@schlessera/brain-ui-server 0.13.0 → 0.14.0

package/src/db/client.ts

@@ -2,42 +2,23 @@ import { Database } from "bun:sqlite";
 import { readdirSync, readFileSync } from "fs";
 import { join } from "path";
 
-let db: Database | null = null;
-let configuredPath: string | null = null;
-
 /**
- * Override the database path before the first `getDb()` call (used by
- * `createApp({ dbPath })`). Configuring after the handle exists would silently
- * split state across two files — refuse instead.
+ * The UI's OWN SQLite database (sessions, passkeys, settings, cron runs) —
+ * distinct from the brain database, which is opened read-only via
+ * src/db/brain-db.ts.
+ *
+ * No module-level handle: `createApp()` opens one per app instance and threads
+ * it to every consumer, so two apps with different configuration can coexist
+ * in one process and a test gets an isolated database by construction.
  */
-export function configureDb(dbPath: string): void {
-  if (db && configuredPath !== dbPath) {
-    throw new Error(
-      "configureDb() called after the database was opened; set dbPath before the first use"
-    );
-  }
-  configuredPath = dbPath;
-}
-
-export function getDb(): Database {
-  if (!db) {
-    const dbPath =
-      configuredPath || process.env.DB_PATH || join(process.cwd(), "brain-ui.db");
-    db = new Database(dbPath, { create: true });
-    db.exec("PRAGMA journal_mode = WAL");
-    db.exec("PRAGMA foreign_keys = ON");
-    runMigrations(db);
-  }
+export function createUiDb(dbPath: string): Database {
+  const db = new Database(dbPath, { create: true });
+  db.exec("PRAGMA journal_mode = WAL");
+  db.exec("PRAGMA foreign_keys = ON");
+  runMigrations(db);
   return db;
 }
 
-export function closeDb() {
-  if (db) {
-    db.close();
-    db = null;
-  }
-}
-
 function runMigrations(database: Database) {
   // Ensure _migrations table exists
   database.exec(`

package/src/db/settings.ts

@@ -6,12 +6,12 @@
 // corrupt row degrades to the caller's fallback rather than throwing, because
 // a bad preference must never take a route down.
 
-import { getDb } from "./client.js";
+import type { Database } from "bun:sqlite";
 
 const HIDDEN_MODELS_KEY = "models.hidden";
 
-export function getSetting<T>(key: string, fallback: T): T {
-  const row = getDb()
+export function getSetting<T>(db: Database, key: string, fallback: T): T {
+  const row = db
     .query("SELECT value FROM settings WHERE key = ?")
     .get(key) as { value: string } | null;
   if (!row) return fallback;
@@ -23,24 +23,22 @@ export function getSetting<T>(key: string, fallback: T): T {
   }
 }
 
-export function setSetting(key: string, value: unknown): void {
-  getDb()
-    .prepare(
-      `INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)
-       ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`
-    )
-    .run(key, JSON.stringify(value), Date.now());
+export function setSetting(db: Database, key: string, value: unknown): void {
+  db.prepare(
+    `INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)
+     ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`
+  ).run(key, JSON.stringify(value), Date.now());
 }
 
 /** Profile ids the user keeps out of the model picker. */
-export function getHiddenModelIds(): string[] {
-  const value = getSetting<unknown>(HIDDEN_MODELS_KEY, []);
+export function getHiddenModelIds(db: Database): string[] {
+  const value = getSetting<unknown>(db, HIDDEN_MODELS_KEY, []);
   if (!Array.isArray(value)) return [];
   return value.filter((id): id is string => typeof id === "string");
 }
 
 /** Replace the hidden set (the client always sends the full list, not a delta). */
-export function setHiddenModelIds(ids: string[]): void {
+export function setHiddenModelIds(db: Database, ids: string[]): void {
   const unique = [...new Set(ids.filter((id) => typeof id === "string" && id))];
-  setSetting(HIDDEN_MODELS_KEY, unique);
+  setSetting(db, HIDDEN_MODELS_KEY, unique);
 }

package/src/files/walker.ts

@@ -25,10 +25,6 @@ const HARD_EXCLUDE_FILE_NAMES = new Set(
   ].map((n) => n.toLowerCase())
 );
 
