@antseed/cli 0.1.178 → 0.1.180

package/dist/gateway/auth/hardening.test.js

@@ -0,0 +1,155 @@
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, describe, it } from 'node:test';
+import { Wallet } from 'ethers';
+import { createLocalJWKSet, exportJWK, generateKeyPair, SignJWT } from 'jose';
+import { GatewayStore } from '../store.js';
+import { AuthDb, MAX_PENDING_TICKETS, memberWalletAddresses, sessionSignIn, SETUP_TOKEN_TTL_MS, sha256Hex } from './db.js';
+import { clientIp } from './http.js';
+import { startHarness } from './test-helpers.js';
+let harness = null;
+let dataDir = null;
+afterEach(async () => {
+    await harness?.close();
+    harness = null;
+    if (dataDir)
+        rmSync(dataDir, { recursive: true, force: true });
+    dataDir = null;
+});
+function realStore() {
+    dataDir = mkdtempSync(join(tmpdir(), 'antseed-auth-hard-'));
+    const dir = dataDir;
+    return (now) => new GatewayStore(dir, now);
+}
+function bearer(secret) {
+    return { headers: { authorization: `Bearer ${secret}` }, socket: { remoteAddress: '127.0.0.1' } };
+}
+async function cloudflareHarness(extraEnv = {}) {
+    const { privateKey, publicKey } = await generateKeyPair('RS256');
+    const jwks = createLocalJWKSet({ keys: [{ ...(await exportJWK(publicKey)), kid: 'cf1', alg: 'RS256' }] });
+    harness = await startHarness({
+        makeStore: realStore(),
+        env: { ANTSEED_CF_ACCESS_TEAM_DOMAIN: 'myteam.cloudflareaccess.com', ANTSEED_CF_ACCESS_AUD: 'aud-1', ...extraEnv },
+        authOptions: { cloudflareAccessKeys: jwks },
+    });
+    const h = harness;
+    return (email) => new SignJWT({ email }).setProtectedHeader({ alg: 'RS256', kid: 'cf1' })
+        .setIssuer('https://myteam.cloudflareaccess.com').setAudience('aud-1').setSubject(`sub-${email}`)
+        .setIssuedAt(Math.floor(h.clock.now / 1000)).setExpirationTime(Math.floor(h.clock.now / 1000) + 300).sign(privateKey);
+}
+describe('console auth hardening', () => {
+    it('refuses expired management tokens and tokens whose creator lost the admin role', async () => {
+        harness = await startHarness({ makeStore: realStore() });
+        const store = harness.store;
+        const owner = store.createOwner({ label: 'Owner', email: null });
+        const cli = store.createAdminToken({ label: 'cli', scope: 'admin', createdBy: null, expiresAt: null });
+        assert.equal((await harness.auth.authenticate(bearer(cli.secret)))?.kind, 'token');
+        const lapsing = store.createAdminToken({ label: 'lapsing', scope: 'read', createdBy: owner.id, expiresAt: harness.clock.now + 1000 });
+        assert.equal((await harness.auth.authenticate(bearer(lapsing.secret)))?.kind, 'token');
+        harness.clock.now += 1000;
+        assert.equal(await harness.auth.authenticate(bearer(lapsing.secret)), null);
+        const { invite, token } = store.createInvite({ label: 'Adm', email: null, orgRole: 'admin', workspaces: [], expiresAt: harness.clock.now + 60_000, createdBy: owner.id });
+        store.consumeInvite(sha256Hex(token), harness.clock.now);
+        const byAdmin = store.createAdminToken({ label: 'adm', scope: 'admin', createdBy: invite.memberId, expiresAt: null });
+        assert.equal((await harness.auth.authenticate(bearer(byAdmin.secret)))?.kind, 'token');
+        // Demoted without going through the console route (which would also revoke): auth still refuses it.
