Release v2.82.0 - Secure Project URLs

Fotios Tsakiridis · claude · Fotios Tsakiridis · commit edc8412f398c · 2026-01-23T16:08:22.000Z
- Add session-based authentication for project preview URLs
- Each project gets unique secure key for URL access
- Session cookies scoped per-project (7-day expiry)
- Changing key immediately invalidates all existing sessions
- Localhost bypass for Playwright automation
- Auto-upgrade nginx config from Basic Auth to session auth
- Migration generates secure keys for existing projects

Co-Authored-By: Claude Opus 4.5 &lt;noreply@anthropic.com&gt;
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,29 @@ All notable changes to CodeHero will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.82.0] - 2026-01-23
+
+### Added
+- **Secure Project URLs** - Client preview URLs now require authentication
+  - Each project gets a unique secure key for URL access
+  - Session cookies scoped per-project (7-day expiry)
+  - Clients can only access their assigned project, not others
+  - Changing the key immediately invalidates all existing sessions
+  - Localhost (127.0.0.1) bypasses auth for Playwright automation
+
+### Improved
+- **Project Detail UI** - New "Client URL" section
+  - One-click copy of secure URL with key
+  - "New Key" button to regenerate and revoke old access
+  - Clear explanation that each project has isolated access
+
+### Changed
+- Replaced HTTP Basic Auth with session-based authentication
+- Nginx config updated for auth_request validation
+- Migration auto-generates secure keys for existing projects
+
+---
+
 ## [2.81.0] - 2026-01-23
 
 ### Added
diff --git a/INSTALL.md b/INSTALL.md
@@ -12,7 +12,7 @@
 
 ```bash
 cd /root
-unzip codehero-2.81.0.zip
+unzip codehero-2.82.0.zip
 cd codehero
 ```
 
@@ -129,8 +129,8 @@ sudo systemctl restart codehero-web codehero-daemon
 ```bash
 # Download and extract new version
 cd /root
-wget https://github.com/fotsakir/codehero/releases/latest/download/codehero-2.81.0.zip
-unzip codehero-2.81.0.zip
+wget https://github.com/fotsakir/codehero/releases/latest/download/codehero-2.82.0.zip
+unzip codehero-2.82.0.zip
 cd codehero
 
 # Preview what will change (recommended)
diff --git a/README.md b/README.md
@@ -11,7 +11,7 @@
 
 <p align="center">
   <a href="LICENSE"><img src="https://img.shields.io/badge/License-Dual-blue.svg" alt="License"></a>
-  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/version-2.81.0-green.svg" alt="Version"></a>
+  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/version-2.82.0-green.svg" alt="Version"></a>
   <img src="https://img.shields.io/badge/Ubuntu-22.04%20|%2024.04-orange.svg" alt="Ubuntu">
   <a href="https://anthropic.com"><img src="https://img.shields.io/badge/Powered%20by-Claude%20AI-blueviolet.svg" alt="Claude AI"></a>
   <a href="https://github.com/fotsakir/codehero/stargazers"><img src="https://img.shields.io/github/stars/fotsakir/codehero?style=social" alt="Stars"></a>
@@ -378,8 +378,8 @@ apt-get update && apt-get install -y unzip wget net-tools
 
 # Download and extract
 cd /root
-wget https://github.com/fotsakir/codehero/releases/latest/download/codehero-2.81.0.zip
-unzip codehero-2.81.0.zip
+wget https://github.com/fotsakir/codehero/releases/latest/download/codehero-2.82.0.zip
+unzip codehero-2.82.0.zip
 cd codehero
 
 # Run setup
@@ -405,7 +405,7 @@ The installer automatically sets up:
 ```bash
 # Download new version
 cd /root
-unzip codehero-2.81.0.zip
+unzip codehero-2.82.0.zip
 cd codehero
 
