@jimhoyd/urlcode-auth 0.1.0-alpha.1 → 0.1.0-alpha.3

package/dist/admin-account-store.js

@@ -0,0 +1,185 @@
+import { createHash } from 'node:crypto';
+const externalId = (provider, subject) => createHash('sha256').update(provider + '\0' + subject).digest('hex');
+/** All calls are inside the existing store revision/active-key checked transaction. */
+export function adminAccountOperation(operation, args, context) {
+    if (!operation.startsWith('adminAccount'))
+        return;
+    const { db, now } = context, fail = context.fail;
+    const permissions = (roles) => [...new Set(roles.flatMap(role => context.roles[role] ?? []))];
+    const administrator = (user) => permissions(user.roles).includes('*');
+    const authorize = (actor, target, permission, nextRoles) => {
+        const granted = permissions(actor.roles);
+        if (context.isRestricted(actor) || !granted.includes('*') && !granted.includes(permission))
+            fail(403, 'permission_denied');
+        if (actor.id === target.id)
+            fail(403, 'self_administration_denied');
+        for (const permission of [...permissions(target.roles), ...permissions(nextRoles ?? target.roles)])
+            if (!granted.includes('*') && !granted.includes(permission))
+                fail(403, 'delegation_ceiling_exceeded');
+    };
+    const activity = (kind, id) => { const row = db.prepare('SELECT added,last_used FROM auth_method_activity WHERE kind=? AND method_id=?').get(kind, id); return { ...(typeof row?.added === 'number' ? { added: row.added } : {}), ...(typeof row?.last_used === 'number' ? { lastUsed: row.last_used } : {}) }; };
+    const identities = (id) => db.prepare('SELECT provider,subject FROM auth_external WHERE account_id=? LIMIT 16').all(id).map(row => ({ provider: String(row.provider), subject: String(row.subject), id: externalId(String(row.provider), String(row.subject)) }));
+    const validate = (actor, plan) => {
+        const targets = plan.targets.map(entry => {
+            const user = context.account(entry.id);
+            if (!user)
+                fail(404, 'account_not_found');
+            if (user.version !== entry.version)
+                fail(409, 'account_changed');
+            authorize(actor, user, 'auth.users.manage', plan.parameters.roles);
+            if (plan.action === 'cancel-deletion') {
+                if (user.status !== 'pending-delete' || !user.deleteAfter || user.deleteAfter <= now)
+                    fail(409, 'deletion_unavailable');
+            }
+            else if (user.status === 'pending-delete')
+                fail(409, 'account_pending_deletion');
+            if (['force-password-reset', 'resend-verification', 'request-email-change'].includes(plan.action) && user.status !== 'active')
+                fail(409, 'account_not_active');
+            if (plan.action === 'resend-verification' && user.emailVerified)
+                fail(409, 'email_already_verified');
+            if (plan.action === 'remove-passkey') {
+                if (!db.prepare('SELECT id FROM auth_passkeys WHERE id=? AND account_id=?').get(plan.parameters.credentialId, user.id))
+                    fail(404, 'method_not_found');
+                if (user.mfaPasskeys?.includes(plan.parameters.credentialId))
+                    fail(409, 'factor_reset_case_required');
+                if (!user.passwordHash && identities(user.id).length === 0 && Number(db.prepare('SELECT count(*) AS n FROM auth_passkeys WHERE account_id=?').get(user.id)?.n) <= 1)
+                    fail(409, 'last_sign_in_method');
+            }
+            if (plan.action === 'remove-external') {
+                const methods = identities(user.id);
+                if (!methods.some(method => method.id === plan.parameters.externalId))
+                    fail(404, 'method_not_found');
+                if (!user.passwordHash && methods.length <= 1 && Number(db.prepare('SELECT count(*) AS n FROM auth_passkeys WHERE account_id=?').get(user.id)?.n) === 0)
+                    fail(409, 'last_sign_in_method');
+            }
+            if (['remove-passkey', 'remove-external'].includes(plan.action) && !user.passwordHash && !user.totpSecret && user.mfaPasskeys?.length) {
+                const remainingKeys = db.prepare('SELECT id FROM auth_passkeys WHERE account_id=?').all(user.id).map(row => String(row.id)).filter(id => plan.action !== 'remove-passkey' || id !== plan.parameters.credentialId);
