@magland/mochi 0.3.1 → 0.4.0

package/dist/webops.js

@@ -48,13 +48,24 @@ const themes_1 = require("./themes");
 const forms = __importStar(require("./forms"));
 const ops = __importStar(require("./ops"));
 const ops_1 = require("./ops");
+const agefile_1 = require("./agefile");
+const topics_1 = require("./topics");
 const scan_1 = require("./scan");
+const domains_1 = require("./domains");
+const siteshost_1 = require("./siteshost");
+const sitesettings_1 = require("./sitesettings");
+const sitepublish_1 = require("./sitepublish");
 const session_1 = require("./session");
 const perms_1 = require("./perms");
 const vault_1 = require("./vault");
+const githubauth_1 = require("./githubauth");
+const webauthn_1 = require("./webauthn");
+const onetime_1 = require("./onetime");
+const logincodes_1 = require("./logincodes");
 const views_1 = require("./views");
 const web_1 = require("./web");
 const render_1 = require("./render");
+const markdown_1 = require("./markdown");
 const multipart_1 = require("./multipart");
 function urlOf(repo) {
     return (0, views_1.repoUrl)({ collection: repo.collection, repo: repo.name });
@@ -141,13 +152,32 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
             res.redirect(next);
             return;
         }
-        res.type('html').send(forms.loginPage(next));
+        res.type('html').send(forms.loginPage(next, undefined, (0, githubauth_1.githubConfigured)(root)));
     });
+    // A sign-in form posted from another site is refused. None of these
+    // handlers have a session to check a CSRF token against, since their whole
+    // purpose is to start one, so the Origin header is the check: a browser
+    // sends it on every cross-site POST, and a page elsewhere that auto-submits
+    // an attacker's own username and token would otherwise sign the visitor in
+    // as the attacker without their noticing. A request with no Origin is
+    // allowed, as it is for the CSRF check: plenty of clients send none.
+    function refuseCrossSite(req, res) {
+        if ((0, session_1.originOk)(req))
+            return false;
+        (0, web_1.fail)(res, 403, 'This sign-in was posted from another site and was not accepted.', null, '/login');
+        return true;
+    }
     app.post('/login', form, (req, res) => {
+        if (refuseCrossSite(req, res))
+            return;
         const next = safeNext((0, web_1.field)(req, 'next'));
+        const github = (0, githubauth_1.githubConfigured)(root);
         const state = (0, vault_1.loadVault)(root);
         if (state.status !== 'ok') {
-            res.status(500).type('html').send(forms.loginPage(next, 'The vault is not available; try again later.'));
+            res
+                .status(500)
+                .type('html')
+                .send(forms.loginPage(next, 'The vault is not available; try again later.', github));
             return;
         }
         const username = (0, web_1.field)(req, 'username');
@@ -161,7 +191,7 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
             res.status(429).setHeader('Retry-After', String(allowed.retryAfter));
             res
                 .type('html')
-                .send(forms.loginPage(next, `Too many failed sign-in attempts from this address. Try again in ${minutes} minute${minutes === 1 ? '' : 's'}.`));
+                .send(forms.loginPage(next, `Too many failed sign-in attempts from this address. Try again in ${minutes} minute${minutes === 1 ? '' : 's'}.`, github));
             return;
         }
         const auth = (0, vault_1.authenticate)(state.vault, username, (0, web_1.field)(req, 'token'));
@@ -169,18 +199,534 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
             authLimiter.fail(req, username);
             // One generic message: no username/token distinction. The refusal above
             // says nothing about whether the username exists either.
-            res.status(401).type('html').send(forms.loginPage(next, 'Invalid username or token.'));
+            res.status(401).type('html').send(forms.loginPage(next, 'Invalid username or token.', github));
             return;
         }
         (0, session_1.setSessionCookie)(req, res, root, auth);
         res.redirect(next);
     });
-    app.post('/logout', form, (req, res) => {
-        const viewer = (0, session_1.getViewer)(req, root);
-        if (viewer && (0, session_1.checkCsrf)(req, viewer))
-            (0, session_1.clearSessionCookie)(res);
+    // Cleared without a CSRF check: signing someone out is not an action worth
+    // forging, and requiring a live token would leave a stale form redirecting
+    // to / still signed in with no sign anything went wrong.
+    app.post('/logout', form, (_req, res) => {
+        (0, session_1.clearSessionCookie)(res);
         res.redirect('/');
     });
+    // ---- passkeys, the account page, and sign-in codes ----
+    //
+    // Three more ways into a session, all ending at the same setSessionCookie
+    // the token form uses: a passkey (WebAuthn), a short code shown by a
+    // signed-in browser, and a one-time link minted by `mochi web` against the
+    // API. The WebAuthn endpoints speak JSON because the ceremonies run through
+    // fetch; everything else is ordinary forms.
+    const jsonForm = express_1.default.json({ limit: '64kb' });
+    // Pending WebAuthn challenges. The store's opaque id is the challenge
+    // itself: finishing a ceremony hands it back inside clientDataJSON, so
+    // nothing else has to travel, and taking it makes each challenge one use.
+    const registrationChallenges = (0, onetime_1.createOneTimeStore)();
+    const loginChallenges = (0, onetime_1.createOneTimeStore)();
+    const CHALLENGE_TTL_MS = 2 * 60 * 1000;
+    const WEBAUTHN_TIMEOUT_MS = 120000;
+    // The RP ID is the hostname the vault is being served under, which is what
+    // scopes a passkey to this vault: a key made for one hostname does not
+    // answer for another, and moving a vault to a new domain means registering
+    // new passkeys (tokens keep working, so nobody is locked out by the move).
+    const rpIdOf = (req) => req.hostname;
+    const originOf = (req) => `${req.protocol}://${req.get('host')}`;
+    // A restricted token may not add passkeys or hand off sessions broader than
+    // itself: a passkey signs in with the user's full standing, so minting one
+    // from a session that does not have it would widen the token it came from.
+    const restricted = (viewer) => viewer.auth.token.scope !== undefined;
+    function jsonViewer(req, res) {
+        const viewer = (0, session_1.getViewer)(req, root);
+        if (!viewer) {
+            res.status(403).json({ error: 'You are signed out. Reload the page and sign in.' });
+            return null;
+        }
+        if (!(0, session_1.csrfMatches)(req, (0, web_1.field)(req, 'csrf'), viewer)) {
+            res.status(403).json({ error: 'The page has expired; reload it and try again.' });
+            return null;
+        }
+        return viewer;
+    }
+    app.get('/account', (req, res) => {
+        const viewer = (0, web_1.requireViewerPage)(root, req, res);
+        if (!viewer)
+            return;
+        const msg = typeof req.query.msg === 'string' ? req.query.msg : undefined;
+        res.type('html').send(forms.accountPage(viewer, {
+            restricted: restricted(viewer),
+            msg,
+            github: { enabled: (0, githubauth_1.githubConfigured)(root), account: viewer.auth.user.github ?? null },
+        }));
+    });
+    app.post('/account/passkeys/challenge', jsonForm, (req, res) => {
+        const viewer = jsonViewer(req, res);
+        if (!viewer)
+            return;
+        if (restricted(viewer)) {
+            res.status(403).json({ error: 'A session from a restricted token may not add passkeys.' });
+            return;
+        }
+        const username = viewer.auth.username;
+        res.json({
+            challenge: registrationChallenges.put({ username }, CHALLENGE_TTL_MS),
+            rp: { id: rpIdOf(req), name: `Mochi Forge (${rpIdOf(req)})` },
+            // The user handle is what a later usernameless sign-in identifies the
+            // account by; usernames are short and stable, so they are it, verbatim.
+            user: { id: Buffer.from(username, 'utf8').toString('base64url'), name: username, displayName: username },
+            pubKeyCredParams: webauthn_1.SUPPORTED_ALGS.map((alg) => ({ type: 'public-key', alg })),
+            // Resident keys, so signing in needs no username typed first; every
+            // platform authenticator that offers passkeys keeps them.
+            authenticatorSelection: { residentKey: 'required', userVerification: 'preferred' },
+            timeout: WEBAUTHN_TIMEOUT_MS,
+            attestation: 'none',
+            excludeCredentials: (viewer.auth.user.passkeys ?? []).map((p) => ({ type: 'public-key', id: p.id })),
+        });
+    });
+    app.post('/account/passkeys', jsonForm, (req, res) => {
+        const viewer = jsonViewer(req, res);
+        if (!viewer)
+            return;
+        if (restricted(viewer)) {
+            res.status(403).json({ error: 'A session from a restricted token may not add passkeys.' });
+            return;
+        }
+        let clientDataJSON;
+        let attestationObject;
+        try {
+            clientDataJSON = (0, webauthn_1.fromB64url)((0, web_1.field)(req, 'clientDataJSON'));
+            attestationObject = (0, webauthn_1.fromB64url)((0, web_1.field)(req, 'attestationObject'));
+        }
+        catch {
+            res.status(400).json({ error: 'The registration payload is not base64url.' });
+            return;
+        }
+        const challenge = (0, webauthn_1.claimedChallenge)(clientDataJSON);
+        const pending = challenge ? registrationChallenges.take(challenge) : null;
+        if (!pending || pending.username !== viewer.auth.username) {
+            res.status(400).json({ error: 'The challenge is missing or expired; try again.' });
+            return;
+        }
+        let reg;
+        try {
+            reg = (0, webauthn_1.verifyRegistration)({
+                attestationObject,
+                clientDataJSON,
+                challenge: challenge,
+                origin: originOf(req),
+                rpId: rpIdOf(req),
+            });
+        }
+        catch (e) {
+            res.status(400).json({ error: e instanceof webauthn_1.WebAuthnError ? e.message : 'The registration could not be verified.' });
+            return;
+        }
+        const name = (0, web_1.field)(req, 'name').trim().slice(0, 60);
+        try {
+            (0, vault_1.addPasskey)(root, viewer.auth.username, {
+                id: reg.id,
+                publicKey: reg.publicKey,
+                alg: reg.alg,
+                counter: reg.counter,
+                ...(name ? { name } : {}),
+            });
+        }
+        catch (e) {
+            res.status(409).json({ error: e instanceof Error ? e.message : 'The passkey could not be stored.' });
+            return;
+        }
+        res.json({ next: `/account?msg=${encodeURIComponent(`Passkey ${name ? `${name} ` : ''}added.`)}` });
+    });
+    app.post('/account/passkeys/:id/delete', form, (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const wasThisSession = viewer.auth.token.hash === (0, vault_1.passkeyBinding)(req.params.id);
+        if (!(0, vault_1.removePasskey)(root, viewer.auth.username, req.params.id)) {
+            (0, web_1.fail)(res, 404, 'No such passkey on your account.', viewer, '/account');
+            return;
+        }
+        // Removing the passkey this session signed in with ends this session; the
+        // redirect says so instead of pretending otherwise.
