feat: improve remote access UI and functionality - #35
Merged
Conversation
- Architecture: claimer pattern (TCP port as distributed lock), reverse proxy + loopback bypass - Security: CSP with hash-based script/style whitelist, CSRF double-submit cookie, HttpOnly token cookie, rate limiting - Features: global auth token config, dashboard HTML, tailscale serve auto-management - Config: auth.json (atomic write, Load() distinguishes file-not-found vs JSON corruption) - Auth: POST /api/auth returns 400 when token not configured; /api/logout requires CSRF token - Cookie: mw_token 24h sliding expiration via Set-Cookie on each authenticated request - Edge cases: Portal SPOF 10-15s failover window, Serve unexpected exit with Warn log
- 11 tasks with dependency graph and sub-task decomposition - Each sub-task references plan document section and line numbers - Includes acceptance criteria and cross-task concerns appendix - Parallel execution: Task 1+3 first, then Task 5 splits into 6/7/8
- Task 0: Update README.md and README.zh-CN.md before any code changes - Covers: Remote Access section rewrite, Features update, CLI examples, Portal output - Docs-first principle: ensures team alignment on feature scope before implementation
Align with 文档优先 principle: project documentation updates before code
- 0.6: PRD.md — tagline, security section, implementation state, acceptance criteria
- 0.7: ARCHITECTURE.md — overview, new packages (config/portal), data persistence,
security model (dual-layer auth), new CLI flags section
- 0.8: API.md — auth header (mw_token Cookie), new Portal endpoints chapter
(7 endpoints with schemas, CSRF annotations, reverse proxy docs)
- README.md/zh-CN.md: expand Remote Access section (global token, Portal dashboard, Tailscale HTTPS, network security table), add CLI examples (mw config, --portal-port), add Portal output - PRD.md: add Portal Dashboard as key feature, expand security section, update implementation status, add MVP acceptance criteria - ARCHITECTURE.md: add Portal/dashboard overview, new internal/config and internal/portal packages, auth.json/portal registry/server.json, dual-layer auth architecture, CLI flags chapter - API.md: add mw_token Cookie auth source, new Portal Dashboard endpoints section (7 endpoints with schemas, CSRF, reverse proxy)
- 添加 loopback 请求跳过校验（isLoopbackRequest） - Token 提取优先级：Authorization Bearer → ?token= → mw_token Cookie - 提取 extractAuthToken() 函数，使用 r.Cookie() 精确匹配 - 添加单元测试覆盖 loopback 放行、Cookie token、速率限制 [Task 4] §2 Auth中间件改造 (行118-145), §7 Cookie认证 (行446-470)
- Strip /s/<repo-hash>/ prefix before forwarding to target instance - Validate repo-hash format (lowercase hex only) to prevent path traversal - Set proxy.ErrorLog to logWriter for 502 errors with repo_hash context - Add integration tests: auth required (401), invalid hash (400), not found (502), sliding cookie, WebSocket bidirectional message exchange - WebSocket test: waitForPort retry loop instead of time.Sleep - wsWriteFrame: fix mask key offset and extended payload length field
- Add gen.go (//go:build ignore) that reads dashboard.html and generates csp_gen.go with SHA256+base64 hashes for inline <script> and <style> blocks - Add csp_gen.go with CSPHashes [][2]string exported variable - Replace placeholder cspHashes with generated CSPHashes in portal.go - Add //go:generate go run gen.go directive for re-generation - Add CSP hash verification tests supporting multiple same-type blocks: TestCSPHashes_MatchesDashboardHTML (slice-based comparison) TestCSPHashes_NotEmpty TestCSPHashes_NoDuplicateTypes - Fix duplicate style block in gen.go styles loop - Fix test to strip quotes from CSPHashes entries for comparison
- Start Portal in Server.Start() after listener init, with graceful degradation on failure
- Add Shutdown() method for clean teardown: stop Portal, shutdown HTTP server, close listener
- Replace select{} with signal handling in CLI (SIGINT/SIGTERM → Shutdown)
- Add TailscaleDNSName() helper to display Tailscale URL at startup
…code host to 0.0.0.0 ; add tailscaleServeOK guard to suppress stale-check log spam
…dback - Replace hardcoded port 12345 with s.cfg.PortalPort in app.go - Add PortalPort > 0 guard before opening browser - Show 'Portal is disabled' when portalPort is 0 instead of misleading 'Opening browser...' message - Add color CSS property to button in index.html
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.