@lifeaitools/clauth 1.4.2 → 1.4.4

package/cli/commands/serve.js

@@ -959,20 +959,35 @@ async function boot() {
   try {
     const ping = await fetch(BASE + "/ping").then(r => r.json());
     if (ping.locked) {
-      showLockScreen();
+      showLockScreen(ping.hard_locked);
     } else {
       showMain(ping);
       loadServices();
     }
   } catch {
-    showLockScreen();
+    showLockScreen(false);
   }
 }
 
-function showLockScreen() {
+function showLockScreen(hardLocked) {
   document.getElementById("lock-screen").style.display = "flex";
   document.getElementById("main-view").style.display = "none";
-  setTimeout(() => document.getElementById("lock-input").focus(), 50);
+  const input = document.getElementById("lock-input");
+  const btn   = document.getElementById("unlock-btn");
+  const sub   = document.getElementById("lock-sub");
+  const err   = document.getElementById("lock-err");
+  if (hardLocked) {
+    input.disabled = true;
+    btn.disabled = true;
+    sub.textContent = "Too many failed attempts";
+    err.textContent = "✗ Vault locked — restart daemon to try again";
+  } else {
+    input.disabled = false;
+    btn.disabled = false;
+    sub.textContent = "Paste your password to unlock";
+    err.textContent = "";
+    setTimeout(() => input.focus(), 50);
+  }
 }
 
 // ── Upgrade detection ────────────────────────────────────────────
@@ -1011,6 +1026,11 @@ function showMain(ping) {
   checkUpgrade(ping);
   document.getElementById("lock-screen").style.display = "none";
   document.getElementById("main-view").style.display = "block";
+  // Reset lock screen state for next lock
+  document.getElementById("lock-input").disabled = false;
+  document.getElementById("unlock-btn").disabled = false;
+  document.getElementById("lock-sub").textContent = "Paste your password to unlock";
+  document.getElementById("lock-err").textContent = "";
   if (ping) {
     document.getElementById("s-pid").textContent = ping.pid || "—";
     document.getElementById("s-fails").textContent =
@@ -1025,8 +1045,10 @@ async function unlock() {
   const input = document.getElementById("lock-input");
   const btn   = document.getElementById("unlock-btn");
   const err   = document.getElementById("lock-err");
+  const sub   = document.getElementById("lock-sub");
   const pw    = input.value;
 
+  if (input.disabled) return;
   if (!pw) { err.textContent = "Password is required."; return; }
 
   btn.disabled = true; btn.textContent = "Verifying…"; err.textContent = "";
@@ -1038,7 +1060,22 @@ async function unlock() {
       body: JSON.stringify({ password: pw })
     }).then(r => r.json());
 
-    if (r.error) throw new Error(r.error);
+    if (r.hard_locked) {
+      input.value = "";
+      input.disabled = true;
+      btn.disabled = true;
+      btn.textContent = "Unlock";
+      sub.textContent = "Too many failed attempts";
+      err.textContent = "✗ Vault locked — restart daemon to try again";
+      return;
+    }
+
+    if (r.error) {
+      const rem = r.failures_remaining !== undefined
+        ? \` (\${r.failures_remaining} attempt\${r.failures_remaining !== 1 ? "s" : ""} remaining)\`
+        : "";
+      throw new Error(r.error + rem);
+    }
 
     input.value = "";
     const ping = await fetch(BASE + "/ping").then(r => r.json());
@@ -1050,14 +1087,14 @@ async function unlock() {
     err.textContent = "✗ " + (e.message || "Invalid password");
     setTimeout(() => input.className = "lock-input", 600);
   } finally {
-    btn.disabled = false; btn.textContent = "Unlock";
+    if (!input.disabled) { btn.disabled = false; btn.textContent = "Unlock"; }
   }
 }
 
 // ── Lock ────────────────────────────────────
 async function lockVault() {
-  await fetch(BASE + "/lock", { method: "POST" }).catch(() => {});
-  showLockScreen();
+  const r = await fetch(BASE + "/lock", { method: "POST" }).then(r => r.json()).catch(() => ({}));
+  showLockScreen(r.hard_locked || false);
 }
 
 // ── Make Live (blue-green: promote staged instance to live port) ──
@@ -2279,6 +2316,9 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
   }
   const MAX_FAILS = 10;
   let failCount = 0;
+  const MAX_AUTH_FAILS = 10;
+  let authFailCount = 0;
+  let authHardLocked = false;
   let password = initPassword || null;   // null = locked; set via POST /auth
   const machineHash = getMachineHash();
 
