@rubytech/create-maxy-code 0.1.352 → 0.1.354

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.352",
+  "version": "0.1.354",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/lib/admin-access-password/__tests__/index.test.ts

@@ -1,7 +1,8 @@
 import { describe, it, expect } from 'vitest'
 import { mkdtempSync, writeFileSync, readFileSync, existsSync } from 'node:fs'
 import { tmpdir } from 'node:os'
-import { join } from 'node:path'
+import { dirname, join } from 'node:path'
+import type { AuditContext } from '../src/index'
 import {
   hashAccessPassword,
   setAccessPassword,
@@ -13,6 +14,17 @@ import {
   migrateLegacyRemotePassword,
 } from '../src/index'
 
+// Throwaway audit context for the behaviour tests that do not assert on the
+// audit line. The log lands beside the users.json fixture and is ignored.
+function aud(usersFile: string, over: Partial<AuditContext> = {}): AuditContext {
+  return { actor: 'test', logFile: join(dirname(usersFile), 'users-audit.log'), ...over }
+}
+
+function readAudit(logFile: string): string[] {
+  if (!existsSync(logFile)) return []
+  return readFileSync(logFile, 'utf-8').trim().split('\n').filter(Boolean)
+}
+
 function tmpUsers(content: unknown): string {
   const dir = mkdtempSync(join(tmpdir(), 'aap-'))
   const f = join(dir, 'users.json')
@@ -26,7 +38,7 @@ describe('admin-access-password', () => {
       { userId: 'a', pin: 'pinA', phone: '+1' },
       { userId: 'b', pin: 'pinB' },
     ])
-    await setAccessPassword('a', 'Sw0rdfish!', f)
+    await setAccessPassword('a', 'Sw0rdfish!', f, aud(f))
     const users = JSON.parse(readFileSync(f, 'utf-8'))
     expect(users[0].accessHash).toMatch(/^[0-9a-f]+:[0-9a-f]+$/)
     expect(users[0].pin).toBe('pinA')
@@ -36,15 +48,15 @@ describe('admin-access-password', () => {
 
   it('verifyAccessPassword returns the matching userId, null on miss', async () => {
     const f = tmpUsers([{ userId: 'a', pin: 'x' }, { userId: 'b', pin: 'y' }])
-    await setAccessPassword('b', 'Sw0rdfish!', f)
+    await setAccessPassword('b', 'Sw0rdfish!', f, aud(f))
     expect(await verifyAccessPassword('Sw0rdfish!', f)).toBe('b')
     expect(await verifyAccessPassword('wrong', f)).toBeNull()
   })
 
   it("clearAccessPassword removes only that record's hash", async () => {
     const f = tmpUsers([{ userId: 'a', pin: 'x' }])
-    await setAccessPassword('a', 'Sw0rdfish!', f)
-    clearAccessPassword('a', f)
+    await setAccessPassword('a', 'Sw0rdfish!', f, aud(f))
+    clearAccessPassword('a', f, aud(f))
     const users = JSON.parse(readFileSync(f, 'utf-8'))
     expect(users[0].accessHash).toBeUndefined()
     expect(users[0].pin).toBe('x')
@@ -53,7 +65,7 @@ describe('admin-access-password', () => {
   it('anyAccessPasswordConfigured reflects presence', async () => {
     const f = tmpUsers([{ userId: 'a', pin: 'x' }])
     expect(anyAccessPasswordConfigured(f)).toBe(false)
-    await setAccessPassword('a', 'Sw0rdfish!', f)
+    await setAccessPassword('a', 'Sw0rdfish!', f, aud(f))
     expect(anyAccessPasswordConfigured(f)).toBe(true)
   })
 
@@ -64,21 +76,21 @@ describe('admin-access-password', () => {
 
   it('accessPasswordCollides: true when a DIFFERENT admin already has that password', async () => {
     const f = tmpUsers([{ userId: 'a', pin: 'x' }, { userId: 'b', pin: 'y' }])
-    await setAccessPassword('a', 'Sw0rdfish!', f)
+    await setAccessPassword('a', 'Sw0rdfish!', f, aud(f))
     // b is choosing the same password a already uses
     expect(await accessPasswordCollides('Sw0rdfish!', f, 'b')).toBe(true)
   })
 
   it('accessPasswordCollides: false when only the excluded admin holds that password', async () => {
     const f = tmpUsers([{ userId: 'a', pin: 'x' }, { userId: 'b', pin: 'y' }])
-    await setAccessPassword('a', 'Sw0rdfish!', f)
+    await setAccessPassword('a', 'Sw0rdfish!', f, aud(f))
     // a rotating to the same value it already has is not a cross-admin collision
     expect(await accessPasswordCollides('Sw0rdfish!', f, 'a')).toBe(false)
   })
 
   it('accessPasswordCollides: false for a password no other admin uses', async () => {
     const f = tmpUsers([{ userId: 'a', pin: 'x' }, { userId: 'b', pin: 'y' }])
-    await setAccessPassword('a', 'Sw0rdfish!', f)
+    await setAccessPassword('a', 'Sw0rdfish!', f, aud(f))
     expect(await accessPasswordCollides('Different1!', f, 'b')).toBe(false)
   })
 
