@cyberismo/backend 1.1.1 → 1.2.0

package/README.md

@@ -1 +1,22 @@
 Hono backend server for [Cyberismo Solution](https://cyberismo.com/solution)
+
+## Mock identities
+
+With `AUTH_MODE=mock` the roster is on: alice (Admin), bob (Editor) and carol
+(Reader). `?user=<name>` sets a `mock-user` cookie and `?role=<role>` a
+`mock-role` cookie, both sticky until `=default` clears them; the cookie is
+per browser profile, so a tab cannot outrank the profile it lives in.
+`?as=<name>` names a roster identity for that one request without touching
+either cookie, which is how a second participant is scripted from a tab
+already signed in as someone else; being a one-shot identity rather than the
+tab's session, it is not subject to that expiry. `?ttl=<seconds>` gives
+the session an expiry, which is how rotation and the 401 after it can be
+watched without waiting out the default stream lifetime; `?ttl=default`
+clears it. `?user=`, `?as=` and `?ttl=` all need the roster, so `cyberismo app`
+sessions can neither switch identity nor expire; `?role=` works either way.
+
+Locally: `pnpm dev`, then visit `/api/auth/me?user=alice` and `?user=bob` in
+separate browser profiles, reloading the app after a change. In one profile,
+open the app as Alice and drive Bob from the console with `?as=bob`: his SSE
+stream yields a `connectionId`, and `PUT .../events/presence?as=bob` or
+`PATCH .../cards/:key?as=bob` then shows up in Alice's tab.

