@cyberismo/backend 1.1.2 → 1.3.0

package/README.md

@@ -1 +1,22 @@
 Hono backend server for [Cyberismo Solution](https://cyberismo.com/solution)
+
+## Mock identities
+
+With `AUTH_MODE=mock` the roster is on: alice (Admin), bob (Editor) and carol
+(Reader). `?user=<name>` sets a `mock-user` cookie and `?role=<role>` a
+`mock-role` cookie, both sticky until `=default` clears them; the cookie is
+per browser profile, so a tab cannot outrank the profile it lives in.
+`?as=<name>` names a roster identity for that one request without touching
+either cookie, which is how a second participant is scripted from a tab
+already signed in as someone else; being a one-shot identity rather than the
+tab's session, it is not subject to that expiry. `?ttl=<seconds>` gives
+the session an expiry, which is how rotation and the 401 after it can be
+watched without waiting out the default stream lifetime; `?ttl=default`
+clears it. `?user=`, `?as=` and `?ttl=` all need the roster, so `cyberismo app`
+sessions can neither switch identity nor expire; `?role=` works either way.
+
+Locally: `pnpm dev`, then visit `/api/auth/me?user=alice` and `?user=bob` in
+separate browser profiles, reloading the app after a change. In one profile,
+open the app as Alice and drive Bob from the console with `?as=bob`: his SSE
+stream yields a `connectionId`, and `PUT .../events/presence?as=bob` or
+`PATCH .../cards/:key?as=bob` then shows up in Alice's tab.

package/dist/app.d.ts

@@ -1,24 +1,14 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2025
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation.
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
-  details. You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
 import { Hono } from 'hono';
 import type { AppVars, TreeOptions } from './types.js';
 import type { AuthProvider } from './auth/types.js';
-import type { ProjectRegistry } from './project-registry.js';
+import type { ProjectDirectory } from '@cyberismo/data-handler';
 /**
  * Create the Hono app for the backend
  * @param authProvider - Authentication provider
- * @param registry - ProjectRegistry holding all project CommandManagers
+ * @param directory - Directory the projects are opened from
+ * @param exportPrefixes - The projects a static export serves; set only in
+ *   export mode
  */
-export declare function createApp(authProvider: AuthProvider, registry: ProjectRegistry, opts?: TreeOptions, exportMode?: boolean, multiProjectRoot?: string): Hono<{
+export declare function createApp(authProvider: AuthProvider, directory: ProjectDirectory, opts?: TreeOptions, exportPrefixes?: string[], multiProjectRoot?: string): Hono<{
     Variables: AppVars;
 }, import("hono/types").BlankSchema, "/">;

