@elementspanel/epanel-plugin-auth 0.0.0-stage → 1.0.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2025 MCSManager
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,5 @@
-# Temporary Holding Version
+# @elementspanel/epanel-plugin-auth
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Owns the daemon's identity check: the top-level middleware that gates every protocol event, the key verification the panel authenticates with, and the panel IP whitelist. Removing this plugin leaves the daemon answering to anyone who connects.
+
+Available for: daemon.

package/daemon/backend/index.cjs

@@ -0,0 +1,301 @@
+/******/ (() => { // webpackBootstrap
+/******/ 	"use strict";
+/******/ 	var __webpack_modules__ = ({
+
+/***/ "./plugins/auth/src/i18n/index.ts"
+(__unused_webpack_module, exports, __webpack_require__) {
+
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.localeMessages = void 0;
+const de_DE_json_1 = __importDefault(__webpack_require__("./plugins/auth/src/i18n/de_DE.json"));
+const en_US_json_1 = __importDefault(__webpack_require__("./plugins/auth/src/i18n/en_US.json"));
+const es_ES_json_1 = __importDefault(__webpack_require__("./plugins/auth/src/i18n/es_ES.json"));
+const fr_FR_json_1 = __importDefault(__webpack_require__("./plugins/auth/src/i18n/fr_FR.json"));
+const ja_JP_json_1 = __importDefault(__webpack_require__("./plugins/auth/src/i18n/ja_JP.json"));
+const ko_KR_json_1 = __importDefault(__webpack_require__("./plugins/auth/src/i18n/ko_KR.json"));
+const pt_BR_json_1 = __importDefault(__webpack_require__("./plugins/auth/src/i18n/pt_BR.json"));
+const ru_RU_json_1 = __importDefault(__webpack_require__("./plugins/auth/src/i18n/ru_RU.json"));
+const th_TH_json_1 = __importDefault(__webpack_require__("./plugins/auth/src/i18n/th_TH.json"));
+const tr_TR_json_1 = __importDefault(__webpack_require__("./plugins/auth/src/i18n/tr_TR.json"));
+const zh_CN_json_1 = __importDefault(__webpack_require__("./plugins/auth/src/i18n/zh_CN.json"));
+const zh_TW_json_1 = __importDefault(__webpack_require__("./plugins/auth/src/i18n/zh_TW.json"));
+// The lines this plugin writes about who connected and who was turned away.
+// Registered with the daemon's i18next instance at setup, so the shared
+// foundational `plugins/i18n` catalogue carries nothing authentication-specific.
+exports.localeMessages = {
+    de_de: de_DE_json_1.default,
+    en_us: en_US_json_1.default,
+    es_es: es_ES_json_1.default,
+    fr_fr: fr_FR_json_1.default,
+    ja_jp: ja_JP_json_1.default,
+    ko_kr: ko_KR_json_1.default,
+    pt_br: pt_BR_json_1.default,
+    ru_ru: ru_RU_json_1.default,
+    th_th: th_TH_json_1.default,
+    tr_tr: tr_TR_json_1.default,
+    zh_cn: zh_CN_json_1.default,
+    zh_tw: zh_TW_json_1.default
+};
+
+
+/***/ },
+
+/***/ "node:crypto"
+(module) {
+
+module.exports = require("node:crypto");
+
+/***/ },
+
+/***/ "./plugins/auth/src/i18n/de_DE.json"
+(module) {
+
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_auth_router.access":"Sitzung {{id}}({{address}}) Identitätsüberprüfung erfolgreich","TXT_CODE_auth_router.disconnect":"Die Sitzung {{id}}({{address}}) wurde aufgrund einer langen Zeitspanne ohne Identitätsüberprüfung getrennt.","TXT_CODE_auth_router.notAccess":"Sitzung {{id}}({{address}}) hat versucht, unbefugt auf {{event}} zuzugreifen und ist jetzt blockiert."}');
+
+/***/ },
+
+/***/ "./plugins/auth/src/i18n/en_US.json"
+(module) {
+
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_auth_router.access":"Session {{id}} ({{address}}) has successfully authenticated","TXT_CODE_auth_router.disconnect":"Session {{id}} ({{address}}) disconnected due to prolonged unauthentication","TXT_CODE_auth_router.notAccess":"Session {{id}} ({{address}}) attempted unauthorized access to {{event}} and has been blocked."}');
+
+/***/ },
+
+/***/ "./plugins/auth/src/i18n/es_ES.json"
+(module) {
+
