # Launch GUI on http://localhost:8070
-rkd gui --open           # Also open the browser automatically
+rkd gui                  # Launch GUI, prints a tokenized URL to open
+rkd gui --open           # Also open that same URL in the browser automatically
 rkd gui --port 9090      # Use a custom port
 rkd gui --cwd /my/proj   # Point to a specific project directory
 ```
 
+`rkd gui` prints a URL of the form `http://127.0.0.1:8070/?token=<session-token>` —
+use that exact URL, not a bare `http://localhost:8070`. Every API and WebSocket
+call requires this session token (generated fresh on each `rkd gui` start), so
+opening the GUI without it shows a message asking you to use the printed URL
+instead of the project's data. `--open` already opens the correct, tokenized
+URL for you.
+
 The GUI provides a complete visual interface for all Rocketdoo v3 features:
 
 | Section | What you can do |
@@ -469,7 +480,10 @@ Additional interface features:
 - Real-time log streaming via WebSocket
 - Runs entirely from the installed package — no Node.js or build step required
 
-> The GUI server runs locally and is bound to `127.0.0.1` by default, so it is only accessible from your own machine.
+> The GUI server runs locally and is bound to `127.0.0.1` by default, so it is only accessible
+> from your own machine. The session token adds a second layer on top of that: even another
+> process running as your own user on the same machine cannot call the API without it. See
+> [SECURITY.md](SECURITY.md) for the full threat model.
 
 ---
 
@@ -529,6 +543,15 @@ deploy — no manual step needed.
 
 ---
 
+### Security
+
+Rocketdoo is a local, single-user development tool, not a hardened multi-user
+service. See [SECURITY.md](SECURITY.md) for the threat model: what the GUI
+exposes, where credentials live on disk, and the residual risks that are
+accepted rather than solved.
+
+---
+
 ### Technical Support
 
 - If you have any questions or issues with our development environment, you can contact us and submit your inquiry or support ticket by clicking on the link below.

{rocketdoo-3.2.1 → rocketdoo-3.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "rocketdoo"
-version = "3.2.1"
+version = "3.4.0"
 description = "Framework for creating Odoo development environments with Docker and custom templates."
 authors = [
     { name = "Horacio Montaño", email = "horaciomontano@hdmsoft.com.ar" }

rocketdoo-3.4.0/rocketdoo/core/odoo_db.py

@@ -0,0 +1,191 @@
+"""Access to the project's PostgreSQL container: reads and Mailpit writes.
+
+The `pg_database` query and the container lookup used to live only in
+`pack_environment`; the GUI module-update feature needs the same data, so
+this consolidates them into a single place (like `core/compose.py` did for
+`docker compose` in #137) instead of growing a third copy. `rkd mail on/off`
+also writes the Rocketdoo `ir.mail_server` row here (#176), so this module is
+no longer read-only.
+"""
+
+import subprocess
+
+from rocketdoo.project_info import read_docker_compose
+
+PSQL_USER = "root"  # POSTGRES_USER set by the docker-compose template
+
+MAILPIT_SERVER_NAME = "Mailpit (rkd)"
+MAILPIT_SMTP_HOST = "mailpit"
+MAILPIT_SMTP_PORT = 1025
+MAILPIT_SEQUENCE = 1  # Odoo's default is 10: Mailpit must win the tie
+
+
+def db_container(compose_data: dict | None = None) -> str | None:
+    """Return the `db` service's container name, or None if it can't be read."""
+    if compose_data is None:
+        compose_data = read_docker_compose()
+    try:
+        return compose_data["services"]["db"]["container_name"]
+    except (KeyError, TypeError):
+        return None
+
+
+def _psql(db: str, sql: str, *flags: str, compose_data: dict | None = None) -> tuple[str, str]:
+    """Run `sql` against `db` via `docker exec ... psql`. Returns (stdout, error).
+
+    A non-empty error means the query did not run: stdout is not meaningful.
+    Shared by every query/write in this module so the argv and the error
+    translation (missing docker, unreachable container, psql failure) live in
+    one place.
+    """
+    container = db_container(compose_data)
+    if not container:
+        return "", "no database container configured"
+
+    try:
+        result = subprocess.run(
+            ["docker", "exec", container, "psql", "-U", PSQL_USER, "-d", db, *flags, "-c", sql],
+            capture_output=True,
+            text=True,
+            timeout=15,
+        )
+    except FileNotFoundError:
+        return "", "docker not found"
+    except (OSError, subprocess.SubprocessError) as exc:
+        return "", str(exc)
+
+    if result.returncode != 0:
+        return "", result.stderr.strip()
+
+    return result.stdout, ""
+
+
+def databases_result(compose_data: dict | None = None) -> tuple[list[str], str]:
+    """List of user databases plus the reason it came back empty, if any.
