@monotykamary/localterm-server 2.33.0 → 2.35.0

package/dist/identity/oidc-provider.js

@@ -0,0 +1,172 @@
+import { Hono } from "hono";
+import * as oauth from "oauth4webapi";
+import { AUTH_STATE_TTL_MS, IDENTITY_USER_MAX_LENGTH } from "../constants.js";
+import { clearSessionCookie, readSessionIdentity, setSessionCookie } from "./session-cookie.js";
+class OidcStateStore {
+    states = new Map();
+    set(state, entry) {
+        this.states.set(state, entry);
+        const now = Date.now();
+        for (const [key, value] of this.states) {
+            if (value.expiresAt < now)
+                this.states.delete(key);
+        }
+    }
+    consume(state) {
+        const entry = this.states.get(state);
+        this.states.delete(state);
+        if (!entry || entry.expiresAt < Date.now())
+            return null;
+        return entry;
+    }
+}
+// Only allow same-origin relative paths as the post-login landing target, to
+// keep the callback from being an open redirect: a value must start with `/`
+// and not `//` (a protocol-relative URL the browser would treat as absolute).
+export const sanitizeReturnTo = (value) => {
+    if (!value || !value.startsWith("/") || value.startsWith("//"))
+        return "/";
+    return value;
+};
+const buildRedirectUri = (origin) => `${origin.replace(/\/$/, "")}/auth/oidc/callback`;
+const buildOidcRoutes = (deps) => {
+    const app = new Hono();
+    // GET /oidc/login?returnTo=<path> — kick off the auth-code flow: mint PKCE +
+    // state + nonce, remember them against `state`, 302 to the IdP's authz
+    // endpoint. The `redirect_uri` is the daemon's announced origin + this
+    // callback path, which must be registered with the IdP — so OIDC needs a
+    // stable announced origin (the tailnet/local-https surface), unlike passkey
+    // which binds to whatever origin the browser is on.
+    app.get("/oidc/login", async (context) => {
+        const origin = deps.getOrigin();
+        if (!origin)
+            return context.json({ error: "no_origin" }, 500);
+        let metadata;
+        try {
+            metadata = await deps.getMetadata();
+        }
+        catch {
+            return context.json({ error: "issuer_unreachable" }, 502);
+        }
+        if (!metadata.authorization_endpoint) {
+            return context.json({ error: "issuer_unsupported" }, 502);
+        }
+        const redirectUri = buildRedirectUri(origin);
+        const codeVerifier = oauth.generateRandomCodeVerifier();
+        const codeChallenge = await oauth.calculatePKCECodeChallenge(codeVerifier);
+        const state = oauth.generateRandomState();
+        const nonce = oauth.generateRandomNonce();
+        const returnTo = sanitizeReturnTo(new URL(context.req.url).searchParams.get("returnTo"));
+        deps.stateStore.set(state, {
+            codeVerifier,
+            nonce,
+            returnTo,
+            expiresAt: Date.now() + AUTH_STATE_TTL_MS,
+        });
+        const params = new URLSearchParams();
+        params.set("client_id", deps.client.client_id);
+        params.set("redirect_uri", redirectUri);
+        params.set("response_type", "code");
+        params.set("scope", deps.scope);
+        params.set("state", state);
+        params.set("nonce", nonce);
+        params.set("code_challenge", codeChallenge);
+        params.set("code_challenge_method", "S256");
+        const authUrl = new URL(metadata.authorization_endpoint);
+        for (const [key, value] of params.entries()) {
+            authUrl.searchParams.set(key, value);
+        }
+        return context.redirect(authUrl.toString(), 302);
+    });
+    // GET /oidc/callback?code=&state= — the IdP redirects here. Consume the
+    // state, validate the response, exchange the code for tokens (verifying the
+    // ID-token nonce), fetch userinfo, and issue a session cookie for the
+    // configured claim (default email, falling back to `sub`). Any failure
+    // redirects to `/` rather than leaking an error page to the browser.
+    app.get("/oidc/callback", async (context) => {
+        const origin = deps.getOrigin();
+        if (!origin)
+            return context.redirect("/", 302);
+        const callbackUrl = new URL(context.req.url);
+        const state = callbackUrl.searchParams.get("state");
+        if (!state)
+            return context.redirect("/", 302);
+        const stored = deps.stateStore.consume(state);
+        if (!stored)
+            return context.redirect("/", 302);
+        try {
+            const metadata = await deps.getMetadata();
+            const validated = oauth.validateAuthResponse(metadata, deps.client, callbackUrl.searchParams, state);
+            const tokenResponse = await oauth.authorizationCodeGrantRequest(metadata, deps.client, deps.clientAuth, validated, buildRedirectUri(origin), stored.codeVerifier);
+            const tokens = await oauth.processAuthorizationCodeResponse(metadata, deps.client, tokenResponse, {
+                expectedNonce: stored.nonce,
+            });
+            const userInfo = await oauth.processUserInfoResponse(metadata, deps.client, oauth.skipSubjectCheck, await oauth.userInfoRequest(metadata, deps.client, tokens.access_token));
+            const raw = userInfo[deps.claim];
+            const user = (typeof raw === "string" ? raw : userInfo.sub).slice(0, IDENTITY_USER_MAX_LENGTH);
+            setSessionCookie(context, deps.secret, user);
+            return context.redirect(stored.returnTo, 302);
+        }
+        catch {
+            return context.redirect("/", 302);
+        }
+    });
+    app.post("/oidc/logout", (context) => {
+        clearSessionCookie(context);
+        return context.json({ ok: true });
+    });
+    app.get("/oidc/me", (context) => {
+        const identity = readSessionIdentity(context, deps.secret);
+        return context.json({ user: identity?.user ?? null });
+    });
+    return app;
+};
+// The bring-your-own-IdP provider: any OIDC IdP (Google, GitHub, or self-hosted
+// Authentik/Zitadel/Keycloak) authenticates via an authorization-code + PKCE
+// flow; localterm keeps no passwords. Like `passkey`, `identify` reads the
+// signed session cookie the callback issued and `denyUnauthenticated` is true
+// (the gate rejects a no-session request). Discovery is cached lazily and
+// retried on failure; the `redirect_uri` is the daemon's announced origin.
+export const createOidcIdentityProvider = (config, deps) => {
+    const issuerUrl = new URL(config.issuer);
+    const client = { client_id: config.clientId };
+    const clientAuth = config.clientSecret
+        ? oauth.ClientSecretPost(config.clientSecret)
+        : oauth.None();
+    const claim = config.claim ?? "email";
+    const scope = config.scope ?? "openid email";
+    const stateStore = new OidcStateStore();
+    const secret = deps.secret;
+    // Cached OIDC discovery (the IdP's metadata). Resolved once, shared across
+    // flows; reset to null on failure so the next attempt re-discovers rather
+    // than caching a bad result. A single shared promise avoids duplicate
+    // concurrent discoveries.
+    let metadataPromise = null;
+    const getMetadata = () => {
+        if (!metadataPromise) {
+            metadataPromise = (async () => oauth.processDiscoveryResponse(issuerUrl, await oauth.discoveryRequest(issuerUrl)))();
+            metadataPromise.catch(() => {
+                metadataPromise = null;
+            });
+        }
+        return metadataPromise;
+    };
+    return {
+        kind: "oidc",
+        denyUnauthenticated: true,
+        operatorToken: config.operatorToken ?? null,
+        identify: (context) => readSessionIdentity(context, secret),
+        routes: () => buildOidcRoutes({
+            issuerUrl,
+            client,
+            clientAuth,
+            claim,
+            scope,
+            getOrigin: deps.getOrigin,
+            stateStore,
+            secret,
+            getMetadata,
+        }),
+    };
+};
+//# sourceMappingURL=oidc-provider.js.map