-export function getBrainRoot(): string {
-  return process.env.BRAIN_PATH || join(process.env.HOME || "/root", "brain");
-}
-
 export class PathEscapeError extends Error {
   constructor(rel: string) {
     super(`path_escape: ${rel}`);
@@ -54,7 +50,7 @@ export class TooLargeError extends Error {
  * Resolve a repo-relative path to an absolute path, rejecting any escape
  * outside the brain root (including via symlinks).
  */
-export async function safeResolve(rel: string, root = getBrainRoot()): Promise<string> {
+export async function safeResolve(rel: string, root: string): Promise<string> {
   if (typeof rel !== "string") throw new PathEscapeError(String(rel));
   // Reject absolute paths and null bytes
   if (rel.startsWith("/") || rel.startsWith("\\") || rel.includes("\0")) {
@@ -123,7 +119,7 @@ function isHardExcluded(name: string, isDir: boolean): boolean {
  * List entries of a directory, applying ignore rules.
  * Always excludes: .git, node_modules, *.db*. Then applies .gitignore.
  */
-export async function listDirectory(rel: string, root = getBrainRoot()): Promise<FileEntry[]> {
+export async function listDirectory(rel: string, root: string): Promise<FileEntry[]> {
   const abs = await safeResolve(rel, root);
   let s;
   try {
@@ -260,7 +256,7 @@ export interface FileContent {
   content?: string;
 }
 
-export async function readFileContent(rel: string, root = getBrainRoot()): Promise<FileContent> {
+export async function readFileContent(rel: string, root: string): Promise<FileContent> {
   const abs = await safeResolve(rel, root);
   let s;
   try {
@@ -314,7 +310,7 @@ export async function readFileContent(rel: string, root = getBrainRoot()): Promi
  * Stream raw bytes of a file (for image/binary preview).
  * Returns the absolute path; caller uses Bun.file() to stream.
  */
-export async function resolveForRaw(rel: string, root = getBrainRoot()): Promise<{ abs: string; size: number; mime: string; kind: FileContentKind }> {
+export async function resolveForRaw(rel: string, root: string): Promise<{ abs: string; size: number; mime: string; kind: FileContentKind }> {
   const abs = await safeResolve(rel, root);
   let s;
   try {
@@ -336,7 +332,7 @@ export async function resolveForRaw(rel: string, root = getBrainRoot()): Promise
  * If two files share a slug (rare), the first one encountered wins —
  * deterministic given the sorted directory traversal.
  */
-export async function buildWikilinkMap(root = getBrainRoot()): Promise<Record<string, string>> {
+export async function buildWikilinkMap(root: string): Promise<Record<string, string>> {
   const matcher = await loadIgnore(root);
   const out: Record<string, string> = {};
 
@@ -397,7 +393,7 @@ export async function buildWikilinkMap(root = getBrainRoot()): Promise<Record<st
  * Return ancestor directories of a path, root-first (excluding root and the path itself).
  *   resolve("a/b/c.md") -> { ancestors: ["a", "a/b"], exists, type }
  */
-export async function resolveAncestors(rel: string, root = getBrainRoot()): Promise<{ ancestors: string[]; exists: boolean; type?: "dir" | "file" }> {
+export async function resolveAncestors(rel: string, root: string): Promise<{ ancestors: string[]; exists: boolean; type?: "dir" | "file" }> {
   const normalized = rel.replace(/\\/g, "/").replace(/^\/+|\/+$/g, "");
   if (!normalized) return { ancestors: [], exists: true, type: "dir" };
   const parts = normalized.split("/");

package/src/graph/reader.ts

@@ -14,9 +14,8 @@
  * are too interactive to shell out for.
  */
 
-import { Database } from "bun:sqlite";
-import { existsSync } from "fs";
-import { basename, join } from "path";
+import type { Database } from "bun:sqlite";
+import { basename } from "path";
 import type {
   GraphCommunityPayload,
   GraphEdgePayload,
@@ -25,7 +24,7 @@ import type {
   GraphNodePayload,
   GraphSubgraphResponse,
 } from "@schlessera/brain-ui-sdk/protocol";
-import { getBrainRoot } from "../files/walker.js";
+import { BrainDbUnavailableError, openBrainDb } from "../db/brain-db.js";
 
