picoclaw/web/frontend/src/store/gateway.ts
sky5454 06023c79fa
feat(launcher): standard HTTP login/setup/logout flow for dashboard, frontend and backend impl. and fix windows pid lock for ws (#2339)
* feat(launcher): replace token-in-logs auth with standard HTTP login flow

## Problem

Previously users had to find the one-time token from console logs or
log files to access the dashboard - a non-standard, error-prone workflow
with no clear path for changing credentials.

## Solution: standard HTTP API login with bcrypt-backed password store

### Auth flow (new)
1. First run: browser opens, session guard detects uninitialized state,
   redirects to /launcher-setup
2. User sets a password (min 8 chars) via POST /api/auth/setup {password, confirm},
   bcrypt(cost=12) hash stored in ~/.picoclaw/launcher-auth.db (SQLite)
3. Subsequent logins: POST /api/auth/login {password}, HttpOnly cookie
   picoclaw_launcher_auth (HMAC-SHA256 signed, 7-day expiry)
4. 401 on any API call, frontend redirects to /launcher-login
5. Logout: POST /api/auth/logout, cookie cleared, redirect to login

### Backend changes
- web/backend/api/auth.go: renamed Token to Password; added handleSetup;
  launcherAuthStatusResponse now includes Initialized bool; PasswordStore
  interface wires bcrypt store into handlers
- web/backend/dashboardauth/: new package - Store with New(dir) / Open(path);
  SetPassword (bcrypt cost=12), VerifyPassword, IsInitialized
  - sql.go: all DB-layer constants (DBFilename, sqliteDriver, bcryptCost,
    four SQL query strings) - compile-time constants, zero runtime overhead
- web/backend/middleware/launcher_dashboard_auth.go: /launcher-setup and
  /api/auth/setup added to public paths
- web/backend/main.go:
  - dashboardauth.New(picoHome) replaces manual path construction
  - maskSecret(): suffix only revealed when >=5 chars hidden (length >= 12),
    preventing 8-char minimum passwords from leaking their tail
- web/backend/main_test.go: TestMaskSecret updated with boundary cases

### Forward-compatibility: pkg/credential integration

If the dashboard password is later reused as the enc:// passphrase,
the bcrypt hash in launcher-auth.db becomes an offline oracle.
Recommended mitigation (not yet implemented): derive two independent
subkeys via HKDF before use:

  bcrypt(HKDF(password, info="picoclaw-dashboard-login-v1"))  stored in DB
  HKDF(password, info="picoclaw-credential-enc-v1")           passed to PassphraseProvider

This isolates the two domains: cracking the bcrypt hash yields only the
login subkey, which is computationally independent of the enc:// subkey.

* fix(auth): replace wastedassign ok := false with var ok bool

* refactor(tray): remove copy-token clipboard feature

Dashboard login now uses standard web auth (bcrypt + session cookie).
The system tray 'Copy dashboard token' menu item is no longer needed.

- Delete tray_offers_copy.go and tray_offers_copy_stub.go
- Remove mCopyTok menu item and clipboard handler from systray.go
- Remove launcherDashboardTokenForClipboard var from main.go
- Remove MenuCopyToken/MenuCopyTokenHint keys from i18n.go

* feat(launcher-ui): standard HTTP login/setup/logout flow for dashboard

Replaces the previous "find token in logs" workflow with a proper
browser-based authentication UI backed by the new /api/auth/* endpoints.

### New pages
- /launcher-setup: first-run password initialization form (password +
  confirm, min 8 chars); calls POST /api/auth/setup; redirects to login
  on success
- /launcher-login: standard password login form; calls POST /api/auth/login;
  sets HttpOnly session cookie on success

### Session guard (src/routes/__root.tsx)
A useEffect on every non-auth page load calls GET /api/auth/status:
- initialized=false  -> redirect to /launcher-setup
- authenticated=false -> redirect to /launcher-login
This ensures the setup/login UI is shown even when the ?token= URL
mechanism auto-logs in (first-run case).

### Logout button (src/components/app-header.tsx)
IconLogout button added to the header with a confirm AlertDialog;
calls POST /api/auth/logout then redirects to /launcher-login.

### API layer
- src/api/launcher-auth.ts: LauncherAuthStatus gains initialized bool;
  postLauncherDashboardSetup() added; LauncherAuthTokenHelp removed
- src/api/http.ts: 401 guard uses isLauncherAuthPathname() (covers both
  /launcher-login and /launcher-setup) to prevent redirect loops
- src/lib/launcher-login-path.ts: isLauncherSetupPathname() and
  isLauncherAuthPathname() added

### Routing
- src/routeTree.gen.ts: /launcher-setup route registered throughout
- src/routes/launcher-login.tsx: tokenHelp UI removed; useEffect added
  to redirect to setup when initialized=false

### i18n
- en.json / zh.json: launcherSetup block added; launcherLogin keys
  updated to use passwordLabel/passwordPlaceholder