package/dist/identity/oidc-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-provider.js","sourceRoot":"","sources":["../../src/identity/oidc-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAO9E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAchG,MAAM,cAAc;IACD,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAEvD,GAAG,CAAC,KAAa,EAAE,KAAgB;QACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAoB,EAAU,EAAE;IAC/D,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAC3E,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAU,EAAE,CAClD,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC;AAcpD,MAAM,eAAe,GAAG,CAAC,IAAmB,EAAQ,EAAE;IACpD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,6EAA6E;IAC7E,uEAAuE;IACvE,uEAAuE;IACvE,yEAAyE;IACzE,4EAA4E;IAC5E,oDAAoD;IACpD,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9D,IAAI,QAA6B,CAAC;QAClC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,CAAC;YACrC,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,0BAA0B,EAAE,CAAC;QACxD,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,0BAA0B,CAAC,YAAY,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE;YACzB,YAAY;YACZ,KAAK;YACL,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB;SAC1C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;QACzD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5C,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,4EAA4E;IAC5E,sEAAsE;IACtE,uEAAuE;IACvE,qEAAqE;IACrE,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK;YAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,oBAAoB,CAC1C,QAAQ,EACR,IAAI,CAAC,MAAM,EACX,WAAW,CAAC,YAAY,EACxB,KAAK,CACN,CAAC;YACF,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,6BAA6B,CAC7D,QAAQ,EACR,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,UAAU,EACf,SAAS,EACT,gBAAgB,CAAC,MAAM,CAAC,EACxB,MAAM,CAAC,YAAY,CACpB,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gCAAgC,CACzD,QAAQ,EACR,IAAI,CAAC,MAAM,EACX,aAAa,EACb;gBACE,aAAa,EAAE,MAAM,CAAC,KAAK;aAC5B,CACF,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,uBAAuB,CAClD,QAAQ,EACR,IAAI,CAAC,MAAM,EACX,KAAK,CAAC,gBAAgB,EACtB,MAAM,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,CACxE,CAAC;YACF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,CAC/D,CAAC,EACD,wBAAwB,CACzB,CAAC;YACF,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC7C,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE;QACnC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3D,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,gFAAgF;AAChF,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,0EAA0E;AAC1E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,MAA0B,EAC1B,IAA0B,EACR,EAAE;IACpB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAAW,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IACtD,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY;QACpC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC;QAC7C,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACjB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,cAAc,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,cAAc,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAE3B,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,0BAA0B;IAC1B,IAAI,eAAe,GAAwC,IAAI,CAAC;IAChE,MAAM,WAAW,GAAG,GAAiC,EAAE;QACrD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE,CAC5B,KAAK,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,KAAK,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE;gBACzB,eAAe,GAAG,IAAI,CAAC;YACzB,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,mBAAmB,EAAE,IAAI;QACzB,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;QAC3C,QAAQ,EAAE,CAAC,OAAgB,EAAmB,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC;QACrF,MAAM,EAAE,GAAG,EAAE,CACX,eAAe,CAAC;YACd,SAAS;YACT,MAAM;YACN,UAAU;YACV,KAAK;YACL,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU;YACV,MAAM;YACN,WAAW;SACZ,CAAC;KACL,CAAC;AACJ,CAAC,CAAC"}

