@parlor/auth 0.0.0-stage → 0.1.0

package/dist/grants.js

@@ -0,0 +1,6 @@
+import { asId } from "@parlor/core";
+/** One grant per user and OAuth client; re-authorizing after a revocation mints newer tokens. */
+export function grantIdOf(userId, clientId) {
+    return asId("grant", `oauth:${userId}:${clientId}`);
+}
+//# sourceMappingURL=grants.js.map

package/dist/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,cAAc,CAAC;AAElD,iGAAiG;AACjG,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,QAAgB;IACxD,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC;AACtD,CAAC"}

package/dist/hosts.d.ts

@@ -0,0 +1,116 @@
+import { type DataProvider, type GrantId, type HostId, type HostPrincipal, type UserId } from "@parlor/core";
+import { type ActionsOf } from "@parlor/core/registry";
+import { type AnyPluginRoute, type DeviceKeys, type Migration, type PluginHost } from "@parlor/server";
+import { z } from "zod";
+import { type ParlorAuthSettings } from "./better-auth.js";
+import { HOST_AUDIENCE, type HostAssertion } from "./tokens.js";
+export declare const HOST_CLIENT_ID = "parlor-host";
+export declare const MATCHING_CODE: RegExp;
+export type HostRedirect = `http://127.0.0.1:${number}/callback` | "urn:parlor:ipc";
+export interface HostAuthorizeRequest {
+    readonly redirectUri: HostRedirect;
+    readonly codeChallenge: string;
+    readonly state: string;
+    readonly hostName: string;
+    readonly platform: string;
+    readonly matchingCode: string;
+    /** RFC 7638 thumbprint of the key the code exchange must be signed with. */
+    readonly keyThumbprint: string;
+}
+/** `POST /hosts/token` */
+export interface HostKeyExchange {
+    readonly code: string;
+    readonly codeVerifier: string;
+    readonly publicKey: JsonWebKey;
+    /** ES256 over the code with the key the authorize request named. */
+    readonly proof: string;
+}
+export interface AccountSummary {
+    readonly userId: UserId;
+    readonly name: string;
+    readonly email?: string | undefined;
+}
+/** The device that approved the pairing; the host pins it as trusted once confirmed locally. */
+export type ApprovingDevice = DeviceKeys;
+export interface HostGrantResponse {
+    readonly grant: {
+        readonly id: GrantId;
+        readonly hostId: HostId;
+    };
+    /** The host shows it locally before it keeps the grant. */
+    readonly account: AccountSummary;
+    readonly approvedBy?: ApprovingDevice | undefined;
+}
+export declare const HOST_ASSERTION_TTL_MS = 60000;
+/** `authorization: ParlorHost <jws>`, DPoP style: bound to one method and URL, dead in a minute. */
+export interface HostAssertionClaims {
+    readonly aud: typeof HOST_AUDIENCE;
+    readonly gid: string;
+    readonly htm: "GET" | "POST";
+    /** without the query */
+    readonly htu: string;
+    readonly iat: number;
+    readonly exp: number;
+    /** replay-checked in a bounded per-instance LRU over the TTL window */
+    readonly jti: string;
+}
+/** A grant as the server stores it: only the computer's public key. */
+export interface GrantKey {
+    readonly grantId: GrantId;
+    readonly userId: UserId;
+    readonly hostId: HostId;
+    readonly publicKey: JsonWebKey;
+    readonly kid: string;
+}
+/** In memory after one primary-key lookup; dropped when `RevocationSet` reports the grant. */
+export interface GrantKeys {
+    get(grantId: GrantId): Promise<GrantKey | undefined>;
+}
+/** A missing grant is remembered briefly; grant ids are never reused, so a miss stays one. */
+export declare const GRANT_MISS_TTL_MS = 5000;
+export interface GrantKeysOptions {
+    /** How long a loaded key is trusted; clamped to the revocation horizon. */
+    readonly ttlMs?: number | undefined;
+    readonly now?: (() => number) | undefined;
+}
+/**
+ * A grant's key after one primary-key lookup, kept for a few minutes. A grant revoked
+ * meanwhile has no row, and `RevocationSet` (which outlasts the cache) refuses it until the
+ * cache lets go.