package/dist/app.js

@@ -11,18 +11,20 @@
   License along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
 import { Hono } from 'hono';
-import { staticFrontendDirRelative } from './utils.js';
+import { gitOptionsFromEnv, staticFrontendDirRelative } from './utils.js';
 import { serveStatic } from '@hono/node-server/serve-static';
 import { attachProjectRegistry } from './middleware/commandManager.js';
 import calculationsRouter from './domain/calculations/index.js';
 import cardsRouter from './domain/cards/index.js';
 import cardTypesRouter from './domain/cardTypes/index.js';
 import connectorsRouter from './domain/connectors/index.js';
+import eventsRouter from './domain/events/index.js';
 import fieldTypesRouter from './domain/fieldTypes/index.js';
 import graphModelsRouter from './domain/graphModels/index.js';
 import graphViewsRouter from './domain/graphViews/index.js';
 import linkTypesRouter from './domain/linkTypes/index.js';
 import reportsRouter from './domain/reports/index.js';
+import skillsRouter from './domain/skills/index.js';
 import templatesRouter from './domain/templates/index.js';
 import treeRouter from './domain/tree/index.js';
 import workflowsRouter from './domain/workflows/index.js';
@@ -37,9 +39,10 @@ import { isSSGContext } from 'hono/ssg';
 import treeMiddleware from './middleware/tree.js';
 import projectRouter from './domain/project/index.js';
 import { createMcpRouter } from './domain/mcp/index.js';
+import { writableProjects } from './overlay.js';
 import { createAuthRouter } from './domain/auth/index.js';
 import { createAuthMiddleware } from './middleware/auth.js';
-import { MockAuthProvider, mockRoleCookieMiddleware } from './auth/mock.js';
+import { MockAuthProvider } from './auth/mock.js';
 import { CommandManager, scanForProjects } from '@cyberismo/data-handler';
 import { createProjectsRouter } from './domain/projects/index.js';
 import { simpleMcpAuthRouter } from '@hono/mcp';
@@ -53,11 +56,13 @@ function createProjectScopedRoutes(middleware) {
     projectScoped.route('/cards', cardsRouter);
     projectScoped.route('/cardTypes', cardTypesRouter);
     projectScoped.route('/connectors', connectorsRouter);
+    projectScoped.route('/events', eventsRouter);
     projectScoped.route('/fieldTypes', fieldTypesRouter);
     projectScoped.route('/graphModels', graphModelsRouter);
     projectScoped.route('/graphViews', graphViewsRouter);
     projectScoped.route('/linkTypes', linkTypesRouter);
     projectScoped.route('/reports', reportsRouter);
+    projectScoped.route('/skills', skillsRouter);
     projectScoped.route('/templates', templatesRouter);
     projectScoped.route('/tree', treeRouter);
     projectScoped.route('/workflows', workflowsRouter);
@@ -90,14 +95,14 @@ export function createApp(authProvider, registry, opts, exportMode = false, mult
         return c.json({
             staticMode: exportMode,
             logoutUrl: process.env.APP_LOGOUT_URL || '',
-            presenceEnabled: process.env.APP_PRESENCE_ENABLED === 'true',
             defaultProject: process.env.CYBERISMO_DEFAULT_PROJECT || undefined,
+            extensionUrl: process.env.APP_EXTENSION_URL || undefined,
         });
     });
-    // Dev-only: let `?role=<reader|editor|admin>` set a persistent mock-role cookie
-    // so role gating can be exercised locally without code changes or a restart.
+    // Mock-auth only: let `?role=` and, with the roster on, `?user=` set persistent
+    // cookies so role gating and identity can be switched locally without a restart.
     if (authProvider instanceof MockAuthProvider) {
-        app.use(mockRoleCookieMiddleware());
+        app.use(authProvider.cookieMiddleware());
     }
     // Apply authentication middleware to all API and MCP routes
     app.use('/api/*', createAuthMiddleware(authProvider));
@@ -129,9 +134,15 @@ export function createApp(authProvider, registry, opts, exportMode = false, mult
                     error: `Refusing to reset suspicious project path: ${resolvedProject}`,
                 }, 400);
             }
-            await fs.rm(resolvedProject, { recursive: true, force: true });
+            // Windows holds transient locks on files the server has just touched,
+            // which surface as EBUSY on the final rmdir. Retry rather than fail the reset.
+            await fs.rm(resolvedProject, {
+                recursive: true,
+                force: true,
+                maxRetries: 5,
+                retryDelay: 100,
+            });
             await fs.cp(goldenPath, resolvedProject, { recursive: true });
-            const autocommit = process.env.CYBERISMO_AUTOCOMMIT === 'true';
             const projects = await scanForProjects(resolvedProject);
             if (projects.length === 0) {
                 return c.json({
@@ -140,7 +151,7 @@ export function createApp(authProvider, registry, opts, exportMode = false, mult
             }
             const entries = [];
             for (const project of projects) {
-                const commands = new CommandManager(project.path, { autocommit });
+                const commands = new CommandManager(project.path, gitOptionsFromEnv());
                 await commands.initialize();
                 entries.push({ prefix: project.prefix, commands });
             }
@@ -153,7 +164,7 @@ export function createApp(authProvider, registry, opts, exportMode = false, mult
         if (!multiProjectRoot)
             return c.json({ publicKey: null });
         try {
-            const content = await readFile(join(multiProjectRoot, '.git-service', 'id_rsa.pub'), 'utf-8');
+            const content = await readFile(join(multiProjectRoot, '.keyholder', 'id_rsa.pub'), 'utf-8');
             return c.json({ publicKey: content.trim() });
         }
         catch {
@@ -174,7 +185,7 @@ export function createApp(authProvider, registry, opts, exportMode = false, mult
         app.route('/api/projects/:prefix', scoped);
     }
     // MCP endpoint for AI assistant integration
-    app.route('/mcp', createMcpRouter(registry));
+    app.route('/mcp', createMcpRouter(writableProjects(registry)));
     app.use('*', serveStatic({
         root: staticFrontendDirRelative,
     }));