package/dist/identity/passkey-provider.d.ts

@@ -0,0 +1,3 @@
+import type { IdentityProvider, IdentityProviderDeps, PasskeyIdentityConfig } from "./types.js";
+export declare const createPasskeyIdentityProvider: (config: PasskeyIdentityConfig, deps: IdentityProviderDeps) => IdentityProvider;
+//# sourceMappingURL=passkey-provider.d.ts.map

package/dist/identity/passkey-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-provider.d.ts","sourceRoot":"","sources":["../../src/identity/passkey-provider.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAEV,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AA0OpB,eAAO,MAAM,6BAA6B,GACxC,QAAQ,qBAAqB,EAC7B,MAAM,oBAAoB,KACzB,gBAwBF,CAAC"}

package/dist/identity/passkey-provider.js

@@ -0,0 +1,233 @@
+import path from "node:path";
+import { Hono } from "hono";
+import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse, } from "@simplewebauthn/server";
+import { AUTH_CHALLENGE_TTL_MS, HTTP_STATUS_BAD_REQUEST, HTTP_STATUS_FORBIDDEN, IDENTITY_RP_NAME_DEFAULT, IDENTITY_USERNAME_MAX_LENGTH, IDENTITY_USERNAME_MIN_LENGTH, } from "../constants.js";
+import { CredentialStore } from "./credential-store.js";
+import { UserStore } from "./user-store.js";
+import { clearSessionCookie, readSessionIdentity, setSessionCookie } from "./session-cookie.js";
+class ChallengeStore {
+    challenges = new Map();
+    set(challenge, kind) {
+        this.challenges.set(challenge, { kind, expiresAt: Date.now() + AUTH_CHALLENGE_TTL_MS });
+        const now = Date.now();
+        for (const [key, entry] of this.challenges) {
+            if (entry.expiresAt < now)
+                this.challenges.delete(key);
+        }
+    }
+    // Single-use: delete on read, return true only if it matched the expected
+    // kind and hadn't expired. A register challenge can't satisfy a login verify
+    // (and vice versa), and a consumed challenge can't be replayed.
+    consume(challenge, kind) {
+        const entry = this.challenges.get(challenge);
+        this.challenges.delete(challenge);
+        return entry?.kind === kind && entry.expiresAt >= Date.now();
+    }
+}
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const readBody = async (context) => {
+    try {
+        const json = await context.req.json();
+        return isObject(json) ? json : {};
+    }
+    catch {
+        return {};
+    }
+};
+const normalizeUsername = (value) => {
+    if (typeof value !== "string")
+        return null;
+    const trimmed = value.trim();
+    if (trimmed.length < IDENTITY_USERNAME_MIN_LENGTH ||
+        trimmed.length > IDENTITY_USERNAME_MAX_LENGTH) {
+        return null;
+    }
+    return trimmed;
+};
+// The RP origin/id come from the browser's own Origin header (the surface the
+// user is actually on), falling back to the daemon's announced origin. A
+// passkey is bound to the RP ID (hostname), so this is also why a passkey
+// registered on the loopback origin won't work on the tailnet origin and
+// vice-versa — inherent to WebAuthn, surfaced here as expectedOrigin/RPID.
+const resolveRp = (context, getOrigin) => {
+    const raw = context.req.header("origin") || getOrigin();
+    if (!raw)
+        return null;
+    try {
+        const url = new URL(raw);
+        if (!url.hostname)
+            return null;
+        return { origin: url.origin, rpID: url.hostname };
+    }
+    catch {
+        return null;
+    }
+};
+// Quick structural reject for the credential response the browser sends; the
+// real validation is simplewebauthn's verify (which throws on malformed input,
+// caught by the route). The predicate narrows to the library's exact type so
+// no cast is needed at the verify call.
+const isRegistrationResponse = (value) => isObject(value) && typeof value.id === "string" && isObject(value.response);
+const isAuthenticationResponse = (value) => isObject(value) && typeof value.id === "string" && isObject(value.response);
+const buildPasskeyRoutes = (deps) => {
+    const app = new Hono();
+    app.get("/passkey/me", (context) => {
+        const identity = readSessionIdentity(context, deps.secret);
+        return context.json({ user: identity?.user ?? null });
+    });
+    app.post("/passkey/register/options", async (context) => {
+        if (!deps.registrationOpen) {
+            return context.json({ error: "registration_closed" }, HTTP_STATUS_FORBIDDEN);
+        }
+        const body = await readBody(context);
+        const username = normalizeUsername(body.username);
+        if (!username)
+            return context.json({ error: "invalid_username" }, HTTP_STATUS_BAD_REQUEST);
+        const rp = resolveRp(context, deps.getOrigin);
+        if (!rp)
+            return context.json({ error: "invalid_origin" }, HTTP_STATUS_BAD_REQUEST);
+        const excludeCredentials = (deps.userStore.get(username)?.credentialIds ?? []).map((id) => ({
+            id,
+        }));
+        const options = await generateRegistrationOptions({
+            rpName: deps.rpName,
+            rpID: rp.rpID,
+            userName: username,
+            excludeCredentials,
+            authenticatorSelection: { residentKey: "preferred", userVerification: "preferred" },
+        });
+        deps.challenges.set(options.challenge, "register");
+        return context.json(options);
+    });
+    app.post("/passkey/register/verify", async (context) => {
+        if (!deps.registrationOpen) {
+            return context.json({ error: "registration_closed" }, HTTP_STATUS_FORBIDDEN);
+        }
+        const body = await readBody(context);
+        const username = normalizeUsername(body.username);