package/dist/app.js

@@ -1,28 +1,21 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2025
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation.
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
-  details. You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
 import { Hono } from 'hono';
-import { gitOptionsFromEnv, staticFrontendDirRelative } from './utils.js';
+import { staticFrontendDirRelative } from './utils.js';
 import { serveStatic } from '@hono/node-server/serve-static';
-import { attachProjectRegistry } from './middleware/commandManager.js';
+import { attachProjectDirectory } from './middleware/commandManager.js';
+import { errorResponse } from './common/errors.js';
 import calculationsRouter from './domain/calculations/index.js';
 import cardsRouter from './domain/cards/index.js';
 import cardTypesRouter from './domain/cardTypes/index.js';
 import connectorsRouter from './domain/connectors/index.js';
+import eventsRouter from './domain/events/index.js';
 import fieldTypesRouter from './domain/fieldTypes/index.js';
 import graphModelsRouter from './domain/graphModels/index.js';
 import graphViewsRouter from './domain/graphViews/index.js';
 import linkTypesRouter from './domain/linkTypes/index.js';
 import reportsRouter from './domain/reports/index.js';
+import skillsRouter from './domain/skills/index.js';
 import templatesRouter from './domain/templates/index.js';
 import treeRouter from './domain/tree/index.js';
 import workflowsRouter from './domain/workflows/index.js';
@@ -37,10 +30,11 @@ import { isSSGContext } from 'hono/ssg';
 import treeMiddleware from './middleware/tree.js';
 import projectRouter from './domain/project/index.js';
 import { createMcpRouter } from './domain/mcp/index.js';
+import { writableProjects } from './overlay.js';
 import { createAuthRouter } from './domain/auth/index.js';
 import { createAuthMiddleware } from './middleware/auth.js';
-import { MockAuthProvider, mockRoleCookieMiddleware } from './auth/mock.js';
-import { CommandManager, scanForProjects } from '@cyberismo/data-handler';
+import { MockAuthProvider } from './auth/mock.js';
+import { EventsByProject } from './domain/events/events-by-project.js';
 import { createProjectsRouter } from './domain/projects/index.js';
 import { simpleMcpAuthRouter } from '@hono/mcp';
 /**
@@ -53,11 +47,13 @@ function createProjectScopedRoutes(middleware) {
     projectScoped.route('/cards', cardsRouter);
     projectScoped.route('/cardTypes', cardTypesRouter);
     projectScoped.route('/connectors', connectorsRouter);
+    projectScoped.route('/events', eventsRouter);
     projectScoped.route('/fieldTypes', fieldTypesRouter);
     projectScoped.route('/graphModels', graphModelsRouter);
     projectScoped.route('/graphViews', graphViewsRouter);
     projectScoped.route('/linkTypes', linkTypesRouter);
     projectScoped.route('/reports', reportsRouter);
+    projectScoped.route('/skills', skillsRouter);
     projectScoped.route('/templates', templatesRouter);
     projectScoped.route('/tree', treeRouter);
     projectScoped.route('/workflows', workflowsRouter);
@@ -70,10 +66,14 @@ function createProjectScopedRoutes(middleware) {
 /**
  * Create the Hono app for the backend
  * @param authProvider - Authentication provider
- * @param registry - ProjectRegistry holding all project CommandManagers
+ * @param directory - Directory the projects are opened from
+ * @param exportPrefixes - The projects a static export serves; set only in
+ *   export mode
  */
-export function createApp(authProvider, registry, opts, exportMode = false, multiProjectRoot) {
+export function createApp(authProvider, directory, opts, exportPrefixes, multiProjectRoot) {
     const app = new Hono();
+    const exportMode = exportPrefixes !== undefined;
+    const events = new EventsByProject(directory);
     // Public — no auth middleware (MCP clients call this before they have a token)
     // RFC 9728 resource metadata & OAuth authorization server metadata via @hono/mcp
     const issuer = process.env.OIDC_ISSUER;
@@ -90,24 +90,24 @@ export function createApp(authProvider, registry, opts, exportMode = false, mult
         return c.json({
             staticMode: exportMode,
             logoutUrl: process.env.APP_LOGOUT_URL || '',
-            presenceEnabled: process.env.APP_PRESENCE_ENABLED === 'true',
             defaultProject: process.env.CYBERISMO_DEFAULT_PROJECT || undefined,
+            extensionUrl: process.env.APP_EXTENSION_URL || undefined,
         });
     });
-    // Dev-only: let `?role=<reader|editor|admin>` set a persistent mock-role cookie
-    // so role gating can be exercised locally without code changes or a restart.
+    // Mock-auth only: let `?role=` and, with the roster on, `?user=` set persistent
+    // cookies so role gating and identity can be switched locally without a restart.
