@lifeaitools/clauth 0.3.0 → 0.3.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "0.3.0",
+  "version": "0.3.5",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {

package/supabase/functions/auth-vault/index.ts

@@ -159,6 +159,17 @@ async function handleStatus(sb: any, mh: string) {
   return { services: services || [] };
 }
 
+async function handleChangePassword(sb: any, body: any, mh: string) {
+  const { new_hmac_seed_hash } = body;
+  if (!new_hmac_seed_hash) return { error: "new_hmac_seed_hash required" };
+  const { error } = await sb.from("clauth_machines")
+    .update({ hmac_seed_hash: new_hmac_seed_hash, fail_count: 0, locked: false })
+    .eq("machine_hash", mh);
+  if (error) return { error: error.message };
+  await auditLog(sb, mh, "system", "change-password", "success");
+  return { success: true };
+}
+
 async function handleRegisterMachine(sb: any, body: any) {
   const { machine_hash, hmac_seed_hash, label, admin_token } = body;
   if (admin_token !== ADMIN_BOOTSTRAP_TOKEN) return { error: "invalid_admin_token" };
@@ -216,8 +227,9 @@ Deno.serve(async (req: Request) => {
     case "add":      return Response.json(await handleAdd(sb, body, mh));
     case "remove":   return Response.json(await handleRemove(sb, body, mh));
     case "revoke":   return Response.json(await handleRevoke(sb, body, mh));
-    case "status":   return Response.json(await handleStatus(sb, mh));
-    case "test":     return Response.json({ valid: true, machine_hash: mh, timestamp: body.timestamp, ip });
+    case "status":          return Response.json(await handleStatus(sb, mh));
+    case "change-password": return Response.json(await handleChangePassword(sb, body, mh));
+    case "test":            return Response.json({ valid: true, machine_hash: mh, timestamp: body.timestamp, ip });
     default:         return Response.json({ error: "unknown_route", route }, { status: 404 });
   }
 });