@@ -113,7 +125,7 @@ describe('migrateLegacyRemotePassword', () => {
   it('moves the legacy hash into the owner record and deletes the file', async () => {
     const legacyHash = await hashAccessPassword('OwnerPass1!')
     const { usersFile, legacyFile } = setup([{ userId: 'owner', pin: 'x' }], legacyHash)
-    const r = migrateLegacyRemotePassword(usersFile, legacyFile, 'owner')
+    const r = migrateLegacyRemotePassword(usersFile, legacyFile, 'owner', aud(usersFile))
     expect(r).toBe('migrated')
     expect(existsSync(legacyFile)).toBe(false)
     const users = JSON.parse(readFileSync(usersFile, 'utf-8'))
@@ -123,20 +135,90 @@ describe('migrateLegacyRemotePassword', () => {
   it('is idempotent — second run is noop', async () => {
     const legacyHash = await hashAccessPassword('OwnerPass1!')
     const { usersFile, legacyFile } = setup([{ userId: 'owner', pin: 'x' }], legacyHash)
-    migrateLegacyRemotePassword(usersFile, legacyFile, 'owner')
-    expect(migrateLegacyRemotePassword(usersFile, legacyFile, 'owner')).toBe('noop-no-legacy')
+    migrateLegacyRemotePassword(usersFile, legacyFile, 'owner', aud(usersFile))
+    expect(migrateLegacyRemotePassword(usersFile, legacyFile, 'owner', aud(usersFile))).toBe('noop-no-legacy')
   })
 
   it('no owner record → leaves the legacy file in place', async () => {
     const legacyHash = await hashAccessPassword('OwnerPass1!')
     const { usersFile, legacyFile } = setup([{ userId: 'someoneelse', pin: 'x' }], legacyHash)
-    expect(migrateLegacyRemotePassword(usersFile, legacyFile, 'owner')).toBe('noop-no-owner')
+    expect(migrateLegacyRemotePassword(usersFile, legacyFile, 'owner', aud(usersFile))).toBe('noop-no-owner')
     expect(existsSync(legacyFile)).toBe(true)
   })
 
