@antseed/cli 0.1.179 → 0.1.181

package/dist/gateway/auth/http.d.ts

@@ -0,0 +1,53 @@
+import type * as http from 'node:http';
+import { type ConsoleResponse } from '../console-api/router.js';
+export declare const SESSION_COOKIE = "antseed_console";
+export declare const OIDC_STATE_COOKIE = "antseed_console_oidc";
+export declare function isLoopbackAddress(address: string | undefined | null): boolean;
+/**
+ * Client address for rate limiting, session records and the audit log.
+ * Forwarding headers are trusted only from a loopback peer (Caddy /
+ * cloudflared on the same host); from anyone else they are
+ * client-controlled. `CF-Connecting-IP` additionally needs `trustCloudflare`
+ * (the gateway runs behind its own Cloudflare tunnel, which overwrites it):
+ * behind Caddy or ngrok a client could set it to anything.
+ */
+export declare function clientIp(req: http.IncomingMessage, options?: {
+    trustCloudflare?: boolean;
+}): string;
+export declare function headerValue(req: http.IncomingMessage, name: string): string | null;
+/** Where the browser thinks it is: from publicUrl when set, else the request's Host (loopback peers only). */
+export declare function requestOrigin(req: http.IncomingMessage, publicUrl: string | null): {
+    origin: string;
+    hostname: string;
+    host: string;
+} | null;
+export declare function readCookie(req: http.IncomingMessage, name: string): string | null;
+export declare function serializeCookie(req: http.IncomingMessage, name: string, value: string, options: {
+    maxAgeSeconds: number;
+    path: string;
+    sameSite: 'Strict' | 'Lax';
+}): string;
+export declare function appendSetCookie(res: http.ServerResponse, cookie: string): void;
+export declare function isIpHostname(hostname: string): boolean;
+interface Window {
+    limit: number;
+    ms: number;
+}
+/**
+ * Fixed-window counters per bucket (an IP or an account). In memory: limits
+ * reset on restart, which is fine for slowing down guessing.
+ */
+export declare class RateLimiter {
+    private readonly _windows;
+    private readonly _now;
+    private readonly _hits;
+    private _lastSweep;
+    constructor(_windows: readonly Window[], _now: () => number);
+    /** Records a hit; returns seconds to wait when any window is exhausted. */
+    hit(bucket: string): number | null;
+    private _sweep;
+}
+export declare function rateLimited(retryAfterSeconds: number): ConsoleResponse;
+export declare function redirect(res: http.ServerResponse, location: string): undefined;
+export {};
+//# sourceMappingURL=http.d.ts.map

package/dist/gateway/auth/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/gateway/auth/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAA;AAGtC,OAAO,EAAW,KAAK,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAExE,eAAO,MAAM,cAAc,oBAAoB,CAAA;AAC/C,eAAO,MAAM,iBAAiB,yBAAyB,CAAA;AAEvD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAI7E;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,GAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,CAcvG;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIlF;AAED,8GAA8G;AAC9G,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAe5I;AAoBD,wBAAgB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYjF;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,QAAQ,GAAG,KAAK,CAAA;CAAE,GAAG,MAAM,CAI5K;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAM9E;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,UAAU,MAAM;IACd,KAAK,EAAE,MAAM,CAAA;IACb,EAAE,EAAE,MAAM,CAAA;CACX;AAED;;;GAGG;AACH,qBAAa,WAAW;IAIV,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAAqB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAH/E,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4D;IAClF,OAAO,CAAC,UAAU,CAAI;gBAEO,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAmB,IAAI,EAAE,MAAM,MAAM;IAE7F,2EAA2E;IAC3E,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAiBlC,OAAO,CAAC,MAAM;CAQf;AAED,wBAAgB,WAAW,CAAC,iBAAiB,EAAE,MAAM,GAAG,eAAe,CAItE;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,CAM9E"}

