@adonis-agora/durable 0.6.1 → 0.8.0

package/dist/src/control-plane-redis/redis-control-plane.js.map

@@ -1 +1 @@
-{"version":3,"file":"redis-control-plane.js","sourceRoot":"","sources":["../../../src/control-plane-redis/redis-control-plane.ts"],"names":[],"mappings":"AA2CA;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,iBAAiB;IACX,UAAU,CAAc;IACxB,OAAO,CAAS;IACzB,UAAU,CAA0B;IACpC,UAAU,GAAG,KAAK,CAAC;IAE3B,YAAY,OAAiC;QAC3C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,SAAS,UAAU,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAmB;QACtC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,SAAS,CAAC,OAAsC;QAC9C,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,CAAC,qCAAqC;QAClE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QAEvB,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE;YAClC,IAAI,GAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,6EAA6E;YACvF,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC,CAAC;QAEF,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACpD,wFAAwF;YACxF,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;YACxC,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;YACtB,KAAK,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjC,GAAG,CAAC,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,iGAAiG;YACjG,KAAK,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC9B,CAAC;CACF"}
+{"version":3,"file":"redis-control-plane.js","sourceRoot":"","sources":["../../../src/control-plane-redis/redis-control-plane.ts"],"names":[],"mappings":"AAqEA,+DAA+D;AAC/D,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,uFAAuF;AACvF,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAEzC;;;GAGG;AACH,SAAS,qBAAqB,CAAC,KAAiC;IAC9D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,wBAAwB,CAAC;IACzD,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,iBAAiB;IACX,UAAU,CAAc;IACxB,OAAO,CAAS;IACzB,UAAU,CAA0B;IACpC,UAAU,GAAG,KAAK,CAAC;IACV,cAAc,CAAiB;IACxC,iBAAiB,CAA6C;IAC9D,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAY,OAAiC;QAC3C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,SAAS,UAAU,CAAC;QACxD,IAAI,CAAC,cAAc,GAAG,qBAAqB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAmB;QACtC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,SAAS,CAAC,OAAsC;QAC9C,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,CAAC,qCAAqC;QAClE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QAEvB,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE;YAClC,IAAI,GAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,6EAA6E;YACvF,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC,CAAC;QAEF,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACpD,wFAAwF;YACxF,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;YACxC,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;YACtB,KAAK,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjC,GAAG,CAAC,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,QAAgB,EAAE,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAU,CAAC,CAAC;YACxF,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,iGAAiG;YACjG,KAAK,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,eAAe,CAAC,GAAgB;QACtC,IAAI,gBAAgB,GAAG,KAAK,CAAC;QAC7B,GAAG,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,GAAU,EAAE,EAAE;YAChC,IAAI,gBAAgB;gBAAE,OAAO,CAAC,kDAAkD;YAChF,gBAAgB,GAAG,IAAI,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,oDAAoD,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAClF,CAAC,CAAU,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE;YACtB,gBAAgB,GAAG,KAAK,CAAC;QAC3B,CAAC,CAAU,CAAC,CAAC;QACb,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACK,iBAAiB,CAAC,GAAgB;QACxC,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,cAAc,KAAK,KAAK;YAAE,OAAO;QACpE,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO,CAAC,sDAAsD;QAClG,IAAI,CAAC,iBAAiB,GAAG,WAAW,CAAC,GAAG,EAAE;YACxC,KAAK,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACxB,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,CAAC;IACnC,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,cAAc,CAAC,GAAgB;QAC3C,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO;QAC/D,MAAM,SAAS,GACb,IAAI,CAAC,cAAc,KAAK,KAAK;YAC3B,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBAC/E,GAAG;qBACA,IAAI,EAAE,EAAE;qBACR,IAAI,CAAC,GAAG,EAAE;oBACT,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC;qBACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBACtB,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC9D,CAAC,CAAC,CAAC;YACP,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,4FAA4F;YAC5F,kFAAkF;YAClF,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO;YACxB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,IAAI,CACV,2DAA2D,OAAO,8CAA8C,CACjH,CAAC;YACF,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,IAAI,CAAC,iBAAiB;YAAE,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAClE,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACnC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC9B,CAAC;CACF"}