+                const remainingExternal = identities(user.id).filter(method => plan.action !== 'remove-external' || method.id !== plan.parameters.externalId);
+                if (!remainingExternal.length && !remainingKeys.some(primary => user.mfaPasskeys.some(factor => factor !== primary && remainingKeys.includes(factor))))
+                    fail(409, 'last_sign_in_method');
+            }
+            if (plan.action === 'request-email-change') {
+                if (user.email === plan.parameters.email)
+                    fail(400, 'email_unchanged');
+                if (db.prepare('SELECT id FROM auth_accounts WHERE email=?').get(plan.parameters.email))
+                    fail(409, 'email_unavailable');
+                if (db.prepare('SELECT account_id FROM auth_email_changes WHERE account_id=? AND expires>?').get(user.id, now))
+                    fail(409, 'email_change_pending');
+            }
+            return user;
+        });
+        const disabling = (user) => ['schedule-deletion', 'force-password-reset'].includes(plan.action) || plan.action === 'assign-roles' && !permissions(plan.parameters.roles).includes('*');
+        if (targets.some(user => administrator(user) && user.status === 'active' && !context.isRestricted(user) && disabling(user))) {
+            const disabled = new Set(targets.filter(disabling).map(user => user.id));
+            const remaining = db.prepare("SELECT data FROM auth_accounts WHERE administrator=1 AND status='active'").all().some(row => { const user = JSON.parse(String(row.data)); return !disabled.has(user.id) && !context.isRestricted(user); });
+            if (!remaining)
+                fail(409, 'last_administrator_required');
+        }
+        return targets;
+    };
+    const revoke = (id) => { for (const table of ['auth_sessions', 'auth_tokens', 'auth_email_codes', 'auth_email_changes', 'auth_factor_recovery', 'auth_second_factor_proofs', 'auth_trusted_devices', 'auth_manual_recovery'])
+        db.prepare(`DELETE FROM ${table} WHERE account_id=?`).run(id); };
+    if (operation === 'adminAccountInspect') {
+        const actor = context.fresh(String(args.hash), now).user, target = context.account(String(args.accountId));
+        if (!target)
+            fail(404, 'account_not_found');
+        authorize(actor, target, 'auth.users.read');
+        context.audit(actor.id, 'admin.authentication_inspected', target.id, now, String(args.reason));
+        return { value: { accountId: target.id, password: !!target.passwordHash, totp: !!target.totpSecret, passkeys: db.prepare('SELECT id FROM auth_passkeys WHERE account_id=? LIMIT 16').all(target.id).map(row => ({ id: String(row.id), ...activity('passkey', String(row.id)), secondFactor: target.mfaPasskeys?.includes(String(row.id)) ?? false })), external: identities(target.id).map(({ id, provider, subject }) => ({ id, provider, ...activity('oidc', provider + '\0' + subject) })) } };
+    }
+    if (operation === 'adminAccountStage') {
+        const actor = context.fresh(String(args.hash), now).user, targets = args.accountIds.map(id => { const user = context.account(id); if (!user)
+            fail(404, 'account_not_found'); const tokens = args.tokens.find(item => item.accountId === id); return { id, version: user.version, primaryHash: tokens.primaryHash, secondaryHash: tokens.secondaryHash }; });
+        const plan = { actorId: actor.id, actorVersion: actor.version, action: args.action, reason: String(args.reason), parameters: args.parameters, targets };
+        const users = validate(actor, plan);
+        db.prepare('DELETE FROM auth_admin_operations WHERE expires<=?').run(now);
+        if (Number(db.prepare('SELECT count(*) AS n FROM auth_admin_operations').get()?.n) >= 1000)
+            fail(503, 'auth_capacity_reached');
+        db.prepare('INSERT INTO auth_admin_operations(id,data,expires) VALUES(?,?,?)').run(String(args.operationId), JSON.stringify(plan), now + 300000);
+        const deliveries = [];
+        for (const user of users) {
+            const base = { accountId: user.id, email: user.email, ...(user.profile?.locale ? { locale: user.profile.locale } : {}) };
+            if (['remove-passkey', 'remove-external'].includes(plan.action) && !user.passwordHash && !user.totpSecret && user.mfaPasskeys?.length) {