package/dist/gateway/auth/http.js

@@ -0,0 +1,165 @@
+import { isIP } from 'node:net';
+import { respond } from '../console-api/router.js';
+export const SESSION_COOKIE = 'antseed_console';
+export const OIDC_STATE_COOKIE = 'antseed_console_oidc';
+export function isLoopbackAddress(address) {
+    if (!address)
+        return false;
+    const normalized = address.startsWith('::ffff:') ? address.slice(7) : address;
+    return normalized === '::1' || normalized.startsWith('127.');
+}
+/**
+ * Client address for rate limiting, session records and the audit log.
+ * Forwarding headers are trusted only from a loopback peer (Caddy /
+ * cloudflared on the same host); from anyone else they are
+ * client-controlled. `CF-Connecting-IP` additionally needs `trustCloudflare`
+ * (the gateway runs behind its own Cloudflare tunnel, which overwrites it):
+ * behind Caddy or ngrok a client could set it to anything.
+ */
+export function clientIp(req, options = {}) {
+    const peer = req.socket?.remoteAddress ?? 'unknown';
+    if (!isLoopbackAddress(peer))
+        return peer;
+    if (options.trustCloudflare) {
+        const cf = headerValue(req, 'cf-connecting-ip');
+        if (cf && isIP(cf))
+            return cf;
+    }
+    const forwarded = headerValue(req, 'x-forwarded-for');
+    if (forwarded) {
+        // The local proxy appends the address it saw, so the last entry is the one we can trust.
+        const last = forwarded.split(',').map((part) => part.trim()).filter(Boolean).pop();
+        if (last && isIP(last))
+            return last;
+    }
+    return peer;
+}
+export function headerValue(req, name) {
+    const value = req.headers[name];
+    if (Array.isArray(value))
+        return value[0] ?? null;
+    return value ?? null;
+}
+/** Where the browser thinks it is: from publicUrl when set, else the request's Host (loopback peers only). */
+export function requestOrigin(req, publicUrl) {
+    if (publicUrl) {
+        const url = new URL(publicUrl);
+        return { origin: url.origin, hostname: url.hostname, host: url.host };
+    }
+    if (!isLoopbackAddress(req.socket.remoteAddress))
+        return null;
+    const host = headerValue(req, 'host');
+    if (!host)
+        return null;
+    let url;
+    try {
+        url = new URL(`${isEncrypted(req) || forwardedHttps(req) ? 'https' : 'http'}://${host}`);
+    }
+    catch {
+        return null;
+    }
+    return { origin: url.origin, hostname: url.hostname, host: url.host };
+}
+function isEncrypted(req) {
+    return Boolean(req.socket.encrypted);
+}
+function forwardedHttps(req) {
+    return isLoopbackAddress(req.socket.remoteAddress) && headerValue(req, 'x-forwarded-proto')?.split(',')[0]?.trim() === 'https';
+}
+/**
+ * Cookies are `Secure` when the browser reached the console over https,
+ * directly or through a local proxy. On plain http (localhost, or a LAN
+ * address with `--host 0.0.0.0`) browsers drop `Secure` cookies, so sign-in
+ * could never stick.
+ */
+function isHttpsRequest(req) {
+    return isEncrypted(req) || forwardedHttps(req);
+}
+export function readCookie(req, name) {
+    const header = headerValue(req, 'cookie');
+    if (!header)
+        return null;
+    for (const part of header.split(';')) {
+        const index = part.indexOf('=');
+        if (index < 0)
+            continue;
+        if (part.slice(0, index).trim() === name) {
+            const value = part.slice(index + 1).trim();
+            return value.length > 0 ? value : null;
+        }
+    }
+    return null;
+}
+export function serializeCookie(req, name, value, options) {
+    const parts = [`${name}=${value}`, 'HttpOnly', `SameSite=${options.sameSite}`, `Path=${options.path}`, `Max-Age=${options.maxAgeSeconds}`];
+    if (isHttpsRequest(req))
+        parts.push('Secure');
+    return parts.join('; ');
+}
+export function appendSetCookie(res, cookie) {
+    const existing = res.getHeader('set-cookie');
+    let list = [];
+    if (Array.isArray(existing))
+        list = existing;
+    else if (existing !== undefined)
+        list = [String(existing)];
+    res.setHeader('set-cookie', [...list, cookie]);
+}
+export function isIpHostname(hostname) {
+    return isIP(hostname.replace(/^\[|\]$/g, '')) !== 0;
+}
+/**
+ * Fixed-window counters per bucket (an IP or an account). In memory: limits
+ * reset on restart, which is fine for slowing down guessing.
+ */
+export class RateLimiter {
+    _windows;
+    _now;
+    _hits = new Map();
+    _lastSweep = 0;
+    constructor(_windows, _now) {
+        this._windows = _windows;
+        this._now = _now;
+    }
+    /** Records a hit; returns seconds to wait when any window is exhausted. */
+    hit(bucket) {
+        const now = this._now();
+        this._sweep(now);
+        let retryAfterMs = 0;
+        for (const window of this._windows) {
+            const key = `${window.ms}:${bucket}`;
+            let entry = this._hits.get(key);
+            if (!entry || now - entry.windowStart >= window.ms) {
+                entry = { windowStart: now, count: 0 };
+                this._hits.set(key, entry);
+            }
+            entry.count += 1;
+            if (entry.count > window.limit)
+                retryAfterMs = Math.max(retryAfterMs, entry.windowStart + window.ms - now);
+        }
+        return retryAfterMs > 0 ? Math.max(1, Math.ceil(retryAfterMs / 1000)) : null;
+    }
+    _sweep(now) {
+        if (now - this._lastSweep < 60_000)
+            return;
+        this._lastSweep = now;
+        const longest = Math.max(...this._windows.map((window) => window.ms));
+        for (const [key, entry] of this._hits) {
+            if (now - entry.windowStart >= longest)
+                this._hits.delete(key);
+        }
+    }
+}
+export function rateLimited(retryAfterSeconds) {
+    return respond(429, { error: { code: 'rate_limited', message: `Too many attempts. Try again in ${retryAfterSeconds} s.` } }, {
+        headers: { 'retry-after': String(retryAfterSeconds) },
+    });
+}
+export function redirect(res, location) {
+    res.statusCode = 302;
+    res.setHeader('location', location);
+    res.setHeader('cache-control', 'no-store');
+    res.end();
+    return undefined;
+}
+//# sourceMappingURL=http.js.map