 /** brain.db schema that first carries the graph tables. */
 export const MIN_SCHEMA_VERSION = 8;
@@ -59,8 +58,8 @@ export class GraphNotFoundError extends Error {
 }
 
 export interface GraphReadOptions {
-  /** Defaults to the repo the rest of the server reads (BRAIN_PATH). */
-  brainPath?: string;
+  /** The brain repo to read — injected by the route layer from ServerConfig. */
+  brainPath: string;
 }
 
 export interface ClustersOptions extends GraphReadOptions {
@@ -89,13 +88,25 @@ export const DEFAULT_STALE_DAYS = 180;
 
 // --- db access -------------------------------------------------------------
 
-function openDb(brainPath?: string): Database {
-  const dbPath = join(brainPath ?? getBrainRoot(), "brain.db");
-  if (!existsSync(dbPath)) throw new GraphUnavailableError("schema");
-  return new Database(dbPath, { readonly: true });
+/**
+ * Every open goes through src/db/brain-db.ts (the package-wide brain.db
+ * chokepoint). A missing file or a schema older than the package's baseline
+ * maps onto the same "schema" unavailability the route layer already renders;
+ * the graph-specific v8 gate stays per-mode below, because the neighborhood
+ * mode deliberately works on repos that predate the graph tables.
+ */
+function openDb(brainPath: string): Database {
+  try {
+    return openBrainDb(brainPath).db;
+  } catch (err) {
+    if (err instanceof BrainDbUnavailableError) {
+      throw new GraphUnavailableError("schema");
+    }
+    throw err;
+  }
 }
 
-function withDb<T>(brainPath: string | undefined, fn: (db: Database) => T): T {
+function withDb<T>(brainPath: string, fn: (db: Database) => T): T {
   const db = openDb(brainPath);
   try {
     return fn(db);
@@ -423,7 +434,7 @@ function isStale(db: Database, computedAt: string): boolean {
   return computed < indexed;
 }
 
-export function getGraphMeta(opts: GraphReadOptions = {}): GraphMetaResponse {
+export function getGraphMeta(opts: GraphReadOptions): GraphMetaResponse {
   let db: Database;
   try {
     db = openDb(opts.brainPath);
@@ -478,7 +489,7 @@ function unavailable(
 
 // --- modes -----------------------------------------------------------------
 
-export function getClusters(opts: ClustersOptions = {}): GraphSubgraphResponse {
+export function getClusters(opts: ClustersOptions): GraphSubgraphResponse {
   return withDb(opts.brainPath, (db) => {
     requireComputedGraph(db, readMetadata(db));
 
@@ -528,7 +539,7 @@ export function getNeighborhood(opts: NeighborhoodOptions): GraphSubgraphRespons
   });
 }
 
-export function getDiscovery(opts: DiscoveryOptions = {}): GraphSubgraphResponse {
+export function getDiscovery(opts: DiscoveryOptions): GraphSubgraphResponse {
   const maxDepth = clamp(opts.maxDepth ?? MAX_DISCOVERY_DEPTH, 1, MAX_DISCOVERY_DEPTH);
   const direction = opts.direction ?? "out";
 
@@ -605,7 +616,7 @@ export function getDiscovery(opts: DiscoveryOptions = {}): GraphSubgraphResponse
   });
 }
 