package/dist/src/dashboard/auth.d.ts

@@ -0,0 +1,89 @@
+import { type DashboardSession, type DashboardSessionUser } from './session_cookie.js';
+/**
+ * Framework-light `dashboardAuth` mechanism for the durable dashboard — config resolution, the
+ * open-redirect guard, the login decision, and session verification. NO AdonisJS types leak in
+ * (mirroring {@link file://./handlers.ts handlers.ts}), so every branch is unit-testable against a
+ * plain object with no HTTP server. The provider (`providers/dashboard_provider.ts`) adapts an
+ * `HttpContext` to these functions and owns the cookie read/write via AdonisJS's native cookie API.
+ *
+ * When configured it gates BOTH the dashboard HTML shell (a full-page navigation redirected `302`
+ * to a server-rendered login page) and the JSON API (a plain `401`) behind a signed session cookie.
+ * When left unconfigured the dashboard behaves exactly as before (no login/logout routes, no
+ * session guard).
+ */
+/** Host hook validating submitted credentials from the built-in login page. */
+export type LoginHook = (username: string, password: string) => Promise<DashboardSessionUser | null> | DashboardSessionUser | null;
+/**
+ * Author-facing `dashboardAuth` option on `config/durable_dashboard.ts`. Gates the dashboard behind
+ * a signed session cookie via the built-in server-rendered login page (`GET <path>/login`) — the
+ * bundled dashboard SPA stays untouched.
+ *
+ * Nest needed a `forRootAsync` to reach app services from the `login` hook; AdonisJS does not — the
+ * config module is a plain file and `login` is just a function that may be `async` and close over
+ * `app.container`/services (import them at the top of `config/durable_dashboard.ts`), so there is
+ * nothing extra to build for the async case.
+ */
+export interface DashboardAuthOptions {
+    /** REQUIRED HMAC-SHA256 signing key. Missing/empty => boot error (fail closed). */
+    secret: string;
+    /** Cookie TTL as a duration string (`'8h'`, `'30m'`, `'7d'`). Default `'8h'`. */
+    ttl?: string;
+    /** Validates submitted username/password; return the session user, or `null` to deny. Thrown
+     *  errors are treated as a denial (logged once, never surfaced to the client). May be async. */
+    login: LoginHook;
+}
+/** Resolved, validated `dashboardAuth` config shared by the guard, the login handler, and the page. */
+export interface ResolvedDashboardAuth {
+    secret: string;
+    ttlMs: number;
+    login: LoginHook;
+}
+/** Cookie name carrying the signed dashboard session. */
+export declare const SESSION_COOKIE_NAME = "durable_dashboard_session";
+/**
+ * Validate + resolve the `dashboardAuth` option. Returns `null` when unconfigured (today's
+ * unauthenticated behavior, unchanged). Throws at boot (fail closed) when configured but missing a
+ * secret or a `login` hook — the host learns immediately rather than shipping an un-mintable gate.
+ */
+export declare function resolveDashboardAuth(options: DashboardAuthOptions | undefined): ResolvedDashboardAuth | null;
+/**
+ * Guard a client-supplied redirect target against an open redirect: it must be a same-origin,
+ * root-relative path (`/durable/foo`), never a protocol-relative (`//evil.com`) or absolute
+ * (`https://evil.com`) URL. Falls back to `fallback` (the dashboard's own `basePath`) for anything
+ * else, including a missing/non-string value.
+ */
+export declare function sanitizeReturnTo(candidate: unknown, fallback: string): string;
+/**
+ * The framework-light outcome of a login attempt, mapped to HTTP by the provider:
+ * - `ok`       → set `cookieValue` as the session cookie, reply `200 { redirectTo }`.
+ * - `bad-request` → `400` (body missing string `username`/`password`).
+ * - `unauthorized` → uniform `401 { error }` for EVERY credential failure (unknown user, wrong
+ *   password, or a throwing hook) — no user-enumeration. `hookError` is set only when the hook
+ *   threw, so the provider can warn-log it once without changing the client-visible response.
+ */
+export type LoginOutcome = {
+    kind: 'ok';
+    cookieValue: string;
+    redirectTo: string;
+} | {
+    kind: 'bad-request';
+    message: string;
+} | {
+    kind: 'unauthorized';
+    message: string;
+    hookError?: unknown;
+};
+/**
+ * Decide a login attempt end-to-end (validate body → run hook → mint cookie) with no HTTP types.
+ * On success returns the signed cookie value to set plus the sanitized `redirectTo`; the password
+ * is forwarded to the hook AS-IS (empty string when blank), so the hook alone decides whether a
+ * password is required.
+ */
+export declare function performLogin(auth: ResolvedDashboardAuth, body: unknown, basePath: string, now?: number): Promise<LoginOutcome>;
+/**
+ * Read + verify a session cookie value, returning the session or `null` when absent, tampered, or
+ * expired. Thin wrapper over {@link verifySessionCookie} so the provider never touches crypto.
+ */
+export declare function readSession(auth: ResolvedDashboardAuth, cookieValue: string | undefined, now?: number): DashboardSession | null;
+export type { DashboardSession, DashboardSessionUser } from './session_cookie.js';
+//# sourceMappingURL=auth.d.ts.map