+        if (wasThisSession) {
+            res.redirect('/login');
+            return;
+        }
+        res.redirect(`/account?msg=${encodeURIComponent('Passkey removed.')}`);
+    });
+    app.post('/account/link', form, (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        // The new session is bound to whatever this one is -- the same token
+        // hash (scope and all), or the same passkey -- so nothing new is minted,
+        // nothing widens, and one revocation ends both.
+        const code = (0, logincodes_1.mintHandoff)(root, viewer.auth.username, viewer.auth.token.hash);
+        res.type('html').send(forms.accountLinkPage(viewer, code, Math.round(logincodes_1.HANDOFF_TTL_MS / 60000)));
+    });
+    app.get('/login/link', (req, res) => {
+        const next = safeNext(String(req.query.next ?? '/'));
+        if ((0, session_1.getViewer)(req, root)) {
+            res.redirect(next);
+            return;
+        }
+        res.type('html').send(forms.loginLinkPage(next));
+    });
+    // Redeeming any kind of sign-in code shares the token form's rate limiter:
+    // a code is a credential being presented, and guessing them is the same
+    // attack mistyping tokens is throttled as.
+    function redeemPending(req, res, pending, renderRefusal) {
+        if (!pending) {
+            authLimiter.fail(req, null);
+            renderRefusal('That code is not valid. Codes work once and expire after a few minutes.', 401);
+            return;
+        }
+        const state = (0, vault_1.loadVault)(root);
+        const auth = state.status === 'ok' ? (0, vault_1.authForBinding)(state.vault, pending.username, pending.binding) : null;
+        if (!auth) {
+            renderRefusal('The credential behind this code has been revoked; sign in another way.', 403);
+            return;
+        }
+        (0, session_1.setSessionCookie)(req, res, root, auth);
+        res.redirect(safeNext(pending.next ?? (0, web_1.field)(req, 'next')));
+    }
+    app.post('/login/link', form, (req, res) => {
+        if (refuseCrossSite(req, res))
+            return;
+        const next = safeNext((0, web_1.field)(req, 'next'));
+        const allowed = authLimiter.allow(req, null);
+        if (!allowed.ok) {
+            res.status(429).setHeader('Retry-After', String(allowed.retryAfter));
+            res.type('html').send(forms.loginLinkPage(next, 'Too many attempts from this address. Try again later.'));
+            return;
+        }
+        redeemPending(req, res, (0, logincodes_1.takeHandoff)(root, (0, web_1.field)(req, 'code')), (error, status) => {
+            res.status(status).type('html').send(forms.loginLinkPage(next, error));
+        });
+    });
+    // The landing page of a `mochi web` link: it looks the code up without
+    // consuming it and asks for a click, so a GET never changes who the browser
+    // is and a prefetch cannot burn the code.
+    app.get('/login/code/:code', (req, res) => {
+        const pending = (0, logincodes_1.peekLoginLink)(root, req.params.code);
+        if (!pending) {
+            (0, web_1.fail)(res, 404, 'This sign-in link has expired or was already used. Run mochi web again for a fresh one.', null, '/login');
+            return;
+        }
+        res.type('html').send(forms.loginLinkConfirmPage(pending.username, req.params.code, safeNext(pending.next ?? '/')));
+    });
+    app.post('/login/code', form, (req, res) => {
+        if (refuseCrossSite(req, res))
+            return;
+        const allowed = authLimiter.allow(req, null);
+        if (!allowed.ok) {
+            res.status(429).setHeader('Retry-After', String(allowed.retryAfter));
+            (0, web_1.fail)(res, 429, 'Too many attempts from this address. Try again later.', null, '/login');
+            return;
+        }
+        redeemPending(req, res, (0, logincodes_1.takeLoginLink)(root, (0, web_1.field)(req, 'code')), (error, status) => {
+            (0, web_1.fail)(res, status, error, null, '/login');
+        });
+    });
+    app.post('/login/passkey/challenge', jsonForm, (req, res) => {
+        res.json({
+            challenge: loginChallenges.put(true, CHALLENGE_TTL_MS),
+            rpId: rpIdOf(req),
+            timeout: WEBAUTHN_TIMEOUT_MS,
+            userVerification: 'preferred',
+        });
+    });
+    app.post('/login/passkey', jsonForm, (req, res) => {
+        if (!(0, session_1.originOk)(req)) {
+            res.status(403).json({ error: 'This sign-in was posted from another site and was not accepted.' });
+            return;
+        }
+        const allowed = authLimiter.allow(req, null);
+        if (!allowed.ok) {
+            res.setHeader('Retry-After', String(allowed.retryAfter));
+            res.status(429).json({ error: 'Too many failed sign-in attempts from this address; try again later.' });
+            return;
+        }
+        let clientDataJSON;
+        let authenticatorData;
+        let signature;
+        try {
+            clientDataJSON = (0, webauthn_1.fromB64url)((0, web_1.field)(req, 'clientDataJSON'));
+            authenticatorData = (0, webauthn_1.fromB64url)((0, web_1.field)(req, 'authenticatorData'));
+            signature = (0, webauthn_1.fromB64url)((0, web_1.field)(req, 'signature'));
+        }
+        catch {
+            res.status(400).json({ error: 'The sign-in payload is not base64url.' });
+            return;
+        }
+        const challenge = (0, webauthn_1.claimedChallenge)(clientDataJSON);
+        if (!challenge || !loginChallenges.take(challenge)) {
+            res.status(400).json({ error: 'The challenge is missing or expired; try again.' });
+            return;
+        }
+        const state = (0, vault_1.loadVault)(root);
+        if (state.status !== 'ok') {
+            res.status(500).json({ error: 'The vault is not available; try again later.' });
+            return;
+        }
+        const found = (0, vault_1.findPasskey)(state.vault, (0, web_1.field)(req, 'id'));
+        if (!found) {
+            authLimiter.fail(req, null);
+            res.status(401).json({ error: 'This passkey is not registered on this vault.' });
+            return;
+        }
+        // The authenticator says whose credential it presented; when it does, it
+        // must agree with where the credential id was found.
+        const handle = (0, web_1.field)(req, 'userHandle');
+        if (handle) {
+            let claimed;
+            try {
+                claimed = (0, webauthn_1.fromB64url)(handle).toString('utf8');
+            }
+            catch {
+                claimed = '';
+            }
+            if (claimed !== found.username) {
+                authLimiter.fail(req, null);
+                res.status(401).json({ error: 'The passkey does not match its account.' });
+                return;
+            }
+        }
+        let assertion;
+        try {
+            assertion = (0, webauthn_1.verifyAssertion)({
+                authenticatorData,
+                clientDataJSON,
+                signature,
+                publicKey: found.passkey.publicKey,
+                alg: found.passkey.alg,
+                challenge,
+                origin: originOf(req),
+                rpId: rpIdOf(req),
+            });
+        }
+        catch (e) {
+            authLimiter.fail(req, null);
+            res.status(401).json({ error: e instanceof webauthn_1.WebAuthnError ? e.message : 'The sign-in could not be verified.' });
+            return;
+        }
+        // A counter that moved backwards means two devices hold this key, which
+        // resident passkeys do legitimately (they sync); most report 0 and skip
+        // this entirely. Only an actual regression from a counter-keeping key is
+        // refused.
+        if (assertion.counter > 0 && found.passkey.counter > 0 && assertion.counter <= found.passkey.counter) {
+            authLimiter.fail(req, null);
+            res.status(401).json({ error: 'The passkey presented an old signature counter; remove and re-register it.' });
+            return;
+        }
+        if (assertion.counter > 0)
+            (0, vault_1.setPasskeyCounter)(root, found.username, found.passkey.id, assertion.counter);
+        (0, session_1.setSessionCookie)(req, res, root, {
+            username: found.username,
+            user: found.user,
+            token: { hash: (0, vault_1.passkeyBinding)(found.passkey.id) },
+        });
+        res.json({ next: safeNext((0, web_1.field)(req, 'next')) });
+    });
+    // ---- sign in with GitHub ----
+    //
+    // The OAuth code flow, ending at the same setSessionCookie as every other
+    // way in. The state parameter is a one-time id from the same kind of store
+    // the WebAuthn challenges use, so a callback that was not started here, or
+    // is replayed, redeems nothing; an entry marked with `link` was started by
+    // a signed-in user's own CSRF-checked form and attaches the GitHub account
+    // to them instead of signing anyone in. The access token GitHub hands back
+    // is used for one request -- who is this -- and dropped. The session is
+    // bound to gh:<numeric id> and resolves against live vault.json on every
+    // request (authForBinding in src/vault.ts), so unlinking the account ends
+    // its sessions the way revoking a token does.