+        if (!username || !isRegistrationResponse(body.response)) {
+            return context.json({ error: "invalid_body" }, HTTP_STATUS_BAD_REQUEST);
+        }
+        const rp = resolveRp(context, deps.getOrigin);
+        if (!rp)
+            return context.json({ error: "invalid_origin" }, HTTP_STATUS_BAD_REQUEST);
+        const response = body.response;
+        let verified;
+        try {
+            verified = await verifyRegistrationResponse({
+                response,
+                expectedChallenge: (challenge) => deps.challenges.consume(challenge, "register"),
+                expectedOrigin: rp.origin,
+                expectedRPID: rp.rpID,
+                requireUserVerification: true,
+            });
+        }
+        catch {
+            return context.json({ error: "verification_failed" }, HTTP_STATUS_BAD_REQUEST);
+        }
+        if (!verified || !verified.verified || !verified.registrationInfo) {
+            return context.json({ error: "verification_failed" }, HTTP_STATUS_BAD_REQUEST);
+        }
+        const credential = verified.registrationInfo.credential;
+        deps.userStore.findOrCreate(username);
+        deps.userStore.addCredential(username, credential.id);
+        deps.credentialStore.put({
+            id: credential.id,
+            publicKey: Buffer.from(credential.publicKey).toString("base64"),
+            counter: credential.counter,
+            username,
+        });
+        setSessionCookie(context, deps.secret, username);
+        return context.json({ user: username });
+    });
+    app.post("/passkey/login/options", async (context) => {
+        const body = await readBody(context);
+        const username = normalizeUsername(body.username);
+        const rp = resolveRp(context, deps.getOrigin);
+        if (!rp)
+            return context.json({ error: "invalid_origin" }, HTTP_STATUS_BAD_REQUEST);
+        const allowCredentials = username
+            ? (deps.userStore.get(username)?.credentialIds ?? []).map((id) => ({ id }))
+            : undefined;
+        const options = await generateAuthenticationOptions({
+            rpID: rp.rpID,
+            allowCredentials,
+            userVerification: "preferred",
+        });
+        deps.challenges.set(options.challenge, "login");
+        return context.json(options);
+    });
+    app.post("/passkey/login/verify", async (context) => {
+        const body = await readBody(context);
+        if (!isAuthenticationResponse(body.response)) {
+            return context.json({ error: "invalid_body" }, HTTP_STATUS_BAD_REQUEST);
+        }
+        const response = body.response;
+        const rp = resolveRp(context, deps.getOrigin);
+        if (!rp)
+            return context.json({ error: "invalid_origin" }, HTTP_STATUS_BAD_REQUEST);
+        const stored = deps.credentialStore.get(response.id);
+        if (!stored)
+            return context.json({ error: "unknown_credential" }, HTTP_STATUS_BAD_REQUEST);
+        const credential = {
+            id: stored.id,
+            publicKey: Buffer.from(stored.publicKey, "base64"),
+            counter: stored.counter,
+        };
+        let verified;
+        try {
+            verified = await verifyAuthenticationResponse({
+                response,
+                expectedChallenge: (challenge) => deps.challenges.consume(challenge, "login"),
+                expectedOrigin: rp.origin,
+                expectedRPID: rp.rpID,
+                credential,
+                requireUserVerification: true,
+            });
+        }
+        catch {
+            return context.json({ error: "verification_failed" }, HTTP_STATUS_BAD_REQUEST);
+        }
+        if (!verified || !verified.verified) {
+            return context.json({ error: "verification_failed" }, HTTP_STATUS_BAD_REQUEST);
+        }
+        deps.credentialStore.updateCounter(stored.id, verified.authenticationInfo.newCounter);
+        setSessionCookie(context, deps.secret, stored.username);
+        return context.json({ user: stored.username });
+    });
+    app.post("/passkey/logout", (context) => {
+        clearSessionCookie(context);
+        return context.json({ ok: true });
+    });
+    return app;
+};
+// The self-contained identity provider: localterm is the identity authority.
+// `identify` reads the signed session cookie the register/login flow set;
+// `denyUnauthenticated: true` makes the gate reject any request without a
+// valid session (401 / WS policy-violation) — unlike `header`, there's no
+// operator fallback, because there's no external proxy to vouch for one.
+// `routes()` is the `/auth/passkey/*` login flow mounted by the daemon.
+export const createPasskeyIdentityProvider = (config, deps) => {
+    const rpName = config.rpName?.trim() || IDENTITY_RP_NAME_DEFAULT;
+    const registrationOpen = (config.registration ?? "open") === "open";
+    const userStore = new UserStore(path.join(deps.stateDirectory, "users.json"));
+    const credentialStore = new CredentialStore(path.join(deps.stateDirectory, "credentials.json"));
+    const challenges = new ChallengeStore();
+    const secret = deps.secret;
+    return {
+        kind: "passkey",
+        denyUnauthenticated: true,
+        operatorToken: config.operatorToken ?? null,
+        identify: (context) => readSessionIdentity(context, secret),
+        routes: () => buildPasskeyRoutes({
+            rpName,
+            registrationOpen,
+            getOrigin: deps.getOrigin,
+            userStore,
+            credentialStore,
+            challenges,
+            secret,
+        }),
+    };
+};
+//# sourceMappingURL=passkey-provider.js.map

