@noxsoft/anima 2.0.2 → 2.0.4

package/dist/auth-DMPZWzEa.js

@@ -0,0 +1,639 @@
+import { C as isYes, S as isVerbose, w as logVerbose } from "./entry.js";
+import { n as runExec } from "./exec-DDmuVVNq.js";
+import { i as isTrustedProxyAddress, l as resolveGatewayClientIp, o as parseForwardedForClientIp, t as isLoopbackAddress } from "./net-0A_zcaQD.js";
+import { t as safeEqualSecret } from "./secret-equal-DJpmLXlG.js";
+import { stdin, stdout } from "node:process";
+import { existsSync } from "node:fs";
+import readline from "node:readline/promises";
+
+//#region src/cli/prompt.ts
+async function promptYesNo(question, defaultYes = false) {
+	if (isVerbose() && isYes()) return true;
+	if (isYes()) return true;
+	const rl = readline.createInterface({
+		input: stdin,
+		output: stdout
+	});
+	const suffix = defaultYes ? " [Y/n] " : " [y/N] ";
+	const answer = (await rl.question(`${question}${suffix}`)).trim().toLowerCase();
+	rl.close();
+	if (!answer) return defaultYes;
+	return answer.startsWith("y");
+}
+
+//#endregion
+//#region src/infra/tailscale.ts
+function parsePossiblyNoisyJsonObject(stdout) {
+	const trimmed = stdout.trim();
+	const start = trimmed.indexOf("{");
+	const end = trimmed.lastIndexOf("}");
+	if (start >= 0 && end > start) return JSON.parse(trimmed.slice(start, end + 1));
+	return JSON.parse(trimmed);
+}
+/**
+* Locate Tailscale binary using multiple strategies:
+* 1. PATH lookup (via which command)
+* 2. Known macOS app path
+* 3. find /Applications for Tailscale.app
+* 4. locate database (if available)
+*
+* @returns Path to Tailscale binary or null if not found
+*/
+async function findTailscaleBinary() {
+	const checkBinary = async (path) => {
+		if (!path || !existsSync(path)) return false;
+		try {
+			await Promise.race([runExec(path, ["--version"], { timeoutMs: 3e3 }), new Promise((_, reject) => setTimeout(() => reject(/* @__PURE__ */ new Error("timeout")), 3e3))]);
+			return true;
+		} catch {
+			return false;
+		}
+	};
+	try {
+		const { stdout } = await runExec("which", ["tailscale"]);
+		const fromPath = stdout.trim();
+		if (fromPath && await checkBinary(fromPath)) return fromPath;
+	} catch {}
+	const macAppPath = "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
+	if (await checkBinary(macAppPath)) return macAppPath;
+	try {
+		const { stdout } = await runExec("find", [
+			"/Applications",
+			"-maxdepth",
+			"3",
+			"-name",
+			"Tailscale",
+			"-path",
+			"*/Tailscale.app/Contents/MacOS/Tailscale"
+		], { timeoutMs: 5e3 });
+		const found = stdout.trim().split("\n")[0];
+		if (found && await checkBinary(found)) return found;
+	} catch {}
+	try {
+		const { stdout } = await runExec("locate", ["Tailscale.app"]);
+		const candidates = stdout.trim().split("\n").filter((line) => line.includes("/Tailscale.app/Contents/MacOS/Tailscale"));
+		for (const candidate of candidates) if (await checkBinary(candidate)) return candidate;
+	} catch {}
+	return null;
+}
+async function getTailnetHostname(exec = runExec, detectedBinary) {
+	const candidates = detectedBinary ? [detectedBinary] : ["tailscale", "/Applications/Tailscale.app/Contents/MacOS/Tailscale"];
+	let lastError;
+	for (const candidate of candidates) {
+		if (candidate.startsWith("/") && !existsSync(candidate)) continue;
+		try {
+			const { stdout } = await exec(candidate, ["status", "--json"], {
+				timeoutMs: 5e3,
+				maxBuffer: 4e5
+			});
+			const parsed = stdout ? parsePossiblyNoisyJsonObject(stdout) : {};
+			const self = typeof parsed.Self === "object" && parsed.Self !== null ? parsed.Self : void 0;
+			const dns = typeof self?.DNSName === "string" ? self.DNSName : void 0;
+			const ips = Array.isArray(self?.TailscaleIPs) ? parsed.Self.TailscaleIPs ?? [] : [];
+			if (dns && dns.length > 0) return dns.replace(/\.$/, "");
+			if (ips.length > 0) return ips[0];
+			throw new Error("Could not determine Tailscale DNS or IP");
+		} catch (err) {
+			lastError = err;
+		}
+	}
+	throw lastError ?? /* @__PURE__ */ new Error("Could not determine Tailscale DNS or IP");
+}
+/**
+* Get the Tailscale binary command to use.
