rocketdoo 3.3.0__tar.gz → 3.4.0__tar.gz

{rocketdoo-3.3.0 → rocketdoo-3.4.0}/LICENSE

@@ -57,7 +57,7 @@ If the Library as you received it specifies that a proxy can decide whether futu
 <div RKD as ROCKETDOO V3=""></div>
 
 Licencia: LGPL-3.0+
-Versión: "3.3.0"
+Versión: "3.4.0"
 Autor: Horacio Montaño
-Fecha: 14/09/2026
+Fecha: 16/09/2026
 Descripción: Framework to development Odoo

{rocketdoo-3.3.0/rocketdoo.egg-info → rocketdoo-3.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rocketdoo
-Version: 3.3.0
+Version: 3.4.0
 Summary: Framework for creating Odoo development environments with Docker and custom templates.
 Author-email: Horacio Montaño <horaciomontano@hdmsoft.com.ar>
 License: GNU LESSER GENERAL PUBLIC LICENSE
@@ -62,9 +62,9 @@ License: GNU LESSER GENERAL PUBLIC LICENSE
         <div RKD as ROCKETDOO V3=""></div>
         
         Licencia: LGPL-3.0+
-        Versión: "3.3.0"
+        Versión: "3.4.0"
         Autor: Horacio Montaño
-        Fecha: 14/09/2026
+        Fecha: 16/09/2026
         Descripción: Framework to development Odoo
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -97,7 +97,7 @@ Odoo Development Framework
    - "Horacio Montaño"
 
 ## Version: 
-   - "3.3.0"
+   - "3.4.0"
 
 ----------------------------------------------------------------------------------------------------------------------------------------------------------
 
@@ -532,12 +532,19 @@ rkd instance status                  # Show configured environments
 Rocketdoo v3 includes a professional web-based management interface, accessible from your browser just like Odoo — no installation of additional tools required.
 
 ```bash
-rkd gui                  # Launch GUI on http://localhost:8070
-rkd gui --open           # Also open the browser automatically
+rkd gui                  # Launch GUI, prints a tokenized URL to open
+rkd gui --open           # Also open that same URL in the browser automatically
 rkd gui --port 9090      # Use a custom port
 rkd gui --cwd /my/proj   # Point to a specific project directory
 ```
 
+`rkd gui` prints a URL of the form `http://127.0.0.1:8070/?token=<session-token>` —
+use that exact URL, not a bare `http://localhost:8070`. Every API and WebSocket
+call requires this session token (generated fresh on each `rkd gui` start), so
+opening the GUI without it shows a message asking you to use the printed URL
+instead of the project's data. `--open` already opens the correct, tokenized
+URL for you.
+
 The GUI provides a complete visual interface for all Rocketdoo v3 features:
 
 | Section | What you can do |
@@ -555,7 +562,10 @@ Additional interface features:
 - Real-time log streaming via WebSocket
 - Runs entirely from the installed package — no Node.js or build step required
 
-> The GUI server runs locally and is bound to `127.0.0.1` by default, so it is only accessible from your own machine.
+> The GUI server runs locally and is bound to `127.0.0.1` by default, so it is only accessible
+> from your own machine. The session token adds a second layer on top of that: even another
+> process running as your own user on the same machine cannot call the API without it. See
+> [SECURITY.md](SECURITY.md) for the full threat model.
 
 ---
 
@@ -615,6 +625,15 @@ deploy — no manual step needed.
 
 ---
 
+### Security
+
+Rocketdoo is a local, single-user development tool, not a hardened multi-user
+service. See [SECURITY.md](SECURITY.md) for the threat model: what the GUI
+exposes, where credentials live on disk, and the residual risks that are
+accepted rather than solved.
+
+---
+
 ### Technical Support
 
 - If you have any questions or issues with our development environment, you can contact us and submit your inquiry or support ticket by clicking on the link below.

