Fixes #139 #140

README.md

@@ -82,7 +82,7 @@ silverbullet <pages-path>
 
 By default, SB will bind to port `3000`, to use a different port use the
 `--port` flag. By default SB doesn’t offer any sort of authentication, to add
-basic password authentication, pass the `--password` flag.
+basic password authentication, pass the `--user` flag (e.g. `--user pete:1234`).
 
 Once downloaded and booted, SB will print out a URL to open SB in your browser
 (spoiler alert: by default this will be http://localhost:3000 ).

cmd/server.ts

@@ -21,7 +21,7 @@ export function serveCommand(options: any, folder: string) {
     pagesPath: pagesPath,
     dbPath: path.join(pagesPath, options.db),
     assetBundle: new AssetBundle(assetBundle as AssetJson),
-    password: options.password,
+    user: options.user,
   });
   httpServer.start().catch((e) => {
     console.error("HTTP Server error", e);

common/spaces/http_space_primitives.ts

@@ -10,22 +10,16 @@ import { mime } from "../../plugos/deps.ts";
 export class HttpSpacePrimitives implements SpacePrimitives {
   fsUrl: string;
   private plugUrl: string;
-  token?: string;
 
-  constructor(url: string, token?: string) {
+  constructor(url: string) {
     this.fsUrl = url + "/fs";
     this.plugUrl = url + "/plug";
-    this.token = token;
   }
 
   private async authenticatedFetch(
     url: string,
     options: any,
   ): Promise<Response> {
-    if (this.token) {
-      options.headers = options.headers || {};
-      options.headers["Authorization"] = `Bearer ${this.token}`;
-    }
     const result = await fetch(url, options);
     if (result.status === 401) {
       throw Error("Unauthorized");

server/http_server.ts

@@ -11,7 +11,8 @@ export type ServerOptions = {
   pagesPath: string;
   dbPath: string;
   assetBundle: AssetBundle;
-  password?: string;
+  user?: string;
+  pass?: string;
 };
 
 const staticLastModified = new Date().toUTCString();
@@ -20,14 +21,14 @@ export class HttpServer {
   app: Application;
   systemBoot: SpaceSystem;
   private port: number;
-  password?: string;
+  user?: string;
   settings: { [key: string]: any } = {};
   abortController?: AbortController;
 
   constructor(options: ServerOptions) {
     this.port = options.port;
     this.app = new Application(); //{ serverConstructor: FlashServer });
-    this.password = options.password;
+    this.user = options.user;
     this.systemBoot = new SpaceSystem(
       options.assetBundle,
       options.pagesPath,
@@ -63,6 +64,7 @@ export class HttpServer {
     await this.systemBoot.start();
     await this.systemBoot.ensureSpaceIndex();
     await this.ensureAndLoadSettings();
+
     // Serve static files (javascript, css, html)
     this.app.use(async ({ request, response }, next) => {
       if (request.url.pathname === "/") {
@@ -106,6 +108,8 @@ export class HttpServer {
       }
     });
 
+    this.addPasswordAuth(this.app);
+
     // Pages API
     const fsRouter = this.buildFsRouter(this.systemBoot.spacePrimitives);
     this.app.use(fsRouter.routes());
@@ -163,15 +167,20 @@ export class HttpServer {
     }
   }
 
-  private addPasswordAuth(r: Router) {
+  private addPasswordAuth(app: Application) {
-    if (this.password) {
+    if (this.user) {
-      r.use(async ({ request, response }, next) => {
+      app.use(async ({ request, response }, next) => {
         if (
-          request.headers.get("Authorization") === `Bearer ${this.password}`
+          request.headers.get("Authorization") ===
+            `Basic ${btoa(this.user!)}`
         ) {
           await next();
         } else {
           response.status = 401;
+          response.headers.set(
+            "WWW-Authenticate",
+            `Basic realm="Please enter your username and password"`,
+          );
           response.body = "Unauthorized";
         }
       });
@@ -180,7 +189,6 @@ export class HttpServer {
 
   private buildFsRouter(spacePrimitives: SpacePrimitives): Router {
     const fsRouter = new Router();
-    this.addPasswordAuth(fsRouter);
     // File list
     fsRouter.get("/", async ({ response }) => {
       response.headers.set("Content-type", "application/json");
@@ -276,7 +284,7 @@ export class HttpServer {
 
   private buildPlugRouter(): Router {
     const plugRouter = new Router();
-    this.addPasswordAuth(plugRouter);
+    // this.addPasswordAuth(plugRouter);
     const system = this.systemBoot.system;
 
     plugRouter.post(

silverbullet.ts

@@ -23,7 +23,10 @@ await new Command()
   .option("--db <dbfile:string>", "Filename for the database", {
     default: "data.db",
   })
-  .option("--password <password:string>", "Password for basic authentication")
+  .option(
+    "--user <user:string>",
+    "'username:password' combo for BasicAuth authentication",
+  )
   .action(serveCommand)
   // fix
   .command("fix", "Fix a broken space")

web/boot.ts

@@ -8,28 +8,14 @@ import { SilverBulletHooks } from "../common/manifest.ts";
 import { System } from "../plugos/system.ts";
 
 safeRun(async () => {
-  let password: string | undefined = localStorage.getItem("password") ||
+  const httpPrimitives = new HttpSpacePrimitives("");
-    undefined;
-
-  let httpPrimitives = new HttpSpacePrimitives("", password);
   let settingsPageText = "";
-  while (true) {
+  try {
-    try {
+    settingsPageText = (
-      settingsPageText = (
+      await httpPrimitives.readFile("SETTINGS.md", "string")
-        await httpPrimitives.readFile("SETTINGS.md", "string")
+    ).data as string;
-      ).data as string;
+  } catch (e: any) {
-      break;
+    console.error("No settings page found", e.message);
-    } catch (e: any) {
-      if (e.message === "Unauthorized") {
-        password = prompt("Password: ") || undefined;
-        if (!password) {
-          alert("Sorry, need a password");
-          return;
-        }
-        localStorage.setItem("password", password!);
-        httpPrimitives = new HttpSpacePrimitives("", password);
-      }
-    }
   }
 
   // Instantiate a PlugOS system for the client

website/CHANGELOG.md

@@ -3,6 +3,12 @@ release.
 
 ---
 
+## Next
+
+* Replaced the `--password` flag with `--user` taking a basic auth combination of username and password, e.g. `--user pete:1234`. Authentication now uses standard basic auth. This should fix attachments not working with password protected setups.
+
+---
+
 ## 0.2.2
 
 * New page link aliasing syntax (Obsidian compatible) is here: `[[page link|alias]]` e.g. [[CHANGELOG|this is a link to this changelog]]. Also supported for command links: `{[Plugs: Add|add a plug]}`

website/Silver Bullet.md

@@ -103,7 +103,7 @@ To run Silver Bullet, create a folder for your pages (it can be empty, or be an
 silverbullet <pages-path>
 ```
 
-By default, Silver Bullet will bind to port `3000`, to use a different port use the the `--port` flag. By default Silver Bullet is unauthenticated, to password-protect it, specify a password with the `--password` flag.
+By default, Silver Bullet will bind to port `3000`, to use a different port use the the `--port` flag. By default Silver Bullet is unauthenticated, to password-protect it, specify a username and password with the `--user` flag (e.g. `--user pete:1234`).
 
 Once downloaded and booted, Silver Bullet will print out a URL to open SB in your browser (by default this will be http://localhost:3000 ).