+* Returns a cached detected binary or the default "tailscale" command.
+*/
+let cachedTailscaleBinary = null;
+async function getTailscaleBinary() {
+	const forcedBinary = process.env.ANIMA_TEST_TAILSCALE_BINARY?.trim();
+	if (forcedBinary) {
+		cachedTailscaleBinary = forcedBinary;
+		return forcedBinary;
+	}
+	if (cachedTailscaleBinary) return cachedTailscaleBinary;
+	cachedTailscaleBinary = await findTailscaleBinary();
+	return cachedTailscaleBinary ?? "tailscale";
+}
+async function readTailscaleStatusJson(exec = runExec, opts) {
+	const { stdout } = await exec(await getTailscaleBinary(), ["status", "--json"], {
+		timeoutMs: opts?.timeoutMs ?? 5e3,
+		maxBuffer: 4e5
+	});
+	return stdout ? parsePossiblyNoisyJsonObject(stdout) : {};
+}
+const whoisCache = /* @__PURE__ */ new Map();
+function extractExecErrorText(err) {
+	const errOutput = err;
+	return {
+		stdout: typeof errOutput.stdout === "string" ? errOutput.stdout : "",
+		stderr: typeof errOutput.stderr === "string" ? errOutput.stderr : "",
+		message: typeof errOutput.message === "string" ? errOutput.message : "",
+		code: typeof errOutput.code === "string" ? errOutput.code : ""
+	};
+}
+function isPermissionDeniedError(err) {
+	const { stdout, stderr, message, code } = extractExecErrorText(err);
+	if (code.toUpperCase() === "EACCES") return true;
+	const combined = `${stdout}\n${stderr}\n${message}`.toLowerCase();
+	return combined.includes("permission denied") || combined.includes("access denied") || combined.includes("operation not permitted") || combined.includes("not permitted") || combined.includes("requires root") || combined.includes("must be run as root") || combined.includes("must be run with sudo") || combined.includes("requires sudo") || combined.includes("need sudo");
+}
+async function execWithSudoFallback(exec, bin, args, opts) {
+	try {
+		return await exec(bin, args, opts);
+	} catch (err) {
+		if (!isPermissionDeniedError(err)) throw err;
+		logVerbose(`Command failed, retrying with sudo: ${bin} ${args.join(" ")}`);
+		try {
+			return await exec("sudo", [
+				"-n",
+				bin,
+				...args
+			], opts);
+		} catch (sudoErr) {
+			const { stderr, message } = extractExecErrorText(sudoErr);
+			const detail = (stderr || message).trim();
+			if (detail) logVerbose(`Sudo retry failed: ${detail}`);
+			throw err;
+		}
+	}
+}
+async function enableTailscaleServe(port, exec = runExec) {
+	await execWithSudoFallback(exec, await getTailscaleBinary(), [
+		"serve",
+		"--bg",
+		"--yes",
+		`${port}`
+	], {
+		maxBuffer: 2e5,
+		timeoutMs: 15e3
+	});
+}
+async function disableTailscaleServe(exec = runExec) {
+	await execWithSudoFallback(exec, await getTailscaleBinary(), ["serve", "reset"], {
+		maxBuffer: 2e5,
+		timeoutMs: 15e3
+	});
+}
+async function enableTailscaleFunnel(port, exec = runExec) {
+	await execWithSudoFallback(exec, await getTailscaleBinary(), [
+		"funnel",
+		"--bg",
+		"--yes",
+		`${port}`
+	], {
+		maxBuffer: 2e5,
+		timeoutMs: 15e3
+	});
+}
+async function disableTailscaleFunnel(exec = runExec) {
+	await execWithSudoFallback(exec, await getTailscaleBinary(), ["funnel", "reset"], {
+		maxBuffer: 2e5,
+		timeoutMs: 15e3
+	});
+}
+function getString(value) {
+	return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function readRecord(value) {
+	return value && typeof value === "object" ? value : null;
+}
+function parseWhoisIdentity(payload) {
+	const userProfile = readRecord(payload.UserProfile) ?? readRecord(payload.userProfile) ?? readRecord(payload.User);