+                const remainingKeys = db.prepare('SELECT id FROM auth_passkeys WHERE account_id=?').all(user.id).map(row => String(row.id)).filter(id => plan.action !== 'remove-passkey' || id !== plan.parameters.credentialId);
+                const remainingExternal = identities(user.id).filter(method => plan.action !== 'remove-external' || method.id !== plan.parameters.externalId);
+                if (!remainingExternal.length && !remainingKeys.some(primary => user.mfaPasskeys.some(factor => factor !== primary && remainingKeys.includes(factor))))
+                    fail(409, 'last_sign_in_method');
+            }
+            if (plan.action === 'request-email-change') {
+                deliveries.push({ ...base, kind: 'token', purpose: 'cancel-email-change', tokenSlot: 'secondary' }, { ...base, email: plan.parameters.email, kind: 'token', purpose: 'verify-email-change', tokenSlot: 'primary' });
+            }
+            else if (['force-password-reset', 'resend-verification', 'schedule-deletion'].includes(plan.action))
+                deliveries.push({ ...base, kind: 'token', purpose: plan.action === 'force-password-reset' ? 'reset-password' : plan.action === 'resend-verification' ? 'verify-email' : 'cancel-deletion', tokenSlot: 'primary' });
+            else
+                deliveries.push({ ...base, kind: 'notice', action: plan.action });
+            context.audit(actor.id, 'admin.' + plan.action + '.staged', user.id, now, plan.reason);
+        }
+        return { value: { operationId: String(args.operationId), deliveries } };
+    }
+    if (operation === 'adminAccountComplete' || operation === 'adminAccountCancel') {
+        const actor = context.fresh(String(args.hash), now).user, row = db.prepare('SELECT data FROM auth_admin_operations WHERE id=? AND expires>?').get(String(args.operationId), now);
+        if (!row)
+            fail(409, 'administration_unavailable');
+        const plan = JSON.parse(String(row.data));
+        if (plan.actorId !== actor.id || plan.actorVersion !== actor.version)
+            fail(409, 'administration_actor_changed');
+        if (operation === 'adminAccountCancel') {
+            db.prepare('DELETE FROM auth_admin_operations WHERE id=?').run(String(args.operationId));
+            for (const target of plan.targets)
+                context.audit(actor.id, 'admin.' + plan.action + '.cancelled', target.id, now, plan.reason);
+            return { value: undefined };
+        }
+        const users = validate(actor, plan);
+        for (const user of users) {
+            const tokens = plan.targets.find(target => target.id === user.id);
+            if (!['resend-verification', 'request-email-change'].includes(plan.action)) {
+                user.version++;
+                revoke(user.id);
+            }
+            switch (plan.action) {
+                case 'verify-email':
+                    user.emailVerified = true;
+                    break;
+                case 'force-password-reset':
+                    user.passwordHash = '';
+                    db.prepare("INSERT INTO auth_tokens VALUES(?,?,'reset-password',?,?)").run(tokens.primaryHash, user.id, now + 1800000, user.version);
+                    break;
+                case 'schedule-deletion':
+                    user.status = 'pending-delete';
+                    user.deleteAfter = now + context.deletionGraceMs;
+                    db.prepare("INSERT INTO auth_tokens VALUES(?,?,'cancel-deletion',?,?)").run(tokens.primaryHash, user.id, user.deleteAfter, user.version);
+                    break;
+                case 'cancel-deletion':
+                    user.status = 'active';
+                    delete user.deleteAfter;
+                    break;
+                case 'remove-passkey':
+                    db.prepare("DELETE FROM auth_method_activity WHERE kind='passkey' AND method_id=? AND account_id=?").run(plan.parameters.credentialId, user.id);
+                    db.prepare('DELETE FROM auth_passkeys WHERE id=? AND account_id=?').run(plan.parameters.credentialId, user.id);
+                    break;
+                case 'remove-external': {
+                    const method = identities(user.id).find(item => item.id === plan.parameters.externalId);
+                    db.prepare('DELETE FROM auth_external WHERE provider=? AND subject=? AND account_id=?').run(method.provider, method.subject, user.id);