+ */
+export declare function createGrantKeys(database: DataProvider, options?: GrantKeysOptions): GrantKeys;
+export declare function verifyHostAssertion(assertion: HostAssertion, request: {
+    readonly method: string;
+    readonly url: string;
+}, keys: GrantKeys, now: number): Promise<GrantKey>;
+export declare function hostPrincipalOf(grant: GrantKey): HostPrincipal;
+export declare const HOSTS_TAG = "parlor_auth_hosts";
+export declare const HOSTS_MIGRATION: Migration;
+export interface ConnectedHost {
+    readonly hostId: HostId;
+    readonly name: string;
+    readonly platform: string;
+    readonly connectedAt: string;
+    readonly lastUsedAt: string | null;
+}
+export interface HostGrantDeps {
+    readonly host: PluginHost;
+    readonly settings: ParlorAuthSettings;
+}
+/** `hosts` and `revokeHost`, merged into the account actions once host grants land. */
+export declare function hostAccountActions(deps: HostGrantDeps): import("@parlor/core/registry").ActionRegistry<{
+    hosts: import("@parlor/core").ActionDefinition<z.ZodObject<{}, z.core.$strip>, ConnectedHost[]>;
+    revokeHost: import("@parlor/core").ActionDefinition<z.ZodObject<{
+        hostId: z.ZodString;
+    }, z.core.$strip>, {
+        readonly id: string;
+    }>;
+}>;
+export type HostAccountActions = ActionsOf<ReturnType<typeof hostAccountActions>>;
+/**
+ * `GET|POST /hosts/authorize` is the framework-owned consent page and its answer, `POST
+ * /hosts/token` the PKCE exchange binding the host's key, `POST /hosts/revoke` the host
+ * disconnecting itself.
+ */
+export declare function hostRoutes(deps: HostGrantDeps): readonly AnyPluginRoute[];
+//# sourceMappingURL=hosts.d.ts.map

package/dist/hosts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosts.d.ts","sourceRoot":"","sources":["../src/hosts.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,YAAY,EAEjB,KAAK,OAAO,EACZ,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,KAAK,MAAM,EACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,KAAK,SAAS,EAAkB,MAAM,uBAAuB,CAAC;AACvE,OAAO,EACL,KAAK,cAAc,EAEnB,KAAK,UAAU,EAEf,KAAK,SAAS,EACd,KAAK,UAAU,EAKhB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAA2B,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAKpF,OAAO,EAAsB,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEpF,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAE5C,eAAO,MAAM,aAAa,QAA8B,CAAC;AAEzD,MAAM,MAAM,YAAY,GAAG,oBAAoB,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAEpF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,0BAA0B;AAC1B,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,gGAAgG;AAChG,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC;AAEzC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;CACnD;AAED,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAE5C,oGAAoG;AACpG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,OAAO,aAAa,CAAC;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,KAAK,GAAG,MAAM,CAAC;IAC7B,wBAAwB;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,uEAAuE;AACvE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,8FAA8F;AAC9F,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;CACtD;AAID,8FAA8F;AAC9F,eAAO,MAAM,iBAAiB,OAAQ,CAAC;AAKvC,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CAC3C;AAwBD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,YAAY,EACtB,OAAO,GAAE,gBAAqB,GAC7B,SAAS,CAqDX;AAsDD,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAC1D,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,QAAQ,CAAC,CAgDnB;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,QAAQ,GAAG,aAAa,CAO9D;AAED,eAAO,MAAM,SAAS,sBAAkB,CAAC;AAEzC,eAAO,MAAM,eAAe,EAAE,SA2B7B,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;CACvC;AA8CD,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa;;;;;qBA0BK,MAAM;;GAShE;AAED,MAAM,MAAM,kBAAkB,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC;AA4HlF;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,cAAc,EAAE,CA0LzE"}

package/dist/hosts.js

@@ -0,0 +1,530 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { ActionError, asId, defineAction, } from "@parlor/core";
+import { createRegistry } from "@parlor/core/registry";