package/dist/identity/passkey-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-provider.js","sourceRoot":"","sources":["../../src/identity/passkey-provider.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,GAM3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAO5C,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAWhG,MAAM,cAAc;IACD,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEhE,GAAG,CAAC,SAAiB,EAAE,IAA0B;QAC/C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,EAAE,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG;gBAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,gEAAgE;IAChE,OAAO,CAAC,SAAiB,EAAE,IAA0B;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAClC,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/D,CAAC;CACF;AAED,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEvE,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAgB,EAAoC,EAAE;IAC5E,IAAI,CAAC;QACH,MAAM,IAAI,GAAY,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC/C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAiB,EAAE;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IACE,OAAO,CAAC,MAAM,GAAG,4BAA4B;QAC7C,OAAO,CAAC,MAAM,GAAG,4BAA4B,EAC7C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF,8EAA8E;AAC9E,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,MAAM,SAAS,GAAG,CAChB,OAAgB,EAChB,SAA8B,EACW,EAAE;IAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,wCAAwC;AACxC,MAAM,sBAAsB,GAAG,CAAC,KAAc,EAAqC,EAAE,CACnF,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAC9E,MAAM,wBAAwB,GAAG,CAAC,KAAc,EAAuC,EAAE,CACvF,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAY9E,MAAM,kBAAkB,GAAG,CAAC,IAAsB,EAAQ,EAAE;IAC1D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE;QACjC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3D,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACtD,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,uBAAuB,CAAC,CAAC;QAC3F,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACnF,MAAM,kBAAkB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1F,EAAE;SACH,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,QAAQ,EAAE,QAAQ;YAClB,kBAAkB;YAClB,sBAAsB,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,EAAE;SACpF,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACnD,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACrD,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxD,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,uBAAuB,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,QAAkD,CAAC;QACvD,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,0BAA0B,CAAC;gBAC1C,QAAQ;gBACR,iBAAiB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC;gBAChF,cAAc,EAAE,EAAE,CAAC,MAAM;gBACzB,YAAY,EAAE,EAAE,CAAC,IAAI;gBACrB,uBAAuB,EAAE,IAAI;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YAClE,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,UAAU,GAAG,QAAQ,CAAC,gBAAgB,CAAC,UAAU,CAAC;QACxD,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;YACvB,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/D,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,QAAQ;SACT,CAAC,CAAC;QACH,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACnD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACnF,MAAM,gBAAgB,GAAG,QAAQ;YAC/B,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAClD,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,gBAAgB;YAChB,gBAAgB,EAAE,WAAW;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAClD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,uBAAuB,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,uBAAuB,CAAC,CAAC;QAC3F,MAAM,UAAU,GAAuB;YACrC,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC;YAClD,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;QACF,IAAI,QAAoD,CAAC;QACzD,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,4BAA4B,CAAC;gBAC5C,QAAQ;gBACR,iBAAiB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;gBAC7E,cAAc,EAAE,EAAE,CAAC,MAAM;gBACzB,YAAY,EAAE,EAAE,CAAC,IAAI;gBACrB,UAAU;gBACV,uBAAuB,EAAE,IAAI;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACpC,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACtF,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxD,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE;QACtC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,6EAA6E;AAC7E,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,MAA6B,EAC7B,IAA0B,EACR,EAAE;IACpB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,wBAAwB,CAAC;IACjE,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,KAAK,MAAM,CAAC;IACpE,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC;IAC9E,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAChG,MAAM,UAAU,GAAG,IAAI,cAAc,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAE3B,OAAO;QACL,IAAI,EAAE,SAAS;QACf,mBAAmB,EAAE,IAAI;QACzB,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;QAC3C,QAAQ,EAAE,CAAC,OAAgB,EAAmB,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC;QACrF,MAAM,EAAE,GAAG,EAAE,CACX,kBAAkB,CAAC;YACjB,MAAM;YACN,gBAAgB;YAChB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS;YACT,eAAe;YACf,UAAU;YACV,MAAM;SACP,CAAC;KACL,CAAC;AACJ,CAAC,CAAC"}

