@omnitron-dev/omnitron 0.1.1

package/dist/services/auth-middleware.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Auth Middleware for Omnitron Daemon RPC
+ *
+ * Creates an invocationWrapper that validates JWT tokens on
+ * non-anonymous endpoints. Integrates with the Netron HTTP
+ * transport's invocationWrapper option.
+ *
+ * Anonymous endpoints (signIn, validateToken, Prometheus scrape,
+ * fleet heartbeat, telemetry push) bypass auth checks.
+ */
+import type { AuthService } from './auth.service.js';
+/**
+ * Check if a service.method combination is anonymous (no auth required).
+ */
+export declare function isAnonymousEndpoint(serviceName: string, methodName: string): boolean;
+export declare class AuthenticationError extends Error {
+    readonly code = "AUTHENTICATION_REQUIRED";
+    readonly statusCode = 401;
+    constructor(message?: string);
+}
+export interface AuthContext {
+    userId: string;
+    sessionId: string;
+    role?: string;
+}
+/**
+ * Creates an invocationWrapper function for the Netron HTTP transport.
+ *
+ * The wrapper intercepts every RPC invocation:
+ * 1. Extracts `serviceName` and `methodName` from metadata (set by Netron HTTP server).
+ * 2. If the endpoint is in ANONYMOUS_ENDPOINTS, calls fn() directly (no auth).
+ * 3. Otherwise, requires a valid Bearer JWT token — validates it via AuthService.
+ * 4. On valid token, injects authContext into metadata for downstream handlers.
+ * 5. On invalid/missing token, throws a 401 error.
+ *
+ * Usage in daemon.ts:
+ * ```typescript
+ * this.app.netron.registerTransportServer('http', {
+ *   name: 'daemon-http',
+ *   options: {
+ *     invocationWrapper: createAuthInvocationWrapper(authService),
+ *   },
+ * });
+ * ```
+ */
+export declare function createAuthInvocationWrapper(authService: AuthService): (metadata: Map<string, unknown>, fn: () => Promise<unknown>) => Promise<unknown>;
+//# sourceMappingURL=auth-middleware.d.ts.map

package/dist/services/auth-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-middleware.d.ts","sourceRoot":"","sources":["../../src/services/auth-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAoCrD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAEpF;AAMD,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,6BAA6B;IAC1C,QAAQ,CAAC,UAAU,OAAO;gBAEd,OAAO,SAA4B;CAIhD;AAMD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,WAAW,GACvB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CA2DlF"}

