469037cb94
An OPTIONAL shared token so the app can be used off-LAN (via the relay/tunnel) more safely than "anyone who reaches the port gets a shell". Sits IN FRONT OF the existing Origin/CSRF model — never replacing it — and is fully inert when unset. - src/http/auth.ts (new, pure): constantTimeEqual hashes both inputs to sha256 (32 bytes) then crypto.timingSafeEqual — no `===`, no length side-channel, never throws. parseCookieHeader / cookieIsAuthed / buildSetCookie / isAuthEnabled. - WEBTERM_TOKEN in config: 16–512 URL/cookie-safe chars or the server refuses to start. - GET /?token=<t> or POST /auth (rate-limited 10/min) validates → sets HttpOnly; SameSite=Strict; Secure-when-https cookie; public/login.html (no <script>). - When enabled: the WS handshake (AFTER the Origin check, before handleUpgrade) + a central authGate over all remote HTTP require the cookie. Open: /login, /auth. Loopback bypass scoped to /hook* ONLY (tighter than the plan — gates the local browser too). - Unset ⇒ isAuthEnabled false ⇒ pure passthrough (LAN zero-config unchanged). Honest tradeoff (in code + CLAUDE.md + login page): a bar-raiser, NOT a TLS/Tailscale substitute — on bare ws:// the token is cleartext + replayable; only hardens the TLS-terminated relay path. Verified: typecheck + build:web clean, 2118 pass at --test-timeout=30000 (disabled-mode regression proven; only the known tmux flake red); auth.ts 100% line coverage.
126 lines
3.8 KiB
HTML
126 lines
3.8 KiB
HTML
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
<meta name="robots" content="noindex" />
|
|
<title>Sign in — web-terminal</title>
|
|
<!--
|
|
w5-access-token login page. FULLY SELF-CONTAINED: inline <style> only, NO
|
|
<script> (the CSP is `script-src 'self'`, which blocks inline JS). Auth is a
|
|
native form POST → the server 302s and sets the HttpOnly cookie → the app
|
|
loads. Zero JS required. The error banner is revealed server-side by GET
|
|
/login?e=1 swapping the single `ERRSTATE` token on <body> for `show-error`.
|
|
-->
|
|
<style>
|
|
:root {
|
|
color-scheme: light dark;
|
|
--bg: #0b0e14;
|
|
--card: #131722;
|
|
--fg: #e6e9ef;
|
|
--muted: #8b93a7;
|
|
--accent: #4c8bf5;
|
|
--border: #262c3a;
|
|
--err-bg: #3a1720;
|
|
--err-fg: #ff9aa8;
|
|
--err-border: #6b2230;
|
|
}
|
|
@media (prefers-color-scheme: light) {
|
|
:root {
|
|
--bg: #f4f6fb;
|
|
--card: #ffffff;
|
|
--fg: #1a1f2b;
|
|
--muted: #5a6274;
|
|
--accent: #2563eb;
|
|
--border: #dde2ec;
|
|
--err-bg: #fdecef;
|
|
--err-fg: #b42035;
|
|
--err-border: #f3c2ca;
|
|
}
|
|
}
|
|
* { box-sizing: border-box; }
|
|
body {
|
|
margin: 0;
|
|
min-height: 100vh;
|
|
display: flex;
|
|
align-items: center;
|
|
justify-content: center;
|
|
padding: 1.5rem;
|
|
background: var(--bg);
|
|
color: var(--fg);
|
|
font: 15px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
|
|
}
|
|
.card {
|
|
width: 100%;
|
|
max-width: 22rem;
|
|
background: var(--card);
|
|
border: 1px solid var(--border);
|
|
border-radius: 14px;
|
|
padding: 1.75rem;
|
|
box-shadow: 0 12px 40px rgba(0, 0, 0, 0.28);
|
|
}
|
|
h1 { margin: 0 0 0.25rem; font-size: 1.15rem; }
|
|
p.sub { margin: 0 0 1.25rem; color: var(--muted); font-size: 0.85rem; }
|
|
label { display: block; margin-bottom: 0.4rem; font-size: 0.8rem; color: var(--muted); }
|
|
input[type="password"] {
|
|
width: 100%;
|
|
padding: 0.65rem 0.75rem;
|
|
font-size: 1rem;
|
|
color: var(--fg);
|
|
background: var(--bg);
|
|
border: 1px solid var(--border);
|
|
border-radius: 9px;
|
|
outline: none;
|
|
}
|
|
input[type="password"]:focus { border-color: var(--accent); }
|
|
button {
|
|
margin-top: 1rem;
|
|
width: 100%;
|
|
padding: 0.7rem;
|
|
font-size: 0.95rem;
|
|
font-weight: 600;
|
|
color: #fff;
|
|
background: var(--accent);
|
|
border: 0;
|
|
border-radius: 9px;
|
|
cursor: pointer;
|
|
}
|
|
button:hover { filter: brightness(1.06); }
|
|
.error-banner {
|
|
display: none;
|
|
margin-bottom: 1rem;
|
|
padding: 0.6rem 0.75rem;
|
|
font-size: 0.85rem;
|
|
color: var(--err-fg);
|
|
background: var(--err-bg);
|
|
border: 1px solid var(--err-border);
|
|
border-radius: 9px;
|
|
}
|
|
body.show-error .error-banner { display: block; }
|
|
.note {
|
|
margin-top: 1.25rem;
|
|
font-size: 0.72rem;
|
|
line-height: 1.45;
|
|
color: var(--muted);
|
|
}
|
|
</style>
|
|
</head>
|
|
<body class="login ERRSTATE">
|
|
<main class="card">
|
|
<h1>Access token required</h1>
|
|
<p class="sub">This web-terminal is protected by a shared access token.</p>
|
|
<div class="error-banner" role="alert">Invalid token — please try again.</div>
|
|
<form method="POST" action="/auth">
|
|
<label for="token">Access token</label>
|
|
<input id="token" name="token" type="password" autocomplete="current-password" autofocus required />
|
|
<button type="submit">Unlock</button>
|
|
</form>
|
|
<p class="note">
|
|
Bar-raiser, not a substitute for TLS/Tailscale. On a plain <code>ws://</code> LAN
|
|
the token is sent in cleartext and can be replayed — only use this off-LAN over
|
|
an HTTPS/WSS relay or tunnel. Never port-forward the raw port to the internet.
|
|
</p>
|
|
</main>
|
|
</body>
|
|
</html>
|