@mason-data/cli 0.8.0 → 0.10.0

package/dist/src/duck/token.js

@@ -14,11 +14,14 @@ export function mintToken(apiKey, seconds, now = Date.now()) {
     const expiry = Math.floor(now / 1000) + seconds;
     return { token: `${PREFIX}_${expiry}_${mac(apiKey, expiry)}`, expiresAt: new Date(expiry * 1000).toISOString() };
 }
+const TOKEN_RE = /^mason_(\d{1,12})_([A-Za-z0-9_-]{43})$/;
+/** Whether a password is a token by its shape, good or not. */
+export const isToken = (password) => TOKEN_RE.test(password);
 /** null when the token is good; else why not, in a sentence a person reads after "password authentication failed" */
 export function tokenProblem(apiKey, token, now = Date.now()) {
     if (token === apiKey)
         return "the API key is not a password here: mason user add <name> makes a user whose password does not expire";
-    const m = /^mason_(\d{1,12})_([A-Za-z0-9_-]{43})$/.exec(token);
+    const m = TOKEN_RE.exec(token);
     if (m === null)
         return "not a Mason user's password or token: mason user add <name> makes a user whose password does not expire";
     const expiry = Number(m[1]);

package/dist/src/duck/types.js

@@ -11,9 +11,11 @@
  * UNION as its text. Each column that diverges carries the reason, and the runner logs it once per statement.
  */
 import { Buffer } from "node:buffer";
-import { DuckDBTypeId, DuckDBDateValue, DuckDBTimestampValue, DuckDBTimestampTZValue, DuckDBDecimalValue, DuckDBUUIDValue, DuckDBListValue, DuckDBArrayValue, DuckDBIntervalValue, DuckDBBlobValue, DuckDBTimeValue, DuckDBListType, DuckDBArrayType, DuckDBTimestampSecondsValue, DuckDBTimestampMillisecondsValue, DuckDBTimestampNanosecondsValue, } from "@duckdb/node-api";
+import { DuckDBTypeId, DuckDBDateValue, DuckDBTimestampValue, DuckDBTimestampTZValue, DuckDBDecimalValue, DuckDBUUIDValue, DuckDBListValue, DuckDBArrayValue, DuckDBIntervalValue, DuckDBBlobValue, DuckDBTimeValue, DuckDBListType, DuckDBArrayType, DuckDBTimeTZValue, DuckDBTimestampSecondsValue, DuckDBTimestampMillisecondsValue, DuckDBTimestampNanosecondsValue, } from "@duckdb/node-api";
 import { jsonbText } from "./jsonb.js";
 import { gapMark } from "./gaps.js";
+import { heldType, ZONED_HELD } from "./held-types.js";
+import { pgEvalSync } from "./pg-eval.js";
 import { EncodeError, encodeValue, OID, TIMESTAMP } from "../api/postgres/encode.js";
 const MICROS_PER_DAY = 86400000000n;
 const DATE_INFINITY = 2_147_483_647, DATE_NEG_INFINITY = -2_147_483_647;
@@ -137,6 +139,12 @@ function timeText(micros) {
     const secs = micros / 1000000n, frac = micros % 1000000n;
     return `${pad(secs / 3600n)}:${pad((secs % 3600n) / 60n)}:${pad(secs % 60n)}${frac === 0n ? "" : `.${pad(frac, 6).replace(/0+$/, "")}`}`;
 }
+/** A timetz as timetz_out writes it: the time, then its offset as `+HH`, `+HH:MM` or `+HH:MM:SS` (DuckDB's offset, as
+ *  Postgres writes it, is east of UTC; its stored zone is west) */
+export function timetzText(v) {
+    const abs = Math.abs(v.offset), s = abs % 60, m = Math.trunc(abs / 60) % 60;
+    return `${timeText(v.micros)}${v.offset < 0 ? "-" : "+"}${pad(Math.trunc(abs / 3600))}${m !== 0 || s !== 0 ? `:${pad(m)}` : ""}${s !== 0 ? `:${pad(s)}` : ""}`;