{rocketdoo-3.3.0 → rocketdoo-3.4.0}/README.md

@@ -15,7 +15,7 @@ Odoo Development Framework
    - "Horacio Montaño"
 
 ## Version: 
-   - "3.3.0"
+   - "3.4.0"
 
 ----------------------------------------------------------------------------------------------------------------------------------------------------------
 
@@ -450,12 +450,19 @@ rkd instance status                  # Show configured environments
 Rocketdoo v3 includes a professional web-based management interface, accessible from your browser just like Odoo — no installation of additional tools required.
 
 ```bash
-rkd gui                  # Launch GUI on http://localhost:8070
-rkd gui --open           # Also open the browser automatically
+rkd gui                  # Launch GUI, prints a tokenized URL to open
+rkd gui --open           # Also open that same URL in the browser automatically
 rkd gui --port 9090      # Use a custom port
 rkd gui --cwd /my/proj   # Point to a specific project directory
 ```
 
+`rkd gui` prints a URL of the form `http://127.0.0.1:8070/?token=<session-token>` —
+use that exact URL, not a bare `http://localhost:8070`. Every API and WebSocket
+call requires this session token (generated fresh on each `rkd gui` start), so
+opening the GUI without it shows a message asking you to use the printed URL
+instead of the project's data. `--open` already opens the correct, tokenized
+URL for you.
+
 The GUI provides a complete visual interface for all Rocketdoo v3 features:
 
 | Section | What you can do |
@@ -473,7 +480,10 @@ Additional interface features:
 - Real-time log streaming via WebSocket
 - Runs entirely from the installed package — no Node.js or build step required
 
-> The GUI server runs locally and is bound to `127.0.0.1` by default, so it is only accessible from your own machine.
+> The GUI server runs locally and is bound to `127.0.0.1` by default, so it is only accessible
+> from your own machine. The session token adds a second layer on top of that: even another
+> process running as your own user on the same machine cannot call the API without it. See
+> [SECURITY.md](SECURITY.md) for the full threat model.
 
 ---
 
@@ -533,6 +543,15 @@ deploy — no manual step needed.
 
 ---
 
+### Security
+
+Rocketdoo is a local, single-user development tool, not a hardened multi-user
+service. See [SECURITY.md](SECURITY.md) for the threat model: what the GUI
+exposes, where credentials live on disk, and the residual risks that are
+accepted rather than solved.
+
+---
+
 ### Technical Support
 
 - If you have any questions or issues with our development environment, you can contact us and submit your inquiry or support ticket by clicking on the link below.

{rocketdoo-3.3.0 → rocketdoo-3.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "rocketdoo"
-version = "3.3.0"
+version = "3.4.0"
 description = "Framework for creating Odoo development environments with Docker and custom templates."
 authors = [
     { name = "Horacio Montaño", email = "horaciomontano@hdmsoft.com.ar" }

{rocketdoo-3.3.0 → rocketdoo-3.4.0}/rocketdoo/gui/server.py

@@ -1,9 +1,12 @@
 import asyncio
+import secrets
 from pathlib import Path
 
 from fastapi import FastAPI, WebSocket, WebSocketDisconnect
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import FileResponse, JSONResponse
+from starlette.datastructures import Headers, QueryParams
+from starlette.routing import get_route_path
 
 from rocketdoo import __version__
 
@@ -62,6 +65,55 @@ async def _stream_process(websocket: WebSocket, cmd: list[str], timeout: float =
             pass
 