-export function getMaintenance(opts: MaintenanceOptions = {}): GraphMaintenanceResponse {
+export function getMaintenance(opts: MaintenanceOptions): GraphMaintenanceResponse {
   const staleDays = clamp(opts.staleDays ?? DEFAULT_STALE_DAYS, 1, 3650);
 
   return withDb(opts.brainPath, (db) => {

package/src/index.ts

@@ -5,39 +5,78 @@
  * decides the port/idleTimeout, wires SIGTERM, and injects deployment-only
  * pieces (static client build, PNG/PDF renderer). Everything else — routes,
  * auth, passkeys, the WebSocket turn coordinator, the session catalog — lives
- * behind createApp().
+ * behind createApp(), which returns a handle carrying the app's own resources
+ * (config, database, ws host) instead of module-level singletons.
  */
-export { createApp, type CreateAppOptions, type AppRenderer } from "./app.js";
+export {
+  createApp,
+  type CreateAppOptions,
+  type BrainUiApp,
+  type AppRenderer,
+} from "./app.js";
 
-// Process lifecycle helpers for the bin entry.
-export { websocket, cancelActiveTurn, isTurnActive } from "./ws/handler.js";
-export { getDb, closeDb, configureDb } from "./db/client.js";
+// Configuration: the package's single environment chokepoint. The descriptor
+// (ENV_VARS) is the artifact the env-parity gate diffs against documentation.
+export {
+  ENV_VARS,
+  resolveServerConfig,
+  type EnvVarDescriptor,
+  type ServerConfig,
+  type AuthConfig,
+  type WebAuthnConfig,
+  type AgentConfig,
+  type VoiceConfig,
+} from "./config/env.js";
 
 // Boot-time diagnostics (fail fast on a bad AGENT_BACKEND / profile config,
 // log the resolved auth mode).
-export { getBackends, getBackendsInfo } from "./agent/backend.js";
-export { resolveAuthMode, type AuthMode } from "./middleware/auth.js";
+export {
+  assertBackendResolvable,
+  createBackendRegistry,
+  createStaticBackendRegistry,
+  type BackendRegistry,
+  type ModelDiscoverySource,
+  type ModelDiscoveryState,
+} from "./agent/backend.js";
+export {
+  resolveAuthMode,
+  type AuthMode,
+  type AuthRuntime,
+} from "./middleware/auth.js";
+
+// The app's own SQLite database (sessions, passkeys, settings).
+export { createUiDb } from "./db/client.js";
+
+// Brain database access (read-only, schema-gated) for embedders adding
+// their own readers.
+export {
+  openBrainDb,
+  withBrainDb,
+  BrainDbUnavailableError,
+  MIN_BRAIN_SCHEMA_VERSION,
+} from "./db/brain-db.js";
 
 // WebSocket internals for embedders and tests.
+export { WsHost, type WsHostOptions } from "./ws/host.js";
+export { createWsUpgrade, websocket } from "./ws/connection.js";
+export { handleClientMessage } from "./ws/dispatch.js";
+export { resolveTurnTarget } from "./ws/routing.js";
 export {
-  WsHost,
-  type WsHostOptions,
-  defaultWsHost,
-  configureWsHost,
-  handleClientMessage,
-  resetForTests,
-  resolveTurnTarget,
   createSessionCatalog,
   type SessionCatalog,
-} from "./ws/handler.js";
+} from "./ws/session-catalog.js";
 
 // Brain repo access (spawned CLI wrapper) — useful for embedders that add
 // their own routes on top.
-export * as brainClient from "./brain/client.js";
+export { createBrainClient, type BrainClient } from "./brain/client.js";
 
 // Share staging: a deployment can sweep expired staging dirs at boot; the
 // intake route also sweeps opportunistically on every share.
 export { pruneShareStaging, shareStagingRoot } from "./share/staging.js";
 
 // Voice keyterm cache rebuild (used by deployments after `brain sync`).
-export { buildKeyterms, writeCache } from "./voice/keyterm-builder.js";
+export {
+  buildKeyterms,
+  writeCache,
+  type KeytermSettings,
+} from "./voice/keyterm-builder.js";

package/src/middleware/auth.ts

@@ -2,6 +2,7 @@ import { Hono } from "hono";
 import type { Context, MiddlewareHandler } from "hono";
 import { getSignedCookie, setSignedCookie, deleteCookie } from "hono/cookie";
 import { isTailscaleAllowed, clientIp } from "./tailscale.js";
+import type { AuthConfig } from "../config/env.js";
 
