diff --git a/frontend/js/views/kiosk.js b/frontend/js/views/kiosk.js index 6463c99..6b6c684 100644 --- a/frontend/js/views/kiosk.js +++ b/frontend/js/views/kiosk.js @@ -1,5 +1,6 @@ import { showToast } from '../components/toast.js'; import { t } from '../i18n.js'; +import { esc } from '../utils.js'; const API = (url, opts = {}) => fetch('/api' + url, { headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${localStorage.getItem('token')}`, ...opts.headers }, ...opts }).then(r => r.json()); @@ -44,12 +45,12 @@ async function renderList(container) { 🖱
-
${p.name}
+
${esc(p.name)}
${t('kiosk.label')}
${t('kiosk.preview')} - +
`).join(''); @@ -85,7 +86,7 @@ async function renderEditor(container, pageId) { ${t('kiosk.back')}
-

${page.name}

+

${esc(page.name)}

${t('kiosk.preview')} @@ -98,17 +99,17 @@ async function renderEditor(container, pageId) {

${t('kiosk.page_settings')}

-
-
-
-
-
+
+
+
+
+

${t('kiosk.style')}

-
+
- + +
- +
- +
`).join('') || `

${t('kiosk.no_buttons')}

`; diff --git a/frontend/js/views/layout-editor.js b/frontend/js/views/layout-editor.js index e216529..01d0de0 100644 --- a/frontend/js/views/layout-editor.js +++ b/frontend/js/views/layout-editor.js @@ -1,6 +1,7 @@ import { api } from '../api.js'; import { showToast } from '../components/toast.js'; import { t, tn } from '../i18n.js'; +import { esc } from '../utils.js'; const API = (url, opts = {}) => fetch('/api' + url, { headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${localStorage.getItem('token')}`, ...opts.headers }, ...opts }).then(r => r.json()); @@ -84,12 +85,12 @@ function renderLayoutCard(layout, isTemplate) { ${(layout.zones || []).map(z => `
${z.name}
+ font-size:9px;color:var(--text-muted);overflow:hidden">${esc(z.name)}
`).join('')}
-
${layout.name}
+
${esc(layout.name)}
${zonesText}${isTemplate ? ' • ' + t('layout.template_label') : ''}
@@ -97,7 +98,7 @@ function renderLayoutCard(layout, isTemplate) { ? `` : `` } - +
`; @@ -115,7 +116,7 @@ async function renderEditor(container, layoutId) { ${t('layout.back')}
-

${layout.name}

+

${esc(layout.name)}

@@ -228,8 +229,8 @@ async function renderEditor(container, layoutId) {
-
${z.name}
-
${Math.round(z.width_percent)}% x ${Math.round(z.height_percent)}% • ${z.zone_type}
+
${esc(z.name)}
+
${Math.round(z.width_percent)}% x ${Math.round(z.height_percent)}% • ${esc(z.zone_type)}
`).join(''); diff --git a/frontend/js/views/teams.js b/frontend/js/views/teams.js index 5240ac1..4c1901e 100644 --- a/frontend/js/views/teams.js +++ b/frontend/js/views/teams.js @@ -1,6 +1,7 @@ import { api } from '../api.js'; import { showToast } from '../components/toast.js'; import { t, tn } from '../i18n.js'; +import { esc } from '../utils.js'; const API = (url, opts = {}) => fetch('/api' + url, { headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${localStorage.getItem('token')}`, ...opts.headers }, ...opts }).then(r => r.json()); @@ -46,9 +47,9 @@ async function renderList(container) {
-
${team.name[0].toUpperCase()}
+
${esc(team.name[0].toUpperCase())}
-
${team.name}
+
${esc(team.name)}
${t('team.your_role', { role: team.my_role })} · ${tn('team.member_count', team.member_count)}
@@ -77,7 +78,7 @@ async function renderTeamDetail(container, teamId) { ${t('team.back')}
-