+import { AuthFailure, HOST_GRANTS_TAG, pluginRoute, readBoundedText, SHELL_ORIGINS, REVOCATION_HORIZON_MS, } from "@parlor/server";
+import { sql } from "drizzle-orm";
+import { calculateJwkThumbprint, compactVerify, decodeProtectedHeader } from "jose";
+import { z } from "zod";
+import { signedIn } from "./account.js";
+import { AUTH_PLUGIN, devOrigins } from "./better-auth.js";
+import { jwkOf, rowsOf } from "./database.js";
+import { findPendingDevice } from "./devices.js";
+import { escape, failure, page } from "./pages.js";
+import { RevocationSet } from "./revocation.js";
+import { HOST_ASSERTION_TYP, HOST_AUDIENCE } from "./tokens.js";
+export const HOST_CLIENT_ID = "parlor-host";
+export const MATCHING_CODE = /^[A-Z2-9]{3}-[A-Z2-9]{3}$/;
+export const HOST_ASSERTION_TTL_MS = 60_000;
+const GRANT_KEY_TTL_MS = 5 * 60_000;
+const GRANT_KEY_CACHE_SIZE = 10_000;
+/** A missing grant is remembered briefly; grant ids are never reused, so a miss stays one. */
+export const GRANT_MISS_TTL_MS = 5_000;
+const GRANT_MISS_CACHE_SIZE = 1_000;
+const REPLAY_CACHE_SIZE = 100_000;
+const CLOCK_SKEW_MS = 5_000;
+const verifyKeys = new WeakMap();
+const replays = new WeakMap();
+const EC_P256 = { name: "ECDSA", namedCurve: "P-256" };
+function verifyKeyOf(grant) {
+    let key = verifyKeys.get(grant);
+    if (!key) {
+        key = crypto.subtle.importKey("jwk", grant.publicKey, EC_P256, false, ["verify"]);
+        verifyKeys.set(grant, key);
+    }
+    return key;
+}
+/**
+ * A grant's key after one primary-key lookup, kept for a few minutes. A grant revoked
+ * meanwhile has no row, and `RevocationSet` (which outlasts the cache) refuses it until the
+ * cache lets go.
+ */
+export function createGrantKeys(database, options = {}) {
+    const ttlMs = Math.min(options.ttlMs ?? GRANT_KEY_TTL_MS, REVOCATION_HORIZON_MS);
+    const now = options.now ?? Date.now;
+    const cache = new Map();
+    const misses = new Map();
+    const loading = new Map();
+    const load = async (grantId) => {
+        const rows = rowsOf(await database.read().execute(sql `
+        select grant_id, user_id, host_id, public_key, kid from parlor_auth_hosts
+        where grant_id = ${grantId}`));
+        const row = rows[0];
+        if (!row) {
+            misses.set(grantId, now());
+            while (misses.size > GRANT_MISS_CACHE_SIZE) {
+                misses.delete(misses.keys().next().value);
+            }
+            return undefined;
+        }
+        const key = {
+            grantId: asId("grant", row.grant_id),
+            userId: asId("user", row.user_id),
+            hostId: asId("host", row.host_id),
+            publicKey: jwkOf(row.public_key),
+            kid: row.kid,
+        };
+        cache.set(grantId, { key, loadedAt: now() });
+        while (cache.size > GRANT_KEY_CACHE_SIZE) {
+            cache.delete(cache.keys().next().value);
+        }
+        return key;
+    };
+    return {
+        async get(grantId) {
+            const hit = cache.get(grantId);
+            if (hit && now() - hit.loadedAt < ttlMs)
+                return hit.key;
+            cache.delete(grantId);
+            const missedAt = misses.get(grantId);
+            if (missedAt !== undefined) {
+                if (now() - missedAt < GRANT_MISS_TTL_MS)
+                    return undefined;
+                misses.delete(grantId);
+            }
+            let pending = loading.get(grantId);
+            if (!pending) {
+                pending = load(grantId).finally(() => loading.delete(grantId));
+                loading.set(grantId, pending);
+            }
+            return pending;
+        },
+    };
+}
+const assertionClaims = z.object({
+    aud: z.literal(HOST_AUDIENCE),
+    gid: z.string().min(1),
+    htm: z.enum(["GET", "POST"]),
+    htu: z.string().min(1),
+    iat: z.number().int(),
+    exp: z.number().int(),
+    jti: z.string().min(8).max(128),
+});
+const withoutQuery = (url) => {
+    const parsed = new URL(url);
+    parsed.search = "";
+    parsed.hash = "";
+    return parsed.href;
+};
+function claimJti(keys, grantId, jti, now, rememberUntil) {
+    let seen = replays.get(keys);
+    if (!seen)
+        replays.set(keys, (seen = new Map()));
+    for (const [id, expiresAt] of seen) {