+    const githubStates = (0, onetime_1.createOneTimeStore)();
+    const GITHUB_STATE_TTL_MS = 10 * 60 * 1000;
+    const githubCallbackUrl = (req) => `${req.protocol}://${req.get('host')}/login/github/callback`;
+    app.get('/login/github', (req, res) => {
+        const next = safeNext(String(req.query.next ?? '/'));
+        if ((0, session_1.getViewer)(req, root)) {
+            res.redirect(next);
+            return;
+        }
+        if (!(0, githubauth_1.githubConfigured)(root)) {
+            (0, web_1.fail)(res, 404, 'Sign-in with GitHub is not configured on this vault.', null, '/login');
+            return;
+        }
+        const state = githubStates.put({ next }, GITHUB_STATE_TTL_MS);
+        res.redirect((0, githubauth_1.githubAuthorizeUrl)((0, config_1.loadConfig)(root).auth.githubClientId, githubCallbackUrl(req), state));
+    });
+    // Linking starts from a POST on the account page, so the CSRF check has
+    // already vouched that the account's owner asked for it; the state entry
+    // carries their name to the callback. A restricted session may not link,
+    // for the passkey rule's reason: signing in with GitHub carries the user's
+    // full standing, so minting the way in from a session that does not have it
+    // would widen the token it came from.
+    app.post('/account/github', form, (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        if (restricted(viewer)) {
+            (0, web_1.fail)(res, 403, 'A session from a restricted token may not link a GitHub account.', viewer, '/account');
+            return;
+        }
+        if (!(0, githubauth_1.githubConfigured)(root)) {
+            (0, web_1.fail)(res, 404, 'Sign-in with GitHub is not configured on this vault.', viewer, '/account');
+            return;
+        }
+        const state = githubStates.put({ next: '/account', link: viewer.auth.username }, GITHUB_STATE_TTL_MS);
+        res.redirect((0, githubauth_1.githubAuthorizeUrl)((0, config_1.loadConfig)(root).auth.githubClientId, githubCallbackUrl(req), state));
+    });
+    app.get('/login/github/callback', (0, web_1.ah)(async (req, res) => {
+        // The shared sign-in limiter: a forged or replayed callback is a
+        // credential being guessed, like a mistyped token.
+        const allowed = authLimiter.allow(req, null);
+        if (!allowed.ok) {
+            res.setHeader('Retry-After', String(allowed.retryAfter));
+            (0, web_1.fail)(res, 429, 'Too many attempts from this address. Try again later.', null, '/login');
+            return;
+        }
+        const pending = githubStates.take(String(req.query.state ?? ''));
+        if (!pending) {
+            authLimiter.fail(req, null);
+            (0, web_1.fail)(res, 400, 'This sign-in attempt is stale or was not started here; start again from the sign-in page.', null, '/login');
+            return;
+        }
+        const code = String(req.query.code ?? '');
+        if (code === '') {
+            // GitHub answers a cancelled authorization with ?error=access_denied
+            // and no code: a choice, not a failure worth a limiter charge.
+            (0, web_1.fail)(res, 400, 'GitHub did not complete the sign-in.', null, '/login');
+            return;
+        }
+        const clientId = (0, config_1.loadConfig)(root).auth.githubClientId;
+        const clientSecret = (0, githubauth_1.readGithubSecret)(root);
+        if (clientId === '' || clientSecret === null) {
+            (0, web_1.fail)(res, 404, 'Sign-in with GitHub is not configured on this vault.', null, '/login');
+            return;
+        }
+        const accessToken = await (0, githubauth_1.exchangeGithubCode)({
+            clientId,
+            clientSecret,
+            code,
+            redirectUri: githubCallbackUrl(req),
+        });
+        const account = accessToken === null ? null : await (0, githubauth_1.fetchGithubUser)(accessToken);
+        // The access token's one use has been made; nothing keeps it.
+        if (!account) {
+            (0, web_1.fail)(res, 502, 'GitHub did not confirm the sign-in; try again.', null, '/login');
+            return;
+        }
+        if (pending.link !== undefined) {
+            const viewer = (0, session_1.getViewer)(req, root);
+            if (!viewer || viewer.auth.username !== pending.link || restricted(viewer)) {
+                (0, web_1.fail)(res, 403, 'The session that started linking is gone; sign in and link again from your account page.', null, '/account');
+                return;
+            }
+            try {
+                (0, vault_1.linkGithub)(root, viewer.auth.username, account);
+            }
+            catch (e) {
+                (0, web_1.fail)(res, 409, e instanceof Error ? e.message : String(e), viewer, '/account');
+                return;
+            }
+            res.redirect(`/account?msg=${encodeURIComponent(`Linked GitHub account ${account.login}.`)}`);
+            return;
+        }
+        const outcome = (0, vault_1.resolveGithubSignIn)(root, account);
+        if (outcome.kind === 'refused') {
+            authLimiter.fail(req, null);
+            (0, web_1.fail)(res, 403, `The GitHub account ${account.login} is not authorized on this vault. An administrator can approve it, ` +
+                'or you can link it from your account page if you already have an account here.', null, '/login');
+            return;
+        }
+        if (outcome.kind === 'error') {
+            (0, web_1.fail)(res, 409, outcome.message, null, '/login');
+            return;
+        }
+        const state = (0, vault_1.loadVault)(root);
+        const auth = state.status === 'ok' ? (0, vault_1.authForBinding)(state.vault, outcome.username, (0, vault_1.githubBinding)(account.id)) : null;
+        if (!auth) {
+            (0, web_1.fail)(res, 500, 'The vault is not available; try again later.', null, '/login');
+            return;
+        }
+        (0, session_1.setSessionCookie)(req, res, root, auth);
+        res.redirect(safeNext(pending.next));
+    }));
+    app.post('/account/github/unlink', form, (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const linked = viewer.auth.user.github;
+        if (!linked) {
+            (0, web_1.fail)(res, 404, 'No GitHub account is linked.', viewer, '/account');
+            return;
+        }
+        // An account whose GitHub link is its only credential would be stranded
+        // by unlinking -- and, if its GitHub id is still on the approved list, a
+        // later sign-in would mint a second account beside the orphan. Refused
+        // with the way out named instead.
+        if (viewer.auth.user.tokens.length === 0 && !viewer.auth.user.passkeys?.length) {
+            (0, web_1.fail)(res, 409, 'This GitHub link is the only way this account can sign in. Add a passkey, or have an administrator mint a token, before unlinking it.', viewer, '/account');
+            return;
+        }
+        const wasThisSession = viewer.auth.token.hash === (0, vault_1.githubBinding)(linked.id);
+        (0, vault_1.unlinkGithub)(root, viewer.auth.username);
+        // Unlinking the credential this session signed in with ends this session;
+        // the redirect says so instead of pretending otherwise.
+        if (wasThisSession) {
+            res.redirect('/login');
+            return;
+        }
+        res.redirect(`/account?msg=${encodeURIComponent('GitHub account unlinked.')}`);
+    });
+    // ---- the signed-in user's own profile ----
+    // The profile a user's page at /<username> shows. The name "settings" is
+    // reserved as a collection name, so this path can never shadow one, and the
+    // route registers before the generic /:collection/:repo browse routes.
+    app.get('/settings/profile', (req, res) => {
+        const viewer = (0, web_1.requireViewerPage)(root, req, res);
+        if (!viewer)
+            return;
+        const msg = typeof req.query.msg === 'string' ? req.query.msg : undefined;
+        res.type('html').send(forms.profileSettingsPage(viewer, viewer.auth.user.profile, msg));
+    });
+    app.post('/settings/profile', form, (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const rerender = (status, error) => {
+            res.status(status).type('html').send(forms.profileSettingsPage(viewer, viewer.auth.user.profile, undefined, error));
+        };
+        const displayName = (0, web_1.field)(req, 'displayName').trim();
+        const bio = (0, web_1.field)(req, 'bio').trim();
+        if (displayName.length > 80 || /[\r\n]/.test(displayName)) {
+            rerender(400, 'The display name must be one line of at most 80 characters.');
+            return;
+        }
+        if (bio.length > 500) {
+            rerender(400, 'The bio must be at most 500 characters.');
+            return;
+        }
+        const links = (0, web_1.field)(req, 'links')
+            .split(/\r?\n/)
+            .map((l) => l.trim())
+            .filter((l) => l !== '');
+        if (links.length > 5) {
+            rerender(400, 'At most five links.');
+            return;
+        }
+        // http(s) only: these render as hyperlinks on a page other people read,
+        // and nothing else belongs in an href there.
+        const bad = links.find((l) => l.length > 200 || !/^https?:\/\/\S+$/i.test(l));
+        if (bad !== undefined) {
+            rerender(400, `That does not look like an http(s) URL: ${bad}`);
+            return;
+        }
+        (0, vault_1.setUserProfile)(root, viewer.auth.username, { name: displayName, bio, links });
+        res.redirect(`/settings/profile?msg=${encodeURIComponent('Profile saved.')}`);
+    });
     // ---- new repository, new collection, import ----
     // Importing is a client-side operation: git copies the repository from its
     // current home and pushes it here, where push-to-create makes it. The server
@@ -265,6 +811,183 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
         }
         res.redirect(`/${encodeURIComponent(name)}`);
     });
+    // ---- vault settings ----
+    //
+    // Registered ahead of the collection settings below, because the
+    // /:collection/settings pattern would otherwise swallow /admin/settings:
+    // 'admin' is a reserved name, so it can never be a collection, but the
+    // parameter route cannot know that and answers first in registration
+    // order. The helpers this block calls are declared in the administration
+    // section further down, which function hoisting makes reachable.
+    //
+    // The rest of config.json, administered from the browser: the sites
+    // hostname, CI retention, and the startup-read network and limits blocks.
+    // The JSON API refuses to write the startup-read ones, because an API caller
+    // reads the response as the new state of the server. A page can say more
+    // than a status code, so here they are editable, and the page names each
+    // saved value the running server is not yet using, with the command that
+    // restarts it.
