@openparachute/hub 0.7.3 → 0.7.4-rc.10

package/src/api-account-2fa.ts

@@ -0,0 +1,373 @@
+/**
+ * `/api/account/*` — JSON self-service account surfaces for the admin SPA
+ * (hub#85). The server-rendered `/account/2fa` + `/account/change-password`
+ * pages stay (they work without JS, the friend-facing path); these are the
+ * JSON twins the in-`/admin` SPA "My account" page drives.
+ *
+ *   POST /api/account/2fa/start    → mint a fresh secret + QR + otpauth URL
+ *                                     (NOT persisted — confirm seals it)
+ *   POST /api/account/2fa/confirm  → verify a live code vs the in-flight
+ *                                     secret, persist enrollment, return the
+ *                                     backup codes ONCE
+ *   POST /api/account/2fa/disable  → verify current password, clear 2FA
+ *   POST /api/account/password     → verify current, set new (+ revoke the
+ *                                     user's still-active tokens)
+ *
+ * Auth posture: every endpoint is **self-service** — it acts on the
+ * SIGNED-IN user's OWN account (`session.userId`), never a client-supplied
+ * user id. ANY authenticated user reaches them (the owner / first-admin is
+ * NOT special — same path, no privilege bypass). This is deliberately the
+ * `/api/admin-lock` cookie+CSRF posture, NOT the host-admin Bearer posture:
+ * a user managing their own credentials shouldn't need (or have) the
+ * `parachute:host:admin` scope. Order on every POST:
+ *
+ *   1. Session cookie (else 401).
+ *   2. CSRF double-submit `__csrf` in the JSON body (else 403). Same-origin
+ *      belt is applied by the hub-server dispatcher before this runs.
+ *   3. Per-action validation.
+ *
+ * The crypto + persistence is REUSED, never duplicated: secret generation +
+ * code verification live in `totp.ts`; enrollment storage lives in
+ * `two-factor-store.ts`; password validation + hashing live in `users.ts`.
+ * This file is the JSON wire layer only.
+ *
+ * In-flight-secret model (mirrors the server-rendered flow): `start` returns
+ * the secret, the SPA holds it client-side, and `confirm` sends it back with
+ * the live code. Nothing is persisted until `confirm` verifies — an abandoned
+ * setup leaves zero state.
+ */
+import type { Database } from "bun:sqlite";
+import { hash as argonHash } from "@node-rs/argon2";
+import QRCode from "qrcode";
+import { verifyCsrfToken } from "./csrf.ts";
+import { changePasswordRateLimiter } from "./rate-limit.ts";
+import { findActiveSession } from "./sessions.ts";
+import { generateTotpSecret, otpauthUrlFor, verifyTotpCode } from "./totp.ts";
+import {
+  clearEnrollment,
+  getTotpState,
+  isTotpEnrolled,
+  persistEnrollment,
+} from "./two-factor-store.ts";
+import {
+  PASSWORD_MAX_LEN,
+  type User,
+  UserNotFoundError,
+  getUserById,
+  validatePassword,
+  verifyPassword,
+} from "./users.ts";
+
+export interface ApiAccount2faDeps {
+  db: Database;
+  /** Test seam — defaults to the real clock. */
+  now?: () => Date;
+}
+
+function json(status: number, body: unknown, extra: Record<string, string> = {}): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json", "cache-control": "no-store", ...extra },
+  });
+}
+
+function jsonError(status: number, error: string, description: string): Response {
+  return json(status, { error, error_description: description });
+}
+
+/** Resolve the signed-in user, or an error Response (401). Self-only — no id from the client. */
+function requireUser(
+  db: Database,
+  req: Request,
+): { ok: true; user: User } | { ok: false; res: Response } {
+  const session = findActiveSession(db, req);
