Add token-based authentication for the Launcher's embedded Web Dashboard. - Ephemeral token generated in-memory each run (or via PICOCLAW_LAUNCHER_TOKEN env var) - HMAC-SHA256 session cookie (HttpOnly, SameSite=Lax, Secure when HTTPS) - Bearer token support for API/script access - Rate limiting on login (10 attempts/IP/min) - Referrer-Policy: no-referrer on all responses - POST-only logout with JSON content-type (CSRF-safe) - System tray "Copy dashboard token" action - Login page shows contextual help (console/tray/log file path) - Path traversal protection via path.Clean - X-Forwarded-Host/Port/Proto support for reverse proxy deployments - Full i18n support (English, Chinese) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
40 lines
1 KiB
TypeScript
40 lines
1 KiB
TypeScript
import { launcherFetch } from "@/api/http"
|
|
|
|
// API client for Pico Channel configuration.
|
|
|
|
interface PicoTokenResponse {
|
|
token: string
|
|
ws_url: string
|
|
enabled: boolean
|
|
}
|
|
|
|
interface PicoSetupResponse {
|
|
token: string
|
|
ws_url: string
|
|
enabled: boolean
|
|
changed: boolean
|
|
}
|
|
|
|
const BASE_URL = ""
|
|
|
|
async function request<T>(path: string, options?: RequestInit): Promise<T> {
|
|
const res = await launcherFetch(`${BASE_URL}${path}`, options)
|
|
if (!res.ok) {
|
|
throw new Error(`API error: ${res.status} ${res.statusText}`)
|
|
}
|
|
return res.json() as Promise<T>
|
|
}
|
|
|
|
export async function getPicoToken(): Promise<PicoTokenResponse> {
|
|
return request<PicoTokenResponse>("/api/pico/token")
|
|
}
|
|
|
|
export async function regenPicoToken(): Promise<PicoTokenResponse> {
|
|
return request<PicoTokenResponse>("/api/pico/token", { method: "POST" })
|
|
}
|
|
|
|
export async function setupPico(): Promise<PicoSetupResponse> {
|
|
return request<PicoSetupResponse>("/api/pico/setup", { method: "POST" })
|
|
}
|
|
|
|
export type { PicoTokenResponse, PicoSetupResponse }
|