@repo-os/repoos 0.5.45

package/dist/core/auth-store.js

@@ -0,0 +1,530 @@
+/**
+ * Auth persistence layer. Wraps the SQLite database with typed operations
+ * for users, sessions, OTP challenges, and audit log entries.
+ *
+ * All OTP codes and session tokens are stored hashed — plaintext never
+ * touches disk.
+ */
+import { existsSync, mkdirSync } from "node:fs";
+import { createRequire } from "node:module";
+import { join } from "node:path";
+import { hashSessionToken, randomHex } from "./auth.js";
+let Database;
+let dbAvailable = false;
+let sqliteLoadAttempted = false;
+const runtimeRequire = createRequire(import.meta.url);
+/**
+ * Load SQLite on first actual use, not at module import time — see the
+ * matching comment in db.ts for why (this module is on the same
+ * nearly-every-command import path, so requiring node:sqlite eagerly here
+ * would print its ExperimentalWarning before the CLI even dispatches).
+ */
+function loadSqlite() {
+    if (sqliteLoadAttempted)
+        return;
+    sqliteLoadAttempted = true;
+    try {
+        const g = globalThis;
+        if (g.Bun && typeof g.Bun === "object") {
+            try {
+                const sqlite = runtimeRequire("bun:sqlite");
+                Database = sqlite.Database;
+                dbAvailable = true;
+            }
+            catch {
+                /* fall through */
+            }
+        }
+        if (!dbAvailable) {
+            try {
+                const sqlite = runtimeRequire("node:sqlite");
+                Database = sqlite.DatabaseSync;
+                dbAvailable = true;
+            }
+            catch {
+                /* unavailable */
+            }
+        }
+    }
+    catch {
+        /* degrade */
+    }
+}
+// ---------------------------------------------------------------------------
+// Schema migration
+// ---------------------------------------------------------------------------
+// Safety-net DDL — identical to db.ts migration v2 but ensures auth tables
+// exist even if the auth-store is opened before the main DB migration runs.
+// All statements use CREATE TABLE IF NOT EXISTS, so this is idempotent.
+const AUTH_MIGRATION = `
+  CREATE TABLE IF NOT EXISTS auth_users (
+    email TEXT PRIMARY KEY,
+    role TEXT NOT NULL DEFAULT 'member',
+    display_name TEXT,
+    auth_source TEXT NOT NULL DEFAULT 'otp',
+    added_by TEXT,
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+  );
+
+  CREATE TABLE IF NOT EXISTS auth_sessions (
+    session_id TEXT PRIMARY KEY,
+    token_hash TEXT NOT NULL UNIQUE,
+    email TEXT NOT NULL,
+    role TEXT NOT NULL,
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    expires_at TEXT NOT NULL,
+    revoked_at TEXT
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_auth_sessions_token_hash ON auth_sessions(token_hash);
+  CREATE INDEX IF NOT EXISTS idx_auth_sessions_email ON auth_sessions(email);
+
+  CREATE TABLE IF NOT EXISTS auth_otp (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    email TEXT NOT NULL,
+    code_hash TEXT NOT NULL,
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    expires_at TEXT NOT NULL,
+    used_at TEXT,
+    source_ip TEXT
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_auth_otp_email ON auth_otp(email);
+
+  CREATE TABLE IF NOT EXISTS auth_audit_log (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    action TEXT NOT NULL,
+    target_email TEXT,
+    actor_email TEXT,
+    details TEXT,
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+  );
+`;
+// ---------------------------------------------------------------------------
+// Store
+// ---------------------------------------------------------------------------
+export class AuthStore {
+    db;
+    available;
+    constructor(repoRoot) {
+        this.available = false;
+        loadSqlite();
+        if (!dbAvailable || !Database)
+            return;
+        try {
+            const cacheDir = join(repoRoot, ".repoos");
+            if (!existsSync(cacheDir))
+                mkdirSync(cacheDir, { recursive: true });
+            const dbPath = join(cacheDir, "repoos.db");
+            this.db = new Database(dbPath);
+            this.db.exec("PRAGMA journal_mode=WAL");
+            this.db.exec("PRAGMA synchronous=NORMAL");
+            this.db.exec(AUTH_MIGRATION);
+            this.available = true;
+        }
+        catch {
+            this.available = false;
+        }
+    }
+    isAvailable() {
+        return this.available;
+    }
+    // ---- Users ----
+    getUser(email) {
+        if (!this.available)
+            return null;
+        try {
+            const rows = this.db.prepare("SELECT * FROM auth_users WHERE email = ?").all(email);
+            return rows.length > 0 ? this.toUser(rows[0]) : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    listUsers() {
+        if (!this.available)
+            return [];
+        try {