 /**
  * Authentication for a remote surface to an agent with write access to the
@@ -20,10 +21,21 @@ import { isTailscaleAllowed, clientIp } from "./tailscale.js";
  *                 explicit BRAIN_UI_DANGEROUSLY_DISABLE_AUTH=1 escape hatch.
  *
  * Default: `password` when BRAIN_UI_PASSWORD_HASH is set, else `tailscale`.
+ *
+ * All configuration is injected as the resolved {@link AuthRuntime} — this
+ * module never reads the environment, so two apps with different auth
+ * configuration can coexist and tests vary it without global mutation. The
+ * validation semantics themselves are unchanged.
  */
 
 export type AuthMode = "password" | "tailscale" | "proxy" | "none";
 
+/** What the auth layer needs from the resolved server config. */
+export interface AuthRuntime extends AuthConfig {
+  /** Bind host, for the loopback check on AUTH_MODE=none. */
+  host: string;
+}
+
 const COOKIE_NAME = "brain_ui_session";
 const SESSION_TTL_SECONDS = 30 * 24 * 60 * 60; // 30 days
 export const LOGIN_RATE_LIMIT = 5; // attempts per window, per client IP
@@ -35,22 +47,15 @@ const LOGIN_RATE_WINDOW_MS = 60_000; // per minute
 // verify cost, makes online guessing infeasible without being a lockout an
 // attacker could weaponize to deny the owner access.
 export const GLOBAL_LOGIN_RATE_LIMIT = 20; // attempts per window, all IPs combined
-const DEFAULT_PROXY_HEADER = "x-forwarded-user";
 
-export function resolveAuthMode(): AuthMode {
-  const explicit = process.env.AUTH_MODE?.trim().toLowerCase();
-  if (
-    explicit === "password" ||
-    explicit === "tailscale" ||
-    explicit === "proxy" ||
-    explicit === "none"
-  ) {
-    return explicit;
-  }
-  if (explicit) {
-    console.warn(`[auth] Unknown AUTH_MODE="${explicit}"; auto-detecting instead.`);
+export function resolveAuthMode(auth: AuthRuntime): AuthMode {
+  if (auth.mode) return auth.mode;
+  if (auth.invalidMode) {
+    console.warn(
+      `[auth] Unknown AUTH_MODE="${auth.invalidMode}"; auto-detecting instead.`
+    );
   }
-  if (process.env.BRAIN_UI_PASSWORD_HASH) return "password";
+  if (auth.passwordHash) return "password";
   return "tailscale";
 }
 
@@ -58,18 +63,18 @@ export function resolveAuthMode(): AuthMode {
  * Validate the auth configuration at startup. Throws (refusing to boot) on an
  * unsafe or unusable configuration.
  */
-export function assertAuthConfig(mode: AuthMode): void {
-  const host = process.env.HOST ?? "";
+export function assertAuthConfig(mode: AuthMode, auth: AuthRuntime): void {
+  const host = auth.host;
   const loopback = host === "127.0.0.1" || host === "::1" || host === "localhost";
 
   if (mode === "password") {
-    if (!process.env.BRAIN_UI_PASSWORD_HASH) {
+    if (!auth.passwordHash) {
       throw new Error(
         "AUTH_MODE=password requires BRAIN_UI_PASSWORD_HASH. Generate one with:\n" +
           "  bun -e 'console.log(await Bun.password.hash(process.argv[1]))' 'your-password'"
       );
     }
-    if (!process.env.COOKIE_SECRET) {
+    if (!auth.cookieSecret) {
       throw new Error(
         "AUTH_MODE=password requires COOKIE_SECRET (a long random string used to " +
           "sign the session cookie). Generate one with:\n  openssl rand -hex 32"
@@ -81,7 +86,7 @@ export function assertAuthConfig(mode: AuthMode): void {
   // difference between "auth required" and "agent with file-write access
   // exposed to the network".
   if (mode === "none" && !loopback) {
-    if (process.env.BRAIN_UI_DANGEROUSLY_DISABLE_AUTH === "1") {
+    if (auth.dangerouslyDisableAuth) {
       console.warn(
         "[auth] AUTH_MODE=none on a non-loopback host, allowed by " +
           "BRAIN_UI_DANGEROUSLY_DISABLE_AUTH=1 — every network peer has full " +
@@ -100,7 +105,7 @@ export function assertAuthConfig(mode: AuthMode): void {
   }
 