+        store.updateMember(invite.memberId, { orgRole: 'member' });
+        assert.equal(await harness.auth.authenticate(bearer(byAdmin.secret)), null);
+        store.updateMember(invite.memberId, { orgRole: 'admin' });
+        store.setMemberStatus(invite.memberId, 'disabled');
+        assert.equal(await harness.auth.authenticate(bearer(byAdmin.secret)), null);
+    });
+    it('setup links last one hour', async () => {
+        harness = await startHarness({ makeStore: realStore() });
+        assert.equal(SETUP_TOKEN_TTL_MS, 60 * 60 * 1000);
+        const token = harness.auth.createSetupLink().split('#')[1];
+        harness.clock.now += SETUP_TOKEN_TTL_MS + 1;
+        const setup = await harness.browser().request('POST', '/auth/setup', { token });
+        assert.equal(setup.status, 400);
+        const store = harness.store;
+        assert.deepEqual(store.listAudit({ action: 'auth' }).entries.map((entry) => [entry.action, entry.details['method']]), [['auth.sign_in_failed', 'setup']]);
+    });
+    it('an owner signing in through Cloudflare Access completes setup', async () => {
+        const sign = await cloudflareHarness();
+        const token = harness.auth.createSetupLink().split('#')[1];
+        const setup = await harness.browser().request('POST', '/auth/setup', { token, email: 'owner@acme.example' });
+        assert.equal(setup.status, 200);
+        assert.equal(harness.auth.authConfig().setupRequired, true, 'no credential yet: the setup owner may still re-claim');
+        const me = await harness.browser().request('GET', '/auth/me', undefined, { 'cf-access-jwt-assertion': await sign('owner@acme.example') });
+        assert.equal(me.status, 200, JSON.stringify(me.body));
+        assert.equal(harness.auth.authConfig().setupRequired, false);
+        assert.throws(() => harness.auth.createSetupLink());
+    });
+    it('SSO activates an invited member only while their invite is live', async () => {
+        const sign = await cloudflareHarness();
+        const store = harness.store;
+        store.createOwner({ label: 'Owner', email: null });
+        const lapsed = store.createInvite({ label: 'Late', email: 'late@acme.example', orgRole: 'member', workspaces: [], expiresAt: harness.clock.now + 1000, createdBy: null });
+        harness.clock.now += 2000;
+        const refused = await harness.browser().request('GET', '/auth/me', undefined, { 'cf-access-jwt-assertion': await sign('late@acme.example') });
+        assert.equal(refused.status, 401);
+        assert.equal(store.getMember(lapsed.invite.memberId).status, 'invited');
+        const cancelled = store.createInvite({ label: 'Gone', email: 'gone@acme.example', orgRole: 'member', workspaces: [], expiresAt: harness.clock.now + 60_000, createdBy: null });
+        store.deleteInvite(cancelled.invite.id);
+        assert.equal((await harness.browser().request('GET', '/auth/me', undefined, { 'cf-access-jwt-assertion': await sign('gone@acme.example') })).status, 401);
+        const live = store.createInvite({ label: 'Ok', email: 'ok@acme.example', orgRole: 'member', workspaces: [], expiresAt: harness.clock.now + 60_000, createdBy: null });
+        const me = await harness.browser().request('GET', '/auth/me', undefined, { 'cf-access-jwt-assertion': await sign('ok@acme.example') });
+        assert.equal(me.status, 200, JSON.stringify(me.body));
+        assert.equal(store.getMember(live.invite.memberId).status, 'active');
+        assert.notEqual(store.getInvite(live.invite.id).usedAt, null, 'the invite is consumed');
+    });
+    it('records sign-ins and failed sign-ins, and stamps sessions with their sign-in time', async () => {
+        harness = await startHarness({ makeStore: realStore() });
+        const store = harness.store;
+        store.createOwner({ label: 'Owner', email: null });
+        const wallet = Wallet.createRandom();
+        const invite = store.createInvite({ label: 'Dana', email: null, orgRole: 'member', workspaces: [], expiresAt: harness.clock.now + 60_000, createdBy: null });
+        const browser = harness.browser();
+        const enrollment = (await browser.request('POST', '/auth/invite', { token: invite.token })).body.enrollment;
+        const message = (await browser.request('POST', '/auth/wallet/nonce', { address: wallet.address })).body.message;
+        const signedIn = await browser.request('POST', '/auth/wallet/verify', { message, signature: await wallet.signMessage(message), enrollment });
+        assert.equal(signedIn.status, 200, JSON.stringify(signedIn.body));
+        const other = Wallet.createRandom();
+        const second = (await harness.browser().request('POST', '/auth/wallet/nonce', { address: wallet.address })).body.message;
+        assert.equal((await harness.browser().request('POST', '/auth/wallet/verify', { message: second, signature: await other.signMessage(second) })).status, 401);
+        const entries = store.listAudit({ action: 'auth' }).entries;
+        assert.deepEqual(entries.map((entry) => entry.action), ['auth.sign_in_failed', 'auth.sign_in', 'auth.credential_add', 'auth.invite_accept']);
+        assert.deepEqual(entries[0].details, { method: 'wallet', code: 'bad_signature' });
+        assert.deepEqual(entries[1].actor, { kind: 'member', id: invite.invite.memberId, label: 'Dana' });