package/dist/services/auth-middleware.js

@@ -0,0 +1,158 @@
+/**
+ * Auth Middleware for Omnitron Daemon RPC
+ *
+ * Creates an invocationWrapper that validates JWT tokens on
+ * non-anonymous endpoints. Integrates with the Netron HTTP
+ * transport's invocationWrapper option.
+ *
+ * Anonymous endpoints (signIn, validateToken, Prometheus scrape,
+ * fleet heartbeat, telemetry push) bypass auth checks.
+ */
+// =============================================================================
+// Anonymous Endpoint Registry
+// =============================================================================
+/**
+ * Endpoints that do NOT require authentication.
+ * Key format: `ServiceName.methodName`
+ */
+const ANONYMOUS_ENDPOINTS = new Set([
+    // Auth — must be accessible before login
+    'OmnitronAuth.signIn',
+    'OmnitronAuth.validateToken',
+    'OmnitronAuth.refreshSession',
+    'OmnitronAuth.signOut',
+    'OmnitronAuth.validateSession',
+    // Prometheus scraping — external monitoring tools
+    'OmnitronMetrics.getPrometheusMetrics',
+    // Telemetry — follower nodes push without portal auth
+    'OmnitronTelemetry.pushBatch',
+    // Fleet — follower heartbeat uses node-level trust, not user auth
+    'OmnitronFleet.heartbeat',
+    // Cluster — election protocol operates at node level
+    'OmnitronCluster.requestVote',
+    'OmnitronCluster.leaderHeartbeat',
+    'OmnitronCluster.getClusterState',
+    // Daemon ping — CLI connectivity check
+    'OmnitronDaemon.ping',
+]);
+/**
+ * Check if a service.method combination is anonymous (no auth required).
+ */
+export function isAnonymousEndpoint(serviceName, methodName) {
+    return ANONYMOUS_ENDPOINTS.has(`${serviceName}.${methodName}`);
+}
+// =============================================================================
+// Auth Error
+// =============================================================================
+export class AuthenticationError extends Error {
+    code = 'AUTHENTICATION_REQUIRED';
+    statusCode = 401;
+    constructor(message = 'Authentication required') {
+        super(message);
+        this.name = 'AuthenticationError';
+    }
+}
+/**
+ * Creates an invocationWrapper function for the Netron HTTP transport.
+ *
+ * The wrapper intercepts every RPC invocation:
+ * 1. Extracts `serviceName` and `methodName` from metadata (set by Netron HTTP server).
+ * 2. If the endpoint is in ANONYMOUS_ENDPOINTS, calls fn() directly (no auth).
+ * 3. Otherwise, requires a valid Bearer JWT token — validates it via AuthService.
+ * 4. On valid token, injects authContext into metadata for downstream handlers.
+ * 5. On invalid/missing token, throws a 401 error.
+ *
+ * Usage in daemon.ts:
+ * ```typescript
+ * this.app.netron.registerTransportServer('http', {
+ *   name: 'daemon-http',
+ *   options: {
+ *     invocationWrapper: createAuthInvocationWrapper(authService),
+ *   },
+ * });
+ * ```
+ */
+export function createAuthInvocationWrapper(authService) {
+    return async (metadata, fn) => {
+        const serviceName = metadata.get('serviceName') ?? '';
+        const methodName = metadata.get('methodName') ?? '';
+        // Check if this endpoint is anonymous (no auth required)
+        const key = `${serviceName}.${methodName}`;
+        if (ANONYMOUS_ENDPOINTS.has(key)) {
+            // Still try to extract auth context if token is present (best-effort)
+            await tryExtractAuthContext(authService, metadata);
+            return fn();
+        }
+        // For non-anonymous endpoints, require valid authentication
+        const authorization = metadata.get('authorization');
+        if (!authorization?.startsWith('Bearer ')) {
+            const err = new AuthenticationError('Authentication required');
+            throw err;
+        }
+        const token = authorization.slice(7);
+        let result;
+        try {
+            result = await authService.validateToken(token);
+        }
+        catch {
+            result = null;
+        }
+        if (!result) {
+            const err = new AuthenticationError('Invalid or expired token');
+            err.code = 'INVALID_TOKEN';
+            throw err;
+        }
+        // Inject validated auth context
+        const authContext = {
+            userId: result.userId,
+            sessionId: result.sessionId,
+        };
+        // Look up user role for authorization decisions
+        try {
+            const user = await authService.validateSession(result.sessionId);
+            if (user) {
+                authContext.role = user.role;
+            }
+        }
+        catch {
+            // Non-critical — role lookup failure doesn't invalidate auth
+        }
+        metadata.set('authContext', authContext);
+        metadata.set('userId', result.userId);
+        metadata.set('sessionId', result.sessionId);
+        metadata.set('authenticated', true);
+        return fn();
+    };
+}
+// =============================================================================
+// Helper — best-effort auth extraction for anonymous endpoints
+// =============================================================================
+async function tryExtractAuthContext(authService, metadata) {
+    const authorization = metadata.get('authorization');
+    if (!authorization?.startsWith('Bearer '))
+        return;
+    const token = authorization.slice(7);
+    try {
+        const result = await authService.validateToken(token);
+        if (result) {
+            const authContext = {
+                userId: result.userId,
+                sessionId: result.sessionId,
+            };
+            try {
+                const user = await authService.validateSession(result.sessionId);
+                if (user)
+                    authContext.role = user.role;
+            }
+            catch { /* non-critical */ }
+            metadata.set('authContext', authContext);
+            metadata.set('userId', result.userId);
+            metadata.set('sessionId', result.sessionId);
+            metadata.set('authenticated', true);
+        }
+    }
+    catch {
+        // Token invalid on anonymous endpoint — not a problem
+    }
+}
+//# sourceMappingURL=auth-middleware.js.map