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;EAWE;AACF,OAAO,EAAE,IAAI,EAA0B,MAAM,MAAM,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,kBAAkB,MAAM,gCAAgC,CAAC;AAChE,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAClD,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,gBAAgB,MAAM,8BAA8B,CAAC;AAC5D,OAAO,gBAAgB,MAAM,8BAA8B,CAAC;AAC5D,OAAO,iBAAiB,MAAM,+BAA+B,CAAC;AAC9D,OAAO,gBAAgB,MAAM,8BAA8B,CAAC;AAC5D,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,aAAa,MAAM,2BAA2B,CAAC;AACtD,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,UAAU,MAAM,wBAAwB,CAAC;AAChD,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,YAAY,MAAM,0BAA0B,CAAC;AACpD,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,mBAAmB,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,OAAO,cAAc,MAAM,sBAAsB,CAAC;AAClD,OAAO,aAAa,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE5E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEhD;;GAEG;AACH,SAAS,yBAAyB,CAChC,UAA6B;IAE7B,MAAM,aAAa,GAAG,IAAI,IAAI,EAA0B,CAAC;IACzD,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACnC,aAAa,CAAC,KAAK,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;IACzD,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3C,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACnD,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACrD,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACrD,aAAa,CAAC,KAAK,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IACvD,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACrD,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACnD,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC/C,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACnD,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACzC,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACnD,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACnD,aAAa,CAAC,KAAK,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IAC3D,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC7C,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC/C,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,YAA0B,EAC1B,QAAyB,EACzB,IAAkB,EAClB,UAAU,GAAG,KAAK,EAClB,gBAAyB;IAEzB,MAAM,GAAG,GAAG,IAAI,IAAI,EAA0B,CAAC;IAE/C,+EAA+E;IAC/E,iFAAiF;IACjF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACvC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QACtC,GAAG,CAAC,KAAK,CACP,GAAG,EACH,mBAAmB,CAAC;YAClB,MAAM;YACN,iBAAiB,EAAE,IAAI,GAAG,CAAC,GAAG,MAAM,MAAM,CAAC;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IAE9B,2BAA2B;IAC3B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE;QAC3B,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,UAAU,EAAE,UAAU;YACtB,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE;YAC3C,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM;YAC5D,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,SAAS;SACnE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,6EAA6E;IAC7E,IAAI,YAAY,YAAY,gBAAgB,EAAE,CAAC;QAC7C,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,4DAA4D;IAC5D,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;IACtD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;IACpD,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;IAEtD,4DAA4D;IAC5D,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC3C,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAE7E,wEAAwE;IACxE,mEAAmE;IACnE,oEAAoE;IACpE,qDAAqD;IACrD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACtC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACxD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACrD,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChC,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EACH,oFAAoF;iBACvF,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,0EAA0E;YAC1E,wEAAwE;YACxE,mCAAmC;YACnC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAClD,IACE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,eAAe;gBACjD,eAAe,KAAK,EAAE,CAAC,OAAO,EAAE,EAChC,CAAC;gBACD,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,8CAA8C,eAAe,EAAE;iBACvE,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM,CAAC;YAC/D,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,eAAe,CAAC,CAAC;YAExD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,mCAAmC,eAAe,EAAE;iBAC5D,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,EAAE,CAAC;YACnB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;gBAClE,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IACD,8BAA8B;IAC9B,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,IAAI,CAAC,gBAAgB;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAC5B,IAAI,CAAC,gBAAgB,EAAE,cAAc,EAAE,YAAY,CAAC,EACpD,OAAO,CACR,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,UAAU,EAAE,CAAC;QACf,yDAAyD;QACzD,mEAAmE;QACnE,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,yBAAyB,CACtC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,CACxC,CAAC;YACF,GAAG,CAAC,KAAK,CAAC,iBAAiB,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,qCAAqC;QACrC,MAAM,MAAM,GAAG,yBAAyB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1E,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,4CAA4C;IAC5C,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE7C,GAAG,CAAC,GAAG,CACL,GAAG,EACH,WAAW,CAAC;QACV,IAAI,EAAE,yBAAyB;KAChC,CAAC,CACH,CAAC;IAEF,wCAAwC;IACxC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,IACE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAC7B,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EACrC,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,CACvD,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IACH,iBAAiB;IACjB,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACrB,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACpC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,uBAAuB;SAC9C,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;EAWE;AACF,OAAO,EAAE,IAAI,EAA0B,MAAM,MAAM,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,kBAAkB,MAAM,gCAAgC,CAAC;AAChE,