+        if (expiresAt > now)
+            break;
+        seen.delete(id);
+    }
+    const id = `${grantId}:${jti}`;
+    if (seen.has(id))
+        return false;
+    while (seen.size >= REPLAY_CACHE_SIZE)
+        seen.delete(seen.keys().next().value);
+    seen.set(id, rememberUntil);
+    return true;
+}
+function claimsOf(assertion) {
+    try {
+        const header = decodeProtectedHeader(assertion);
+        const payload = JSON.parse(Buffer.from(assertion.split(".")[1] ?? "", "base64url").toString("utf8"));
+        if (header.typ !== HOST_ASSERTION_TYP || typeof payload.gid !== "string") {
+            throw new Error("not a host assertion");
+        }
+        return { gid: payload.gid, kid: header.kid };
+    }
+    catch {
+        throw new AuthFailure("invalid", "The host assertion is malformed.");
+    }
+}
+export async function verifyHostAssertion(assertion, request, keys, now) {
+    const { gid, kid } = claimsOf(assertion);
+    const grant = await keys.get(asId("grant", gid));
+    if (!grant || kid !== grant.kid) {
+        throw new AuthFailure("invalid", "This computer is not connected.");
+    }
+    let payload;
+    try {
+        const verified = await compactVerify(assertion, await verifyKeyOf(grant), {
+            algorithms: ["ES256"],
+        });
+        payload = JSON.parse(new TextDecoder().decode(verified.payload));
+    }
+    catch {
+        throw new AuthFailure("invalid", "The host assertion is not signed by this computer.");
+    }
+    const parsed = assertionClaims.safeParse(payload);
+    if (!parsed.success)
+        throw new AuthFailure("invalid", "The host assertion is malformed.");
+    const claims = parsed.data;
+    if (claims.htm !== request.method) {
+        throw new AuthFailure("invalid", "The host assertion is for another method.");
+    }
+    let sameUrl;
+    try {
+        sameUrl = withoutQuery(claims.htu) === withoutQuery(request.url);
+    }
+    catch {
+        sameUrl = false;
+    }
+    if (!sameUrl)
+        throw new AuthFailure("invalid", "The host assertion is for another URL.");
+    const issuedAt = claims.iat * 1000;
+    if (claims.exp - claims.iat > HOST_ASSERTION_TTL_MS / 1000 ||
+        issuedAt - now > CLOCK_SKEW_MS) {
+        throw new AuthFailure("invalid", "The host assertion has an impossible lifetime.");
+    }
+    if (now - issuedAt > HOST_ASSERTION_TTL_MS || claims.exp * 1000 <= now) {
+        throw new AuthFailure("expired", "The host assertion expired.");
+    }
+    const acceptableUntil = Math.min(claims.exp * 1000, issuedAt + HOST_ASSERTION_TTL_MS);
+    if (!claimJti(keys, grant.grantId, claims.jti, now, acceptableUntil)) {
+        throw new AuthFailure("invalid", "The host assertion was already used.");
+    }
+    return grant;
+}
+export function hostPrincipalOf(grant) {
+    return {
+        kind: "host",
+        userId: grant.userId,
+        grantId: grant.grantId,
+        hostId: grant.hostId,
+    };
+}
+export const HOSTS_TAG = HOST_GRANTS_TAG;
+export const HOSTS_MIGRATION = {
+    id: "auth/0003_hosts",
+    sql: `
+    create table parlor_auth_hosts (
+      grant_id text primary key,
+      host_id text not null unique,
+      user_id text not null,
+      name text not null,
+      platform text not null,
+      public_key jsonb not null,
+      kid text not null,
+      created_at timestamptz not null default now(),
+      last_used_at timestamptz
+    );
+    create index parlor_auth_hosts_user on parlor_auth_hosts (user_id);
+
+    create table parlor_auth_host_codes (
+      code_hash text primary key,
+      user_id text not null,
+      code_challenge text not null,
+      key_thumbprint text not null,
+      redirect_uri text not null,
+      host_name text not null,
+      platform text not null,
+      device_id text,
+      expires_at timestamptz not null
+    )`,
+};
+function databaseOf(host) {
+    if (!host.database)
+        throw new Error("Host grants need a database.");
+    return host.database;
+}
+/**
+ * Deletes the grant's key row and revokes the grant in one transaction. The row must go:
+ * `RevocationSet` forgets after its horizon, and a host assertion's `iat` is always fresh.