+
+    Excludes `postgres` and the templates, matching what `rkd pack` already
+    queried. Any failure to reach the container yields an empty list.
+    """
+    stdout, error = _psql(
+        "postgres",
+        "SELECT datname FROM pg_database WHERE datistemplate = false AND datname != 'postgres';",
+        "-t",
+        compose_data=compose_data,
+    )
+    if error:
+        return [], error
+
+    return [line.strip() for line in stdout.splitlines() if line.strip()], ""
+
+
+def list_databases(compose_data: dict | None = None) -> list[str]:
+    """List of user databases. Use `databases_result` when the reason matters."""
+    return databases_result(compose_data)[0]
+
+
+def module_states(db: str) -> tuple[dict[str, str], str]:
+    """Map `{module_name: state}` read from `ir_module_module` in `db`.
+
+    `db` is not validated here: that is the trust boundary's job (the GUI
+    layer), and keeping it in one place avoids the validation being
+    duplicated with different criteria. If `db` isn't an Odoo database,
+    psql fails and ({}, stderr) is returned.
+    """
+    stdout, error = _psql(db, "SELECT name, state FROM ir_module_module;", "-t", "-A", "-F", "\t")
+    if error:
+        return {}, error
+
+    states = {}
+    for line in stdout.splitlines():
+        name, _, state = line.strip().partition("\t")
+        if name and state:
+            states[name] = state
+    return states, ""
+
+
+def mail_servers(db: str) -> tuple[list[dict], str]:
+    """Every ir.mail_server row in `db`, ordered the way Odoo orders them.
+
+    All rows are returned, active or not, so `rkd mail status` can tell
+    "archived" from "never created" with a single query.
+    """
+    stdout, error = _psql(
+        db,
+        "SELECT id, name, sequence, smtp_host, active FROM ir_mail_server ORDER BY sequence, id;",
+        "-t",
+        "-A",
+        "-F",
+        "\t",
+    )
+    if error:
+        return [], error
+
+    servers = []
+    for line in stdout.splitlines():
+        fields = line.split("\t")
+        if len(fields) != 5:
+            continue
+        raw_id, name, raw_sequence, smtp_host, raw_active = fields
+        try:
+            server_id = int(raw_id)
+            sequence = int(raw_sequence)
+        except ValueError:
+            continue
+        servers.append(
+            {
+                "id": server_id,
+                "name": name,
+                "sequence": sequence,
+                "smtp_host": smtp_host,
+                "active": raw_active == "t",
+            }
+        )
+    return servers, ""
+
+
+def enable_mailpit_server(db: str) -> str:
+    """Create or reactivate the Rocketdoo mail server. Returns '' on success.
+
+    Matched by name + smtp_host, not by id: there is no UNIQUE constraint on
+    name to key an UPSERT off. Idempotent by construction, so callers can run
+    it unconditionally instead of tracking local state.
+    """
+    sql = (
+        "WITH updated AS ("
+        "UPDATE ir_mail_server "
+        f"SET active = true, smtp_port = {MAILPIT_SMTP_PORT}, sequence = {MAILPIT_SEQUENCE}, write_date = now() "
+        f"WHERE name = '{MAILPIT_SERVER_NAME}' AND smtp_host = '{MAILPIT_SMTP_HOST}' "
+        "RETURNING id"
+        ") "
+        "INSERT INTO ir_mail_server "
+        "(name, smtp_host, smtp_port, smtp_encryption, smtp_authentication, sequence, active, create_date, write_date) "
+        f"SELECT '{MAILPIT_SERVER_NAME}', '{MAILPIT_SMTP_HOST}', {MAILPIT_SMTP_PORT}, 'none', 'login', "
+        f"{MAILPIT_SEQUENCE}, true, now(), now() "
+        "WHERE NOT EXISTS (SELECT 1 FROM updated);"
+    )
+    _, error = _psql(db, sql)
+    return error
+
+
+def disable_mailpit_server(db: str) -> tuple[int, str]:
+    """Archive the Rocketdoo mail server. Returns (rows archived, error).
