@digitalpaws/starr 0.0.1

package/data/starr.jwt

@@ -0,0 +1 @@
+2ycV61gcvBbFPUFSyDwik7EjLTB5iEqpiONLIthUFr4=

package/data/starr.key

@@ -0,0 +1 @@
+dNLIYmYMSfBQNU7M/vsS8LZR88nH8/LhxHAL4jjeB3o=

package/dist/auth/auth-service.d.ts

@@ -0,0 +1,42 @@
+import type Database from "better-sqlite3";
+import type { Logger } from "../types/plugin.js";
+export declare class AuthService {
+    private db;
+    private logger;
+    constructor(db: Database.Database, logger: Logger);
+    needsSetup(): boolean;
+    setup(username: string, password: string): Promise<void>;
+    login(username: string, password: string): Promise<string | null>;
+    /**
+     * Create a session for an OIDC-authenticated user.
+     * Called after a successful OIDC callback.
+     * @param userId The user's UUID from the users table.
+     * @param role The user's role ("admin" | "user").
+     * @returns The JWT string.
+     */
+    loginOidc(userId: string, role: string): string;
+    validateToken(token: string): {
+        userId: string;
+        sessionId: string;
+        role: string;
+    } | null;
+    logout(sessionId: string): void;
+    changePassword(username: string, currentPassword: string, newPassword: string): Promise<void>;
+    /**
+     * Get the role for a user. Looks up by id or username in the users table.
+     * Falls back to "admin" for backward compatibility (pre-migration rows).
+     */
+    private getUserRole;
+    /**
+     * Get user details for the status endpoint.
+     * Returns the user's id, username, display name, avatar URL, and role.
+     */
+    getUserInfo(userId: string): {
+        id: string;
+        username: string;
+        displayName: string | null;
+        avatarUrl: string | null;
+        role: string;
+    } | null;
+}
+//# sourceMappingURL=auth-service.d.ts.map

package/dist/auth/auth-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../../src/auth/auth-service.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AA2OjD,qBAAa,WAAW;IACtB,OAAO,CAAC,EAAE,CAAoB;IAC9B,OAAO,CAAC,MAAM,CAAS;gBAGrB,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,MAAM,EAAE,MAAM;IAMhB,UAAU,IAAI,OAAO;IAIf,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IASvE;;;;;;OAMG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM;IAK/C,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAIxF,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAIzB,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAIhB;;;OAGG;IACH,OAAO,CAAC,WAAW;IAOnB;;;OAGG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG;QAC3B,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,IAAI;CAaT"}