+}
 /** An interval as Postgres's `interval_out` writes it under IntervalStyle postgres: `1 year 2 mons 3 days 04:05:06.7` */
 export function intervalText(months, days, micros) {
     const parts = [];
@@ -213,7 +221,7 @@ function arrayElement(text) {
 /** Postgres's array OIDs of the element OIDs this file sends */
 const ARRAY_OID = {
     16: 1000, 17: 1001, 20: 1016, 21: 1005, 23: 1007, 25: 1009, 700: 1021, 701: 1022, 1082: 1182, 1083: 1183,
-    1114: 1115, 1184: 1185, 1186: 1187, 1700: 1231, 2950: 2951, 3802: 3807,
+    1114: 1115, 1184: 1185, 1186: 1187, 1266: 1270, 1700: 1231, 2950: 2951, 3802: 3807,
 };
 function custom(name, oid, size, text, binary, divergence = null) {
     return {
@@ -285,6 +293,8 @@ export function wireColumn(name, t) {
         case DuckDBTypeId.TIMESTAMP_TZ: return timestampColumn(name, true);
         case DuckDBTypeId.TIME:
             return custom(name, 1083, 8, (v) => timeText(v.micros), (v) => { const b = Buffer.alloc(8); b.writeBigInt64BE(v.micros); return b; });
+        case DuckDBTypeId.TIME_TZ:
+            return custom(name, 1266, 12, (v) => timetzText(v), (v) => { const t = v; const b = Buffer.alloc(12); b.writeBigInt64BE(t.micros, 0); b.writeInt32BE(-t.offset, 8); return b; });
         case DuckDBTypeId.INTERVAL:
             return custom(name, 1186, 16, (v) => { const i = v; return intervalText(i.months, i.days, i.micros); }, (v) => { const i = v; const b = Buffer.alloc(16); b.writeBigInt64BE(i.micros, 0); b.writeInt32BE(i.days, 8); b.writeInt32BE(i.months, 12); return b; });
         case DuckDBTypeId.BLOB:
@@ -313,7 +323,7 @@ export function wireColumn(name, t) {
 // int4, its DECIMAL as a numeric, its JSON as jsonb's canonical text. Where DuckDB's value cannot be written as
 // Postgres's type (a timestamp where Postgres says date), DuckDB's own encoding stands and the column says why.
 /** pg_type.typlen of the OIDs a result column may have */
-const TYPLEN = { 16: 1, 18: 1, 19: 64, 20: 8, 21: 2, 23: 4, 26: 4, 700: 4, 701: 8, 1082: 4, 1083: 8, 1114: 8, 1184: 8, 1186: 16, 2950: 16 };
+const TYPLEN = { 16: 1, 18: 1, 19: 64, 20: 8, 21: 2, 23: 4, 26: 4, 700: 4, 701: 8, 1082: 4, 1083: 8, 1114: 8, 1184: 8, 1186: 16, 1266: 12, 2950: 16 };
 const PG_TEXT = new Set([25, 1043, 1042, 19, 18]);
 const PG_INT = { 21: "int2", 23: "int4", 20: "int8" };
 const DUCK_EXACT = new Set([DuckDBTypeId.TINYINT, DuckDBTypeId.SMALLINT, DuckDBTypeId.INTEGER, DuckDBTypeId.BIGINT, DuckDBTypeId.HUGEINT,
@@ -349,6 +359,45 @@ export function floatAsNumeric(x, digits = 15) {
     }
     return s === "-0" ? "0" : s;
 }
+/** the binary forms of the text-held types a driver asks for by default (pgjdbc: point, box): each a float8's bytes */
+const HELD_BINARY = {
+    600: floats, 603: floats,
+};
+function floats(text) {
+    const parts = text.match(/-?(?:Infinity|NaN|[\d.]+(?:e[-+]?\d+)?)/g) ?? [];
+    const b = Buffer.alloc(parts.length * 8);
+    parts.forEach((p, i) => b.writeDoubleBE(Number(p), i * 8));
+    return b;
+}
+/** a time range's text in the session's zone: Postgres's own output, a value at a time, the last few remembered */
+const zonedTexts = new Map();