+	const login = getString(userProfile?.LoginName) ?? getString(userProfile?.Login) ?? getString(userProfile?.login) ?? getString(payload.LoginName) ?? getString(payload.login);
+	if (!login) return null;
+	return {
+		login,
+		name: getString(userProfile?.DisplayName) ?? getString(userProfile?.Name) ?? getString(userProfile?.displayName) ?? getString(payload.DisplayName) ?? getString(payload.name)
+	};
+}
+function readCachedWhois(ip, now) {
+	const cached = whoisCache.get(ip);
+	if (!cached) return;
+	if (cached.expiresAt <= now) {
+		whoisCache.delete(ip);
+		return;
+	}
+	return cached.value;
+}
+function writeCachedWhois(ip, value, ttlMs) {
+	whoisCache.set(ip, {
+		value,
+		expiresAt: Date.now() + ttlMs
+	});
+}
+async function readTailscaleWhoisIdentity(ip, exec = runExec, opts) {
+	const normalized = ip.trim();
+	if (!normalized) return null;
+	const cached = readCachedWhois(normalized, Date.now());
+	if (cached !== void 0) return cached;
+	const cacheTtlMs = opts?.cacheTtlMs ?? 6e4;
+	const errorTtlMs = opts?.errorTtlMs ?? 5e3;
+	try {
+		const { stdout } = await exec(await getTailscaleBinary(), [
+			"whois",
+			"--json",
+			normalized
+		], {
+			timeoutMs: opts?.timeoutMs ?? 5e3,
+			maxBuffer: 2e5
+		});
+		const identity = parseWhoisIdentity(stdout ? parsePossiblyNoisyJsonObject(stdout) : {});
+		writeCachedWhois(normalized, identity, cacheTtlMs);
+		return identity;
+	} catch {
+		writeCachedWhois(normalized, null, errorTtlMs);
+		return null;
+	}
+}
+
+//#endregion
+//#region src/gateway/auth-rate-limit.ts
+/**
+* In-memory sliding-window rate limiter for gateway authentication attempts.
+*
+* Tracks failed auth attempts by {scope, clientIp}. A scope lets callers keep
+* independent counters for different credential classes (for example, shared
+* gateway token/password vs device-token auth) while still sharing one
+* limiter instance.
+*
+* Design decisions:
+* - Pure in-memory Map – no external dependencies; suitable for a single
+*   gateway process.  The Map is periodically pruned to avoid unbounded
+*   growth.
+* - Loopback addresses (127.0.0.1 / ::1) are exempt by default so that local
+*   CLI sessions are never locked out.
+* - The module is side-effect-free: callers create an instance via
+*   {@link createAuthRateLimiter} and pass it where needed.
+*/
+const AUTH_RATE_LIMIT_SCOPE_DEFAULT = "default";
+const AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET = "shared-secret";
+const AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN = "device-token";
+const DEFAULT_MAX_ATTEMPTS = 10;
+const DEFAULT_WINDOW_MS = 6e4;
+const DEFAULT_LOCKOUT_MS = 3e5;
+const PRUNE_INTERVAL_MS = 6e4;
+function createAuthRateLimiter(config) {
+	const maxAttempts = config?.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+	const windowMs = config?.windowMs ?? DEFAULT_WINDOW_MS;
+	const lockoutMs = config?.lockoutMs ?? DEFAULT_LOCKOUT_MS;
+	const exemptLoopback = config?.exemptLoopback ?? true;
+	const entries = /* @__PURE__ */ new Map();
+	const pruneTimer = setInterval(() => prune(), PRUNE_INTERVAL_MS);
+	if (pruneTimer.unref) pruneTimer.unref();
+	function normalizeScope(scope) {
+		return (scope ?? AUTH_RATE_LIMIT_SCOPE_DEFAULT).trim() || AUTH_RATE_LIMIT_SCOPE_DEFAULT;
+	}
+	function normalizeIp(ip) {
+		return (ip ?? "").trim() || "unknown";
+	}
+	function resolveKey(rawIp, rawScope) {
+		const ip = normalizeIp(rawIp);
+		return {
+			key: `${normalizeScope(rawScope)}:${ip}`,
+			ip
+		};
+	}
+	function isExempt(ip) {
+		return exemptLoopback && isLoopbackAddress(ip);
+	}
+	function slideWindow(entry, now) {