+    // What the running server actually read: registration happens once, at
+    // startup, alongside server.ts reading the same file for its limiters, so
+    // this snapshot is the values the process is living by.
+    const startupConfig = (0, config_1.loadConfig)(root);
+    /**
+     * How this server is restarted, for the page's restart notes. The
+     * environment says which deployment this is: a Fly machine carries its app
+     * name, which names the exact command; a container carries /.dockerenv,
+     * which says only that it is one, so the command is the documented compose
+     * deployment's and is offered with that said. Null means nothing identifies
+     * a deployment, and the page says to start it again however it was started,
+     * which is the honest answer rather than a guess at somebody's unit file.
+     */
+    function restartHow() {
+        const flyApp = process.env.FLY_APP_NAME;
+        if (flyApp)
+            return { command: `fly apps restart ${flyApp}`, caveat: '' };
+        if (fs.existsSync('/.dockerenv')) {
+            return {
+                command: 'docker compose restart mochi',
+                caveat: 'if this is the compose deployment; otherwise restart the container however it was started',
+            };
+        }
+        return null;
+    }
+    /** Back to the box the form was posted from, carrying its confirmation; see settingsBack above. */
+    function vaultSettingsBack(section, msg) {
+        return `/admin/settings?msg=${encodeURIComponent(msg)}&in=${section}#${section}`;
+    }
+    const VAULT_WIDE = 'Vault settings are vault-wide, so they take a site admin.';
+    app.get('/admin/settings', (req, res) => {
+        const viewer = requireAdminPage(req, res);
+        if (!viewer)
+            return;
+        if (!canSetVaultWide(viewer)) {
+            (0, web_1.fail)(res, 403, VAULT_WIDE, viewer, '/admin');
+            return;
+        }
+        const msg = typeof req.query.msg === 'string' ? req.query.msg : undefined;
+        const inBox = typeof req.query.in === 'string' ? req.query.in : '';
+        const config = (0, config_1.loadConfig)(root);
+        res.type('html').send(forms.vaultSettingsPage(viewer, {
+            sitesHost: config.sites.host,
+            // What is already named under the sites host. Only gathered when
+            // there is one: the two scans are cheap but pointless on a vault
+            // serving its sites sandboxed on the forge host.
+            names: config.sites.host
+                ? {
+                    labels: (0, sitesettings_1.listSiteLabels)(root),
+                    collections: (0, sitesettings_1.collectionSiteAliases)(root),
+                    reserved: (0, siteshost_1.reservedSiteLabels)(),
+                }
+                : null,
+            ci: config.ci,
+            trustProxy: config.network.trustProxy,
+            limits: config.limits,
+            startup: { trustProxy: startupConfig.network.trustProxy, limits: startupConfig.limits },
+            restart: restartHow(),
+        }, msg, forms.isVaultSettingsSection(inBox) ? inBox : undefined));
+    });
+    /** A whole number from a form field, at least min, or null when it is not one. */
+    function intField(req, name, min) {
+        const raw = (0, web_1.field)(req, name).trim();
+        if (!/^\d{1,9}$/.test(raw))
+            return null;
+        const n = parseInt(raw, 10);
+        return n >= min ? n : null;
+    }
+    function requireVaultAdminPost(req, res) {
+        const viewer = requireAdminPost(req, res);
+        if (!viewer)
+            return null;
+        if (!canSetVaultWide(viewer)) {
+            (0, web_1.fail)(res, 403, VAULT_WIDE, viewer, '/admin');
+            return null;
+        }
+        return viewer;
+    }
+    app.post('/admin/settings/sites', form, (req, res) => {
+        const viewer = requireVaultAdminPost(req, res);
+        if (!viewer)
+            return;
+        const host = (0, siteshost_1.normalizeHostname)((0, web_1.field)(req, 'host'));
+        // loadConfig ignores a value that is not a hostname and uses the default,
+        // which is right for a hand-edited file and wrong here: refuse the typo
+        // with a message, as the API does, rather than store it silently inert.
+        if (host !== '' && !(0, config_1.isPlausibleHostname)(host)) {
+            (0, web_1.fail)(res, 400, `${(0, web_1.field)(req, 'host').trim()} is not a hostname: give at least two labels of letters, digits, and interior hyphens, with no scheme, port, or path.`, viewer, '/admin/settings');
+            return;
+        }
+        (0, config_1.saveConfig)(root, { sites: { host } });
+        const msg = host
+            ? `Sites are served from their own hostnames under ${host}, from the next request on.`
+            : 'Sites are served on the forge host, sandboxed, from the next request on.';
+        res.redirect(vaultSettingsBack('sites', msg));
+    });
+    app.post('/admin/settings/ci', form, (req, res) => {
+        const viewer = requireVaultAdminPost(req, res);
+        if (!viewer)
+            return;
+        const runs = intField(req, 'runs', 0);
+        const days = intField(req, 'days', 0);
+        const artifactMb = intField(req, 'artifactMb', 1);
+        if (runs === null || days === null || artifactMb === null) {
+            (0, web_1.fail)(res, 400, 'Runs and days are whole numbers, 0 disabling the age limit, and the artifact size is at least 1 MB.', viewer, '/admin/settings');
+            return;
+        }
+        (0, config_1.saveConfig)(root, { ci: { runs, days, artifactMb } });
+        res.redirect(vaultSettingsBack('ci', `CI retention saved: keep ${runs} runs${days > 0 ? ` and ${days} days` : ''}, artifacts up to ${artifactMb} MB.`));
+    });
+    app.post('/admin/settings/network', form, (req, res) => {
+        const viewer = requireVaultAdminPost(req, res);
+        if (!viewer)
+            return;
+        const value = (0, web_1.field)(req, 'trustProxy');
+        if (value !== 'true' && value !== 'false') {
+            (0, web_1.fail)(res, 400, 'Say whether the forwarded headers are believed or not.', viewer, '/admin/settings');
+            return;
+        }
+        const trustProxy = value === 'true';
+        (0, config_1.saveConfig)(root, { network: { trustProxy } });
+        res.redirect(vaultSettingsBack('network', trustProxy === startupConfig.network.trustProxy
+            ? `Saved: forwarded headers ${trustProxy ? 'believed' : 'not believed'}, which is what the running server started with.`
+            : 'Saved to config.json; the running server keeps its startup value until it restarts.'));
+    });
+    app.post('/admin/settings/limits', form, (req, res) => {
+        const viewer = requireVaultAdminPost(req, res);
+        if (!viewer)
+            return;
+        const requestsPerMinute = intField(req, 'requestsPerMinute', 0);
+        const authFailures = intField(req, 'authFailures', 0);
+        const clone = intField(req, 'clone', 1);
+        const push = intField(req, 'push', 1);
+        const search = intField(req, 'search', 1);
+        const tree = intField(req, 'tree', 1);
+        if (requestsPerMinute === null ||
+            authFailures === null ||
+            clone === null ||
+            push === null ||
+            search === null ||
+            tree === null) {
+            (0, web_1.fail)(res, 400, 'Limits are whole numbers: 0 disables a rate limit, and each concurrency is at least 1.', viewer, '/admin/settings');
+            return;
+        }
+        // The whole block is written back, since saveConfig replaces a top-level
+        // key rather than merging into it; the egress cap keeps the value it has,
+        // because its lever is the Egress page.
+        (0, config_1.saveConfig)(root, {
+            limits: { ...(0, config_1.loadConfig)(root).limits, requestsPerMinute, authFailures, clone, push, search, tree },
+        });
+        const s = startupConfig.limits;
+        const applied = requestsPerMinute === s.requestsPerMinute &&
+            authFailures === s.authFailures &&
+            clone === s.clone &&
+            push === s.push &&
+            search === s.search &&
+            tree === s.tree;
+        res.redirect(vaultSettingsBack('limits', applied
+            ? 'Limits saved, matching what the running server started with.'
+            : 'Limits saved to config.json; values the running server read at startup keep applying until it restarts.'));
+    });
     // ---- a collection's own settings ----
     //
     // These sit at /:collection/settings, one segment shallower than a
@@ -300,6 +1023,22 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
         }
         return { name, repos };
     }
+    /**
+     * What the collection's Site alias box shows: which tier its alias comes
+     * from, and, when the rewritten label is unavailable, who holds it. The
+     * resolution is the vault's, so it is done here rather than in the page.
+     */
+    function collectionSites(collection) {
+        const row = (0, sitesettings_1.collectionSiteAliases)(root).find((r) => r.collection === collection);
+        const taken = row?.taken ?? '';
+        return {
+            host: (0, config_1.loadConfig)(root).sites.host,
+            stored: (0, sitesettings_1.storedCollectionAlias)(root, collection),
+            alias: row?.alias ?? null,
+            taken,
+            takenBy: taken ? ((0, sitesettings_1.collectionAliasConflict)(root, taken, collection) ?? '') : '',
+        };
+    }
     app.get('/:collection/settings', (req, res) => {
         const viewer = (0, web_1.requireViewerPage)(root, req, res);
         if (!viewer)
@@ -310,7 +1049,43 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
         const msg = typeof req.query.msg === 'string' ? req.query.msg : undefined;
         res
             .type('html')
-            .send(forms.collectionSettingsPage(viewer, loaded.name, loaded.repos.length, (0, perms_1.collectionOwners)(root, loaded.name), msg));
+            .send(forms.collectionSettingsPage(viewer, loaded.name, loaded.repos.length, (0, perms_1.collectionOwners)(root, loaded.name), collectionSites(loaded.name), msg));
+    });
+    /**
+     * Store or clear the collection's site alias. Ownership of the collection is
+     * the whole question, as it is for the owners list and the rename: the alias
+     * decides the hostnames of the sites in this collection and nothing else.
+     * The label it claims is checked against every other collection's, so an
+     * owner cannot take a name another collection is already reached by.
