@adonis-agora/durable 1.0.0-rc.0 → 1.0.0-rc.10

package/dist/assets/spa/index.html

@@ -10,8 +10,8 @@
       rel="stylesheet"
     />
     <title>durable · control plane</title>
-    <script type="module" crossorigin src="/__DURABLE_DASHBOARD__/assets/index-CJjMAUau.js"></script>
-    <link rel="stylesheet" crossorigin href="/__DURABLE_DASHBOARD__/assets/index-70hGzOnT.css">
+    <script type="module" crossorigin src="/__DURABLE_DASHBOARD__/assets/index-Bgf_8IJ0.js"></script>
+    <link rel="stylesheet" crossorigin href="/__DURABLE_DASHBOARD__/assets/index-B2kIfzsc.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/commands/runs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runs.d.ts","sourceRoot":"","sources":["../../commands/runs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAS,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAY/D;;;;;;;;;GASG;AACH,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,WAAW;IAClD,OAAgB,WAAW,SAAkB;IAC7C,OAAgB,WAAW,SAAuC;IAClE,OAAgB,OAAO,EAAE,cAAc,CAAsB;IAKrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAGhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB,KAAK,EAAE,MAAM,CAAC;IAQd,KAAK,CAAC,EAAE,MAAM,CAAC;IAER,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CA0BlC;CACF"}
+{"version":3,"file":"runs.d.ts","sourceRoot":"","sources":["../../commands/runs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAS,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAY/D;;;;;;;;;GASG;AACH,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,WAAW;IAClD,OAAgB,WAAW,SAAkB;IAC7C,OAAgB,WAAW,SAAuC;IAClE,OAAgB,OAAO,EAAE,cAAc,CAAsB;IAKrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAGhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB,KAAK,EAAE,MAAM,CAAC;IAQd,KAAK,CAAC,EAAE,MAAM,CAAC;IAER,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CA4BlC;CACF"}

package/dist/commands/runs.js

@@ -26,10 +26,12 @@ export default class DurableRuns extends BaseCommand {
         const wantsStale = this.stale !== undefined;
         const runs = await listRuns(engine, {
             ...(this.status ? { status: this.status } : {}),
-            // No explicit --status: scope the query to running/suspended, the only statuses a stranded
+            // No explicit --status: scope the query to running/suspended/cancelling, the only statuses a stranded
             // dispatch can show up in, so a stale candidate isn't pushed out of the window by newer
             // terminal runs.
-            ...(!this.status && wantsStale ? { statuses: ['running', 'suspended'] } : {}),
+            ...(!this.status && wantsStale
+                ? { statuses: ['running', 'suspended', 'cancelling'] }
+                : {}),
             ...(this.workflow ? { workflow: this.workflow } : {}),
             limit: this.limit,
         });

package/dist/commands/runs.js.map

@@ -1 +1 @@
-{"version":3,"file":"runs.js","sourceRoot":"","sources":["../../commands/runs.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,QAAQ,EACR,eAAe,EACf,eAAe,EACf,SAAS,GACV,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAkB,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjE;;;;;;;;;GASG;AACH,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,WAAW;IAClD,MAAM,CAAU,WAAW,GAAG,cAAc,CAAC;IAC7C,MAAM,CAAU,WAAW,GAAG,mCAAmC,CAAC;IAClE,MAAM,CAAU,OAAO,GAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAqBpD,KAAK,CAAC,GAAG;QAChB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE;YAClC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,2FAA2F;YAC3F,wFAAwF;YACxF,iBAAiB;YACjB,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,WAAW,CAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEpD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GACf,IAAI,CAAC,KAAK,KAAK,EAAE;YACf,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,gBAAgB,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,KAAK;YAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;CACF;AA3CS;IAHP,KAAK,CAAC,MAAM,CAAC;QACZ,WAAW,EAAE,8EAA8E;KAC5F,CAAC;2CACsB;AAGhB;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;6CAC/B;AAGlB;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;0CACzC;AAQd;IANP,KAAK,CAAC,MAAM,CAAC;QACZ,WAAW,EACT,2FAA2F;YAC3F,6FAA6F;YAC7F,iDAAiD;KACpD,CAAC;0CACqB"}
