legop3/MultiRoombaRover
1
0
Fork 0
mirror of https://github.com/legop3/MultiRoombaRover.git synced 2026-09-16 09:31:20 -04:00
Code Issues Actions Packages Projects Releases Wiki Activity

private rover security! and styling updaes

Browse Source
This commit is contained in:
legop3
2026-07-06 15:26:43 -04:00
parent f9f87c00d3
commit 07ad43f42f
9 changed files with 45 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/public/assets/index-CjRD7Org.css
-1
View File
File diff suppressed because one or more lines are too long
server/public/assets/index-LIjDMlbF.css
+1
View File
File diff suppressed because one or more lines are too long
server/public/assets/index-qmfprxrq.js → server/public/assets/index-_MGdcdqA.js
+2 -2
View File
File diff suppressed because one or more lines are too long
server/public/assets/index-_MGdcdqA.js.map
+1
View File
File diff suppressed because one or more lines are too long
server/public/assets/index-qmfprxrq.js.map
-1
View File
File diff suppressed because one or more lines are too long
server/public/index.html
+2 -2
View File
@@ -78,8 +78,8 @@
<script defer src="https://analytics.otter.land/script.js" data-website-id="82dd56a5-db44-4279-bd1e-a4d9fee39af7" data-domains="rover.otter.land"></script>
<script defer src="https://analytics.otter.land/recorder.js" data-website-id="82dd56a5-db44-4279-bd1e-a4d9fee39af7" data-domains="rover.otter.land" data-sample-rate="0.15" data-mask-level="moderate" data-max-duration="300000"></script>
<title>Roomba Rover</title>
<script type="module" crossorigin src="/assets/index-qmfprxrq.js"></script>
<link rel="stylesheet" crossorigin href="/assets/index-CjRD7Org.css">
<script type="module" crossorigin src="/assets/index-_MGdcdqA.js"></script>
<link rel="stylesheet" crossorigin href="/assets/index-LIjDMlbF.css">
</head>
<body>
<div id="root"></div>
server/src/services/interInstanceService/index.js
+26 -1
View File
@@ -137,11 +137,26 @@ function buildRoomCameraInfo(camera) {
};
}
function isClosedPrivateRover(rover) {
return Boolean(rover?.private?.enabled && !rover?.private?.open);
}
function getPublicRoster() {
return roverManager
.getRoster()
/*
Closed private rovers are intentionally absent from the public
inter-instance contract. If a rover is private and closed, other servers
should not see its row or receive any derived snapshot URL for it.
*/
.filter((rover) => !isClosedPrivateRover(rover));
}
function buildLocalInfo() {
const mode = getMode();
const lockdown = isLockdownMode();
const features = getFeatureFlags();
const roster = roverManager.getRoster().map((rover) => (lockdown ? rover : addRoverSnapshotLinks(rover)));
const roster = getPublicRoster().map((rover) => (lockdown ? rover : addRoverSnapshotLinks(rover)));
const roomCameras = lockdown || !features.roomCameras ? [] : getRoomCameras().map(buildRoomCameraInfo);
return {
instance: {
@@ -184,6 +199,16 @@ app.get('/api/inter-instance/rover-snapshots/:roverId/latest', (req, res) => {
return;
}
const roverId = String(req.params.roverId || '');
const publicRover = getPublicRoster().find((rover) => String(rover.id) === roverId);
if (!publicRover) {
/*
Do not rely on "not advertising the URL" as the privacy boundary. Public
snapshot hosting must also reject direct requests for closed-private or
unknown rovers because old URLs, logs, or guesses can outlive roster state.
*/
res.status(404).json({ error: 'Rover snapshot unavailable' });
return;
}
sendJpegState(res, getRoverSnapshotState(roverId), 'Rover snapshot unavailable');
});