+function inZone(type, text, zone) {
+    const key = `${zone}\u0000${type}\u0000${text}`;
+    let written = zonedTexts.get(key);
+    if (written === undefined) {
+        written = pgEvalSync(`SELECT $1::${type}::text`, [text], zone)[0]?.[0] ?? text;
+        if (zonedTexts.size >= 1024)
+            zonedTexts.clear();
+        zonedTexts.set(key, written);
+    }
+    return written;
+}
+/** a column of a type held as its text. A value's text only: Mason writes the binary form of few of them */
+function heldColumn(name, oid, own, size) {
+    const binary = HELD_BINARY[oid], zoned = ZONED_HELD.get(oid);
+    return {
+        name, oid, size, divergence: null,
+        encode: (v, format, s) => {
+            if (v === null)
+                return null;
+            if (format === 0)
+                return zoned !== undefined ? Buffer.from(inZone(zoned, str(v), s.timeZone), "utf8") : own.encode(v, 0, s);
+            if (binary !== undefined)
+                return binary(str(v));
+            throw new EncodeError(`column ${JSON.stringify(name)} (type OID ${oid}) is held as its text and cannot be sent in binary by Mason: ask for text (${gapMark("binary-held-type")})`, "0A000", "binary-held-type");
+        },
+    };
+}
 /** The wire column of a result column whose Postgres type the analysis gave, holding DuckDB values of type `t`. */
 export function pgTypedColumn(name, oid, t, typmod = -1) {
     const own = wireColumn(name, t);
@@ -360,6 +409,16 @@ export function pgTypedColumn(name, oid, t, typmod = -1) {
         return retyped(viaApi(name, "numeric", (v) => padDecimals(exactText(v), (typmod - 4) & 0xffff)));
     if (own.oid === oid)
         return retyped(own);
+    // a type the copy holds as its text, or an array of one (src/duck/held-types.ts): the text, under Postgres's OID
+    const held = heldType(oid);
+    if (held !== undefined && (own.oid === 25 || own.oid === 1009))
+        return heldColumn(name, oid, own, held.oid === oid ? held.size : -1);
+    // an oid element of an oid[], held as its digits
+    if (oid === 26 && own.oid === 25)
+        return custom(name, 26, 4, str, (v) => { const b = Buffer.alloc(4); b.writeUInt32BE(Number(str(v))); return b; });
+    // an oid: DuckDB's UINTEGER
+    if (oid === 26 && DUCK_EXACT.has(t.typeId))
+        return custom(name, 26, 4, (v) => exactText(v), (v) => { const b = Buffer.alloc(4); b.writeUInt32BE(Number(exactText(v))); return b; });
     // an inet: stored as Postgres's text with its mask (`10.3.6.45/32`), sent as inet_out writes it (a full mask dropped)
     if (oid === 869 && own.oid === 25)
         return custom(name, 869, -1, (v) => inetOut(str(v)), (v) => inetBytes(str(v)));
@@ -404,12 +463,9 @@ export function pgTypedColumn(name, oid, t, typmod = -1) {
     }
     return { ...own, divergence: `Postgres says type OID ${oid}; the engine computed ${t.toString()}, sent as its own type` };
 }
-/** How a cell of an exact numeric (src/duck/rewrite.ts ExactColumn) reads as a decimal text, by DuckDB's type: an exact
- *  number's digits, a float as Postgres's cast to numeric writes it — or null where the cell needs digits DuckDB did not
- *  keep (a double where the program wants exact ones). */
 export function cellText(t, conv) {
     // a numeric's text as Postgres's numeric_out wrote it (a text read by numeric_in, src/duck/pg-eval.ts)
-    if (conv === "text")
+    if (conv === "text" || conv === "parsed")
         return t.typeId === DuckDBTypeId.VARCHAR ? (v) => String(v) : null;
     if (DUCK_EXACT.has(t.typeId))
         return exactText;

package/dist/src/duck/usage.js

@@ -1,5 +1,5 @@
 import { MASON_SCHEMA } from "./store.js";
-import { History, Streak } from "./history.js";
+import { History, Streak, cutoff } from "./history.js";
 import { outcomeOf } from "../api/request-log.js";
 export const USAGE_TABLE = `${MASON_SCHEMA}.usage`;
 export const SIZES_TABLE = `${MASON_SCHEMA}.copy_sizes`;
@@ -265,10 +265,12 @@ export class UsageSampler {
             this.log(`usage: measured ${rows.length} synced tables' own size in ${Math.round(performance.now() - t0)} ms (every ${Math.round((this.options.sizeEveryMs ?? SIZE_EVERY_MS) / 60_000)} min)`);
         }
     }
-    /** Deletes the samples and sizes older than the retention. */
+    /** Deletes the samples and sizes older than the retention, counted back from the module's ONE clock (`now`, which
+     *  stamps each sample), never the engine's `now()` (src/duck/events.ts `trim` says why). */
     async trim() {
-        await this.history.writer.run(`DELETE FROM ${USAGE_TABLE} WHERE sampled_at < now() - INTERVAL (${this.days}) DAY`);
-        await this.history.writer.run(`DELETE FROM ${SIZES_TABLE} WHERE sampled_at < now() - INTERVAL (${this.days}) DAY`);
+        const before = cutoff(this.now(), this.days);
+        await this.history.writer.run(`DELETE FROM ${USAGE_TABLE} WHERE sampled_at < $1::TIMESTAMPTZ`, [before]);
+        await this.history.writer.run(`DELETE FROM ${SIZES_TABLE} WHERE sampled_at < $1::TIMESTAMPTZ`, [before]);
     }
     /**
      * The samples from `since` until `until`, oldest first; with `stepSeconds`, re-bucketed in ONE query: buckets of that

package/dist/src/duck/users.js

@@ -24,11 +24,19 @@
  * user's session, the file read again when its inode, size or mtime moved), so a removal refuses the next connection
  * at once and ends the sessions that user holds at their next statement, without a restart. FAIL CLOSED: a file that
  * cannot be read refuses every user login with the reason (57P03, "could not tell"), never "live"; no file is no users.
+ *
+ * A USER'S ADDRESS RANGES (`from`, `mason user add --from`, `mason user from`): where it may connect from, read by the one
+ * grammar `MASON_PG_PROXY_FROM` is read by (src/lib/cidr.ts). Judged at login BEFORE the password, on the session's own
+ * address (`Session.clientAddr`, the PROXY header's client behind a named proxy), and again before each statement; an
+ * address that could not be read is outside every list (fail closed). While any user has ranges, a name that is no user
+ * is refused in the same words, and with the same work, as an address outside them: a limited user cannot be told from
+ * a missing one by the answer or its time (a user with no ranges still answers a wrong password 28P01).