+{"version":3,"file":"runs.js","sourceRoot":"","sources":["../../commands/runs.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,QAAQ,EACR,eAAe,EACf,eAAe,EACf,SAAS,GACV,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAkB,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjE;;;;;;;;;GASG;AACH,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,WAAW;IAClD,MAAM,CAAU,WAAW,GAAG,cAAc,CAAC;IAC7C,MAAM,CAAU,WAAW,GAAG,mCAAmC,CAAC;IAClE,MAAM,CAAU,OAAO,GAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAqBpD,KAAK,CAAC,GAAG;QAChB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE;YAClC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,sGAAsG;YACtG,wFAAwF;YACxF,iBAAiB;YACjB,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU;gBAC5B,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,YAAY,CAAgB,EAAE;gBACrE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEpD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GACf,IAAI,CAAC,KAAK,KAAK,EAAE;YACf,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,gBAAgB,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,KAAK;YAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;CACF;AA7CS;IAHP,KAAK,CAAC,MAAM,CAAC;QACZ,WAAW,EAAE,8EAA8E;KAC5F,CAAC;2CACsB;AAGhB;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;6CAC/B;AAGlB;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;0CACzC;AAQd;IANP,KAAK,CAAC,MAAM,CAAC;QACZ,WAAW,EACT,2FAA2F;YAC3F,6FAA6F;YAC7F,iDAAiD;KACpD,CAAC;0CACqB"}

package/dist/providers/dashboard_provider.d.ts

@@ -37,15 +37,7 @@ import type { ApplicationService } from '@adonisjs/core/types';
 export default class DashboardProvider {
     protected app: ApplicationService;
     constructor(app: ApplicationService);
-    /** Warn once so a throwing `login`/`session` hook doesn't spam the logs on every failed attempt. */
-    private warnedOnHookThrow;
     private warnedOnAuthorizeThrow;
-    /** Login-attempt timestamps per client address — a simple sliding window (10/min) so a brute
-     *  force can't hammer the host's `login` hook at line rate. In-memory per instance: a cluster
-     *  multiplies the budget by pod count, which still reduces the attack by orders of magnitude. */
-    private readonly loginAttempts;
-    /** True (and reply 429) when this address exhausted its login window. */
-    private loginRateLimited;
     /** SSE connections currently open, per client address (and in total) — see streamRun. */
     private readonly sseByAddress;
     private sseTotal;
@@ -76,43 +68,23 @@ export default class DashboardProvider {
     private streamRun;
     private compatSource;
     private fleetTransport;
-    /**
-     * Mount the built-in `dashboardAuth` endpoints under `basePath`. All are public (no guard): they
-     * create/destroy the session the {@link enforce} guard checks for.
-     *
-     * - `GET  <base>/login`  -> the server-rendered login page (Mode B only).
-     * - `POST <base>/login`  -> verifies credentials via the host `login` hook and mints the cookie.
-     * - `POST <base>/session` -> Mode A: verifies the HOST APP's own auth (off the raw request) via the
-     *    `session` hook and mints the cookie. No body — the hook reads whatever it needs off `request`.
-     *    `204` on success, uniform `401` on denial. Mirrors `@dudousxd/nestjs-durable-dashboard`'s
-     *    `DurableAuthController.session` and `client/console-session.ts`'s `mintDurableConsoleSession`.
-     * - `GET  <base>/logout` -> clears the cookie and redirects to the login page (Mode B) or the
-     *    dashboard root (Mode A only). A plain `GET` (idempotent, only ever destroys the caller's own
-     *    session) so a simple `<a href>` works.
-     */
-    private registerAuthRoutes;
     /** Record one mutating console action (see DashboardAuditEntry). Never throws into the request. */
     private audit;
     /** Route a handler 500's detail to the app logger (the client only ever sees a generic body). */
     private logServerError;
     private warnAuthorizeThrow;
-    private warnHookThrow;
+    /** The once-per-boot warning for a console with no `authorize` (open in dev, 403 in production). */
+    private warnNoAuthorize;
     /**
-     * Run the guards for a dashboard resource. Composes the existing `authorize` hook (bearer
-     * token/custom) with the optional `dashboardAuth` session guard — BOTH must pass:
+     * Run `authorize` for a dashboard resource. On a denial:
      *
-     * 1. `authorize` denies -> the built-in (or host-customised) access-denied PAGE for a `page`
-     *    request, JSON for an `api` request. `reason: 'unauthenticated'` is a `401`
-     *    (`{ error: 'unauthorized' }`); `false`, `{ allowed: false }`, `reason: 'forbidden'` or a
-     *    throwing hook is a `403` (`{ error: 'forbidden' }`). A hook that already answered the request
-     *    (a redirect, a body) keeps its answer.
-     * 2. `dashboardAuth` configured AND no valid session -> for a `page` request, redirect `302` to
-     *    the login page (Mode B) carrying a sanitized `returnTo`, or the `401` "open this console
-     *    from your app" page (Mode A only, no login page to redirect to); for an `api` request, a
-     *    plain `401 { error: 'unauthorized', auth: { modes } }` — the `modes` list lets the SPA's
-     *    client (`durable-client.ts`) decide whether to offer the login page.