package/dist/auth/auth-service.js

@@ -0,0 +1,226 @@
+// SPDX-License-Identifier: 0BSD
+// SPDX-FileCopyrightText: 2025 Digi <digitalpaws@proton.me>
+import * as argon2 from "argon2";
+import { createHmac, randomUUID } from "node:crypto";
+import { getJwtSecret } from "./jwt-secret.js";
+// ── Password hashing (Argon2id) ─────────────────────────────
+const ARGON2_OPTIONS = {
+    type: argon2.argon2id, // explicit Argon2id
+    memoryCost: 19456, // ~19 MiB (OWASP minimum for Argon2id)
+    timeCost: 2,
+    parallelism: 1,
+};
+async function hashPassword(password) {
+    return argon2.hash(password, ARGON2_OPTIONS);
+}
+async function verifyPassword(hash, password) {
+    return argon2.verify(hash, password);
+}
+function base64url(buf) {
+    return buf
+        .toString("base64")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+function base64urlDecode(str) {
+    str = str.replace(/-/g, "+").replace(/_/g, "/");
+    while (str.length % 4)
+        str += "=";
+    return Buffer.from(str, "base64");
+}
+function signJwt(payload) {
+    const header = base64url(Buffer.from(JSON.stringify({ alg: "HS256", typ: "JWT" })));
+    const body = base64url(Buffer.from(JSON.stringify(payload)));
+    const secret = getJwtSecret();
+    const sig = base64url(createHmac("sha256", secret).update(`${header}.${body}`).digest());
+    return `${header}.${body}.${sig}`;
+}
+function verifyJwt(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return null;
+    const [headerB64, bodyB64, sigB64] = parts;
+    // Verify signature
+    const secret = getJwtSecret();
+    const expectedSig = base64url(createHmac("sha256", secret).update(`${headerB64}.${bodyB64}`).digest());
+    if (sigB64 !== expectedSig)
+        return null;
+    // Decode payload
+    let payload;
+    try {
+        payload = JSON.parse(base64urlDecode(bodyB64).toString("utf8"));
+    }
+    catch {
+        return null;
+    }
+    // Validate expiry
+    if (typeof payload.exp !== "number" || payload.exp < Math.floor(Date.now() / 1000)) {
+        return null;
+    }
+    return payload;
+}
+// ── Session TTL ─────────────────────────────────────────────
+const SESSION_TTL_HOURS = parseInt(process.env.STARR_SESSION_TTL_HOURS ?? "168", 10);
+// ── Session management (DB) ────────────────────────────────
+function createSession(db, userId, role, // NEW parameter
+logger) {
+    const sessionId = randomUUID();
+    const now = Math.floor(Date.now() / 1000);
+    const exp = now + SESSION_TTL_HOURS * 3600;
+    const payload = { sub: userId, sid: sessionId, role, iat: now, exp };
+    const jwt = signJwt(payload);
+    db.prepare(`INSERT INTO sessions (session_id, user_id, created_at, expires_at)
+     VALUES (@sid, @uid, datetime('now'), datetime(@exp, 'unixepoch'))`).run({ sid: sessionId, uid: userId, exp });
+    logger.info("session created", { userId, sessionId });
+    return { sessionId, jwt };
+}
+function validateSession(db, token, logger) {
+    const payload = verifyJwt(token);
+    if (!payload)
+        return null;
+    // Check session exists and is not expired in the DB
+    const row = db.prepare(`SELECT user_id, expires_at FROM sessions WHERE session_id = @sid`).get({ sid: payload.sid });
+    if (!row) {
+        logger.debug("session not found in DB", { sessionId: payload.sid });
+        return null;
+    }
+    // DB expiry check (defense in depth; JWT exp is primary)
+    if (new Date(row.expires_at + "Z").getTime() < Date.now()) {
+        logger.debug("session expired", { sessionId: payload.sid });
+        // Clean up expired session
+        db.prepare("DELETE FROM sessions WHERE session_id = @sid").run({ sid: payload.sid });
+        return null;
+    }
+    return {
+        userId: payload.sub,
+        sessionId: payload.sid,
+        role: payload.role ?? "user", // NEW: extract role from JWT
+    };
+}
+function destroySession(db, sessionId) {
+    db.prepare("DELETE FROM sessions WHERE session_id = @sid").run({ sid: sessionId });
+}
+function destroyAllSessionsForUser(db, userId) {
+    db.prepare("DELETE FROM sessions WHERE user_id = @uid").run({ uid: userId });
+}
+// ── First-run detection & Account CRUD ─────────────────────
+function hasAdminAccount(db) {
+    const row = db.prepare("SELECT 1 FROM admin_accounts LIMIT 1").get();
+    return row !== undefined;
+}
+async function createAdminAccount(db, username, password, logger) {
+    if (hasAdminAccount(db)) {
+        throw new Error("Admin account already exists");