+                    db.prepare("DELETE FROM auth_method_activity WHERE kind='oidc' AND method_id=? AND account_id=?").run(method.provider + '\0' + method.subject, user.id);
+                    break;
+                }
+                case 'assign-roles':
+                    user.roles = plan.parameters.roles;
+                    break;
+                case 'resend-verification':
+                    db.prepare("DELETE FROM auth_tokens WHERE account_id=? AND purpose='verify-email'").run(user.id);
+                    db.prepare("INSERT INTO auth_tokens VALUES(?,?,'verify-email',?,?)").run(tokens.primaryHash, user.id, now + 1800000, user.version);
+                    break;
+                case 'request-email-change':
+                    db.prepare('DELETE FROM auth_email_changes WHERE account_id=?').run(user.id);
+                    db.prepare('INSERT INTO auth_email_changes VALUES(?,?,?,?,?,?,?)').run(user.id, plan.parameters.email, tokens.primaryHash, tokens.secondaryHash, now + 86400000, now + 172800000, user.version);
+                    break;
+            }
+            context.save(user);
+            context.audit(actor.id, 'admin.' + plan.action, user.id, now, plan.reason);
+        }
+        db.prepare('DELETE FROM auth_admin_operations WHERE id=?').run(String(args.operationId));
+        return { value: { affected: users.length } };
+    }
+    return;
+}

package/dist/auth-baseline.d.ts

@@ -0,0 +1,30 @@
+import type { AuthService, AuthSecurityPolicy } from './auth-core.ts';
+export interface BaselineCheck {
+    name: string;
+    passed: boolean;
+}
+export interface AuthBaselineResult {
+    passed: boolean;
+    scope: 'offline-synthetic-runtime';
+    checks: BaselineCheck[];
+    liveProviders: 'unverified';
+    limitations: string[];
+}
+/** Fixed synthetic fixtures only; the deadline also bounds broken runtime startup. */
+export declare function runAuthBaseline(options?: {
+    timeoutMs?: number;
+    temporaryDirectory?: string;
+}): Promise<AuthBaselineResult>;
+/** Checks the already-loaded trusted service; no account mutation or migration is requested. */
+export declare function validateAuthService(service: AuthService): Promise<{
+    passed: boolean;
+    checks: BaselineCheck[];
+    revision: string;
+    registration: string;
+    security: AuthSecurityPolicy;
+    roles: {
+        count: number;
+        permissionCount: number;
+    };
+    liveProviders: 'unverified';
+}>;

package/dist/auth-baseline.js

@@ -0,0 +1,153 @@
+import { fork } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { mkdtemp, mkdir, writeFile, chmod, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+const limitations = ['Synthetic local probes are not an independent security assessment or deployment certification.', 'No network, live provider, mail delivery, browser, load or recovery drill is exercised.', 'These fixtures do not inspect an operator deployment, password-breach callback or SMS policy.'];
+const result = (checks) => ({ passed: checks.length > 0 && checks.every(item => item.passed), scope: 'offline-synthetic-runtime', checks, liveProviders: 'unverified', limitations: [...limitations] });
+/** Fixed synthetic fixtures only; the deadline also bounds broken runtime startup. */
+export async function runAuthBaseline(options = {}) {
+    const timeoutMs = options.timeoutMs ?? 30000;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 60000)
+        throw new Error('Invalid baseline deadline');
+    const root = await mkdtemp(join(options.temporaryDirectory ?? tmpdir(), 'urlcode-auth-baseline-'));
+    let child;
+    try {
+        await chmod(root, 0o700);
+        return await new Promise(resolve => {
+            let finished = false;
+            const finish = (value) => { if (finished)
+                return; finished = true; clearTimeout(timer); resolve(value); };
+            const timer = setTimeout(() => finish(result([{ name: 'baseline.completed-within-deadline', passed: false }])), timeoutMs);
+            try {
+                child = fork(fileURLToPath(import.meta.url), [root], { env: { URLCODE_AUTH_BASELINE_CHILD: '1' }, execArgv: ['--max-old-space-size=256', ...process.execArgv.filter(value => value.startsWith('--conditions='))], stdio: ['ignore', 'pipe', 'pipe', 'ipc'] });
+                // Fixed probes must not surface guest/runtime diagnostics as credential-bearing output.