+     * - `{ redirectTo }`: a `page` request is redirected there (`302`); an `api` request gets
+     *   `401 { error: 'unauthenticated', redirectTo }`;
+     * - `reason: 'unauthenticated'`: `401` (the access-denied page, or `{ error: 'unauthenticated' }`);
+     * - anything else (`false`, `{ allowed: false }`, a throw): `403` (the access-denied page, or
+     *   `{ error: 'forbidden' }`).
      *
-     * When `dashboardAuth` is unconfigured only step 1 runs.
+     * A hook that already answered the request (a redirect, a body) keeps its answer.
      * Returns `false` (and has already written the response) when the request must short-circuit.
      */
     private enforce;
@@ -123,16 +95,8 @@ export default class DashboardProvider {
      * redirect keeps it; the provider never overwrites a `location` header.
      */
     private denyPage;
-    private readSessionCookie;
-    private writeSessionCookie;
     shutdown(): Promise<void>;
 }
-/**
- * Whether something already answered this request: a redirect (`location` header — the signal the
- * `authorize` contract has always honoured) or a body queued on the response. The body check reads
- * AdonisJS's `response.hasLazyBody` structurally so a plain-object `ctx` double in a unit test
- * (which has neither) still works.
- */
 /** Whether this request can change state (everything but GET/HEAD/OPTIONS). Exported for tests. */
 export declare function isMutatingMethod(ctx: HttpContext): boolean;
 /**
@@ -143,8 +107,10 @@ export declare function isMutatingMethod(ctx: HttpContext): boolean;
  * cross-subdomain POST caller, and strict beats sorry here.
  */
 export declare function crossSiteRequest(ctx: HttpContext): boolean;
-/** Role convention (see enforce): no roles = full access; with roles, mutating needs operator/admin. */
-export declare function sessionCanMutate(session: {
-    roles: string[];
-}): boolean;
+/**
+ * Who a mutating console action is attributed to: the signed-in user (`ctx.auth.user`'s `email`,
+ * `name` or `id`, read structurally — this package does not depend on `@adonisjs/auth`), `'bearer'`
+ * for a caller with an `Authorization` header and no user, else `'anonymous'`.
+ */
+export declare function auditActor(ctx: HttpContext): string;
 //# sourceMappingURL=dashboard_provider.d.ts.map

package/dist/providers/dashboard_provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard_provider.d.ts","sourceRoot":"","sources":["../../providers/dashboard_provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAqB,MAAM,sBAAsB,CAAC;AAiFlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,OAAO,OAAO,iBAAiB;IACxB,SAAS,CAAC,GAAG,EAAE,kBAAkB;IAA7C,YAAsB,GAAG,EAAE,kBAAkB,EAAI;IAEjD,oGAAoG;IACpG,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,sBAAsB,CAAS;IAEvC;;qGAEiG;IACjG,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA+B;IAE7D,yEAAyE;IACzE,OAAO,CAAC,gBAAgB;IAkBxB,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAK;IAErB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAChE,oFAAoF;IACpF,OAAO,CAAC,iBAAiB,CAA6B;IACtD,kGAAkG;IAClG,OAAO,CAAC,gBAAgB,CAAiC;IAEzD,oGAAoG;IACpG,OAAO,CAAC,WAAW;IAIb,IAAI,kBAgBT;YAEa,iBAAiB;IAiB/B,OAAO,CAAC,cAAc;IA+KtB,yEAAyE;IACzE,OAAO,CAAC,iBAAiB;IAgDzB;;;;;;OAMG;YACW,SAAS;YA6CT,YAAY;YAWZ,cAAc;IAQ5B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,kBAAkB;IAyF1B,mGAAmG;IACnG,OAAO,CAAC,KAAK;IAiCb,iGAAiG;YACnF,cAAc;YAWd,kBAAkB;YAQlB,aAAa;IAQ3B;;;;;;;;;;;;;;;;;OAiBG;YACW,OAAO;IA0ErB;;;;;OAKG;YACW,QAAQ;IAuBtB,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,kBAAkB;IAapB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAK9B;CACF;AAED;;;;;GAKG;AACH,mGAAmG;AACnG,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAG1D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAU1D;AAED,wGAAwG;AACxG,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IAAE,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,OAAO,CAMtE"}
