@lifeaitools/clauth 1.9.2 → 1.9.3

package/cli/commands/serve.js

@@ -604,6 +604,22 @@ function isProcessAlive(pid) {
   try { process.kill(pid, 0); return true; } catch { return false; }
 }
 
+// STOP-ON-REJECTION classifier. A server `reason` of invalid_token / machine_locked
+// (and friends) is a terminal verdict: the supplied password/machine is wrong or the
+// machine is locked, so every further attempt only burns another of the 5 server-side
+// strikes toward a DB lockout. Transport failures (fetch failed, ECONNREFUSED, …) are
+// NOT verdicts — they carry no `reason` and are safe to retry. Pure + exported so the
+// regression is unit-testable without a live vault.
+export function isTerminalAuthVerdict(reason) {
+  if (!reason || typeof reason !== "string") return false;
+  return (
+    reason.includes("invalid_token") ||
+    reason.includes("machine_locked") ||
+    reason.includes("machine_disabled") ||
+    reason.includes("machine_not_found")
+  );
+}
+
 function openBrowser(url) {
   try {
     const cmd = os.platform() === "win32" ? `start "" "${url}"`
@@ -1361,8 +1377,17 @@ async function unlock() {
       input.disabled = true;
       btn.disabled = true;
       btn.textContent = "Unlock";
-      sub.textContent = "Too many failed attempts";
-      err.textContent = "✗ Vault locked — restart daemon to try again";
+      if (r.terminal) {
+        // Server rendered a terminal verdict (invalid_token / machine_locked).
+        // Show the reason — this is the one-line signal that diagnoses the lockout.
+        sub.textContent = r.reason ? ("Vault rejected: " + r.reason) : "Vault rejected credentials";
+        err.textContent = "✗ Recovery required — unlock machine + re-seal boot.key (see runbook)";
+      } else {
+        sub.textContent = "Too many failed attempts";
+        err.textContent = r.reason
+          ? ("✗ Vault locked (" + r.reason + ") — restart daemon to try again")
+          : "✗ Vault locked — restart daemon to try again";
+      }
       return;
     }
 
@@ -5376,7 +5401,13 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       try {
         const { token, timestamp } = deriveToken(pw, machineHash);
         const result = await api.test(pw, machineHash, token, timestamp);
-        if (result.error) throw new Error(result.error);
+        if (result.error) {
+          // Preserve the server's `reason` (invalid_token (N/5), machine_locked, …)
+          // so the catch block can surface it AND decide whether to keep retrying.
+          const authError = new Error(result.error);
+          authError.serverReason = result.reason || null;
+          throw authError;
+        }
         password = pw;   // unlock — store in process memory only
         writeSession = makeWriteToken();
         authFailCount = 0;
@@ -5436,26 +5467,42 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         return ok(res, { ok: true, locked: false, write_token: writeSession.token, write_expires_at: new Date(writeSession.expiresAt).toISOString() });
       } catch (authErr) {
         const msg = authErr.message || "";
+        const serverReason = authErr.serverReason || null;
         const isTransport = msg.includes("fetch failed") || msg.includes("ECONNREFUSED") || msg.includes("ETIMEDOUT") || msg.includes("ENOTFOUND") || msg.includes("network");
         if (isTransport) {
+          // Transport failure — the vault never rendered a verdict. Safe to retry; no strike.
           const failLog = `[${new Date().toISOString()}] Vault unreachable: ${msg}\n`;
           try { fs.appendFileSync(LOG_FILE, failLog); } catch {}
           res.writeHead(503, { "Content-Type": "application/json", ...CORS });
           return res.end(JSON.stringify({ error: "Vault backend is unreachable — try again in a moment", transport_error: true, detail: msg }));
         }
+        // Server rendered a verdict. Surface its `reason` so the CLI/log shows
+        // WHY (invalid_token (N/5) vs machine_locked) instead of a bare "auth_failed".
+        const reasonSuffix = serverReason ? ` (${serverReason})` : "";
+        // STOP-ON-REJECTION: a server-side machine lock or invalid_token is terminal —
+        // each retry only burns another of the 5 server-side strikes toward a DB lockout.
+        // Hard-lock locally NOW so the browser/CLI cannot keep hammering the vault.
+        const isTerminalVerdict = isTerminalAuthVerdict(serverReason);
         authFailCount++;
         const authRemaining = MAX_AUTH_FAILS - authFailCount;
-        const failLog = `[${new Date().toISOString()}] [AUTH FAIL ${authFailCount}/${MAX_AUTH_FAILS}] ${msg || "Wrong password"}\n`;
+        const failLog = `[${new Date().toISOString()}] [AUTH FAIL ${authFailCount}/${MAX_AUTH_FAILS}] ${msg || "Wrong password"}${reasonSuffix}\n`;
         try { fs.appendFileSync(LOG_FILE, failLog); } catch {}
+        if (isTerminalVerdict) {
+          authHardLocked = true;
+          const lockLog = `[${new Date().toISOString()}] Server rejected with terminal verdict${reasonSuffix} — hard-locking locally to stop strike accrual; recover via the runbook (unlock machine + re-seal boot.key)\n`;
+          try { fs.appendFileSync(LOG_FILE, lockLog); } catch {}
+          res.writeHead(401, { "Content-Type": "application/json", ...CORS });
+          return res.end(JSON.stringify({ error: "Vault rejected credentials — recovery required", reason: serverReason, hard_locked: true, terminal: true }));
+        }
         if (authFailCount >= MAX_AUTH_FAILS) {
           authHardLocked = true;
           const lockLog = `[${new Date().toISOString()}] Auth failure limit reached — vault hard-locked\n`;
           try { fs.appendFileSync(LOG_FILE, lockLog); } catch {}
           res.writeHead(401, { "Content-Type": "application/json", ...CORS });
-          return res.end(JSON.stringify({ error: "Too many failed attempts — restart daemon to try again", hard_locked: true }));
+          return res.end(JSON.stringify({ error: "Too many failed attempts — restart daemon to try again", reason: serverReason, hard_locked: true }));
         }
         res.writeHead(401, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "Invalid password", failures_remaining: authRemaining }));
+        return res.end(JSON.stringify({ error: "Invalid password", reason: serverReason, failures_remaining: authRemaining }));
       }
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.9.2",
+  "version": "1.9.3",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {
@@ -8,6 +8,7 @@
   },
   "scripts": {
     "build": "bash scripts/build.sh",
+    "test": "node test-auth-verdict.mjs",
     "postinstall": "node scripts/postinstall.js",
     "worker:start": "node cli/index.js serve",
     "worker:stop": "curl -s http://127.0.0.1:52437/shutdown 2>nul || taskkill /F /IM cloudflared.exe 2>nul & exit 0",