package/dist/identity/proxy-allowlist.d.ts

@@ -0,0 +1,5 @@
+export interface ProxyAllowlist {
+    contains: (ip: string) => boolean;
+}
+export declare const createProxyAllowlist: (spec: string) => ProxyAllowlist;
+//# sourceMappingURL=proxy-allowlist.d.ts.map

package/dist/identity/proxy-allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-allowlist.d.ts","sourceRoot":"","sources":["../../src/identity/proxy-allowlist.ts"],"names":[],"mappings":"AA2BA,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC;CACnC;AAQD,eAAO,MAAM,oBAAoB,GAAI,MAAM,MAAM,KAAG,cA6BnD,CAAC"}

package/dist/identity/proxy-allowlist.js

@@ -0,0 +1,64 @@
+import net from "node:net";
+const IPV4_MAPPED_PREFIX = "::ffff:";
+// net.BlockList checks family-strict, so a dual-stack listener hands us an
+// IPv4-mapped IPv6 address (::ffff:1.2.3.4) that an IPv4 subnet rule would
+// miss. Normalize it back to the v4 form so one allowlist rule covers both.
+const normalizeIp = (ip) => {
+    if (ip.startsWith(IPV4_MAPPED_PREFIX)) {
+        return { address: ip.slice(IPV4_MAPPED_PREFIX.length), family: "ipv4" };
+    }
+    return { address: ip, family: ip.includes(":") ? "ipv6" : "ipv4" };
+};
+const parseCidr = (cidr) => {
+    const slash = cidr.indexOf("/");
+    if (slash === -1)
+        return null;
+    const address = cidr.slice(0, slash);
+    const prefix = Number.parseInt(cidr.slice(slash + 1), 10);
+    if (!Number.isInteger(prefix) || prefix < 0)
+        return null;
+    const family = address.includes(":") ? "ipv6" : "ipv4";
+    if (prefix > (family === "ipv4" ? 32 : 128))
+        return null;
+    return { address, prefix, family };
+};
+// Build a source-IP allowlist for the `header` identity provider. `spec` is one
+// of the shorthands `"loopback"` (127/8, ::1) or `"private"` (RFC1918, CGNAT,
+// link-local, ULA — mirrors the network-policy private check), a CIDR string
+// (`"10.0.0.0/8"`, `"::1/128"`), or a bare address. The provider only honors
+// the identity header when the request's source IP is in this range, so a
+// direct caller forging the header from outside the proxy is ignored.
+export const createProxyAllowlist = (spec) => {
+    const list = new net.BlockList();
+    if (spec === "loopback") {
+        list.addSubnet("127.0.0.0", 8, "ipv4");
+        list.addAddress("::1", "ipv6");
+    }
+    else if (spec === "private") {
+        list.addSubnet("127.0.0.0", 8, "ipv4");
+        list.addSubnet("10.0.0.0", 8, "ipv4");
+        list.addSubnet("172.16.0.0", 12, "ipv4");
+        list.addSubnet("192.168.0.0", 16, "ipv4");
+        list.addSubnet("100.64.0.0", 10, "ipv4");
+        list.addSubnet("169.254.0.0", 16, "ipv4");
+        list.addAddress("::1", "ipv6");
+        list.addSubnet("fc00::", 7, "ipv6");
+        list.addSubnet("fe80::", 10, "ipv6");
+    }
+    else {
+        const cidr = parseCidr(spec);
+        if (cidr) {
+            list.addSubnet(cidr.address, cidr.prefix, cidr.family);
+        }
+        else {
+            list.addAddress(spec, spec.includes(":") ? "ipv6" : "ipv4");
+        }
+    }
+    return {
+        contains: (ip) => {
+            const { address, family } = normalizeIp(ip);
+            return list.check(address, family);
+        },
+    };
+};
+//# sourceMappingURL=proxy-allowlist.js.map