 
+class TokenAuthMiddleware:
+    """Require the session token on every /api and /ws request.
+
+    CORS only constrains browsers; any local process can reach 127.0.0.1 and
+    drive Docker or the filesystem through this API. The token raises that bar
+    to "processes that can read the terminal running rkd gui". ASGI middleware
+    is used instead of a FastAPI dependency because the 3 websocket routes are
+    plain ASGI routes on `app`, outside the router, and a dependency cannot
+    reach them; a `BaseHTTPMiddleware` cannot either, since it never sees the
+    `websocket` scope.
+    """
+
+    def __init__(self, app, token: str):
+        self.app = app
+        self.token = token
+
+    async def __call__(self, scope, receive, send):
+        if scope["type"] in ("http", "websocket") and self._protected(scope):
+            if not self._authorized(scope):
+                await self._reject(scope, receive, send)
+                return
+        await self.app(scope, receive, send)
+
+    @staticmethod
+    def _protected(scope) -> bool:
+        # get_route_path, not scope["path"]: the router strips root_path before
+        # matching, so mounting this app under a prefix would make the two
+        # diverge and every protected route would answer unauthenticated.
+        path = get_route_path(scope)
+        return (path.startswith("/api/") or path.startswith("/ws/")) and scope.get("method") != "OPTIONS"
+
+    def _authorized(self, scope) -> bool:
+        provided = Headers(scope=scope).get("x-rkd-token") or QueryParams(scope["query_string"]).get("token")
+        # isascii() first: compare_digest raises TypeError on non-ASCII strings,
+        # and the value is entirely attacker-controlled. Without this a crafted
+        # header answers 500 with a traceback instead of 401.
+        if not provided or not provided.isascii():
+            return False
+        return secrets.compare_digest(provided, self.token)
+
+    @staticmethod
+    async def _reject(scope, receive, send):
+        if scope["type"] == "websocket":
+            await send({"type": "websocket.close", "code": 1008})
+        else:
+            response = JSONResponse({"detail": "Unauthorized"}, status_code=401)
+            await response(scope, receive, send)
+
+
 def local_origins(host: str = "127.0.0.1", port: int = DEFAULT_PORT) -> list[str]:
     """Browser origins allowed to call this API.
 
@@ -79,14 +131,26 @@ def local_origins(host: str = "127.0.0.1", port: int = DEFAULT_PORT) -> list[str
     return origins
 
 
-def create_app(host: str = "127.0.0.1", port: int = DEFAULT_PORT) -> FastAPI:
+def create_app(host: str = "127.0.0.1", port: int = DEFAULT_PORT, token: str | None = None) -> FastAPI:
     app = FastAPI(
         title="Rocketdoo GUI",
         version=__version__,
         docs_url="/api/docs",
+        # Under /api so the token middleware covers it: on its default path it
+        # served the full route inventory to anyone on the host.
+        openapi_url="/api/openapi.json",
         redoc_url=None,
     )
 
+    # Generated even if the caller passes nothing: there is no way to end up
+    # with an unprotected API by omission.
+    app.state.rkd_token = token or secrets.token_urlsafe(32)
+
+    # Added before CORSMiddleware so it ends up as the inner layer: CORS stays
+    # the outermost middleware and keeps handling preflight and headers
+    # exactly as before, unaffected by the token check.
+    app.add_middleware(TokenAuthMiddleware, token=app.state.rkd_token)
+
     # Not allow_origins=["*"]: with allow_credentials=True Starlette echoes the
     # caller's Origin back, so any site the user visited while `rkd gui` was
     # running could read /api/workspace and POST /api/docker/down.

{rocketdoo-3.3.0 → rocketdoo-3.4.0}/rocketdoo/gui/static/index.html

@@ -161,11 +161,28 @@ html.light ::-webkit-scrollbar-thumb:hover { background: #4A6080; }
 <script>
 const { createApp, ref, computed, onMounted, onActivated, onUnmounted, watch, nextTick } = Vue
 
+/* ── Session token ───────────────────────────────────────────────────────── */
+// `rkd gui` prints the URL with `?token=...`; kept in the URL (not stripped
+// after reading it) so a page refresh or a duplicated tab keeps working.
+const TOKEN = new URLSearchParams(location.search).get('token') || ''
+const authError = ref(!TOKEN)
+
+function wsUrl(path) {
+  const proto = location.protocol === 'https:' ? 'wss' : 'ws'
+  const sep = path.includes('?') ? '&' : '?'
+  return `${proto}://${location.host}${path}${sep}token=${TOKEN}`
+}
+
 /* ── API ─────────────────────────────────────────────────────────────────── */
 const api = {
-  async get(p) { const r = await fetch('/api'+p); return r.json() },
+  async get(p) {
+    const r = await fetch('/api'+p, { headers: { 'X-RKD-Token': TOKEN } })
+    if (r.status === 401) authError.value = true
+    return r.json()
+  },
   async post(p, b={}) {
-    const r = await fetch('/api'+p, { method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify(b) })
+    const r = await fetch('/api'+p, { method:'POST', headers:{'Content-Type':'application/json','X-RKD-Token':TOKEN}, body: JSON.stringify(b) })
+    if (r.status === 401) authError.value = true
     return r.json()
   }
 }
@@ -265,8 +282,7 @@ const LogViewer = {
       pending = []
       lines.value = []
       live.value = true
-      const proto = location.protocol==='https:'?'wss':'ws'
-      ws = new WebSocket(`${proto}://${location.host}/ws/logs/${props.name}`)
+      ws = new WebSocket(wsUrl(`/ws/logs/${props.name}`))
       ws.onmessage = e => {
         pending.push(e.data)
         if (!raf) raf = requestAnimationFrame(flush)
@@ -335,8 +351,7 @@ const DockerTerminal = {
     }
 