+		const cutoff = now - windowMs;
+		entry.attempts = entry.attempts.filter((ts) => ts > cutoff);
+	}
+	function check(rawIp, rawScope) {
+		const { key, ip } = resolveKey(rawIp, rawScope);
+		if (isExempt(ip)) return {
+			allowed: true,
+			remaining: maxAttempts,
+			retryAfterMs: 0
+		};
+		const now = Date.now();
+		const entry = entries.get(key);
+		if (!entry) return {
+			allowed: true,
+			remaining: maxAttempts,
+			retryAfterMs: 0
+		};
+		if (entry.lockedUntil && now < entry.lockedUntil) return {
+			allowed: false,
+			remaining: 0,
+			retryAfterMs: entry.lockedUntil - now
+		};
+		if (entry.lockedUntil && now >= entry.lockedUntil) {
+			entry.lockedUntil = void 0;
+			entry.attempts = [];
+		}
+		slideWindow(entry, now);
+		const remaining = Math.max(0, maxAttempts - entry.attempts.length);
+		return {
+			allowed: remaining > 0,
+			remaining,
+			retryAfterMs: 0
+		};
+	}
+	function recordFailure(rawIp, rawScope) {
+		const { key, ip } = resolveKey(rawIp, rawScope);
+		if (isExempt(ip)) return;
+		const now = Date.now();
+		let entry = entries.get(key);
+		if (!entry) {
+			entry = { attempts: [] };
+			entries.set(key, entry);
+		}
+		if (entry.lockedUntil && now < entry.lockedUntil) return;
+		slideWindow(entry, now);
+		entry.attempts.push(now);
+		if (entry.attempts.length >= maxAttempts) entry.lockedUntil = now + lockoutMs;
+	}
+	function reset(rawIp, rawScope) {
+		const { key } = resolveKey(rawIp, rawScope);
+		entries.delete(key);
+	}
+	function prune() {
+		const now = Date.now();
+		for (const [key, entry] of entries) {
+			if (entry.lockedUntil && now < entry.lockedUntil) continue;
+			slideWindow(entry, now);
+			if (entry.attempts.length === 0) entries.delete(key);
+		}
+	}
+	function size() {
+		return entries.size;
+	}
+	function dispose() {
+		clearInterval(pruneTimer);
+		entries.clear();
+	}
+	return {
+		check,
+		recordFailure,
+		reset,
+		size,
+		prune,
+		dispose
+	};
+}
+
+//#endregion
+//#region src/gateway/auth.ts
+function normalizeLogin(login) {
+	return login.trim().toLowerCase();
+}
+function getHostName(hostHeader) {
+	const host = (hostHeader ?? "").trim().toLowerCase();
+	if (!host) return "";
+	if (host.startsWith("[")) {
+		const end = host.indexOf("]");
+		if (end !== -1) return host.slice(1, end);
+	}
+	const [name] = host.split(":");
+	return name ?? "";
+}
+function headerValue(value) {
+	return Array.isArray(value) ? value[0] : value;
+}
+function resolveTailscaleClientIp(req) {
+	if (!req) return;
+	const forwardedFor = headerValue(req.headers?.["x-forwarded-for"]);
+	return forwardedFor ? parseForwardedForClientIp(forwardedFor) : void 0;
+}
+function resolveRequestClientIp(req, trustedProxies) {
+	if (!req) return;
+	return resolveGatewayClientIp({
+		remoteAddr: req.socket?.remoteAddress ?? "",
+		forwardedFor: headerValue(req.headers?.["x-forwarded-for"]),
+		realIp: headerValue(req.headers?.["x-real-ip"]),
+		trustedProxies
+	});
+}
+function isLocalDirectRequest(req, trustedProxies) {
+	if (!req) return false;
+	if (!isLoopbackAddress(resolveRequestClientIp(req, trustedProxies) ?? "")) return false;
+	const host = getHostName(req.headers?.host);
+	const hostIsLocal = host === "localhost" || host === "127.0.0.1" || host === "::1";
+	const hostIsTailscaleServe = host.endsWith(".ts.net");
+	const hasForwarded = Boolean(req.headers?.["x-forwarded-for"] || req.headers?.["x-real-ip"] || req.headers?.["x-forwarded-host"]);
+	const remoteIsTrustedProxy = isTrustedProxyAddress(req.socket?.remoteAddress, trustedProxies);