+        assert.equal(entries[1].ip, '127.0.0.1');
+        const session = store.database.prepare('SELECT id FROM auth_sessions WHERE member_id = ?').get(invite.invite.memberId);
+        assert.equal(sessionSignIn(store.database, session.id)?.authenticatedAt, harness.clock.now);
+        assert.equal(sessionSignIn(store.database, 'unknown'), null);
+        assert.deepEqual(memberWalletAddresses(store.database, invite.invite.memberId), [wallet.address.toLowerCase()]);
+    });
+    it('caps pending passkey challenges and wallet nonces', () => {
+        const clock = { now: 1_000_000 };
+        const store = realStore()(() => clock.now);
+        try {
+            const db = new AuthDb(store.database, () => clock.now);
+            for (let index = 0; index < MAX_PENDING_TICKETS + 25; index += 1) {
+                clock.now += 1;
+                db.saveChallenge(`challenge-${index}`, 'login', null);
+            }
+            const count = store.database.prepare('SELECT COUNT(*) FROM auth_challenges').pluck().get();
+            assert.equal(count, MAX_PENDING_TICKETS);
+            assert.equal(db.takeChallenge('challenge-0', 'login'), null, 'the oldest went first');
+            assert.notEqual(db.takeChallenge(`challenge-${MAX_PENDING_TICKETS + 24}`, 'login'), null);
+            db.saveWalletNonce('n1', `0x${'ab'.repeat(20)}`, 'msg', clock.now - 1);
+            db.saveWalletNonce('n2', `0x${'ab'.repeat(20)}`, 'msg', clock.now + 1000);
+            assert.equal(store.database.prepare('SELECT COUNT(*) FROM auth_wallet_nonces').pluck().get(), 1, 'expired nonces are swept on insert');
+        }
+        finally {
+            store.close();
+        }
+    });
+    it('believes CF-Connecting-IP only in Cloudflare tunnel mode', () => {
+        const req = (remoteAddress, headers) => ({ socket: { remoteAddress }, headers });
+        assert.equal(clientIp(req('127.0.0.1', { 'cf-connecting-ip': '198.51.100.1' })), '127.0.0.1');
+        assert.equal(clientIp(req('127.0.0.1', { 'cf-connecting-ip': '198.51.100.1' }), { trustCloudflare: true }), '198.51.100.1');
+        assert.equal(clientIp(req('203.0.113.4', { 'cf-connecting-ip': '198.51.100.1' }), { trustCloudflare: true }), '203.0.113.4');
+    });
+});
+//# sourceMappingURL=hardening.test.js.map

package/dist/gateway/auth/hardening.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardening.test.js","sourceRoot":"","sources":["../../../src/gateway/auth/hardening.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAY,MAAM,MAAM,CAAA;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAC1H,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAAE,YAAY,EAAgB,MAAM,mBAAmB,CAAA;AAE9D,IAAI,OAAO,GAAmB,IAAI,CAAA;AAClC,IAAI,OAAO,GAAkB,IAAI,CAAA;AACjC,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,EAAE,KAAK,EAAE,CAAA;IACtB,OAAO,GAAG,IAAI,CAAA;IACd,IAAI,OAAO;QAAE,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9D,OAAO,GAAG,IAAI,CAAA;AAChB,CAAC,CAAC,CAAA;AAEF,SAAS,SAAS;IAChB,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAA;IAC3D,MAAM,GAAG,GAAG,OAAO,CAAA;IACnB,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AAC5C,CAAC;AAED,SAAS,MAAM,CAAC,MAAc;IAC5B,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,EAAW,CAAA;AAC5G,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,WAAmC,EAAE;IACpE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAA;IAChE,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAS,CAAC,EAAE,CAAC,CAAA;IAChH,OAAO,GAAG,MAAM,YAAY,CAAC;QAC3B,SAAS,EAAE,SAAS,EAAE;QACtB,GAAG,EAAE,EAAE,6BAA6B,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,OAAO,EAAE,GAAG,QAAQ,EAAE;QAClH,WAAW,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE;KAC5C,CAAC,CAAA;IACF,MAAM,CAAC,GAAG,OAAO,CAAA;IACjB,OAAO,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SAC9F,SAAS,CAAC,qCAAqC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,OAAO,KAAK,EAAE,CAAC;SAChG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;AACzH,CAAC;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAgC,CAAA;QACtD,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAChE,MAAM,GAAG,GAAG,KAAK,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACtG,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QAElF,MAAM,OAAO,GAAG,KAAK,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC,CAAA;QACrI,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QACtF,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAA;QACzB,MAAM,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;QAE3E,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QACzK,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACxD,MAAM,OAAO,GAAG,KAAK,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACrH,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QACtF,oGAAoG;QACpG,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC1D,MAAM,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;QAC3E,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QACzD,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QAClD,MAAM,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;QACxD,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAA;QAC3D,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,kBAAkB,GAAG,CAAC,CAAA;QAC3C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/E,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAgC,CAAA;QACtD,