     onMounted(() => {
-      const proto = location.protocol === 'https:' ? 'wss' : 'ws'
-      ws = new WebSocket(`${proto}://${location.host}${props.url}`)
+      ws = new WebSocket(wsUrl(props.url))
       ws.onmessage = e => {
         const txt = e.data
         if (txt.startsWith('\x00exit:')) {
@@ -2298,10 +2313,20 @@ const App = {
       if (!darkMode.value) document.documentElement.classList.add('light')
       init()
     })
-    return { view, nav, notifs, I, viewMap, currentPath, darkMode, toggleTheme, rkdVersion }
+    return { view, nav, notifs, I, viewMap, currentPath, darkMode, toggleTheme, rkdVersion, authError }
   },
   template: `
-  <div class="layout">
+  <div v-if="authError" style="min-height:100vh;display:flex;align-items:center;justify-content:center;padding:24px;">
+    <div class="card" style="max-width:460px;text-align:center;">
+      <span v-html="I.warn" style="width:32px;height:32px;color:#FCD34D;display:inline-block;margin-bottom:12px;"></span>
+      <h2 style="font-size:16px;margin-bottom:8px;">Session token required</h2>
+      <p style="color:#8CA0C4;font-size:13px;line-height:1.6;">
+        This page has no valid session token. Open the URL printed by <code>rkd gui</code>
+        in the terminal it is running from — it ends with <code>?token=...</code>.
+      </p>
+    </div>
+  </div>
+  <div v-else class="layout">
     <!-- Sidebar -->
     <aside class="sidebar">
       <div class="logo-area">

{rocketdoo-3.3.0 → rocketdoo-3.4.0}/rocketdoo/gui_cli.py

@@ -35,14 +35,15 @@ def gui_command(port, host, auto_open, cwd):
 
     from rocketdoo.gui.server import create_app
 
-    url = f"http://{host}:{port}"
-    browser_note = "opening automatically" if auto_open else "copy the URL above (--open to launch one here)"
+    # Built first so the panel below can show the real, tokenized URL.
+    app = create_app(host=host, port=port)
+    url = f"http://{host}:{port}/?token={app.state.rkd_token}"
+    browser_note = "opening automatically" if auto_open else "not opened (--open to launch one here)"
 
     console.print()
     console.print(
         Panel(
             f"[bold white]Rocketdoo GUI[/bold white] [dim]v{__version__}[/dim]\n\n"
-            f"  [dim]URL:[/dim]      [bold cyan]{url}[/bold cyan]\n"
             f"  [dim]Browser:[/dim]  {browser_note}\n"
             f"  [dim]Stop:[/dim]     [bold]Ctrl+C[/bold] (this terminal stays busy while the server runs)",
             title="[bold blue]RKD GUI[/bold blue]",
@@ -51,9 +52,23 @@ def gui_command(port, host, auto_open, cwd):
             padding=(1, 2),
         )
     )
+    # Outside the panel and unwrapped: the tokenised URL is long, and inside a
+    # bordered box Rich splits it across lines, which breaks copy-paste — the
+    # one thing the user has to do with it.
+    console.print("\n  Open this URL (it carries the session token):\n")
+    console.print(f"  [bold cyan]{url}[/bold cyan]", soft_wrap=True, highlight=False)
     console.print()
 