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAClD,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,gBAAgB,MAAM,8BAA8B,CAAC;AAC5D,OAAO,YAAY,MAAM,0BAA0B,CAAC;AACpD,OAAO,gBAAgB,MAAM,8BAA8B,CAAC;AAC5D,OAAO,iBAAiB,MAAM,+BAA+B,CAAC;AAC9D,OAAO,gBAAgB,MAAM,8BAA8B,CAAC;AAC5D,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,aAAa,MAAM,2BAA2B,CAAC;AACtD,OAAO,YAAY,MAAM,0BAA0B,CAAC;AACpD,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,UAAU,MAAM,wBAAwB,CAAC;AAChD,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,YAAY,MAAM,0BAA0B,CAAC;AACpD,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,mBAAmB,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,OAAO,cAAc,MAAM,sBAAsB,CAAC;AAClD,OAAO,aAAa,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEhD;;GAEG;AACH,SAAS,yBAAyB,CAChC,UAA6B;IAE7B,MAAM,aAAa,GAAG,IAAI,IAAI,EAA0B,CAAC;IACzD,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACnC,aAAa,CAAC,KAAK,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;IACzD,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3C,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACnD,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACrD,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC7C,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACrD,aAAa,CAAC,KAAK,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IACvD,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACrD,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACnD,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC/C,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC7C,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACnD,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACzC,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACnD,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACnD,aAAa,CAAC,KAAK,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IAC3D,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC7C,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC/C,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,YAA0B,EAC1B,QAAyB,EACzB,IAAkB,EAClB,UAAU,GAAG,KAAK,EAClB,gBAAyB;IAEzB,MAAM,GAAG,GAAG,IAAI,IAAI,EAA0B,CAAC;IAE/C,+EAA+E;IAC/E,iFAAiF;IACjF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACvC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QACtC,GAAG,CAAC,KAAK,CACP,GAAG,EACH,mBAAmB,CAAC;YAClB,MAAM;YACN,iBAAiB,EAAE,IAAI,GAAG,CAAC,GAAG,MAAM,MAAM,CAAC;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IAE9B,2BAA2B;IAC3B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE;QAC3B,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,UAAU,EAAE,UAAU;YACtB,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE;YAC3C,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,SAAS;YAClE,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,SAAS;SACzD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,iFAAiF;IACjF,IAAI,YAAY,YAAY,gBAAgB,EAAE,CAAC;QAC7C,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,4DAA4D;IAC5D,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;IACtD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;IACpD,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;IAEtD,4DAA4D;IAC5D,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC3C,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAE7E,wEAAwE;IACxE,mEAAmE;IACnE,oEAAoE;IACpE,qDAAqD;IACrD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACtC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACxD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACrD,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChC,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EACH,oFAAoF;iBACvF,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,0EAA0E;YAC1E,wEAAwE;YACxE,mCAAmC;YACnC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAClD,IACE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,eAAe;gBACjD,eAAe,KAAK,EAAE,CAAC,OAAO,EAAE,EAChC,CAAC;gBACD,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,8CAA8C,eAAe,EAAE;iBACvE,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,sEAAsE;YACtE,+EAA+E;YAC/E,MAAM,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE;gBAC3B,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,CAAC;gBACb,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;YACH,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,eAAe,CAAC,CAAC;YAExD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,mCAAmC,eAAe,EAAE;iBAC5D,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,EAAE,CAAC;YACnB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBACvE,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IACD,8BAA8B;IAC9B,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,IAAI,CAAC,gBAAgB;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAC5B,IAAI,CAAC,gBAAgB,EAAE,YAAY,EAAE,YAAY,CAAC,EAClD,OAAO,CACR,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,UAAU,EAAE,CAAC;QACf,yDAAyD;QACzD,mEAAmE;QACnE,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,yBAAyB,CACtC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,CACxC,CAAC;YACF,GAAG,CAAC,KAAK,CAAC,iBAAiB,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,qCAAqC;QACrC,MAAM,MAAM,GAAG,yBAAyB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1E,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,4CAA4C;IAC5C,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE/D,GAAG,CAAC,GAAG,CACL,GAAG,EACH,WAAW,CAAC;QACV,IAAI,EAAE,yBAAyB;KAChC,CAAC,CACH,CAAC;IAEF,wCAAwC;IACxC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,IACE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAC7B,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EACrC,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,CACvD,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IACH,iBAAiB;IACjB,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACrB,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACpC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,uBAAuB;SAC9C,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/auth/index.d.ts