+ */
+async function removeGrant(deps, match, userId) {
+    return databaseOf(deps.host).transaction(async (handle) => {
+        const tx = handle;
+        const removed = rowsOf(await tx.execute("hostId" in match
+            ? sql `delete from parlor_auth_hosts where host_id = ${match.hostId} and user_id = ${userId} returning grant_id, host_id`
+            : sql `delete from parlor_auth_hosts where grant_id = ${match.grantId} and user_id = ${userId} returning grant_id, host_id`))[0];
+        if (!removed)
+            return undefined;
+        await RevocationSet.revoke(tx, { kind: "grant", id: removed.grant_id });
+        return removed;
+    });
+}
+const isoOf = (value) => new Date(value).toISOString();
+/** `hosts` and `revokeHost`, merged into the account actions once host grants land. */
+export function hostAccountActions(deps) {
+    return createRegistry({
+        hosts: defineAction({
+            description: "List the computers connected to this account.",
+            input: z.object({}),
+            reads: [HOSTS_TAG],
+            run: async (_input, ctx) => {
+                const user = signedIn(ctx);
+                const rows = rowsOf(await databaseOf(deps.host).read().execute(sql `
+            select host_id, name, platform, created_at, last_used_at from parlor_auth_hosts
+            where user_id = ${user.userId} order by created_at, host_id`));
+                return rows.map((row) => ({
+                    hostId: asId("host", row.host_id),
+                    name: row.name,
+                    platform: row.platform,
+                    connectedAt: isoOf(row.created_at),
+                    lastUsedAt: row.last_used_at === null ? null : isoOf(row.last_used_at),
+                }));
+            },
+        }),
+        revokeHost: defineAction({
+            description: "Disconnect a computer; its grant, turn tokens and stream end at once.",
+            input: z.object({ hostId: z.string().min(1) }),
+            run: async ({ hostId }, ctx) => {
+                const user = signedIn(ctx);
+                const removed = await removeGrant(deps, { hostId }, user.userId);
+                if (!removed)
+                    throw new ActionError("not_found", `No computer ${hostId}`);
+                await deps.host.announce(ctx.scope, [[HOSTS_TAG, hostId]]);
+                return { id: hostId };
+            },
+        }),
+    });
+}
+const THUMBPRINT = /^[A-Za-z0-9_-]{43}$/;
+const isPrintable = (text) => [...text].every((char) => {
+    const code = char.codePointAt(0);
+    return code >= 0x20 && code !== 0x7f;
+});
+const LOOPBACK = /^http:\/\/127\.0\.0\.1:(\d{1,5})\/callback$/;
+const IPC_REDIRECT = "urn:parlor:ipc";
+const CODE_TTL_MS = 10 * 60_000;
+function isHostRedirect(value) {
+    if (value === IPC_REDIRECT)
+        return true;
+    if (typeof value !== "string")
+        return false;
+    const port = LOOPBACK.exec(value)?.[1];
+    return port !== undefined && Number(port) >= 1 && Number(port) <= 65_535;
+}
+const authorizeRequest = z.object({
+    redirectUri: z.custom(isHostRedirect, "Use a loopback redirect."),
+    codeChallenge: z.string().regex(THUMBPRINT),
+    state: z.string().min(1).max(256),
+    hostName: z
+        .string()
+        .trim()
+        .min(1)
+        .max(64)
+        .refine(isPrintable, "Use printable characters."),
+    platform: z
+        .string()
+        .trim()
+        .min(1)
+        .max(32)
+        .refine(isPrintable, "Use printable characters."),
+    matchingCode: z.string().regex(MATCHING_CODE),
+    keyThumbprint: z.string().regex(THUMBPRINT),
+});
+const authorizeAnswer = authorizeRequest.extend({
+    decision: z.enum(["connect", "cancel"]),
+});
+const publicKeySchema = z.looseObject({
+    kty: z.literal("EC"),
+    crv: z.literal("P-256"),
+    x: z.string().regex(THUMBPRINT),
+    y: z.string().regex(THUMBPRINT),
+});
+const keyExchange = z.object({
+    code: z.string().min(16).max(256),
+    codeVerifier: z.string().min(43).max(128),
+    publicKey: publicKeySchema,
+    proof: z.string().min(1).max(256),
+});
+const MAX_BODY_BYTES = 16 * 1024;
+const sha256 = (text, encoding) => createHash("sha256").update(text).digest(encoding);
+function sameText(a, b) {
+    const left = createHash("sha256").update(a).digest();
+    const right = createHash("sha256").update(b).digest();
+    return timingSafeEqual(left, right);
+}
+async function bodyOf(request) {
+    const text = await readBoundedText(request, MAX_BODY_BYTES);
+    if (text === undefined)
+        return { json: false, fields: undefined };
+    if ((request.headers.get("content-type") ?? "").includes("application/json")) {
+        try {
+            return { json: true, fields: JSON.parse(text) };
+        }
+        catch {
+            return { json: true, fields: undefined };
+        }
+    }
+    return { json: false, fields: Object.fromEntries(new URLSearchParams(text)) };
+}
+function invalidGrant() {
+    return Response.json({
+        error: {
+            code: "invalid_grant",
+            message: "The pairing code is invalid, expired or already used.",
+        },
+    }, { status: 400 });
+}
+async function verifyProof(publicKey, code, proof) {
+    try {
+        const key = await crypto.subtle.importKey("jwk", publicKey, EC_P256, false, [
+            "verify",
+        ]);
+        return await crypto.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, key, Buffer.from(proof, "base64url"), new TextEncoder().encode(code));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * `GET|POST /hosts/authorize` is the framework-owned consent page and its answer, `POST
+ * /hosts/token` the PKCE exchange binding the host's key, `POST /hosts/revoke` the host
+ * disconnecting itself.