+  if (!session) {
+    return {
+      ok: false,
+      res: jsonError(401, "unauthenticated", "no session — sign in at /login first"),
+    };
+  }
+  const user = getUserById(db, session.userId);
+  if (!user) {
+    return {
+      ok: false,
+      res: jsonError(401, "unauthenticated", "signed-in account no longer exists"),
+    };
+  }
+  return { ok: true, user };
+}
+
+async function readJsonBody(req: Request): Promise<Record<string, unknown>> {
+  try {
+    const body = (await req.json()) as unknown;
+    return body && typeof body === "object" ? (body as Record<string, unknown>) : {};
+  } catch {
+    return {};
+  }
+}
+
+function checkCsrf(req: Request, body: Record<string, unknown>): boolean {
+  const token = typeof body.__csrf === "string" ? body.__csrf : null;
+  return verifyCsrfToken(req, token);
+}
+
+/**
+ * Gate the password-verifying endpoints (`/password`, `/2fa/disable`) before the
+ * argon2id `verifyPassword` call — a session-hijack attacker shouldn't get an
+ * unbounded grind window against the hash. Keyed by `user.id` (identity is
+ * already established by the session) and shares the `changePasswordRateLimiter`
+ * bucket (3 attempts / 5 min) with the server-rendered change-password POST, so
+ * a single user's argon2id budget is uniform across both surfaces. Returns a 429
+ * Response when the bucket is exhausted, else null. Fires AFTER CSRF so a junk
+ * cross-site POST can't burn the victim's bucket slot.
+ */
+function passwordRateLimit(userId: string, now: () => Date): Response | null {
+  const gate = changePasswordRateLimiter.checkAndRecord(userId, now());
+  if (gate.allowed) return null;
+  const retryAfter = gate.retryAfterSeconds ?? 1;
+  return json(
+    429,
+    {
+      error: "too_many_attempts",
+      error_description: `Too many attempts. Try again in ${retryAfter} seconds.`,
+    },
+    { "retry-after": String(retryAfter) },
+  );
+}
+
+/**
+ * Router for `/api/account/*`. `subpath` is the path AFTER `/api/account`
+ * (e.g. "/2fa/start", "/password"). The hub-server dispatcher slices it.
+ *
+ * Every route here is a POST (state-changing); the read-side 2FA status the
+ * SPA renders comes from `/api/me`'s `two_factor_enabled` field, so there's
+ * no GET on this surface.
+ */
+export async function handleApiAccount(
+  req: Request,
+  subpath: string,
+  deps: ApiAccount2faDeps,
+): Promise<Response> {
+  if (req.method !== "POST") return jsonError(405, "method_not_allowed", "use POST");
+
+  const gate = requireUser(deps.db, req);
+  if (!gate.ok) return gate.res;
+  const user = gate.user;
+
+  const body = await readJsonBody(req);
+  if (!checkCsrf(req, body)) {
+    return jsonError(403, "csrf_failed", "missing or invalid CSRF token");
+  }
+
+  switch (subpath) {
+    case "/2fa/start":
+      return handleStart(deps.db, user);
+    case "/2fa/confirm":
+      return handleConfirm(deps, user, body);
+    case "/2fa/disable":
+      return handleDisable(deps, user, body);
+    case "/password":
+      return handlePassword(deps, user, body);
+    default:
+      return jsonError(404, "not_found", `no account route at /api/account${subpath}`);
+  }
+}
+
+/**
+ * POST /api/account/2fa/start — mint a fresh secret + provisioning artifacts.
+ * Refuses if already enrolled (disable first to re-enroll) — same guard as
+ * the server-rendered `start`. The secret is NOT persisted; the SPA holds it
+ * and round-trips it back on confirm.
+ */
+async function handleStart(db: Database, user: User): Promise<Response> {
+  if (isTotpEnrolled(db, user.id)) {
+    return jsonError(
+      409,
+      "already_enrolled",