   it('owner already has accessHash → deletes stale legacy file, noop', async () => {
     const { usersFile, legacyFile } = setup([{ userId: 'owner', pin: 'x', accessHash: 'aa:bb' }], 'cc:dd')
-    expect(migrateLegacyRemotePassword(usersFile, legacyFile, 'owner')).toBe('noop-owner-has-hash')
+    expect(migrateLegacyRemotePassword(usersFile, legacyFile, 'owner', aud(usersFile))).toBe('noop-owner-has-hash')
     expect(existsSync(legacyFile)).toBe(false)
   })
 })
+
+describe('users-audit emission', () => {
+  it('setAccessPassword emits one set-access line with actor and unchanged row-set', async () => {
+    const f = tmpUsers([{ userId: 'aaaaaaaa-1', pin: 'x' }, { userId: 'bbbbbbbb-2', pin: 'y' }])
+    const logFile = join(dirname(f), 'users-audit.log')
+    await setAccessPassword('aaaaaaaa-1', 'Sw0rdfish!', f, { actor: 'cccccccc-9', logFile })
+    const lines = readAudit(logFile)
+    expect(lines).toHaveLength(1)
+    expect(lines[0]).toContain('[users-audit]')
+    expect(lines[0]).toContain('action=set-access')
+    expect(lines[0]).toContain('field=accessHash')
+    expect(lines[0]).toContain('actor=cccccccc')
+    expect(lines[0]).toContain('rowsBefore=aaaaaaaa,bbbbbbbb')
+    expect(lines[0]).toContain('rowsAfter=aaaaaaaa,bbbbbbbb')
+    expect(lines[0]).toMatch(/ts=\d{4}-\d\d-\d\dT/)
+    expect(lines[0]).not.toContain('session=')
+  })
+
+  it('a non-uuid sentinel actor is written whole (not truncated to 8 chars)', async () => {
+    const f = tmpUsers([{ userId: 'aaaaaaaa-1', pin: 'x' }])
+    const logFile = join(dirname(f), 'users-audit.log')
+    await setAccessPassword('aaaaaaaa-1', 'Sw0rdfish!', f, { actor: 'onboarding', logFile })
+    expect(readAudit(logFile)[0]).toContain('actor=onboarding')
+  })
+
+  it('session= appears only when supplied', async () => {
+    const f = tmpUsers([{ userId: 'aaaaaaaa-1', pin: 'x' }])
+    const logFile = join(dirname(f), 'users-audit.log')
+    await setAccessPassword('aaaaaaaa-1', 'Sw0rdfish!', f, { actor: 'cccccccc-9', session: 'dddddddd-7', logFile })
+    expect(readAudit(logFile)[0]).toContain('session=dddddddd')
+  })
+
+  it('clearAccessPassword on a record with a hash emits clear-access', async () => {
+    const f = tmpUsers([{ userId: 'aaaaaaaa-1', pin: 'x' }])
+    const logFile = join(dirname(f), 'users-audit.log')
+    await setAccessPassword('aaaaaaaa-1', 'Sw0rdfish!', f, { actor: 'a', logFile })
+    clearAccessPassword('aaaaaaaa-1', f, { actor: 'cccccccc-9', logFile })
+    const lines = readAudit(logFile)
+    expect(lines).toHaveLength(2)
+    expect(lines[1]).toContain('action=clear-access')
+    expect(lines[1]).toContain('field=accessHash')
+    expect(lines[1]).toContain('actor=cccccccc')
+  })
+
+  it('clearAccessPassword on a record with no hash is a noop and emits nothing', () => {
+    const f = tmpUsers([{ userId: 'aaaaaaaa-1', pin: 'x' }])
+    const logFile = join(dirname(f), 'users-audit.log')
+    clearAccessPassword('aaaaaaaa-1', f, { actor: 'cccccccc-9', logFile })
+    expect(readAudit(logFile)).toHaveLength(0)
+  })
+
+  it('migrate emits one migrate line; the noop variants emit nothing', async () => {
+    const legacyHash = await hashAccessPassword('OwnerPass1!')
+    const dir = mkdtempSync(join(tmpdir(), 'aapmaudit-'))
+    const usersFile = join(dir, 'users.json')
+    const legacyFile = join(dir, '.remote-password')
+    const logFile = join(dir, 'users-audit.log')