+     */
+    app.post('/:collection/settings/site', form, (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = loadCollection(req, res, viewer, true);
+        if (!loaded)
+            return;
+        const backUrl = `/${encodeURIComponent(loaded.name)}/settings`;
+        const alias = (0, web_1.field)(req, 'alias').trim();
+        if (alias !== '' && !(0, sitesettings_1.isUsableCollectionAlias)(alias)) {
+            (0, web_1.fail)(res, 400, 'A site alias is lowercase letters, digits, and single interior hyphens, with no doubled hyphen, at most 63 characters.', viewer, backUrl);
+            return;
+        }
+        if (alias !== '') {
+            const holder = (0, sitesettings_1.collectionAliasConflict)(root, alias, loaded.name);
+            if (holder) {
+                (0, web_1.fail)(res, 409, `The alias ${alias} is already how the collection ${holder} is reached.`, viewer, backUrl);
+                return;
+            }
+        }
+        (0, sitesettings_1.setCollectionAlias)(root, loaded.name, alias);
+        const effective = (0, sitesettings_1.collectionSiteAlias)(root, loaded.name);
+        const msg = alias === ''
+            ? effective
+                ? `Alias cleared; the collection is reached as ${effective}.`
+                : 'Alias cleared; the collection has no derived hostname.'
+            : `Sites in this collection are now served under ${alias}.`;
+        res.redirect(`${backUrl}?msg=${encodeURIComponent(msg)}`);
     });
     app.post('/:collection/settings/rename', form, (0, web_1.ah)(async (req, res) => {
         const viewer = (0, web_1.requireViewerPost)(root, req, res);
@@ -380,6 +1155,32 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
         (0, perms_1.removeCollectionOwner)(root, loaded.name, username);
         res.redirect(`${backUrl}?msg=${encodeURIComponent(`Removed ${username} from the owners of ${loaded.name}.`)}`);
     });
+    // Deletion, confirmed by typing the name as a repository's is. Ownership,
+    // which loadCollection has established, is the whole permission; whether the
+    // collection is empty is the operation's own check, so a repository pushed
+    // between loading the page and clicking the button is a refusal, not a loss.
+    app.post('/:collection/settings/delete', form, (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = loadCollection(req, res, viewer, true);
+        if (!loaded)
+            return;
+        const backUrl = `/${encodeURIComponent(loaded.name)}/settings`;
+        if ((0, web_1.field)(req, 'confirm').trim() !== loaded.name) {
+            (0, web_1.fail)(res, 400, `Type ${loaded.name} exactly to confirm deletion.`, viewer, backUrl);
+            return;
+        }
+        try {
+            ops.deleteCollection(root, loaded.name);
+        }
+        catch (e) {
+            const message = e instanceof ops_1.OpError ? e.message : 'Could not delete the collection.';
+            (0, web_1.fail)(res, e instanceof ops_1.OpError ? (0, ops_1.opErrorStatus)(e.kind) : 400, message, viewer, backUrl);
+            return;
+        }
+        res.redirect('/');
+    });
     app.get('/new', (req, res) => {
         const viewer = (0, web_1.requireViewerPage)(root, req, res);
         if (!viewer)
@@ -491,6 +1292,41 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
         }
         throw e;
     }
+    // The markdown editor's Preview tab posts a draft here and gets it back
+    // rendered. The route is repo-scoped so relative links, `#12`, and commit
+    // ids resolve exactly as they will on the saved page, and it sits behind the
+    // same session and CSRF check as the write being drafted: the renderer
+    // sanitizes what it is given, but there is no reason to render for anyone
+    // who could not save.
+    app.post('/:collection/:repo/preview', form, (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = await (0, web_1.loadRepo)(root, req, res, viewer);
+        if (!loaded)
+            return;
+        const ctx = await (0, web_1.makeCtx)(root, req, loaded, loaded.defaultBranch ?? '', viewer);
+        const text = (0, web_1.field)(req, 'text');
+        // The ref and directory are the draft's claim about where it sits: an
+        // unknown ref falls back to the default branch, and a directory is only
+        // honoured when it is a plain relative path.
+        const asked = (0, web_1.field)(req, 'ref');
+        const ref = asked !== '' && loaded.refNames.includes(asked) ? asked : ctx.defaultBranch || ctx.ref || 'HEAD';
+        const dirAsked = (0, web_1.field)(req, 'dir');
+        const dir = dirAsked !== '' && dirAsked.split('/').every((s) => s !== '' && s !== '.' && s !== '..') ? dirAsked : '';
+        const base = urlOf(loaded.repo);
+        const at = (kind) => `${base}/${kind}/${(0, views_1.encPath)(ref)}${dir === '' ? '' : `/${(0, views_1.encPath)(dir)}`}`;
+        const rendered = text.trim() === ''
+            ? '<p class="muted">Nothing to preview.</p>'
+            : (0, markdown_1.renderMarkdown)(text, {
+                rawBase: at('raw'),
+                blobBase: at('blob'),
+                issueBase: `${base}/issues`,
+                commitBase: `${base}/commit`,
+                mentions: ctx.hasUser,
+            });
+        res.type('html').send(rendered);
+    }));
     app.get('/:collection/:repo/edit/*', (0, web_1.ah)(async (req, res) => {
         const viewer = (0, web_1.requireViewerPage)(root, req, res);
         if (!viewer)
@@ -499,11 +1335,18 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
         if (!target)
             return;
         const { loaded, branch, filePath } = target;
-        const type = await loaded.repo.entryType(branch, filePath);
-        if (type !== 'blob') {
+        const info = await loaded.repo.blobInfo(branch, filePath);
+        if (!info) {
             (0, web_1.send404)(res, `File ${filePath} not found at ${branch}`, viewer);
             return;
         }
+        // From the size alone, before the file is read: the checks below say
+        // the same thing after reading it, and a file the size of the machine
+        // should not be read to be told it is too big for a text box.
+        if (info.size > ops_1.MAX_EDIT_SIZE) {
+            (0, web_1.fail)(res, 400, 'Only text files up to 1 MB can be edited in the browser.', viewer, urlOf(loaded.repo));
+            return;
+        }
         const buf = await loaded.repo.catBlob(branch, filePath);
         // Editing a pointer as text would silently corrupt the repository's
         // LFS state, so it is refused outright (deletion remains allowed).
@@ -511,6 +1354,19 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
             (0, web_1.fail)(res, 400, 'This file is stored with Git LFS; the repository holds only a pointer to it. Change the file with a git client instead.', viewer, urlOf(loaded.repo));
             return;
         }
+        // An age file gets the decrypt-in-the-browser editor, whichever framing
+        // it is in: the ciphertext may be binary, but what the editor holds and
+        // what the commit posts are text. The size cap still applies, since the
+        // posted ciphertext travels the same form as any other edit.
+        if ((0, agefile_1.isAgeFile)(filePath)) {
+            if (buf.length > ops_1.MAX_EDIT_SIZE) {
+                (0, web_1.fail)(res, 400, 'Only files up to 1 MB can be edited in the browser.', viewer, urlOf(loaded.repo));
+                return;
+            }
+            const ctx = await (0, web_1.makeCtx)(root, req, loaded, branch, viewer);
+            res.type('html').send(forms.editAgeFilePage(ctx, filePath, target.tip));
+            return;
+        }
         if ((0, render_1.isBinary)(buf) || buf.length > ops_1.MAX_EDIT_SIZE) {
             (0, web_1.fail)(res, 400, 'Only text files up to 1 MB can be edited in the browser.', viewer, urlOf(loaded.repo));
             return;
@@ -532,15 +1388,35 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
             return;
         }
         const content = normalizeContent((0, web_1.field)(req, 'content'));
+        const retryUrl = `${urlOf(loaded.repo)}/edit/${(0, views_1.encPath)(branch)}/${(0, views_1.encPath)(filePath)}`;
+        // The editor only opens files up to MAX_EDIT_SIZE, so content beyond it
+        // means a paste that outgrew what this form is for. Checked here so the
+        // refusal names the way that does work, instead of the body limit 413ing
+        // with no advice.
+        if (Buffer.byteLength(content, 'utf8') > ops_1.MAX_EDIT_SIZE) {
+            (0, web_1.fail)(res, 413, 'Files over 1 MB cannot be committed through the editor. Use the Upload files form, or push with git.', viewer, retryUrl);
+            return;
+        }
         // A changed path renames or moves the file in the same commit, which is
-        // what the path field on the form is for.
-        const wantedPath = (0, web_1.field)(req, 'path').trim().replace(/^\/+/, '');
+        // what the path field on the form is for. Rejected rather than silently
+        // rewritten when it is not a path this repository can take.
+        const wantedPath = (0, web_1.field)(req, 'path').trim();
         const toPath = wantedPath === '' || wantedPath === filePath ? undefined : wantedPath;
-        const retryUrl = `${urlOf(loaded.repo)}/edit/${(0, views_1.encPath)(branch)}/${(0, views_1.encPath)(filePath)}`;
-        if (toPath !== undefined && !(0, git_1.isValidRepoPath)(toPath)) {
+        if (toPath !== undefined && !(0, git_1.isValidNewRepoPath)(toPath)) {
             (0, web_1.fail)(res, 400, `${toPath} is not a usable path.`, viewer, retryUrl);
             return;
         }
+        // What stands between a failed script and a plaintext commit: a .age
+        // path only ever receives age-shaped bytes through this form. The
+        // browser editor encrypts before posting, so ordinary use never sees
+        // this; a page where that script did not run must not quietly write
+        // the secret it was meant to protect. Byte-exact writes that are not
+        // age files remain possible over git and the API, where nothing is
+        // encrypting on the caller's behalf.