@@ -11,6 +11,6 @@
   License along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
 export type { AuthProvider } from './types.js';
-export { MockAuthProvider, mockRoleCookieMiddleware } from './mock.js';
+export { MockAuthProvider } from './mock.js';
 export { KeycloakAuthProvider } from './keycloak.js';
 export type { KeycloakConfig } from './keycloak.js';

package/dist/auth/index.js

@@ -10,6 +10,6 @@
   You should have received a copy of the GNU Affero General Public
   License along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
-export { MockAuthProvider, mockRoleCookieMiddleware } from './mock.js';
+export { MockAuthProvider } from './mock.js';
 export { KeycloakAuthProvider } from './keycloak.js';
 //# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;EAWE;AAGF,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;EAWE;AAGF,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC"}

package/dist/auth/keycloak.d.ts

@@ -10,8 +10,7 @@
   You should have received a copy of the GNU Affero General Public
   License along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
-import type { UserInfo } from '../types.js';
-import type { AuthProvider } from './types.js';
+import type { AuthProvider, AuthResult } from './types.js';
 export interface KeycloakConfig {
     issuer: string;
     audience: string;
@@ -22,6 +21,6 @@ export declare class KeycloakAuthProvider implements AuthProvider {
     private jwks;
     constructor(config: KeycloakConfig);
     private getJWKS;
-    authenticate(req: Request): Promise<UserInfo | null>;
+    authenticate(req: Request): Promise<AuthResult | null>;
     private mapRole;
 }

package/dist/auth/keycloak.js

@@ -50,11 +50,17 @@ export class KeycloakAuthProvider {
             if (!claims.email) {
                 throw new Error('Missing email');
             }
+            // Optional in RFC 7519, and jwtVerify only checks it when present, so a
+            // token without one would rotate on jitter alone and never clamp.
+            if (!claims.exp) {
+                throw new Error('Missing exp');
+            }
             return {
                 id: claims.sub,
                 email: claims.email,
                 name: claims.name ?? claims.preferred_username ?? 'Unknown',
                 role,
+                exp: claims.exp,
             };
         }
         catch {

package/dist/auth/keycloak.js.map

@@ -1 +1 @@
-{"version":3,"file":"keycloak.js","sourceRoot":"","sources":["../../src/auth/keycloak.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;EAWE;AAEF,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAErD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAkBvC,MAAM,OAAO,oBAAoB;IACd,MAAM,CAAS;IACf,QAAQ,CAAS;IAC1B,IAAI,GAAiD,IAAI,CAAC;IAElE,YAAY,MAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAClC,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,gCAAgC,CAClE,CAAC;YACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAY;QAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;gBAC/C,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,OAA6B,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAEtD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YACnC,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,MAAM,CAAC,GAAG;gBACd,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,kBAAkB,IAAI,SAAS;gBAC3D,IAAI;aACL,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,KAAgB;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC,KAAK,CAAC;QACxB,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC;QACzB,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC;QACzB,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,OAAO,QAAQ,CAAC,SAAS,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;CACF"}
+{"version":3,"file":"keycloak.js","sourceRoot":"","sources":["../../src/auth/keycloak.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;EAWE;AAEF,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAErD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAiBvC,MAAM,OAAO,oBAAoB;IACd,MAAM,CAAS;IACf,QAAQ,CAAS;IAC1B,IAAI,GAAiD,IAAI,CAAC;IAElE,YAAY,MAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAClC,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,gCAAgC,CAClE,CAAC;YACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAY;QAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;gBAC/C,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,OAA6B,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAEtD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YACnC,CAAC;YACD,wEAAwE;YACxE,kEAAkE;YAClE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;YACjC,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,MAAM,CAAC,GAAG;gBACd,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,kBAAkB,IAAI,SAAS;gBAC3D,IAAI;gBACJ,GAAG,EAAE,MAAM,CAAC,GAAG;aAChB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,KAAgB;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC,KAAK,CAAC;QACxB,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC;QACzB,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC;QACzB,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,OAAO,QAAQ,CAAC,SAAS,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;CACF"}

package/dist/auth/mock.d.ts

@@ -11,20 +11,24 @@
   License along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
 import type { MiddlewareHandler } from 'hono';
-import type { UserInfo } from '../types.js';
-import type { AuthProvider } from './types.js';
+import type { AuthProvider, AuthResult } from './types.js';
 export interface MockUserConfig {
     name?: string;
     email?: string;
+    roster?: boolean;
 }
 export declare const MOCK_ROLE_COOKIE = "mock-role";
+export declare const MOCK_USER_COOKIE = "mock-user";
+export declare const MOCK_EXP_COOKIE = "mock-exp";
+export declare const MOCK_AS_PARAM = "as";
 export declare class MockAuthProvider implements AuthProvider {
     private readonly userConfig;
     constructor(config?: MockUserConfig);
-    authenticate(req: Request): Promise<UserInfo>;
+    authenticate(req: Request): Promise<AuthResult | null>;
+    /**
+     * Turns ?role= and, with the roster on, ?user= and ?ttl= into cookies;
+     * "default" clears. ?ttl= seconds gives the session an expiry, which is
+     * what drives stream rotation and the 401 that follows it.
+     */
+    cookieMiddleware(): MiddlewareHandler;
 }
-/**
- * Dev-only middleware that turns `?role=<reader|editor|admin>` into a persistent
- * `mock-role` cookie, and clears it on `?role=default`.
- */
-export declare function mockRoleCookieMiddleware(): MiddlewareHandler;