+    writeFileSync(usersFile, JSON.stringify([{ userId: 'owner-aaa', pin: 'x' }], null, 2))
+    writeFileSync(legacyFile, legacyHash)
+    expect(migrateLegacyRemotePassword(usersFile, legacyFile, 'owner-aaa', { actor: 'boot', logFile })).toBe('migrated')
+    let lines = readAudit(logFile)
+    expect(lines).toHaveLength(1)
+    expect(lines[0]).toContain('action=migrate')
+    expect(lines[0]).toContain('field=accessHash')
+    expect(lines[0]).toContain('actor=boot')
+    // second run is a noop → no new line
+    expect(migrateLegacyRemotePassword(usersFile, legacyFile, 'owner-aaa', { actor: 'boot', logFile })).toBe('noop-no-legacy')
+    expect(readAudit(logFile)).toHaveLength(1)
+  })
+})

package/payload/platform/lib/admin-access-password/dist/index.d.ts

@@ -5,12 +5,28 @@ export interface AccessUserEntry {
     accessHash?: string;
     [k: string]: unknown;
 }
+/**
+ * Identity + destination for one credential-store audit line. The writers are
+ * pure (they only know the file paths); the caller is the only party that knows
+ * WHO is acting and WHERE the audit log lives, so it is threaded in. `actor` is
+ * an admin userId or a non-user sentinel (`onboarding` | `install` | `boot` |
+ * `unknown` when an MCP caller has no resolvable USER_ID); `session` is the
+ * spawning agent session (SESSION_NODE_ID) when one drove the write. `logFile`
+ * is the absolute path to the append-only users-audit log, distinct from
+ * server.log. Mirrored in platform/lib/admins-write.
+ */
+export interface AuditContext {
+    actor: string;
+    session?: string;
+    logFile: string;
+}
 export declare function hashAccessPassword(password: string): Promise<string>;
 declare function matchesHash(password: string, stored: string): Promise<boolean>;
 /** Write `accessHash` onto the userId's record. Throws if the record is absent. */
-export declare function setAccessPassword(userId: string, password: string, usersFile: string): Promise<void>;
-/** Remove `accessHash` from the userId's record. No-op if absent. */
-export declare function clearAccessPassword(userId: string, usersFile: string): void;
+export declare function setAccessPassword(userId: string, password: string, usersFile: string, audit: AuditContext): Promise<void>;
+/** Remove `accessHash` from the userId's record. No-op (no write, no audit
+ *  line) when the record is absent or already carries no accessHash. */
+export declare function clearAccessPassword(userId: string, usersFile: string, audit: AuditContext): void;
 /** Return the userId whose accessHash matches, or null. */
 export declare function verifyAccessPassword(password: string, usersFile: string): Promise<string | null>;
 /**
@@ -41,7 +57,7 @@ export type MigrateResult = 'migrated' | 'noop-no-legacy' | 'noop-no-owner' | 'n
  * exists yet, leave the legacy file untouched (verify still reads it as a
  * candidate during this window — see readLegacyRemoteHash).
  */
-export declare function migrateLegacyRemotePassword(usersFile: string, legacyFile: string, ownerUserId: string): MigrateResult;
+export declare function migrateLegacyRemotePassword(usersFile: string, legacyFile: string, ownerUserId: string, audit: AuditContext): MigrateResult;
 /** Read a still-present legacy single-password hash, or null. Used by verify
  *  as one additional candidate before the boot migration runs. */
 export declare function readLegacyRemoteHash(legacyFile: string): string | null;