+      "Two-factor is already enabled. Turn it off first to re-enroll.",
+    );
+  }
+  const { secret, otpauthUrl } = generateTotpSecret(user.username);
+  // PNG data-URL QR (margin:1 for scanner-friendly quiet zone). The repo
+  // already depends on `qrcode`; returning a data-URL lets the SPA render a
+  // plain <img> with no new client dependency, and the otpauth URL is
+  // returned alongside for manual-entry / copy affordances.
+  const qrDataUrl = await QRCode.toDataURL(otpauthUrl, { margin: 1, errorCorrectionLevel: "M" });
+  return json(200, { secret, otpauth_url: otpauthUrl, qr_data_url: qrDataUrl });
+}
+
+/** base32 alphabet (A–Z, 2–7) + optional `=` padding, ≥16 chars. Same N1 guard as the HTML flow. */
+function isPlausibleBase32Secret(secret: string): boolean {
+  return /^[A-Z2-7]+=*$/i.test(secret) && secret.length >= 16;
+}
+
+/**
+ * POST /api/account/2fa/confirm {secret, code} — verify the live code vs the
+ * in-flight secret, persist enrollment, return the backup codes ONCE.
+ */
+async function handleConfirm(
+  deps: ApiAccount2faDeps,
+  user: User,
+  body: Record<string, unknown>,
+): Promise<Response> {
+  const secret = typeof body.secret === "string" ? body.secret : "";
+  const code = typeof body.code === "string" ? body.code : "";
+
+  if (!secret || !isPlausibleBase32Secret(secret)) {
+    return jsonError(400, "setup_expired", "Setup expired or malformed. Start again.");
+  }
+  // Defensive — a confirm POST against an already-enrolled account.
+  if (isTotpEnrolled(deps.db, user.id)) {
+    return jsonError(409, "already_enrolled", "Two-factor is already enabled.");
+  }
+  if (!verifyTotpCode(secret, code)) {
+    return jsonError(
+      400,
+      "invalid_code",
+      "That code didn't match. Check your device clock and try the current code.",
+    );
+  }
+  const result = await persistEnrollment(deps.db, user.id, secret, deps.now ?? (() => new Date()));
+  // Backup codes are shown ONCE — no-store so the response is never cached.
+  return json(200, {
+    enrolled: true,
+    enrolled_at: result.enrolledAt,
+    backup_codes: result.backupCodes,
+  });
+}
+
+/**
+ * POST /api/account/2fa/disable {password} — verify the current password,
+ * clear 2FA. Password-gated (same safety as the HTML flow): disabling a
+ * second factor with only a session cookie would let a hijacked session
+ * strip the very protection that defends the account.
+ */
+async function handleDisable(
+  deps: ApiAccount2faDeps,
+  user: User,
+  body: Record<string, unknown>,
+): Promise<Response> {
+  const db = deps.db;
+  if (!isTotpEnrolled(db, user.id)) {
+    // Idempotent — already off.
+    return json(200, { enrolled: false });
+  }
+  const password = typeof body.password === "string" ? body.password : "";
+  if (!password) {
+    return jsonError(
+      400,
+      "password_required",
+      "Enter your current password to turn off two-factor.",
+    );
+  }
+  // Cap before argon2id verify (CPU-DoS guard — same posture as /login).
+  if (password.length > PASSWORD_MAX_LEN) {
+    return jsonError(
+      413,
+      "password_too_long",
+      `Password must be ≤ ${PASSWORD_MAX_LEN} characters.`,
+    );
+  }
+  // Rate-limit before the argon2id verify (a stolen session shouldn't grind).
+  const limited = passwordRateLimit(user.id, deps.now ?? (() => new Date()));
+  if (limited) return limited;
+  const ok = await verifyPassword(user, password);
+  if (!ok) {
+    return jsonError(401, "invalid_credentials", "That password is incorrect.");
+  }
+  clearEnrollment(db, user.id);
+  return json(200, { enrolled: false });
+}
+
+/**