+    }
+    if (!username || username.length < 1) {
+        throw new Error("Username must not be empty");
+    }
+    if (!password || password.length < 8) {
+        throw new Error("Password must be at least 8 characters");
+    }
+    const passwordHash = await hashPassword(password);
+    // Use a transaction to keep both inserts atomic
+    db.transaction(() => {
+        db.prepare(`INSERT INTO admin_accounts (username, password_hash) VALUES (@u, @h)`).run({ u: username, h: passwordHash });
+        // Also create the corresponding users row
+        db.prepare(`
+      INSERT OR IGNORE INTO users (id, username, display_name, role, provider)
+      VALUES (@id, @username, @displayName, 'admin', 'local')
+    `).run({
+            id: username, // use the username as the id for backward compat
+            username,
+            displayName: username,
+        });
+    })();
+    logger.info("admin account created", { username });
+}
+async function verifyAdminPassword(db, username, password) {
+    const row = db.prepare("SELECT password_hash FROM admin_accounts WHERE username = @u").get({ u: username });
+    if (!row)
+        return false;
+    return verifyPassword(row.password_hash, password);
+}
+async function changePassword(db, username, currentPassword, newPassword, logger) {
+    if (!newPassword || newPassword.length < 8) {
+        throw new Error("New password must be at least 8 characters");
+    }
+    const valid = await verifyAdminPassword(db, username, currentPassword);
+    if (!valid) {
+        throw new Error("Current password is incorrect");
+    }
+    const newHash = await hashPassword(newPassword);
+    db.prepare(`UPDATE admin_accounts SET password_hash = @h, updated_at = datetime('now') WHERE username = @u`).run({ u: username, h: newHash });
+    // Invalidate all existing sessions for this user
+    destroyAllSessionsForUser(db, username);
+    logger.info("password changed", { username });
+}
+// ── AuthService class ──────────────────────────────────────
+export class AuthService {
+    db;
+    logger;
+    constructor(db, logger) {
+        this.db = db;
+        this.logger = logger;
+    }
+    needsSetup() {
+        return !hasAdminAccount(this.db);
+    }
+    async setup(username, password) {
+        return createAdminAccount(this.db, username, password, this.logger);
+    }
+    async login(username, password) {
+        const valid = await verifyAdminPassword(this.db, username, password);
+        if (!valid)
+            return null;
+        // Look up the user's role from the users table
+        const role = this.getUserRole(username);
+        const { jwt } = createSession(this.db, username, role, this.logger);
+        return jwt;
+    }
+    /**
+     * Create a session for an OIDC-authenticated user.
+     * Called after a successful OIDC callback.
+     * @param userId The user's UUID from the users table.
+     * @param role The user's role ("admin" | "user").
+     * @returns The JWT string.
+     */
+    loginOidc(userId, role) {
+        const { jwt } = createSession(this.db, userId, role, this.logger);
+        return jwt;
+    }
+    validateToken(token) {
+        return validateSession(this.db, token, this.logger);
+    }
+    logout(sessionId) {
+        destroySession(this.db, sessionId);
+    }
+    async changePassword(username, currentPassword, newPassword) {
+        return changePassword(this.db, username, currentPassword, newPassword, this.logger);
+    }
+    /**
+     * Get the role for a user. Looks up by id or username in the users table.
+     * Falls back to "admin" for backward compatibility (pre-migration rows).
+     */
+    getUserRole(userId) {
+        const row = this.db.prepare("SELECT role FROM users WHERE id = @id OR username = @id").get({ id: userId });
+        return row?.role ?? "admin";
+    }
+    /**
+     * Get user details for the status endpoint.
+     * Returns the user's id, username, display name, avatar URL, and role.
+     */
+    getUserInfo(userId) {
+        const row = this.db.prepare("SELECT id, username, display_name, avatar_url, role FROM users WHERE id = @id OR username = @id").get({ id: userId });
+        if (!row)
+            return null;
+        return {
+            id: row.id,
+            username: row.username,
+            displayName: row.display_name,
+            avatarUrl: row.avatar_url,
+            role: row.role,
+        };
+    }
+}
+//# sourceMappingURL=auth-service.js.map