package/dist/src/dashboard/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/dashboard/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAG1B,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;GAWG;AAEH,+EAA+E;AAC/E,MAAM,MAAM,SAAS,GAAG,CACtB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,oBAAoB,GAAG,IAAI,CAAC;AAExE;;;;;;;;;GASG;AACH,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;oGACgG;IAChG,KAAK,EAAE,SAAS,CAAC;CAClB;AAED,uGAAuG;AACvG,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;CAClB;AAED,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAoB/D;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,oBAAoB,GAAG,SAAS,GACxC,qBAAqB,GAAG,IAAI,CAgB9B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAM7E;AAaD;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAqBnE;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,qBAAqB,EAC3B,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,MAAM,EAChB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,YAAY,CAAC,CAiBvB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,qBAAqB,EAC3B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,GAAG,CAAC,EAAE,MAAM,GACX,gBAAgB,GAAG,IAAI,CAMzB;AAED,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/src/dashboard/auth.js

@@ -0,0 +1,113 @@
+import { signSessionCookie, verifySessionCookie, } from './session_cookie.js';
+/** Cookie name carrying the signed dashboard session. */
+export const SESSION_COOKIE_NAME = 'durable_dashboard_session';
+const DEFAULT_TTL = '8h';
+const DEFAULT_TTL_MS = 8 * 60 * 60 * 1000;
+const DURATION_UNITS = {
+    s: 1000,
+    m: 60 * 1000,
+    h: 60 * 60 * 1000,
+    d: 24 * 60 * 60 * 1000,
+};
+/** Parse a `'<number><s|m|h|d>'` duration to ms; falls back to the 8h default on a bad value. */
+function durationToMs(ttl) {
+    const match = /^(\d+)([smhd])$/.exec(ttl.trim());
+    if (!match)
+        return DEFAULT_TTL_MS;
+    const unit = DURATION_UNITS[match[2] ?? ''];
+    if (unit === undefined)
+        return DEFAULT_TTL_MS;
+    return Number(match[1]) * unit;
+}
+/**
+ * Validate + resolve the `dashboardAuth` option. Returns `null` when unconfigured (today's
+ * unauthenticated behavior, unchanged). Throws at boot (fail closed) when configured but missing a
+ * secret or a `login` hook — the host learns immediately rather than shipping an un-mintable gate.
+ */
+export function resolveDashboardAuth(options) {
+    if (options === undefined)
+        return null;
+    if (typeof options.secret !== 'string' || options.secret === '') {
+        throw new Error('durable_dashboard: dashboardAuth.secret is required and must be a non-empty string ' +
+            '(HMAC-SHA256 signing key, 32+ bytes recommended). Failing closed.');
+    }
+    if (typeof options.login !== 'function') {
+        throw new Error('durable_dashboard: dashboardAuth.login is required (a login hook).');
+    }
+    return {
+        secret: options.secret,
+        ttlMs: durationToMs(options.ttl ?? DEFAULT_TTL),
+        login: options.login,
+    };
+}
+/**
+ * Guard a client-supplied redirect target against an open redirect: it must be a same-origin,
+ * root-relative path (`/durable/foo`), never a protocol-relative (`//evil.com`) or absolute
+ * (`https://evil.com`) URL. Falls back to `fallback` (the dashboard's own `basePath`) for anything
+ * else, including a missing/non-string value.
+ */
+export function sanitizeReturnTo(candidate, fallback) {
+    if (typeof candidate !== 'string')
+        return fallback;
+    if (!candidate.startsWith('/'))
+        return fallback;
+    if (candidate.startsWith('//'))
+        return fallback;
+    if (candidate.includes('://'))
+        return fallback;
+    return candidate;
+}
+function isString(value) {
+    return typeof value === 'string';
+}
+const UNAUTHORIZED_MESSAGE = 'Invalid username or password.';
+/**
+ * Run the host's `login` hook defensively: a throw is treated as a denial (uniform failure) so a
+ * buggy hook never 500s the endpoint into a stack-trace leak. The thrown error is surfaced on the
+ * outcome (`hookError`) so the provider can warn-log it once, but it never reaches the client.
+ */
+async function runLoginHook(auth, username, password) {
+    try {
+        return { user: (await auth.login(username, password)) ?? null };
+    }
+    catch (error) {
+        return { user: null, error };
+    }
+}
+/**
+ * Decide a login attempt end-to-end (validate body → run hook → mint cookie) with no HTTP types.
+ * On success returns the signed cookie value to set plus the sanitized `redirectTo`; the password
+ * is forwarded to the hook AS-IS (empty string when blank), so the hook alone decides whether a
+ * password is required.
+ */
+export async function performLogin(auth, body, basePath, now) {
+    const parsed = (body ?? {});
+    if (!isString(parsed.username) || !isString(parsed.password)) {