package/dist/auth/mock.js

@@ -13,17 +13,80 @@
 import { setCookie } from 'hono/cookie';
 import { UserRole } from '../types.js';
 export const MOCK_ROLE_COOKIE = 'mock-role';
-const ROLE_RESET_VALUE = 'default';
-const ROLE_ALIASES = {
-    reader: UserRole.Reader,
-    editor: UserRole.Editor,
-    admin: UserRole.Admin,
-    connector: UserRole.Connector,
-};
+export const MOCK_USER_COOKIE = 'mock-user';
+export const MOCK_EXP_COOKIE = 'mock-exp';
+export const MOCK_AS_PARAM = 'as';
+const RESET_VALUE = 'default';
+const MAX_TTL_SECONDS = 86_400;
+// Mock sessions do not expire. Saying so with a distant deadline rather than
+// no deadline keeps `exp` total for every consumer: it is far beyond the
+// 30-minute stream lifetime, so computeLifetimeMs() min()s it away and
+// rotation still falls to the jitter, exactly as an absent one did.
+const NO_EXPIRY_SECONDS = 100 * 365 * 24 * 60 * 60;
+function noExpiry() {
+    return Math.floor(Date.now() / 1000) + NO_EXPIRY_SECONDS;
+}
+const ROLE_ALIASES = new Map([
+    ['reader', UserRole.Reader],
+    ['editor', UserRole.Editor],
+    ['admin', UserRole.Admin],
+    ['connector', UserRole.Connector],
+]);
+// Opt-in: `cyberismo app` ships mock auth, where a roster identity would forge
+// git commit authorship. Dev and e2e need several users in one backend process.
+const MOCK_USERS = new Map([
+    [
+        'alice',
+        {
+            id: 'mock-user-alice',
+            name: 'Alice',
+            email: 'alice@example.com',
+            role: UserRole.Admin,
+        },
+    ],
+    [
+        'bob',
+        {
+            id: 'mock-user-bob',
+            name: 'Bob',
+            email: 'bob@example.com',
+            role: UserRole.Editor,
+        },
+    ],
+    [
+        'carol',
+        {
+            id: 'mock-user-carol',
+            name: 'Carol',
+            email: 'carol@example.com',
+            role: UserRole.Reader,
+        },
+    ],
+]);
 function parseRole(value) {
     if (!value)
         return null;
-    return ROLE_ALIASES[value.toLowerCase()] ?? null;
+    return ROLE_ALIASES.get(value.toLowerCase()) ?? null;
+}
+function parseUser(value) {
+    if (!value)
+        return null;
+    return MOCK_USERS.get(value.toLowerCase()) ?? null;
+}
+/** An unreadable deadline is dropped rather than treated as long past, which
+ * would lock the user out with no request left to clear the cookie. */
+function parseExpiry(value) {
+    const exp = Number(value);
+    return value && Number.isInteger(exp) && exp > 0 ? exp : null;
+}
+/** Seconds from now to the absolute epoch-second deadline to store. */
+function toDeadline(value) {
+    const seconds = Number(value);
+    if (!Number.isInteger(seconds) || seconds <= 0)
+        return null;
+    if (seconds > MAX_TTL_SECONDS)
+        return null;
+    return String(Math.floor(Date.now() / 1000) + seconds);
 }
 function readCookie(header, name) {
     if (!header)
@@ -38,40 +101,65 @@ function readCookie(header, name) {
     }
     return undefined;
 }
+function applyOverride(c, override, cookieName, toCookieValue) {
+    if (!override)
+        return;
+    if (override.toLowerCase() === RESET_VALUE) {
+        setCookie(c, cookieName, '', { path: '/', maxAge: 0 });
+        return;
+    }