     if auto_open:
+        # The tokenised URL becomes an argument of the browser helper process
+        # (webbrowser resolves to Popen(["xdg-open", url]) on Linux), so it is
+        # briefly visible in `ps aux` to any local user. Same channel #142
+        # closed for VPS passwords, here as an accepted trade-off of an opt-in
+        # flag: documented in SECURITY.md rather than silently accepted.
+        console.print("[dim]  note: --open passes the tokenised URL to the browser helper,[/dim]")
+        console.print("[dim]        which makes it briefly visible in the process list.[/dim]")
+        console.print()
+
         import threading
         import time
         import webbrowser
@@ -64,7 +79,6 @@ def gui_command(port, host, auto_open, cwd):
 
         threading.Thread(target=_open, daemon=True).start()
 
-    # host/port reach the app so CORS can allow exactly the origin the user
-    # will open, and nothing else.
-    app = create_app(host=host, port=port)
+    # log_level="error" also keeps the token out of an access log: the query
+    # string would otherwise be recorded on every request.
     uvicorn.run(app, host=host, port=port, log_level="error")

{rocketdoo-3.3.0 → rocketdoo-3.4.0/rocketdoo.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rocketdoo
-Version: 3.3.0
+Version: 3.4.0
 Summary: Framework for creating Odoo development environments with Docker and custom templates.
 Author-email: Horacio Montaño <horaciomontano@hdmsoft.com.ar>
 License: GNU LESSER GENERAL PUBLIC LICENSE
@@ -62,9 +62,9 @@ License: GNU LESSER GENERAL PUBLIC LICENSE
         <div RKD as ROCKETDOO V3=""></div>
         
         Licencia: LGPL-3.0+
-        Versión: "3.3.0"
+        Versión: "3.4.0"
         Autor: Horacio Montaño
-        Fecha: 14/09/2026
+        Fecha: 16/09/2026
         Descripción: Framework to development Odoo
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -97,7 +97,7 @@ Odoo Development Framework
    - "Horacio Montaño"
 
 ## Version: 
-   - "3.3.0"
+   - "3.4.0"
 
 ----------------------------------------------------------------------------------------------------------------------------------------------------------
 
@@ -532,12 +532,19 @@ rkd instance status                  # Show configured environments
 Rocketdoo v3 includes a professional web-based management interface, accessible from your browser just like Odoo — no installation of additional tools required.
 
 ```bash
-rkd gui                  # Launch GUI on http://localhost:8070
-rkd gui --open           # Also open the browser automatically
+rkd gui                  # Launch GUI, prints a tokenized URL to open
+rkd gui --open           # Also open that same URL in the browser automatically
 rkd gui --port 9090      # Use a custom port
 rkd gui --cwd /my/proj   # Point to a specific project directory
 ```
 
+`rkd gui` prints a URL of the form `http://127.0.0.1:8070/?token=<session-token>` —
+use that exact URL, not a bare `http://localhost:8070`. Every API and WebSocket
+call requires this session token (generated fresh on each `rkd gui` start), so
+opening the GUI without it shows a message asking you to use the printed URL
+instead of the project's data. `--open` already opens the correct, tokenized
+URL for you.
+
 The GUI provides a complete visual interface for all Rocketdoo v3 features:
 
 | Section | What you can do |
@@ -555,7 +562,10 @@ Additional interface features:
 - Real-time log streaming via WebSocket
 - Runs entirely from the installed package — no Node.js or build step required
 
-> The GUI server runs locally and is bound to `127.0.0.1` by default, so it is only accessible from your own machine.
+> The GUI server runs locally and is bound to `127.0.0.1` by default, so it is only accessible
+> from your own machine. The session token adds a second layer on top of that: even another
+> process running as your own user on the same machine cannot call the API without it. See
+> [SECURITY.md](SECURITY.md) for the full threat model.
 
 ---
 
@@ -615,6 +625,15 @@ deploy — no manual step needed.
 