+{"version":3,"file":"dashboard_provider.d.ts","sourceRoot":"","sources":["../../providers/dashboard_provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAqB,MAAM,sBAAsB,CAAC;AAuElF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,OAAO,OAAO,iBAAiB;IACxB,SAAS,CAAC,GAAG,EAAE,kBAAkB;IAA7C,YAAsB,GAAG,EAAE,kBAAkB,EAAI;IAEjD,OAAO,CAAC,sBAAsB,CAAS;IAEvC,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAK;IAErB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAChE,oFAAoF;IACpF,OAAO,CAAC,iBAAiB,CAA6B;IACtD,kGAAkG;IAClG,OAAO,CAAC,gBAAgB,CAAiC;IAEzD,oGAAoG;IACpG,OAAO,CAAC,WAAW;IAIb,IAAI,kBAkBT;YAEa,iBAAiB;IAiB/B,OAAO,CAAC,cAAc;IAwKtB,yEAAyE;IACzE,OAAO,CAAC,iBAAiB;IAgDzB;;;;;;OAMG;YACW,SAAS;YA6CT,YAAY;YAWZ,cAAc;IAQ5B,mGAAmG;IACnG,OAAO,CAAC,KAAK;IA2Bb,iGAAiG;YACnF,cAAc;YAWd,kBAAkB;IAQhC,oGAAoG;YACtF,eAAe;IAS7B;;;;;;;;;;;OAWG;YACW,OAAO;IA6CrB;;;;;OAKG;YACW,QAAQ;IAsBhB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAK9B;CACF;AAED,mGAAmG;AACnG,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAG1D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAU1D;AAwBD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,CAUnD"}

package/dist/providers/dashboard_provider.js

@@ -3,13 +3,11 @@ import { basename, resolve as resolvePath } from 'node:path';
 import { PassThrough } from 'node:stream';
 import { fileURLToPath } from 'node:url';
 import { resolveAccessDeniedPage, } from '../src/dashboard/access_denied_page.js';
-import { performLogin, performSession, readSession, SESSION_COOKIE_NAME, sanitizeReturnTo, } from '../src/dashboard/auth.js';
 import { compat, enumerateLiveFleet, mergeFleets, } from '../src/dashboard/compat.js';
-import { isProduction, normalizeAuthorizeResult, resolveConfig, } from '../src/dashboard/define_config.js';
+import { NO_AUTHORIZE_WARNING, resolveConfig, } from '../src/dashboard/define_config.js';
 import { BlockedDiagnosticsRecorder } from '../src/dashboard/diagnostics-recorder.js';
 import { dashboardEngineForRole } from '../src/dashboard/gateway-adapter.js';
 import { bulkAction, cancelRun, completeTaskRun, continueRun, deliverWebhook, failTaskRun, getFanMembers, getRun, getRunEvent, health, listRuns, listSchedules, metricsText, redispatchPendingRun, republishLifecycleRun, retryRun, retryWithInputRun, runValues, scheduleAction, signalRun, topology, updateRun, workers, workflowLifecycle, } from '../src/dashboard/handlers.js';
-import { renderLoginPage } from '../src/dashboard/login_page.js';
 import { openApiDocument } from '../src/dashboard/openapi.js';
 import { contentTypeFor, renderIndexHtml } from '../src/dashboard/spa.js';
 import { WorkflowEngine } from '../src/index.js';
@@ -66,32 +64,7 @@ export default class DashboardProvider {
     constructor(app) {
         this.app = app;
     }
-    /** Warn once so a throwing `login`/`session` hook doesn't spam the logs on every failed attempt. */
-    warnedOnHookThrow = false;
     warnedOnAuthorizeThrow = false;
-    /** Login-attempt timestamps per client address — a simple sliding window (10/min) so a brute
-     *  force can't hammer the host's `login` hook at line rate. In-memory per instance: a cluster
-     *  multiplies the budget by pod count, which still reduces the attack by orders of magnitude. */
-    loginAttempts = new Map();
-    /** True (and reply 429) when this address exhausted its login window. */
-    loginRateLimited(ctx) {
-        const WINDOW_MS = 60_000;
-        const MAX_ATTEMPTS = 10;
-        const key = ctx.request.ip() || 'unknown';
-        const now = Date.now();
-        const recent = (this.loginAttempts.get(key) ?? []).filter((t) => now - t < WINDOW_MS);
-        if (recent.length >= MAX_ATTEMPTS) {
-            this.loginAttempts.set(key, recent);
-            ctx.response.status(429).json({ error: 'too many login attempts — retry in a minute' });
-            return true;
-        }
-        recent.push(now);
-        this.loginAttempts.set(key, recent);
-        // Bounded: prune other addresses opportunistically so the map can't grow without limit.