+        return { kind: 'bad-request', message: 'Body must include string `username` and `password`.' };
+    }
+    const { user, error } = await runLoginHook(auth, parsed.username, parsed.password);
+    if (!user) {
+        return error !== undefined
+            ? { kind: 'unauthorized', message: UNAUTHORIZED_MESSAGE, hookError: error }
+            : { kind: 'unauthorized', message: UNAUTHORIZED_MESSAGE };
+    }
+    const cookieValue = signSessionCookie(user, {
+        secret: auth.secret,
+        ttlMs: auth.ttlMs,
+        ...(now !== undefined ? { now } : {}),
+    });
+    return { kind: 'ok', cookieValue, redirectTo: sanitizeReturnTo(parsed.returnTo, basePath) };
+}
+/**
+ * Read + verify a session cookie value, returning the session or `null` when absent, tampered, or
+ * expired. Thin wrapper over {@link verifySessionCookie} so the provider never touches crypto.
+ */
+export function readSession(auth, cookieValue, now) {
+    if (cookieValue === undefined || cookieValue === '')
+        return null;
+    return verifySessionCookie(cookieValue, {
+        secret: auth.secret,
+        ...(now !== undefined ? { now } : {}),
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/src/dashboard/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/dashboard/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAgD7B,yDAAyD;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAE/D,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,cAAc,GAA2B;IAC7C,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,EAAE,GAAG,IAAI;IACZ,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACjB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;CACvB,CAAC;AAEF,iGAAiG;AACjG,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,cAAc,CAAC;IAClC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC;IAC9C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAyC;IAEzC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,qFAAqF;YACnF,mEAAmE,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC;QAC/C,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAkB,EAAE,QAAgB;IACnE,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACnD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChD,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChD,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/C,OAAO,SAAS,CAAC;AACnB,CAAC;AASD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC;AACnC,CAAC;AAeD,MAAM,oBAAoB,GAAG,+BAA+B,CAAC;AAE7D;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,IAA2B,EAC3B,QAAgB,EAChB,QAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAA2B,EAC3B,IAAa,EACb,QAAgB,EAChB,GAAY;IAEZ,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAAc,CAAC;IACzC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;IACjG,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,KAAK,EAAE;YAC3E,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,EAAE;QAC1C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,IAA2B,EAC3B,WAA+B,EAC/B,GAAY;IAEZ,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,mBAAmB,CAAC,WAAW,EAAE;QACtC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/dashboard/define_config.d.ts

@@ -1,4 +1,5 @@
 import type { HttpContext } from '@adonisjs/core/http';
+import { type DashboardAuthOptions, type ResolvedDashboardAuth } from './auth.js';
 /**
  * Authorization guard for the dashboard. Runs before every dashboard route
  * (API + HTML). Return `true` to allow the request, `false` to deny it (the
@@ -27,12 +28,28 @@ export interface DurableDashboardConfig {
      * token matching the `DURABLE_DASHBOARD_TOKEN` env var (deny if it is unset).
      */
     authorize?: AuthorizeHook;
+    /**
+     * Optional built-in login screen. When set, the provider mounts a
+     * server-rendered `GET <path>/login` page plus `POST <path>/login` /
+     * `GET <path>/logout`, and stamps a session guard on the dashboard: an
+     * unauthenticated page navigation is redirected (`302`) to the login page and
+     * an unauthenticated API request gets `401`. The signed session cookie is
+     * minted only by the host's {@link DashboardAuthOptions.login} hook.
+     *
+     * This is ADDITIVE and composes WITH {@link authorize} (both must pass) — it
+     * does not replace it. Omit it entirely to keep today's behavior byte-for-byte
+     * (no login/logout routes, no session guard). Missing `secret`/`login` fails
+     * closed at boot.
+     */
+    dashboardAuth?: DashboardAuthOptions;
 }
 /** A fully-resolved config — every field present (defaults applied). */
 export interface ResolvedDurableDashboardConfig {
     enabled: boolean;
     path: string;
     authorize: AuthorizeHook;
+    /** Resolved built-in login config, or `null` when `dashboardAuth` is unconfigured. */
+    dashboardAuth: ResolvedDashboardAuth | null;
 }
 /**
  * The default guard: open outside production; in production it requires a