package/dist/gateway/auth/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/gateway/auth/http.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE/B,OAAO,EAAE,OAAO,EAAwB,MAAM,0BAA0B,CAAA;AAExE,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAA;AAC/C,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAA;AAEvD,MAAM,UAAU,iBAAiB,CAAC,OAAkC;IAClE,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAC1B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IAC7E,OAAO,UAAU,KAAK,KAAK,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAyB,EAAE,UAAyC,EAAE;IAC7F,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,SAAS,CAAA;IACnD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACzC,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;QAC/C,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,CAAA;IAC/B,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAA;IACrD,IAAI,SAAS,EAAE,CAAC;QACd,yFAAyF;QACzF,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAA;QAClF,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;IACrC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAyB,EAAE,IAAY;IACjE,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IACjD,OAAO,KAAK,IAAI,IAAI,CAAA;AACtB,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,aAAa,CAAC,GAAyB,EAAE,SAAwB;IAC/E,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAA;QAC9B,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAA;IACvE,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7D,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAA;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAA;AACvE,CAAC;AAED,SAAS,WAAW,CAAC,GAAyB;IAC5C,OAAO,OAAO,CAAE,GAAG,CAAC,MAAoB,CAAC,SAAS,CAAC,CAAA;AACrD,CAAC;AAED,SAAS,cAAc,CAAC,GAAyB;IAC/C,OAAO,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,mBAAmB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,OAAO,CAAA;AAChI,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,GAAyB;IAC/C,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAyB,EAAE,IAAY;IAChE,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,KAAK,GAAG,CAAC;YAAE,SAAQ;QACvB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAC1C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;QACxC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAyB,EAAE,IAAY,EAAE,KAAa,EAAE,OAA4E;IAClK,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,OAAO,CAAC,QAAQ,EAAE,EAAE,QAAQ,OAAO,CAAC,IAAI,EAAE,EAAE,WAAW,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;IAC1I,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAwB,EAAE,MAAc;IACtE,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;IAC5C,IAAI,IAAI,GAAa,EAAE,CAAA;IACvB,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,IAAI,GAAG,QAAQ,CAAA;SACvC,IAAI,QAAQ,KAAK,SAAS;QAAE,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC1D,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;AACrD,CAAC;AAOD;;;GAGG;AACH,MAAM,OAAO,WAAW;IAIO;IAA8C;IAH1D,KAAK,GAAG,IAAI,GAAG,EAAkD,CAAA;IAC1E,UAAU,GAAG,CAAC,CAAA;IAEtB,YAA6B,QAA2B,EAAmB,IAAkB;QAAhE,aAAQ,GAAR,QAAQ,CAAmB;QAAmB,SAAI,GAAJ,IAAI,CAAc;IAAG,CAAC;IAEjG,2EAA2E;IAC3E,GAAG,CAAC,MAAc;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAChB,IAAI,YAAY,GAAG,CAAC,CAAA;QACpB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,EAAE,IAAI,MAAM,EAAE,CAAA;YACpC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC/B,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACnD,KAAK,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;gBACtC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAC5B,CAAC;YACD,KAAK,CAAC,KAAK,IAAI,CAAC,CAAA;YAChB,IAAI,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK;gBAAE,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,EAAE,GAAG,GAAG,CAAC,CAAA;QAC5G,CAAC;QACD,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9E,CAAC;IAEO,MAAM,CAAC,GAAW;QACxB,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,GAAG,MAAM;YAAE,OAAM;QAC1C,IAAI,CAAC,UAAU,GAAG,GAAG,CAAA;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;QACrE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACtC,IAAI,GAAG,GAAG,KAAK,CAAC,WAAW,IAAI,OAAO;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAChE,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,WAAW,CAAC,iBAAyB;IACnD,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,mCAAmC,iBAAiB,KAAK,EAAE,EAAE,EAAE;QAC3H,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE;KACtD,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAwB,EAAE,QAAgB;IACjE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;IACpB,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IACnC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;IAC1C,GAAG,CAAC,GAAG,EAAE,CAAA;IACT,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/gateway/auth/index.d.ts