 ---
 
+### Security
+
+Rocketdoo is a local, single-user development tool, not a hardened multi-user
+service. See [SECURITY.md](SECURITY.md) for the threat model: what the GUI
+exposes, where credentials live on disk, and the residual risks that are
+accepted rather than solved.
+
+---
+
 ### Technical Support
 
 - If you have any questions or issues with our development environment, you can contact us and submit your inquiry or support ticket by clicking on the link below.

{rocketdoo-3.3.0 → rocketdoo-3.4.0}/tests/test_gui_api.py

@@ -17,13 +17,20 @@ import pytest
 
 fastapi_testclient = pytest.importorskip("fastapi.testclient")
 
+from starlette.websockets import WebSocketDisconnect  # noqa: E402
+
 from rocketdoo.gui.server import create_app  # noqa: E402
 
 
 @pytest.fixture
 def client(project_dir):
-    """A TestClient whose working directory is an empty project dir."""
-    return fastapi_testclient.TestClient(create_app())
+    """A TestClient whose working directory is an empty project dir.
+
+    Sends the app's own session token by default: these tests exercise the
+    endpoints, not the token gate itself (that is #142's T11).
+    """
+    app = create_app()
+    return fastapi_testclient.TestClient(app, headers={"X-RKD-Token": app.state.rkd_token})
 
 
 GET_ENDPOINTS = [
@@ -421,7 +428,8 @@ def test_the_app_honours_the_port_it_was_created_with():
     """`rkd gui --port N` passes N through, so CORS matches the real URL."""
     from rocketdoo.gui.server import create_app
 
-    client = fastapi_testclient.TestClient(create_app(port=9090))
+    app = create_app(port=9090)
+    client = fastapi_testclient.TestClient(app, headers={"X-RKD-Token": app.state.rkd_token})
     response = client.get("/api/workspace", headers={"Origin": "http://localhost:9090"})
     assert response.headers.get("access-control-allow-origin") == "http://localhost:9090"
 
@@ -503,3 +511,149 @@ class TestHealthReportsTheRealVersion:
 