+
+    Only rows matching both name and smtp_host are touched, and only
+    archived: never DELETE, so a record a user renamed or repurposed is
+    never at risk even if it collides on one of the two conditions.
+    """
+    sql = (
+        "UPDATE ir_mail_server SET active = false, write_date = now() "
+        f"WHERE name = '{MAILPIT_SERVER_NAME}' AND smtp_host = '{MAILPIT_SMTP_HOST}' "
+        "RETURNING id;"
+    )
+    # -q suppresses psql's status line: without it, `RETURNING id` with zero
+    # rows still prints "UPDATE 0", which counts as a row and makes the command
+    # report an archive that never happened.
+    stdout, error = _psql(db, sql, "-q", "-t", "-A")
+    if error:
+        return 0, error
+
+    # Count returned ids, not non-empty lines: psql's status line ("UPDATE 0")
+    # is not a row, and counting it reports an archive that never happened.
+    return len([line for line in stdout.splitlines() if line.strip().isdigit()]), ""

{rocketdoo-3.2.1 → rocketdoo-3.4.0}/rocketdoo/gui/server.py

@@ -1,9 +1,12 @@
 import asyncio
+import secrets
 from pathlib import Path
 
 from fastapi import FastAPI, WebSocket, WebSocketDisconnect
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import FileResponse, JSONResponse
+from starlette.datastructures import Headers, QueryParams
+from starlette.routing import get_route_path
 
 from rocketdoo import __version__
 
@@ -62,6 +65,55 @@ async def _stream_process(websocket: WebSocket, cmd: list[str], timeout: float =
             pass
 
 
+class TokenAuthMiddleware:
+    """Require the session token on every /api and /ws request.
+
+    CORS only constrains browsers; any local process can reach 127.0.0.1 and
+    drive Docker or the filesystem through this API. The token raises that bar
+    to "processes that can read the terminal running rkd gui". ASGI middleware
+    is used instead of a FastAPI dependency because the 3 websocket routes are
+    plain ASGI routes on `app`, outside the router, and a dependency cannot
+    reach them; a `BaseHTTPMiddleware` cannot either, since it never sees the
+    `websocket` scope.
+    """
+
+    def __init__(self, app, token: str):
+        self.app = app
+        self.token = token
+
+    async def __call__(self, scope, receive, send):
+        if scope["type"] in ("http", "websocket") and self._protected(scope):
+            if not self._authorized(scope):
+                await self._reject(scope, receive, send)
+                return
+        await self.app(scope, receive, send)
+
+    @staticmethod
+    def _protected(scope) -> bool:
+        # get_route_path, not scope["path"]: the router strips root_path before
+        # matching, so mounting this app under a prefix would make the two
+        # diverge and every protected route would answer unauthenticated.
+        path = get_route_path(scope)
+        return (path.startswith("/api/") or path.startswith("/ws/")) and scope.get("method") != "OPTIONS"
+
+    def _authorized(self, scope) -> bool:
+        provided = Headers(scope=scope).get("x-rkd-token") or QueryParams(scope["query_string"]).get("token")
+        # isascii() first: compare_digest raises TypeError on non-ASCII strings,
+        # and the value is entirely attacker-controlled. Without this a crafted
+        # header answers 500 with a traceback instead of 401.
+        if not provided or not provided.isascii():
+            return False
+        return secrets.compare_digest(provided, self.token)
+
+    @staticmethod
+    async def _reject(scope, receive, send):
+        if scope["type"] == "websocket":
+            await send({"type": "websocket.close", "code": 1008})
+        else:
+            response = JSONResponse({"detail": "Unauthorized"}, status_code=401)
+            await response(scope, receive, send)
+
+
 def local_origins(host: str = "127.0.0.1", port: int = DEFAULT_PORT) -> list[str]:
     """Browser origins allowed to call this API.
 
@@ -79,14 +131,26 @@ def local_origins(host: str = "127.0.0.1", port: int = DEFAULT_PORT) -> list[str
     return origins
 
 
-def create_app(host: str = "127.0.0.1", port: int = DEFAULT_PORT) -> FastAPI:
+def create_app(host: str = "127.0.0.1", port: int = DEFAULT_PORT, token: str | None = None) -> FastAPI:
     app = FastAPI(
         title="Rocketdoo GUI",
         version=__version__,
         docs_url="/api/docs",
+        # Under /api so the token middleware covers it: on its default path it
+        # served the full route inventory to anyone on the host.