+ */
+export function hostRoutes(deps) {
+    const { host, settings } = deps;
+    const appName = () => process.env.PARLOR_APP_NAME ?? settings.appName ?? new URL(settings.origin).host;
+    const authorizeUrl = `${host.basePath}/${AUTH_PLUGIN}/hosts/authorize`;
+    const accountOf = async (userId) => host.auth?.account?.(userId);
+    return [
+        pluginRoute({
+            method: "GET",
+            path: "/hosts/authorize",
+            access: ["user"],
+            handle: async (request, caller) => {
+                const parsed = authorizeRequest.safeParse(Object.fromEntries(new URL(request.url).searchParams));
+                if (!parsed.success) {
+                    return failure("This connection request is incomplete.", 400);
+                }
+                const pairing = parsed.data;
+                const profile = await accountOf(caller.principal.userId);
+                const app = appName();
+                const hidden = Object.entries(pairing)
+                    .map(([name, value]) => `<input type="hidden" name="${name}" value="${escape(String(value))}">`)
+                    .join("\n");
+                const body = `
+<h1>Connect ${escape(pairing.hostName)} to ${escape(app)}?</h1>
+<p>Signed in as <strong>${escape(profile?.email ?? profile?.name ?? "your account")}</strong>.</p>
+<p>The coding agents on <strong>${escape(pairing.hostName)}</strong> (${escape(pairing.platform)}) will take your prompts from ${escape(app)} and run on that computer. Continue only if you just ran <code>connect</code> there.</p>
+<form method="post" action="${escape(authorizeUrl)}">
+${hidden}
+<button type="submit" name="decision" value="cancel">Cancel</button>
+<button type="submit" name="decision" value="connect">Connect</button>
+</form>`;
+                const target = pairing.redirectUri === IPC_REDIRECT
+                    ? []
+                    : [new URL(pairing.redirectUri).origin];
+                return page("Connect a computer", body, ["'self'", ...target]);
+            },
+        }),
+        pluginRoute({
+            method: "POST",
+            path: "/hosts/authorize",
+            access: ["user"],
+            handle: async (request, caller) => {
+                const { json, fields } = await bodyOf(request);
+                const refuse = (status, code, message) => json
+                    ? Response.json({ error: { code, message } }, { status })
+                    : failure(message, status);
+                const origin = request.headers.get("origin");
+                if (origin !== settings.origin &&
+                    !(origin && [...SHELL_ORIGINS, ...devOrigins()].includes(origin))) {
+                    return refuse(403, "forbidden", "This answer did not come from the consent page.");
+                }
+                const parsed = authorizeAnswer.safeParse(fields);
+                if (!parsed.success) {
+                    return refuse(400, "invalid_input", "This connection request is incomplete.");
+                }
+                const { decision, ...pairing } = parsed.data;
+                const target = pairing.redirectUri === IPC_REDIRECT ? undefined : new URL(pairing.redirectUri);
+                if (decision === "cancel") {
+                    if (!target)
+                        return Response.json({ error: "access_denied", state: pairing.state });
+                    target.searchParams.set("error", "access_denied");
+                    target.searchParams.set("state", pairing.state);
+                    return new Response(null, { status: 303, headers: { location: target.href } });
+                }
+                const code = randomBytes(32).toString("base64url");
+                await databaseOf(host).transaction(async (handle) => {
+                    const tx = handle;
+                    await tx.execute(sql `delete from parlor_auth_host_codes where expires_at < ${new Date().toISOString()}`);
+                    await tx.execute(sql `
+            insert into parlor_auth_host_codes
+              (code_hash, user_id, code_challenge, key_thumbprint, redirect_uri, host_name, platform, expires_at)
+            values (${sha256(code, "hex")}, ${caller.principal.userId}, ${pairing.codeChallenge},
+              ${pairing.keyThumbprint}, ${pairing.redirectUri}, ${pairing.hostName}, ${pairing.platform},