         source = (Path(rocketdoo.__path__[0]) / "gui" / "server.py").read_text()
         assert not re.findall(r'"\d+\.\d+\.\d+"', source)
+
+
+class TestSessionToken:
+    """The token gate itself (#142's T11): T8-T10 only made `client` send it.
+
+    `no_token_client` deliberately carries no default header, so each test
+    controls exactly what credential (if any) travels with the request.
+    """
+
+    @pytest.fixture
+    def app(self, project_dir):
+        return create_app()
+
+    @pytest.fixture
+    def no_token_client(self, app):
+        return fastapi_testclient.TestClient(app)
+
+    def test_rest_without_token_is_rejected(self, no_token_client):
+        assert no_token_client.get("/api/project").status_code == 401
+
+    def test_rest_with_an_invalid_token_is_rejected(self, no_token_client):
+        response = no_token_client.get("/api/project", headers={"X-RKD-Token": "not-the-token"})
+        assert response.status_code == 401
+
+    def test_rest_with_the_valid_header_token_is_accepted(self, app, no_token_client):
+        headers = {"X-RKD-Token": app.state.rkd_token}
+        assert no_token_client.get("/api/project", headers=headers).status_code == 200
+
+    def test_rest_with_the_valid_query_token_is_accepted(self, app, no_token_client):
+        response = no_token_client.get(f"/api/project?token={app.state.rkd_token}")
+        assert response.status_code == 200
+
+    def test_post_endpoints_are_gated_too(self, no_token_client):
+        assert no_token_client.post("/api/mail/off").status_code == 401
+
+    @pytest.mark.parametrize("path", ["/", "/health", "/some/spa/route"])
+    def test_public_paths_need_no_token(self, no_token_client, path):
+        assert no_token_client.get(path).status_code == 200
+
+    @pytest.mark.parametrize(
+        "ws_path",
+        ["/ws/docker/bogus", "/ws/logs/some-container", "/ws/odoo/update?module=m&db=d"],
+    )
+    def test_every_websocket_route_rejects_a_missing_token(self, no_token_client, ws_path):
+        """Rejected in the middleware, before the handler runs — no Docker involved."""
+        with pytest.raises(WebSocketDisconnect):
+            with no_token_client.websocket_connect(ws_path):
+                pass
+
+    def test_websocket_rejects_an_invalid_token(self, no_token_client):
+        with pytest.raises(WebSocketDisconnect):
+            with no_token_client.websocket_connect("/ws/docker/bogus?token=not-the-token"):
+                pass
+
+    def test_websocket_connects_with_the_valid_token(self, app, no_token_client):
+        url = f"/ws/docker/bogus?token={app.state.rkd_token}"
+        with no_token_client.websocket_connect(url) as websocket:
+            assert websocket.receive_text() == "[error] Unknown action: bogus"
+
+    def test_two_apps_never_share_a_token(self, project_dir):
+        assert create_app().state.rkd_token != create_app().state.rkd_token
+
+    def test_the_generated_token_is_not_a_short_guess(self, app):
+        assert len(app.state.rkd_token) >= 32
+
+
+class TestTokenMiddlewareEdges:
+    """Ways the middleware could answer without a token, found in review."""
+
+    @pytest.fixture
+    def untokened(self, project_dir):
+        """A client that sends no token, unlike the module-wide `client`."""
+        from rocketdoo.gui.server import create_app
+
+        return fastapi_testclient.TestClient(create_app())
+
+    def _probe(self, app, path, headers=None, query=b"", root_path=""):
+        """Drive the app over raw ASGI: httpx rejects non-ASCII headers itself."""
+        import asyncio
+
+        scope = {
+            "type": "http",
+            "method": "GET",
+            "path": path,
+            "raw_path": path.encode(),
+            "query_string": query,
+            "headers": headers or [],
+            "root_path": root_path,
+            "app": app,
+            "scheme": "http",
+            "server": ("test", 80),
+            "client": ("c", 1),
+            "http_version": "1.1",
+        }
+        seen = {}
+
+        async def receive():
+            return {"type": "http.request", "body": b"", "more_body": False}
+
+        async def send(message):
+            if message["type"] == "http.response.start":
+                seen["status"] = message["status"]
+
+        asyncio.run(app(scope, receive, send))
+        return seen.get("status")
+
+    def test_a_non_ascii_token_is_rejected_not_a_crash(self):
+        """compare_digest raises TypeError on non-ASCII, and the value is attacker-controlled."""
+        from rocketdoo.gui.server import create_app
+
+        app = create_app()
+        status = self._probe(app, "/api/project", [(b"x-rkd-token", "tokén".encode("latin-1"))])
+
+        assert status == 401, "a crafted header must answer 401, not 500"
+
+    def test_a_non_ascii_token_in_the_query_is_rejected(self):
+        from rocketdoo.gui.server import create_app
+
+        app = create_app()
+        status = self._probe(app, "/api/project", query="token=tokén".encode("latin-1"))
+
+        assert status == 401
+
+    def test_a_mounted_app_still_requires_the_token(self):
+        """The router strips root_path before matching; the guard must too.
+
+        Reading scope["path"] instead made every route answer unauthenticated
+        once the app was mounted under a prefix — failing open, silently.
+        """
+        from rocketdoo.gui.server import create_app
+
+        app = create_app()
+        status = self._probe(app, "/prefix/api/project", root_path="/prefix")
+
+        assert status == 401
+
+    def test_the_route_inventory_is_not_public(self, untokened):
+        """openapi_url defaulted outside /api and served all 47 paths."""
+        response = untokened.get("/openapi.json")
+
+        assert "text/html" in response.headers.get("content-type", "")
+        assert "/api/instances/deploy" not in response.text
+
+    def test_the_schema_under_api_needs_the_token(self, untokened, client):
+        assert untokened.get("/api/openapi.json").status_code == 401
+        assert client.get("/api/openapi.json").status_code == 200

{rocketdoo-3.3.0 → rocketdoo-3.4.0}/tests/test_secrets_hardening.py

@@ -393,26 +393,55 @@ ROCKETDOO_ROOT = Path(__file__).resolve().parent.parent / "rocketdoo"
 # self._sshpass_password and INSTANCE_STAGE_PASSWORD must all match).
 _SENSITIVE_NAME_RE = re.compile(r"password|passwd|secret|token", re.IGNORECASE)
 