* fix(lint): ts lint fixed 1

* fix(auth): detail auth error handle

* fix(login):  frontend web auth error handle

* fix(frontend): auth error handler 5xx
2026-04-08 21:43:51 +08:00

213 lines
5.3 KiB
TypeScript

import { atom, getDefaultStore } from "jotai"
import { type GatewayStatusResponse, getGatewayStatus } from "@/api/gateway"
export type GatewayState =
| "running"
| "starting"
| "restarting"
| "stopping"
| "stopped"
| "error"
| "unknown"
export interface GatewayStoreState {
status: GatewayState
canStart: boolean
startReason?: string
restartRequired: boolean
}
type GatewayStorePatch = Partial<GatewayStoreState>
const DEFAULT_GATEWAY_STATE: GatewayStoreState = {
status: "unknown",
canStart: true,
restartRequired: false,
}
const GATEWAY_POLL_INTERVAL_MS = 2000
const GATEWAY_TRANSIENT_POLL_INTERVAL_MS = 1000
const GATEWAY_STOPPING_TIMEOUT_MS = 5000
interface RefreshGatewayStateOptions {
force?: boolean
}
// Global atom for gateway state
export const gatewayAtom = atom<GatewayStoreState>(DEFAULT_GATEWAY_STATE)
let gatewayPollingSubscribers = 0
let gatewayPollingTimer: ReturnType<typeof setTimeout> | null = null
let gatewayPollingRequest: Promise<void> | null = null
let gatewayStoppingTimer: ReturnType<typeof setTimeout> | null = null
function clearGatewayStoppingTimeout() {
if (gatewayStoppingTimer !== null) {
clearTimeout(gatewayStoppingTimer)
gatewayStoppingTimer = null
}
}
function normalizeGatewayStoreState(
prev: GatewayStoreState,
patch: GatewayStorePatch,
) {
const next = { ...prev, ...patch }
if (
next.status === prev.status &&
next.canStart === prev.canStart &&
next.startReason === prev.startReason &&
next.restartRequired === prev.restartRequired
) {
return prev
}
return next
}
export function updateGatewayStore(
patch:
| GatewayStorePatch
| ((prev: GatewayStoreState) => GatewayStorePatch | GatewayStoreState),
) {
const store = getDefaultStore()
store.set(gatewayAtom, (prev) => {
const nextPatch = typeof patch === "function" ? patch(prev) : patch
return normalizeGatewayStoreState(prev, nextPatch)
})
const nextState = store.get(gatewayAtom)
if (nextState?.status !== "stopping") {
clearGatewayStoppingTimeout()
}
}
export function beginGatewayStoppingTransition() {
clearGatewayStoppingTimeout()
updateGatewayStore({
status: "stopping",
canStart: false,
restartRequired: false,
})
gatewayStoppingTimer = setTimeout(() => {
gatewayStoppingTimer = null
updateGatewayStore((prev) =>
prev.status === "stopping" ? { status: "running" } : prev,
)
void refreshGatewayState({ force: true })
}, GATEWAY_STOPPING_TIMEOUT_MS)
}
export function cancelGatewayStoppingTransition() {
clearGatewayStoppingTimeout()
updateGatewayStore((prev) =>
prev.status === "stopping" ? { status: "running" } : prev,
)
}
export function applyGatewayStatusToStore(
data: Partial<
Pick<
GatewayStatusResponse,
| "gateway_status"
| "gateway_start_allowed"
| "gateway_start_reason"
| "gateway_restart_required"
>
>,
) {
updateGatewayStore((prev) => ({
status:
prev.status === "stopping" && data.gateway_status === "running"
? "stopping"
: (data.gateway_status ?? prev.status),
canStart:
prev.status === "stopping" && data.gateway_status === "running"
? false
: (data.gateway_start_allowed ?? prev.canStart),
startReason:
prev.status === "stopping" && data.gateway_status === "running"
? prev.startReason
: (data.gateway_start_reason ?? prev.startReason),
restartRequired:
prev.status === "stopping" && data.gateway_status === "running"
? false
: (data.gateway_restart_required ?? prev.restartRequired),
}))
}
function nextGatewayPollInterval() {
const status = getDefaultStore().get(gatewayAtom).status
if (
status === "starting" ||
status === "restarting" ||
status === "stopping"
) {
return GATEWAY_TRANSIENT_POLL_INTERVAL_MS
}
return GATEWAY_POLL_INTERVAL_MS
}
function scheduleGatewayPoll(delay = nextGatewayPollInterval()) {
if (gatewayPollingSubscribers === 0) {
return
}
if (gatewayPollingTimer !== null) {
clearTimeout(gatewayPollingTimer)
}
gatewayPollingTimer = setTimeout(() => {
gatewayPollingTimer = null
void refreshGatewayState()
}, delay)
}
export async function refreshGatewayState(
options: RefreshGatewayStateOptions = {},
) {
if (gatewayPollingRequest) {
await gatewayPollingRequest
if (options.force) {
return refreshGatewayState()
}
return
}
gatewayPollingRequest = (async () => {
try {
const status = await getGatewayStatus()
applyGatewayStatusToStore(status)
} catch {
// Preserve the last known state when a poll fails.
} finally {
gatewayPollingRequest = null
scheduleGatewayPoll()
}
})()
try {
await gatewayPollingRequest
} finally {
if (gatewayPollingSubscribers === 0 && gatewayPollingTimer !== null) {
clearTimeout(gatewayPollingTimer)
gatewayPollingTimer = null
}
}
}
export function subscribeGatewayPolling() {
gatewayPollingSubscribers += 1
if (gatewayPollingSubscribers === 1) {
void refreshGatewayState()
}
return () => {
gatewayPollingSubscribers = Math.max(0, gatewayPollingSubscribers - 1)
if (gatewayPollingSubscribers === 0 && gatewayPollingTimer !== null) {
clearTimeout(gatewayPollingTimer)
gatewayPollingTimer = null
}
}
}