feat: direct TCP URI with SSL toggle and optional password auth (#635)

* feat: direct TCP URI with SSL toggle and optional password auth Replaces the heuristic-driven direct-connection model with a user-controlled one. The Add Host dialog now exposes structured Host, Port, "Use SSL", and masked Password fields that compose the canonical `tcp://host:port?ssl=true&password=xxx` URI used as the storage form. The daemon gains optional shared-secret auth: `Authorization: Bearer <pw>` on HTTP and `Sec-WebSocket-Protocol: paseo.bearer.<pw>` on the WS upgrade (browser WebSocket can't set custom headers). Configured via config.json `auth.password` or `PASEO_PASSWORD` env. Off by default — old clients keep working unchanged. The `port === 443` heuristic for ws/wss is gone; the explicit `useTls` flag drives scheme selection at every call site. * fix: stabilize direct tcp auth ci checks * fix: restore fetch stub in bootstrap smoke test * fix(app): collapse Advanced section in add-host modal * feat(server): hash daemon password in config * fix: update lockfile signatures and Nix hash * Improve direct TCP auth failures * Fix workspace cwd updates after rebase --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-04-30 22:05:49 +08:00
parent 30f7842e8f
commit 088a6c14c0
48 changed files with 1829 additions and 129 deletions
@@ -7,6 +7,7 @@ import path from "node:path";
 import {
  getDaemonHost,
  normalizeDaemonHost,
+  resolveDaemonPassword,
  resolveDaemonTarget,
  resolveDefaultDaemonHosts,
 } from "../src/utils/client.js";
@@ -37,20 +38,39 @@ console.log("=== CLI IPC Target Helpers ===\n");
 }

 {
-  console.log("Test 3: local unix socket paths normalize into IPC daemon targets");
+  console.log("Test 3: tcp URI host targets honor ssl=true");
+  const target = resolveDaemonTarget("tcp://example.com:6767?ssl=true&password=query-secret");
+  assert.deepStrictEqual(target, {
+    type: "tcp",
+    url: "wss://example.com:6767/ws",
+  });
+  console.log("✓ tcp URI host targets honor ssl=true\n");
+}
+
+{
+  console.log("Test 4: tcp URI hosts normalize into canonical direct TCP targets");
+  assert.strictEqual(
+    normalizeDaemonHost("tcp://Example.com:6767?ssl=true&password=query-secret"),
+    "tcp://Example.com:6767?ssl=true&password=query-secret",
+  );
+  console.log("✓ tcp URI hosts normalize into canonical direct TCP targets\n");
+}
+
+{
+  console.log("Test 5: local unix socket paths normalize into IPC daemon targets");
  assert.strictEqual(normalizeDaemonHost("/tmp/paseo.sock"), "unix:///tmp/paseo.sock");
  console.log("✓ local unix socket paths normalize into IPC daemon targets\n");
 }

 {
-  console.log("Test 3b: Windows absolute paths are NOT treated as unix sockets");
+  console.log("Test 5b: Windows absolute paths are NOT treated as unix sockets");
  assert.strictEqual(normalizeDaemonHost("C:\\Users\\foo\\.paseo\\paseo.sock"), null);
  assert.strictEqual(normalizeDaemonHost("D:\\project\\socket"), null);
  console.log("✓ Windows absolute paths are not treated as unix sockets\n");
 }

 {
-  console.log("Test 4: default host resolution tries local IPC first, then localhost fallback");
+  console.log("Test 6: default host resolution tries local IPC first, then localhost fallback");
  const paseoHome = mkdtempSync(path.join(os.tmpdir(), "paseo-client-targets-"));
  try {
    mkdirSync(paseoHome, { recursive: true });
@@ -78,7 +98,7 @@ console.log("=== CLI IPC Target Helpers ===\n");
 }

 {
-  console.log("Test 5: configured TCP host is preserved before the localhost fallback");
+  console.log("Test 7: configured TCP host is preserved before the localhost fallback");
  const paseoHome = mkdtempSync(path.join(os.tmpdir(), "paseo-client-targets-tcp-"));
  try {
    assert.deepStrictEqual(
@@ -95,13 +115,13 @@ console.log("=== CLI IPC Target Helpers ===\n");
 }

 {
-  console.log("Test 6: CLI app version resolves for daemon hello compatibility");
+  console.log("Test 8: CLI app version resolves for daemon hello compatibility");
  assert.match(resolveCliVersion(), /^\d+\.\d+\.\d+/);
  console.log("✓ CLI app version resolves for daemon hello compatibility\n");
 }

