diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml index d1643f0..5a4cc48 100644 --- a/android/app/src/main/AndroidManifest.xml +++ b/android/app/src/main/AndroidManifest.xml @@ -67,11 +67,21 @@ android:screenOrientation="landscape" android:theme="@style/Theme.RemoteDisplay.Fullscreen" /> - + + android:foregroundServiceType="mediaPlayback" /> + + + = Build.VERSION_CODES.O) { + context.startForegroundService(intent) + } else { + context.startService(intent) + } + } + + fun stop(context: Context) { + context.stopService(Intent(context, MediaProjectionService::class.java)) + } + } + + override fun onBind(intent: Intent?): IBinder? = null + + override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int { + // Enter the foreground with the mediaProjection type FIRST (required on + // Android 14+ before getMediaProjection()). + startForegroundCompat() + + val resultCode = intent?.getIntExtra(EXTRA_RESULT_CODE, Activity.RESULT_CANCELED) + ?: Activity.RESULT_CANCELED + @Suppress("DEPRECATION") + val data: Intent? = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) { + intent?.getParcelableExtra(EXTRA_RESULT_DATA, Intent::class.java) + } else { + intent?.getParcelableExtra(EXTRA_RESULT_DATA) + } + + if (resultCode != Activity.RESULT_OK || data == null) { + Log.e(TAG, "Missing/invalid projection consent; stopping service") + stopSelf() + return START_NOT_STICKY + } + + return try { + ScreenCaptureService.startProjection(this, resultCode, data) + START_STICKY + } catch (e: Throwable) { + Log.e(TAG, "startProjection failed: ${e.message}", e) + stopSelf() + START_NOT_STICKY + } + } + + private fun startForegroundCompat() { + val notif = NotificationCompat.Builder(this, RemoteDisplayApp.CHANNEL_ID) + .setContentTitle("ScreenTinker") + .setContentText("Screen capture active") + .setSmallIcon(android.R.drawable.ic_menu_camera) + .setOngoing(true) + .build() + if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) { + startForeground(NOTIF_ID, notif, ServiceInfo.FOREGROUND_SERVICE_TYPE_MEDIA_PROJECTION) + } else { + startForeground(NOTIF_ID, notif) + } + } + + override fun onDestroy() { + // Release the projection when the service goes away. + try { ScreenCaptureService.stop() } catch (_: Throwable) {} + super.onDestroy() + } +} diff --git a/android/app/src/main/java/com/remotedisplay/player/service/ScreenCaptureService.kt b/android/app/src/main/java/com/remotedisplay/player/service/ScreenCaptureService.kt index 9eb32c2..3961ce2 100644 --- a/android/app/src/main/java/com/remotedisplay/player/service/ScreenCaptureService.kt +++ b/android/app/src/main/java/com/remotedisplay/player/service/ScreenCaptureService.kt @@ -54,13 +54,9 @@ object ScreenCaptureService { imageReader = ImageReader.newInstance(captureWidth, captureHeight, PixelFormat.RGBA_8888, 4) - virtualDisplay = projection.createVirtualDisplay( - "ScreenTinker", - captureWidth, captureHeight, density, - DisplayManager.VIRTUAL_DISPLAY_FLAG_AUTO_MIRROR, - imageReader!!.surface, null, null - ) - + // #5: Android 14+ requires a Callback registered BEFORE createVirtualDisplay, + // otherwise createVirtualDisplay throws IllegalStateException. (Was registered + // after, which broke system capture on Android 14+.) projection.registerCallback(object : MediaProjection.Callback() { override fun onStop() { Log.i(TAG, "MediaProjection stopped by system") @@ -68,6 +64,13 @@ object ScreenCaptureService { } }, null) + virtualDisplay = projection.createVirtualDisplay( + "ScreenTinker", + captureWidth, captureHeight, density, + DisplayManager.VIRTUAL_DISPLAY_FLAG_AUTO_MIRROR, + imageReader!!.surface, null, null + ) + Log.i(TAG, "MediaProjection started: ${captureWidth}x${captureHeight}") } diff --git a/android/app/src/main/java/com/remotedisplay/player/service/WebSocketService.kt b/android/app/src/main/java/com/remotedisplay/player/service/WebSocketService.kt index c0c3fbf..1574556 100644 --- a/android/app/src/main/java/com/remotedisplay/player/service/WebSocketService.kt +++ b/android/app/src/main/java/com/remotedisplay/player/service/WebSocketService.kt @@ -53,7 +53,16 @@ class WebSocketService : Service() { super.onCreate() config = ServerConfig(this) deviceInfo = DeviceInfo(this) - startForeground(1, createNotification()) + // #5: claim ONLY the mediaPlayback FGS type. The 2-arg startForeground + // claims every manifest-declared type, and on Android 14+ claiming + // mediaProjection without a consent token throws and kills the service at + // boot (the "app won't run on newer Android" symptom). Screen capture has + // its own mediaProjection-typed service (MediaProjectionService). + if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.Q) { + startForeground(1, createNotification(), android.content.pm.ServiceInfo.FOREGROUND_SERVICE_TYPE_MEDIA_PLAYBACK) + } else { + startForeground(1, createNotification()) + } // Keep CPU alive so the WebSocket connection stays alive in background val pm = getSystemService(POWER_SERVICE) as android.os.PowerManager diff --git a/frontend/js/views/kiosk.js b/frontend/js/views/kiosk.js index 6463c99..6b6c684 100644 --- a/frontend/js/views/kiosk.js +++ b/frontend/js/views/kiosk.js @@ -1,5 +1,6 @@ import { showToast } from '../components/toast.js'; import { t } from '../i18n.js'; +import { esc } from '../utils.js'; const API = (url, opts = {}) => fetch('/api' + url, { headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${localStorage.getItem('token')}`, ...opts.headers }, ...opts }).then(r => r.json()); @@ -44,12 +45,12 @@ async function renderList(container) { 🖱
-
${p.name}
+
${esc(p.name)}
${t('kiosk.label')}
${t('kiosk.preview')} - +
`).join(''); @@ -85,7 +86,7 @@ async function renderEditor(container, pageId) { ${t('kiosk.back')}
-

