Add token-based authentication for the Launcher's embedded Web Dashboard. - Ephemeral token generated in-memory each run (or via PICOCLAW_LAUNCHER_TOKEN env var) - HMAC-SHA256 session cookie (HttpOnly, SameSite=Lax, Secure when HTTPS) - Bearer token support for API/script access - Rate limiting on login (10 attempts/IP/min) - Referrer-Policy: no-referrer on all responses - POST-only logout with JSON content-type (CSRF-safe) - System tray "Copy dashboard token" action - Login page shows contextual help (console/tray/log file path) - Path traversal protection via path.Clean - X-Forwarded-Host/Port/Proto support for reverse proxy deployments - Full i18n support (English, Chinese) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
58 lines
1.4 KiB
TypeScript
58 lines
1.4 KiB
TypeScript
import { launcherFetch } from "@/api/http"
|
|
|
|
export interface ToolSupportItem {
|
|
name: string
|
|
description: string
|
|
category: string
|
|
config_key: string
|
|
status: "enabled" | "disabled" | "blocked"
|
|
reason_code?: string
|
|
}
|
|
|
|
interface ToolsResponse {
|
|
tools: ToolSupportItem[]
|
|
}
|
|
|
|
interface ToolActionResponse {
|
|
status: string
|
|
}
|
|
|
|
async function request<T>(path: string, options?: RequestInit): Promise<T> {
|
|
const res = await launcherFetch(path, options)
|
|
if (!res.ok) {
|
|
let message = `API error: ${res.status} ${res.statusText}`
|
|
try {
|
|
const body = (await res.json()) as {
|
|
error?: string
|
|
errors?: string[]
|
|
}
|
|
if (Array.isArray(body.errors) && body.errors.length > 0) {
|
|
message = body.errors.join("; ")
|
|
} else if (typeof body.error === "string" && body.error.trim() !== "") {
|
|
message = body.error
|
|
}
|
|
} catch {
|
|
// ignore invalid body
|
|
}
|
|
throw new Error(message)
|
|
}
|
|
return res.json() as Promise<T>
|
|
}
|
|
|
|
export async function getTools(): Promise<ToolsResponse> {
|
|
return request<ToolsResponse>("/api/tools")
|
|
}
|
|
|
|
export async function setToolEnabled(
|
|
name: string,
|
|
enabled: boolean,
|
|
): Promise<ToolActionResponse> {
|
|
return request<ToolActionResponse>(
|
|
`/api/tools/${encodeURIComponent(name)}/state`,
|
|
{
|
|
method: "PUT",
|
|
headers: { "Content-Type": "application/json" },
|
|
body: JSON.stringify({ enabled }),
|
|
},
|
|
)
|
|
}
|