+    const value = toCookieValue(override);
+    if (value === null)
+        return;
+    setCookie(c, cookieName, value, { path: '/', sameSite: 'Lax' });
+}
 export class MockAuthProvider {
     userConfig;
     constructor(config) {
         this.userConfig = config ?? {};
     }
     async authenticate(req) {
-        const cookieRole = parseRole(readCookie(req.headers.get('cookie'), MOCK_ROLE_COOKIE));
-        return {
+        const cookies = req.headers.get('cookie');
+        const cookieRole = parseRole(readCookie(cookies, MOCK_ROLE_COOKIE));
+        if (this.userConfig.roster) {
+            // One-shot: a second identity from inside a tab already signed in as
+            // someone else, so neither the cookie nor the role override applies.
+            const asUser = parseUser(new URL(req.url).searchParams.get(MOCK_AS_PARAM));
+            if (asUser)
+                return { ...asUser, exp: noExpiry() };
+        }
+        const rosterUser = this.userConfig.roster
+            ? parseUser(readCookie(cookies, MOCK_USER_COOKIE))
+            : null;
+        const expiry = this.userConfig.roster
+            ? parseExpiry(readCookie(cookies, MOCK_EXP_COOKIE))
+            : null;
+        if (expiry !== null && expiry * 1000 <= Date.now())
+            return null;
+        const exp = expiry ?? noExpiry();
+        const identity = rosterUser ?? {
             id: 'mock-user',
             email: this.userConfig.email ?? 'admin@cyberismo.local',
             name: this.userConfig.name ?? 'Local Admin',
-            role: cookieRole ?? UserRole.Admin,
+            role: UserRole.Admin,
         };
+        return { ...identity, role: cookieRole ?? identity.role, exp };
     }
-}
-/**
- * Dev-only middleware that turns `?role=<reader|editor|admin>` into a persistent
- * `mock-role` cookie, and clears it on `?role=default`.
- */
-export function mockRoleCookieMiddleware() {
-    return async (c, next) => {
-        const override = new URL(c.req.url).searchParams.get('role');
-        if (override) {
-            if (override.toLowerCase() === ROLE_RESET_VALUE) {
-                setCookie(c, MOCK_ROLE_COOKIE, '', { path: '/', maxAge: 0 });
+    /**
+     * Turns ?role= and, with the roster on, ?user= and ?ttl= into cookies;
+     * "default" clears. ?ttl= seconds gives the session an expiry, which is
+     * what drives stream rotation and the 401 that follows it.
+     */
+    cookieMiddleware() {
+        return async (c, next) => {
+            const params = new URL(c.req.url).searchParams;
+            applyOverride(c, params.get('role'), MOCK_ROLE_COOKIE, (value) => parseRole(value) ? value.toLowerCase() : null);
+            if (this.userConfig.roster) {
+                applyOverride(c, params.get('user'), MOCK_USER_COOKIE, (value) => parseUser(value) ? value.toLowerCase() : null);
+                applyOverride(c, params.get('ttl'), MOCK_EXP_COOKIE, toDeadline);
             }
-            else if (parseRole(override)) {
-                setCookie(c, MOCK_ROLE_COOKIE, override.toLowerCase(), {
-                    path: '/',
-                    sameSite: 'Lax',
-                });
-            }
-        }
-        await next();
-    };
+            await next();
+        };
+    }
 }
 //# sourceMappingURL=mock.js.map