package/payload/platform/lib/admin-access-password/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CACrB;AAWD,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI1E;AAED,iBAAe,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAS7E;AAiBD,mFAAmF;AACnF,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM1G;AAED,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAQ3E;AAED,2DAA2D;AAC3D,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAStG;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED,2DAA2D;AAC3D,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAItE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAGhE;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,gBAAgB,GAAG,eAAe,GAAG,qBAAqB,CAAA;AAEnG;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,aAAa,CAgBf;AAED;kEACkE;AAClE,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAItE;AAED,OAAO,EAAE,WAAW,IAAI,mBAAmB,EAAE,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CACrB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;CAChB;AA+CD,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI1E;AAED,iBAAe,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAS7E;AAiBD,mFAAmF;AACnF,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ/H;AAED;wEACwE;AACxE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAYhG;AAED,2DAA2D;AAC3D,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAStG;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED,2DAA2D;AAC3D,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAItE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAGhE;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,gBAAgB,GAAG,eAAe,GAAG,qBAAqB,CAAA;AAEnG;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,YAAY,GAClB,aAAa,CAkBf;AAED;kEACkE;AAClE,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAItE;AAED,OAAO,EAAE,WAAW,IAAI,mBAAmB,EAAE,CAAA"}

package/payload/platform/lib/admin-access-password/dist/index.js

@@ -15,10 +15,39 @@ exports.verifyHashCandidate = matchesHash;
 // admin MCP plugin (dist) — mirrors platform/lib/admins-write.
 const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
 const SCRYPT_N = 16384;
 const SCRYPT_R = 8;
 const SCRYPT_P = 1;
 const SCRYPT_KEYLEN = 64;
+/** First 8 chars — the short-id convention used across the auth logs. */
+function id8(value) {
+    return value.slice(0, 8);
+}
+function rowIds(users) {
+    return users.map(u => id8(u.userId)).join(',');
+}
+/**
+ * Append one canonical `[users-audit]` line. Append failures never propagate —
+ * an audit-write fault must not break the credential write it records; the
+ * fault is surfaced once on stderr instead.
+ */
+function appendUsersAuditLine(audit, fields) {
+    const sess = audit.session ? ` session=${id8(audit.session)}` : '';
+    // userIds are uuids (shortened to id8); sentinels (boot|install|onboarding|
+    // unknown) carry no dash and are written whole so attribution stays readable.
+    const actor = audit.actor.includes('-') ? id8(audit.actor) : audit.actor;
+    const line = `[users-audit] action=${fields.action} actor=${actor}${sess} ` +
+        `field=${fields.field} rowsBefore=${fields.rowsBefore} rowsAfter=${fields.rowsAfter} ` +
+        `ts=${new Date().toISOString()}\n`;
+    try {
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(audit.logFile), { recursive: true, mode: 0o700 });
+        (0, node_fs_1.appendFileSync)(audit.logFile, line, { mode: 0o600 });
+    }
+    catch (err) {
+        console.error(`[users-audit] op=write-failed logFile=${audit.logFile} error=${err instanceof Error ? err.message : String(err)}`);
+    }
+}
 function scryptAsync(password, salt) {
     return new Promise((resolve, reject) => {
         (0, node_crypto_1.scrypt)(password, salt, SCRYPT_KEYLEN, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P }, (err, key) => {
@@ -68,24 +97,32 @@ function writeUsersAtomic(usersFile, users) {
     (0, node_fs_1.renameSync)(tmp, usersFile);
 }
 /** Write `accessHash` onto the userId's record. Throws if the record is absent. */
-async function setAccessPassword(userId, password, usersFile) {
+async function setAccessPassword(userId, password, usersFile, audit) {
     const users = readUsers(usersFile);
     const idx = users.findIndex(u => u.userId === userId);
     if (idx === -1)
         throw new Error(`no users.json record for userId=${userId}`);
+    const rows = rowIds(users);
     users[idx] = { ...users[idx], accessHash: await hashAccessPassword(password) };
     writeUsersAtomic(usersFile, users);
+    appendUsersAuditLine(audit, { action: 'set-access', field: 'accessHash', rowsBefore: rows, rowsAfter: rows });
 }
-/** Remove `accessHash` from the userId's record. No-op if absent. */
-function clearAccessPassword(userId, usersFile) {
+/** Remove `accessHash` from the userId's record. No-op (no write, no audit
+ *  line) when the record is absent or already carries no accessHash. */
+function clearAccessPassword(userId, usersFile, audit) {
     const users = readUsers(usersFile);
     const idx = users.findIndex(u => u.userId === userId);
     if (idx === -1)
         return;
+    const existing = users[idx].accessHash;
+    if (typeof existing !== 'string' || existing.length === 0)
+        return;
+    const rows = rowIds(users);
     const { accessHash, ...rest } = users[idx];
     void accessHash;
     users[idx] = rest;
     writeUsersAtomic(usersFile, users);
+    appendUsersAuditLine(audit, { action: 'clear-access', field: 'accessHash', rowsBefore: rows, rowsAfter: rows });
 }
 /** Return the userId whose accessHash matches, or null. */
 async function verifyAccessPassword(password, usersFile) {
@@ -165,7 +202,7 @@ function accessStoreUnreadable(usersFile) {
  * exists yet, leave the legacy file untouched (verify still reads it as a
  * candidate during this window — see readLegacyRemoteHash).
  */
-function migrateLegacyRemotePassword(usersFile, legacyFile, ownerUserId) {
+function migrateLegacyRemotePassword(usersFile, legacyFile, ownerUserId, audit) {
     if (!(0, node_fs_1.existsSync)(legacyFile))
         return 'noop-no-legacy';
     const legacy = (0, node_fs_1.readFileSync)(legacyFile, 'utf-8').trim();
@@ -182,9 +219,11 @@ function migrateLegacyRemotePassword(usersFile, legacyFile, ownerUserId) {
         (0, node_fs_1.unlinkSync)(legacyFile);
         return 'noop-no-legacy';
     }
+    const rows = rowIds(users);
     users[idx] = { ...users[idx], accessHash: legacy };
     writeUsersAtomic(usersFile, users);
     (0, node_fs_1.unlinkSync)(legacyFile);
+    appendUsersAuditLine(audit, { action: 'migrate', field: 'accessHash', rowsBefore: rows, rowsAfter: rows });
     return 'migrated';
 }
 /** Read a still-present legacy single-password hash, or null. Used by verify