-        if (this.loginAttempts.size > 10_000)
-            this.loginAttempts.clear();
-        return false;
-    }
     /** SSE connections currently open, per client address (and in total) — see streamRun. */
     sseByAddress = new Map();
     sseTotal = 0;
@@ -110,9 +83,11 @@ export default class DashboardProvider {
         return this.app.config.get('durable', {}).role ?? 'standalone';
     }
     async boot() {
-        const config = resolveConfig(this.app.config.get('durable_dashboard', {}));
+        const config = resolveConfig(this.app.config.get('durable_dashboard', {}), { inProduction: this.app.inProduction });
         if (!config.enabled)
             return;
+        if (!config.authorizeConfigured)
+            await this.warnNoAuthorize();
         const role = this.durableRole();
         // Route registration can't happen synchronously in `boot()` — see the long-standing note this
         // provider always carried: the router singleton isn't committed until the app's "booted" hooks
@@ -153,12 +128,6 @@ export default class DashboardProvider {
             ...(config.redact ? { redact: config.redact } : {}),
             ...(this.metricsCollector ? { metrics: this.metricsCollector } : {}),
         });
-        // Built-in `dashboardAuth` (Mode A `session` and/or Mode B `login`, opt-in). Registered ONLY when
-        // configured, so omitting `dashboardAuth` leaves route registration byte-for-byte as it was. These
-        // endpoints are public (behind NEITHER guard): they MINT the session the guard checks for.
-        if (config.dashboardAuth) {
-            this.registerAuthRoutes(router, config, config.dashboardAuth);
-        }
         this.registerSpaRoutes(router, config, apiBase);
         // JSON API.
         const json = (handler) => {
@@ -424,110 +393,12 @@ export default class DashboardProvider {
             return null;
         }
     }
-    /**
-     * Mount the built-in `dashboardAuth` endpoints under `basePath`. All are public (no guard): they
-     * create/destroy the session the {@link enforce} guard checks for.
-     *
-     * - `GET  <base>/login`  -> the server-rendered login page (Mode B only).
-     * - `POST <base>/login`  -> verifies credentials via the host `login` hook and mints the cookie.
-     * - `POST <base>/session` -> Mode A: verifies the HOST APP's own auth (off the raw request) via the
-     *    `session` hook and mints the cookie. No body — the hook reads whatever it needs off `request`.
-     *    `204` on success, uniform `401` on denial. Mirrors `@dudousxd/nestjs-durable-dashboard`'s
-     *    `DurableAuthController.session` and `client/console-session.ts`'s `mintDurableConsoleSession`.
-     * - `GET  <base>/logout` -> clears the cookie and redirects to the login page (Mode B) or the
-     *    dashboard root (Mode A only). A plain `GET` (idempotent, only ever destroys the caller's own
-     *    session) so a simple `<a href>` works.
-     */
-    registerAuthRoutes(router, config, auth) {
-        const loginPath = `${config.path}/login`;
-        const sessionPath = `${config.path}/session`;
-        const logoutPath = `${config.path}/logout`;
-        if (auth.login) {
-            router
-                .get(loginPath, async (ctx) => {
-                ctx.response.header('content-type', 'text/html; charset=utf-8');
-                ctx.response.header('cache-control', 'no-store, must-revalidate');
-                const qs = ctx.request.qs();
-                const nonce = cspNonce(ctx);
-                return ctx.response.send(renderLoginPage(config.path, {
-                    ...(nonce !== undefined ? { nonce } : {}),
-                    error: qs.error !== undefined,
-                    returnTo: qs.returnTo,
-                }));
-            })
-                .as('durable_dashboard.login.page');
-            // Two callers: the page's own `fetch` (JSON in, JSON out — `{ redirectTo }` / `{ error }`)
-            // and, with JavaScript off or its inline script dropped by a CSP, the same page as a classic
-            // form post (form-encoded in, a redirect out: to `returnTo` on success, back to the login
-            // page with `?error` on failure). Same hook, same cookie, same uniform failure either way.