package/dist/services/auth-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-middleware.js","sourceRoot":"","sources":["../../src/services/auth-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS;IAC1C,yCAAyC;IACzC,qBAAqB;IACrB,4BAA4B;IAC5B,6BAA6B;IAC7B,sBAAsB;IACtB,8BAA8B;IAE9B,kDAAkD;IAClD,sCAAsC;IAEtC,sDAAsD;IACtD,6BAA6B;IAE7B,kEAAkE;IAClE,yBAAyB;IAEzB,qDAAqD;IACrD,6BAA6B;IAC7B,iCAAiC;IACjC,iCAAiC;IAEjC,uCAAuC;IACvC,qBAAqB;CACtB,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB,EAAE,UAAkB;IACzE,OAAO,mBAAmB,CAAC,GAAG,CAAC,GAAG,WAAW,IAAI,UAAU,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,GAAG,yBAAyB,CAAC;IACjC,UAAU,GAAG,GAAG,CAAC;IAE1B,YAAY,OAAO,GAAG,yBAAyB;QAC7C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAYD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,2BAA2B,CACzC,WAAwB;IAExB,OAAO,KAAK,EAAE,QAA8B,EAAE,EAA0B,EAAoB,EAAE;QAC5F,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAW,IAAI,EAAE,CAAC;QAChE,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAW,IAAI,EAAE,CAAC;QAE9D,yDAAyD;QACzD,MAAM,GAAG,GAAG,GAAG,WAAW,IAAI,UAAU,EAAE,CAAC;QAC3C,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,sEAAsE;YACtE,MAAM,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACnD,OAAO,EAAE,EAAE,CAAC;QACd,CAAC;QAED,4DAA4D;QAC5D,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAuB,CAAC;QAE1E,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,IAAI,mBAAmB,CAAC,yBAAyB,CAAC,CAAC;YAC/D,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,MAAoD,CAAC;QAEzD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,IAAI,mBAAmB,CAAC,0BAA0B,CAAC,CAAC;YAC/D,GAAW,CAAC,IAAI,GAAG,eAAe,CAAC;YACpC,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,gCAAgC;QAChC,MAAM,WAAW,GAAgB;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;QAEF,gDAAgD;QAChD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACjE,IAAI,IAAI,EAAE,CAAC;gBACT,WAAW,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YAC/B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;QAED,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QACzC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5C,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QAEpC,OAAO,EAAE,EAAE,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,+DAA+D;AAC/D,gFAAgF;AAEhF,KAAK,UAAU,qBAAqB,CAClC,WAAwB,EACxB,QAA8B;IAE9B,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAuB,CAAC;IAC1E,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO;IAElD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,WAAW,GAAgB;gBAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;YAEF,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACjE,IAAI,IAAI;oBAAE,WAAW,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;YAE9B,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;YACzC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACtC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5C,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;AACH,CAAC"}

package/dist/services/auth.rpc-service.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Omnitron Auth RPC Service
+ *
+ * Netron RPC endpoints for portal authentication.
+ * Uses titan-auth + netron/auth for JWT validation (standard Titan pattern).
+ *
+ * Auth context flows:
+ *   1. Netron HTTP middleware validates JWT → sets authContext in metadata
+ *   2. invocationWrapper bridges metadata → AsyncLocalStorage
+ *   3. Service methods call getCurrentAuth() / requireAuth()
+ *
+ * @Public({ auth: { allowAnonymous: true } }) = no auth required
+ * @Public({ auth: true }) = auth required (role-based access possible)
+ * @Public() = default (follows configureAuth rules)
+ */
+import type { AuthService, OmnitronSignInResult, OmnitronAuthUser, OmnitronActiveSession } from './auth.service.js';
+export declare class AuthRpcService {
+    private readonly authService;
+    constructor(authService: AuthService);
+    signIn(data: {
+        username: string;
+        password: string;
+        ipAddress?: string;
+        userAgent?: string;
+    }): Promise<OmnitronSignInResult>;
+    validateToken(data: {
+        token: string;
+    }): Promise<{
+        valid: boolean;
+        userId?: string;
+        sessionId?: string;
+    }>;
+    validateSession(data: {
+        sessionId: string;
+    }): Promise<{
+        valid: boolean;
+        user?: OmnitronAuthUser | undefined;
+        session?: {
+            expiresAt: string;
+        } | undefined;
+    }>;
+    refreshSession(data: {
+        sessionId: string;
+    }): Promise<{
+        success: boolean;
+        result?: OmnitronSignInResult;
+    }>;
+    signOut(data: {
+        sessionId: string;
+    }): Promise<{
+        success: boolean;
+    }>;
+    getActiveSessions(): Promise<OmnitronActiveSession[]>;
+    changePassword(data: {
+        oldPassword: string;
+        newPassword: string;
+    }): Promise<{
+        success: boolean;
+    }>;
+}
+//# sourceMappingURL=auth.rpc-service.d.ts.map

package/dist/services/auth.rpc-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.rpc-service.d.ts","sourceRoot":"","sources":["../../src/services/auth.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,KAAK,EACV,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,mBAAmB,CAAC;AAE3B,qBACa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,WAAW;IAO/C,MAAM,CAAC,IAAI,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAK3B,aAAa,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACpD,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IAOI,eAAe,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAC1D,KAAK,EAAE,OAAO,CAAC;QACf,IAAI,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;QACpC,OAAO,CAAC,EAAE;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC;KAC7C,CAAC;IAQI,cAAc,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACzD,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,oBAAoB,CAAC;KAC/B,CAAC;IAOI,OAAO,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAkBnE,iBAAiB,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAOrD,cAAc,CAAC,IAAI,EAAE;QACzB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CAMlC"}