package/payload/platform/lib/admin-access-password/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;AA4BA,gDAIC;AA6BD,8CAMC;AAGD,kDAQC;AAGD,oDASC;AAUD,wDAcC;AAGD,kEAIC;AASD,sDAGC;AAYD,kEAoBC;AAID,oDAIC;AAEuB,0CAAmB;AA/K3C,4EAA4E;AAC5E,0EAA0E;AAC1E,+DAA+D;AAC/D,6CAAkE;AAClE,qCAAyF;AAEzF,MAAM,QAAQ,GAAG,KAAK,CAAA;AACtB,MAAM,QAAQ,GAAG,CAAC,CAAA;AAClB,MAAM,QAAQ,GAAG,CAAC,CAAA;AAClB,MAAM,aAAa,GAAG,EAAE,CAAA;AAUxB,SAAS,WAAW,CAAC,QAAgB,EAAE,IAAY;IACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAA,oBAAM,EAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5F,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAA;;gBACf,OAAO,CAAC,GAAG,CAAC,CAAA;QACnB,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAEM,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IACvD,MAAM,IAAI,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAA;IAC5B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAC9C,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;AAC1D,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,MAAc;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;IACvD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAC9D,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,KAAK,CAAA;IACrD,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAC3E,OAAO,IAAA,6BAAe,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,SAAS,CAAC,SAAiB;IAClC,IAAI,CAAC,IAAA,oBAAU,EAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAA;IACrC,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IACnB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IACzE,OAAO,MAA2B,CAAA;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB,EAAE,KAAwB;IACnE,MAAM,GAAG,GAAG,GAAG,SAAS,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAA;IAC7C,IAAA,uBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1E,IAAA,oBAAU,EAAC,GAAG,EAAE,SAAS,CAAC,CAAA;AAC5B,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,QAAgB,EAAE,SAAiB;IACzF,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;IACrD,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,EAAE,CAAC,CAAA;IAC5E,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAA;IAC9E,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;AACpC,CAAC;AAED,qEAAqE;AACrE,SAAgB,mBAAmB,CAAC,MAAc,EAAE,SAAiB;IACnE,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;IACrD,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAM;IACtB,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1C,KAAK,UAAU,CAAA;IACf,KAAK,CAAC,GAAG,CAAC,GAAG,IAAuB,CAAA;IACpC,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;AACpC,CAAC;AAED,2DAA2D;AACpD,KAAK,UAAU,oBAAoB,CAAC,QAAgB,EAAE,SAAiB;IAC5E,IAAI,KAAwB,CAAA;IAC5B,IAAI,CAAC;QAAC,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACpF,OAAO,CAAC,CAAC,MAAM,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,sBAAsB,CAC1C,QAAgB,EAChB,SAAiB,EACjB,aAAqB;IAErB,IAAI,KAAwB,CAAA;IAC5B,IAAI,CAAC;QAAC,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa;YAAE,SAAQ;QACxC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACpF,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,2DAA2D;AAC3D,SAAgB,2BAA2B,CAAC,SAAiB;IAC3D,IAAI,KAAwB,CAAA;IAC5B,IAAI,CAAC;QAAC,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AACrF,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CAAC,SAAiB;IACrD,IAAI,CAAC,IAAA,oBAAU,EAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAA;IACxC,IAAI,CAAC;QAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;AAClE,CAAC;AAID;;;;;;;GAOG;AACH,SAAgB,2BAA2B,CACzC,SAAiB,EACjB,UAAkB,EAClB,WAAmB;IAEnB,IAAI,CAAC,IAAA,oBAAU,EAAC,UAAU,CAAC;QAAE,OAAO,gBAAgB,CAAA;IACpD,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACvD,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAA;IAC1D,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,eAAe,CAAA;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,UAAU,CAAA;IACtC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAA;QACtB,OAAO,qBAAqB,CAAA;IAC9B,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAAC,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAC;QAAC,OAAO,gBAAgB,CAAA;IAAC,CAAC;IAC9E,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAClD,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAClC,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAA;IACtB,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;kEACkE;AAClE,SAAgB,oBAAoB,CAAC,UAAkB;IACrD,IAAI,CAAC,IAAA,oBAAU,EAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IACxC,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACpD,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AACvC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;AAiFA,gDAIC;AA6BD,8CAQC;AAID,kDAYC;AAGD,oDASC;AAUD,wDAcC;AAGD,kEAIC;AASD,sDAGC;AAYD,kEAuBC;AAID,oDAIC;AAEuB,0CAAmB;AA9O3C,4EAA4E;AAC5E,0EAA0E;AAC1E,+DAA+D;AAC/D,6CAAkE;AAClE,qCAAoH;AACpH,yCAAmC;AAEnC,MAAM,QAAQ,GAAG,KAAK,CAAA;AACtB,MAAM,QAAQ,GAAG,CAAC,CAAA;AAClB,MAAM,QAAQ,GAAG,CAAC,CAAA;AAClB,MAAM,aAAa,GAAG,EAAE,CAAA;AA0BxB,yEAAyE;AACzE,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,MAAM,CAAC,KAAwB;IACtC