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;IAC3J,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,OAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAA;QAC5D,MAAM,KAAK,GAAG,MAAM,OAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAA;QAC7G,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC/B,MAAM,CAAC,KAAK,CAAC,OAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,uDAAuD,CAAC,CAAA;QACrH,MAAM,EAAE,GAAG,MAAM,OAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,yBAAyB,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAA;QAC1I,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QACrD,MAAM,CAAC,KAAK,CAAC,OAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;QAC7D,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,OAAQ,CAAC,KAAgC,CAAA;QACvD,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAClD,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,OAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC1K,OAAQ,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAA;QAC1B,MAAM,OAAO,GAAG,MAAM,OAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,yBAAyB,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAA;QAC9I,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACjC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAExE,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,OAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/K,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACvC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,yBAAyB,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAE1J,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,OAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACtK,MAAM,EAAE,GAAG,MAAM,OAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,yBAAyB,EAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAA;QACvI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QACrD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACrE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAE,CAAC,MAAM,EAAE,IAAI,EAAE,wBAAwB,CAAC,CAAA;IAC1F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAgC,CAAA;QACtD,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE,CAAA;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5J,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QACjC,MAAM,UAAU,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAA;QAC3G,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAA;QAC/G,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;QAC5I,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;QAEjE,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,EAAE,CAAA;QACnC,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAA;QACxH,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAE3J,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAA;QAC3D,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,qBAAqB,EAAE,cAAc,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,CAAC,CAAA;QAC5I,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAA;QAClF,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QAClG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;QAEzC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAmB,CAAA;QACxI,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC3F,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,CAAA;QAC5D,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IACjH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAA;QAChC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC1C,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACtD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,mBAAmB,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;gBACjE,KAAK,CAAC,GAAG,IAAI,CAAC,CAAA;gBACd,EAAE,CAAC,aAAa,CAAC,aAAa,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;YACvD,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,EAAY,CAAA;YACpG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAA;YACxC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAA;YACrF,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,aAAa,CAAC,aAAa,mBAAmB,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAA;YACzF,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;YACtE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAA;YACzE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,oCAAoC,CAAC,CAAA;QACxI,CAAC;gBAAS,CAAC;YACT,KAAK,CAAC,KAAK,EAAE,CAAA;QACf,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,GAAG,GAAG,CAAC,aAAqB,EAAE,OAA+B,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,CAAU,CAAA;QACzH,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,cAAc,EAAE,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;QAC7F,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,EAAE,cAAc,CAAC,CAAA;QAC3H,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,kBAAkB,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,EAAE,aAAa,CAAC,CAAA;IAC9H,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/gateway/auth/http.d.ts

@@ -0,0 +1,53 @@
+import type * as http from 'node:http';
+import { type ConsoleResponse } from '../console-api/router.js';
+export declare const SESSION_COOKIE = "antseed_console";
+export declare const OIDC_STATE_COOKIE = "antseed_console_oidc";
+export declare function isLoopbackAddress(address: string | undefined | null): boolean;
+/**
+ * Client address for rate limiting, session records and the audit log.