+	return (hostIsLocal || hostIsTailscaleServe) && (!hasForwarded || remoteIsTrustedProxy);
+}
+function getTailscaleUser(req) {
+	if (!req) return null;
+	const login = req.headers["tailscale-user-login"];
+	if (typeof login !== "string" || !login.trim()) return null;
+	const nameRaw = req.headers["tailscale-user-name"];
+	const profilePic = req.headers["tailscale-user-profile-pic"];
+	const name = typeof nameRaw === "string" && nameRaw.trim() ? nameRaw.trim() : login.trim();
+	return {
+		login: login.trim(),
+		name,
+		profilePic: typeof profilePic === "string" && profilePic.trim() ? profilePic.trim() : void 0
+	};
+}
+function hasTailscaleProxyHeaders(req) {
+	if (!req) return false;
+	return Boolean(req.headers["x-forwarded-for"] && req.headers["x-forwarded-proto"] && req.headers["x-forwarded-host"]);
+}
+function isTailscaleProxyRequest(req) {
+	if (!req) return false;
+	return isLoopbackAddress(req.socket?.remoteAddress) && hasTailscaleProxyHeaders(req);
+}
+async function resolveVerifiedTailscaleUser(params) {
+	const { req, tailscaleWhois } = params;
+	const tailscaleUser = getTailscaleUser(req);
+	if (!tailscaleUser) return {
+		ok: false,
+		reason: "tailscale_user_missing"
+	};
+	if (!isTailscaleProxyRequest(req)) return {
+		ok: false,
+		reason: "tailscale_proxy_missing"
+	};
+	const clientIp = resolveTailscaleClientIp(req);
+	if (!clientIp) return {
+		ok: false,
+		reason: "tailscale_whois_failed"
+	};
+	const whois = await tailscaleWhois(clientIp);
+	if (!whois?.login) return {
+		ok: false,
+		reason: "tailscale_whois_failed"
+	};
+	if (normalizeLogin(whois.login) !== normalizeLogin(tailscaleUser.login)) return {
+		ok: false,
+		reason: "tailscale_user_mismatch"
+	};
+	return {
+		ok: true,
+		user: {
+			login: whois.login,
+			name: whois.name ?? tailscaleUser.name,
+			profilePic: tailscaleUser.profilePic
+		}
+	};
+}
+function resolveGatewayAuth(params) {
+	const authConfig = params.authConfig ?? {};
+	const env = params.env ?? process.env;
+	const token = authConfig.token ?? env.ANIMA_GATEWAY_TOKEN ?? void 0;
+	const password = authConfig.password ?? env.ANIMA_GATEWAY_PASSWORD ?? void 0;
+	const trustedProxy = authConfig.trustedProxy;
+	let mode;
+	if (authConfig.mode) mode = authConfig.mode;
+	else if (password) mode = "password";
+	else if (token) mode = "token";
+	else mode = "none";
+	const allowTailscale = authConfig.allowTailscale ?? (params.tailscaleMode === "serve" && mode !== "password" && mode !== "trusted-proxy");
+	return {
+		mode,
+		token,
+		password,
+		allowTailscale,
+		trustedProxy
+	};
+}
+function assertGatewayAuthConfigured(auth) {
+	if (auth.mode === "token" && !auth.token) {
+		if (auth.allowTailscale) return;
+		throw new Error("gateway auth mode is token, but no token was configured (set gateway.auth.token or ANIMA_GATEWAY_TOKEN)");
+	}
+	if (auth.mode === "password" && !auth.password) throw new Error("gateway auth mode is password, but no password was configured");
+	if (auth.mode === "trusted-proxy") {
+		if (!auth.trustedProxy) throw new Error("gateway auth mode is trusted-proxy, but no trustedProxy config was provided (set gateway.auth.trustedProxy)");
+		if (!auth.trustedProxy.userHeader || auth.trustedProxy.userHeader.trim() === "") throw new Error("gateway auth mode is trusted-proxy, but trustedProxy.userHeader is empty (set gateway.auth.trustedProxy.userHeader)");
+	}
+}
+/**
+* Check if the request came from a trusted proxy and extract user identity.
+* Returns the user identity if valid, or null with a reason if not.