+ * POST /api/account/password {current_password, new_password} — JSON twin of
+ * the server-rendered `/account/change-password` POST. Same validation +
+ * atomic hash-write-and-revoke-tokens as `api-account.ts`, reusing the same
+ * `users.ts` validators. Self-only (the signed-in user's own hash).
+ *
+ * Check order mirrors the HTML handler:
+ *   1. fields present (400)
+ *   2. current too long → 413 (before argon2id verify)
+ *   3. new too long → 413 (before argon2id hash)
+ *   4. validatePassword(new) → 400
+ *   5. rate-limit (429, before the argon2id verify — same as the HTML twin)
+ *   6. verifyPassword(current) → 401
+ *   7. new === current → 400 (after verify — see api-account.ts rationale)
+ *   8. hash new + UPDATE + revoke tokens (one tx)
+ */
+async function handlePassword(
+  deps: ApiAccount2faDeps,
+  user: User,
+  body: Record<string, unknown>,
+): Promise<Response> {
+  const currentPassword = typeof body.current_password === "string" ? body.current_password : "";
+  const newPassword = typeof body.new_password === "string" ? body.new_password : "";
+
+  if (!currentPassword || !newPassword) {
+    return jsonError(400, "missing_fields", "current_password and new_password are required.");
+  }
+  if (currentPassword.length > PASSWORD_MAX_LEN) {
+    return jsonError(
+      413,
+      "password_too_long",
+      `Current password must be ≤ ${PASSWORD_MAX_LEN} characters.`,
+    );
+  }
+  if (newPassword.length > PASSWORD_MAX_LEN) {
+    return jsonError(
+      413,
+      "password_too_long",
+      `New password must be ≤ ${PASSWORD_MAX_LEN} characters.`,
+    );
+  }
+  if (!validatePassword(newPassword).valid) {
+    return jsonError(
+      400,
+      "invalid_password",
+      "New password must be at least 12 characters (a passphrase is fine).",
+    );
+  }
+  // Rate-limit before the argon2id verify (a stolen session shouldn't grind
+  // the current-password check). Shares the bucket with the HTML twin + the
+  // disable endpoint — uniform per-user argon2id budget.
+  const limited = passwordRateLimit(user.id, deps.now ?? (() => new Date()));
+  if (limited) return limited;
+  const currentOk = await verifyPassword(user, currentPassword);
+  if (!currentOk) {
+    return jsonError(401, "invalid_credentials", "Current password is incorrect.");
+  }
+  if (newPassword === currentPassword) {
+    return jsonError(
+      400,
+      "password_unchanged",
+      "New password must differ from your current password.",
+    );
+  }
+
+  // Hash OUTSIDE the transaction — argon2id is async and bun:sqlite's
+  // `db.transaction()` is sync; an async closure silently breaks atomicity
+  // (same constraint api-account.ts documents). Then write the hash, flip
+  // `password_changed`, and revoke the user's still-active tokens in one tx.
+  const now = deps.now ?? (() => new Date());
+  const passwordHash = await argonHash(newPassword);
+  const stamp = now().toISOString();
+  try {
+    deps.db.transaction(() => {
+      const result = deps.db
+        .prepare(
+          "UPDATE users SET password_hash = ?, password_changed = 1, updated_at = ? WHERE id = ?",
+        )
+        .run(passwordHash, stamp, user.id);
+      if (result.changes === 0) throw new UserNotFoundError(user.id);
+      deps.db
+        .prepare("UPDATE tokens SET revoked_at = ? WHERE user_id = ? AND revoked_at IS NULL")
+        .run(stamp, user.id);
+    })();
+  } catch (err) {
+    if (err instanceof UserNotFoundError) {
+      return jsonError(401, "unauthenticated", "The signed-in account no longer exists.");
+    }
+    throw err;
+  }
+  return json(200, { ok: true });
+}