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_auth_router.access":"Sesión {{id}}({{address}}) Verificación de identidad exitosa","TXT_CODE_auth_router.disconnect":"La sesión {{id}}({{address}}) se desconectó debido a un largo período de identidad no verificada.","TXT_CODE_auth_router.notAccess":"La sesión {{id}}({{address}}) intentó acceder no autorizado a {{event}} y ahora está bloqueada."}');
+
+/***/ },
+
+/***/ "./plugins/auth/src/i18n/fr_FR.json"
+(module) {
+
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_auth_router.access":"Session {{id}}({{address}}) Vérification d\'identité réussie","TXT_CODE_auth_router.disconnect":"La session {{id}}({{address}}) a été déconnectée en raison d\'une longue période d\'identité non vérifiée.","TXT_CODE_auth_router.notAccess":"La session {{id}}({{address}}) a tenté un accès non autorisé à {{event}} et est maintenant bloquée."}');
+
+/***/ },
+
+/***/ "./plugins/auth/src/i18n/ja_JP.json"
+(module) {
+
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_auth_router.access":"セッション {{id}}({{address}}) の本人確認が成功しました","TXT_CODE_auth_router.disconnect":"セッション {{id}}({{address}}) は、長期間 ID が確認されなかったため切断されました。","TXT_CODE_auth_router.notAccess":"セッション {{id}}({{address}}) は {{event}} への不正アクセスを試みたため、現在ブロックされています。"}');
+
+/***/ },
+
+/***/ "./plugins/auth/src/i18n/ko_KR.json"
+(module) {
+
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_auth_router.access":"세션 {{id}}({{address}}) 신원 확인 성공","TXT_CODE_auth_router.disconnect":"장기간 신원이 확인되지 않아 세션 {{id}}({{address}})의 연결이 끊어졌습니다.","TXT_CODE_auth_router.notAccess":"세션 {{id}}({{address}})이(가) {{event}}에 대한 무단 액세스를 시도하여 현재 차단되었습니다."}');
+
+/***/ },
+
+/***/ "./plugins/auth/src/i18n/pt_BR.json"
+(module) {
+
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_auth_router.access":"A sessão {{id}} ({{address}}) foi autenticada com sucesso","TXT_CODE_auth_router.disconnect":"A sessão {{id}} ({{address}}) foi desconectada devido à não autenticação prolongada","TXT_CODE_auth_router.notAccess":"A sessão {{id}} ({{address}}) tentou um acesso não autorizado a {{event}} e foi bloqueada."}');
+
+/***/ },
+
+/***/ "./plugins/auth/src/i18n/ru_RU.json"
+(module) {
+
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_auth_router.access":"Сеанс {{id}} ({{address}}) успешно аутентифицирован","TXT_CODE_auth_router.disconnect":"Сеанс {{id}} ({{address}}) отключен из-за длительной неаутентификации","TXT_CODE_auth_router.notAccess":"Сеанс {{id}} ({{address}}) попытался совершить несанкционированный доступ к {{event}}, и был заблокирован."}');
+
+/***/ },
+
+/***/ "./plugins/auth/src/i18n/th_TH.json"
+(module) {
+
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_auth_router.access":"เซสชัน {{id}} ({{address}}) ยืนยันตัวตนสำเร็จแล้ว","TXT_CODE_auth_router.disconnect":"เซสชัน {{id}} ({{address}}) ถูกตัดการเชื่อมต่อเนื่องจากไม่มีการยืนยันตัวตนเป็นเวลานาน","TXT_CODE_auth_router.notAccess":"เซสชัน {{id}} ({{address}}) พยายามเข้าถึง {{event}} โดยไม่ได้รับอนุญาตและถูกบล็อก"}');
+
+/***/ },
+
+/***/ "./plugins/auth/src/i18n/tr_TR.json"
+(module) {
+
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_auth_router.access":"Oturum {{id}} ({{address}}) kimliği başarıyla doğrulandı","TXT_CODE_auth_router.disconnect":"Oturum {{id}} ({{address}}) uzun süreli kimlik doğrulaması nedeniyle bağlantısı kesildi","TXT_CODE_auth_router.notAccess":"Oturum {{id}} ({{address}}) {{event}}\'a yetkisiz erişim girişiminde bulundu ve engellendi."}');
+
+/***/ },
+
+/***/ "./plugins/auth/src/i18n/zh_CN.json"
+(module) {
+
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_auth_router.access":"会话 {{id}}({{address}}) 验证身份成功","TXT_CODE_auth_router.disconnect":"会话 {{id}}({{address}}) 因长时间未验证身份而断开连接","TXT_CODE_auth_router.notAccess":"会话 {{id}}({{address}}) 试图无权限访问 {{event}} 现已阻止."}');
+
+/***/ },
+
+/***/ "./plugins/auth/src/i18n/zh_TW.json"
+(module) {
+
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_auth_router.access":"會話 {{id}}({{address}}) 驗證身分成功","TXT_CODE_auth_router.disconnect":"會話 {{id}}({{address}}) 因長時間未驗證身分而中斷連線","TXT_CODE_auth_router.notAccess":"會話 {{id}}({{address}}) 試圖無權限存取 {{event}} 現已封鎖."}');