+ * Forwarding headers are trusted only from a loopback peer (Caddy /
+ * cloudflared on the same host); from anyone else they are
+ * client-controlled. `CF-Connecting-IP` additionally needs `trustCloudflare`
+ * (the gateway runs behind its own Cloudflare tunnel, which overwrites it):
+ * behind Caddy or ngrok a client could set it to anything.
+ */
+export declare function clientIp(req: http.IncomingMessage, options?: {
+    trustCloudflare?: boolean;
+}): string;
+export declare function headerValue(req: http.IncomingMessage, name: string): string | null;
+/** Where the browser thinks it is: from publicUrl when set, else the request's Host (loopback peers only). */
+export declare function requestOrigin(req: http.IncomingMessage, publicUrl: string | null): {
+    origin: string;
+    hostname: string;
+    host: string;
+} | null;
+export declare function readCookie(req: http.IncomingMessage, name: string): string | null;
+export declare function serializeCookie(req: http.IncomingMessage, name: string, value: string, options: {
+    maxAgeSeconds: number;
+    path: string;
+    sameSite: 'Strict' | 'Lax';
+}): string;
+export declare function appendSetCookie(res: http.ServerResponse, cookie: string): void;
+export declare function isIpHostname(hostname: string): boolean;
+interface Window {
+    limit: number;
+    ms: number;
+}
+/**
+ * Fixed-window counters per bucket (an IP or an account). In memory: limits
+ * reset on restart, which is fine for slowing down guessing.
+ */
+export declare class RateLimiter {
+    private readonly _windows;
+    private readonly _now;
+    private readonly _hits;
+    private _lastSweep;
+    constructor(_windows: readonly Window[], _now: () => number);
+    /** Records a hit; returns seconds to wait when any window is exhausted. */
+    hit(bucket: string): number | null;
+    private _sweep;
+}
+export declare function rateLimited(retryAfterSeconds: number): ConsoleResponse;
+export declare function redirect(res: http.ServerResponse, location: string): undefined;
+export {};
+//# sourceMappingURL=http.d.ts.map

package/dist/gateway/auth/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/gateway/auth/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAA;AAGtC,OAAO,EAAW,KAAK,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAExE,eAAO,MAAM,cAAc,oBAAoB,CAAA;AAC/C,eAAO,MAAM,iBAAiB,yBAAyB,CAAA;AAEvD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAI7E;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,GAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,CAcvG;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIlF;AAED,8GAA8G;AAC9G,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAe5I;AAoBD,wBAAgB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYjF;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,QAAQ,GAAG,KAAK,CAAA;CAAE,GAAG,MAAM,CAI5K;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAM9E;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,UAAU,MAAM;IACd,KAAK,EAAE,MAAM,CAAA;IACb,EAAE,EAAE,MAAM,CAAA;CACX;AAED;;;GAGG;AACH,qBAAa,WAAW;IAIV,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAAqB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAH/E,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4D;IAClF,OAAO,CAAC,UAAU,CAAI;gBAEO,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAmB,IAAI,EAAE,MAAM,MAAM;IAE7F,2EAA2E;IAC3E,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAiBlC,OAAO,CAAC,MAAM;CAQf;AAED,wBAAgB,WAAW,CAAC,iBAAiB,EAAE,MAAM,GAAG,eAAe,CAItE;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,CAM9E"}

package/dist/gateway/auth/http.js

@@ -0,0 +1,165 @@
+import { isIP } from 'node:net';
+import { respond } from '../console-api/router.js';
+export const SESSION_COOKIE = 'antseed_console';
+export const OIDC_STATE_COOKIE = 'antseed_console_oidc';
+export function isLoopbackAddress(address) {
+    if (!address)
+        return false;
+    const normalized = address.startsWith('::ffff:') ? address.slice(7) : address;
+    return normalized === '::1' || normalized.startsWith('127.');
+}
+/**
+ * Client address for rate limiting, session records and the audit log.