 # Preview changes (recommended)
diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-2.81.0
+2.82.0
diff --git a/database/migrations/2.82.0_secure_urls.sql b/database/migrations/2.82.0_secure_urls.sql
@@ -0,0 +1,21 @@
+-- Migration: Add secure_key column for project URL authentication
+-- Version: 2.82.0
+
+-- Add secure_key column if not exists
+SET @dbname = DATABASE();
+SET @tablename = 'projects';
+SET @columnname = 'secure_key';
+SET @preparedStatement = (SELECT IF(
+  (SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS
+   WHERE TABLE_SCHEMA = @dbname AND TABLE_NAME = @tablename AND COLUMN_NAME = @columnname) > 0,
+  'SELECT 1',
+  'ALTER TABLE projects ADD COLUMN secure_key VARCHAR(32) NULL AFTER preview_url'
+));
+PREPARE alterIfNotExists FROM @preparedStatement;
+EXECUTE alterIfNotExists;
+DEALLOCATE PREPARE alterIfNotExists;
+
+-- Generate secure keys for existing projects that don't have one
+UPDATE projects
+SET secure_key = SUBSTRING(SHA2(CONCAT(UUID(), RAND(), id), 256), 1, 32)
+WHERE secure_key IS NULL;
diff --git a/database/schema.sql b/database/schema.sql
@@ -234,6 +234,7 @@ CREATE TABLE `projects` (
   `tech_stack` varchar(255) DEFAULT NULL,
   `web_path` varchar(500) DEFAULT NULL,
   `preview_url` varchar(500) DEFAULT NULL,
+  `secure_key` varchar(32) DEFAULT NULL COMMENT 'Secure key for project URL authentication',
   `app_path` varchar(500) DEFAULT NULL,
   `reference_path` varchar(500) DEFAULT NULL COMMENT 'Path to imported reference project (for template mode)',
   `context` text,
diff --git a/docs/USER_GUIDE.md b/docs/USER_GUIDE.md
@@ -557,8 +557,8 @@ Fix:
 
 ```bash
 cd /root
-wget https://github.com/fotsakir/codehero/releases/latest/download/codehero-2.81.0.zip
-unzip codehero-2.81.0.zip
+wget https://github.com/fotsakir/codehero/releases/latest/download/codehero-2.82.0.zip
+unzip codehero-2.82.0.zip
 cd codehero
 sudo ./upgrade.sh
 ```
diff --git a/docs/VM_INSTALLATION.md b/docs/VM_INSTALLATION.md
@@ -345,10 +345,10 @@ sudo su
 cd /root
 
 # Download the latest release
-wget https://github.com/fotsakir/codehero/releases/latest/download/codehero-2.81.0.zip
+wget https://github.com/fotsakir/codehero/releases/latest/download/codehero-2.82.0.zip
 
 # Extract
-unzip codehero-2.81.0.zip
+unzip codehero-2.82.0.zip
 
 # Enter the folder
 cd codehero
diff --git a/docs/WSL_INSTALL.md b/docs/WSL_INSTALL.md
@@ -131,10 +131,10 @@ apt-get install -y unzip wget curl
 
 # Download latest release
 cd /root
-wget https://github.com/fotsakir/codehero/releases/latest/download/codehero-2.81.0.zip
+wget https://github.com/fotsakir/codehero/releases/latest/download/codehero-2.82.0.zip
 