package/dist/services/auth.rpc-service.js

@@ -0,0 +1,131 @@
+/**
+ * Omnitron Auth RPC Service
+ *
+ * Netron RPC endpoints for portal authentication.
+ * Uses titan-auth + netron/auth for JWT validation (standard Titan pattern).
+ *
+ * Auth context flows:
+ *   1. Netron HTTP middleware validates JWT → sets authContext in metadata
+ *   2. invocationWrapper bridges metadata → AsyncLocalStorage
+ *   3. Service methods call getCurrentAuth() / requireAuth()
+ *
+ * @Public({ auth: { allowAnonymous: true } }) = no auth required
+ * @Public({ auth: true }) = auth required (role-based access possible)
+ * @Public() = default (follows configureAuth rules)
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Service, Public } from '@omnitron-dev/titan/decorators';
+import { getCurrentAuth, requireAuth } from './auth-context.js';
+let AuthRpcService = class AuthRpcService {
+    authService;
+    constructor(authService) {
+        this.authService = authService;
+    }
+    // ===========================================================================
+    // Public (anonymous) endpoints — no token required
+    // ===========================================================================
+    async signIn(data) {
+        return this.authService.signIn(data);
+    }
+    async validateToken(data) {
+        const result = await this.authService.validateToken(data.token);
+        if (!result)
+            return { valid: false };
+        return { valid: true, userId: result.userId, sessionId: result.sessionId };
+    }
+    async validateSession(data) {
+        const user = await this.authService.validateSession(data.sessionId);
+        if (!user)
+            return { valid: false };
+        const session = await this.authService.getSessionInfo(data.sessionId);
+        return { valid: true, user, session: session ? { expiresAt: session.expiresAt.toISOString() } : undefined };
+    }
+    async refreshSession(data) {
+        const result = await this.authService.refreshSession(data.sessionId);
+        if (!result)
+            return { success: false };
+        return { success: true, result };
+    }
+    async signOut(data) {
+        // If authenticated, verify session ownership
+        const auth = getCurrentAuth();
+        if (auth) {
+            const sessionOwner = await this.authService.validateSession(data.sessionId);
+            if (sessionOwner && sessionOwner.id !== auth.userId) {
+                throw new Error('Forbidden: cannot revoke another user\'s session');
+            }
+        }
+        await this.authService.signOut(data.sessionId);
+        return { success: true };
+    }
+    // ===========================================================================
+    // Authenticated endpoints — auth context from titan middleware
+    // ===========================================================================
+    async getActiveSessions() {
+        const auth = requireAuth();
+        const sessionId = auth.metadata?.sessionId;
+        return this.authService.getActiveSessions(auth.userId, sessionId);
+    }
+    async changePassword(data) {
+        const auth = requireAuth();
+        const sessionId = auth.metadata?.sessionId;
+        await this.authService.changePassword(auth.userId, data.oldPassword, data.newPassword, sessionId);
+        return { success: true };
+    }
+};
+__decorate([
+    Public({ auth: { allowAnonymous: true } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthRpcService.prototype, "signIn", null);
+__decorate([
+    Public({ auth: { allowAnonymous: true } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthRpcService.prototype, "validateToken", null);
+__decorate([
+    Public({ auth: { allowAnonymous: true } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthRpcService.prototype, "validateSession", null);
+__decorate([
+    Public({ auth: { allowAnonymous: true } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthRpcService.prototype, "refreshSession", null);
+__decorate([
+    Public({ auth: { allowAnonymous: true } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthRpcService.prototype, "signOut", null);
+__decorate([
+    Public({ auth: true }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], AuthRpcService.prototype, "getActiveSessions", null);
+__decorate([
+    Public({ auth: true }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthRpcService.prototype, "changePassword", null);
+AuthRpcService = __decorate([
+    Service({ name: 'OmnitronAuth' }),
+    __metadata("design:paramtypes", [Function])
+], AuthRpcService);
+export { AuthRpcService };
+//# sourceMappingURL=auth.rpc-service.js.map