package/dist/src/dashboard/define_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE7E,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,wEAAwE;AACxE,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,aAAa,CAAC;CAC1B;AA4BD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAK1D;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,MAAM,GAAE,sBAA2B,GAAG,8BAA8B,CASjG;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,MAAM,GAAE,sBAA2B,GAAG,sBAAsB,CAExF"}
+{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAE3B,MAAM,WAAW,CAAC;AAEnB;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE7E,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;CACtC;AAED,wEAAwE;AACxE,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,aAAa,CAAC;IACzB,sFAAsF;IACtF,aAAa,EAAE,qBAAqB,GAAG,IAAI,CAAC;CAC7C;AAyCD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAQ1D;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,MAAM,GAAE,sBAA2B,GAAG,8BAA8B,CAYjG;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,MAAM,GAAE,sBAA2B,GAAG,sBAAsB,CAExF"}

package/dist/src/dashboard/define_config.js

@@ -1,3 +1,5 @@
+import { timingSafeEqual } from 'node:crypto';
+import { resolveDashboardAuth, } from './auth.js';
 /**
  * Whether the process is running in production. Mirrors how AdonisJS reads the
  * environment without taking a hard dependency on its env service.
@@ -25,6 +27,19 @@ function readToken(ctx) {
         return qs;
     return undefined;
 }
+/**
+ * Compare two secrets in constant time (guarding for equal byte-length first,
+ * since {@link timingSafeEqual} throws on a length mismatch). Returns `false`
+ * for any length difference, otherwise the timing-safe equality — so the token
+ * check leaks neither a match nor the token's length via response time.
+ */
+function secretsMatch(a, b) {
+    const bufA = Buffer.from(a);
+    const bufB = Buffer.from(b);
+    if (bufA.length !== bufB.length)
+        return false;
+    return timingSafeEqual(bufA, bufB);
+}
 /**
  * The default guard: open outside production; in production it requires a
  * bearer token equal to `DURABLE_DASHBOARD_TOKEN`. If that env var is unset in
@@ -37,7 +52,11 @@ export function defaultAuthorize(ctx) {
     const expected = process.env.DURABLE_DASHBOARD_TOKEN;
     if (!expected)
         return false;
-    return readToken(ctx) === expected;
+    const provided = readToken(ctx);
+    if (provided === undefined)
+        return false;
+    // Constant-time compare to remove the timing side-channel from the token check.
+    return secretsMatch(provided, expected);
 }
 /** Apply defaults to a partial config, producing a fully-resolved one. */
 export function resolveConfig(config = {}) {
@@ -48,6 +67,9 @@ export function resolveConfig(config = {}) {
         enabled: config.enabled ?? true,
         path: trimmed === '/' ? '' : trimmed,
         authorize: config.authorize ?? defaultAuthorize,
+        // Validate + resolve now so a misconfigured secret/login fails closed at boot,
+        // not on the first login attempt. `null` when `dashboardAuth` is omitted.
+        dashboardAuth: resolveDashboardAuth(config.dashboardAuth),
     };
 }
 /** Identity helper giving `config/durable_dashboard.ts` full type-checking. */

package/dist/src/dashboard/define_config.js.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AAwCA;;;GAGG;AACH,SAAS,YAAY;IACnB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,GAAgB;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;IAClC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACvD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB;IAC/C,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACrD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,SAAS,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;AACrC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,SAAiC,EAAE;IAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC;IAC1C,mFAAmF;IACnF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;IACtE,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QAC/B,IAAI,EAAE,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO;QACpC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,gBAAgB;KAChD,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,SAAiC,EAAE;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAGL,oBAAoB,GACrB,MAAM,WAAW,CAAC;AAwDnB;;;GAGG;AACH,SAAS,YAAY;IACnB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,GAAgB;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;IAClC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACvD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB;IAC/C,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACrD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzC,gFAAgF;IAChF,OAAO,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,SAAiC,EAAE;IAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC;IAC1C,mFAAmF;IACnF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;IACtE,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QAC/B,IAAI,EAAE,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO;QACpC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,gBAAgB;QAC/C,+EAA+E;QAC/E,0EAA0E;QAC1E,aAAa,EAAE,oBAAoB,CAAC,MAAM,CAAC,aAAa,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,SAAiC,EAAE;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/dashboard/index.d.ts