+ * Forwarding headers are trusted only from a loopback peer (Caddy /
+ * cloudflared on the same host); from anyone else they are
+ * client-controlled. `CF-Connecting-IP` additionally needs `trustCloudflare`
+ * (the gateway runs behind its own Cloudflare tunnel, which overwrites it):
+ * behind Caddy or ngrok a client could set it to anything.
+ */
+export function clientIp(req, options = {}) {
+    const peer = req.socket?.remoteAddress ?? 'unknown';
+    if (!isLoopbackAddress(peer))
+        return peer;
+    if (options.trustCloudflare) {
+        const cf = headerValue(req, 'cf-connecting-ip');
+        if (cf && isIP(cf))
+            return cf;
+    }
+    const forwarded = headerValue(req, 'x-forwarded-for');
+    if (forwarded) {
+        // The local proxy appends the address it saw, so the last entry is the one we can trust.
+        const last = forwarded.split(',').map((part) => part.trim()).filter(Boolean).pop();
+        if (last && isIP(last))
+            return last;
+    }
+    return peer;
+}
+export function headerValue(req, name) {
+    const value = req.headers[name];
+    if (Array.isArray(value))
+        return value[0] ?? null;
+    return value ?? null;
+}
+/** Where the browser thinks it is: from publicUrl when set, else the request's Host (loopback peers only). */
+export function requestOrigin(req, publicUrl) {
+    if (publicUrl) {
+        const url = new URL(publicUrl);
+        return { origin: url.origin, hostname: url.hostname, host: url.host };
+    }
+    if (!isLoopbackAddress(req.socket.remoteAddress))
+        return null;
+    const host = headerValue(req, 'host');
+    if (!host)
+        return null;
+    let url;
+    try {
+        url = new URL(`${isEncrypted(req) || forwardedHttps(req) ? 'https' : 'http'}://${host}`);
+    }
+    catch {
+        return null;
+    }
+    return { origin: url.origin, hostname: url.hostname, host: url.host };
+}
+function isEncrypted(req) {
+    return Boolean(req.socket.encrypted);
+}
+function forwardedHttps(req) {
+    return isLoopbackAddress(req.socket.remoteAddress) && headerValue(req, 'x-forwarded-proto')?.split(',')[0]?.trim() === 'https';
+}
+/**
+ * Cookies are `Secure` when the browser reached the console over https,
+ * directly or through a local proxy. On plain http (localhost, or a LAN
+ * address with `--host 0.0.0.0`) browsers drop `Secure` cookies, so sign-in
+ * could never stick.
+ */
+function isHttpsRequest(req) {
+    return isEncrypted(req) || forwardedHttps(req);
+}
+export function readCookie(req, name) {
+    const header = headerValue(req, 'cookie');
+    if (!header)
+        return null;
+    for (const part of header.split(';')) {
+        const index = part.indexOf('=');
+        if (index < 0)
+            continue;
+        if (part.slice(0, index).trim() === name) {
+            const value = part.slice(index + 1).trim();
+            return value.length > 0 ? value : null;
+        }
+    }
+    return null;
+}
+export function serializeCookie(req, name, value, options) {
+    const parts = [`${name}=${value}`, 'HttpOnly', `SameSite=${options.sameSite}`, `Path=${options.path}`, `Max-Age=${options.maxAgeSeconds}`];
+    if (isHttpsRequest(req))
+        parts.push('Secure');
+    return parts.join('; ');
+}
+export function appendSetCookie(res, cookie) {
+    const existing = res.getHeader('set-cookie');
+    let list = [];
+    if (Array.isArray(existing))
+        list = existing;
+    else if (existing !== undefined)
+        list = [String(existing)];
+    res.setHeader('set-cookie', [...list, cookie]);
+}
+export function isIpHostname(hostname) {
+    return isIP(hostname.replace(/^\[|\]$/g, '')) !== 0;
+}
+/**
+ * Fixed-window counters per bucket (an IP or an account). In memory: limits
+ * reset on restart, which is fine for slowing down guessing.