-            router
-                .post(loginPath, async (ctx) => {
-                if (this.loginRateLimited(ctx))
-                    return;
-                const body = ctx.request.body();
-                const outcome = await performLogin(auth, body, config.path);
-                const form = isFormPost(ctx);
-                const backToLogin = () => ctx.response
-                    .redirect()
-                    .withQs({
-                    error: '1',
-                    returnTo: sanitizeReturnTo(body?.returnTo, config.path || '/'),
-                })
-                    .toPath(loginPath);
-                if (outcome.kind === 'bad-request') {
-                    if (form)
-                        return backToLogin();
-                    return ctx.response.status(400).json({ error: outcome.message });
-                }
-                if (outcome.kind === 'unauthorized') {
-                    void this.warnHookThrow(outcome.hookError).catch(() => undefined);
-                    if (form)
-                        return backToLogin();
-                    return ctx.response.status(401).json({ error: outcome.message });
-                }
-                this.writeSessionCookie(ctx, auth, outcome.cookieValue);
-                if (form)
-                    return ctx.response.redirect().toPath(outcome.redirectTo);
-                return ctx.response.status(200).json({ redirectTo: outcome.redirectTo });
-            })
-                .as('durable_dashboard.login.submit');
-        }
-        if (auth.session) {
-            router
-                .post(sessionPath, async (ctx) => {
-                if (this.loginRateLimited(ctx))
-                    return;
-                const outcome = await performSession(auth, ctx.request.request);
-                if (outcome.kind === 'unauthorized') {
-                    void this.warnHookThrow(outcome.hookError).catch(() => undefined);
-                    return ctx.response.status(401).json({ error: 'unauthorized' });
-                }
-                this.writeSessionCookie(ctx, auth, outcome.cookieValue);
-                return ctx.response.status(204).send('');
-            })
-                .as('durable_dashboard.session.mint');
-        }
-        const logout = async (ctx) => {
-            ctx.response.clearCookie(SESSION_COOKIE_NAME, { path: '/' });
-            return ctx.response.redirect().toPath(auth.login ? loginPath : config.path || '/');
-        };
-        router.get(logoutPath, logout).as('durable_dashboard.logout');
-        // POST too: the CSRF-proof spelling for clients that prefer it (the GET stays for plain <a>
-        // links — it only ever destroys the caller's own session, so a forced logout is an annoyance,
-        // not a compromise).
-        router.post(logoutPath, logout).as('durable_dashboard.logout.post');
-    }
     /** Record one mutating console action (see DashboardAuditEntry). Never throws into the request. */
     audit(config, ctx) {
         try {
-            const auth = config.dashboardAuth;
-            const session = auth ? readSession(auth, this.readSessionCookie(ctx)) : null;
-            const fromToken = ctx.request.header('authorization') !== undefined ||
-                ctx.request.header('x-durable-token') !== undefined;
-            const actor = session?.name ?? session?.sub ?? (fromToken ? 'token' : 'anonymous');
             const entry = {
                 at: new Date(),
-                actor,
+                actor: auditActor(ctx),
                 method: ctx.request.method().toUpperCase(),
                 path: ctx.request.url(false),
             };
@@ -567,95 +438,66 @@ export default class DashboardProvider {
         const logger = await this.app.container.make('logger');
         logger.warn(`[durable_dashboard] authorize hook threw; treating as denial (403). ${message}`);
     }
-    async warnHookThrow(hookError) {
-        if (hookError === undefined || this.warnedOnHookThrow)
-            return;
-        this.warnedOnHookThrow = true;
-        const message = hookError instanceof Error ? hookError.message : String(hookError);
-        const logger = await this.app.container.make('logger');
-        logger.warn(`dashboardAuth login/session hook threw; treating as denial. ${message}`);
+    /** The once-per-boot warning for a console with no `authorize` (open in dev, 403 in production). */
+    async warnNoAuthorize() {
+        try {
+            const logger = await this.app.container.make('logger');
+            logger.warn(NO_AUTHORIZE_WARNING);
+        }
+        catch {
+            console.warn(NO_AUTHORIZE_WARNING);
+        }
     }
     /**
-     * Run the guards for a dashboard resource. Composes the existing `authorize` hook (bearer
-     * token/custom) with the optional `dashboardAuth` session guard — BOTH must pass:
+     * Run `authorize` for a dashboard resource. On a denial:
      *
-     * 1. `authorize` denies -> the built-in (or host-customised) access-denied PAGE for a `page`
-     *    request, JSON for an `api` request. `reason: 'unauthenticated'` is a `401`
-     *    (`{ error: 'unauthorized' }`); `false`, `{ allowed: false }`, `reason: 'forbidden'` or a
-     *    throwing hook is a `403` (`{ error: 'forbidden' }`). A hook that already answered the request
-     *    (a redirect, a body) keeps its answer.
-     * 2. `dashboardAuth` configured AND no valid session -> for a `page` request, redirect `302` to
-     *    the login page (Mode B) carrying a sanitized `returnTo`, or the `401` "open this console
-     *    from your app" page (Mode A only, no login page to redirect to); for an `api` request, a
-     *    plain `401 { error: 'unauthorized', auth: { modes } }` — the `modes` list lets the SPA's
-     *    client (`durable-client.ts`) decide whether to offer the login page.
+     * - `{ redirectTo }`: a `page` request is redirected there (`302`); an `api` request gets
+     *   `401 { error: 'unauthenticated', redirectTo }`;
+     * - `reason: 'unauthenticated'`: `401` (the access-denied page, or `{ error: 'unauthenticated' }`);
+     * - anything else (`false`, `{ allowed: false }`, a throw): `403` (the access-denied page, or
+     *   `{ error: 'forbidden' }`).