${page.name}

+

${esc(page.name)}

${t('kiosk.preview')} @@ -98,17 +99,17 @@ async function renderEditor(container, pageId) {

${t('kiosk.page_settings')}

-
-
-
-
-
+
+
+
+
+

${t('kiosk.style')}

-
+
- + +
- +
- +
`).join('') || `

${t('kiosk.no_buttons')}

`; diff --git a/frontend/js/views/layout-editor.js b/frontend/js/views/layout-editor.js index e216529..01d0de0 100644 --- a/frontend/js/views/layout-editor.js +++ b/frontend/js/views/layout-editor.js @@ -1,6 +1,7 @@ import { api } from '../api.js'; import { showToast } from '../components/toast.js'; import { t, tn } from '../i18n.js'; +import { esc } from '../utils.js'; const API = (url, opts = {}) => fetch('/api' + url, { headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${localStorage.getItem('token')}`, ...opts.headers }, ...opts }).then(r => r.json()); @@ -84,12 +85,12 @@ function renderLayoutCard(layout, isTemplate) { ${(layout.zones || []).map(z => `
${z.name}
+ font-size:9px;color:var(--text-muted);overflow:hidden">${esc(z.name)}
`).join('')}
-
${layout.name}
+
${esc(layout.name)}
${zonesText}${isTemplate ? ' • ' + t('layout.template_label') : ''}
@@ -97,7 +98,7 @@ function renderLayoutCard(layout, isTemplate) { ? `` : `` } - +
`; @@ -115,7 +116,7 @@ async function renderEditor(container, layoutId) { ${t('layout.back')}
-