package/dist/identity/proxy-allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-allowlist.js","sourceRoot":"","sources":["../../src/identity/proxy-allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAErC,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,MAAM,WAAW,GAAG,CAAC,EAAU,EAAgD,EAAE;IAC/E,IAAI,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AACrE,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAChB,IAAY,EACyD,EAAE;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IACvD,IAAI,MAAM,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC,CAAC;AAMF,gFAAgF;AAChF,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,0EAA0E;AAC1E,sEAAsE;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAkB,EAAE;IACnE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;IACjC,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,CAAC,EAAU,EAAW,EAAE;YAChC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/identity/resolve.d.ts

@@ -0,0 +1,11 @@
+import type { Context } from "hono";
+import type { MiddlewareHandler } from "hono";
+import type { Identity, IdentityProvider, SessionOwner } from "./types.js";
+export declare const getRequestSourceIp: (context: Context) => string | null;
+export interface IdentityResolver {
+    resolve: (context: Context, sourceIp?: string | null) => Identity | null;
+}
+export declare const createIdentityResolver: (provider: IdentityProvider | null) => IdentityResolver;
+export declare const toSessionOwner: (identity: Identity | null) => SessionOwner;
+export declare const createAuthGateMiddleware: (provider: IdentityProvider | null, resolveIdentity: (context: Context, sourceIp?: string | null) => Identity | null) => MiddlewareHandler;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/identity/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/identity/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAI9C,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAO3E,eAAO,MAAM,kBAAkB,GAAI,SAAS,OAAO,KAAG,MAAM,GAAG,IAO9D,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,KAAK,QAAQ,GAAG,IAAI,CAAC;CAC1E;AASD,eAAO,MAAM,sBAAsB,GAAI,UAAU,gBAAgB,GAAG,IAAI,KAAG,gBAGzE,CAAC;AAEH,eAAO,MAAM,cAAc,GAAI,UAAU,QAAQ,GAAG,IAAI,KAAG,YAC1B,CAAC;AAYlC,eAAO,MAAM,wBAAwB,GAEjC,UAAU,gBAAgB,GAAG,IAAI,EACjC,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,KAAK,QAAQ,GAAG,IAAI,KAC/E,iBAkBF,CAAC"}

package/dist/identity/resolve.js

@@ -0,0 +1,57 @@
+import { getConnInfo } from "@hono/node-server/conninfo";
+import { HTTP_STATUS_UNAUTHORIZED } from "../constants.js";
+import { timingSafeEqualString } from "../utils/timing-safe-equal.js";
+// Best-effort source-IP read for an HTTP (non-WS) request. @hono/node-server's
+// conninfo reads the underlying socket's remoteAddress. Returns null when the
+// adapter doesn't expose it (or the helper throws — never 500 a request over
+// an identity read) so the caller falls back to "untrusted source" and ignores
+// any identity header.
+export const getRequestSourceIp = (context) => {
+    try {
+        const address = getConnInfo(context).remote.address;
+        return typeof address === "string" ? address : null;
+    }
+    catch {
+        return null;
+    }
+};
+// Build the per-request identity resolver. With no provider configured it
+// resolves to `null` for every request — the operator/legacy tier — so every
+// request is the single authority and the registry stays unscoped,
+// byte-identical to the no-auth behavior. Otherwise it delegates to the
+// provider, injecting the caller-resolved source IP: the WS upgrade reads it
+// from the raw socket (more authoritative than conninfo at upgrade time), HTTP
+// routes via conninfo.
+export const createIdentityResolver = (provider) => ({
+    resolve: (context, sourceIp = null) => provider ? provider.identify(context, sourceIp) : null,
+});
+export const toSessionOwner = (identity) => identity ? identity.user : null;
+// The auth gate for providers that own their own login (passkey/oidc): reject a
+// request with no valid session at the door (401) so it never reaches the
+// session registry — unlike `header`, whose no-header case is the operator
+// tier (denyUnauthenticated: false), there's no external proxy to vouch for an
+// unauthenticated caller here, so silence can't mean admin. Exempts
+// `/api/health` (readiness) and everything outside `/api` and `/ws` (the static
+// terminal app + the `/auth` login flow must load before there's a session). A
+// request carrying the daemon's operator bearer token (the CLI) is admitted as
+// the operator tier — full access, no session — since the CLI can't run a
+// WebAuthn/OIDC ceremony.
+export const createAuthGateMiddleware = (provider, resolveIdentity) => async (context, next) => {
+    if (!provider?.denyUnauthenticated)
+        return await next();
+    const requestPath = context.req.path;
+    const isProtected = (requestPath === "/ws" || requestPath.startsWith("/api/")) && requestPath !== "/api/health";
+    if (!isProtected)
+        return await next();
+    const authorization = context.req.header("authorization");
+    if (provider.operatorToken &&
+        authorization &&
+        timingSafeEqualString(authorization, `Bearer ${provider.operatorToken}`)) {
+        return await next();
+    }
+    const identity = resolveIdentity(context, getRequestSourceIp(context));
+    if (!identity)
+        return context.json({ error: "unauthorized" }, HTTP_STATUS_UNAUTHORIZED);
+    await next();
+};
+//# sourceMappingURL=resolve.js.map