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,KAAmB,EACnB,MAAgF;IAEhF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAClE,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAA;IACxE,MAAM,IAAI,GACR,wBAAwB,MAAM,CAAC,MAAM,UAAU,KAAK,GAAG,IAAI,GAAG;QAC9D,SAAS,MAAM,CAAC,KAAK,eAAe,MAAM,CAAC,UAAU,cAAc,MAAM,CAAC,SAAS,GAAG;QACtF,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,CAAA;IACpC,IAAI,CAAC;QACH,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACnE,IAAA,wBAAc,EAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,yCAAyC,KAAK,CAAC,OAAO,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnH,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,IAAY;IACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAA,oBAAM,EAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5F,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAA;;gBACf,OAAO,CAAC,GAAG,CAAC,CAAA;QACnB,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAEM,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IACvD,MAAM,IAAI,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAA;IAC5B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAC9C,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;AAC1D,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,MAAc;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;IACvD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAC9D,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,KAAK,CAAA;IACrD,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAC3E,OAAO,IAAA,6BAAe,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,SAAS,CAAC,SAAiB;IAClC,IAAI,CAAC,IAAA,oBAAU,EAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAA;IACrC,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IACnB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IACzE,OAAO,MAA2B,CAAA;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB,EAAE,KAAwB;IACnE,MAAM,GAAG,GAAG,GAAG,SAAS,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAA;IAC7C,IAAA,uBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1E,IAAA,oBAAU,EAAC,GAAG,EAAE,SAAS,CAAC,CAAA;AAC5B,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,QAAgB,EAAE,SAAiB,EAAE,KAAmB;IAC9G,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;IACrD,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,EAAE,CAAC,CAAA;IAC5E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAA;IAC9E,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAClC,oBAAoB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;AAC/G,CAAC;AAED;wEACwE;AACxE,SAAgB,mBAAmB,CAAC,MAAc,EAAE,SAAiB,EAAE,KAAmB;IACxF,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;IACrD,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAM;IACtB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,UAAU,CAAA;IACtC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1C,KAAK,UAAU,CAAA;IACf,KAAK,CAAC,GAAG,CAAC,GAAG,IAAuB,CAAA;IACpC,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAClC,oBAAoB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;AACjH,CAAC;AAED,2DAA2D;AACpD,KAAK,UAAU,oBAAoB,CAAC,QAAgB,EAAE,SAAiB;IAC5E,IAAI,KAAwB,CAAA;IAC5B,IAAI,CAAC;QAAC,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACpF,OAAO,CAAC,CAAC,MAAM,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,sBAAsB,CAC1C,QAAgB,EAChB,SAAiB,EACjB,aAAqB;IAErB,IAAI,KAAwB,CAAA;IAC5B,IAAI,CAAC;QAAC,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa;YAAE,SAAQ;QACxC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACpF,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,2DAA2D;AAC3D,SAAgB,2BAA2B,CAAC,SAAiB;IAC3D,IAAI,KAAwB,CAAA;IAC5B,IAAI,CAAC;QAAC,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AACrF,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CAAC,SAAiB;IACrD,IAAI,CAAC,IAAA,oBAAU,EAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAA;IACxC,IAAI,CAAC;QAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;AAClE,CAAC;AAID;;;;;;;GAOG;AACH,SAAgB,2BAA2B,CACzC,SAAiB,EACjB,UAAkB,EAClB,WAAmB,EACnB,KAAmB;IAEnB,IAAI,CAAC,IAAA,oBAAU,EAAC,UAAU,CAAC;QAAE,OAAO,gBAAgB,CAAA;IACpD,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACvD,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAA;IAC1D,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,eAAe,CAAA;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,UAAU,CAAA;IACtC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAA;QACtB,OAAO,qBAAqB,CAAA;IAC9B,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAAC,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAC;QAAC,OAAO,gBAAgB,CAAA;IAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAClD,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAClC,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAA;IACtB,oBAAoB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1G,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;kEACkE;AAClE,SAAgB,oBAAoB,CAAC,UAAkB;IACrD,IAAI,CAAC,IAAA,oBAAU,EAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IACxC,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACpD,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AACvC,CAAC"}