+                child.stdout?.resume();
+                child.stderr?.resume();
+                child.once('message', (message) => finish(message));
+                child.once('error', () => finish(result([{ name: 'baseline.process-completed', passed: false }])));
+                child.once('exit', () => { if (!finished)
+                    finish(result([{ name: 'baseline.process-completed', passed: false }])); });
+            }
+            catch {
+                finish(result([{ name: 'baseline.process-started', passed: false }]));
+            }
+        });
+    }
+    finally {
+        if (child && child.exitCode === null && child.signalCode === null) {
+            const exited = new Promise(resolve => child.once('exit', () => resolve()));
+            child.kill('SIGKILL');
+            await exited;
+        }
+        await rm(root, { recursive: true, force: true });
+    }
+}
+/** Checks the already-loaded trusted service; no account mutation or migration is requested. */
+export async function validateAuthService(service) {
+    const revision = await service.getConfigurationRevision(), registration = service.getRegistrationMode(), value = service.getSecurityPolicy(), roles = service.getRoles();
+    const checks = [
+        { name: 'configuration.revision', passed: typeof revision === 'string' && /^[a-f0-9]{64}$/.test(revision) },
+        { name: 'configuration.registration', passed: ['open', 'invite-only', 'waitlist', 'off'].includes(registration) },
+        { name: 'configuration.security-policy', passed: Boolean(value && typeof value.requireEmailVerification === 'boolean' && typeof value.requireMfa === 'boolean' && Number.isSafeInteger(value.deletionGraceMs) && value.deletionGraceMs >= 86400000 && value.deletionGraceMs <= 2592000000 && (value.trustedDeviceTtlMs === undefined || Number.isSafeInteger(value.trustedDeviceTtlMs) && value.trustedDeviceTtlMs >= 60000 && value.trustedDeviceTtlMs <= 2592000000) && [value.allowPasskeySecondFactor, value.allowEmailFactorRecovery, value.allowManualRecovery].every(flag => flag === undefined || flag === true)) },
+    ];
+    const entries = roles && typeof roles === 'object' && !Array.isArray(roles) ? Object.entries(roles) : [];
+    checks.push({ name: 'configuration.roles', passed: entries.length > 0 && entries.length <= 64 && entries.every(([name, permissions]) => /^[a-z][a-z0-9_-]{0,63}$/.test(name) && Array.isArray(permissions) && permissions.length <= 128 && permissions.every(permission => typeof permission === 'string' && /^\*$|^[a-z][a-z0-9_.:-]{0,127}$/.test(permission))) });
+    checks.push({ name: 'configuration.revision-stable', passed: await service.getConfigurationRevision() === revision });
+    // Explicit allowlist: arbitrary operator callback properties never become diagnostic output.