package/src/api-hub-upgrade.ts

@@ -67,6 +67,34 @@ export const HUB_UPGRADE_REQUIRED_SCOPE = "parachute:host:admin";
  */
 const IN_FLIGHT_PHASES = new Set<HubUpgradeStatus["phase"]>(["pending", "running", "restarting"]);
 
+/**
+ * #506: TTL for the 409 in-flight guard. The status file is single-slot, and a
+ * helper that CRASHES (OOM, killed mid-rewrite, host reboot) never reaches a
+ * terminal phase — leaving the slot stuck in `pending`/`running`/`restarting`
+ * FOREVER and 409-deadlocking every future upgrade. So: an in-flight slot whose
+ * `started_at` is older than this bound is treated as ABANDONED and the new
+ * request proceeds (overwriting the stale slot).
+ *
+ * 15 minutes — comfortably past the longest expected in-place upgrade (an
+ * `npm view` + `bun add -g` rewrite + restart is seconds-to-low-minutes even on
+ * a slow box / cold cache). A live upgrade finishing under the bound is never
+ * mistaken for abandoned; a crashed one frees the slot within 15 min instead of
+ * never. (A missing/garbage `started_at` is treated as stale → not 409, so a
+ * malformed file can't deadlock either.)
+ */
+const IN_FLIGHT_TTL_MS = 15 * 60 * 1000;
+
+/**
+ * Is an in-flight slot still FRESH (within the TTL), so a second POST must be
+ * rejected 409? An unparseable / missing `started_at` is treated as stale
+ * (not fresh) so a malformed file frees the slot rather than deadlocking it.
+ */
+function isInFlightFresh(existing: HubUpgradeStatus, now: Date): boolean {
+  const startedMs = Date.parse(existing.started_at);
+  if (Number.isNaN(startedMs)) return false;
+  return now.getTime() - startedMs < IN_FLIGHT_TTL_MS;
+}
+
 export interface SpawnHelperArgs {
   operationId: string;
   channel: "rc" | "latest";
@@ -213,7 +241,9 @@ export async function handleHubUpgrade(req: Request, deps: ApiHubUpgradeDeps): P
   const parsed = await parseBody(req);
   if (parsed instanceof Response) return parsed;
 
-  // ── 409 in-flight guard ────────────────────────────────────────────────────
+  const now = (deps.now ?? (() => new Date()))();
+
+  // ── 409 in-flight guard (TTL-bounded) ──────────────────────────────────────
   // The status file is single-slot (one hub, one upgrade). If a prior upgrade
   // is still in a non-terminal phase (pending/running/restarting), starting a
   // SECOND would overwrite its operation_id — and a still-running first helper
@@ -222,9 +252,15 @@ export async function handleHubUpgrade(req: Request, deps: ApiHubUpgradeDeps): P
   // server-side too (a second tab, a stale page, a scripted POST). Reject with
   // 409 unless the slot is free (no file) or the prior op reached a terminal
   // phase (failed / redeploy-required / succeeded).
+  //
+  // #506: BUT a non-terminal slot is only a real block while it's FRESH. A
+  // helper that crashed (OOM / killed / host reboot) leaves the slot stuck
+  // in-flight forever and would 409-deadlock every future upgrade. So an
+  // in-flight slot older than IN_FLIGHT_TTL_MS is treated as ABANDONED and the
+  // request proceeds (the seeded status below overwrites the stale slot).
   const readStatus = deps.readStatus ?? readHubUpgradeStatus;
   const existing = readStatus(deps.configDir);
-  if (existing && IN_FLIGHT_PHASES.has(existing.phase)) {
+  if (existing && IN_FLIGHT_PHASES.has(existing.phase) && isInFlightFresh(existing, now)) {
     return jsonError(
       409,
       "upgrade_in_flight",
@@ -234,7 +270,6 @@ export async function handleHubUpgrade(req: Request, deps: ApiHubUpgradeDeps): P
 