 # Extract and install
-unzip codehero-2.81.0.zip
+unzip codehero-2.82.0.zip
 cd codehero
 chmod +x setup.sh
 ./setup.sh
diff --git a/docs/index.html b/docs/index.html
@@ -41,7 +41,7 @@
         "description": "The Developer That Never Rests. Self-hosted autonomous AI coding agent. Give it tasks. Walk away. Wake up to working code.",
         "url": "https://fotsakir.github.io/codehero/",
         "downloadUrl": "https://github.com/fotsakir/codehero/releases/latest",
-        "softwareVersion": "2.81.0",
+        "softwareVersion": "2.82.0",
         "applicationCategory": "DeveloperApplication",
         "operatingSystem": "Ubuntu 22.04, Ubuntu 24.04",
         "offers": {
@@ -1330,9 +1330,9 @@ <h1>CodeHero</h1>
                         Install on <strong>Ubuntu 22.04/24.04</strong> VM (VirtualBox, VMware, Hyper-V, or cloud VPS).
                     </p>
                     <div style="position: relative; background: rgba(0,0,0,0.3); padding: 0.8rem 3rem 0.8rem 0.8rem; border-radius: 6px; font-family: 'JetBrains Mono', monospace; font-size: 0.7rem; overflow-x: auto;">
-                        <button onclick="copyCode(this, 'wget https://github.com/fotsakir/codehero/releases/latest/download/codehero-2.81.0.zip\nunzip codehero-*.zip && cd codehero && ./setup.sh')" style="position: absolute; top: 6px; right: 6px; background: rgba(255,255,255,0.1); border: none; color: var(--text-muted); padding: 4px 8px; border-radius: 4px; cursor: pointer; font-size: 0.7rem; transition: all 0.2s;" onmouseover="this.style.background='rgba(255,255,255,0.2)'" onmouseout="this.style.background='rgba(255,255,255,0.1)'">📋</button>
+                        <button onclick="copyCode(this, 'wget https://github.com/fotsakir/codehero/releases/latest/download/codehero-2.82.0.zip\nunzip codehero-*.zip && cd codehero && ./setup.sh')" style="position: absolute; top: 6px; right: 6px; background: rgba(255,255,255,0.1); border: none; color: var(--text-muted); padding: 4px 8px; border-radius: 4px; cursor: pointer; font-size: 0.7rem; transition: all 0.2s;" onmouseover="this.style.background='rgba(255,255,255,0.2)'" onmouseout="this.style.background='rgba(255,255,255,0.1)'">📋</button>
                         <span style="color: var(--text-muted);"># On Ubuntu VM (as root)</span><br>
-                        <span style="color: var(--accent-cyan);">wget https://github.com/fotsakir/codehero/releases/latest/download/codehero-2.81.0.zip</span><br>
+                        <span style="color: var(--accent-cyan);">wget https://github.com/fotsakir/codehero/releases/latest/download/codehero-2.82.0.zip</span><br>
                         <span style="color: var(--accent-cyan);">unzip codehero-*.zip && cd codehero && ./setup.sh</span>
                     </div>
                     <p style="margin-top: 0.8rem; font-size: 0.8rem;">
diff --git a/setup.sh b/setup.sh
@@ -678,6 +678,7 @@ NGINXADMIN
 
 cat > /etc/nginx/sites-available/codehero-projects << 'NGINXPROJECTS'
 # CodeHero Web Projects - Port 9867 (HTTPS)
+# Session-based auth with per-project cookies
 server {
     listen 9867 ssl http2;
     listen [::]:9867 ssl http2;
@@ -698,11 +699,36 @@ server {
     gzip on;
     gzip_types text/plain text/css application/json application/javascript text/xml application/xml;
 
+    # Auth validation endpoint (internal)
+    location = /auth/validate {
+        internal;
+        proxy_pass http://127.0.0.1:5000/auth/validate-project-key;
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header X-Original-URI $request_uri;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header Cookie $http_cookie;
+    }
+
     location / {
+        auth_request /auth/validate;
+        auth_request_set $auth_cookie $upstream_http_set_cookie;
+        add_header Set-Cookie $auth_cookie;
+
+        error_page 403 = @denied;
         try_files $uri $uri/ /index.php?$query_string;
     }
 
+    location @denied {
+        default_type text/html;
+        return 403 '<!DOCTYPE html><html><head><title>Access Denied</title><style>body{font-family:system-ui,sans-serif;display:flex;justify-content:center;align-items:center;height:100vh;margin:0;background:#0a0a0f;color:#fff}div{text-align:center;padding:40px}h1{color:#ef4444;margin-bottom:20px}p{color:#94a3b8}</style></head><body><div><h1>Access Denied</h1><p>Use the secure URL with key from CodeHero dashboard.</p></div></body></html>';
+    }
+
     location ~ \.php$ {
+        auth_request /auth/validate;
+        auth_request_set $auth_cookie $upstream_http_set_cookie;
+        add_header Set-Cookie $auth_cookie;
+
         fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
         fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
         include fastcgi_params;
@@ -713,7 +739,8 @@ server {
         deny all;
     }
 