+        if ((0, agefile_1.isAgeFile)(toPath ?? filePath) && !(0, agefile_1.looksLikeAge)(Buffer.from(content, 'utf8'))) {
+            (0, web_1.fail)(res, 400, 'A .age file holds an age ciphertext, and this content is not one. The editor encrypts in the browser before committing; committing this text as-is would store it unencrypted under a name that promises otherwise. To write these bytes anyway, use git or the API.', viewer, retryUrl);
+            return;
+        }
         const message = commitMessage(req, toPath === undefined ? `Update ${filePath.split('/').pop()}` : `Rename ${filePath} to ${toPath}`);
         // The branch choice, the pointer refusal, and the guarded commit are one
         // sequence in ops.writeFile, which the API write path calls too. The GET
@@ -629,15 +1505,21 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
         }
         // Browsers send the name the file had on disk, and some send a whole
         // path; only the last segment is ours to use, and it still has to be a
-        // path this repository would accept.
+        // path this repository would accept. When the last segment is not the
+        // name that arrived, the reader is told what the file was saved as,
+        // rather than the flattening happening in silence.
         const files = [];
+        const renamed = [];
         for (const upload of uploads) {
-            const name = (upload.filename ?? '').split(/[\\/]/).pop() ?? '';
+            const sent = upload.filename ?? '';
+            const name = sent.split(/[\\/]/).pop() ?? '';
             const full = dir === '' ? name : `${dir}/${name}`;
-            if (name === '' || name === '.' || name === '..' || !(0, git_1.isValidRepoPath)(full)) {
+            if (name === '' || name === '.' || name === '..' || !(0, git_1.isValidNewRepoPath)(full)) {
                 (0, web_1.fail)(res, 400, `${name || 'That file'} does not have a usable name.`, viewer, retryUrl);
                 return;
             }
+            if (name !== sent)
+                renamed.push(`${sent} was saved as ${name}`);
             files.push({ path: full, content: upload.data });
         }
         const summary = (0, multipart_1.partField)(parts, 'message').trim();
@@ -679,7 +1561,8 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
             res.redirect(`${urlOf(loaded.repo)}/compare/${(0, views_1.encPath)(branch)}...${(0, views_1.encPath)(onto)}`);
             return;
         }
-        res.redirect(`${urlOf(loaded.repo)}/tree/${(0, views_1.encPath)(onto)}${dir === '' ? '' : `/${(0, views_1.encPath)(dir)}`}`);
+        const note = renamed.length ? `?msg=${encodeURIComponent(renamed.join('; ') + '.')}` : '';
+        res.redirect(`${urlOf(loaded.repo)}/tree/${(0, views_1.encPath)(onto)}${dir === '' ? '' : `/${(0, views_1.encPath)(dir)}`}${note}`);
     }));
     app.get('/:collection/:repo/new/*', (0, web_1.ah)(async (req, res) => {
         const viewer = (0, web_1.requireViewerPage)(root, req, res);
@@ -712,14 +1595,28 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
             await handleOpError(new ops_1.OpError('branch created meanwhile', 'conflict'), req, res, viewer, target, req.originalUrl);
             return;
         }
-        const filename = (0, web_1.field)(req, 'filename').trim().replace(/^\/+|\/+$/g, '');
+        // Rejected rather than silently de-rooted or flattened: a leading slash,
+        // a backslash, or a .git component is a name the commit cannot take, and
+        // rewriting it would commit a path nobody typed.
+        const filename = (0, web_1.field)(req, 'filename').trim();
         const fullPath = dir === '' ? filename : `${dir}/${filename}`;
         const retryUrl = req.originalUrl;
-        if (filename === '' || !(0, git_1.isValidRepoPath)(fullPath)) {
+        if (filename === '' || !(0, git_1.isValidNewRepoPath)(fullPath)) {
             (0, web_1.fail)(res, 400, 'Invalid file name.', viewer, retryUrl);
             return;
         }
         const content = normalizeContent((0, web_1.field)(req, 'content'));
+        // See the edit form: content past what the editor itself would open is
+        // refused with advice rather than left to the body limit.
+        if (Buffer.byteLength(content, 'utf8') > ops_1.MAX_EDIT_SIZE) {
+            (0, web_1.fail)(res, 413, 'Files over 1 MB cannot be committed through the editor. Use the Upload files form, or push with git.', viewer, retryUrl);
+            return;
+        }
+        // The same backstop the edit form has: see the comment there.
+        if ((0, agefile_1.isAgeFile)(fullPath) && !(0, agefile_1.looksLikeAge)(Buffer.from(content, 'utf8'))) {
+            (0, web_1.fail)(res, 400, 'A .age file holds an age ciphertext, and this content is not one. The form encrypts in the browser before committing; committing this text as-is would store it unencrypted under a name that promises otherwise. To write these bytes anyway, use git or the API.', viewer, retryUrl);
+            return;
+        }
         const message = commitMessage(req, `Create ${filename.split('/').pop()}`);
         let written;
         try {
@@ -903,11 +1800,32 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
             return;
         }
         const msg = typeof req.query.msg === 'string' ? req.query.msg : undefined;
+        // Which box the message belongs in, so a save is confirmed where the
+        // form was rather than at the top of a page the reader has been thrown
+        // back to. A value naming no box reads as none, like an unknown sort.
+        const inParam = typeof req.query.in === 'string' ? req.query.in : '';
+        const section = forms.isSettingsSection(inParam) ? inParam : undefined;
         const access = (0, perms_1.repoAccess)(loaded.repo.dir);
-        res.type('html').send(forms.settingsPage(ctx, (0, scan_1.repoDescription)(loaded.repo.dir) ?? '', {
+        const settings = (0, sitesettings_1.siteSettings)(loaded.repo.dir);
+        const sitesHost = (0, config_1.loadConfig)(root).sites.host;
+        // The label the site would be served under with nothing set: the whole
+        // hostname minus the sites host and the dot joining them.
+        const derivedHost = (0, sitesettings_1.siteHostFor)(root, sitesHost, loaded.repo.collection, loaded.repo.name);
+        const alias = (0, sitesettings_1.collectionSiteAlias)(root, loaded.repo.collection);
+        res.type('html').send(forms.settingsPage(ctx, (0, scan_1.repoDescription)(loaded.repo.dir) ?? '', (0, topics_1.repoTopics)(loaded.repo.dir), {
             collaborators: Object.entries(access.collaborators).map(([username, role]) => ({ username, role })),
             owners: (0, perms_1.collectionOwners)(root, loaded.repo.collection),
-        }, msg));
+        }, {
+            enabled: settings.enabled,
+            source: settings.source,
+            path: settings.path,
+            label: settings.label,
+            domain: (0, domains_1.repoDomain)(root, loaded.repo.collection, loaded.repo.name),
+            sitesHost,
+            derivedLabel: derivedHost ? derivedHost.slice(0, -(sitesHost.length + 1)) : null,
+            collectionAlias: alias,
+            dirExists: (0, scan_1.siteDir)(root, loaded.repo.collection, loaded.repo.name) !== null,
+        }, msg, undefined, section));
     }));
     app.post('/:collection/:repo/settings', form, (0, web_1.ah)(async (req, res) => {
         const viewer = (0, web_1.requireViewerPost)(root, req, res);
@@ -916,12 +1834,32 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
         const loaded = await (0, web_1.loadRepo)(root, req, res, viewer);
         if (!loaded)
             return;
-        const backUrl = `${urlOf(loaded.repo)}/settings`;
+        const backUrl = settingsBack(loaded.repo, 'general');
         if (!(0, perms_1.atLeast)(loaded.role, 'write')) {
             (0, web_1.fail)(res, 403, `You do not have the write role on ${loaded.repo.collection}/${loaded.repo.name}.`, viewer, backUrl);
             return;
         }
-        ops.setDescription(loaded.repo.dir, (0, web_1.field)(req, 'description'));
+        try {
+            ops.setDescription(loaded.repo.dir, (0, web_1.field)(req, 'description'));
+            // Only when the form carried the field: the General form always does,
+            // but treating an absent field as "no topics" would let any other
+            // post to this route silently clear them.
+            if (req.body.topics !== undefined) {
+                (0, topics_1.setTopics)(loaded.repo.dir, (0, topics_1.parseTopicsInput)((0, web_1.field)(req, 'topics')));
+            }
+            // Same guard as topics: an absent field means an older or other form,
+            // not a request to clear the upstream.
+            if (req.body.upstream !== undefined) {
+                await ops.setUpstream(loaded.repo.dir, (0, web_1.field)(req, 'upstream').trim());
+            }
+        }
+        catch (e) {
+            if (e instanceof ops_1.OpError) {
+                (0, web_1.fail)(res, (0, ops_1.opErrorStatus)(e.kind), e.message, viewer, backUrl);
+                return;
+            }
+            throw e;
+        }
         const defaultBranch = (0, web_1.field)(req, 'defaultBranch');
         if (defaultBranch !== '' && defaultBranch !== loaded.defaultBranch) {
             if (!loaded.branches.some((b) => b.name === defaultBranch)) {
@@ -929,12 +1867,62 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
                 return;
             }
             await ops.setDefaultBranch(loaded.repo.dir, defaultBranch);
+            // A site that follows the default branch now follows this one.
+            await (0, sitepublish_1.publishSiteAfterPush)(root, loaded.repo, `refs/heads/${defaultBranch}`);
         }
-        res.redirect(`${backUrl}?msg=${encodeURIComponent('Settings saved.')}`);
+        res.redirect(settingsBack(loaded.repo, 'general', 'Settings saved.'));
+    }));
+    // Topics on their own, for the editor in the repository page's About panel:
+    // a form that posted only topics to the route above would clear the
+    // description on the way. Write role, the same as the description, since a
+    // topic publishes nothing and withdraws nothing.
+    app.post('/:collection/:repo/settings/topics', form, (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = await (0, web_1.loadRepo)(root, req, res, viewer);
+        if (!loaded)
+            return;
+        // Back to where the form was: the About panel's editor says so, and
+        // anything else lands on the settings page.