@@ -1,8 +1,13 @@
 /** Keep in sync with this package's `version` in package.json. */
-export declare const VERSION = "0.6.0";
+export declare const VERSION = "0.7.0";
 export { defineConfig, defaultAuthorize, resolveConfig } from './define_config.js';
 export type { AuthorizeHook, DurableDashboardConfig, ResolvedDurableDashboardConfig, } from './define_config.js';
 export { listRuns, getRun, retryRun, cancelRun, health, } from './handlers.js';
 export type { ApiRequest, ApiResponse, Deps } from './handlers.js';
 export { renderDashboard } from './html.js';
+export { resolveDashboardAuth, performLogin, readSession, sanitizeReturnTo, SESSION_COOKIE_NAME, } from './auth.js';
+export type { DashboardAuthOptions, ResolvedDashboardAuth, LoginHook, LoginOutcome, } from './auth.js';
+export { signSessionCookie, verifySessionCookie, } from './session_cookie.js';
+export type { DashboardSession, DashboardSessionUser, SignOptions, VerifyOptions, } from './session_cookie.js';
+export { renderLoginPage } from './login_page.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/dashboard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/dashboard/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnF,YAAY,EACV,aAAa,EACb,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,SAAS,EACT,MAAM,GACP,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/dashboard/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnF,YAAY,EACV,aAAa,EACb,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,SAAS,EACT,MAAM,GACP,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,oBAAoB,EACpB,qBAAqB,EACrB,SAAS,EACT,YAAY,GACb,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,WAAW,EACX,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/src/dashboard/index.js

@@ -1,6 +1,10 @@
 /** Keep in sync with this package's `version` in package.json. */
-export const VERSION = '0.6.0';
+export const VERSION = '0.7.0';
 export { defineConfig, defaultAuthorize, resolveConfig } from './define_config.js';
 export { listRuns, getRun, retryRun, cancelRun, health, } from './handlers.js';
 export { renderDashboard } from './html.js';
+// Built-in `dashboardAuth` login screen (optional; opt-in via `config/durable_dashboard.ts`).
+export { resolveDashboardAuth, performLogin, readSession, sanitizeReturnTo, SESSION_COOKIE_NAME, } from './auth.js';
+export { signSessionCookie, verifySessionCookie, } from './session_cookie.js';
+export { renderLoginPage } from './login_page.js';
 //# sourceMappingURL=index.js.map

package/dist/src/dashboard/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/dashboard/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAMnF,OAAO,EACL,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,SAAS,EACT,MAAM,GACP,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/dashboard/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAMnF,OAAO,EACL,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,SAAS,EACT,MAAM,GACP,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,8FAA8F;AAC9F,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AAOnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/src/dashboard/login_page.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The built-in `dashboardAuth` login page (`GET <basePath>/login`). Deliberately a small,
+ * dependency-free, hand-authored HTML page — NOT part of the bundled dashboard SPA — so gating the
+ * dashboard shell doesn't require rebuilding or extending the bundled `assets/dashboard.html`.
+ *
+ * `returnTo` and any error state are read CLIENT-SIDE from `location.search` (never server-echoed
+ * into the HTML), so this function's only per-request-ish input is `basePath` — a developer-
+ * controlled config value, not user input — and the page body is otherwise a static template.
+ * This sidesteps HTML-escaping entirely: there is no reflected query-param interpolation surface
+ * to get wrong.
+ *
+ * The visual language (dark zinc card, mono type, emerald accent) mirrors the Agora consoles so
+ * they feel like one family. The submit flow POSTs JSON via `fetch` and follows the JSON
+ * `redirectTo` it gets back (rather than a classic form POST + server redirect), which is why the
+ * markup keeps its own `<script>`.
+ *
+ * The password input has NO `required` attribute and the value is forwarded AS-IS (empty string
+ * when blank): the host's `login` hook — not this page — decides whether a password matters, so an
+ * email-only host (gate on username, ignore password) works with the same page as a host with real
+ * passwords.
+ */
+export declare function renderLoginPage(basePath: string): string;
+//# sourceMappingURL=login_page.d.ts.map