-# Anything that launches a child process, plus the local helpers that build
-# the ssh/rsync argv passed to one. Matched by the called name only (not by
-# module), so `subprocess.run(...)` and `self._ssh(...)` are both covered.
-_SINK_NAMES = {
-    "run",
+# Process-launching methods from stdlib modules. Matched by (module, method)
+# rather than by method name alone: a bare-name match on "run" or "call" also
+# fires on unrelated calls like `uvicorn.run(...)`, which is not a sink.
+_STDLIB_SINK_MODULES = {"subprocess", "os", "asyncio"}
+
+# Names common enough to collide with unrelated calls (uvicorn.run, a local
+# call()), so they only count when qualified by one of the modules above.
+_QUALIFIED_SINK_METHODS = {"run", "call", "check_call", "system", "popen"}
+
+# Names that belong to no other API worth worrying about: matched bare, so a
+# `from asyncio import create_subprocess_exec` still counts.
+_BARE_SINK_METHODS = {
     "Popen",
-    "call",
-    "check_call",
-    "check_output",  # subprocess.*
-    "system",
-    "popen",  # os.*
+    "check_output",
     "create_subprocess_exec",
-    "create_subprocess_shell",  # asyncio.*, used by gui/server.py
+    "create_subprocess_shell",
+}
+
+# Local helpers that build the ssh/rsync argv passed to a sink, or launch one
+# directly on `self`. Their names are specific enough to match bare, unlike
+# the generic stdlib methods above.
+_LOCAL_SINK_NAMES = {
     "_ssh",
     "_run_ssh_command",
-    "_rsync",  # deployer helpers
+    "_rsync",
     "build_ssh_cmd",
-    "build_rsync_cmd",  # ssh_utils command builders
+    "build_rsync_cmd",
 }
 
+
+def _is_sink_call(node: ast.Call) -> bool:
+    """Whether this call launches a process.
+
+    Known gap: a qualified sink reached under another name -- `from
+    subprocess import run` with a bare `run(...)`, or `import subprocess as
+    sp` with `sp.run(...)` -- is not matched, because requiring a known
+    module qualifier is what keeps uvicorn.run from producing a false
+    positive. Nothing in the package does either; if that changes, add the
+    name to _BARE_SINK_METHODS or the alias to _STDLIB_SINK_MODULES.
+    """
+    name = _called_name(node.func)
+    if name in _LOCAL_SINK_NAMES or name in _BARE_SINK_METHODS:
+        return True
+    if name not in _QUALIFIED_SINK_METHODS or not isinstance(node.func, ast.Attribute):
+        return False
+    base = node.func.value
+    return isinstance(base, ast.Name) and base.id in _STDLIB_SINK_MODULES
+
+
 # The only two channels a secret is allowed to travel through once it is
 # about to reach a sink: subprocess's own `input=`/`env=` keywords, and the
 # first argument of sshpass_wrap() (which moves it into `env["SSHPASS"]`).
@@ -484,7 +513,7 @@ def _walk_pruned(node: ast.AST, safe_ids: set[int]):
 
 
 def _violations_in_function(func: ast.AST) -> list[tuple[int, str]]:
-    if not any(isinstance(n, ast.Call) and _called_name(n.func) in _SINK_NAMES for n in ast.walk(func)):
+    if not any(isinstance(n, ast.Call) and _is_sink_call(n) for n in ast.walk(func)):
         return []
 
     safe_ids = _safe_node_ids(func)
@@ -528,7 +557,7 @@ def test_no_secret_reaches_subprocess_argv_construction():
       - the secret read through a subscript of a literal key
         (`conn["password"]`) or renamed first (`pw = self.password`)
       - the command built in a helper that does not launch anything itself
-      - a sink reached under a name not in _SINK_NAMES
+      - a sink reached under a name not in _QUALIFIED_SINK_METHODS/_LOCAL_SINK_NAMES
 
     Closing those needs real dataflow analysis, which is a bigger machine than
     the bug it guards. Reviewing a diff that touches a deploy path is still the