+              ${new Date(Date.now() + CODE_TTL_MS).toISOString()})`);
+                });
+                if (!target)
+                    return Response.json({ code, state: pairing.state });
+                target.searchParams.set("code", code);
+                target.searchParams.set("state", pairing.state);
+                return new Response(null, { status: 303, headers: { location: target.href } });
+            },
+        }),
+        {
+            method: "POST",
+            path: "/hosts/token",
+            access: "public",
+            handle: async (request) => {
+                const { fields } = await bodyOf(request);
+                const exchange = keyExchange.safeParse(fields);
+                if (!exchange.success || "d" in exchange.data.publicKey)
+                    return invalidGrant();
+                const { code, codeVerifier, proof } = exchange.data;
+                const { kty, crv, x, y } = exchange.data.publicKey;
+                const publicKey = { kty, crv, x, y };
+                const database = databaseOf(host);
+                const stored = await database.transaction(async (handle) => rowsOf(await handle.execute(sql `
+              delete from parlor_auth_host_codes where code_hash = ${sha256(code, "hex")}
+              returning user_id, code_challenge, key_thumbprint, host_name, platform, expires_at`))[0]);
+                if (!stored ||
+                    new Date(stored.expires_at).getTime() <= Date.now() ||
+                    !sameText(sha256(codeVerifier, "base64url"), stored.code_challenge) ||
+                    !sameText(await calculateJwkThumbprint(publicKey, "sha256"), stored.key_thumbprint) ||
+                    !(await verifyProof(publicKey, code, proof))) {
+                    return invalidGrant();
+                }
+                const grantId = asId("grant", `host:${crypto.randomUUID()}`);
+                const hostId = asId("host", crypto.randomUUID());
+                const userId = asId("user", stored.user_id);
+                await database.transaction(async (handle) => {
+                    await handle.execute(sql `
+            insert into parlor_auth_hosts (grant_id, host_id, user_id, name, platform, public_key, kid)
+            values (${grantId}, ${hostId}, ${userId}, ${stored.host_name}, ${stored.platform},
+              ${JSON.stringify(publicKey)}::jsonb, ${stored.key_thumbprint})`);
+                });
+                await host.announce(userId, [[HOSTS_TAG, hostId]]);
+                const profile = await accountOf(userId);
+                const response = {
+                    grant: { id: grantId, hostId },
+                    account: { userId, name: profile?.name ?? "", email: profile?.email },
+                };
+                return Response.json(response);
+            },
+        },
+        pluginRoute({
+            method: "POST",
+            path: "/hosts/devices/link",
+            access: ["host"],
+            handle: async (request, caller) => {
+                const { fields } = await bodyOf(request);
+                const code = z.object({ code: z.string().max(32) }).safeParse(fields).data?.code ?? "";
+                const found = await findPendingDevice(databaseOf(host), caller.principal.userId, {
+                    code,
+                });
+                if (!found) {
+                    return Response.json({
+                        error: {
+                            code: "not_found",
+                            message: "No device of this account shows that code. Check it, or show a new code on the device.",
+                        },
+                    }, { status: 404 });
+                }
+                return Response.json(found);
+            },
+        }),
+        pluginRoute({
+            method: "POST",
+            path: "/hosts/revoke",
+            access: ["host"],
+            handle: async (_request, caller) => {
+                const { userId, grantId } = caller.principal;
+                const removed = await removeGrant(deps, { grantId }, userId);
+                if (removed)
+                    await host.announce(caller.scope, [[HOSTS_TAG, removed.host_id]]);
+                return Response.json({ id: grantId });
+            },
+        }),
+    ];
+}
+//# sourceMappingURL=hosts.js.map