package/dist/identity/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/identity/resolve.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAGtE,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,+EAA+E;AAC/E,uBAAuB;AACvB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAgB,EAAiB,EAAE;IACpE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACpD,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAMF,0EAA0E;AAC1E,6EAA6E;AAC7E,mEAAmE;AACnE,wEAAwE;AACxE,6EAA6E;AAC7E,+EAA+E;AAC/E,uBAAuB;AACvB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,QAAiC,EAAoB,EAAE,CAAC,CAAC;IAC9F,OAAO,EAAE,CAAC,OAAgB,EAAE,WAA0B,IAAI,EAAmB,EAAE,CAC7E,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;CACzD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAyB,EAAgB,EAAE,CACxE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAElC,gFAAgF;AAChF,0EAA0E;AAC1E,2EAA2E;AAC3E,+EAA+E;AAC/E,oEAAoE;AACpE,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,0EAA0E;AAC1E,0BAA0B;AAC1B,MAAM,CAAC,MAAM,wBAAwB,GACnC,CACE,QAAiC,EACjC,eAAgF,EAC7D,EAAE,CACvB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtB,IAAI,CAAC,QAAQ,EAAE,mBAAmB;QAAE,OAAO,MAAM,IAAI,EAAE,CAAC;IACxD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IACrC,MAAM,WAAW,GACf,CAAC,WAAW,KAAK,KAAK,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,WAAW,KAAK,aAAa,CAAC;IAC9F,IAAI,CAAC,WAAW;QAAE,OAAO,MAAM,IAAI,EAAE,CAAC;IACtC,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1D,IACE,QAAQ,CAAC,aAAa;QACtB,aAAa;QACb,qBAAqB,CAAC,aAAa,EAAE,UAAU,QAAQ,CAAC,aAAa,EAAE,CAAC,EACxE,CAAC;QACD,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,wBAAwB,CAAC,CAAC;IACxF,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC"}

package/dist/identity/session-cookie.d.ts

@@ -0,0 +1,10 @@
+import type { Context } from "hono";
+import type { Identity } from "./types.js";
+export declare const generateAuthSecret: () => string;
+export declare const loadOrCreateAuthSecret: (filePath: string) => string;
+export declare const signSessionToken: (secret: string, user: string) => string;
+export declare const verifySessionToken: (secret: string, token: string) => string | null;
+export declare const setSessionCookie: (context: Context, secret: string, user: string) => void;
+export declare const clearSessionCookie: (context: Context) => void;
+export declare const readSessionIdentity: (context: Context, secret: string) => Identity | null;
+//# sourceMappingURL=session-cookie.d.ts.map

package/dist/identity/session-cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-cookie.d.ts","sourceRoot":"","sources":["../../src/identity/session-cookie.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGpC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAe3C,eAAO,MAAM,kBAAkB,QAAO,MACgB,CAAC;AAKvD,eAAO,MAAM,sBAAsB,GAAI,UAAU,MAAM,KAAG,MAazD,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,EAAE,MAAM,MAAM,KAAG,MAO/D,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,EAAE,OAAO,MAAM,KAAG,MAAM,GAAG,IAmB3E,CAAC;AAsBF,eAAO,MAAM,gBAAgB,GAAI,SAAS,OAAO,EAAE,QAAQ,MAAM,EAAE,MAAM,MAAM,KAAG,IAOjF,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,SAAS,OAAO,KAAG,IAErD,CAAC;AAEF,eAAO,MAAM,mBAAmB,GAAI,SAAS,OAAO,EAAE,QAAQ,MAAM,KAAG,QAAQ,GAAG,IAKjF,CAAC"}