     if (authProvider instanceof MockAuthProvider) {
-        app.use(mockRoleCookieMiddleware());
+        app.use(authProvider.cookieMiddleware());
     }
     // Apply authentication middleware to all API and MCP routes
     app.use('/api/*', createAuthMiddleware(authProvider));
     app.use('/mcp', createAuthMiddleware(authProvider));
     app.use('/mcp/*', createAuthMiddleware(authProvider));
-    // Global routes (no project-specific CommandManager needed)
+    // Global routes (no project handle needed)
     app.route('/api/auth', createAuthRouter());
-    app.route('/api/projects', createProjectsRouter(registry, multiProjectRoot));
+    app.route('/api/projects', createProjectsRouter(directory, multiProjectRoot));
     // Test-mode reset endpoint: wipes the project dir, restores it from the
-    // golden snapshot, and rebuilds the registry in place. Used by the
+    // golden snapshot, and reopens its projects in place. Used by the
     // Playwright e2e harness to restore the project between spec files.
     // Gated by NODE_ENV so it never ships in production.
     if (process.env.NODE_ENV === 'test') {
@@ -129,21 +129,25 @@ export function createApp(authProvider, registry, opts, exportMode = false, mult
                     error: `Refusing to reset suspicious project path: ${resolvedProject}`,
                 }, 400);
             }
-            await fs.rm(resolvedProject, { recursive: true, force: true });
+            // Windows holds transient locks on files the server has just touched,
+            // which surface as EBUSY on the final rmdir. Retry rather than fail the reset.
+            await fs.rm(resolvedProject, {
+                recursive: true,
+                force: true,
+                maxRetries: 5,
+                retryDelay: 100,
+            });
             await fs.cp(goldenPath, resolvedProject, { recursive: true });
-            const projects = await scanForProjects(resolvedProject);
+            const projects = await directory.list();
             if (projects.length === 0) {
                 return c.json({
                     error: `reset scan found no projects at ${resolvedProject}`,
                 }, 500);
             }
-            const entries = [];
             for (const project of projects) {
-                const commands = new CommandManager(project.path, gitOptionsFromEnv());
-                await commands.initialize();
-                entries.push({ prefix: project.prefix, commands });
+                await directory.replace(project.prefix);
+                events.drop(project.prefix);
             }
-            await registry.replace(entries);
             return c.body(null, 204);
         });
     }
@@ -159,21 +163,21 @@ export function createApp(authProvider, registry, opts, exportMode = false, mult
             return c.json({ publicKey: null });
         }
     });
-    if (exportMode) {
+    if (exportPrefixes) {
         // Export mode: mount at each concrete prefix so SSG sees
         // static routes instead of dynamic :prefix patterns it would skip.
-        for (const { prefix } of registry.list()) {
-            const scoped = createProjectScopedRoutes(attachProjectRegistry(registry, prefix));
+        for (const prefix of exportPrefixes) {
+            const scoped = createProjectScopedRoutes(attachProjectDirectory(directory, events, prefix));
             app.route(`/api/projects/${prefix}`, scoped);
         }
     }
     else {
         // Normal mode: dynamic :prefix param
-        const scoped = createProjectScopedRoutes(attachProjectRegistry(registry));
+        const scoped = createProjectScopedRoutes(attachProjectDirectory(directory, events));
         app.route('/api/projects/:prefix', scoped);
     }
     // MCP endpoint for AI assistant integration
-    app.route('/mcp', createMcpRouter(registry));
+    app.route('/mcp', createMcpRouter(writableProjects(directory)));
     app.use('*', serveStatic({
         root: staticFrontendDirRelative,
     }));
@@ -187,15 +191,13 @@ export function createApp(authProvider, registry, opts, exportMode = false, mult
         return c.html(file.toString());
     });
     // Error handling
+    // Only server faults are logged; client errors are answered, not logged.
     app.onError((err, c) => {
-        if (!isSSGContext(c)) {
-            if (process.env.NODE_ENV !== 'test') {
-                console.error(err.stack);
-            }
+        const { status, body } = errorResponse(err);
+        if (status >= 500 && !isSSGContext(c) && process.env.NODE_ENV !== 'test') {
+            console.error(err.stack);
         }
-        return c.json({
-            error: err.message || 'Internal Server Error',
-        }, 500);
+        return c.json(body, status);
     });
     return app;
 }