      *
-     * When `dashboardAuth` is unconfigured only step 1 runs.
+     * A hook that already answered the request (a redirect, a body) keeps its answer.
      * Returns `false` (and has already written the response) when the request must short-circuit.
      */
     async enforce(config, ctx, mode) {
-        // CSRF defense-in-depth over the Lax session cookie: a browser-originated CROSS-SITE mutating
-        // request is rejected outright, whatever guard would have passed it. The mutating endpoints
-        // need no body and read flags from the query string, so without this a malicious page could
-        // fire them as SIMPLE cross-origin POSTs (no preflight) against a console the operator's
-        // browser is authenticated to. Non-browser clients send neither header and pass.
+        // CSRF defense-in-depth: a browser-originated CROSS-SITE mutating request is rejected outright,
+        // whatever `authorize` would say. The mutating endpoints need no body and read flags from the
+        // query string, so without this a malicious page could fire them as SIMPLE cross-origin POSTs
+        // (no preflight) against a console the operator's browser is signed in to. Non-browser clients
+        // send neither header and pass.
         if (mode === 'api' && isMutatingMethod(ctx) && crossSiteRequest(ctx)) {
             ctx.response.status(403).json({ error: 'cross-site request rejected' });
             return false;
         }
-        // Never test the raw result: a decision OBJECT is truthy, so `{ allowed: false }` would pass a
-        // `!result` check. A throwing hook is a denial (403), never a 500 and never a pass.
-        let decision;
-        try {
-            decision = normalizeAuthorizeResult(await config.authorize(ctx));
-        }
-        catch (error) {
-            void this.warnAuthorizeThrow(error).catch(() => undefined);
-            decision = { allowed: false, reason: 'forbidden' };
-        }
-        if (!decision.allowed) {
-            const unauthenticated = decision.reason === 'unauthenticated';
-            if (mode === 'page') {
-                await this.denyPage(ctx, config, unauthenticated
-                    ? { status: 401, reason: 'unauthenticated' }
-                    : { status: 403, reason: 'forbidden' });
-            }
-            else if (!responseAnswered(ctx)) {
-                ctx.response
-                    .status(unauthenticated ? 401 : 403)
-                    .json({ error: unauthenticated ? 'unauthorized' : 'forbidden' });
-            }
-            return false;
-        }
-        const auth = config.dashboardAuth;
-        if (!auth)
-            return true;
-        const session = readSession(auth, this.readSessionCookie(ctx));
-        if (session) {
-            // Role convention: a session WITHOUT roles keeps full access (back-compat — most host hooks
-            // never set them); a session WITH roles must carry `operator` (or `admin`) to mutate.
-            // Previously every authenticated principal — including a read-only support login — could
-            // bulk-cancel with compensation or fix-and-replay.
-            if (mode === 'api' && isMutatingMethod(ctx) && !sessionCanMutate(session)) {
-                ctx.response
-                    .status(403)
-                    .json({ error: "this session's roles do not include 'operator' (or 'admin')" });
-                return false;
-            }
+        // The resolved gate never throws: a throwing `authorize` comes back as a 403 carrying the error.
+        const decision = await config.authorize(ctx);
+        if (decision.allowed)
             return true;
-        }
+        if (decision.error !== undefined)
+            void this.warnAuthorizeThrow(decision.error).catch(() => undefined);
+        const unauthenticated = decision.reason === 'unauthenticated';
         if (mode === 'page') {
-            if (auth.login) {
-                const returnTo = ctx.request.url(true);
-                ctx.response.redirect().withQs('returnTo', returnTo).toPath(`${config.path}/login`);
+            if (decision.redirectTo !== undefined && !responseAnswered(ctx)) {
+                ctx.response.redirect().toPath(decision.redirectTo);
                 return false;
             }
-            // Mode A only: there's no login page to send the browser to — this deployment expects the
-            // host app to mint a session via `POST <path>/session` before ever navigating here.