 {
-  console.log("Test 7: local IPC still takes priority over configured TCP hosts");
+  console.log("Test 9: local IPC still takes priority over configured TCP hosts");
  const paseoHome = mkdtempSync(path.join(os.tmpdir(), "paseo-client-targets-order-"));
  try {
    mkdirSync(paseoHome, { recursive: true });
@@ -122,4 +142,15 @@ console.log("=== CLI IPC Target Helpers ===\n");
  console.log("✓ local IPC still takes priority over configured TCP hosts\n");
 }

+{
+  console.log("Test 10: daemon password resolution uses only the TCP URI query");
+  assert.strictEqual(
+    resolveDaemonPassword("tcp://example.com:6767?ssl=true&password=query-secret"),
+    "query-secret",
+  );
+  assert.strictEqual(resolveDaemonPassword("tcp://missing.example:6767"), undefined);
+  assert.strictEqual(resolveDaemonPassword("example.com:6767"), undefined);
+  console.log("✓ daemon password resolution uses only the TCP URI query\n");
+}
+
 console.log("=== All CLI IPC target tests passed ===");
@@ -0,0 +1,107 @@
+#!/usr/bin/env npx tsx
+
+import assert from "node:assert";
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { Command } from "commander";
+import { isBearerTokenValid } from "@getpaseo/server";
+import {
+  runSetPasswordCommand,
+  setDaemonPasswordInConfig,
+  type PromptPassword,
+} from "../src/commands/daemon/set-password.ts";
+
+console.log("=== Daemon Set Password Command ===\n");
+
+const root = await mkdtemp(join(tmpdir(), "paseo-set-password-"));
+const paseoHome = join(root, ".paseo");
+
+function promptSequence(values: string[]): PromptPassword {
+  return async () => {
+    const value = values.shift();
+    if (value === undefined) {
+      throw new Error("prompt called too many times");
+    }
+    return value;
+  };
+}
+
+try {
+  {
+    console.log("Test 1: setDaemonPasswordInConfig writes hash and preserves config fields");
+    await mkdir(paseoHome, { recursive: true });
+    await writeFile(
+      join(paseoHome, "config.json"),
+      `${JSON.stringify(
+        {
+          version: 1,
+          daemon: {
+            listen: "127.0.0.1:9999",
+            relay: { enabled: false },
+          },
+          app: { baseUrl: "https://app.paseo.sh" },
+        },
+        null,
+        2,
+      )}\n`,
+    );
+
+    const result = await setDaemonPasswordInConfig("shared-secret", { home: paseoHome });
+    const config = JSON.parse(await readFile(join(paseoHome, "config.json"), "utf-8"));
+
+    assert.strictEqual(result.configPath, join(paseoHome, "config.json"));
+    assert.strictEqual(result.restartCommand, "paseo daemon restart");
+    assert.strictEqual(config.daemon.listen, "127.0.0.1:9999");
+    assert.strictEqual(config.daemon.relay.enabled, false);
+    assert.notStrictEqual(config.daemon.auth.password, "shared-secret");
+    assert.match(config.daemon.auth.password, /^\$2[aby]\$12\$/);
+    assert.strictEqual(
+      isBearerTokenValid({ password: config.daemon.auth.password, token: "shared-secret" }),
+      true,
+    );
+    console.log("✓ set-password writes bcrypt hash without clobbering config\n");
+  }
+
+  {
+    console.log("Test 2: command prompts twice and accepts matching confirmation");
+    const result = await runSetPasswordCommand(
+      {
+        home: paseoHome,
+        promptPassword: promptSequence(["new-secret", "new-secret"]),
+      },
+      {} as Command,
+    );
+    const config = JSON.parse(await readFile(join(paseoHome, "config.json"), "utf-8"));
+
+    assert.strictEqual(result.data.action, "password_set");
+    assert.strictEqual(
+      isBearerTokenValid({ password: config.daemon.auth.password, token: "new-secret" }),
+      true,
+    );
+    console.log("✓ command accepts matching confirmation\n");
+  }
+
+  {
+    console.log("Test 3: command refuses mismatched confirmation");
+    await assert.rejects(
+      runSetPasswordCommand(
+        {
+          home: paseoHome,
+          promptPassword: promptSequence(["first-secret", "second-secret"]),
+        },
+        {} as Command,
+      ),
+      (error: unknown) =>
+        typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === "PASSWORD_MISMATCH",
+    );
+    console.log("✓ command refuses password mismatch\n");
+  }
+} finally {
+  await rm(root, { recursive: true, force: true });
+}
+
+console.log("=== Daemon Set Password Command Tests Passed ===");