+    const security = { requireEmailVerification: value.requireEmailVerification, requireMfa: value.requireMfa, deletionGraceMs: value.deletionGraceMs, ...(value.allowPasskeySecondFactor === true ? { allowPasskeySecondFactor: true } : {}), ...(value.allowEmailFactorRecovery === true ? { allowEmailFactorRecovery: true } : {}), ...(value.allowManualRecovery === true ? { allowManualRecovery: true } : {}), ...(typeof value.trustedDeviceTtlMs === 'number' ? { trustedDeviceTtlMs: value.trustedDeviceTtlMs } : {}) };
+    if (!checks.every(check => check.passed))
+        throw new Error('Invalid operator service configuration');
+    return { passed: true, checks, revision, registration, security, roles: { count: entries.length, permissionCount: new Set(entries.flatMap(([, permissions]) => permissions)).size }, liveProviders: 'unverified' };
+}
+async function probe(root) {
+    const checks = [], add = (name, passed) => checks.push({ name, passed });
+    let runtime, service;
+    try {
+        const { createRuntime } = await import('@jimhoyd/urlcode'), { inspectExtensionRevision } = await import('@jimhoyd/urlcode/extensions'), { createAuthService } = await import("./auth-core.js"), { authExtension } = await import("./auth.js");
+        const project = join(root, 'project'), operator = join(root, 'operator'), origin = 'https://baseline.invalid';
+        await mkdir(project, { mode: 0o700 });
+        await mkdir(operator, { mode: 0o700 });
+        await writeFile(join(project, 'urlcode.yaml'), JSON.stringify({ version: '1', extensions: { auth: { version: '1', config: { registration: 'open' } } }, routes: {
+                '/account/*': { extension: 'auth', methods: ['GET', 'HEAD', 'POST'] },
+                '/protected': { respond: { json: { authorized: true } }, methods: ['GET', 'POST'], policies: { extensions: { auth: { permission: 'baseline.read' } } } },
+                '/public-guest': { parameters: [{ name: 'cookie', in: 'header', schema: { type: 'string', default: 'untrusted-default' } }, { name: 'authorization', in: 'header', schema: { type: 'string' } }], function: { source: 'guest.mjs' } },
+            } }), { mode: 0o600 });
+        await writeFile(join(project, 'guest.mjs'), 'export default (request, context) => Response.json({ cookie: request.headers.get("cookie"), authorization: request.headers.get("authorization"), header: context.inputs.header });', { mode: 0o600 });
+        const revision = await inspectExtensionRevision(project), csrfKey = randomBytes(32), encryptionKey = randomBytes(32), password = 'synthetic-baseline-' + randomBytes(16).toString('hex');
+        service = await createAuthService({ database: join(operator, 'ordinary.sqlite'), encryptionKey, roles: { member: ['baseline.read'], admin: ['*'] }, defaultRole: 'member' });
+        const account = await service.register({ email: 'synthetic-baseline@example.test', password });
+        const startRuntime = () => createRuntime(project, { origin, environment: {}, workers: 1, timeoutMs: 1000, extensions: [authExtension({ service: service, csrfKey, projectSha256: revision })], log: () => { } });
+        runtime = await startRuntime();
+        const text = (response) => typeof response.body === 'string' ? response.body : response.body ? Buffer.from(response.body).toString('utf8') : '';
+        const cookies = new Map();
+        const cookieValues = (response) => response.headers.filter(([name]) => name.toLowerCase() === 'set-cookie').map(([, value]) => value);
+        const cookieSafe = (cookie) => { const parts = cookie.split(';').map(value => value.trim()), attrs = new Map(parts.slice(1).map(value => { const at = value.indexOf('='); return at < 0 ? [value.toLowerCase(), ''] : [value.slice(0, at).toLowerCase(), value.slice(at + 1)]; })); return parts[0].startsWith('__Host-') && attrs.has('secure') && attrs.has('httponly') && attrs.get('path') === '/' && attrs.get('samesite') === 'Strict' && !attrs.has('domain'); };
+        const request = async (target, data, requestOrigin = origin, extra = {}) => {
+            const headers = new Headers({ accept: 'application/json', ...(cookies.size ? { cookie: [...cookies].map(([name, value]) => name + '=' + value).join('; ') } : {}), ...(data ? { 'content-type': 'application/json', origin: requestOrigin } : {}), ...extra });
+            const response = await runtime.handle({ target, origin, method: data ? 'POST' : 'GET', headers, headerCounts: Object.fromEntries([...headers].map(([name]) => [name, 1])), ...(data ? { body: Buffer.from(JSON.stringify(data)) } : {}) });
+            for (const value of cookieValues(response)) {
+                const first = value.split(';')[0], at = first.indexOf('=');
