mirror of
https://github.com/grp06/openclaw-studio.git
synced 2026-08-14 00:47:51 +00:00
George Pickett
732b994120
Centralize OpenClaw agent id validation in a new module (src/lib/agents/agentIds.ts) and route every gateway, cron, ssh, and intent path through it. Tighten the safe-id regex to match the gateway's 64-char normalization and reserve "main" from UI creation. Add symlink-aware boundary checks and move rollback to trash/restoreAgentStateLocally and the SSH equivalent so a failed move never leaves the filesystem half-migrated, and restore refuses symlinks that escape stateDir. Validate session keys (hasMalformedAgentSessionKey, sessionKeyBelongsToAgent) and cron job fields before trusting gateway output, and compare cron agent ids case-insensitively. Refactor applyGatewayConfigPatch and exec-approvals retry to fetch the snapshot inside the retry callback, eliminating a stale-baseHash race. Harden the control-plane adapter: stop() now waits on in-flight start, times out hung sockets, and ignores stale ws event handlers via a connection epoch. Close a WebSocket upgrade auth bypass in server/index.js by routing upgrades through accessGate.allowUpgrade, make access-gate cookie values URL-safe and stop reconstructing redirect URLs from Host headers, and apply the access gate to all non-token requests rather than only /api/. Read media via realpath + boundary re-check, enforce MAX_MEDIA_BYTES on remote SSH responses, and whitelist response MIME types. Clean up SSE streams on client abort. Normalize localhost gateway URLs in studio-settings so token hints only apply when the draft URL matches, and write settings atomically. Make the Playwright port configurable (PLAYWRIGHT_PORT, default 3100) to avoid colliding with the running dev server, and ignore .worktrees in eslint. Add unit tests for the new agentIds module, gateway connect profile, disconnect-like errors, local gateway, and studio settings store, and extend existing tests to cover the new validation, rollback, retry, and normalization paths.
92 lines
2.5 KiB
JavaScript
92 lines
2.5 KiB
JavaScript
const { URL } = require("node:url");
|
|
|
|
const parseCookies = (header) => {
|
|
const raw = typeof header === "string" ? header : "";
|
|
if (!raw.trim()) return {};
|
|
const out = {};
|
|
for (const part of raw.split(";")) {
|
|
const idx = part.indexOf("=");
|
|
if (idx === -1) continue;
|
|
const key = part.slice(0, idx).trim();
|
|
const value = part.slice(idx + 1).trim();
|
|
if (!key) continue;
|
|
try {
|
|
out[key] = decodeURIComponent(value);
|
|
} catch {
|
|
out[key] = value;
|
|
}
|
|
}
|
|
return out;
|
|
};
|
|
|
|
const buildRedirectUrl = (req, nextPathWithQuery) => {
|
|
void req;
|
|
return nextPathWithQuery || "/";
|
|
};
|
|
|
|
const writeUnauthorized = (res) => {
|
|
res.statusCode = 401;
|
|
res.setHeader("Content-Type", "application/json");
|
|
res.end(
|
|
JSON.stringify({
|
|
error:
|
|
"Studio access token required. Open /?access_token=... once to set a cookie.",
|
|
})
|
|
);
|
|
};
|
|
|
|
function createAccessGate(options) {
|
|
const token = String(options?.token ?? "").trim();
|
|
const cookieName = String(options?.cookieName ?? "studio_access").trim() || "studio_access";
|
|
const queryParam = String(options?.queryParam ?? "access_token").trim() || "access_token";
|
|
|
|
const enabled = Boolean(token);
|
|
|
|
const isAuthorized = (req) => {
|
|
if (!enabled) return true;
|
|
const cookieHeader = req.headers?.cookie;
|
|
const cookies = parseCookies(cookieHeader);
|
|
return cookies[cookieName] === token;
|
|
};
|
|
|
|
const handleHttp = (req, res) => {
|
|
if (!enabled) return false;
|
|
const host = req.headers?.host || "localhost";
|
|
const url = new URL(req.url || "/", `http://${host}`);
|
|
const provided = url.searchParams.get(queryParam);
|
|
|
|
if (provided !== null) {
|
|
if (provided !== token) {
|
|
res.statusCode = 401;
|
|
res.setHeader("Content-Type", "application/json");
|
|
res.end(JSON.stringify({ error: "Invalid Studio access token." }));
|
|
return true;
|
|
}
|
|
|
|
url.searchParams.delete(queryParam);
|
|
const cookieValue = `${cookieName}=${encodeURIComponent(token)}; HttpOnly; Path=/; SameSite=Lax`;
|
|
res.statusCode = 302;
|
|
res.setHeader("Set-Cookie", cookieValue);
|
|
res.setHeader("Location", buildRedirectUrl(req, url.pathname + url.search));
|
|
res.end();
|
|
return true;
|
|
}
|
|
|
|
if (!isAuthorized(req)) {
|
|
writeUnauthorized(res);
|
|
return true;
|
|
}
|
|
|
|
return false;
|
|
};
|
|
|
|
const allowUpgrade = (req) => {
|
|
if (!enabled) return true;
|
|
return isAuthorized(req);
|
|
};
|
|
|
|
return { enabled, handleHttp, allowUpgrade };
|
|
}
|
|
|
|
module.exports = { createAccessGate };
|