  */
 import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { ApiError, USER_DISABLED } from "../api/error.js";
+import { ADDRESS_NOT_ALLOWED, ApiError, USER_DISABLED } from "../api/error.js";
+import { cidrOf, cidrText, inRanges, rangeOf } from "../lib/cidr.js";
 import { tokenProblem } from "./token.js";
 import { ATTRIBUTE_NAME_RE } from "./row-filter.js";
 export const USERS_FILE = "users.json";
@@ -36,6 +44,46 @@ export const USERS_FILE = "users.json";
  *  capitalises it is told so, never another user. */
 export const USER_NAME_RE = /^[a-z0-9][a-z0-9_.-]{0,62}$/;
 export const USER_NAME_RULE = "1 to 63 lower case letters, digits, \"_\", \".\" or \"-\", starting with a letter or digit (e.g. metabase)";
+/**
+ * A user's address ranges as given (`--from`, the file, `/api/users`): each read by the one grammar (src/lib/cidr.ts
+ * `cidrOf`), written back in its one form (`cidrText`: `10.0.0.0/16`, `2001:db8::/32`, `192.0.2.10`), a range given
+ * twice once; or every entry that is not a range, each with what is wrong. An empty list is no list of ranges: the way
+ * to any address is to have none (`mason user from <name> --any`).
+ */
+export function userRanges(list) {
+    if (list.length === 0)
+        return { problem: "no address range: name one or more (10.0.0.0/16, 2001:db8::/32, 192.0.2.10)" };
+    if (list.length > MAX_RANGES)
+        return { problem: `${list.length} address ranges: a user takes at most ${MAX_RANGES}` };
+    const from = [], ranges = [], wrong = [];
+    for (const entry of list) {
+        const c = cidrOf(entry);
+        if ("problem" in c) {
+            wrong.push(c.problem);
+            continue;
+        }
+        const t = cidrText(c);
+        if (!from.includes(t)) {
+            from.push(t);
+            ranges.push(rangeOf(c));
+        }
+    }
+    return wrong.length ? { problem: wrong.join("; ") } : { from, ranges };
+}
+/** The most address ranges one user takes (all input is untrusted: a bound). */
+export const MAX_RANGES = 100;
+/** Whether a user may connect from `address` (`Session.clientAddr`): any address when it has no ranges; with ranges, one
+ *  in them, and never an address that could not be read (null), nor any when its ranges cannot be read (fail closed). */
+export function addressAllowed(u, address) {
+    if (u.from === undefined)
+        return true;
+    if (address === null)
+        return false;
+    const r = userRanges(u.from);
+    return !("problem" in r) && inRanges(r.ranges, address);
+}
+/** an address as a refusal says it */
+export const addressShown = (address) => address === null ? "an address that could not be read" : address;
 /** a user's attributes as the file keeps them: a name each, a string or a list of strings */
 function attributesValid(v) {
     // a NUL ends the statement it is bound into, wherever it is: every statement of the user would fail as a syntax error
@@ -59,6 +107,8 @@ export const newUserId = () => crypto.randomBytes(8).toString("hex");
 export const userPassword = (apiKey, name, id) => `mason_${id}_${mac(apiKey, name, id)}`;
 /** Whether a password is a user's by its shape (else it is read as a token, src/duck/token.ts). */
 export const isUserPassword = (password) => PASSWORD_RE.test(password);
+/** What every `mason share` password begins with (src/cli/share-run.ts `newSharePassword`): no user's has it, `share` being no hex. */
+export const SHARE_PASSWORD_PREFIX = "mason_share_";
 /** Whether a user was added under this API key (one rotated since is no longer live). */
 export const underKey = (u, apiKey) => u.key === keyFingerprint(apiKey);
 /** The users the file lists; none when there is no file; why not, when it cannot be read — never an empty list then. */
@@ -91,7 +141,12 @@ function parseUsers(file, text) {
         if (typeof o !== "object" || o === null || typeof o.name !== "string" || !USER_NAME_RE.test(o.name) || typeof o.id !== "string" || !/^[0-9a-f]{16}$/.test(o.id) ||
             typeof o.addedAt !== "string" || typeof o.key !== "string" || (o.role !== undefined && (typeof o.role !== "string" || !ROLE_RE.test(o.role))) ||
             (o.attributes !== undefined && !attributesValid(o.attributes))) {
-            return { problem: `${file}: users[${i}] is not { name, id, addedAt, key, role?, attributes?[, removedAt][, disabledAt] } as mason user add writes it` };