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;EAWE;AACF,OAAO,EAAE,IAAI,EAA0B,MAAM,MAAM,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,kBAAkB,MAAM,gCAAgC,CAAC;AAChE,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAClD,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,gBAAgB,MAAM,8BAA8B,CAAC;AAC5D,OAAO,gBAAgB,MAAM,8BAA8B,CAAC;AAC5D,OAAO,iBAAiB,MAAM,+BAA+B,CAAC;AAC9D,OAAO,gBAAgB,MAAM,8BAA8B,CAAC;AAC5D,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,aAAa,MAAM,2BAA2B,CAAC;AACtD,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,UAAU,MAAM,wBAAwB,CAAC;AAChD,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,YAAY,MAAM,0BAA0B,CAAC;AACpD,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,mBAAmB,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,OAAO,cAAc,MAAM,sBAAsB,CAAC;AAClD,OAAO,aAAa,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE5E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEhD;;GAEG;AACH,SAAS,yBAAyB,CAChC,UAA6B;IAE7B,MAAM,aAAa,GAAG,IAAI,IAAI,EAA0B,CAAC;IACzD,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACnC,aAAa,CAAC,KAAK,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;IACzD,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3C,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACnD,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACrD,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACrD,aAAa,CAAC,KAAK,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IACvD,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACrD,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACnD,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC/C,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACnD,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACzC,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACnD,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACnD,aAAa,CAAC,KAAK,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IAC3D,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC7C,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC/C,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,YAA0B,EAC1B,QAAyB,EACzB,IAAkB,EAClB,UAAU,GAAG,KAAK,EAClB,gBAAyB;IAEzB,MAAM,GAAG,GAAG,IAAI,IAAI,EAA0B,CAAC;IAE/C,+EAA+E;IAC/E,iFAAiF;IACjF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACvC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QACtC,GAAG,CAAC,KAAK,CACP,GAAG,EACH,mBAAmB,CAAC;YAClB,MAAM;YACN,iBAAiB,EAAE,IAAI,GAAG,CAAC,GAAG,MAAM,MAAM,CAAC;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IAE9B,2BAA2B;IAC3B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE;QAC3B,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,UAAU,EAAE,UAAU;YACtB,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE;YAC3C,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM;YAC5D,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,SAAS;SACnE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,6EAA6E;IAC7E,IAAI,YAAY,YAAY,gBAAgB,EAAE,CAAC;QAC7C,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,4DAA4D;IAC5D,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;IACtD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;IACpD,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;IAEtD,4DAA4D;IAC5D,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC3C,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAE7E,wEAAwE;IACxE,mEAAmE;IACnE,oEAAoE;IACpE,qDAAqD;IACrD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACtC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACxD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACrD,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChC,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EACH,oFAAoF;iBACvF,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,0EAA0E;YAC1E,wEAAwE;YACxE,mCAAmC;YACnC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAClD,IACE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,eAAe;gBACjD,eAAe,KAAK,EAAE,CAAC,OAAO,EAAE,EAChC,CAAC;gBACD,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,8CAA8C,eAAe,EAAE;iBACvE,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,eAAe,CAAC,CAAC;YAExD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,mCAAmC,eAAe,EAAE;iBAC5D,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,EAAE,CAAC;YACnB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBACvE,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IACD,8BAA8B;IAC9B,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,IAAI,CAAC,gBAAgB;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAC5B,IAAI,CAAC,gBAAgB,EAAE,YAAY,EAAE,YAAY,CAAC,EAClD,OAAO,CACR,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,UAAU,EAAE,CAAC;QACf,yDAAyD;QACzD,mEAAmE;QACnE,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,yBAAyB,CACtC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,CACxC,CAAC;YACF,GAAG,CAAC,KAAK,CAAC,iBAAiB,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,qCAAqC;QACrC,MAAM,MAAM,GAAG,yBAAyB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1E,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,4CAA4C;IAC5C,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE7C,GAAG,CAAC,GAAG,CACL,GAAG,EACH,WAAW,CAAC;QACV,IAAI,EAAE,yBAAyB;KAChC,CAAC,CACH,CAAC;IAEF,wCAAwC;IACxC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,IACE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAC7B,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EACrC,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,CACvD,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IACH,iBAAiB;IACjB,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACrB,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACpC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,uBAAuB;SAC9C,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,yCAAyC;AAEzC,OAAO,EAAE,IAAI,EAA0B,MAAM,MAAM,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,kBAAkB,MAAM,gCAAgC,CAAC;AAChE,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAClD,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,gBAAgB,MAAM,8BAA8B,CAAC;AAC5D,OAAO,YAAY,MAAM,0BAA0B,CAAC;AACpD,OAAO,gBAAgB,MAAM,8BAA8B,CAAC;AAC5D,OAAO,iBAAiB,MAAM,+BAA+B,CAAC;AAC9D,OAAO,gBAAgB,MAAM,8BAA8B,CAAC;AAC5D,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,aAAa,MAAM,2BAA2B,CAAC;AACtD,OAAO,YAAY,MAAM,0BAA0B,CAAC;AACpD,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,UAAU,MAAM,wBAAwB,CAAC;AAChD,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,YAAY,MAAM,0BAA0B,CAAC;AACpD,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,mBAAmB,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,OAAO,cAAc,MAAM,sBAAsB,CAAC;AAClD,OAAO,aAAa,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEhD;;GAEG;AACH,SAAS,yBAAyB,CAChC,UAA6B;IAE7B,MAAM,aAAa,GAAG,IAAI,IAAI,EAA0B,CAAC;IACzD,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACnC,aAAa,CAAC,KAAK,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;IACzD,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3C,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACnD,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACrD,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC7C,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACrD,aAAa,CAAC,KAAK,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IACvD,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACrD,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACnD,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC/C,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC7C,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACnD,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACzC,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACnD,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACnD,aAAa,CAAC,KAAK,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IAC3D,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC7C,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC/C,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CACvB,YAA0B,EAC1B,SAA2B,EAC3B,IAAkB,EAClB,cAAyB,EACzB,gBAAyB;IAEzB,MAAM,GAAG,GAAG,IAAI,IAAI,EAA0B,CAAC;IAC/C,MAAM,UAAU,GAAG,cAAc,KAAK,SAAS,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,SAAS,CAAC,CAAC;IAE9C,+EAA+E;IAC/E,iFAAiF;IACjF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACvC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QACtC,GAAG,CAAC,KAAK,CACP,GAAG,EACH,mBAAmB,CAAC;YAClB,MAAM;YACN,iBAAiB,EAAE,IAAI,GAAG,CAAC,GAAG,MAAM,MAAM,CAAC;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IAE9B,2BAA2B;IAC3B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE;QAC3B,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,UAAU,EAAE,UAAU;YACtB,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE;YAC3C,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,SAAS;YAClE,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,SAAS;SACzD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,iFAAiF;IACjF,IAAI,YAAY,YAAY,gBAAgB,EAAE,CAAC;QAC7C,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,4DAA4D;IAC5D,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;IACtD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;IACpD,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;IAEtD,2CAA2C;IAC3C,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC3C,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAE9E,wEAAwE;IACxE,kEAAkE;IAClE,oEAAoE;IACpE,qDAAqD;IACrD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACtC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACxD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACrD,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChC,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EACH,oFAAoF;iBACvF,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,0EAA0E;YAC1E,wEAAwE;YACxE,mCAAmC;YACnC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAClD,IACE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,eAAe;gBACjD,eAAe,KAAK,EAAE,CAAC,OAAO,EAAE,EAChC,CAAC;gBACD,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,8CAA8C,eAAe,EAAE;iBACvE,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,sEAAsE;YACtE,+EAA+E;YAC/E,MAAM,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE;gBAC3B,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,CAAC;gBACb,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;YACH,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;YAExC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,mCAAmC,eAAe,EAAE;iBAC5D,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IACD,8BAA8B;IAC9B,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,IAAI,CAAC,gBAAgB;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAC5B,IAAI,CAAC,gBAAgB,EAAE,YAAY,EAAE,YAAY,CAAC,EAClD,OAAO,CACR,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,cAAc,EAAE,CAAC;QACnB,yDAAyD;QACzD,mEAAmE;QACnE,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,yBAAyB,CACtC,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAClD,CAAC;YACF,GAAG,CAAC,KAAK,CAAC,iBAAiB,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,qCAAqC;QACrC,MAAM,MAAM,GAAG,yBAAyB,CACtC,sBAAsB,CAAC,SAAS,EAAE,MAAM,CAAC,CAC1C,CAAC;QACF,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,4CAA4C;IAC5C,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAEhE,GAAG,CAAC,GAAG,CACL,GAAG,EACH,WAAW,CAAC;QACV,IAAI,EAAE,yBAAyB;KAChC,CAAC,CACH,CAAC;IAEF,wCAAwC;IACxC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,IACE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAC7B,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EACrC,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,CACvD,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IACH,iBAAiB;IACjB,yEAAyE;IACzE,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACzE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/auth/index.d.ts