+*/
+function authorizeTrustedProxy(params) {
+	const { req, trustedProxies, trustedProxyConfig } = params;
+	if (!req) return { reason: "trusted_proxy_no_request" };
+	const remoteAddr = req.socket?.remoteAddress;
+	if (!remoteAddr || !isTrustedProxyAddress(remoteAddr, trustedProxies)) return { reason: "trusted_proxy_untrusted_source" };
+	const requiredHeaders = trustedProxyConfig.requiredHeaders ?? [];
+	for (const header of requiredHeaders) {
+		const value = headerValue(req.headers[header.toLowerCase()]);
+		if (!value || value.trim() === "") return { reason: `trusted_proxy_missing_header_${header}` };
+	}
+	const userHeaderValue = headerValue(req.headers[trustedProxyConfig.userHeader.toLowerCase()]);
+	if (!userHeaderValue || userHeaderValue.trim() === "") return { reason: "trusted_proxy_user_missing" };
+	const user = userHeaderValue.trim();
+	const allowUsers = trustedProxyConfig.allowUsers ?? [];
+	if (allowUsers.length > 0 && !allowUsers.includes(user)) return { reason: "trusted_proxy_user_not_allowed" };
+	return { user };
+}
+async function authorizeGatewayConnect(params) {
+	const { auth, connectAuth, req, trustedProxies } = params;
+	const tailscaleWhois = params.tailscaleWhois ?? readTailscaleWhoisIdentity;
+	const localDirect = isLocalDirectRequest(req, trustedProxies);
+	if (auth.mode === "trusted-proxy") {
+		if (!auth.trustedProxy) return {
+			ok: false,
+			reason: "trusted_proxy_config_missing"
+		};
+		if (!trustedProxies || trustedProxies.length === 0) return {
+			ok: false,
+			reason: "trusted_proxy_no_proxies_configured"
+		};
+		const result = authorizeTrustedProxy({
+			req,
+			trustedProxies,
+			trustedProxyConfig: auth.trustedProxy
+		});
+		if ("user" in result) return {
+			ok: true,
+			method: "trusted-proxy",
+			user: result.user
+		};
+		return {
+			ok: false,
+			reason: result.reason
+		};
+	}
+	const limiter = params.rateLimiter;
+	const ip = params.clientIp ?? resolveRequestClientIp(req, trustedProxies) ?? req?.socket?.remoteAddress;
+	const rateLimitScope = params.rateLimitScope ?? AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET;
+	if (limiter) {
+		const rlCheck = limiter.check(ip, rateLimitScope);
+		if (!rlCheck.allowed) return {
+			ok: false,
+			reason: "rate_limited",
+			rateLimited: true,
+			retryAfterMs: rlCheck.retryAfterMs
+		};
+	}
+	if (auth.allowTailscale && !localDirect) {
+		const tailscaleCheck = await resolveVerifiedTailscaleUser({
+			req,
+			tailscaleWhois
+		});
+		if (tailscaleCheck.ok) {
+			limiter?.reset(ip, rateLimitScope);
+			return {
+				ok: true,
+				method: "tailscale",
+				user: tailscaleCheck.user.login
+			};
+		}
+	}
+	if (auth.mode === "token") {
+		if (!auth.token) return {
+			ok: false,
+			reason: "token_missing_config"
+		};
+		if (!connectAuth?.token) {
+			limiter?.recordFailure(ip, rateLimitScope);
+			return {
+				ok: false,
+				reason: "token_missing"
+			};
+		}
+		if (!safeEqualSecret(connectAuth.token, auth.token)) {
+			limiter?.recordFailure(ip, rateLimitScope);
+			return {
+				ok: false,
+				reason: "token_mismatch"
+			};
+		}
+		limiter?.reset(ip, rateLimitScope);
+		return {
+			ok: true,
+			method: "token"
+		};
+	}
+	if (auth.mode === "password") {
+		const password = connectAuth?.password;
+		if (!auth.password) return {
+			ok: false,
+			reason: "password_missing_config"
+		};
+		if (!password) {
+			limiter?.recordFailure(ip, rateLimitScope);
+			return {
+				ok: false,
+				reason: "password_missing"
+			};
+		}
+		if (!safeEqualSecret(password, auth.password)) {
+			limiter?.recordFailure(ip, rateLimitScope);
+			return {
+				ok: false,
+				reason: "password_mismatch"
+			};
+		}
+		limiter?.reset(ip, rateLimitScope);
+		return {
+			ok: true,
+			method: "password"
+		};
+	}
+	limiter?.recordFailure(ip, rateLimitScope);
+	return {
+		ok: false,
+		reason: "unauthorized"
+	};
+}
+
+//#endregion
+export { AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN as a, disableTailscaleFunnel as c, enableTailscaleServe as d, findTailscaleBinary as f, promptYesNo as h, resolveGatewayAuth as i, disableTailscaleServe as l, readTailscaleStatusJson as m, authorizeGatewayConnect as n, AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET as o, getTailnetHostname as p, isLocalDirectRequest as r, createAuthRateLimiter as s, assertGatewayAuthConfigured as t, enableTailscaleFunnel as u };