fix(devtools): require dev auth token for openInEditor and options RPC methods - #1039
Merged
Conversation
…C methods Gate the openInEditor, updateOptions and clearOptions RPC methods on the dev auth token, consistent with the rest of the mutating RPC surface (restartNuxt, storage writes, npm, terminals, ...). Update the client callers to pass the token, keep the passive UI-options watcher silent when unauthenticated, and add a focused unit test for the token checks.
Deploying nuxt-devtools with
|
| Latest commit: |
8b84b29
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://e49e8691.nuxt-devtools.pages.dev |
| Branch Preview URL: | https://fix-devtools-rpc-auth.nuxt-devtools.pages.dev |
The build task had no dependsOn, so with caching cold turbo could build @nuxt/devtools before its workspace dependency @nuxt/devtools-kit was built, intermittently failing with MODULE_NOT_FOUND. Add "^build" so dependencies are built first.
nuxt.options and the ServerFunctions return type resolve to two different NuxtOptions copies (@nuxt/schema vs nuxt/schema) that diverge on the unocss augmentation, breaking vue-tsc. Cast to the declared return type, matching the equivalent fix already on main.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A few mutating server RPC methods were not gated on the dev auth token, unlike the rest of the RPC surface. This aligns them with the existing convention so that every method that runs a command or writes to disk goes through
ensureDevAuthToken.Methods now token-gated:
openInEditor— opens a file in the user's editorupdateOptions— persists DevTools options to diskclearOptions— resets persisted DevTools optionsThis matches how
restartNuxt, storage writes, npm actions, terminals, etc. already work.Changes
openInEditor,updateOptions,clearOptionsnow take atokenfirst argument and callensureDevAuthToken(token)before doing any work.getOptions(read-only) is unchanged.ServerFunctionssignatures in@nuxt/devtools-kit.ensureDevAuthToken(). The passive UI-options watcher only persists when the session is already authenticated (it never triggers an auth prompt from background writes), while the Settings page ensures auth on the first deliberate edit so changes still persist.test:unitwiring.Notes
localStorageand silently re-verified, so this is effectively a one-time prompt per browser.disableAuthorization(e.g. sandboxed environments) continues to bypass the check as before.This PR was created with the help of an agent.