package/dist/services/auth.rpc-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.rpc-service.js","sourceRoot":"","sources":["../../src/services/auth.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AASzD,IAAM,cAAc,GAApB,MAAM,cAAc;IACI;IAA7B,YAA6B,WAAwB;QAAxB,gBAAW,GAAX,WAAW,CAAa;IAAG,CAAC;IAEzD,8EAA8E;IAC9E,mDAAmD;IACnD,8EAA8E;IAGxE,AAAN,KAAK,CAAC,MAAM,CAAC,IAKZ;QACC,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAGK,AAAN,KAAK,CAAC,aAAa,CAAC,IAAuB;QAKzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IAC7E,CAAC;IAGK,AAAN,KAAK,CAAC,eAAe,CAAC,IAA2B;QAK/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC9G,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc,CAAC,IAA2B;QAI9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAC,IAA2B;QACvC,6CAA6C;QAC7C,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC5E,IAAI,YAAY,IAAI,YAAY,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,8EAA8E;IAC9E,+DAA+D;IAC/D,8EAA8E;IAGxE,AAAN,KAAK,CAAC,iBAAiB;QACrB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAI,IAAI,CAAC,QAAgB,EAAE,SAAS,CAAC;QACpD,OAAO,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpE,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc,CAAC,IAGpB;QACC,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAI,IAAI,CAAC,QAAgB,EAAE,SAAS,CAAC;QACpD,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAClG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AA7EO;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;4CAQ1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;mDAS1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;qDAU1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;oDAQ1C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;;;;6CAY1C;AAOK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;;;uDAKtB;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;;;oDAStB;AApFU,cAAc;IAD1B,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;;GACrB,cAAc,CAqF1B"}

package/dist/services/auth.service.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Omnitron Auth Service
+ *
+ * Portal authentication for the Omnitron webapp. Handles user sign-in,
+ * session lifecycle, JWT issuance, and password management.
+ *
+ * Uses Kysely directly against omnitron-pg (port 5480).
+ * Password hashing via Node's native crypto.scrypt (zero external deps).
+ * JWT via jose (HS256), already a Titan dependency.
+ */
+import type { Kysely } from 'kysely';
+import type { OmnitronDatabase } from '../database/schema.js';
+export interface OmnitronSignInRequest {
+    username: string;
+    password: string;
+    ipAddress?: string;
+    userAgent?: string;
+}
+export interface OmnitronSignInResult {
+    user: OmnitronAuthUser;
+    session: OmnitronSessionInfo;
+    accessToken: string;
+}
+export interface OmnitronAuthUser {
+    id: string;
+    username: string;
+    displayName: string | null;
+    role: string;
+    totpEnabled: boolean;
+    pgpEnabled: boolean;
+}
+export interface OmnitronSessionInfo {
+    id: string;
+    expiresAt: Date;
+}
+export interface OmnitronActiveSession {
+    id: string;
+    ipAddress: string | null;
+    userAgent: string | null;
+    createdAt: Date;
+    expiresAt: Date;
+    current: boolean;
+}
+export declare class AuthService {
+    private readonly db;
+    private readonly jwtSecret;
+    constructor(db: Kysely<OmnitronDatabase>, jwtSecret?: string);
+    signIn(request: OmnitronSignInRequest): Promise<OmnitronSignInResult>;
+    signOut(sessionId: string): Promise<void>;
+    validateSession(sessionId: string): Promise<OmnitronAuthUser | null>;
+    /**
+     * Get session info (expiry) without full user validation.
+     */
+    getSessionInfo(sessionId: string): Promise<{
+        expiresAt: Date;
+    } | null>;
+    validateToken(token: string): Promise<{
+        userId: string;
+        sessionId: string;
+    } | null>;
+    getActiveSessions(userId: string, currentSessionId?: string): Promise<OmnitronActiveSession[]>;
+    refreshSession(sessionId: string): Promise<OmnitronSignInResult | null>;
+    changePassword(userId: string, oldPassword: string, newPassword: string, currentSessionId?: string): Promise<void>;
+    hashPassword(password: string): Promise<string>;
+    verifyPassword(password: string, hash: string): Promise<boolean>;
+    private issueToken;
+    /** Remove all expired sessions — call periodically */
+    cleanupExpiredSessions(): Promise<number>;
+}
+//# sourceMappingURL=auth.service.d.ts.map

package/dist/services/auth.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../src/services/auth.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAQ9D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAeD,qBAAa,WAAW;IAIpB,OAAO,CAAC,QAAQ,CAAC,EAAE;IAHrB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAa;gBAGpB,EAAE,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAC7C,SAAS,CAAC,EAAE,MAAM;IAWd,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA8DrE,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWzC,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAqC1E;;OAEG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAetE,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAiCnF,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAuB9F,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAoDvE,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoClH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAM/C,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;YAexD,UAAU;IAcxB,sDAAsD;IAChD,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC;CAQhD"}