${team.name}

+

${esc(team.name)}

@@ -92,10 +93,10 @@ async function renderTeamDetail(container, teamId) {
${(team.members || []).map(m => `
-
${(m.user_name || m.email)[0].toUpperCase()}
+
${esc((m.user_name || m.email)[0].toUpperCase())}
-
${m.user_name || m.email}
-
${m.email}
+
${esc(m.user_name || m.email)}
+
${esc(m.email)}
- ${unassignedDevices.map(d => ``).join('')} + ${unassignedDevices.map(d => ``).join('')}
@@ -121,8 +122,8 @@ async function renderTeamDetail(container, teamId) {
-
${d.name}
-
${d.status}
+
${esc(d.name)}
+
${esc(d.status)}
diff --git a/server/lib/branding.js b/server/lib/branding.js index 2103ded..6400bf0 100644 --- a/server/lib/branding.js +++ b/server/lib/branding.js @@ -50,4 +50,14 @@ function resolveBranding(db, { workspaceId = null, domain = null } = {}) { return platformDefaultRow(db) || { ...HARDCODED_BRANDING }; } -module.exports = { resolveBranding, platformDefaultRow, HARDCODED_BRANDING, PLATFORM_DEFAULT_ID }; +// Presentational fields only. The PUBLIC resolver (GET /api/branding) and the +// by-domain lookup must not leak internal columns (id, user_id, workspace_id, +// custom_domain, timestamps) to unauthenticated / cross-tenant callers. +const PUBLIC_BRANDING_FIELDS = ['brand_name', 'logo_url', 'favicon_url', 'primary_color', 'secondary_color', 'bg_color', 'custom_css', 'hide_branding']; +function publicBranding(row) { + const out = {}; + for (const f of PUBLIC_BRANDING_FIELDS) out[f] = row ? (row[f] ?? null) : null; + return out; +} + +module.exports = { resolveBranding, platformDefaultRow, publicBranding, HARDCODED_BRANDING, PLATFORM_DEFAULT_ID }; diff --git a/server/lib/device-sanitize.js b/server/lib/device-sanitize.js new file mode 100644 index 0000000..bf63cb4 --- /dev/null +++ b/server/lib/device-sanitize.js @@ -0,0 +1,14 @@ +'use strict'; + +// Security: never return a device's WebSocket auth secret to API/dashboard +// clients. `device_token` is the credential the device proves with (validated +// via crypto.timingSafeEqual on the /device socket); leaking it to any +// workspace user enables device impersonation. Strip it from every device row +// before it leaves the server. +function stripDeviceSecrets(d) { + if (!d || typeof d !== 'object') return d; + delete d.device_token; + return d; +} + +module.exports = { stripDeviceSecrets }; diff --git a/server/middleware/auth.js b/server/middleware/auth.js index 04e3334..5cdeb4a 100644 --- a/server/middleware/auth.js +++ b/server/middleware/auth.js @@ -53,6 +53,16 @@ function requireAuth(req, res, next) { req.user = user; // Tenancy middleware reads this on the resolver step. req.jwtWorkspaceId = decoded.current_workspace_id || null; + // #7: enforce the forced first-login password change SERVER-SIDE (was a + // frontend-only redirect, so a provisioned temp password worked indefinitely + // via the API). While the flag is set, allow only reading/updating one's own + // profile (the password change is PUT /api/auth/me, which clears the flag) + // and logout; block everything else. + if (user.must_change_password) { + const url = (req.originalUrl || '').split('?')