${layout.name}

+

${esc(layout.name)}

@@ -228,8 +229,8 @@ async function renderEditor(container, layoutId) {
-
${z.name}
-
${Math.round(z.width_percent)}% x ${Math.round(z.height_percent)}% • ${z.zone_type}
+
${esc(z.name)}
+
${Math.round(z.width_percent)}% x ${Math.round(z.height_percent)}% • ${esc(z.zone_type)}
`).join(''); diff --git a/frontend/js/views/teams.js b/frontend/js/views/teams.js index 5240ac1..4c1901e 100644 --- a/frontend/js/views/teams.js +++ b/frontend/js/views/teams.js @@ -1,6 +1,7 @@ import { api } from '../api.js'; import { showToast } from '../components/toast.js'; import { t, tn } from '../i18n.js'; +import { esc } from '../utils.js'; const API = (url, opts = {}) => fetch('/api' + url, { headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${localStorage.getItem('token')}`, ...opts.headers }, ...opts }).then(r => r.json()); @@ -46,9 +47,9 @@ async function renderList(container) {
-
${team.name[0].toUpperCase()}
+
${esc(team.name[0].toUpperCase())}
-
${team.name}
+
${esc(team.name)}
${t('team.your_role', { role: team.my_role })} · ${tn('team.member_count', team.member_count)}
@@ -77,7 +78,7 @@ async function renderTeamDetail(container, teamId) { ${t('team.back')}
-