package/dist/auth/auth-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-service.js","sourceRoot":"","sources":["../../src/auth/auth-service.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,4DAA4D;AAE5D,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGrD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,+DAA+D;AAE/D,MAAM,cAAc,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAG,oBAAoB;IAC5C,UAAU,EAAE,KAAK,EAAO,uCAAuC;IAC/D,QAAQ,EAAE,CAAC;IACX,WAAW,EAAE,CAAC;CACf,CAAC;AAEF,KAAK,UAAU,YAAY,CAAC,QAAgB;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,QAAgB;IAC1D,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACvC,CAAC;AAYD,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG;SACP,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,IAAI,GAAG,CAAC;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,OAAO,CAAC,OAAmB;IAClC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,OAAO,GAAG,MAAM,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;IAE3C,mBAAmB;IACnB,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,SAAS,CAC3B,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CACxE,CAAC;IACF,IAAI,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAExC,iBAAiB;IACjB,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kBAAkB;IAClB,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+DAA+D;AAE/D,MAAM,iBAAiB,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;AAErF,8DAA8D;AAE9D,SAAS,aAAa,CACpB,EAAqB,EACrB,MAAc,EACd,IAAY,EAAO,gBAAgB;AACnC,MAAc;IAEd,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,GAAG,iBAAiB,GAAG,IAAI,CAAC;IAE3C,MAAM,OAAO,GAAe,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACjF,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7B,EAAE,CAAC,OAAO,CACR;uEACmE,CACpE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAE5C,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACtD,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,eAAe,CACtB,EAAqB,EACrB,KAAa,EACb,MAAc;IAEd,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,oDAAoD;IACpD,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CACpB,kEAAkE,CACnE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAwD,CAAC;IAEnF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yDAAyD;IACzD,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5D,2BAA2B;QAC3B,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACrF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,GAAG;QACnB,SAAS,EAAE,OAAO,CAAC,GAAG;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,MAAM,EAAG,6BAA6B;KAC7D,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,EAAqB,EAAE,SAAiB;IAC9D,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,yBAAyB,CAAC,EAAqB,EAAE,MAAc;IACtE,EAAE,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,8DAA8D;AAE9D,SAAS,eAAe,CAAC,EAAqB;IAC5C,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,GAAG,EAAE,CAAC;IACrE,OAAO,GAAG,KAAK,SAAS,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,EAAqB,EACrB,QAAgB,EAChB,QAAgB,EAChB,MAAc;IAEd,IAAI,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;IAElD,gDAAgD;IAChD,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;QAClB,EAAE,CAAC,OAAO,CACR,sEAAsE,CACvE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QAExC,0CAA0C;QAC1C,EAAE,CAAC,OAAO,CAAC;;;KAGV,CAAC,CAAC,GAAG,CAAC;YACL,EAAE,EAAE,QAAQ,EAAG,iDAAiD;YAChE,QAAQ;YACR,WAAW,EAAE,QAAQ;SACtB,CAAC,CAAC;IACL,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,EAAqB,EACrB,QAAgB,EAChB,QAAgB;IAEhB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CACpB,8DAA8D,CAC/D,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAA0C,CAAC;IAChE,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,OAAO,cAAc,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,EAAqB,EACrB,QAAgB,EAChB,eAAuB,EACvB,WAAmB,EACnB,MAAc;IAEd,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;IAChD,EAAE,CAAC,OAAO,CACR,gGAAgG,CACjG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAEnC,iDAAiD;IACjD,yBAAyB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAExC,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,8DAA8D;AAE9D,MAAM,OAAO,WAAW;IACd,EAAE,CAAoB;IACtB,MAAM,CAAS;IAEvB,YACE,EAAqB,EACrB,MAAc;QAEd,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,UAAU;QACR,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,QAAgB;QAC5C,OAAO,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,QAAgB;QAC5C,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,+CAA+C;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpE,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,MAAc,EAAE,IAAY;QACpC,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC;IACb,CAAC;IAED,aAAa,CAAC,KAAa;QACzB,OAAO,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,QAAgB,EAChB,eAAuB,EACvB,WAAmB;QAEnB,OAAO,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACtF,CAAC;IAED;;;OAGG;IACK,WAAW,CAAC,MAAc;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB,yDAAyD,CAC1D,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAiC,CAAC;QACtD,OAAO,GAAG,EAAE,IAAI,IAAI,OAAO,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,MAAc;QAOxB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB,iGAAiG,CAClG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAQ,CAAC;QAC7B,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;IACJ,CAAC;CACF"}