+            const rows = this.db.prepare("SELECT * FROM auth_users ORDER BY created_at").all();
+            return rows.map((r) => this.toUser(r));
+        }
+        catch {
+            return [];
+        }
+    }
+    upsertUser(email, role, addedBy, displayName) {
+        if (!this.available)
+            return;
+        try {
+            this.db
+                .prepare(`
+        INSERT INTO auth_users (email, role, display_name, added_by, updated_at)
+        VALUES (?, ?, ?, ?, datetime('now'))
+        ON CONFLICT(email) DO UPDATE SET
+          role = excluded.role,
+          display_name = COALESCE(excluded.display_name, display_name),
+          updated_at = datetime('now')
+      `)
+                .run(email, role, displayName ?? null, addedBy);
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    deleteUser(email) {
+        if (!this.available)
+            return false;
+        try {
+            this.db.prepare("DELETE FROM auth_users WHERE email = ?").run(email);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    getAdminCount() {
+        if (!this.available)
+            return 0;
+        try {
+            const rows = this.db
+                .prepare("SELECT COUNT(*) as cnt FROM auth_users WHERE role = 'admin'")
+                .all();
+            return rows[0]?.cnt ?? 0;
+        }
+        catch {
+            return 0;
+        }
+    }
+    // ---- Sessions ----
+    createSession(email, role, maxAgeSeconds) {
+        if (!this.available)
+            return "";
+        const token = randomHex(32);
+        const tokenHash = hashSessionToken(token);
+        const sessionId = randomHex(16);
+        const now = new Date();
+        const expires = new Date(now.getTime() + maxAgeSeconds * 1000);
+        try {
+            this.db
+                .prepare(`
+        INSERT INTO auth_sessions (session_id, token_hash, email, role, created_at, expires_at)
+        VALUES (?, ?, ?, ?, ?, ?)
+      `)
+                .run(sessionId, tokenHash, email, role, now.toISOString(), expires.toISOString());
+        }
+        catch {
+            return "";
+        }
+        return token;
+    }
+    getSession(token) {
+        if (!this.available)
+            return null;
+        const tokenHash = hashSessionToken(token);
+        try {
+            const now = new Date().toISOString();
+            const rows = this.db
+                .prepare(`
+        SELECT * FROM auth_sessions
+        WHERE token_hash = ? AND revoked_at IS NULL AND expires_at > ?
+      `)
+                .all(tokenHash, now);
+            return rows.length > 0 ? this.toSession(rows[0]) : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    revokeSession(token) {
+        if (!this.available)
+            return false;
+        const tokenHash = hashSessionToken(token);
+        try {
+            this.db
+                .prepare(`
+        UPDATE auth_sessions SET revoked_at = datetime('now') WHERE token_hash = ? AND revoked_at IS NULL
+      `)
+                .run(tokenHash);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    revokeAllSessions(email) {
+        if (!this.available)
+            return 0;
+        try {
+            const result = this.db
+                .prepare(`
+        UPDATE auth_sessions SET revoked_at = datetime('now')
+        WHERE email = ? AND revoked_at IS NULL
+      `)
+                .run(email);
+            return result.changes ?? 0;
+        }
+        catch {
+            return 0;
+        }
+    }
+    /** Update the role column on all active sessions for a user. */
+    updateSessionRoles(email, newRole) {
+        if (!this.available)
+            return 0;
+        try {
+            const result = this.db
+                .prepare(`
+        UPDATE auth_sessions SET role = ?
+        WHERE email = ? AND revoked_at IS NULL
+      `)
+                .run(newRole, email);
+            return result.changes ?? 0;
+        }
+        catch {
+            return 0;
+        }
+    }
+    cleanupExpiredSessions() {
+        if (!this.available)
+            return 0;
+        try {
+            const now = new Date().toISOString();
+            const result = this.db
+                .prepare(`
+        DELETE FROM auth_sessions WHERE expires_at < ?
+      `)
+                .run(now);
+            return result.changes ?? 0;
+        }
+        catch {
+            return 0;
+        }
+    }
+    // ---- OTP ----
+    /** Store a hashed OTP challenge. Returns the challenge id. */
+    createOtpChallenge(email, codeHash, ttlSeconds, sourceIp) {
+        if (!this.available)
+            return -1;
+        const now = new Date();
+        const expires = new Date(now.getTime() + ttlSeconds * 1000);
+        try {
+            const result = this.db
+                .prepare(`
+        INSERT INTO auth_otp (email, code_hash, created_at, expires_at, source_ip)
+        VALUES (?, ?, ?, ?, ?)