+        const backUrl = (0, web_1.field)(req, 'next') === 'repo' ? urlOf(loaded.repo) : `${urlOf(loaded.repo)}/settings`;
+        if (!(0, perms_1.atLeast)(loaded.role, 'write')) {
+            (0, web_1.fail)(res, 403, `You do not have the write role on ${loaded.repo.collection}/${loaded.repo.name}.`, viewer, backUrl);
+            return;
+        }
+        try {
+            (0, topics_1.setTopics)(loaded.repo.dir, (0, topics_1.parseTopicsInput)((0, web_1.field)(req, 'topics')));
+        }
+        catch (e) {
+            if (e instanceof ops_1.OpError) {
+                (0, web_1.fail)(res, (0, ops_1.opErrorStatus)(e.kind), e.message, viewer, backUrl);
+                return;
+            }
+            throw e;
+        }
+        const now = (0, topics_1.repoTopics)(loaded.repo.dir);
+        const msg = now.length === 0 ? 'Topics cleared.' : `Topics saved: ${now.join(', ')}.`;
+        // Topics live in the General box, so a post from the settings page is
+        // confirmed there; one from the About panel goes back to the repository
+        // page, which has no box to name.
+        res.redirect((0, web_1.field)(req, 'next') === 'repo'
+            ? `${backUrl}?msg=${encodeURIComponent(msg)}`
+            : settingsBack(loaded.repo, 'general', msg));
     }));
     // ---- visibility and collaborators ----
     // Both take the admin role: who may see or write a repository is decided by
     // the people who administer it, the same rule the JSON API applies.
+    /**
+     * Where a settings form sends the reader afterwards: back to the box it was
+     * posted from, carrying its confirmation. The fragment is what scrolls
+     * there, so a save no longer throws the reader to the top of the page, and
+     * `in=` names the same box in the query because a fragment never reaches the
+     * server and the page has to know which box to show the message in.
+     */
+    function settingsBack(repo, section, msg) {
+        const query = msg === undefined ? '' : `?msg=${encodeURIComponent(msg)}&in=${section}`;
+        return `${urlOf(repo)}/settings${query}#${section}`;
+    }
     async function loadForRepoAdmin(req, res, viewer) {
         const loaded = await (0, web_1.loadRepo)(root, req, res, viewer);
         if (!loaded)
@@ -952,13 +1940,101 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
         const loaded = await loadForRepoAdmin(req, res, viewer);
         if (!loaded)
             return;
-        const backUrl = `${urlOf(loaded.repo)}/settings`;
         const priv = (0, web_1.field)(req, 'private') === 'true';
         (0, perms_1.setRepoPrivate)(loaded.repo.dir, priv);
         const msg = priv
             ? 'This repository is now private: visible to its collaborators, the collection’s owners, and site admins.'
             : 'This repository is now public: anyone can read it.';
-        res.redirect(`${backUrl}?msg=${encodeURIComponent(msg)}`);
+        res.redirect(settingsBack(loaded.repo, 'access', msg));
+    }));
+    // The site's switch, source, hostname label, and custom domain, from the
+    // Site box on the settings page. Admin, like visibility: enabling a site
+    // publishes whatever the directory holds to everyone. Each field is applied
+    // only when the form carried it, so the enable/disable button and the
+    // config form can post to one route without clearing each other's fields.
+    // The domain field is rendered only for a site admin and re-checked here,
+    // since attaching a hostname is the operator's act.
+    app.post('/:collection/:repo/settings/site', form, (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = await loadForRepoAdmin(req, res, viewer);
+        if (!loaded)
+            return;
+        const backUrl = settingsBack(loaded.repo, 'site');
+        const body = req.body;
+        const label = (0, web_1.field)(req, 'label').trim();
+        if (body.label !== undefined && label !== '') {
+            if ((0, siteshost_1.isReservedSiteLabel)(label)) {
+                (0, web_1.fail)(res, 409, `The label ${label} is reserved for the operator of this vault: it is one of the names kept for the vault's own use under the sites host.`, viewer, backUrl);
+                return;
+            }
+            if (!(0, sitesettings_1.isUsableSiteLabel)(label)) {
+                (0, web_1.fail)(res, 400, 'A site label is lowercase letters, digits, and single interior hyphens, at most 63 characters.', viewer, backUrl);
+                return;
+            }
+            const holder = (0, sitesettings_1.siteLabelConflict)(root, label, loaded.repo.collection, loaded.repo.name);
+            if (holder) {
+                (0, web_1.fail)(res, 409, `The label ${label} is already used by ${holder}.`, viewer, backUrl);
+                return;
+            }
+        }
+        const source = (0, web_1.field)(req, 'source');
+        if (body.source !== undefined && !(0, sitesettings_1.isSiteSource)(source)) {
+            (0, web_1.fail)(res, 400, 'The site source must be copied files, workflow deploys, or repository contents.', viewer, backUrl);
+            return;
+        }
+        const sitePath = body.path !== undefined ? (0, sitesettings_1.normalizeSitePath)((0, web_1.field)(req, 'path')) : null;
+        if (sitePath !== null && !(0, sitesettings_1.isUsableSitePath)(sitePath)) {
+            (0, web_1.fail)(res, 400, 'The directory must be a relative path within the repository, such as docs, or empty for the root.', viewer, backUrl);
+            return;
+        }
+        if (body.domain !== undefined) {
+            if (!(0, perms_1.isSiteAdmin)(viewer.auth)) {
+                (0, web_1.fail)(res, 403, 'Attaching a custom domain takes a site admin.', viewer, backUrl);
+                return;
+            }
+            const domain = (0, web_1.field)(req, 'domain').trim();
+            if (domain === '') {
+                (0, domains_1.clearRepoDomain)(root, loaded.repo.collection, loaded.repo.name);
+            }
+            else {
+                const problem = (0, domains_1.setRepoDomain)(root, loaded.repo.collection, loaded.repo.name, domain);
+                if (problem) {
+                    (0, web_1.fail)(res, problem.kind === 'conflict' ? 409 : 400, `The domain was refused: ${problem.message}.`, viewer, backUrl);
+                    return;
+                }
+            }
+        }
+        const changingSettings = body.enabled !== undefined || body.source !== undefined || body.label !== undefined || sitePath !== null;
+        const settings = changingSettings
+            ? (0, sitesettings_1.editSiteSettings)(loaded.repo.dir, (s) => {
+                if (body.enabled !== undefined)
+                    s.enabled = (0, web_1.field)(req, 'enabled') === 'true';
+                if (body.source !== undefined && (0, sitesettings_1.isSiteSource)(source))
+                    s.source = source;
+                if (body.label !== undefined)
+                    s.label = label;
+                if (sitePath !== null)
+                    s.path = sitePath;
+            })
+            : (0, sitesettings_1.siteSettings)(loaded.repo.dir);
+        let msg = body.enabled !== undefined
+            ? settings.enabled
+                ? 'The site is now enabled: the files in its site directory are served to everyone.'
+                : 'The site is now disabled: its files stay on disk but nothing is served, and workflow deploys are refused.'
+            : 'Site settings saved.';
+        // A site published from the repository is written now, so that
+        // enabling it or pointing it at a directory takes effect without
+        // waiting for the next push; the outcome is part of the message.
+        if (changingSettings) {
+            const published = await (0, sitepublish_1.publishSiteForSettings)(root, loaded.repo);
+            if (published && 'files' in published)
+                msg += ` The site was published from the repository: ${published.files} file(s).`;
+            else if (published)
+                msg += ` The site could not be published from the repository: ${published.error}.`;
+        }
+        res.redirect(settingsBack(loaded.repo, 'site', msg));
     }));
     app.post('/:collection/:repo/settings/collaborators', form, (0, web_1.ah)(async (req, res) => {
         const viewer = (0, web_1.requireViewerPost)(root, req, res);
@@ -967,7 +2043,7 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
         const loaded = await loadForRepoAdmin(req, res, viewer);
         if (!loaded)
             return;
-        const backUrl = `${urlOf(loaded.repo)}/settings`;
+        const backUrl = settingsBack(loaded.repo, 'access');
         const username = (0, web_1.field)(req, 'username').trim();
         const role = (0, web_1.field)(req, 'role');
         if (role !== 'read' && role !== 'write' && role !== 'admin') {
@@ -982,7 +2058,7 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
             return;
         }
         (0, perms_1.setCollaborator)(loaded.repo.dir, username, role);
-        res.redirect(`${backUrl}?msg=${encodeURIComponent(`${username} now has the ${role} role here.`)}`);
+        res.redirect(settingsBack(loaded.repo, 'access', `${username} now has the ${role} role here.`));
     }));
     app.post('/:collection/:repo/settings/collaborators/remove', form, (0, web_1.ah)(async (req, res) => {
         const viewer = (0, web_1.requireViewerPost)(root, req, res);
@@ -991,14 +2067,14 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
         const loaded = await loadForRepoAdmin(req, res, viewer);
         if (!loaded)
             return;
-        const backUrl = `${urlOf(loaded.repo)}/settings`;
+        const backUrl = settingsBack(loaded.repo, 'access');
         const username = (0, web_1.field)(req, 'username').trim();
         if ((0, perms_1.repoAccess)(loaded.repo.dir).collaborators[username] === undefined) {
             (0, web_1.fail)(res, 404, `${username} is not a collaborator here.`, viewer, backUrl);
             return;
         }
         (0, perms_1.removeCollaborator)(loaded.repo.dir, username);
-        res.redirect(`${backUrl}?msg=${encodeURIComponent(`Removed ${username}.`)}`);
+        res.redirect(settingsBack(loaded.repo, 'access', `Removed ${username}.`));
     }));
     // ---- forking ----
     app.get('/:collection/:repo/fork', (0, web_1.ah)(async (req, res) => {
@@ -1049,6 +2125,24 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
         }
         res.redirect((0, views_1.repoUrl)({ collection: toCollection, repo: toName }));
     }));
+    // Syncing a fork from its upstream, like importing, runs on the operator's
+    // machine: the server never fetches from another host. So the Sync link in
+    // the repository header leads here, and this page only hands them the
+    // command, the way the import page does.