package/dist/auth/http-server.d.ts

@@ -0,0 +1,16 @@
+import { type IncomingMessage, type ServerResponse } from "node:http";
+import type { Server } from "node:http";
+import type { Logger } from "../types/plugin.js";
+import { AuthService } from "./auth-service.js";
+declare const COOKIE_NAME = "starr_sid";
+declare function parseCookies(req: IncomingMessage): Record<string, string>;
+/**
+ * Extract and validate the JWT from the request cookie.
+ * Returns the authenticated userId, or null if not authenticated.
+ */
+declare function authenticate(req: IncomingMessage, auth: AuthService): string | null;
+type AuthHandler = (req: IncomingMessage, res: ServerResponse, userId: string) => Promise<void>;
+declare function withAuth(auth: AuthService, handler: AuthHandler): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+export declare function createAuthServer(auth: AuthService, logger: Logger, port?: number): Server;
+export { authenticate, withAuth, parseCookies, COOKIE_NAME };
+//# sourceMappingURL=http-server.d.ts.map

package/dist/auth/http-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../../src/auth/http-server.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AACpF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AA+BhD,QAAA,MAAM,WAAW,cAAc,CAAC;AAEhC,iBAAS,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUlE;AAmBD;;;GAGG;AACH,iBAAS,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,CAM5E;AAED,KAAK,WAAW,GAAG,CACjB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,iBAAS,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,IACzC,KAAK,eAAe,EAAE,KAAK,cAAc,mBAQxD;AAcD,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,SAAO,GACV,MAAM,CAqIR;AAED,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC"}