${team.name}

+

${esc(team.name)}

@@ -92,10 +93,10 @@ async function renderTeamDetail(container, teamId) {
${(team.members || []).map(m => `
-
${(m.user_name || m.email)[0].toUpperCase()}
+
${esc((m.user_name || m.email)[0].toUpperCase())}
-
${m.user_name || m.email}
-
${m.email}
+
${esc(m.user_name || m.email)}
+
${esc(m.email)}
- ${unassignedDevices.map(d => ``).join('')} + ${unassignedDevices.map(d => ``).join('')}
@@ -121,8 +122,8 @@ async function renderTeamDetail(container, teamId) {
-
${d.name}
-
${d.status}
+
${esc(d.name)}
+
${esc(d.status)}
diff --git a/server/lib/branding.js b/server/lib/branding.js index 2103ded..6400bf0 100644 --- a/server/lib/branding.js +++ b/server/lib/branding.js @@ -50,4 +50,14 @@ function resolveBranding(db, { workspaceId = null, domain = null } = {}) { return platformDefaultRow(db) || { ...HARDCODED_BRANDING }; } -module.exports = { resolveBranding, platformDefaultRow, HARDCODED_BRANDING, PLATFORM_DEFAULT_ID }; +// Presentational fields only. The PUBLIC resolver (GET /api/branding) and the +// by-domain lookup must not leak internal columns (id, user_id, workspace_id, +// custom_domain, timestamps) to unauthenticated / cross-tenant callers. +const PUBLIC_BRANDING_FIELDS = ['brand_name', 'logo_url', 'favicon_url', 'primary_color', 'secondary_color', 'bg_color', 'custom_css', 'hide_branding']; +function publicBranding(row) { + const out = {}; + for (const f of PUBLIC_BRANDING_FIELDS) out[f] = row ? (row[f] ?? null) : null; + return out; +} + +module.exports = { resolveBranding, platformDefaultRow, publicBranding, HARDCODED_BRANDING, PLATFORM_DEFAULT_ID }; diff --git a/server/lib/device-sanitize.js b/server/lib/device-sanitize.js new file mode 100644 index 0000000..bf63cb4 --- /dev/null +++ b/server/lib/device-sanitize.js @@ -0,0 +1,14 @@ +'use strict'; + +// Security: never return a device's WebSocket auth secret to API/dashboard +// clients. `device_token` is the credential the device proves with (validated +// via crypto.timingSafeEqual on the /device socket); leaking it to any +// workspace user enables device impersonation. Strip it from every device row +// before it leaves the server. +function stripDeviceSecrets(d) { + if (!d || typeof d !== 'object') return d; + delete d.device_token; + return d; +} + +module.exports = { stripDeviceSecrets }; diff --git a/server/middleware/auth.js b/server/middleware/auth.js index 04e3334..5cdeb4a 100644 --- a/server/middleware/auth.js +++ b/server/middleware/auth.js @@ -53,6 +53,16 @@ function requireAuth(req, res, next) { req.user = user; // Tenancy middleware reads this on the resolver step. req.jwtWorkspaceId = decoded.current_workspace_id || null; + // #7: enforce the forced first-login password change SERVER-SIDE (was a + // frontend-only redirect, so a provisioned temp password worked indefinitely + // via the API). While the flag is set, allow only reading/updating one's own + // profile (the password change is PUT /api/auth/me, which clears the flag) + // and logout; block everything else. + if (user.must_change_password) { + const url = (req.originalUrl || '').split('?')[0].replace(/\/$/, ''); + const allowed = url === '/api/auth/me' || url === '/api/auth/logout'; + if (!allowed) return res.status(403).json({ error: 'password_change_required' }); + } next(); } catch (err) { return res.status(401).json({ error: 'Invalid or expired token' }); diff --git a/server/routes/devices.js b/server/routes/devices.js index b5dbe5a..67a62f4 100644 --- a/server/routes/devices.js +++ b/server/routes/devices.js @@ -5,6 +5,7 @@ const { PLATFORM_ROLES, ELEVATED_ROLES, isPlatformStaff } = require('../middlewa // Phase 2.2a: workspace-aware access. accessContext returns { workspaceRole, actingAs } // or null based on the caller's reach into a specific workspace. const { accessContext } = require('../lib/tenancy'); +const { stripDeviceSecrets } = require('../lib/device-sanitize'); // List devices in the caller's current workspace. // Phase 2.2a: filter by workspace_id instead of user_id. The caller's current @@ -39,7 +40,7 @@ router.get('/', (req, res) => { ORDER BY d.created_at ASC LIMIT ? OFFSET ? `).all(req.workspaceId, limit, offset); - res.json(devices); + res.json(devices.map(stripDeviceSecrets)); }); // List unclaimed provisioning devices (admin only). @@ -118,7 +119,7 @@ router.get('/:id', (req, res) => { 'SELECT reported_at FROM device_telemetry WHERE device_id = ? AND reported_at > ? ORDER BY reported_at ASC' ).all(req.params.id, dayAgo).map(r => r.reported_at); - res.json({ ...device, telemetry, screenshot, assignments, playlist_status, playlist_has_published, uptimeData, statusLog }); + res.json({ ...stripDeviceSecrets(device), telemetry, screenshot, assignments, playlist_status, playlist_has_published, uptimeData, statusLog }); }); // Helper: check device write access via the workspace the device belongs to. @@ -162,7 +163,7 @@ router.put('/:id', (req, res) => { } const updated = db.prepare('SELECT * FROM devices WHERE id = ?').get(req.params.id); - res.json(updated); + res.json(stripDeviceSecrets(updated)); }); // Delete device diff --git a/server/routes/provisioning.js b/server/routes/provisioning.js index d0f7f59..f3a441a 100644 --- a/server/routes/provisioning.js +++ b/server/routes/provisioning.js @@ -17,7 +17,7 @@ router.post('/', (req, res) => { `).run(device.id); const updated = db.prepare('SELECT * FROM devices WHERE id = ?').get(device.id); - res.json(updated); + res.json(require('../lib/device-sanitize').stripDeviceSecrets(updated)); }); module.exports = router; diff --git a/server/routes/white-label.js b/server/routes/white-label.js index f96dded..dac14a1 100644 --- a/server/routes/white-label.js +++ b/server/routes/white-label.js @@ -5,7 +5,7 @@ const { db } = require('../db/database'); // Phase 2.2f: workspace-scoped branding. POST gated by requireWorkspaceAdmin // per the design doc (branding is a workspace_admin power, not editor). const { requireWorkspaceAdmin } = require('../lib/permissions'); -const { resolveBranding } = require('../lib/branding'); +const { resolveBranding, publicBranding } = require('../lib/branding'); // Get the current workspace's effective branding. #15: when the workspace has no // row of its own, fall through to the platform default (workspace_id IS NULL) @@ -19,7 +19,7 @@ router.get('/', (req, res) => { // hardcoded. (Mounted behind requireAuth like the rest of this router; the // public/pre-login path is GET /api/branding, registered before auth.) router.get('/domain/:domain', (req, res) => { - res.json(resolveBranding(db, { domain: req.params.domain })); + res.json(publicBranding(resolveBranding(db, { domain: req.params.domain }))); }); // Create or update the current workspace's white-label config. Restricted to @@ -30,6 +30,17 @@ router.post('/', requireWorkspaceAdmin, (req, res) => { const { brand_name, logo_url, favicon_url, primary_color, secondary_color, bg_color, custom_domain, custom_css, hide_branding } = req.body; + // Security (#3): custom_domain drives the PUBLIC, pre-auth branding resolver + // (GET /api/branding) and custom_css is injected into the login page's