@@ -1,16 +1,4 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2026
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation. This program is distributed in the hope that it
-  will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty
-  of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-  See the GNU Affero General Public License for more details.
-  You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
 export type { AuthProvider } from './types.js';
-export { MockAuthProvider, mockRoleCookieMiddleware } from './mock.js';
+export { MockAuthProvider } from './mock.js';
 export { KeycloakAuthProvider } from './keycloak.js';
 export type { KeycloakConfig } from './keycloak.js';

package/dist/auth/index.js

@@ -1,15 +1,5 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2026
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation. This program is distributed in the hope that it
-  will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty
-  of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-  See the GNU Affero General Public License for more details.
-  You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
-export { MockAuthProvider, mockRoleCookieMiddleware } from './mock.js';
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
+export { MockAuthProvider } from './mock.js';
 export { KeycloakAuthProvider } from './keycloak.js';
 //# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;EAWE;AAGF,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,yCAAyC;AAGzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC"}

package/dist/auth/keycloak.d.ts

@@ -1,17 +1,4 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2026
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation. This program is distributed in the hope that it
-  will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty
-  of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-  See the GNU Affero General Public License for more details.
-  You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
-import type { UserInfo } from '../types.js';
-import type { AuthProvider } from './types.js';
+import type { AuthProvider, AuthResult } from './types.js';
 export interface KeycloakConfig {
     issuer: string;
     audience: string;
@@ -22,6 +9,6 @@ export declare class KeycloakAuthProvider implements AuthProvider {
     private jwks;
     constructor(config: KeycloakConfig);
     private getJWKS;
-    authenticate(req: Request): Promise<UserInfo | null>;
+    authenticate(req: Request): Promise<AuthResult | null>;
     private mapRole;
 }

package/dist/auth/keycloak.js

@@ -1,15 +1,5 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2026
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation. This program is distributed in the hope that it
-  will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty
-  of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-  See the GNU Affero General Public License for more details.
-  You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
 import { createRemoteJWKSet, jwtVerify } from 'jose';
 import { UserRole } from '../types.js';
 export class KeycloakAuthProvider {
@@ -50,11 +40,17 @@ export class KeycloakAuthProvider {
             if (!claims.email) {
                 throw new Error('Missing email');
             }
+            // Optional in RFC 7519, and jwtVerify only checks it when present, so a
+            // token without one would rotate on jitter alone and never clamp.
+            if (!claims.exp) {
+                throw new Error('Missing exp');
+            }
             return {
                 id: claims.sub,
                 email: claims.email,
                 name: claims.name ?? claims.preferred_username ?? 'Unknown',
                 role,
+                exp: claims.exp,
             };
         }
         catch {

package/dist/auth/keycloak.js.map

@@ -1 +1 @@
-{"version":3,"file":"keycloak.js","sourceRoot":"","sources":["../../src/auth/keycloak.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;EAWE;AAEF,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAErD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAkBvC,MAAM,OAAO,oBAAoB;IACd,MAAM,CAAS;IACf,QAAQ,CAAS;IAC1B,IAAI,GAAiD,IAAI,CAAC;IAElE,YAAY,MAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAClC,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,gCAAgC,CAClE,CAAC;YACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAY;QAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;gBAC/C,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,OAA6B,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAEtD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YACnC,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,MAAM,CAAC,GAAG;gBACd,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,kBAAkB,IAAI,SAAS;gBAC3D,IAAI;aACL,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,KAAgB;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC,KAAK,CAAC;QACxB,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC;QACzB,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC;QACzB,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,OAAO,QAAQ,CAAC,SAAS,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;CACF"}
+{"version":3,"file":"keycloak.js","sourceRoot":"","sources":["../../src/auth/keycloak.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,yCAAyC;AAEzC,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAErD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAiBvC,MAAM,OAAO,oBAAoB;IACd,MAAM,CAAS;IACf,QAAQ,CAAS;IAC1B,IAAI,GAAiD,IAAI,CAAC;IAElE,YAAY,MAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAClC,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,gCAAgC,CAClE,CAAC;YACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAY;QAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;gBAC/C,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,OAA6B,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAEtD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YACnC,CAAC;YACD,wEAAwE;YACxE,kEAAkE;YAClE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;YACjC,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,MAAM,CAAC,GAAG;gBACd,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,kBAAkB,IAAI,SAAS;gBAC3D,IAAI;gBACJ,GAAG,EAAE,MAAM,CAAC,GAAG;aAChB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,KAAgB;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC,KAAK,CAAC;QACxB,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC;QACzB,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC;QACzB,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,OAAO,QAAQ,CAAC,SAAS,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;CACF"}

