From 90d76a797f075b91f0a8d94b1cc33eff6ed455fe Mon Sep 17 00:00:00 2001 From: vitya Date: Fri, 28 Aug 2026 00:52:52 +0300 Subject: [PATCH] =?UTF-8?q?sched:=20UI=20morda=20(/)=20=D0=BE=D1=82=D0=BA?= =?UTF-8?q?=D1=80=D1=8B=D1=82=20=E2=80=94=20=D1=81=D1=82=D0=B0=D1=82=D0=B8?= =?UTF-8?q?=D1=87=D0=BD=D0=B0=D1=8F=20=D1=84=D0=BE=D1=80=D0=BC=D0=B0=20?= =?UTF-8?q?=D0=B2=D1=85=D0=BE=D0=B4=D0=B0=20=D0=B1=D0=B5=D0=B7=20=D0=B4?= =?UTF-8?q?=D0=B0=D0=BD=D0=BD=D1=8B=D1=85;=20data=20plane=20(/api/*=20?= =?UTF-8?q?=D0=BA=D1=80=D0=BE=D0=BC=D0=B5=20health,=20/mcp)=20=D0=B7=D0=B0?= =?UTF-8?q?=20Bearer.=20=D0=A4=D0=B8=D0=BA=D1=81=20UI-tor=D1=87it.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- host-stacks/vds-kzntsv/sched-custom/custom-entry.mjs | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/host-stacks/vds-kzntsv/sched-custom/custom-entry.mjs b/host-stacks/vds-kzntsv/sched-custom/custom-entry.mjs index 779dcda..130be4d 100644 --- a/host-stacks/vds-kzntsv/sched-custom/custom-entry.mjs +++ b/host-stacks/vds-kzntsv/sched-custom/custom-entry.mjs @@ -51,12 +51,13 @@ const mcpHandler = createMcpHttpHandler({ client: mcpClient, readonly: process.e let uiBundle = null; try { uiBundle = readFileSync(DEFAULT_UI_BUNDLE); } catch { /* bundle missing → morda 404s its script */ } -// One HTTP server, auth at the boundary: everything EXCEPT /api/health (probe, open) and -// /sched-ui.bundle.js (static UI assets) requires `Authorization: Bearer SCHED_ADMIN_KEY`. -// This closes the MCP + admin API + morda exposed WITHOUT a token (vitya found /mcp open). -const AUTH_OPEN_PATHS = ['/api/health']; +// One HTTP server, auth at the boundary. OPEN (no token): /api/health (probe) + the UI itself +// (/ and /sched-ui.bundle.js — static login page/JS bundle, ZERO data; data comes from /api/*). +// AUTH required (Bearer SCHED_ADMIN_KEY): /api/* (except health) and /mcp — the actual data plane. +// This is the vitya correction: morda stays reachable (it's just the login form), data plane is locked. +const AUTH_OPEN_PATHS = ['/api/health', '/sched-ui.bundle.js']; function isOpenPath(p) { - return AUTH_OPEN_PATHS.includes(p) || p === '/sched-ui.bundle.js'; + return AUTH_OPEN_PATHS.includes(p) || p === '/'; // UI root = static login page, no data } function isAuthorized(req) { if (!ADMIN_KEY) return true; // dev mode, open