+      `)
+                .run(email, codeHash, now.toISOString(), expires.toISOString(), sourceIp);
+            return result.lastInsertRowid ?? -1;
+        }
+        catch {
+            return -1;
+        }
+    }
+    /** Find a valid, unused OTP for this email. Returns null if none found or expired. */
+    findValidOtp(email, codeHash) {
+        if (!this.available)
+            return null;
+        const now = new Date().toISOString();
+        try {
+            const rows = this.db
+                .prepare(`
+        SELECT * FROM auth_otp
+        WHERE email = ? AND code_hash = ? AND used_at IS NULL AND expires_at > ?
+        ORDER BY created_at DESC LIMIT 1
+      `)
+                .all(email, codeHash, now);
+            return rows.length > 0 ? this.toOtp(rows[0]) : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /** Mark an OTP as used. */
+    markOtpUsed(otpId) {
+        if (!this.available)
+            return;
+        try {
+            this.db
+                .prepare(`
+        UPDATE auth_otp SET used_at = datetime('now') WHERE id = ?
+      `)
+                .run(otpId);
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    /** Count OTP requests for this email in the given time window. */
+    countRecentOtpRequests(email, windowSeconds) {
+        if (!this.available)
+            return 0;
+        try {
+            const cutoff = new Date(Date.now() - windowSeconds * 1000).toISOString();
+            const rows = this.db
+                .prepare(`
+        SELECT COUNT(*) as cnt FROM auth_otp
+        WHERE email = ? AND created_at > ?
+      `)
+                .all(email, cutoff);
+            return rows[0]?.cnt ?? 0;
+        }
+        catch {
+            return 0;
+        }
+    }
+    /** Count failed verify attempts for this email in the given time window. */
+    countFailedVerifyAttempts(email, windowSeconds) {
+        if (!this.available)
+            return 0;
+        try {
+            const cutoff = new Date(Date.now() - windowSeconds * 1000).toISOString();
+            const rows = this.db
+                .prepare(`
+        SELECT COUNT(*) as cnt FROM auth_otp
+        WHERE email = ? AND created_at > ? AND used_at IS NOT NULL AND code_hash != ''
+      `)
+                .all(email, cutoff);
+            return rows[0]?.cnt ?? 0;
+        }
+        catch {
+            return 0;
+        }
+    }
+    cleanupExpiredOtps() {
+        if (!this.available)
+            return 0;
+        try {
+            const now = new Date().toISOString();
+            const result = this.db
+                .prepare(`
+        DELETE FROM auth_otp WHERE expires_at < ?
+      `)
+                .run(now);
+            return result.changes ?? 0;
+        }
+        catch {
+            return 0;
+        }
+    }
+    // ---- Audit Log ----
+    logAudit(action, targetEmail, actorEmail, details) {
+        if (!this.available)
+            return;
+        try {
+            this.db
+                .prepare(`
+        INSERT INTO auth_audit_log (action, target_email, actor_email, details, created_at)
+        VALUES (?, ?, ?, ?, datetime('now'))
+      `)
+                .run(action, targetEmail, actorEmail, details ?? null);
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    getAuditLog(limit = 50) {
+        if (!this.available)
+            return [];
+        try {
+            return this.db
+                .prepare(`
+        SELECT * FROM auth_audit_log ORDER BY created_at DESC LIMIT ?