package/dist/src/dashboard/login_page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login_page.d.ts","sourceRoot":"","sources":["../../../src/dashboard/login_page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAmJxD"}

package/dist/src/dashboard/login_page.js

@@ -0,0 +1,170 @@
+/**
+ * The built-in `dashboardAuth` login page (`GET <basePath>/login`). Deliberately a small,
+ * dependency-free, hand-authored HTML page — NOT part of the bundled dashboard SPA — so gating the
+ * dashboard shell doesn't require rebuilding or extending the bundled `assets/dashboard.html`.
+ *
+ * `returnTo` and any error state are read CLIENT-SIDE from `location.search` (never server-echoed
+ * into the HTML), so this function's only per-request-ish input is `basePath` — a developer-
+ * controlled config value, not user input — and the page body is otherwise a static template.
+ * This sidesteps HTML-escaping entirely: there is no reflected query-param interpolation surface
+ * to get wrong.
+ *
+ * The visual language (dark zinc card, mono type, emerald accent) mirrors the Agora consoles so
+ * they feel like one family. The submit flow POSTs JSON via `fetch` and follows the JSON
+ * `redirectTo` it gets back (rather than a classic form POST + server redirect), which is why the
+ * markup keeps its own `<script>`.
+ *
+ * The password input has NO `required` attribute and the value is forwarded AS-IS (empty string
+ * when blank): the host's `login` hook — not this page — decides whether a password matters, so an
+ * email-only host (gate on username, ignore password) works with the same page as a host with real
+ * passwords.
+ */
+export function renderLoginPage(basePath) {
+    const loginAction = `${basePath}/login`;
+    const defaultReturnTo = basePath === '' ? '/' : basePath;
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<meta name="robots" content="noindex, nofollow" />
+<title>Sign in — Durable</title>
+<style>
+  :root { color-scheme: dark; }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    min-height: 100vh;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    background: #09090b;
+    color: #e4e4e7;
+    font: 14px/1.5 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    padding: 16px;
+  }
+  .card {
+    width: 100%;
+    max-width: 384px;
+    border: 1px solid #27272a;
+    background: #18181b;
+    border-radius: 8px;
+    padding: 32px;
+    box-shadow: 0 25px 50px -12px rgb(0 0 0 / 0.5);
+  }
+  .brand {
+    margin: 0 0 24px;
+    text-align: center;
+    font-size: 18px;
+    font-weight: 600;
+    color: #34d399;
+  }
+  form { display: flex; flex-direction: column; gap: 16px; }
+  label { display: flex; flex-direction: column; gap: 6px; }
+  .field-label {
+    font-size: 11px;
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+    color: #71717a;
+  }
+  input {
+    border-radius: 4px;
+    border: 1px solid #3f3f46;
+    background: #09090b;
+    color: #f4f4f5;
+    padding: 8px 12px;
+    font: inherit;
+    outline: none;
+  }
+  input:focus { border-color: rgb(52 211 153 / 0.6); }
+  #error {
+    display: none;
+    margin: 0;
+    font-size: 12px;
+    color: #fb7185;
+  }
+  button {
+    margin-top: 8px;
+    border-radius: 4px;
+    border: 1px solid rgb(52 211 153 / 0.4);
+    background: rgb(52 211 153 / 0.1);
+    color: #6ee7b7;
+    padding: 8px 12px;
+    font: inherit;
+    font-size: 12px;
+    font-weight: 500;
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+    cursor: pointer;
+  }
+  button:hover:not(:disabled) { background: rgb(52 211 153 / 0.2); }
+  button:disabled { opacity: 0.6; cursor: default; }
+</style>
+</head>
+<body>
+  <div class="card">
+    <p class="brand">Durable</p>
+    <form id="login-form" autocomplete="on">
+      <label>
+        <span class="field-label">Username</span>
+        <input id="username" name="username" type="text" autocomplete="username" required autofocus />
+      </label>
+      <label>
+        <span class="field-label">Password</span>
+        <input id="password" name="password" type="password" autocomplete="current-password" />
+      </label>
+      <p id="error" role="alert">Invalid username or password.</p>
+      <button id="submit" type="submit">Sign in</button>
+    </form>
+  </div>
+<script>
+(function () {
+  var LOGIN_ACTION = ${JSON.stringify(loginAction)};
+  var DEFAULT_RETURN_TO = ${JSON.stringify(defaultReturnTo)};
+  var params = new URLSearchParams(window.location.search);
+  var errorBox = document.getElementById('error');
+  if (params.get('error')) errorBox.style.display = 'block';
+
+  function sameOriginReturnTo(value) {
+    if (typeof value !== 'string' || value === '') return DEFAULT_RETURN_TO;
+    if (value.charAt(0) !== '/' || value.charAt(1) === '/' || value.indexOf('://') !== -1) {
+      return DEFAULT_RETURN_TO;
+    }
+    return value;
+  }
+
+  var form = document.getElementById('login-form');
+  var submitButton = document.getElementById('submit');
+  form.addEventListener('submit', function (event) {
+    event.preventDefault();
+    submitButton.disabled = true;
+    errorBox.style.display = 'none';
+    var returnTo = sameOriginReturnTo(params.get('returnTo'));
+    fetch(LOGIN_ACTION, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      credentials: 'same-origin',
+      body: JSON.stringify({
+        username: document.getElementById('username').value,
+        password: document.getElementById('password').value,
+        returnTo: returnTo,
+      }),
+    })
+      .then(function (response) {
+        if (!response.ok) throw new Error('unauthorized');
+        return response.json();
+      })
+      .then(function (data) {
+        window.location.href = data.redirectTo || DEFAULT_RETURN_TO;
+      })
+      .catch(function () {
+        errorBox.style.display = 'block';
+        submitButton.disabled = false;
+      });
+  });
+})();
+</script>
+</body>
+</html>`;
+}
+//# sourceMappingURL=login_page.js.map