   if (mode === "proxy") {
-    if (process.env.TRUST_PROXY !== "1") {
+    if (!auth.trustProxy) {
       throw new Error(
         "AUTH_MODE=proxy requires TRUST_PROXY=1 — the proxy-auth header is only " +
           "trustworthy when a fronting proxy is guaranteed to set it and strip " +
@@ -108,7 +113,7 @@ export function assertAuthConfig(mode: AuthMode): void {
       );
     }
     console.log(
-      `[auth] mode: proxy (trusting header "${proxyHeaderName()}"; ensure your ` +
+      `[auth] mode: proxy (trusting header "${auth.proxyAuthHeader}"; ensure your ` +
         "upstream proxy sets it and strips any client-supplied copy)"
     );
     return;
@@ -117,11 +122,11 @@ export function assertAuthConfig(mode: AuthMode): void {
 }
 
 /** Middleware guarding /api/* according to the resolved mode. */
-export function authGuard(mode: AuthMode): MiddlewareHandler {
+export function authGuard(mode: AuthMode, auth: AuthRuntime): MiddlewareHandler {
   switch (mode) {
     case "tailscale":
       return async (c, next) => {
-        if (isTailscaleAllowed(c, process.env.TRUST_PROXY === "1")) {
+        if (isTailscaleAllowed(c, auth.trustProxy, auth.trustProxyHops)) {
           await next();
         } else {
           return c.json({ error: "VPN access required" }, 403);
@@ -129,7 +134,7 @@ export function authGuard(mode: AuthMode): MiddlewareHandler {
       };
     case "proxy":
       return async (c, next) => {
-        if (hasProxyAuth(c)) {
+        if (hasProxyAuth(c, auth)) {
           await next();
         } else {
           return c.json(
@@ -140,7 +145,7 @@ export function authGuard(mode: AuthMode): MiddlewareHandler {
       };
     case "password":
       return async (c, next) => {
-        if (await hasValidSession(c)) {
+        if (await hasValidSession(c, auth)) {
           await next();
         } else {
           return c.json(
@@ -163,16 +168,20 @@ export function authGuard(mode: AuthMode): MiddlewareHandler {
  * middleware may sit on the WS route (immutable-header errors). Mirrors
  * {@link authGuard} without emitting a response.
  */
-export async function isWsAuthorized(c: Context, mode: AuthMode): Promise<boolean> {
+export async function isWsAuthorized(
+  c: Context,
+  mode: AuthMode,
+  auth: AuthRuntime
+): Promise<boolean> {
   switch (mode) {
     case "none":
       return true;
     case "tailscale":
-      return isTailscaleAllowed(c, process.env.TRUST_PROXY === "1");
+      return isTailscaleAllowed(c, auth.trustProxy, auth.trustProxyHops);
     case "proxy":
-      return hasProxyAuth(c);
+      return hasProxyAuth(c, auth);
     case "password":
-      return hasValidSession(c);
+      return hasValidSession(c, auth);
   }
 }
 
@@ -183,8 +192,8 @@ export async function isWsAuthorized(c: Context, mode: AuthMode): Promise<boolea
  * both password login and passkey login (middleware/passkeys.ts) call this, so
  * authGuard / isWsAuthorized / TTL semantics stay identical across methods.
  */
-export async function issueSessionCookie(c: Context): Promise<void> {
-  const secret = process.env.COOKIE_SECRET ?? "";
+export async function issueSessionCookie(c: Context, auth: AuthRuntime): Promise<void> {
+  const secret = auth.cookieSecret ?? "";
   await setSignedCookie(c, COOKIE_NAME, String(Date.now()), secret, {
     httpOnly: true,
     sameSite: "Strict",
@@ -197,8 +206,8 @@ export async function issueSessionCookie(c: Context): Promise<void> {
   });
 }
 