+
+/***/ }
+
+/******/ 	});
+/************************************************************************/
+/******/ 	// The module cache
+/******/ 	var __webpack_module_cache__ = {};
+/******/ 	
+/******/ 	// The require function
+/******/ 	function __webpack_require__(moduleId) {
+/******/ 		// Check if module is in cache
+/******/ 		var cachedModule = __webpack_module_cache__[moduleId];
+/******/ 		if (cachedModule !== undefined) {
+/******/ 			return cachedModule.exports;
+/******/ 		}
+/******/ 		// Create a new module (and put it into the cache)
+/******/ 		var module = __webpack_module_cache__[moduleId] = {
+/******/ 			// no module.id needed
+/******/ 			// no module.loaded needed
+/******/ 			exports: {}
+/******/ 		};
+/******/ 	
+/******/ 		// Execute the module function
+/******/ 		__webpack_modules__[moduleId].call(module.exports, module, module.exports, __webpack_require__);
+/******/ 	
+/******/ 		// Return the exports of the module
+/******/ 		return module.exports;
+/******/ 	}
+/******/ 	
+/************************************************************************/
+var __webpack_exports__ = {};
+// This entry needs to be wrapped in an IIFE because it uses a non-standard name for the exports (exports).
+(() => {
+var exports = __webpack_exports__;
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.inject = void 0;
+exports.apply = apply;
+const node_crypto_1 = __webpack_require__("node:crypto");
+const i18n_1 = __webpack_require__("./plugins/auth/src/i18n/index.ts");
+// The daemon's identity check.
+//
+// Everything about deciding *who* may talk to this daemon lives here: the
+// top-level protocol middleware that gates every event, the key comparison the
+// panel authenticates with, the optional panel IP whitelist and the timeout that
+// hangs up on a connection that never authenticates.
+//
+// The daemon core keeps no "is auth enabled" branch anywhere — it simply has no
+// opinion on who is calling. Removing this plugin therefore leaves the daemon
+// answering every event to anyone who can reach the port, which is the same trade
+// the panel makes with `plugins/user`.
+//
+// The session type is this plugin's own; stream and upload passports are exposed
+// by the runtime transfer service.
+/** How long a connection may stay unauthenticated before it is hung up on. */
+const AUTH_TIMEOUT = 6000;
+/** What this plugin marks a session it has authenticated with. */
+const LOGIN_BY_TOP_LEVEL = "TOP_LEVEL";
+exports.inject = ["protocol", "i18n", "settings", "transfer"];
+function apply(ctx) {
+    ctx.i18n.define(i18n_1.localeMessages);
+    const $t = ctx.i18n.$t;
+    const protocol = ctx.protocol;
+    // Temporary upload/download passports are part of authentication: they are
+    // issued only after the panel has authenticated and are consumed by the file
+    // and terminal plugins. Keeping this event here leaves the server plugin
+    // responsible only for transport.
+    const ONE_HOUR_TIME = 3600000;
+    protocol.on("passport/register", (routerCtx, data) => {
+        const start = Date.now();
+        const end = start + ONE_HOUR_TIME;
+        if (!data?.name || !data?.password) {
+            throw new Error($t("TXT_CODE_passport_router.registerErr"));
+        }
+        ctx.transfer.passports.registerMission(data.password, {
+            name: data.name,
+            parameter: { ...data.parameter, _taskOwner: data._taskOwner },
+            count: data.count,
+            start,
+            end
+        });
+        protocol.response(routerCtx, true);
+    });
+    const isAuthenticated = (routerCtx) => routerCtx.session.key === ctx.settings.config.key &&
+        routerCtx.session.type === LOGIN_BY_TOP_LEVEL &&
+        routerCtx.session.login &&
+        routerCtx.session.id;
+    // Top-level authority authentication middleware. It is registered before the
+    // server listens, and it is the only protocol middleware, so it runs first for
+    // every event on every socket.