-    location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff|woff2|ttf|svg)$ {
+    location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff|woff2|ttf|svg|eot)$ {
+        auth_request /auth/validate;
         expires 7d;
         add_header Cache-Control "public, immutable";
     }
diff --git a/upgrade.sh b/upgrade.sh
@@ -513,6 +513,88 @@ SVCEOF
 
 log_success "Systemd services updated"
 
+# =====================================================
+# STEP 7.5: UPDATE NGINX CONFIG (if needed)
+# =====================================================
+
+# Update nginx config for session-based auth if still using old Basic Auth
+if grep -q "auth_basic" /etc/nginx/sites-available/codehero-projects 2>/dev/null; then
+    log_info "Updating nginx config for session-based auth..."
+    cat > /etc/nginx/sites-available/codehero-projects << 'NGINXPROJECTS'
+# CodeHero Web Projects - Port 9867 (HTTPS)
+# Session-based auth with per-project cookies
+server {
+    listen 9867 ssl http2;
+    listen [::]:9867 ssl http2;
+    server_name _;
+
+    ssl_certificate /etc/codehero/ssl/cert.pem;
+    ssl_certificate_key /etc/codehero/ssl/key.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+
+    root /var/www/projects;
+    index index.html index.php;
+
+    access_log /var/log/nginx/codehero-projects-access.log;
+    error_log /var/log/nginx/codehero-projects-error.log;
+    client_max_body_size 500M;
+
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript text/xml application/xml;
+
+    # Auth validation endpoint (internal)
+    location = /auth/validate {
+        internal;
+        proxy_pass http://127.0.0.1:5000/auth/validate-project-key;
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header X-Original-URI $request_uri;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header Cookie $http_cookie;
+    }
+
+    location / {
+        auth_request /auth/validate;
+        auth_request_set $auth_cookie $upstream_http_set_cookie;
+        add_header Set-Cookie $auth_cookie;
+
+        error_page 403 = @denied;
+        try_files $uri $uri/ /index.php?$query_string;
+    }
+
+    location @denied {
+        default_type text/html;
+        return 403 '<!DOCTYPE html><html><head><title>Access Denied</title><style>body{font-family:system-ui,sans-serif;display:flex;justify-content:center;align-items:center;height:100vh;margin:0;background:#0a0a0f;color:#fff}div{text-align:center;padding:40px}h1{color:#ef4444;margin-bottom:20px}p{color:#94a3b8}</style></head><body><div><h1>Access Denied</h1><p>Use the secure URL with key from CodeHero dashboard.</p></div></body></html>';
+    }
+
+    location ~ \.php$ {
+        auth_request /auth/validate;
+        auth_request_set $auth_cookie $upstream_http_set_cookie;
+        add_header Set-Cookie $auth_cookie;
+
+        fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
+        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
+        include fastcgi_params;
+        fastcgi_read_timeout 300s;
+    }
+
+    location ~ /\.ht {
+        deny all;
+    }
+
+    location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff|woff2|ttf|svg|eot)$ {
+        auth_request /auth/validate;
+        expires 7d;
+        add_header Cache-Control "public, immutable";
+    }
+}
+NGINXPROJECTS
+    # Remove old htpasswd file if exists
+    rm -f /etc/codehero/projects.htpasswd
+    log_success "Nginx config updated for session-based auth"
+fi
+
 # =====================================================
 # STEP 8: RESTART SERVICES
 # =====================================================
diff --git a/web/app.py b/web/app.py
diff --git a/web/templates/project_detail.html b/web/templates/project_detail.html