@@ -2487,17 +2527,18 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       error: message,
       failures: failCount,
       failures_remaining: remaining,
-      ...(failCount >= MAX_FAILS ? { shutdown: true } : {})
+      ...(failCount >= MAX_FAILS ? { locked: true } : {})
     });
 
     res.writeHead(code, { "Content-Type": "application/json", ...CORS });
     res.end(body);
 
     if (failCount >= MAX_FAILS) {
-      const msg = `[${new Date().toISOString()}] Failure limit reached — shutting down\n`;
+      const msg = `[${new Date().toISOString()}] Failure limit reached — locking vault\n`;
       try { fs.appendFileSync(LOG_FILE, msg); } catch {}
-      removePid();
-      setTimeout(() => process.exit(1), 100);
+      password = null;
+      failCount = 0;
+      stopTunnel();
     }
   }
 
@@ -3013,8 +3054,11 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         status: "ok",
         pid: process.pid,
         locked: !password,
+        hard_locked: authHardLocked,
         failures: failCount,
         failures_remaining: MAX_FAILS - failCount,
+        auth_failures: authFailCount,
+        auth_failures_remaining: MAX_AUTH_FAILS - authFailCount,
         services: whitelist || "all",
         port,
         tunnel_status: tunnelStatus,
@@ -3092,8 +3136,9 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       return ok(res, { status: tunnelStatus });
     }
 
-    // GET /shutdown (for daemon stop — programmatic, keeps boot.key)
-    if (method === "GET" && reqPath === "/shutdown") {
+    // GET|POST /shutdown (for daemon stop — programmatic, keeps boot.key)
+    // Accept POST as well — older scripts and curl default to POST
+    if ((method === "GET" || method === "POST") && reqPath === "/shutdown") {
       stopTunnel();
       ok(res, { ok: true, message: "shutting down" });
       removePid();
@@ -3284,11 +3329,18 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         return res.end(JSON.stringify({ error: "password is required" }));
       }
 
+      if (authHardLocked) {
+        res.writeHead(401, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "Too many failed attempts — restart daemon to try again", hard_locked: true }));
+      }
+
       try {
         const { token, timestamp } = deriveToken(pw, machineHash);
         const result = await api.test(pw, machineHash, token, timestamp);
         if (result.error) throw new Error(result.error);
         password = pw;   // unlock — store in process memory only
+        authFailCount = 0;
+        authHardLocked = false;
         const logLine = `[${new Date().toISOString()}] Vault unlocked\n`;
         try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
         // Start rotation engine on unlock
@@ -3340,9 +3392,19 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         }
         return ok(res, { ok: true, locked: false });
       } catch {
-        // Wrong password — not a lockout strike, just a UI auth attempt
+        authFailCount++;
+        const authRemaining = MAX_AUTH_FAILS - authFailCount;
+        const failLog = `[${new Date().toISOString()}] [AUTH FAIL ${authFailCount}/${MAX_AUTH_FAILS}] Wrong password\n`;
+        try { fs.appendFileSync(LOG_FILE, failLog); } catch {}
+        if (authFailCount >= MAX_AUTH_FAILS) {
+          authHardLocked = true;
+          const lockLog = `[${new Date().toISOString()}] Auth failure limit reached — vault hard-locked\n`;
+          try { fs.appendFileSync(LOG_FILE, lockLog); } catch {}
+          res.writeHead(401, { "Content-Type": "application/json", ...CORS });
+          return res.end(JSON.stringify({ error: "Too many failed attempts — restart daemon to try again", hard_locked: true }));
+        }
         res.writeHead(401, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "Invalid password" }));
+        return res.end(JSON.stringify({ error: "Invalid password", failures_remaining: authRemaining }));
       }
     }
 
@@ -3352,7 +3414,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       stopTunnel();
       const logLine = `[${new Date().toISOString()}] Vault locked\n`;
       try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
-      return ok(res, { ok: true, locked: true });
+      return ok(res, { ok: true, locked: true, hard_locked: authHardLocked });
     }
 
     // POST /toggle/:service — enable or disable a service
@@ -4046,7 +4108,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     // Don't count browser noise, MCP discovery probes, or OAuth probes as auth failures
     const isBenign = reqPath.startsWith("/.well-known/") || [
       "/favicon.ico", "/robots.txt", "/apple-touch-icon.png", "/apple-touch-icon-precomposed.png",
-      "/sse", "/mcp", "/message", "/register", "/authorize", "/token",
+      "/sse", "/mcp", "/message", "/register", "/authorize", "/token", "/shutdown",
     ].includes(reqPath);
     if (isBenign) {
       res.writeHead(404, { "Content-Type": "application/json", ...CORS });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.4.2",
+  "version": "1.4.4",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {