mirror of
https://github.com/sipeed/picoclaw.git
synced 2026-06-12 18:08:54 +00:00
06023c79fa
* feat(launcher): replace token-in-logs auth with standard HTTP login flow
## Problem
Previously users had to find the one-time token from console logs or
log files to access the dashboard - a non-standard, error-prone workflow
with no clear path for changing credentials.
## Solution: standard HTTP API login with bcrypt-backed password store
### Auth flow (new)
1. First run: browser opens, session guard detects uninitialized state,
redirects to /launcher-setup
2. User sets a password (min 8 chars) via POST /api/auth/setup {password, confirm},
bcrypt(cost=12) hash stored in ~/.picoclaw/launcher-auth.db (SQLite)
3. Subsequent logins: POST /api/auth/login {password}, HttpOnly cookie
picoclaw_launcher_auth (HMAC-SHA256 signed, 7-day expiry)
4. 401 on any API call, frontend redirects to /launcher-login
5. Logout: POST /api/auth/logout, cookie cleared, redirect to login
### Backend changes
- web/backend/api/auth.go: renamed Token to Password; added handleSetup;
launcherAuthStatusResponse now includes Initialized bool; PasswordStore
interface wires bcrypt store into handlers
- web/backend/dashboardauth/: new package - Store with New(dir) / Open(path);
SetPassword (bcrypt cost=12), VerifyPassword, IsInitialized
- sql.go: all DB-layer constants (DBFilename, sqliteDriver, bcryptCost,
four SQL query strings) - compile-time constants, zero runtime overhead
- web/backend/middleware/launcher_dashboard_auth.go: /launcher-setup and
/api/auth/setup added to public paths
- web/backend/main.go:
- dashboardauth.New(picoHome) replaces manual path construction
- maskSecret(): suffix only revealed when >=5 chars hidden (length >= 12),
preventing 8-char minimum passwords from leaking their tail
- web/backend/main_test.go: TestMaskSecret updated with boundary cases
### Forward-compatibility: pkg/credential integration
If the dashboard password is later reused as the enc:// passphrase,
the bcrypt hash in launcher-auth.db becomes an offline oracle.
Recommended mitigation (not yet implemented): derive two independent
subkeys via HKDF before use:
bcrypt(HKDF(password, info="picoclaw-dashboard-login-v1")) stored in DB
HKDF(password, info="picoclaw-credential-enc-v1") passed to PassphraseProvider
This isolates the two domains: cracking the bcrypt hash yields only the
login subkey, which is computationally independent of the enc:// subkey.
* fix(auth): replace wastedassign ok := false with var ok bool
* refactor(tray): remove copy-token clipboard feature
Dashboard login now uses standard web auth (bcrypt + session cookie).
The system tray 'Copy dashboard token' menu item is no longer needed.
- Delete tray_offers_copy.go and tray_offers_copy_stub.go
- Remove mCopyTok menu item and clipboard handler from systray.go
- Remove launcherDashboardTokenForClipboard var from main.go
- Remove MenuCopyToken/MenuCopyTokenHint keys from i18n.go
* feat(launcher-ui): standard HTTP login/setup/logout flow for dashboard
Replaces the previous "find token in logs" workflow with a proper
browser-based authentication UI backed by the new /api/auth/* endpoints.
### New pages
- /launcher-setup: first-run password initialization form (password +
confirm, min 8 chars); calls POST /api/auth/setup; redirects to login
on success
- /launcher-login: standard password login form; calls POST /api/auth/login;
sets HttpOnly session cookie on success
### Session guard (src/routes/__root.tsx)
A useEffect on every non-auth page load calls GET /api/auth/status:
- initialized=false -> redirect to /launcher-setup
- authenticated=false -> redirect to /launcher-login
This ensures the setup/login UI is shown even when the ?token= URL
mechanism auto-logs in (first-run case).
### Logout button (src/components/app-header.tsx)
IconLogout button added to the header with a confirm AlertDialog;
calls POST /api/auth/logout then redirects to /launcher-login.
### API layer
- src/api/launcher-auth.ts: LauncherAuthStatus gains initialized bool;
postLauncherDashboardSetup() added; LauncherAuthTokenHelp removed
- src/api/http.ts: 401 guard uses isLauncherAuthPathname() (covers both
/launcher-login and /launcher-setup) to prevent redirect loops
- src/lib/launcher-login-path.ts: isLauncherSetupPathname() and
isLauncherAuthPathname() added
### Routing
- src/routeTree.gen.ts: /launcher-setup route registered throughout
- src/routes/launcher-login.tsx: tokenHelp UI removed; useEffect added
to redirect to setup when initialized=false
### i18n
- en.json / zh.json: launcherSetup block added; launcherLogin keys
updated to use passwordLabel/passwordPlaceholder
* fix(lint): ts lint fixed 1
* fix(auth): detail auth error handle
* fix(login): frontend web auth error handle
* fix(frontend): auth error handler 5xx
121 lines
3.5 KiB
Go
121 lines
3.5 KiB
Go
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"strings"
|
|
)
|
|
|
|
// Language represents the supported languages
|
|
type Language string
|
|
|
|
const (
|
|
LanguageEnglish Language = "en"
|
|
LanguageChinese Language = "zh"
|
|
)
|
|
|
|
// current language (default: English)
|
|
var currentLang Language = LanguageEnglish
|
|
|
|
// TranslationKey represents a translation key used for i18n
|
|
type TranslationKey string
|
|
|
|
const (
|
|
AppTooltip TranslationKey = "AppTooltip"
|
|
MenuOpen TranslationKey = "MenuOpen"
|
|
MenuOpenTooltip TranslationKey = "MenuOpenTooltip"
|
|
MenuAbout TranslationKey = "MenuAbout"
|
|
MenuAboutTooltip TranslationKey = "MenuAboutTooltip"
|
|
MenuVersion TranslationKey = "MenuVersion"
|
|
MenuVersionTooltip TranslationKey = "MenuVersionTooltip"
|
|
MenuGitHub TranslationKey = "MenuGitHub"
|
|
MenuDocs TranslationKey = "MenuDocs"
|
|
MenuRestart TranslationKey = "MenuRestart"
|
|
MenuRestartTooltip TranslationKey = "MenuRestartTooltip"
|
|
MenuQuit TranslationKey = "MenuQuit"
|
|
MenuQuitTooltip TranslationKey = "MenuQuitTooltip"
|
|
Exiting TranslationKey = "Exiting"
|
|
DocUrl TranslationKey = "DocUrl"
|
|
)
|
|
|
|
// Translation tables
|
|
// Chinese translations intentionally contain Han script
|
|
//
|
|
//nolint:gosmopolitan
|
|
var translations = map[Language]map[TranslationKey]string{
|
|
LanguageEnglish: {
|
|
AppTooltip: "%s - Web Console",
|
|
MenuOpen: "Open Console",
|
|
MenuOpenTooltip: "Open PicoClaw console in browser",
|
|
MenuAbout: "About",
|
|
MenuAboutTooltip: "About PicoClaw",
|
|
MenuVersion: "Version: %s",
|
|
MenuVersionTooltip: "Current version number",
|
|
MenuGitHub: "GitHub",
|
|
MenuDocs: "Documentation",
|
|
MenuRestart: "Restart Service",
|
|
MenuRestartTooltip: "Restart Gateway service",
|
|
MenuQuit: "Quit",
|
|
MenuQuitTooltip: "Exit PicoClaw",
|
|
Exiting: "Exiting PicoClaw...",
|
|
DocUrl: "https://docs.picoclaw.io/docs/",
|
|
},
|
|
LanguageChinese: {
|
|
AppTooltip: "%s - Web Console",
|
|
MenuOpen: "打开控制台",
|
|
MenuOpenTooltip: "在浏览器中打开 PicoClaw 控制台",
|
|
MenuAbout: "关于",
|
|
MenuAboutTooltip: "关于 PicoClaw",
|
|
MenuVersion: "版本: %s",
|
|
MenuVersionTooltip: "当前版本号",
|
|
MenuGitHub: "GitHub",
|
|
MenuDocs: "文档",
|
|
MenuRestart: "重启服务",
|
|
MenuRestartTooltip: "重启核心服务",
|
|
MenuQuit: "退出",
|
|
MenuQuitTooltip: "退出 PicoClaw",
|
|
Exiting: "正在退出 PicoClaw...",
|
|
DocUrl: "https://docs.picoclaw.io/zh-Hans/docs/",
|
|
},
|
|
}
|
|
|
|
// SetLanguage sets the current language
|
|
func SetLanguage(lang string) {
|
|
lang = strings.ToLower(strings.TrimSpace(lang))
|
|
|
|
// Extract language code before first underscore or dot
|
|
// e.g., "en_US.UTF-8" -> "en", "zh_CN" -> "zh"
|
|
if idx := strings.IndexAny(lang, "_."); idx > 0 {
|
|
lang = lang[:idx]
|
|
}
|
|
|
|
if lang == "zh" || lang == "zh-cn" || lang == "chinese" {
|
|
currentLang = LanguageChinese
|
|
} else {
|
|
currentLang = LanguageEnglish
|
|
}
|
|
}
|
|
|
|
// GetLanguage returns the current language
|
|
func GetLanguage() Language {
|
|
return currentLang
|
|
}
|
|
|
|
// T translates a key to the current language
|
|
func T(key TranslationKey, args ...any) string {
|
|
if trans, ok := translations[currentLang][key]; ok {
|
|
if len(args) > 0 {
|
|
return fmt.Sprintf(trans, args...)
|
|
}
|
|
return trans
|
|
}
|
|
return string(key)
|
|
}
|
|
|
|
// Initialize i18n from environment variable
|
|
func init() {
|
|
if lang := os.Getenv("LANG"); lang != "" {
|
|
SetLanguage(lang)
|
|
}
|
|
}
|