-async function hasValidSession(c: Context): Promise<boolean> {
-  const secret = process.env.COOKIE_SECRET ?? "";
+async function hasValidSession(c: Context, auth: AuthRuntime): Promise<boolean> {
+  const secret = auth.cookieSecret ?? "";
   if (!secret) return false;
   try {
     const value = await getSignedCookie(c, secret, COOKIE_NAME);
@@ -217,17 +226,13 @@ async function hasValidSession(c: Context): Promise<boolean> {
 
 // --- proxy mode helpers ---
 
-function proxyHeaderName(): string {
-  return (process.env.PROXY_AUTH_HEADER || DEFAULT_PROXY_HEADER).toLowerCase();
-}
-
-function hasProxyAuth(c: Context): boolean {
+function hasProxyAuth(c: Context, auth: AuthRuntime): boolean {
   // The proxy-auth header is only meaningful when a trusted proxy fronts the app
   // and TRUST_PROXY says so; otherwise a client could set it directly. Gate on
-  // TRUST_PROXY, consistent with tailscale-mode XFF trust. (assertAuthConfig
+  // trustProxy, consistent with tailscale-mode XFF trust. (assertAuthConfig
   // already refuses to boot proxy mode without it — this is belt-and-braces.)
-  if (process.env.TRUST_PROXY !== "1") return false;
-  const user = c.req.header(proxyHeaderName());
+  if (!auth.trustProxy) return false;
+  const user = c.req.header(auth.proxyAuthHeader);
   return !!user && user.trim().length > 0;
 }
 
@@ -259,6 +264,7 @@ export function consumeLoginToken(key: string, limit: number): boolean {
 /** Login/logout routes. Only functional in `password` mode. */
 export function authRoutes(
   mode: AuthMode,
+  auth: AuthRuntime,
   deps: {
     /**
      * When provided and returning true, password login is refused (the app
@@ -276,7 +282,7 @@ export function authRoutes(
       return c.json({ error: "Password login is not enabled" }, 400);
     }
 
-    const key = clientIp(c, process.env.TRUST_PROXY === "1") || "unknown";
+    const key = clientIp(c, auth.trustProxy, auth.trustProxyHops) || "unknown";
     const perIpOk = consumeLoginToken(`ip:${key}`, LOGIN_RATE_LIMIT);
     const globalOk = consumeLoginToken("global", GLOBAL_LOGIN_RATE_LIMIT);
     if (!perIpOk || !globalOk) {
@@ -290,8 +296,8 @@ export function authRoutes(
       );
     }
 
-    const hash = process.env.BRAIN_UI_PASSWORD_HASH ?? "";
-    const secret = process.env.COOKIE_SECRET ?? "";
+    const hash = auth.passwordHash ?? "";
+    const secret = auth.cookieSecret ?? "";
     let body: { password?: unknown };
     try {
       body = await c.req.json();
@@ -308,7 +314,7 @@ export function authRoutes(
       return c.json({ error: "Invalid credentials" }, 401);
     }
 
-    await issueSessionCookie(c);
+    await issueSessionCookie(c, auth);
     return c.json({ ok: true });
   });
 

package/src/middleware/origin.ts

@@ -13,14 +13,7 @@ import type { Context } from "hono";
  * The check is free because the routes that use it are only ever called by the
  * app itself, same-origin. Same shape as the WebSocket upgrade's origin guard.
  */
-export function allowedOriginList(): string[] {
-  return (process.env.ALLOWED_ORIGINS ?? "")
-    .split(",")
-    .map((origin) => origin.trim())
-    .filter(Boolean);
-}
-
-export function isSameOriginRequest(c: Context, allowed = allowedOriginList()): boolean {
+export function isSameOriginRequest(c: Context, allowed: string[]): boolean {
   // Chromium and Firefox send this, and it is not settable by script.
   const site = c.req.header("sec-fetch-site");
   if (site) return site === "same-origin" || site === "none";