package/dist/auth/mock.d.ts

@@ -1,30 +1,22 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2026
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation. This program is distributed in the hope that it
-  will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty
-  of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-  See the GNU Affero General Public License for more details.
-  You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
 import type { MiddlewareHandler } from 'hono';
-import type { UserInfo } from '../types.js';
-import type { AuthProvider } from './types.js';
+import type { AuthProvider, AuthResult } from './types.js';
 export interface MockUserConfig {
     name?: string;
     email?: string;
+    roster?: boolean;
 }
 export declare const MOCK_ROLE_COOKIE = "mock-role";
+export declare const MOCK_USER_COOKIE = "mock-user";
+export declare const MOCK_EXP_COOKIE = "mock-exp";
+export declare const MOCK_AS_PARAM = "as";
 export declare class MockAuthProvider implements AuthProvider {
     private readonly userConfig;
     constructor(config?: MockUserConfig);
-    authenticate(req: Request): Promise<UserInfo>;
+    authenticate(req: Request): Promise<AuthResult | null>;
+    /**
+     * Turns ?role= and, with the roster on, ?user= and ?ttl= into cookies;
+     * "default" clears. ?ttl= seconds gives the session an expiry, which is
+     * what drives stream rotation and the 401 that follows it.
+     */
+    cookieMiddleware(): MiddlewareHandler;
 }
-/**
- * Dev-only middleware that turns `?role=<reader|editor|admin>` into a persistent
- * `mock-role` cookie, and clears it on `?role=default`.
- */
-export declare function mockRoleCookieMiddleware(): MiddlewareHandler;