package/dist/auth/http-server.js

@@ -0,0 +1,207 @@
+// SPDX-License-Identifier: 0BSD
+// SPDX-FileCopyrightText: 2025 Digi <digitalpaws@proton.me>
+import { createServer } from "node:http";
+import { RateLimiter } from "./rate-limiter.js";
+// ── JSON Helpers ───────────────────────────────────────────
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        let body = "";
+        req.on("data", (chunk) => (body += chunk));
+        req.on("end", () => resolve(body));
+        req.on("error", reject);
+    });
+}
+async function readJson(req) {
+    const raw = await readBody(req);
+    if (!raw)
+        throw new Error("Empty request body");
+    return JSON.parse(raw);
+}
+function sendJson(res, status, data) {
+    const body = JSON.stringify(data);
+    res.writeHead(status, {
+        "Content-Type": "application/json",
+        "Content-Length": String(Buffer.byteLength(body)),
+    });
+    res.end(body);
+}
+// ── Cookie Helpers ─────────────────────────────────────────
+const COOKIE_NAME = "starr_sid";
+function parseCookies(req) {
+    const header = req.headers.cookie;
+    if (!header)
+        return {};
+    const result = {};
+    for (const part of header.split(";")) {
+        const eq = part.indexOf("=");
+        if (eq === -1)
+            continue;
+        result[part.slice(0, eq).trim()] = part.slice(eq + 1).trim();
+    }
+    return result;
+}
+function setAuthCookie(res, jwt) {
+    const maxAge = parseInt(process.env.STARR_SESSION_TTL_HOURS ?? "168", 10) * 3600;
+    res.setHeader("Set-Cookie", `${COOKIE_NAME}=${jwt}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${maxAge}`);
+}
+function clearAuthCookie(res) {
+    res.setHeader("Set-Cookie", `${COOKIE_NAME}=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0`);
+}
+// ── Auth Middleware ─────────────────────────────────────────
+/**
+ * Extract and validate the JWT from the request cookie.
+ * Returns the authenticated userId, or null if not authenticated.
+ */
+function authenticate(req, auth) {
+    const cookies = parseCookies(req);
+    const token = cookies[COOKIE_NAME];
+    if (!token)
+        return null;
+    const result = auth.validateToken(token);
+    return result?.userId ?? null;
+}
+function withAuth(auth, handler) {
+    return async (req, res) => {
+        const userId = authenticate(req, auth);
+        if (!userId) {
+            sendJson(res, 401, { error: "Unauthorized" });
+            return;
+        }
+        await handler(req, res, userId);
+    };
+}
+function getClientIp(req) {
+    const forwarded = req.headers["x-forwarded-for"];
+    if (typeof forwarded === "string")
+        return forwarded.split(",")[0].trim();
+    return req.socket.remoteAddress ?? "unknown";
+}
+// ── HTTP Server Factory ────────────────────────────────────
+export function createAuthServer(auth, logger, port = 3457) {
+    const limiter = new RateLimiter(4, 15);
+    const routes = new Map();
+    // ── Public routes ──
+    routes.set("GET /api/auth/needs-setup", async (_req, res) => {
+        sendJson(res, 200, { needsSetup: auth.needsSetup() });
+    });
+    routes.set("POST /api/auth/setup", async (req, res) => {
+        const ip = getClientIp(req);
+        if (!limiter.check(ip)) {
+            sendJson(res, 429, { error: "Too many attempts", retryAfter: limiter.retryAfterSeconds(ip) });
+            return;
+        }
+        try {
+            const body = await readJson(req);
+            if (!body.username || !body.password) {
+                sendJson(res, 400, { error: "username and password are required" });
+                return;
+            }
+            await auth.setup(body.username, body.password);
+            // Log in immediately after setup
+            const jwt = await auth.login(body.username, body.password);
+            if (jwt) {
+                limiter.reset(ip);
+                setAuthCookie(res, jwt);
+                sendJson(res, 201, { ok: true });
+            }
+            else {
+                sendJson(res, 500, { error: "Account created but login failed" });
+            }
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : "Unknown error";
+            if (msg.includes("already exists")) {
+                sendJson(res, 403, { error: msg });
+            }
+            else {
+                sendJson(res, 400, { error: msg });
+            }
+        }
+    });
+    routes.set("POST /api/auth/login", async (req, res) => {
+        const ip = getClientIp(req);
+        if (!limiter.check(ip)) {
+            res.setHeader("Retry-After", String(limiter.retryAfterSeconds(ip)));
+            sendJson(res, 429, { error: "Too many login attempts", retryAfter: limiter.retryAfterSeconds(ip) });
+            return;
+        }
+        try {
+            const body = await readJson(req);
+            if (!body.username || !body.password) {
+                sendJson(res, 400, { error: "username and password are required" });
+                return;
+            }
+            const jwt = await auth.login(body.username, body.password);
+            if (!jwt) {
+                sendJson(res, 401, { error: "Invalid credentials" });
+                return;
+            }
+            limiter.reset(ip);
+            setAuthCookie(res, jwt);
+            sendJson(res, 200, { ok: true });
+        }
+        catch (err) {
+            sendJson(res, 500, { error: err instanceof Error ? err.message : "Login failed" });
+        }
+    });
+    // ── Auth-required routes ──
+    routes.set("POST /api/auth/logout", withAuth(auth, async (req, res, _userId) => {
+        const cookies = parseCookies(req);
+        const token = cookies[COOKIE_NAME];
+        if (token) {
+            const result = auth.validateToken(token);
+            if (result)
+                auth.logout(result.sessionId);
+        }
+        clearAuthCookie(res);
+        sendJson(res, 200, { ok: true });
+    }));
+    routes.set("POST /api/auth/change-password", withAuth(auth, async (req, res, userId) => {
+        try {
+            const body = await readJson(req);
+            if (!body.currentPassword || !body.newPassword) {
+                sendJson(res, 400, { error: "currentPassword and newPassword are required" });
+                return;
+            }
+            await auth.changePassword(userId, body.currentPassword, body.newPassword);
+            // Create a new session with the new password context
+            const newJwt = await auth.login(userId, body.newPassword);
+            if (newJwt) {
+                setAuthCookie(res, newJwt);
+            }
+            sendJson(res, 200, { ok: true });
+        }
+        catch (err) {
+            sendJson(res, 400, { error: err instanceof Error ? err.message : "Password change failed" });
+        }
+    }));
+    routes.set("GET /api/auth/status", withAuth(auth, async (_req, res, userId) => {
+        sendJson(res, 200, { user: userId });
+    }));
+    // ── Server ──
+    const server = createServer(async (req, res) => {
+        const method = req.method ?? "GET";
+        const url = new URL(req.url ?? "/", "http://localhost");
+        const key = `${method} ${url.pathname}`;
+        const handler = routes.get(key);
+        if (!handler) {
+            sendJson(res, 404, { error: "Not found" });
+            return;
+        }
+        try {
+            await handler(req, res);
+        }
+        catch (err) {
+            logger.error("unhandled request error", { key, error: err instanceof Error ? err.message : String(err) });
+            if (!res.headersSent) {
+                sendJson(res, 500, { error: "Internal server error" });
+            }
+        }
+    });
+    server.listen(port, () => {
+        logger.info("auth HTTP server listening", { port });
+    });
+    return server;
+}
+export { authenticate, withAuth, parseCookies, COOKIE_NAME };
+//# sourceMappingURL=http-server.js.map