+ */
+export class RateLimiter {
+    _windows;
+    _now;
+    _hits = new Map();
+    _lastSweep = 0;
+    constructor(_windows, _now) {
+        this._windows = _windows;
+        this._now = _now;
+    }
+    /** Records a hit; returns seconds to wait when any window is exhausted. */
+    hit(bucket) {
+        const now = this._now();
+        this._sweep(now);
+        let retryAfterMs = 0;
+        for (const window of this._windows) {
+            const key = `${window.ms}:${bucket}`;
+            let entry = this._hits.get(key);
+            if (!entry || now - entry.windowStart >= window.ms) {
+                entry = { windowStart: now, count: 0 };
+                this._hits.set(key, entry);
+            }
+            entry.count += 1;
+            if (entry.count > window.limit)
+                retryAfterMs = Math.max(retryAfterMs, entry.windowStart + window.ms - now);
+        }
+        return retryAfterMs > 0 ? Math.max(1, Math.ceil(retryAfterMs / 1000)) : null;
+    }
+    _sweep(now) {
+        if (now - this._lastSweep < 60_000)
+            return;
+        this._lastSweep = now;
+        const longest = Math.max(...this._windows.map((window) => window.ms));
+        for (const [key, entry] of this._hits) {
+            if (now - entry.windowStart >= longest)
+                this._hits.delete(key);
+        }
+    }
+}
+export function rateLimited(retryAfterSeconds) {
+    return respond(429, { error: { code: 'rate_limited', message: `Too many attempts. Try again in ${retryAfterSeconds} s.` } }, {
+        headers: { 'retry-after': String(retryAfterSeconds) },
+    });
+}
+export function redirect(res, location) {
+    res.statusCode = 302;
+    res.setHeader('location', location);
+    res.setHeader('cache-control', 'no-store');
+    res.end();
+    return undefined;
+}
+//# sourceMappingURL=http.js.map

package/dist/gateway/auth/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/gateway/auth/http.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE/B,OAAO,EAAE,OAAO,EAAwB,MAAM,0BAA0B,CAAA;AAExE,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAA;AAC/C,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAA;AAEvD,MAAM,UAAU,iBAAiB,CAAC,OAAkC;IAClE,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAC1B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IAC7E,OAAO,UAAU,KAAK,KAAK,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAyB,EAAE,UAAyC,EAAE;IAC7F,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,SAAS,CAAA;IACnD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACzC,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;QAC/C,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,CAAA;IAC/B,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAA;IACrD,IAAI,SAAS,EAAE,CAAC;QACd,yFAAyF;QACzF,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAA;QAClF,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;IACrC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAyB,EAAE,IAAY;IACjE,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IACjD,OAAO,KAAK,IAAI,IAAI,CAAA;AACtB,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,aAAa,CAAC,GAAyB,EAAE,SAAwB;IAC/E,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAA;QAC9B,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAA;IACvE,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7D,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAA;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAA;AACvE,CAAC;AAED,SAAS,WAAW,CAAC,GAAyB;IAC5C,OAAO,OAAO,CAAE,GAAG,CAAC,MAAoB,CAAC,SAAS,CAAC,CAAA;AACrD,CAAC;AAED,SAAS,cAAc,CAAC,GAAyB;IAC/C,OAAO,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,mBAAmB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,OAAO,CAAA;AAChI,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,GAAyB;IAC/C,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAyB,EAAE,IAAY;IAChE,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,KAAK,GAAG,CAAC;YAAE,SAAQ;QACvB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAC1C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;QACxC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAyB,EAAE,IAAY,EAAE,KAAa,EAAE,OAA4E;IAClK,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,OAAO,CAAC,QAAQ,EAAE,EAAE,QAAQ,OAAO,CAAC,IAAI,EAAE,EAAE,WAAW,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;IAC1I,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAwB,EAAE,MAAc;IACtE,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;IAC5C,IAAI,IAAI,GAAa,EAAE,CAAA;IACvB,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,IAAI,GAAG,QAAQ,CAAA;SACvC,IAAI,QAAQ,KAAK,SAAS;QAAE,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC1D,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;AACrD,CAAC;AAOD;;;GAGG;AACH,MAAM,OAAO,WAAW