package/dist/auth/mock.js.map

@@ -1 +1 @@
-{"version":3,"file":"mock.js","sourceRoot":"","sources":["../../src/auth/mock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;EAWE;AAGF,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AASvC,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAC5C,MAAM,gBAAgB,GAAG,SAAS,CAAC;AAEnC,MAAM,YAAY,GAA6B;IAC7C,MAAM,EAAE,QAAQ,CAAC,MAAM;IACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;IACvB,KAAK,EAAE,QAAQ,CAAC,KAAK;IACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;CAC9B,CAAC;AAEF,SAAS,SAAS,CAAC,KAAgC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC;AACnD,CAAC;AAED,SAAS,UAAU,CAAC,MAAqB,EAAE,IAAY;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS;QAChD,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,gBAAgB;IACV,UAAU,CAAiB;IAE5C,YAAY,MAAuB;QACjC,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAY;QAC7B,MAAM,UAAU,GAAG,SAAS,CAC1B,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,CACxD,CAAC;QACF,OAAO;YACL,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,uBAAuB;YACvD,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,aAAa;YAC3C,IAAI,EAAE,UAAU,IAAI,QAAQ,CAAC,KAAK;SACnC,CAAC;IACJ,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,gBAAgB,EAAE,CAAC;gBAChD,SAAS,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/D,CAAC;iBAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,SAAS,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE;oBACrD,IAAI,EAAE,GAAG;oBACT,QAAQ,EAAE,KAAK;iBAChB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"mock.js","sourceRoot":"","sources":["../../src/auth/mock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;EAWE;AAGF,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAUvC,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAC5C,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAC5C,MAAM,CAAC,MAAM,eAAe,GAAG,UAAU,CAAC;AAC1C,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC;AAClC,MAAM,WAAW,GAAG,SAAS,CAAC;AAC9B,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,6EAA6E;AAC7E,yEAAyE;AACzE,uEAAuE;AACvE,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEnD,SAAS,QAAQ;IACf,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,iBAAiB,CAAC;AAC3D,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAmB;IAC7C,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC;IAC3B,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC;IAC3B,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC;IACzB,CAAC,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC;CAClC,CAAC,CAAC;AASH,+EAA+E;AAC/E,gFAAgF;AAChF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAmB;IAC3C;QACE,OAAO;QACP;YACE,EAAE,EAAE,iBAAiB;YACrB,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,mBAAmB;YAC1B,IAAI,EAAE,QAAQ,CAAC,KAAK;SACrB;KACF;IACD;QACE,KAAK;QACL;YACE,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,QAAQ,CAAC,MAAM;SACtB;KACF;IACD;QACE,OAAO;QACP;YACE,EAAE,EAAE,iBAAiB;YACrB,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,mBAAmB;YAC1B,IAAI,EAAE,QAAQ,CAAC,MAAM;SACtB;KACF;CACF,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,KAAgC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC;AACvD,CAAC;AAED,SAAS,SAAS,CAAC,KAAgC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC;AACrD,CAAC;AAED;uEACuE;AACvE,SAAS,WAAW,CAAC,KAAgC;IACnD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,OAAO,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED,uEAAuE;AACvE,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,OAAO,GAAG,eAAe;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,UAAU,CAAC,MAAqB,EAAE,IAAY;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS;QAChD,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CACpB,CAAU,EACV,QAAuB,EACvB,UAAkB,EAClB,aAA+C;IAE/C,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC;QAC3C,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO;IAC3B,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,OAAO,gBAAgB;IACV,UAAU,CAAiB;IAE5C,YAAY,MAAuB;QACjC,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAY;QAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAC3B,qEAAqE;YACrE,qEAAqE;YACrE,MAAM,MAAM,GAAG,SAAS,CACtB,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CACjD,CAAC;YACF,IAAI,MAAM;gBAAE,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC;QACpD,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM;YACvC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;YAClD,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM;YACnC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACnD,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAChE,MAAM,GAAG,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;QAEjC,MAAM,QAAQ,GAAa,UAAU,IAAI;YACvC,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,uBAAuB;YACvD,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,aAAa;YAC3C,IAAI,EAAE,QAAQ,CAAC,KAAK;SACrB,CAAC;QACF,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,UAAU,IAAI,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;IACjE,CAAC;IAED;;;;OAIG;IACH,gBAAgB;QACd,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACvB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;YAC/C,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC/D,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAC9C,CAAC;YACF,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;gBAC3B,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC/D,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAC9C,CAAC;gBACF,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;QACf,CAAC,CAAC;IACJ,CAAC;CACF"}

package/dist/auth/types.d.ts

@@ -11,6 +11,12 @@
   License along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
 import type { UserInfo } from '../types.js';
+export interface AuthResult extends UserInfo {
+    /** Credential deadline (epoch seconds). Always present: a provider whose
+     * sessions do not expire says so with a deadline far enough out to be
+     * inert, rather than leaving every consumer to handle its absence. */
+    exp: number;
+}
 export interface AuthProvider {
-    authenticate(req: Request): Promise<UserInfo | null>;
+    authenticate(req: Request): Promise<AuthResult | null>;
 }