Skip to content

v0.1.1

Choose a tag to compare

View all tags
@danilopatrial danilopatrial released this 07 Jun 12:13
· 39 commits to main since this release
v0.1.1
7ab536e

Sooket v0.1.1 — Optional auth for the management surface.

What's new

  • Shared-secret auth gate (opt-in): set SOOKET_AUTH_TOKEN to require a secret on the management API + dashboard. Programmatic callers send Authorization: Bearer <token>; the browser unlocks once at /unlock. Enforced centrally in proxy.ts; all token checks are constant-time. Public routes (/api/v1/*, /api/webhooks/*, /api/health, /unlock) stay open, and the management-key-gated admin backup is exempt. Unset = open (the historical default).
  • Exposure warning (always on): a loud startup banner now fires when the server binds to a non-loopback host without SOOKET_AUTH_TOKEN, in both the Next.js and execution-server processes.
  • CI now runs on pushes to dev as well as main.

Still no per-user accounts — this is a single shared secret for self-hosted exposure, not a multi-user auth system. Loopback bind remains the default security model.

License: source-available under FSL-1.1-MIT (converts to MIT two years after release).

Assets 2
Loading