feat: direct TCP URI with SSL toggle and optional password auth (#635)

* feat: direct TCP URI with SSL toggle and optional password auth Replaces the heuristic-driven direct-connection model with a user-controlled one. The Add Host dialog now exposes structured Host, Port, "Use SSL", and masked Password fields that compose the canonical `tcp://host:port?ssl=true&password=xxx` URI used as the storage form. The daemon gains optional shared-secret auth: `Authorization: Bearer <pw>` on HTTP and `Sec-WebSocket-Protocol: paseo.bearer.<pw>` on the WS upgrade (browser WebSocket can't set custom headers). Configured via config.json `auth.password` or `PASEO_PASSWORD` env. Off by default — old clients keep working unchanged. The `port === 443` heuristic for ws/wss is gone; the explicit `useTls` flag drives scheme selection at every call site. * fix: stabilize direct tcp auth ci checks * fix: restore fetch stub in bootstrap smoke test * fix(app): collapse Advanced section in add-host modal * feat(server): hash daemon password in config * fix: update lockfile signatures and Nix hash * Improve direct TCP auth failures * Fix workspace cwd updates after rebase --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-04-30 22:05:49 +08:00
parent 30f7842e8f
commit 088a6c14c0
48 changed files with 1829 additions and 129 deletions
@@ -0,0 +1,107 @@
+#!/usr/bin/env npx tsx
+
+import assert from "node:assert";
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { Command } from "commander";
+import { isBearerTokenValid } from "@getpaseo/server";
+import {
+  runSetPasswordCommand,
+  setDaemonPasswordInConfig,
+  type PromptPassword,
+} from "../src/commands/daemon/set-password.ts";
+
+console.log("=== Daemon Set Password Command ===\n");
+
+const root = await mkdtemp(join(tmpdir(), "paseo-set-password-"));
+const paseoHome = join(root, ".paseo");
+
+function promptSequence(values: string[]): PromptPassword {
+  return async () => {
+    const value = values.shift();
+    if (value === undefined) {
+      throw new Error("prompt called too many times");
+    }
+    return value;
+  };
+}
+
+try {
+  {
+    console.log("Test 1: setDaemonPasswordInConfig writes hash and preserves config fields");
+    await mkdir(paseoHome, { recursive: true });
+    await writeFile(
+      join(paseoHome, "config.json"),
+      `${JSON.stringify(
+        {
+          version: 1,
+          daemon: {
+            listen: "127.0.0.1:9999",
+            relay: { enabled: false },
+          },
+          app: { baseUrl: "https://app.paseo.sh" },
+        },
+        null,
+        2,
+      )}\n`,
+    );
+
+    const result = await setDaemonPasswordInConfig("shared-secret", { home: paseoHome });
+    const config = JSON.parse(await readFile(join(paseoHome, "config.json"), "utf-8"));
+
+    assert.strictEqual(result.configPath, join(paseoHome, "config.json"));
+    assert.strictEqual(result.restartCommand, "paseo daemon restart");
+    assert.strictEqual(config.daemon.listen, "127.0.0.1:9999");
+    assert.strictEqual(config.daemon.relay.enabled, false);
+    assert.notStrictEqual(config.daemon.auth.password, "shared-secret");
+    assert.match(config.daemon.auth.password, /^\$2[aby]\$12\$/);
+    assert.strictEqual(
+      isBearerTokenValid({ password: config.daemon.auth.password, token: "shared-secret" }),
+      true,
+    );
+    console.log("✓ set-password writes bcrypt hash without clobbering config\n");
+  }
+
+  {
+    console.log("Test 2: command prompts twice and accepts matching confirmation");
+    const result = await runSetPasswordCommand(
+      {
+        home: paseoHome,
+        promptPassword: promptSequence(["new-secret", "new-secret"]),
+      },
+      {} as Command,
+    );
+    const config = JSON.parse(await readFile(join(paseoHome, "config.json"), "utf-8"));
+
+    assert.strictEqual(result.data.action, "password_set");
+    assert.strictEqual(
+      isBearerTokenValid({ password: config.daemon.auth.password, token: "new-secret" }),
+      true,
+    );
+    console.log("✓ command accepts matching confirmation\n");
+  }
+
+  {
+    console.log("Test 3: command refuses mismatched confirmation");
+    await assert.rejects(
+      runSetPasswordCommand(
+        {
+          home: paseoHome,
+          promptPassword: promptSequence(["first-secret", "second-secret"]),
+        },
+        {} as Command,
+      ),
+      (error: unknown) =>
+        typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === "PASSWORD_MISMATCH",
+    );
+    console.log("✓ command refuses password mismatch\n");
+  }
+} finally {
+  await rm(root, { recursive: true, force: true });
+}
+
+console.log("=== Daemon Set Password Command Tests Passed ===");