mirror of
https://github.com/Ark0N/Codeman.git
synced 2026-11-15 10:59:32 +01:00
arkonandClaude Opus 4.6
746004c461
Adds ephemeral single-use QR tokens for passwordless tunnel login. Scanning the QR auto-authenticates; bare tunnel URL requires Basic Auth. Backend: - TunnelManager: 60s token rotation, 90s grace, rejection-sampled 6-char base62 short codes, Map-based O(1) lookup, SVG caching, global rate limit - Auth middleware: /q/ bypass, separate qrAuthFailures counter, enhanced AuthSessionRecord with device context (ip, ua, createdAt, method) - Routes: GET /q/:code (consume + cookie + redirect), POST /api/tunnel/qr/ regenerate, POST /api/auth/revoke, updated GET /api/tunnel/qr with cache - SSE: tunnel:qrRotated, tunnel:qrRegenerated, tunnel:qrAuthUsed events - Audit: qr_auth lifecycle log entries Frontend: - Auto-refresh QR via inline SVG in SSE (fallback fetch if absent) - 60s countdown indicator on QR badge - Regenerate QR button - QRLjacking detection toast with [Revoke All] action button (10s duration) - showToast enhanced with optional duration and action button support Fixes: - /api/logout now invalidates server-side session token (was only clearing browser cookie, leaving token valid for replay) Tests: 20 new tests in test/qr-auth.test.ts covering token lifecycle, bias check, rate limiting, SVG caching, and full server integration. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
30 lines
1.1 KiB
TypeScript
30 lines
1.1 KiB
TypeScript
/**
|
|
* @fileoverview Session lifecycle audit types
|
|
*/
|
|
|
|
/** Types of session lifecycle events recorded to the audit log */
|
|
export type LifecycleEventType =
|
|
| 'created' // Session object created
|
|
| 'started' // PTY process launched (interactive/shell/prompt)
|
|
| 'exit' // PTY process exited (with exit code)
|
|
| 'deleted' // cleanupSession() called — session removed
|
|
| 'detached' // Server shutdown — PTY left alive in tmux for recovery
|
|
| 'recovered' // Session restored from tmux on server restart
|
|
| 'stale_cleaned' // Removed from state.json by cleanupStaleSessions()
|
|
| 'mux_died' // tmux session died (detected by reconciliation)
|
|
| 'server_started' // Server started (marker for restart detection)
|
|
| 'server_stopped' // Server shutting down
|
|
| 'qr_auth'; // Device authenticated via QR code scan
|
|
|
|
/** A single entry in the session lifecycle audit log */
|
|
export interface LifecycleEntry {
|
|
ts: number;
|
|
event: LifecycleEventType;
|
|
sessionId: string;
|
|
name?: string;
|
|
mode?: string;
|
|
reason?: string;
|
|
exitCode?: number | null;
|
|
extra?: Record<string, unknown>;
|
|
}
|