package/dist/auth/http-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-server.js","sourceRoot":"","sources":["../../src/auth/http-server.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,4DAA4D;AAE5D,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AAIpF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,8DAA8D;AAE9D,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC;QAC3C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CAA8B,GAAoB;IACvE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;AAC9B,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,kBAAkB;QAClC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;KAClD,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,8DAA8D;AAE9D,MAAM,WAAW,GAAG,WAAW,CAAC;AAEhC,SAAS,YAAY,CAAC,GAAoB;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,GAAmB,EAAE,GAAW;IACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;IACjF,GAAG,CAAC,SAAS,CACX,YAAY,EACZ,GAAG,WAAW,IAAI,GAAG,gDAAgD,MAAM,EAAE,CAC9E,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAmB;IAC1C,GAAG,CAAC,SAAS,CACX,YAAY,EACZ,GAAG,WAAW,iDAAiD,CAChE,CAAC;AACJ,CAAC;AAED,+DAA+D;AAE/D;;;GAGG;AACH,SAAS,YAAY,CAAC,GAAoB,EAAE,IAAiB;IAC3D,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC;AAChC,CAAC;AAQD,SAAS,QAAQ,CAAC,IAAiB,EAAE,OAAoB;IACvD,OAAO,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;QACzD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC;AACJ,CAAC;AAMD,SAAS,WAAW,CAAC,GAAoB;IACvC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjD,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzE,OAAO,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;AAC/C,CAAC;AAED,8DAA8D;AAE9D,MAAM,UAAU,gBAAgB,CAC9B,IAAiB,EACjB,MAAc,EACd,IAAI,GAAG,IAAI;IAEX,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAE1C,sBAAsB;IAEtB,MAAM,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC1D,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpD,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAA2C,GAAG,CAAC,CAAC;YAC3E,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACrC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/C,iCAAiC;YACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3D,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAClB,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACxB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACjE,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACnC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpD,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACpE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,UAAU,EAAE,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACpG,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAA2C,GAAG,CAAC,CAAC;YAC3E,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACrC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3D,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACxB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6BAA6B;IAE7B,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC7E,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QACnC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,MAAM;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;QACD,eAAe,CAAC,GAAG,CAAC,CAAC;QACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,GAAG,CAAC,gCAAgC,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACrF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAqD,GAAG,CAAC,CAAC;YACrF,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC/C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC,CAAC;gBAC9E,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1E,qDAAqD;YACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1D,IAAI,MAAM,EAAE,CAAC;gBACX,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC7B,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC5E,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC,CAAC;IAEJ,eAAe;IAEf,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAExC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1G,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QACvB,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC"}