[0].replace(/\/$/, ''); + const allowed = url === '/api/auth/me' || url === '/api/auth/logout'; + if (!allowed) return res.status(403).json({ error: 'password_change_required' }); + } next(); } catch (err) { return res.status(401).json({ error: 'Invalid or expired token' }); diff --git a/server/routes/devices.js b/server/routes/devices.js index b5dbe5a..67a62f4 100644 --- a/server/routes/devices.js +++ b/server/routes/devices.js @@ -5,6 +5,7 @@ const { PLATFORM_ROLES, ELEVATED_ROLES, isPlatformStaff } = require('../middlewa // Phase 2.2a: workspace-aware access. accessContext returns { workspaceRole, actingAs } // or null based on the caller's reach into a specific workspace. const { accessContext } = require('../lib/tenancy'); +const { stripDeviceSecrets } = require('../lib/device-sanitize'); // List devices in the caller's current workspace. // Phase 2.2a: filter by workspace_id instead of user_id. The caller's current @@ -39,7 +40,7 @@ router.get('/', (req, res) => { ORDER BY d.created_at ASC LIMIT ? OFFSET ? `).all(req.workspaceId, limit, offset); - res.json(devices); + res.json(devices.map(stripDeviceSecrets)); }); // List unclaimed provisioning devices (admin only). @@ -118,7 +119,7 @@ router.get('/:id', (req, res) => { 'SELECT reported_at FROM device_telemetry WHERE device_id = ? AND reported_at > ? ORDER BY reported_at ASC' ).all(req.params.id, dayAgo).map(r => r.reported_at); - res.json({ ...device, telemetry, screenshot, assignments, playlist_status, playlist_has_published, uptimeData, statusLog }); + res.json({ ...stripDeviceSecrets(device), telemetry, screenshot, assignments, playlist_status, playlist_has_published, uptimeData, statusLog }); }); // Helper: check device write access via the workspace the device belongs to. @@ -162,7 +163,7 @@ router.put('/:id', (req, res) => { } const updated = db.prepare('SELECT * FROM devices WHERE id = ?').get(req.params.id); - res.json(updated); + res.json(stripDeviceSecrets(updated)); }); // Delete device diff --git a/server/routes/provisioning.js b/server/routes/provisioning.js index d0f7f59..f3a441a 100644 --- a/server/routes/provisioning.js +++ b/server/routes/provisioning.js @@ -17,7 +17,7 @@ router.post('/', (req, res) => { `).run(device.id); const updated = db.prepare('SELECT * FROM devices WHERE id = ?').get(device.id); - res.json(updated); + res.json(require('../lib/device-sanitize').stripDeviceSecrets(updated)); }); module.exports = router; diff --git a/server/routes/white-label.js b/server/routes/white-label.js index f96dded..dac14a1 100644 --- a/server/routes/white-label.js +++ b/server/routes/white-label.js @@ -5,7 +5,7 @@ const { db } = require('../db/database'); // Phase 2.2f: workspace-scoped branding. POST gated by requireWorkspaceAdmin // per the design doc (branding is a workspace_admin power, not editor). const { requireWorkspaceAdmin } = require('../lib/permissions'); -const { resolveBranding } = require('../lib/branding'); +const { resolveBranding, publicBranding } = require('../lib/branding'); // Get the current workspace's effective branding. #15: when the workspace has no // row of its own, fall through to the platform default (workspace_id IS NULL) @@ -19,7 +19,7 @@ router.get('/', (req, res) => { // hardcoded. (Mounted behind requireAuth like the rest of this router; the // public/pre-login path is GET /api/branding, registered before auth.) router.get('/domain/:domain', (req, res) => { - res.json(resolveBranding(db, { domain: req.params.domain })); + res.json(publicBranding(resolveBranding(db, { domain: req.params.domain }))); }); // Create or update the current workspace's white-label config. Restricted to @@ -30,6 +30,17 @@ router.post('/', requireWorkspaceAdmin, (req, res) => { const { brand_name, logo_url, favicon_url, primary_color, secondary_color, bg_color, custom_domain, custom_css, hide_branding } = req.body; + // Security (#3): custom_domain drives the PUBLIC, pre-auth branding resolver + // (GET /api/branding) and custom_css is injected into the login page's