+    protocol.use(async (routePath, routerCtx, _data, next) => {
+        const socket = routerCtx.socket;
+        // release all data flow controllers
+        if (routePath.startsWith("stream"))
+            return next();
+        // Except for the auth controller, which is publicly accessible, other
+        // business controllers must be authorized before they can be accessed
+        if (routePath === "auth")
+            return await next();
+        if (!routerCtx.session) {
+            throw new Error("Session does not exist in authentication middleware.");
+        }
+        if (isAuthenticated(routerCtx))
+            return await next();
+        ctx.logger.warn($t("TXT_CODE_auth_router.notAccess", {
+            id: socket.id,
+            address: socket.handshake.address,
+            event: routePath
+        }));
+        return protocol.error(routerCtx, "error", protocol.IGNORE, { disablePrint: true });
+    });
+    // The authentication controller itself.
+    protocol.on("auth", (routerCtx, data) => {
+        try {
+            let ip = routerCtx.socket.handshake.address;
+            // extract IPv4 address from IPv6 format
+            if (ip.startsWith("::ffff:"))
+                ip = ip.substring(7);
+            const config = ctx.settings.config;
+            const suppliedKey = typeof data === "string" ? Buffer.from(data, "utf8") : Buffer.alloc(0);
+            const configuredKey = Buffer.from(String(config.key ?? ""), "utf8");
+            if ((!config.whiteListPanelIp || config.whiteListPanelIps.includes(ip)) &&
+                configuredKey.length > 0 &&
+                suppliedKey.length === configuredKey.length &&
+                (0, node_crypto_1.timingSafeEqual)(suppliedKey, configuredKey)) {
+                // The authentication is passed, and the registered session is a trusted
+                // session.
+                ctx.logger.info($t("TXT_CODE_auth_router.access", {
+                    id: routerCtx.socket.id,
+                    address: routerCtx.socket.handshake.address
+                }));
+                routerCtx.session.key = String(data ?? "");
+                routerCtx.session.login = true;
+                routerCtx.session.id = routerCtx.socket.id;
+                routerCtx.session.type = LOGIN_BY_TOP_LEVEL;
+                routerCtx.session.stream = {};
+                protocol.msg(routerCtx, "auth", true);
+            }
+            else {
+                protocol.msg(routerCtx, "auth", false);
+            }
+        }
+        catch (error) {
+            protocol.msg(routerCtx, "auth", false);
+        }
+    });
+    // Hang up on a connection that never authenticates. `ctx.setTimeout` is
+    // cancelled when the plugin unloads, so a pending timer leaves with it.
+    protocol.on("connection", (routerCtx) => {
+        const session = routerCtx.session;
+        ctx.setTimeout(() => {
+            if (!session.login) {
+                routerCtx.socket.disconnect();
+                ctx.logger.info($t("TXT_CODE_auth_router.disconnect", {
+                    id: routerCtx.socket.id,
+                    address: routerCtx.socket.handshake.address
+                }));
+            }
+        }, AUTH_TIMEOUT);
+    });
+}
+
+})();
+
+module.exports = __webpack_exports__;
+/******/ })()
+;

package/daemon/plugin.json

@@ -0,0 +1,8 @@
+{
+  "id": "auth",
+  "name": "Authentication",
+  "version": "1.0.0",
+  "description": "Owns the daemon's identity check: the top-level middleware that gates every protocol event, the key verification the panel authenticates with, and the panel IP whitelist. Removing this plugin leaves the daemon answering to anyone who connects.",
+  "priority": 20,
+  "backend": "backend/index.cjs"
+}

package/package.json

@@ -1,6 +1,41 @@
 {
   "name": "@elementspanel/epanel-plugin-auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "Owns the daemon's identity check: the top-level middleware that gates every protocol event, the key verification the panel authenticates with, and the panel IP whitelist. Removing this plugin leaves the daemon answering to anyone who connects.",
+  "license": "Apache-2.0",
+  "author": "Csituka_D <694428809@qq.com> (https://github.com/JessDaodao)",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/ElementsPanel/ElementsPanel"
+  },
+  "engines": {
+    "node": ">=22.15.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "daemon/",
+    "README.md",
+    "LICENSE"
+  ],
+  "exports": {
+    "./package.json": "./package.json",
+    "./daemon/plugin.json": "./daemon/plugin.json"
+  },
+  "elementspanel": {
+    "id": "auth",
+    "daemon": {
+      "directory": "daemon",
+      "folder": "auth"
+    }
+  },
+  "peerDependencies": {
+    "@elementspanel/daemon": "1.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@elementspanel/daemon": {
+      "optional": true
+    }
+  }
+}