-            await this.denyPage(ctx, config, { status: 401, reason: 'session-required' });
+            await this.denyPage(ctx, config, unauthenticated
+                ? { status: 401, reason: 'unauthenticated' }
+                : { status: 403, reason: 'forbidden' });
             return false;
         }
-        ctx.response.status(401).json({ error: 'unauthorized', auth: { modes: auth.modes } });
+        if (responseAnswered(ctx))
+            return false;
+        if (!unauthenticated) {
+            ctx.response.status(403).json({ error: 'forbidden' });
+        }
+        else if (decision.redirectTo !== undefined) {
+            ctx.response.status(401).json({ error: 'unauthenticated', redirectTo: decision.redirectTo });
+        }
+        else {
+            ctx.response.status(401).json({ error: 'unauthenticated' });
+        }
         return false;
     }
     /**
@@ -672,7 +514,6 @@ export default class DashboardProvider {
         const info = {
             ...denial,
             basePath: config.path,
-            ...(config.dashboardAuth?.login ? { loginHref: `${config.path}/login` } : {}),
             ...(nonce !== undefined ? { nonce } : {}),
         };
         const html = await resolveAccessDeniedPage(info, config.accessDenied, ctx, answered);
@@ -684,22 +525,6 @@ export default class DashboardProvider {
             .header('cache-control', 'no-store, must-revalidate')
             .send(html);
     }
-    readSessionCookie(ctx) {
-        const value = ctx.request.plainCookie(SESSION_COOKIE_NAME, undefined, false);
-        return typeof value === 'string' && value !== '' ? value : undefined;
-    }
-    writeSessionCookie(ctx, auth, value) {
-        ctx.response.plainCookie(SESSION_COOKIE_NAME, value, {
-            httpOnly: true,
-            sameSite: 'lax',
-            // Forced on in production even when `request.secure()` reads false (a TLS-terminating proxy
-            // without AdonisJS trustProxy) — exactly the deployments that most need the Secure flag.
-            secure: isProduction() || ctx.request.secure(),
-            path: '/',
-            maxAge: Math.floor(auth.ttlMs / 1000),
-            encode: false,
-        });
-    }
     async shutdown() {
         this.detachDiagnostics?.();
         this.detachDiagnostics = null;
@@ -707,12 +532,6 @@ export default class DashboardProvider {
         this.metricsCollector = null;
     }
 }
-/**
- * Whether something already answered this request: a redirect (`location` header — the signal the
- * `authorize` contract has always honoured) or a body queued on the response. The body check reads
- * AdonisJS's `response.hasLazyBody` structurally so a plain-object `ctx` double in a unit test
- * (which has neither) still works.
- */
 /** Whether this request can change state (everything but GET/HEAD/OPTIONS). Exported for tests. */
 export function isMutatingMethod(ctx) {
     const method = ctx.request.method().toUpperCase();
@@ -739,15 +558,12 @@ export function crossSiteRequest(ctx) {
         return true; // an unparseable Origin is not a browser being honest — reject
     }
 }
-/** Role convention (see enforce): no roles = full access; with roles, mutating needs operator/admin. */
-export function sessionCanMutate(session) {
-    if (session.roles.length === 0)
-        return true;
-    return session.roles.some((r) => {
-        const role = r.toLowerCase();
-        return role === 'operator' || role === 'admin';
-    });
-}
+/**
+ * Whether something already answered this request: a redirect (`location` header — the signal the
+ * `authorize` contract has always honoured) or a body queued on the response. The body check reads
+ * AdonisJS's `response.hasLazyBody` structurally so a plain-object `ctx` double in a unit test
+ * (which has neither) still works.
+ */
 function responseAnswered(ctx) {
     if (ctx.response.getHeader('location'))
         return true;
@@ -764,13 +580,22 @@ function cspNonce(ctx) {
     return typeof nonce === 'string' && nonce !== '' ? nonce : undefined;
 }
 /**
- * Whether a login `POST` came from a classic HTML form submit (form-encoded — JavaScript off, or
- * the page's inline script dropped by a CSP) rather than the page's own JSON `fetch`. Decides
- * whether the reply is a redirect (a browser navigating) or JSON (a script awaiting it).
+ * Who a mutating console action is attributed to: the signed-in user (`ctx.auth.user`'s `email`,
+ * `name` or `id`, read structurally — this package does not depend on `@adonisjs/auth`), `'bearer'`
+ * for a caller with an `Authorization` header and no user, else `'anonymous'`.
  */
-function isFormPost(ctx) {
-    const type = ctx.request.header('content-type') ?? '';
-    return type.includes('application/x-www-form-urlencoded') || type.includes('multipart/form-data');
+export function auditActor(ctx) {
+    const user = ctx.auth?.user;
+    if (user) {
+        for (const key of ['email', 'name', 'id']) {
+            const value = user[key];
+            if (typeof value === 'string' && value !== '')
+                return value;
+            if (typeof value === 'number')
+                return String(value);
+        }
+    }
+    return ctx.request.header('authorization') !== undefined ? 'bearer' : 'anonymous';
 }
 /** Adapt an AdonisJS `HttpContext` to the framework-light {@link ApiRequest}. */
 function toApiRequest(ctx) {