+            return { problem: `${file}: users[${i}] is not { name, id, addedAt, key, role?, attributes?, from?[, removedAt][, disabledAt] } as mason user add writes it` };
+        }
+        if (o.from !== undefined) {
+            const r = Array.isArray(o.from) && o.from.every((x) => typeof x === "string") ? userRanges(o.from) : { problem: "not a list of strings" };
+            if ("problem" in r)
+                return { problem: `${file}: users[${i}].from is not a list of address ranges as mason user from writes it: ${r.problem}` };
         }
         if (o.removedAt !== undefined && typeof o.removedAt !== "string") {
             return { problem: `${file}: users[${i}].removedAt is not a timestamp as mason user remove writes it` };
@@ -100,7 +155,7 @@ function parseUsers(file, text) {
             return { problem: `${file}: users[${i}].disabledAt is not a timestamp as mason user disable writes it` };
         }
         users.push({ name: o.name, id: o.id, addedAt: o.addedAt, key: o.key, ...(typeof o.role === "string" ? { role: o.role } : {}),
-            ...(attributesValid(o.attributes) ? { attributes: o.attributes } : {}),
+            ...(attributesValid(o.attributes) ? { attributes: o.attributes } : {}), ...(Array.isArray(o.from) ? { from: o.from } : {}),
             ...(o.removedAt !== undefined ? { removedAt: o.removedAt } : {}), ...(o.disabledAt !== undefined ? { disabledAt: o.disabledAt } : {}) });
     }
     return { users };
@@ -182,6 +237,11 @@ export class LiveUsers {
     apiKey;
     seen = null;
     read = { users: [] };
+    /** each live user's ranges, parsed once per read of the file (so a login or a statement costs a lookup, never a parse) */
+    ranges = new Map();
+    /** the longest of those lists: what a name that is no user is judged against, so its refusal costs what a limited
+     *  user's does and the time of the answer does not tell them apart */
+    decoy = [];
     constructor(file, apiKey) { this.file = file; this.apiKey = apiKey; }
     /** the users not removed now (disabled ones included: their login is refused by name); why not, when the file cannot be read */
     now() {
@@ -200,11 +260,38 @@ export class LiveUsers {
             // a removed user is kept in the file for the list: it is no user to the listener
             this.read = "problem" in r ? r : { users: r.users.filter(isActive) };
             this.seen = stamp;
+            this.ranges = new Map();
+            this.decoy = [];
+            for (const u of "problem" in this.read ? [] : this.read.users) {
+                if (u.from === undefined)
+                    continue;
+                const parsed = userRanges(u.from);
+                // the file was read whole, so every list parses; one that would not stays out of the map, which refuses it
+                if ("problem" in parsed)
+                    continue;
+                this.ranges.set(u.id, parsed.ranges);
+                if (parsed.ranges.length > this.decoy.length)
+                    this.decoy = parsed.ranges;
+            }
         }
         return this.read;
     }
-    /** A connection's password, read as a user's: the session's token, or why it is refused. */
-    login(user, password) {
+    /** Whether `address` is inside `ranges` (null: no list, any address); an address not read is inside none. The ranges
+     *  are the parsed ones this read of the file holds, so this is a comparison, never a parse. */
+    inside(ranges, address) {
+        if (ranges === null)
+            return true;
+        return address !== null && inRanges(ranges, address);
+    }
+    /**
+     * A connection's password, read as a user's: the session's token, or why it is refused. `from` is the client's address
+     * (`Session.clientAddr`; null when it could not be read). THE ADDRESS IS JUDGED FIRST, before the password: the user
+     * the startup packet names, held to its ranges (`inside`); and while any user has ranges, a name that is no
+     * user is refused the same way (`ADDRESS_NOT_ALLOWED`, whose words the listener writes from the name and the address
+     * alone), so a connection from outside cannot tell a limited user from a missing one by its answer. Only the log line
+     * says which (the ApiError's message).
