From c9d17d3586c84cd6bc191103308ef745b7e8f13b Mon Sep 17 00:00:00 2001
From: Loi Phan <phanhuuloi15@gmail.com>
Date: Sun, 19 Jul 2026 20:56:53 +0700
Subject: [PATCH] fix: update the save configuration of the cli tools

---
 src/dashboardGuard.js              |  5 ++++-
 tests/unit/dashboard-guard.test.js | 19 +++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/src/dashboardGuard.js b/src/dashboardGuard.js
index 6eec8a70..2d065710 100644
--- a/src/dashboardGuard.js
+++ b/src/dashboardGuard.js
@@ -205,8 +205,11 @@ export async function proxy(request) {
   // case, can change privileged system networking. Keep them available only
   // to authenticated dashboard users on the local machine; never allow the
   // shared CLI bearer token to become a remote host-administration credential.
+  // Configuration routes only persist dashboard-user settings in SQLite, so
+  // authenticated remote dashboard users may access them.
   if (pathname === "/api/cli-tools" || pathname.startsWith("/api/cli-tools/")) {
-    if (!isLocalRequest(request)) {
+    const isConfigRoute = pathname.startsWith("/api/cli-tools/config/");
+    if (!isLocalRequest(request) && !isConfigRoute) {
       return NextResponse.json({ error: "CLI Tools are available only from the local machine" }, { status: 403 });
     }
     if (!(await isAuthenticated(request))) {
diff --git a/tests/unit/dashboard-guard.test.js b/tests/unit/dashboard-guard.test.js
index 992eff2f..675f66bb 100644
--- a/tests/unit/dashboard-guard.test.js
+++ b/tests/unit/dashboard-guard.test.js
@@ -292,6 +292,25 @@ describe("dashboard guard CLI Tools access", () => {
     expect(response.body.error).toBe("CLI Tools are available only from the local machine");
   });
 
+  it("allows authenticated remote users to access CLI tool configuration", async () => {
+    const response = await proxy(request("/api/cli-tools/config/claude", {
+      host: "router.example.com",
+    }, "user-token"));
+
+    expect(response).toBe(mocks.nextResponse);
+  });
+
+  it("rejects unauthenticated remote CLI tool configuration access", async () => {
+    mocks.verifyDashboardAuthToken.mockResolvedValue(false);
+
+    const response = await proxy(request("/api/cli-tools/config/claude", {
+      host: "router.example.com",
+    }));
+
+    expect(response.status).toBe(401);
+    expect(response.body.error).toBe("Unauthorized");
+  });
+
   it("allows a local administrator to use CLI Tools", async () => {
     mocks.getUserById.mockResolvedValue({ id: "user-1", isActive: true, role: "admin" });