package/dist/src/dashboard/login_page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login_page.js","sourceRoot":"","sources":["../../../src/dashboard/login_page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,WAAW,GAAG,GAAG,QAAQ,QAAQ,CAAC;IACxC,MAAM,eAAe,GAAG,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uBAiGc,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;4BACtB,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA6CnD,CAAC;AACT,CAAC"}

package/dist/src/dashboard/session_cookie.d.ts

@@ -0,0 +1,42 @@
+/** The validated dashboard session attached to a request once its cookie verifies. */
+export interface DashboardSession {
+    /** Stable user id (the session user's `id`). */
+    sub: string;
+    /** Optional display name. */
+    name?: string;
+    /** Free-form role strings; the dashboard does not interpret them. */
+    roles: string[];
+    /** Issued-at, epoch milliseconds. */
+    iat: number;
+    /** Expiry, epoch milliseconds. */
+    exp: number;
+}
+/** The session user the host `login` hook returns to mint a cookie. */
+export interface DashboardSessionUser {
+    id: string;
+    name?: string;
+    roles?: string[];
+}
+export interface SignOptions {
+    secret: string;
+    ttlMs: number;
+    /** Injectable clock (epoch ms) for deterministic tests. Defaults to `Date.now()`. */
+    now?: number;
+}
+export interface VerifyOptions {
+    secret: string;
+    /** Injectable clock (epoch ms) for deterministic tests. Defaults to `Date.now()`. */
+    now?: number;
+}
+/**
+ * Sign a session into the cookie value `base64url(payload).base64url(hmac)`. Stateless
+ * HMAC-SHA256, no store, `node:crypto` only — no JWT dependency.
+ */
+export declare function signSessionCookie(user: DashboardSessionUser, options: SignOptions): string;
+/**
+ * Verify a cookie value and return the session, or `null` for anything that's tampered,
+ * malformed, or expired (past `exp` + a 30s grace). Constant-time signature comparison. NEVER
+ * throws — any parse failure yields `null`.
+ */
+export declare function verifySessionCookie(value: string, options: VerifyOptions): DashboardSession | null;
+//# sourceMappingURL=session_cookie.d.ts.map

package/dist/src/dashboard/session_cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session_cookie.d.ts","sourceRoot":"","sources":["../../../src/dashboard/session_cookie.ts"],"names":[],"mappings":"AAcA,sFAAsF;AACtF,MAAM,WAAW,gBAAgB;IAC/B,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,qCAAqC;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAcD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,WAAW,GAAG,MAAM,CAY1F;AAeD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,gBAAgB,GAAG,IAAI,CA4BzB"}