package/dist/auth/mock.js

@@ -1,29 +1,82 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2026
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation. This program is distributed in the hope that it
-  will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty
-  of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-  See the GNU Affero General Public License for more details.
-  You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
 import { setCookie } from 'hono/cookie';
 import { UserRole } from '../types.js';
 export const MOCK_ROLE_COOKIE = 'mock-role';
-const ROLE_RESET_VALUE = 'default';
-const ROLE_ALIASES = {
-    reader: UserRole.Reader,
-    editor: UserRole.Editor,
-    admin: UserRole.Admin,
-    connector: UserRole.Connector,
-};
+export const MOCK_USER_COOKIE = 'mock-user';
+export const MOCK_EXP_COOKIE = 'mock-exp';
+export const MOCK_AS_PARAM = 'as';
+const RESET_VALUE = 'default';
+const MAX_TTL_SECONDS = 86_400;
+// Mock sessions do not expire. Saying so with a distant deadline rather than
+// no deadline keeps `exp` total for every consumer: it is far beyond the
+// 30-minute stream lifetime, so computeLifetimeMs() min()s it away and
+// rotation still falls to the jitter, exactly as an absent one did.
+const NO_EXPIRY_SECONDS = 100 * 365 * 24 * 60 * 60;
+function noExpiry() {
+    return Math.floor(Date.now() / 1000) + NO_EXPIRY_SECONDS;
+}
+const ROLE_ALIASES = new Map([
+    ['reader', UserRole.Reader],
+    ['editor', UserRole.Editor],
+    ['admin', UserRole.Admin],
+    ['connector', UserRole.Connector],
+]);
+// Opt-in: `cyberismo app` ships mock auth, where a roster identity would forge
+// git commit authorship. Dev and e2e need several users in one backend process.
+const MOCK_USERS = new Map([
+    [
+        'alice',
+        {
+            id: 'mock-user-alice',
+            name: 'Alice',
+            email: 'alice@example.com',
+            role: UserRole.Admin,
+        },
+    ],
+    [
+        'bob',
+        {
+            id: 'mock-user-bob',
+            name: 'Bob',
+            email: 'bob@example.com',
+            role: UserRole.Editor,
+        },
+    ],
+    [
+        'carol',
+        {
+            id: 'mock-user-carol',
+            name: 'Carol',
+            email: 'carol@example.com',
+            role: UserRole.Reader,
+        },
+    ],
+]);
 function parseRole(value) {
     if (!value)
         return null;
-    return ROLE_ALIASES[value.toLowerCase()] ?? null;
+    return ROLE_ALIASES.get(value.toLowerCase()) ?? null;
+}
+function parseUser(value) {
+    if (!value)
+        return null;
+    return MOCK_USERS.get(value.toLowerCase()) ?? null;
+}
+/** An unreadable deadline is dropped rather than treated as long past, which
+ * would lock the user out with no request left to clear the cookie. */
+function parseExpiry(value) {
+    const exp = Number(value);
+    return value && Number.isInteger(exp) && exp > 0 ? exp : null;
+}
+/** Seconds from now to the absolute epoch-second deadline to store. */
+function toDeadline(value) {
+    const seconds = Number(value);
+    if (!Number.isInteger(seconds) || seconds <= 0)
+        return null;
+    if (seconds > MAX_TTL_SECONDS)
+        return null;
+    return String(Math.floor(Date.now() / 1000) + seconds);
 }
 function readCookie(header, name) {
     if (!header)
@@ -38,40 +91,65 @@ function readCookie(header, name) {
     }
     return undefined;
 }
+function applyOverride(c, override, cookieName, toCookieValue) {
+    if (!override)
+        return;
+    if (override.toLowerCase() === RESET_VALUE) {
+        setCookie(c, cookieName, '', { path: '/', maxAge: 0 });
+        return;
+    }
+    const value = toCookieValue(override);
+    if (value === null)
+        return;
+    setCookie(c, cookieName, value, { path: '/', sameSite: 'Lax' });
+}
 export class MockAuthProvider {
     userConfig;
     constructor(config) {
         this.userConfig = config ?? {};
     }
     async authenticate(req) {
-        const cookieRole = parseRole(readCookie(req.headers.get('cookie'), MOCK_ROLE_COOKIE));
-        return {
+        const cookies = req.headers.get('cookie');
+        const cookieRole = parseRole(readCookie(cookies, MOCK_ROLE_COOKIE));
+        if (this.userConfig.roster) {
+            // One-shot: a second identity from inside a tab already signed in as
+            // someone else, so neither the cookie nor the role override applies.
+            const asUser = parseUser(new URL(req.url).searchParams.get(MOCK_AS_PARAM));
+            if (asUser)
+                return { ...asUser, exp: noExpiry() };
+        }
+        const rosterUser = this.userConfig.roster
+            ? parseUser(readCookie(cookies, MOCK_USER_COOKIE))
+            : null;
+        const expiry = this.userConfig.roster
+            ? parseExpiry(readCookie(cookies, MOCK_EXP_COOKIE))
+            : null;
+        if (expiry !== null && expiry * 1000 <= Date.now())
+            return null;
+        const exp = expiry ?? noExpiry();
+        const identity = rosterUser ?? {
             id: 'mock-user',
             email: this.userConfig.email ?? 'admin@cyberismo.local',
             name: this.userConfig.name ?? 'Local Admin',
-            role: cookieRole ?? UserRole.Admin,
+            role: UserRole.Admin,
         };
+        return { ...identity, role: cookieRole ?? identity.role, exp };
     }
-}
-/**
- * Dev-only middleware that turns `?role=<reader|editor|admin>` into a persistent
- * `mock-role` cookie, and clears it on `?role=default`.
- */
-export function mockRoleCookieMiddleware() {
-    return async (c, next) => {
-        const override = new URL(c.req.url).searchParams.get('role');
-        if (override) {
-            if (override.toLowerCase() === ROLE_RESET_VALUE) {
-                setCookie(c, MOCK_ROLE_COOKIE, '', { path: '/', maxAge: 0 });
+    /**
+     * Turns ?role= and, with the roster on, ?user= and ?ttl= into cookies;
+     * "default" clears. ?ttl= seconds gives the session an expiry, which is
+     * what drives stream rotation and the 401 that follows it.
+     */
+    cookieMiddleware() {
+        return async (c, next) => {
+            const params = new URL(c.req.url).searchParams;
+            applyOverride(c, params.get('role'), MOCK_ROLE_COOKIE, (value) => parseRole(value) ? value.toLowerCase() : null);
+            if (this.userConfig.roster) {
+                applyOverride(c, params.get('user'), MOCK_USER_COOKIE, (value) => parseUser(value) ? value.toLowerCase() : null);
+                applyOverride(c, params.get('ttl'), MOCK_EXP_COOKIE, toDeadline);
             }
-            else if (parseRole(override)) {
-                setCookie(c, MOCK_ROLE_COOKIE, override.toLowerCase(), {
-                    path: '/',
-                    sameSite: 'Lax',
-                });
-            }
-        }
-        await next();
-    };
+            await next();
+        };
+    }
 }
 //# sourceMappingURL=mock.js.map