+     */
+    login(user, password, from = null) {
         const m = PASSWORD_RE.exec(password);
         if (m === null)
             throw refusal(401, "not a Mason user's password: mason user add <name> makes a user and prints its password", user);
@@ -212,6 +299,13 @@ export class LiveUsers {
         const now = this.now();
         if ("problem" in now)
             throw refusal(503, `the list of users cannot be read, so no user can connect: ${now.problem}`, user);
+        const named = now.users.find((u) => u.name === user);
+        // the same work on both sides: a limited user's own list, or for a name that is no user the longest list there is
+        const inside = this.inside(named === undefined ? this.decoy : named.from === undefined ? null : this.ranges.get(named.id) ?? [], from);
+        if (named !== undefined ? !inside : this.decoy.length > 0) {
+            throw refusal(401, named !== undefined ? `the user "${user}" may not connect from ${addressShown(from)}, outside its address ranges (mason user list shows them)`
+                : `no user "${user}" (from ${addressShown(from)}): refused as an address outside a user's ranges is, since some users have ranges`, user, ADDRESS_NOT_ALLOWED);
+        }
         const found = now.users.find((u) => u.id === id);
         const verifies = (name) => crypto.timingSafeEqual(Buffer.from(mac(this.apiKey, name, id)), Buffer.from(given));
         if (found === undefined) {
@@ -237,7 +331,7 @@ export class LiveUsers {
      * token as the file has the user NOW — its role as `mason user add --role` wrote it, so a role given or taken
      * applies at the user's next statement, without a restart.
      */
-    recheck(token) {
+    recheck(token, from = null) {
         if (token.user === undefined)
             return token;
         const now = this.now();
@@ -248,6 +342,10 @@ export class LiveUsers {
             throw refusal(401, `the user "${token.user}" was removed`, token.user);
         if (isDisabled(found))
             throw refusal(401, `the user "${token.user}" was disabled`, token.user, USER_DISABLED);
+        // its ranges changed since it logged in: a session from outside them ends, as a new connection would be refused
+        if (!this.inside(found.from === undefined ? null : this.ranges.get(found.id) ?? [], from)) {
+            throw refusal(401, `the user "${token.user}" may not connect from ${addressShown(from)}: its address ranges are ${found.from.join(", ")}`, token.user, ADDRESS_NOT_ALLOWED);
+        }
         if (found.role === token.role && JSON.stringify(found.attributes ?? null) === JSON.stringify(token.attributes ?? null))
             return token;
         const { role: _was, attributes: _had, ...rest } = token;
@@ -263,18 +361,21 @@ export const disabledMessage = (name) => `role "${name}" is not permitted to log
  * HOW THE DUCKDB RUN'S LISTENER TAKES A PASSWORD (src/cli/dev.ts; the tests wire the same): a user's password (its shape)
  * is the users file's to judge, and its session is asked again before every statement (a stat); anything else is read as a
  * token, the kind `mason connect` minted before `mason user` (src/duck/token.ts: the API key used as a password is refused by name).
+ * A `mason share` password is refused by name too: it was never this port's, and making a user is not the way out.
  */
 export function listenerLogins(users, apiKey) {
     return {
-        authenticate: (password, user) => {
+        authenticate: (password, user, from) => {
             if (isUserPassword(password))
-                return users.login(user, password);
+                return users.login(user, password, from ?? null);
+            if (password.startsWith(SHARE_PASSWORD_PREFIX))
+                throw new Error("a mason share password logs in only at the address mason share printed, never on this port");
             const problem = tokenProblem(apiKey, password);
             if (problem !== null)
                 throw new Error(problem);
             return { filters: [], subject: undefined };
         },
-        recheck: async (t) => users.recheck(t),
+        recheck: async (t, from) => users.recheck(t, from ?? null),
         recheckMs: 0,
     };
 }