package/payload/platform/lib/admin-access-password/src/index.ts

@@ -2,7 +2,8 @@
 // on users.json admin records. Imported by both platform/ui (src) and the
 // admin MCP plugin (dist) — mirrors platform/lib/admins-write.
 import { scrypt, randomBytes, timingSafeEqual } from 'node:crypto'
-import { existsSync, readFileSync, writeFileSync, renameSync, unlinkSync } from 'node:fs'
+import { existsSync, readFileSync, writeFileSync, renameSync, unlinkSync, appendFileSync, mkdirSync } from 'node:fs'
+import { dirname } from 'node:path'
 
 const SCRYPT_N = 16384
 const SCRYPT_R = 8
@@ -17,6 +18,58 @@ export interface AccessUserEntry {
   [k: string]: unknown
 }
 
+/**
+ * Identity + destination for one credential-store audit line. The writers are
+ * pure (they only know the file paths); the caller is the only party that knows
+ * WHO is acting and WHERE the audit log lives, so it is threaded in. `actor` is
+ * an admin userId or a non-user sentinel (`onboarding` | `install` | `boot` |
+ * `unknown` when an MCP caller has no resolvable USER_ID); `session` is the
+ * spawning agent session (SESSION_NODE_ID) when one drove the write. `logFile`
+ * is the absolute path to the append-only users-audit log, distinct from
+ * server.log. Mirrored in platform/lib/admins-write.
+ */
+export interface AuditContext {
+  actor: string
+  session?: string
+  logFile: string
+}
+
+/** First 8 chars — the short-id convention used across the auth logs. */
+function id8(value: string): string {
+  return value.slice(0, 8)
+}
+
+function rowIds(users: AccessUserEntry[]): string {
+  return users.map(u => id8(u.userId)).join(',')
+}
+
+/**
+ * Append one canonical `[users-audit]` line. Append failures never propagate —
+ * an audit-write fault must not break the credential write it records; the
+ * fault is surfaced once on stderr instead.
+ */
+function appendUsersAuditLine(
+  audit: AuditContext,
+  fields: { action: string; field: string; rowsBefore: string; rowsAfter: string },
+): void {
+  const sess = audit.session ? ` session=${id8(audit.session)}` : ''
+  // userIds are uuids (shortened to id8); sentinels (boot|install|onboarding|
+  // unknown) carry no dash and are written whole so attribution stays readable.
+  const actor = audit.actor.includes('-') ? id8(audit.actor) : audit.actor
+  const line =
+    `[users-audit] action=${fields.action} actor=${actor}${sess} ` +
+    `field=${fields.field} rowsBefore=${fields.rowsBefore} rowsAfter=${fields.rowsAfter} ` +
+    `ts=${new Date().toISOString()}\n`
+  try {
+    mkdirSync(dirname(audit.logFile), { recursive: true, mode: 0o700 })
+    appendFileSync(audit.logFile, line, { mode: 0o600 })
+  } catch (err) {
+    console.error(
+      `[users-audit] op=write-failed logFile=${audit.logFile} error=${err instanceof Error ? err.message : String(err)}`,
+    )
+  }
+}
+
 function scryptAsync(password: string, salt: Buffer): Promise<Buffer> {
   return new Promise((resolve, reject) => {
     scrypt(password, salt, SCRYPT_KEYLEN, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P }, (err, key) => {
@@ -59,23 +112,30 @@ function writeUsersAtomic(usersFile: string, users: AccessUserEntry[]): void {
 }
 
 /** Write `accessHash` onto the userId's record. Throws if the record is absent. */
-export async function setAccessPassword(userId: string, password: string, usersFile: string): Promise<void> {
+export async function setAccessPassword(userId: string, password: string, usersFile: string, audit: AuditContext): Promise<void> {
   const users = readUsers(usersFile)
   const idx = users.findIndex(u => u.userId === userId)
   if (idx === -1) throw new Error(`no users.json record for userId=${userId}`)
+  const rows = rowIds(users)
   users[idx] = { ...users[idx], accessHash: await hashAccessPassword(password) }
   writeUsersAtomic(usersFile, users)
+  appendUsersAuditLine(audit, { action: 'set-access', field: 'accessHash', rowsBefore: rows, rowsAfter: rows })
 }
 
-/** Remove `accessHash` from the userId's record. No-op if absent. */
-export function clearAccessPassword(userId: string, usersFile: string): void {
+/** Remove `accessHash` from the userId's record. No-op (no write, no audit
+ *  line) when the record is absent or already carries no accessHash. */
+export function clearAccessPassword(userId: string, usersFile: string, audit: AuditContext): void {
   const users = readUsers(usersFile)
   const idx = users.findIndex(u => u.userId === userId)
   if (idx === -1) return
+  const existing = users[idx].accessHash
+  if (typeof existing !== 'string' || existing.length === 0) return
+  const rows = rowIds(users)
   const { accessHash, ...rest } = users[idx]
   void accessHash
   users[idx] = rest as AccessUserEntry
   writeUsersAtomic(usersFile, users)
+  appendUsersAuditLine(audit, { action: 'clear-access', field: 'accessHash', rowsBefore: rows, rowsAfter: rows })
 }
 
 /** Return the userId whose accessHash matches, or null. */
@@ -147,6 +207,7 @@ export function migrateLegacyRemotePassword(
   usersFile: string,
   legacyFile: string,
   ownerUserId: string,
+  audit: AuditContext,
 ): MigrateResult {
   if (!existsSync(legacyFile)) return 'noop-no-legacy'
   const legacy = readFileSync(legacyFile, 'utf-8').trim()
@@ -159,9 +220,11 @@ export function migrateLegacyRemotePassword(
     return 'noop-owner-has-hash'
   }
   if (!legacy.includes(':')) { unlinkSync(legacyFile); return 'noop-no-legacy' }
+  const rows = rowIds(users)
   users[idx] = { ...users[idx], accessHash: legacy }
   writeUsersAtomic(usersFile, users)
   unlinkSync(legacyFile)
+  appendUsersAuditLine(audit, { action: 'migrate', field: 'accessHash', rowsBefore: rows, rowsAfter: rows })
   return 'migrated'
 }