675de771c7
Loopback Fastify auth-broker + esbuild SPA. Operator password login (constant-time, signed HttpOnly session cookie, per-forwarded-IP rate-limit) → session-gated proxy that mints a fresh 60s manage capability token per call to the control-plane admin API: list hosts, mint pairing codes (with QR + pair command), revoke hosts. Security headers + CSP, CP_URL pinned loopback (anti-SSRF), hostId dot-segment guard. 55 tests pass; security-reviewed. Deployed behind nginx panel.terminal.yaojia.wang.
36 lines
1.2 KiB
JSON
36 lines
1.2 KiB
JSON
{
|
|
"name": "control-panel",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"description": "Web control panel for the zero-touch tunnel system. Loopback-only Fastify backend that gates an operator session behind a password, then proxies the control-plane admin API (list hosts / issue pairing codes / revoke hosts), minting a fresh short-TTL `manage` capability token per call. Vanilla-TS + esbuild SPA. NEVER logs secrets/tokens/passwords.",
|
|
"engines": {
|
|
"node": ">=18"
|
|
},
|
|
"main": "src/server.ts",
|
|
"scripts": {
|
|
"start": "tsx src/server.ts",
|
|
"typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.web.json --noEmit",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"coverage": "vitest run --coverage",
|
|
"build": "node build.mjs"
|
|
},
|
|
"dependencies": {
|
|
"fastify": "^4.28.1",
|
|
"qrcode": "^1.5.4",
|
|
"relay-auth": "file:../relay-auth",
|
|
"relay-contracts": "file:../relay-contracts",
|
|
"zod": "^3.23.8"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "^25.9.3",
|
|
"@types/qrcode": "^1.5.6",
|
|
"@vitest/coverage-v8": "^4.1.9",
|
|
"esbuild": "^0.28.1",
|
|
"tsx": "^4.19.2",
|
|
"typescript": "^6.0.3",
|
|
"vitest": "^4.1.9"
|
|
}
|
|
}
|