+    app.get('/:collection/:repo/sync', (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPage)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = await (0, web_1.loadRepo)(root, req, res, viewer);
+        if (!loaded)
+            return;
+        const ctx = await (0, web_1.makeCtx)(root, req, loaded, loaded.defaultBranch ?? '', viewer);
+        if (!ctx.upstream) {
+            (0, web_1.fail)(res, 404, 'This repository has no upstream recorded, so there is nothing to sync from. Record one in its settings to make it a fork.', viewer, `${urlOf(loaded.repo)}/settings`);
+            return;
+        }
+        res.type('html').send(forms.syncPage(ctx, `${req.protocol}://${req.get('host') ?? ''}`));
+    }));
     app.post('/:collection/:repo/settings/rename', form, (0, web_1.ah)(async (req, res) => {
         const viewer = (0, web_1.requireViewerPost)(root, req, res);
         if (!viewer)
@@ -1198,6 +2292,125 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
         (0, themes_1.setActiveTheme)(name);
         res.redirect(`/admin/appearance?msg=${encodeURIComponent(`Theme set to ${name}.`)}`);
     });
+    // ---- sign-in with GitHub, administered ----
+    //
+    // One page: the OAuth App's credentials, the approved list, and what is
+    // already linked. All of it is vault-wide, so all of it takes a site admin,
+    // like the theme and the egress budget.
+    const githubAdminOnly = (viewer, res) => {
+        if (canSetVaultWide(viewer))
+            return true;
+        (0, web_1.fail)(res, 403, 'Sign-in with GitHub is vault-wide, so it takes a site admin.', viewer, '/admin');
+        return false;
+    };
+    app.get('/admin/github', (req, res) => {
+        const viewer = requireAdminPage(req, res);
+        if (!viewer)
+            return;
+        if (!githubAdminOnly(viewer, res))
+            return;
+        const state = (0, vault_1.loadVault)(root);
+        if (state.status !== 'ok') {
+            (0, web_1.fail)(res, 500, 'The vault is not available.', viewer, '/admin');
+            return;
+        }
+        const approved = (state.vault.githubApproved ?? []).map((a) => ({
+            ...a,
+            account: (0, vault_1.findGithubAccount)(state.vault, a.id)?.username ?? null,
+        }));
+        const linked = Object.entries(state.vault.users).flatMap(([username, u]) => u.github ? [{ username, id: u.github.id, login: u.github.login }] : []);
+        const msg = typeof req.query.msg === 'string' ? req.query.msg : undefined;
+        res.type('html').send(forms.adminGithubPage(viewer, {
+            clientId: (0, config_1.loadConfig)(root).auth.githubClientId,
+            secretSet: (0, githubauth_1.readGithubSecret)(root) !== null,
+            callbackUrl: githubCallbackUrl(req),
+            approved,
+            linked,
+            msg,
+        }));
+    });
+    // The credentials post back to the page's own two-segment URL, like the
+    // egress and appearance forms: a third segment named `settings` would be
+    // shadowed by the /:collection/:repo/settings route registered above.
+    app.post('/admin/github', form, (req, res) => {
+        const viewer = requireAdminPost(req, res);
+        if (!viewer)
+            return;
+        if (!githubAdminOnly(viewer, res))
+            return;
+        const clientId = (0, web_1.field)(req, 'clientId').trim();
+        const clientSecret = (0, web_1.field)(req, 'clientSecret').trim();
+        if (clientId === '') {
+            (0, config_1.saveConfig)(root, { auth: { githubClientId: '' } });
+            (0, githubauth_1.clearGithubSecret)(root);
+            res.redirect(`/admin/github?msg=${encodeURIComponent('Sign-in with GitHub is off; the stored secret was removed.')}`);
+            return;
+        }
+        if (!/^[\x21-\x7e]{1,100}$/.test(clientId)) {
+            (0, web_1.fail)(res, 400, 'That does not look like a client id.', viewer, '/admin/github');
+            return;
+        }
+        if (clientSecret !== '' && !/^[\x21-\x7e]{1,200}$/.test(clientSecret)) {
+            (0, web_1.fail)(res, 400, 'That does not look like a client secret.', viewer, '/admin/github');
+            return;
+        }
+        (0, config_1.saveConfig)(root, { auth: { githubClientId: clientId } });
+        if (clientSecret !== '')
+            (0, githubauth_1.writeGithubSecret)(root, clientSecret);
+        const ready = (0, githubauth_1.readGithubSecret)(root) !== null;
+        res.redirect(`/admin/github?msg=${encodeURIComponent(ready ? 'Saved. Sign-in with GitHub is on.' : 'Client id saved. Add the client secret to turn sign-in on.')}`);
+    });
+    app.post('/admin/github/approve', form, (0, web_1.ah)(async (req, res) => {
+        const viewer = requireAdminPost(req, res);
+        if (!viewer)
+            return;
+        if (!githubAdminOnly(viewer, res))
+            return;
+        const login = (0, web_1.field)(req, 'login').trim().replace(/^@/, '');
+        if (!(0, githubauth_1.isPlausibleGithubLogin)(login)) {
+            (0, web_1.fail)(res, 400, 'That does not look like a GitHub username.', viewer, '/admin/github');
+            return;
+        }
+        // Resolved to the numeric id now, over GitHub's public API, so the
+        // approval survives any later rename of the login.
+        const resolved = await (0, githubauth_1.lookupGithubLogin)(login);
+        if (!resolved) {
+            (0, web_1.fail)(res, 404, `GitHub does not know a user ${login}, or could not be reached; try again.`, viewer, '/admin/github');
+            return;
+        }
+        (0, vault_1.approveGithub)(root, resolved);
+        res.redirect(`/admin/github?msg=${encodeURIComponent(`Approved ${resolved.login} (GitHub id ${resolved.id}).`)}`);
+    }));
+    app.post('/admin/github/approved/:id/remove', form, (req, res) => {
+        const viewer = requireAdminPost(req, res);
+        if (!viewer)
+            return;
+        if (!githubAdminOnly(viewer, res))
+            return;
+        const id = Number(req.params.id);
+        if (!Number.isInteger(id) || !(0, vault_1.unapproveGithub)(root, id)) {
+            (0, web_1.fail)(res, 404, 'That GitHub account is not on the approved list.', viewer, '/admin/github');
+            return;
+        }
+        res.redirect(`/admin/github?msg=${encodeURIComponent('Approval removed. Accounts already linked keep signing in until unlinked.')}`);
+    });
+    // The admin's off switch for a GitHub link, beside the ones for tokens and
+    // passkeys: the user unlinks their own on /account, and this is for the day
+    // they cannot.
+    app.post('/admin/users/:name/github/unlink', form, (req, res) => {
+        const viewer = requireAdminPost(req, res);
+        if (!viewer)
+            return;
+        const backUrl = `/admin/users/${encodeURIComponent(req.params.name)}`;
+        const found = loadUserForAdmin(req, res, viewer, backUrl);
+        if (!found)
+            return;
+        if (!(0, vault_1.unlinkGithub)(root, found.name)) {
+            (0, web_1.fail)(res, 404, `No GitHub account is linked to ${found.name}.`, viewer, backUrl);
+            return;
+        }
+        res.redirect(`${backUrl}?msg=${encodeURIComponent('GitHub account unlinked.')}`);
+    });
     app.get('/admin/users', (req, res) => {
         const viewer = requireAdminPage(req, res);
         if (!viewer)
@@ -1230,7 +2443,7 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
             (0, web_1.fail)(res, 409, `User ${username} already exists; use Grant or Mint token on the users page instead.`, viewer, backUrl);
             return;
         }
-        const result = (0, vault_1.addUserToken)(root, username, { siteAdmin: (0, web_1.field)(req, 'siteAdmin') === 'true' });
+        const result = (0, vault_1.addUserToken)(root, username, { siteAdmin: (0, web_1.field)(req, 'siteAdmin') === 'true', by: viewer.auth.username });
         res.type('html').send(forms.tokenPage(viewer, username, result.token, true));
     });
     /**
@@ -1296,6 +2509,22 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
         }
         res.redirect(`${backUrl}?msg=${encodeURIComponent(`Revoked token ${req.params.id}.`)}`);
     });
+    // The admin's off switch for a passkey, beside the one for tokens: the
+    // user removes their own on /account, and this is for the day they cannot.
+    app.post('/admin/users/:name/passkeys/:id/delete', form, (req, res) => {
+        const viewer = requireAdminPost(req, res);
+        if (!viewer)
+            return;
+        const backUrl = `/admin/users/${encodeURIComponent(req.params.name)}`;
+        const found = loadUserForAdmin(req, res, viewer, backUrl);
+        if (!found)
+            return;
+        if (!(0, vault_1.removePasskey)(root, found.name, req.params.id)) {
+            (0, web_1.fail)(res, 404, `No such passkey for ${found.name}.`, viewer, backUrl);
+            return;
+        }
+        res.redirect(`${backUrl}?msg=${encodeURIComponent('Passkey removed.')}`);
+    });
     app.post('/admin/users/:name/emails', form, (req, res) => {
         const viewer = requireAdminPost(req, res);
         if (!viewer)
@@ -1396,6 +2625,7 @@ function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
         }
         const result = (0, vault_1.addUserToken)(root, username, {
             tokenScope: tokenScope.length ? tokenScope : undefined,
+            by: viewer.auth.username,
         });
         res.type('html').send(forms.tokenPage(viewer, username, result.token, false));
     });