feat(mobile): Connect Mobile: password-authenticated LAN bridge#2533
Open
Prasad-D-Ware wants to merge 23 commits into
Open
feat(mobile): Connect Mobile: password-authenticated LAN bridge#2533Prasad-D-Ware wants to merge 23 commits into
Prasad-D-Ware wants to merge 23 commits into
Conversation
…ope loopback rule (cherry picked from commit 0d3642ec4806faf6d24bbddb00220819d362723b)
(cherry picked from commit f2617934cac9f2d681e522c92a380fcc60e8a90b)
(cherry picked from commit e030474bceff8322cf2a7e814e0a560db1cd8c54)
(cherry picked from commit 461d3c22be4441e6405286979f3e7b371cb171ae)
(cherry picked from commit 47e7d9770511c863ad5bd724386e8ab774661700)
(cherry picked from commit a10fd4b6e460f234107a89c4d0fad92932b40bf0)
(cherry picked from commit c0bb792f040344a5597fd3190ff035c51a988edf)
(cherry picked from commit 376b5f1b9041392feb03bff65f8ec85353b9f076)
(cherry picked from commit 1a65adbf058db1606d9f8df4c3c794387e08e7dc)
(cherry picked from commit a2c051bcff9d1ccf19f1e39d84900d2e69a957aa)
(cherry picked from commit 27e690005362a34af9c1d5c41313a4076749bdcd)
(cherry picked from commit 33df1d0fb86a114ce849eb8bdd2e1d672933d445)
(cherry picked from commit b4322a4d2397f07977b8f54fae4fb8a14f949297)
(cherry picked from commit 42d8624efc368eec10e2c7dfed2819a69c318956)
… LAN listener (cherry picked from commit 03fd7ac3fdf86566838b5d19d138e58988c88d6d)
(cherry picked from commit 0d721a6a4fd448547441631363955aa397f4186d)
The mobile control routes were gated by localControlRequest, which rejects any request carrying an Origin header. The desktop renderer is a browser context and always sends an Origin, so every enable/disable/status call from the desktop got a 403. Drop that gate: the loopback listener protects these routes via CORS like every other API route, and the phone is already blocked from them on the LAN listener by lanControlBlock (a transport-based 404 that cannot be spoofed). (cherry picked from commit 0fbddfecd7bd4b89599d941014f29b83e83cdf13)
State stored only the password hash, so GET /mobile/status returned an empty password and the desktop modal could not display it. Persist the 8-char password in plaintext in ~/.ao/mobile/config.json (0600) and return it from status while the bridge is enabled; derive the auth hash in memory (HashPassword). Restore on boot re-derives the hash from the persisted plaintext, so a paired phone keeps working across restarts with no rotation. (cherry picked from commit 1ff0c35059f2cb4503407507e3af20f714a0f580)
…xpires Previously the fail counter was only cleared on a successful auth, so after the 60s cooldown the very next failure re-locked immediately for another full minute — and a client that keeps polling with a bad password would stay locked out forever. Clear the counter (and prune the entry) once the cooldown elapses, so each source gets a fresh 5-attempt window. (cherry picked from commit eeb7bd30a7ff42e00037a1232a8a424d231e000a)
…e modal Connect Mobile is now its own item in the sidebar Settings dropdown (its own section above Project/Global settings, in both expanded and collapsed menus) instead of a card on the Global Settings page. The modal is redesigned around a single 'Enable mobile' toggle: flipping it on starts the bridge and reveals the pairing details (QR, address, password + copy, warning, regenerate) below the toggle row; off tears it down. The QR now encodes the password too, so one scan connects with no typing. Adds a shadcn Switch primitive; removes the old ConnectMobileButton card. (cherry picked from commit 36c617d18573efbf8ba3454ee8bd2e3a965e28ed)
- Parse the password from the pairing QR and, on scan, save host/port/password and reconnect — one scan connects with no typing. - 'Save' now behaves like connect: it prompts for the password when empty and reports the result, so it can no longer persist a passwordless config silently. - Reload the server config on screen focus so returning from the scanner repaints the fields. - Stop the background poller on an auth failure (401/429) instead of hammering — a bad password otherwise kept the daemon's lockout armed forever. - Clear a stale error banner once the connection goes live. (cherry picked from commit 7cf5db29bd23c4fa9af9c1b3a68dbac399c5f10d)
…o frontend/src/api)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an opt-in LAN bridge so the mobile app can reach the daemon over the local network.
A second, on-demand HTTP listener runs inside the daemon (loopback listener unchanged);
it serves the app API behind a bearer-password auth middleware with a per-source lockout, and 404-blocks the loopback-only control routes.
Desktop gets a Connect Mobile toggle in the Settings menu (QR + password); mobile scans to connect.
instructions while running :
when running the mobile server run : npx expo run:ios --device
and also have a physical device attached via cord for installing the dev client. as we have a native camera dependency for scan so expo go does not work for that feature.