   const hubSrcDir = deps.hubSrcDir ?? dirname(fileURLToPath(import.meta.url));
   const env = deps.env ?? process.env;
-  const now = (deps.now ?? (() => new Date()))();
 
   const currentVersion = (deps.currentVersion ?? (() => defaultCurrentVersion(hubSrcDir)))();
   // Auto-detect the channel from the current version when not explicitly set —

package/src/api-me.ts

@@ -14,7 +14,12 @@
  * Response shape:
  *
  *   { hasSession: false }
- *   { hasSession: true, user: { id, displayName }, csrf: "<token>" }
+ *   { hasSession: true, user: { id, displayName }, csrf: "<token>",
+ *     two_factor_enabled: boolean }
+ *
+ * `two_factor_enabled` (hub#85) lets the SPA's "My account" page render the
+ * 2FA status without a separate read. It reflects `users.totp_secret` being
+ * set for the signed-in user.
  *
  * `displayName` is the user's `username` today — there's no separate
  * display-name field on the User shape. Surfaced under a different key
@@ -39,6 +44,7 @@
 import type { Database } from "bun:sqlite";
 import { ensureCsrfToken } from "./csrf.ts";
 import { findActiveSession } from "./sessions.ts";
+import { isTotpEnrolled } from "./two-factor-store.ts";
 import { getUserById } from "./users.ts";
 
 export interface ApiMeDeps {
@@ -59,7 +65,9 @@ interface SignedInUser {
  * that mixes states — e.g. `{ hasSession: false, user: staleUser }`
  * fails at the type-check, not just at code-review.
  */
-type ApiMeResponse = { hasSession: false } | { hasSession: true; user: SignedInUser; csrf: string };
+type ApiMeResponse =
+  | { hasSession: false }
+  | { hasSession: true; user: SignedInUser; csrf: string; two_factor_enabled: boolean };
 
 export function handleApiMe(req: Request, deps: ApiMeDeps): Response {
   if (req.method !== "GET") {
@@ -99,6 +107,7 @@ export function handleApiMe(req: Request, deps: ApiMeDeps): Response {
       displayName: user.username,
     },
     csrf: csrf.token,
+    two_factor_enabled: isTotpEnrolled(deps.db, user.id),
   };
   return new Response(JSON.stringify(body), { status: 200, headers });
 }