+      `)
+                .all(limit)
+                .map((r) => this.toAuditEntry(r));
+        }
+        catch {
+            return [];
+        }
+    }
+    // ---- Row mappers ----
+    toUser(row) {
+        return {
+            email: row.email,
+            role: row.role,
+            displayName: row.display_name,
+            authSource: row.auth_source,
+            addedBy: row.added_by,
+            createdAt: row.created_at,
+            updatedAt: row.updated_at,
+        };
+    }
+    toSession(row) {
+        return {
+            sessionId: row.session_id,
+            tokenHash: row.token_hash,
+            email: row.email,
+            role: row.role,
+            createdAt: row.created_at,
+            expiresAt: row.expires_at,
+            revokedAt: row.revoked_at,
+        };
+    }
+    toOtp(row) {
+        return {
+            id: row.id,
+            email: row.email,
+            codeHash: row.code_hash,
+            createdAt: row.created_at,
+            expiresAt: row.expires_at,
+            usedAt: row.used_at,
+            sourceIp: row.source_ip,
+        };
+    }
+    toAuditEntry(row) {
+        return {
+            id: row.id,
+            action: row.action,
+            targetEmail: row.target_email,
+            actorEmail: row.actor_email,
+            details: row.details,
+            createdAt: row.created_at,
+        };
+    }
+    close() {
+        if (this.db) {
+            try {
+                this.db.close();
+            }
+            catch {
+                /* ignore */
+            }
+            this.db = null;
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Singleton + periodic cleanup
+// ---------------------------------------------------------------------------
+let authStoreInstance = null;
+let cleanupTimer = null;
+const CLEANUP_INTERVAL_MS = 60 * 60 * 1000; // 1 hour
+export function getAuthStore(repoRoot) {
+    if (!authStoreInstance) {
+        authStoreInstance = new AuthStore(repoRoot);
+    }
+    // Start periodic cleanup on first access
+    if (!cleanupTimer && authStoreInstance.isAvailable()) {
+        cleanupTimer = setInterval(() => {
+            if (authStoreInstance?.isAvailable()) {
+                authStoreInstance.cleanupExpiredSessions();
+                authStoreInstance.cleanupExpiredOtps();
+            }
+        }, CLEANUP_INTERVAL_MS);
+        // Allow the process to exit even if the timer is running
+        if (cleanupTimer.unref)
+            cleanupTimer.unref();
+    }
+    return authStoreInstance.isAvailable() ? authStoreInstance : null;
+}
+export function resetAuthStoreInstance() {
+    if (cleanupTimer) {
+        clearInterval(cleanupTimer);
+        cleanupTimer = null;
+    }
+    if (authStoreInstance) {
+        authStoreInstance.close();
+    }
+    authStoreInstance = null;
+}

package/dist/core/auth.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Authentication module for RepoOS.
+ *
+ * Opt-in, disabled by default. When enabled, protects all UI, API, and SSE
+ * routes with server-side sessions and HttpOnly cookies. Supports email OTP
+ * (via Resend) and Google OAuth as login methods.
+ *
+ * Zero runtime dependencies — native crypto, fetch, and SQLite.
+ */
+export type AuthRole = "admin" | "member";
+export interface AuthEmailProvider {
+    type: "resend";
+    apiKey: string;
+    fromAddress: string;
+    /** Display name shown alongside fromAddress (e.g. "RepoOS"). Optional —
+     *  without it, mail clients fall back to showing the address's local part. */
+    fromName?: string;
+}
+export interface AuthGoogleConfig {
+    clientId: string;
+    clientSecret: string;
+}
+export interface AuthConfig {
+    enabled: boolean;
+    /** Server-side session secret (auto-generated if not provided). Never exposed to browser. */
+    sessionSecret?: string;
+    /** Session lifetime in seconds. Default 7 days. */
+    sessionMaxAge?: number;
+    /** Email provider config (required when auth enabled). */
+    emailProvider?: AuthEmailProvider;
+    /** Google OAuth config (optional). */
+    google?: AuthGoogleConfig;
+    /** Bootstrap admin email (required on first enable). */
+    bootstrapAdmin?: string;
+}
+/** Generate a cryptographically random hex string. */
+export declare function randomHex(bytes?: number): string;
+/** Generate a 6-digit OTP code. */
+export declare function generateOtp(): string;
+/** SHA-256 hash a string (for OTP storage). */
+export declare function hashOtp(code: string): string;
+/** Constant-time string comparison. */
+export declare function timingSafeEqualStr(a: string, b: string): boolean;
+/** Generate a random session token. */
+export declare function generateSessionToken(): string;
+/** Hash a session token for storage. */
+export declare function hashSessionToken(token: string): string;
+/** Generate a CSRF-like state parameter for OAuth. */
+export declare function generateOAuthState(): string;
+/** Generate a PKCE code verifier (43-128 chars, unreserved chars only). */
+export declare function generatePkceVerifier(): string;
+/** SHA-256 hash for PKCE code challenge, base64url encoded. */
+export declare function pkceChallenge(verifier: string): string;
+export declare const SESSION_COOKIE_NAME = "repoos_session";
+export declare const DEFAULT_SESSION_MAX_AGE: number;
+export declare function buildSessionCookie(token: string, maxAge: number, secure: boolean): string;
+export declare function parseCookies(header: string | undefined): Record<string, string>;
+export declare function isValidEmail(email: string): boolean;
+export interface RateLimitEntry {
+    count: number;
+    resetAt: number;
+}
+export declare class RateLimiter {
+    private entries;
+    private windowMs;
+    private maxAttempts;
+    constructor(windowMs: number, maxAttempts: number);
+    /** Returns true if the request should be allowed. */
+    tryAcquire(key: string): boolean;
+    /** Reset a key (e.g. after successful OTP verify). */
+    reset(key: string): void;
+}
+export declare const otpRequestLimiter: RateLimiter;
+export declare const otpVerifyLimiter: RateLimiter;
+export declare const globalRateLimiter: RateLimiter;