package/dist/auth/jwt-secret.d.ts

@@ -0,0 +1,6 @@
+import type { Logger } from "../types/plugin.js";
+export declare function loadJwtSecret(dataDir: string, logger: Logger): Buffer;
+/** For testing only. */
+export declare function resetJwtSecret(): void;
+export declare function getJwtSecret(): Buffer;
+//# sourceMappingURL=jwt-secret.d.ts.map

package/dist/auth/jwt-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-secret.d.ts","sourceRoot":"","sources":["../../src/auth/jwt-secret.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAMjD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CA0CrE;AAED,wBAAwB;AACxB,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED,wBAAgB,YAAY,IAAI,MAAM,CAGrC"}

package/dist/auth/jwt-secret.js

@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: 0BSD
+// SPDX-FileCopyrightText: 2025 Digi <digitalpaws@proton.me>
+import { randomBytes } from "node:crypto";
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+import path from "node:path";
+const KEY_LENGTH = 32; // 256 bits, bytes
+let _secret = null;
+export function loadJwtSecret(dataDir, logger) {
+    if (_secret)
+        return _secret;
+    // 1. Env var
+    const envSecret = process.env.STARR_JWT_SECRET;
+    if (envSecret) {
+        const buf = Buffer.from(envSecret, "base64");
+        if (buf.length !== KEY_LENGTH) {
+            throw new Error(`STARR_JWT_SECRET must decode to ${KEY_LENGTH} bytes, got ${buf.length}`);
+        }
+        _secret = buf;
+        logger.info("JWT secret loaded from STARR_JWT_SECRET");
+        return _secret;
+    }
+    // 2. Key file
+    const keyPath = path.join(dataDir, "starr.jwt");
+    if (existsSync(keyPath)) {
+        const fileContent = readFileSync(keyPath, "utf8").trim();
+        const buf = Buffer.from(fileContent, "base64");
+        if (buf.length !== KEY_LENGTH) {
+            throw new Error(`Key file ${keyPath} must decode to ${KEY_LENGTH} bytes, got ${buf.length}`);
+        }
+        _secret = buf;
+        logger.info("JWT secret loaded from file", { keyPath });
+        return _secret;
+    }
+    // 3. Auto-generate
+    const newKey = randomBytes(KEY_LENGTH);
+    const encoded = newKey.toString("base64");
+    writeFileSync(keyPath, encoded + "\n", { mode: 0o600 });
+    _secret = newKey;
+    logger.info("auto-generated JWT secret (no STARR_JWT_SECRET set)", { keyPath });
+    return _secret;
+}
+/** For testing only. */
+export function resetJwtSecret() {
+    _secret = null;
+}
+export function getJwtSecret() {
+    if (!_secret)
+        throw new Error("JWT secret not loaded");
+    return _secret;
+}
+//# sourceMappingURL=jwt-secret.js.map

package/dist/auth/jwt-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-secret.js","sourceRoot":"","sources":["../../src/auth/jwt-secret.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,4DAA4D;AAE5D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,kBAAkB;AAEzC,IAAI,OAAO,GAAkB,IAAI,CAAC;AAElC,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,MAAc;IAC3D,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,aAAa;IACb,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC/C,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,mCAAmC,UAAU,eAAe,GAAG,CAAC,MAAM,EAAE,CACzE,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,GAAG,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QACvD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,cAAc;IACd,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,YAAY,OAAO,mBAAmB,UAAU,eAAe,GAAG,CAAC,MAAM,EAAE,CAC5E,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,GAAG,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,mBAAmB;IACnB,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1C,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,OAAO,GAAG,MAAM,CAAC;IACjB,MAAM,CAAC,IAAI,CACT,qDAAqD,EACrD,EAAE,OAAO,EAAE,CACZ,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,wBAAwB;AACxB,MAAM,UAAU,cAAc;IAC5B,OAAO,GAAG,IAAI,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACvD,OAAO,OAAO,CAAC;AACjB,CAAC"}