package/src/cli.ts

@@ -402,23 +402,63 @@ async function main(argv: string[]): Promise<number> {
         );
         return 1;
       }
-      const noBrowser = exposeExtract.rest.includes("--no-browser");
-      const noExposePrompt = exposeExtract.rest.includes("--no-expose-prompt");
-      const cliWizard = exposeExtract.rest.includes("--cli-wizard");
-      const browserWizard = exposeExtract.rest.includes("--browser-wizard");
+      // hub#694 bug 2: `--channel rc|latest` picks the dist-tag init installs the
+      // vault module from. Without it, init always resolved @latest — DOWNGRADING
+      // vault below an rc-tracking hub. Mirrors `parachute install --channel`.
+      const channelExtract = extractNamedFlag(exposeExtract.rest, "--channel");
+      if (channelExtract.error) {
+        console.error(`parachute init: ${channelExtract.error}`);
+        return 1;
+      }
+      if (
+        channelExtract.value !== undefined &&
+        channelExtract.value !== "rc" &&
+        channelExtract.value !== "latest"
+      ) {
+        console.error(
+          `parachute init: --channel must be "rc" or "latest" (got "${channelExtract.value}")`,
+        );
+        return 1;
+      }
+      // #478 Part 2: --vault-name <name> creates the first vault in one shot.
+      const vaultNameExtract = extractNamedFlag(channelExtract.rest, "--vault-name");
+      if (vaultNameExtract.error) {
+        console.error(`parachute init: ${vaultNameExtract.error}`);
+        return 1;
+      }
+      let validatedVaultName: string | undefined;
+      if (vaultNameExtract.value !== undefined) {
+        if (vaultNameExtract.value.trim() === "") {
+          console.error("parachute init: --vault-name must not be empty.");
+          return 1;
+        }
+        const { validateVaultName: vvn } = await import("./vault-name.ts");
+        const vr = vvn(vaultNameExtract.value);
+        if (!vr.ok) {
+          console.error(`parachute init: invalid --vault-name: ${vr.error}`);
+          return 1;
+        }
+        validatedVaultName = vr.name;
+      }
+      const noBrowser = vaultNameExtract.rest.includes("--no-browser");
+      const noExposePrompt = vaultNameExtract.rest.includes("--no-expose-prompt");
+      const cliWizard = vaultNameExtract.rest.includes("--cli-wizard");
+      const browserWizard = vaultNameExtract.rest.includes("--browser-wizard");
       const known = new Set([
         "--no-browser",
         "--no-expose-prompt",
         "--cli-wizard",
         "--browser-wizard",
       ]);
-      const unknown = exposeExtract.rest.find((a) => !known.has(a));
+      const unknown = vaultNameExtract.rest.find((a) => !known.has(a));
       if (unknown !== undefined) {
         console.error(`parachute init: unknown argument "${unknown}"`);
         console.error(
           "usage: parachute init [--no-browser] [--no-expose-prompt]\n" +
             "                     [--expose none|tailnet|cloudflare]\n" +
+            "                     [--channel rc|latest]\n" +
             "                     [--hub-origin <url>]\n" +
+            "                     [--vault-name <name>]\n" +
             "                     [--cli-wizard | --browser-wizard]",
         );
         return 1;
@@ -434,6 +474,10 @@ async function main(argv: string[]): Promise<number> {
       if (exposeExtract.value) {
         initOpts.exposeChoice = exposeExtract.value as "none" | "tailnet" | "cloudflare";
       }
+      if (channelExtract.value === "rc" || channelExtract.value === "latest") {
+        initOpts.channel = channelExtract.value;
+      }
+      if (validatedVaultName !== undefined) initOpts.vaultName = validatedVaultName;
       if (cliWizard) initOpts.wizardChoice = "cli";
       else if (browserWizard) initOpts.wizardChoice = "browser";
       const mod = await loadCommand("init", () => import("./commands/init.ts"));

package/src/clients.ts

@@ -323,9 +323,23 @@ function timingSafeEqualHex(a: string, b: string): boolean {
  * URIs). Doesn't try to match a registered URI; that's `requireRegisteredRedirectUri`.
  */
 export function isValidRedirectUri(uri: string): boolean {
+  // hub#663: reject control chars (C0 0x00-0x1f + DEL 0x7f) in the RAW input
+  // BEFORE URL parsing normalizes/strips them. A `\r`/`\n`/NUL smuggled into a
+  // redirect_uri is a header/log-injection vector even though our exact-match +
+  // verbatim foreign-storage neutralize it downstream — spec-forbidden hygiene.
+  // (Charcode scan rather than a control-char regex literal, which biome's
+  // noControlCharactersInRegex rightly flags as an easy footgun.)
+  for (let i = 0; i < uri.length; i++) {
+    const c = uri.charCodeAt(i);
+    if (c <= 0x1f || c === 0x7f) return false;
+  }
   try {
     const u = new URL(uri);
     if (u.protocol === "javascript:" || u.protocol === "data:") return false;
+    // hub#663: reject userinfo (`https://x@evil.com/cb`). A redirect target
+    // carrying credentials is spec-forbidden and an open-redirect / phishing
+    // shape; the protocol allowlist alone let it through.
+    if (u.username !== "" || u.password !== "") return false;
     return u.protocol === "http:" || u.protocol === "https:";
   } catch {
     return false;