+        openapi_url="/api/openapi.json",
         redoc_url=None,
     )
 
+    # Generated even if the caller passes nothing: there is no way to end up
+    # with an unprotected API by omission.
+    app.state.rkd_token = token or secrets.token_urlsafe(32)
+
+    # Added before CORSMiddleware so it ends up as the inner layer: CORS stays
+    # the outermost middleware and keeps handling preflight and headers
+    # exactly as before, unaffected by the token check.
+    app.add_middleware(TokenAuthMiddleware, token=app.state.rkd_token)
+
     # Not allow_origins=["*"]: with allow_credentials=True Starlette echoes the
     # caller's Origin back, so any site the user visited while `rkd gui` was
     # running could read /api/workspace and POST /api/docker/down.
@@ -176,13 +240,20 @@ def create_app(host: str = "127.0.0.1", port: int = DEFAULT_PORT) -> FastAPI:
             except Exception:
                 pass
 
+    # The SPA is one file with a fixed name, so without this the browser keeps
+    # serving its stored copy across upgrades — a user on a new version saw the
+    # previous interface until a forced refresh. "no-cache" does not disable
+    # caching, it requires revalidation: with the etag already sent, an
+    # unchanged file still answers 304.
+    _SPA_HEADERS = {"Cache-Control": "no-cache"}
+
     @app.get("/", response_class=FileResponse)
     async def root():
-        return FileResponse(STATIC_DIR / "index.html")
+        return FileResponse(STATIC_DIR / "index.html", headers=_SPA_HEADERS)
 
     @app.get("/health")
     async def health():
-        return {"status": "ok", "version": "3.0.0"}
+        return {"status": "ok", "version": __version__}
 
     @app.get("/{path:path}", response_class=FileResponse)
     async def spa_fallback(path: str):
@@ -190,7 +261,7 @@ def create_app(host: str = "127.0.0.1", port: int = DEFAULT_PORT) -> FastAPI:
             return JSONResponse({"error": "Not found"}, status_code=404)
         index = STATIC_DIR / "index.html"
         if index.exists():
-            return FileResponse(index)
+            return FileResponse(index, headers=_SPA_HEADERS)
         return JSONResponse({"error": "GUI not found"}, status_code=404)
 
     return app

{rocketdoo-3.2.1 → rocketdoo-3.4.0}/rocketdoo/gui/static/index.html

@@ -161,11 +161,28 @@ html.light ::-webkit-scrollbar-thumb:hover { background: #4A6080; }
 <script>
 const { createApp, ref, computed, onMounted, onActivated, onUnmounted, watch, nextTick } = Vue
 
+/* ── Session token ───────────────────────────────────────────────────────── */
+// `rkd gui` prints the URL with `?token=...`; kept in the URL (not stripped
+// after reading it) so a page refresh or a duplicated tab keeps working.
+const TOKEN = new URLSearchParams(location.search).get('token') || ''
+const authError = ref(!TOKEN)
+
+function wsUrl(path) {
+  const proto = location.protocol === 'https:' ? 'wss' : 'ws'
+  const sep = path.includes('?') ? '&' : '?'