+                if (value.includes('Max-Age=0'))
+                    cookies.delete(first.slice(0, at));
+                else
+                    cookies.set(first.slice(0, at), first.slice(at + 1));
+            }
+            return response;
+        };
+        add('authorization.anonymous-protected-denied', (await request('/protected')).status === 401);
+        const loginPage = await request('/account/login');
+        add('response.auth-no-store', loginPage.headers.some(([name, value]) => name.toLowerCase() === 'cache-control' && value === 'no-store'));
+        const initial = await request('/account/csrf'), csrf = JSON.parse(text(initial)).csrf;
+        add('response.preauth-cookie-policy', [...cookieValues(loginPage), ...cookieValues(initial)].length > 0 && [...cookieValues(loginPage), ...cookieValues(initial)].every(cookieSafe));
+        add('csrf.missing-denied', (await request('/account/login', { email: account.user.email, password })).status === 403);
+        add('csrf.foreign-origin-denied', (await request('/account/login', { email: account.user.email, password, csrf }, 'https://foreign.invalid')).status === 403);
+        const login = await request('/account/login', { email: account.user.email, password, csrf }), sessionToken = cookies.get('__Host-urlcode-session');
+        add('authentication.password-login', login.status === 200 && typeof sessionToken === 'string');
+        add('response.session-cookie-policy', cookieValues(login).some(value => value.startsWith('__Host-urlcode-session=')) && cookieValues(login).every(cookieSafe));
+        add('response.credentials-withheld', !text(login).includes(password) && Boolean(sessionToken) && !text(login).includes(sessionToken) && !/"(?:token|passwordHash|encryptionKey)"/.test(text(login)));
+        const sessionCsrf = JSON.parse(text(login)).csrf;
+        add('authorization.session-protected-allowed', (await request('/protected')).status === 200);
+        add('csrf.protected-mutation-denied', (await request('/protected', {})).status === 403);
+        add('csrf.protected-mutation-authorized', (await request('/protected', {}, origin, { 'x-csrf-token': sessionCsrf })).status === 200);
+        const guest = await request('/public-guest', undefined, origin, { authorization: 'Bearer synthetic-baseline-bearer' }), guestValue = JSON.parse(text(guest));
+        add('guest.credentials-and-derived-context-withheld', guest.status === 200 && guestValue.cookie === null && guestValue.authorization === null && JSON.stringify(guestValue.header) === '{}' && !text(guest).includes(sessionToken) && !text(guest).includes('synthetic-baseline-bearer'));
+        await service.revokeSessions(account.user.id);
+        add('session.revocation-enforced', (await request('/protected')).status === 401);
+        await runtime.close();
+        runtime = undefined;
+        await service.close();
+        service = undefined;
+        service = await createAuthService({ database: join(operator, 'required.sqlite'), encryptionKey, roles: { member: ['baseline.read'], admin: ['*'] }, defaultRole: 'member', requireEmailVerification: true, requireMfa: true });
+        const restricted = await service.bootstrapAdmin({ email: 'synthetic-restricted@example.test', password });
+        runtime = await startRuntime();
+        cookies.clear();
+        cookies.set('__Host-urlcode-session', restricted.token);
+        add('enrollment.required-policies-declared', service.getSecurityPolicy().requireEmailVerification && service.getSecurityPolicy().requireMfa);
+        add('enrollment.restricted-authority-withheld', restricted.principal.roles.length === 0 && restricted.principal.permissions.length === 0 && restricted.principal.restrictions?.includes('verify-email') === true && restricted.principal.restrictions.includes('enroll-mfa'));
+        add('enrollment.protected-route-denied', (await request('/protected')).status === 403);
+        add('enrollment.account-page-available', (await request('/account/account')).status === 200);
+    }
+    catch {
+        add('baseline.probes-completed', false);
+    }
+    finally {
+        try {
+            await runtime?.close();
+        }
+        catch {
+            add('cleanup.runtime-closed', false);
+        }
+        try {
+            await service?.close();
+        }
+        catch {
+            add('cleanup.service-closed', false);
+        }
+    }
+    return result(checks);
+}
+if (process.env.URLCODE_AUTH_BASELINE_CHILD === '1' && process.send && process.argv[2]) {
+    void probe(process.argv[2]).then(value => process.send(value), () => process.send(result([{ name: 'baseline.probes-completed', passed: false }])));
+}