majjo/PurrfectSnap
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: serve dashboard unauthenticated, validate token via /ping endpoint

Browse Source
This commit is contained in:
Majjo
2026-04-18 17:41:28 +02:00
parent b6435f9010
commit b0715b3f27
1 changed files with 13 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
core/src/main/kotlin/me/eternal/purrfectsnap/core/features/impl/global/CompanionServer.kt
View File

@@ -170,7 +170,13 @@ class CompanionServer : Feature("CompanionServer") {
} }
val query = parseQuery(rawQuery) val query = parseQuery(rawQuery)
// Constant-time auth check // Serve the dashboard without auth so the user can see the login form
if (rawPath == "/" || rawPath == "/index.html") {
serveDashboard(socket)
return
}
// Constant-time auth check for all other endpoints
val providedToken = headers["authorization"]?.removePrefix("Bearer ")?.trim() val providedToken = headers["authorization"]?.removePrefix("Bearer ")?.trim()
?: query["token"] ?: query["token"]
?: "" ?: ""
@@ -180,11 +186,11 @@ class CompanionServer : Feature("CompanionServer") {
} }
when (rawPath) { when (rawPath) {
"/events" -> handleSSE(socket) "/events" -> handleSSE(socket)
"/logs" -> serveJson(socket, synchronized(bufferLock) { recentLogs.toList() }) "/logs" -> serveJson(socket, synchronized(bufferLock) { recentLogs.toList() })
"/network" -> serveJson(socket, synchronized(bufferLock) { recentNetworkCalls.toList() }) "/network" -> serveJson(socket, synchronized(bufferLock) { recentNetworkCalls.toList() })
"/", "/index.html" -> serveDashboard(socket) "/ping" -> serveJson(socket, mapOf("ok" to true))
else -> respond404(socket) else -> respond404(socket)
} }
} }
} }
@@ -384,7 +390,7 @@ function q(id){return document.getElementById(id)}
function connect(){ function connect(){
tok=q('tok').value.trim(); tok=q('tok').value.trim();
if(!tok)return; if(!tok)return;
fetch('/?token='+encodeURIComponent(tok)) fetch('/ping?token='+encodeURIComponent(tok))
.then(function(r){ .then(function(r){
if(r.status===401){q('login-err').style.display='block';return;} if(r.status===401){q('login-err').style.display='block';return;}
q('login').style.display='none'; q('login').style.display='none';