+  return `${proto}://${location.host}${path}${sep}token=${TOKEN}`
+}
+
 /* ── API ─────────────────────────────────────────────────────────────────── */
 const api = {
-  async get(p) { const r = await fetch('/api'+p); return r.json() },
+  async get(p) {
+    const r = await fetch('/api'+p, { headers: { 'X-RKD-Token': TOKEN } })
+    if (r.status === 401) authError.value = true
+    return r.json()
+  },
   async post(p, b={}) {
-    const r = await fetch('/api'+p, { method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify(b) })
+    const r = await fetch('/api'+p, { method:'POST', headers:{'Content-Type':'application/json','X-RKD-Token':TOKEN}, body: JSON.stringify(b) })
+    if (r.status === 401) authError.value = true
     return r.json()
   }
 }
@@ -265,8 +282,7 @@ const LogViewer = {
       pending = []
       lines.value = []
       live.value = true
-      const proto = location.protocol==='https:'?'wss':'ws'
-      ws = new WebSocket(`${proto}://${location.host}/ws/logs/${props.name}`)
+      ws = new WebSocket(wsUrl(`/ws/logs/${props.name}`))
       ws.onmessage = e => {
         pending.push(e.data)
         if (!raf) raf = requestAnimationFrame(flush)
@@ -335,8 +351,7 @@ const DockerTerminal = {
     }
 
     onMounted(() => {
-      const proto = location.protocol === 'https:' ? 'wss' : 'ws'
-      ws = new WebSocket(`${proto}://${location.host}${props.url}`)
+      ws = new WebSocket(wsUrl(props.url))
       ws.onmessage = e => {
         const txt = e.data
         if (txt.startsWith('\x00exit:')) {
@@ -2298,10 +2313,20 @@ const App = {
       if (!darkMode.value) document.documentElement.classList.add('light')
       init()
     })
-    return { view, nav, notifs, I, viewMap, currentPath, darkMode, toggleTheme, rkdVersion }
+    return { view, nav, notifs, I, viewMap, currentPath, darkMode, toggleTheme, rkdVersion, authError }
   },
   template: `
-  <div class="layout">
+  <div v-if="authError" style="min-height:100vh;display:flex;align-items:center;justify-content:center;padding:24px;">
+    <div class="card" style="max-width:460px;text-align:center;">
+      <span v-html="I.warn" style="width:32px;height:32px;color:#FCD34D;display:inline-block;margin-bottom:12px;"></span>
+      <h2 style="font-size:16px;margin-bottom:8px;">Session token required</h2>
+      <p style="color:#8CA0C4;font-size:13px;line-height:1.6;">
+        This page has no valid session token. Open the URL printed by <code>rkd gui</code>
+        in the terminal it is running from — it ends with <code>?token=...</code>.
+      </p>
+    </div>
+  </div>
+  <div v-else class="layout">
     <!-- Sidebar -->
     <aside class="sidebar">
       <div class="logo-area">

{rocketdoo-3.2.1 → rocketdoo-3.4.0}/rocketdoo/gui_cli.py

@@ -35,14 +35,15 @@ def gui_command(port, host, auto_open, cwd):
 
     from rocketdoo.gui.server import create_app
 
-    url = f"http://{host}:{port}"
-    browser_note = "opening automatically" if auto_open else "copy the URL above (--open to launch one here)"
+    # Built first so the panel below can show the real, tokenized URL.
+    app = create_app(host=host, port=port)
+    url = f"http://{host}:{port}/?token={app.state.rkd_token}"
+    browser_note = "opening automatically" if auto_open else "not opened (--open to launch one here)"
 
     console.print()
     console.print(
         Panel(
             f"[bold white]Rocketdoo GUI[/bold white] [dim]v{__version__}[/dim]\n\n"
-            f"  [dim]URL:[/dim]      [bold cyan]{url}[/bold cyan]\n"
             f"  [dim]Browser:[/dim]  {browser_note}\n"
             f"  [dim]Stop:[/dim]     [bold]Ctrl+C[/bold] (this terminal stays busy while the server runs)",
             title="[bold blue]RKD GUI[/bold blue]",
@@ -51,9 +52,23 @@ def gui_command(port, host, auto_open, cwd):
             padding=(1, 2),
         )
     )
+    # Outside the panel and unwrapped: the tokenised URL is long, and inside a
+    # bordered box Rich splits it across lines, which breaks copy-paste — the
+    # one thing the user has to do with it.
+    console.print("\n  Open this URL (it carries the session token):\n")
+    console.print(f"  [bold cyan]{url}[/bold cyan]", soft_wrap=True, highlight=False)
     console.print()
 
     if auto_open:
+        # The tokenised URL becomes an argument of the browser helper process
+        # (webbrowser resolves to Popen(["xdg-open", url]) on Linux), so it is
+        # briefly visible in `ps aux` to any local user. Same channel #142
+        # closed for VPS passwords, here as an accepted trade-off of an opt-in
+        # flag: documented in SECURITY.md rather than silently accepted.
+        console.print("[dim]  note: --open passes the tokenised URL to the browser helper,[/dim]")
+        console.print("[dim]        which makes it briefly visible in the process list.[/dim]")
+        console.print()
+
         import threading
         import time
         import webbrowser
@@ -64,7 +79,6 @@ def gui_command(port, host, auto_open, cwd):
 
         threading.Thread(target=_open, daemon=True).start()
 
-    # host/port reach the app so CORS can allow exactly the origin the user
-    # will open, and nothing else.
-    app = create_app(host=host, port=port)
+    # log_level="error" also keeps the token out of an access log: the query
+    # string would otherwise be recorded on every request.
     uvicorn.run(app, host=host, port=port, log_level="error")