;IAIO;IAA8C;IAH1D,KAAK,GAAG,IAAI,GAAG,EAAkD,CAAA;IAC1E,UAAU,GAAG,CAAC,CAAA;IAEtB,YAA6B,QAA2B,EAAmB,IAAkB;QAAhE,aAAQ,GAAR,QAAQ,CAAmB;QAAmB,SAAI,GAAJ,IAAI,CAAc;IAAG,CAAC;IAEjG,2EAA2E;IAC3E,GAAG,CAAC,MAAc;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAChB,IAAI,YAAY,GAAG,CAAC,CAAA;QACpB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,EAAE,IAAI,MAAM,EAAE,CAAA;YACpC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC/B,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACnD,KAAK,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;gBACtC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAC5B,CAAC;YACD,KAAK,CAAC,KAAK,IAAI,CAAC,CAAA;YAChB,IAAI,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK;gBAAE,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,EAAE,GAAG,GAAG,CAAC,CAAA;QAC5G,CAAC;QACD,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9E,CAAC;IAEO,MAAM,CAAC,GAAW;QACxB,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,GAAG,MAAM;YAAE,OAAM;QAC1C,IAAI,CAAC,UAAU,GAAG,GAAG,CAAA;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;QACrE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACtC,IAAI,GAAG,GAAG,KAAK,CAAC,WAAW,IAAI,OAAO;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAChE,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,WAAW,CAAC,iBAAyB;IACnD,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,mCAAmC,iBAAiB,KAAK,EAAE,EAAE,EAAE;QAC3H,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE;KACtD,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAwB,EAAE,QAAgB;IACjE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;IACpB,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IACnC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;IAC1C,GAAG,CAAC,GAAG,EAAE,CAAA;IACT,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/gateway/auth/index.d.ts

@@ -0,0 +1,26 @@
+import type * as http from 'node:http';
+import { type ConsoleAuth, type ConsoleRequest, type Principal } from '../console-api/router.js';
+import type { AuthConfig, Member } from '../console-api/types.js';
+import type { AuthDeps, ConsoleAuthOptions } from './types.js';
+export type { AuthDeps, AuthKey, AuthMember, AuthStore, ConsoleAuthOptions, NewAuthMember } from './types.js';
+export interface ConsoleAuthService extends ConsoleAuth {
+    /** Single-use owner setup link (publicUrl, else http://localhost:<port>); throws once the console has been claimed. */
+    createSetupLink(): string;
+    /** The gateway's listen port, for setup links when there is no publicUrl. */
+    setGatewayPort(port: number): void;
+    /** Without a request (e.g. `GET /settings`), passkey availability is judged from publicUrl alone. */
+    authConfig(req?: http.IncomingMessage): AuthConfig;
+    /** A member's sign-in methods in the console's `Member.credentials` shape. */
+    credentialsFor(memberId: string): Member['credentials'];
+    /**
+     * Removes one sign-in method (DELETE /members/:id/credentials/:credentialId)
+     * and ends the member's sessions, except `keepSessionId` (the caller's own).
+     */
+    deleteCredential(memberId: string, credentialId: string, keepSessionId?: string | null): boolean;
+    /** A short-lived ticket for registering a sign-in method for `memberId` (recovery links). */
+    createEnrollment(memberId: string): string;
+    /** Refuses (403 `reauth_required`) unless the member's sign-in is recent; for sensitive changes to their own account. */
+    requireFreshSignIn(request: ConsoleRequest, principal: Principal | null): Promise<void>;
+}
+export declare function createConsoleAuth(deps: AuthDeps, options?: ConsoleAuthOptions): ConsoleAuthService;
+//# sourceMappingURL=index.d.ts.map

package/dist/gateway/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/gateway/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAA;AActC,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,cAAc,EAGnB,KAAK,SAAS,EACf,MAAM,0BAA0B,CAAA;AACjC,OAAO,KAAK,EAAU,UAAU,EAAc,MAAM,EAA2E,MAAM,yBAAyB,CAAA;AAmC9J,OAAO,KAAK,EAAE,QAAQ,EAAuB,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAGnF,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAO7G,MAAM,WAAW,kBAAmB,SAAQ,WAAW;IACrD,uHAAuH;IACvH,eAAe,IAAI,MAAM,CAAA;IACzB,6EAA6E;IAC7E,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,qGAAqG;IACrG,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,eAAe,GAAG,UAAU,CAAA;IAClD,8EAA8E;IAC9E,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;IACvD;;;OAGG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAA;IAChG,6FAA6F;IAC7F,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAA;IAC1C,yHAAyH;IACzH,kBAAkB,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACxF;AAID,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAE,kBAAuB,GAAG,kBAAkB,CA65BtG"}