fix: keep Alta bearer out of proxy command lines

2026-08-19 22:26:47 +00:00
parent 582fc46914
commit 808698dc46
15 changed files with 207 additions and 101 deletions
@@ -8,7 +8,7 @@ APT is a Windows Electron desktop app that imports an existing Alta Video sessio
 - The renderer receives only connection origin/state, device/site/auth responses, and owned proxy metadata. It never receives or supplies the Alta session value.
 - The bridge listens only on `127.0.0.1:18247`, accepts only the committed extension origin, requires the `X-APT-Pairing` secret, limits concurrent/body/deadline work, and validates an exact canonical Alta HTTPS origin.
 - The pairing envelope is a scrypt hash stored atomically under Electron `userData` with restrictive permissions. The plaintext secret is shown once on first run or rotation. Revoke invalidates it.
- Proxy launch is a direct `spawn` of the fixed helper with `shell: false`; stop actions can target only children owned by this app.
+- Proxy launch is a direct, detached `spawn` of the fixed helper with `shell: false`. Its exact arguments are deployment host, non-secret Alta username/email, and selected device UUID; no session bearer, password, or 2FA value reaches the command line. Stop actions can target only children owned by this app.
 - Updates are **check-only**. APT checks the exact GitPeji release API and can open only `https://git.pejicorp.com/peji/Alta-Proxy-Tool/releases` in the system browser. It never downloads, replaces, or executes an update.

 ## Requirements
@@ -30,7 +30,8 @@ npm start
 2. Start APT. Under **Bridge Pairing**, copy the one-time secret.
 3. Open the extension pairing settings, paste the secret, and save it.
 4. Visit your Alta deployment in Chrome and use **Send to APT**.
-5. Select a local camera and choose **Start Proxy**.
+5. Select a local camera, enter your Alta username/email, and choose **Start Proxy**.
+6. Complete the password and 2FA prompts in the helper's visible Windows console. APT does not collect or pass those secrets.

 Use **Generate / Rotate** if a pairing may have been exposed, then update the extension. Use **Revoke** to immediately disable bridge authentication.