Replaces synchronous `fs.readFileSync` with `fs.promises.readFile` in `loadTorchConfig` to prevent event loop blocking.
Updates all dependent configuration getters and consumers to use async/await.
Includes benchmark proving non-blocking behavior.
Fixes dashboard tests to properly await server listening.
Co-authored-by: PR0M3TH3AN <[email protected]>
The dashboard previously served the raw `torch-config.json` file, potentially exposing sensitive information like authentication credentials.
This commit modifies the `/torch-config.json` endpoint to:
1. Parse the configuration file.
2. Sanitize the output by removing the `dashboard.auth` field and any unknown fields (using `parseTorchConfig`).
3. Support `TORCH_CONFIG_PATH` environment variable for configuration file location, improving testability and consistency with other components.
Verified with new test `test/dashboard-config-security.test.mjs` and existing auth tests.
Co-authored-by: PR0M3TH3AN <[email protected]>
This patch addresses a security vulnerability where the dashboard server could serve any file from the package root.
Changes:
- Implemented an allowlist in `src/dashboard.mjs` to restrict file access to:
- `dashboard/`
- `assets/`
- `src/docs/`
- `torch-config.json`
- Added `test/dashboard-security.test.mjs` to verify the fix and prevent regressions.
The fix ensures that sensitive files like `package.json` or source code cannot be accessed via the dashboard server.
Co-authored-by: PR0M3TH3AN <[email protected]>
This commit addresses the missing authentication vulnerability in the
dashboard server.
Changes:
- Added Basic Authentication support via TORCH_DASHBOARD_AUTH env var
or dashboard.auth config field.
- Defaulted dashboard host binding to 127.0.0.1 for better security.
- Added --host CLI argument to allow overriding the bind address.
- Used crypto.timingSafeEqual for secure credential comparison.
- Fixed a potential crash when parsing malformed Authorization headers.
- Added comprehensive unit tests for dashboard authentication.
- Updated documentation in README.md and torch-config.example.json.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Fix multiple syntax errors in `src/lib.mjs` (redundant declarations, broken loops, missing imports).
- Fix syntax error in `src/dashboard.mjs` (invalid catch block).
- Remove redundant local function definitions in `src/lib.mjs` in favor of imports from `src/torch-config.mjs` and `src/utils.mjs`.
- Update `landing/index.html` installation command to include `npx torch-lock init` step.
- Verify `torch-lock init` works correctly.
- Ensure all tests pass and linting is clean for `src/lib.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