@@ -0,0 +1,26 @@
+import type * as http from 'node:http';
+import { type ConsoleAuth, type ConsoleRequest, type Principal } from '../console-api/router.js';
+import type { AuthConfig, Member } from '../console-api/types.js';
+import type { AuthDeps, ConsoleAuthOptions } from './types.js';
+export type { AuthDeps, AuthKey, AuthMember, AuthStore, ConsoleAuthOptions, NewAuthMember } from './types.js';
+export interface ConsoleAuthService extends ConsoleAuth {
+    /** Single-use owner setup link (publicUrl, else http://localhost:<port>); throws once the console has been claimed. */
+    createSetupLink(): string;
+    /** The gateway's listen port, for setup links when there is no publicUrl. */
+    setGatewayPort(port: number): void;
+    /** Without a request (e.g. `GET /settings`), passkey availability is judged from publicUrl alone. */
+    authConfig(req?: http.IncomingMessage): AuthConfig;
+    /** A member's sign-in methods in the console's `Member.credentials` shape. */
+    credentialsFor(memberId: string): Member['credentials'];
+    /**
+     * Removes one sign-in method (DELETE /members/:id/credentials/:credentialId)
+     * and ends the member's sessions, except `keepSessionId` (the caller's own).
+     */
+    deleteCredential(memberId: string, credentialId: string, keepSessionId?: string | null): boolean;
+    /** A short-lived ticket for registering a sign-in method for `memberId` (recovery links). */
+    createEnrollment(memberId: string): string;
+    /** Refuses (403 `reauth_required`) unless the member's sign-in is recent; for sensitive changes to their own account. */
+    requireFreshSignIn(request: ConsoleRequest, principal: Principal | null): Promise<void>;
+}
+export declare function createConsoleAuth(deps: AuthDeps, options?: ConsoleAuthOptions): ConsoleAuthService;
+//# sourceMappingURL=index.d.ts.map

package/dist/gateway/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/gateway/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAA;AActC,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,cAAc,EAGnB,KAAK,SAAS,EACf,MAAM,0BAA0B,CAAA;AACjC,OAAO,KAAK,EAAU,UAAU,EAAc,MAAM,EAA2E,MAAM,yBAAyB,CAAA;AAmC9J,OAAO,KAAK,EAAE,QAAQ,EAAuB,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAGnF,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAO7G,MAAM,WAAW,kBAAmB,SAAQ,WAAW;IACrD,uHAAuH;IACvH,eAAe,IAAI,MAAM,CAAA;IACzB,6EAA6E;IAC7E,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,qGAAqG;IACrG,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,eAAe,GAAG,UAAU,CAAA;IAClD,8EAA8E;IAC9E,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;IACvD;;;OAGG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAA;IAChG,6FAA6F;IAC7F,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAA;IAC1C,yHAAyH;IACzH,kBAAkB,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACxF;AAID,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAE,kBAAuB,GAAG,kBAAkB,CA65BtG"}