@schlessera/brain-ui-server 0.4.0

package/dist/middleware/auth.js

@@ -0,0 +1,246 @@
+import { Hono } from "hono";
+import { getSignedCookie, setSignedCookie, deleteCookie } from "hono/cookie";
+import { isTailscaleAllowed, clientIp } from "./tailscale.js";
+const COOKIE_NAME = "brain_ui_session";
+const SESSION_TTL_SECONDS = 30 * 24 * 60 * 60; // 30 days
+export const LOGIN_RATE_LIMIT = 5; // attempts per window, per client IP
+const LOGIN_RATE_WINDOW_MS = 60_000; // per minute
+// A global cap in addition to the per-IP one: the per-IP key is derived from
+// X-Forwarded-For, which a client behind a trusted proxy can rotate to mint a
+// fresh bucket per request. The global cap bounds brute force across rotated
+// IPs. It stays well above a human's needs and, combined with the argon2id
+// verify cost, makes online guessing infeasible without being a lockout an
+// attacker could weaponize to deny the owner access.
+export const GLOBAL_LOGIN_RATE_LIMIT = 20; // attempts per window, all IPs combined
+const DEFAULT_PROXY_HEADER = "x-forwarded-user";
+export function resolveAuthMode() {
+    const explicit = process.env.AUTH_MODE?.trim().toLowerCase();
+    if (explicit === "password" ||
+        explicit === "tailscale" ||
+        explicit === "proxy" ||
+        explicit === "none") {
+        return explicit;
+    }
+    if (explicit) {
+        console.warn(`[auth] Unknown AUTH_MODE="${explicit}"; auto-detecting instead.`);
+    }
+    if (process.env.BRAIN_UI_PASSWORD_HASH)
+        return "password";
+    return "tailscale";
+}
+/**
+ * Validate the auth configuration at startup. Throws (refusing to boot) on an
+ * unsafe or unusable configuration.
+ */
+export function assertAuthConfig(mode) {
+    const host = process.env.HOST ?? "";
+    const loopback = host === "127.0.0.1" || host === "::1" || host === "localhost";
+    if (mode === "password") {
+        if (!process.env.BRAIN_UI_PASSWORD_HASH) {
+            throw new Error("AUTH_MODE=password requires BRAIN_UI_PASSWORD_HASH. Generate one with:\n" +
+                "  bun -e 'console.log(await Bun.password.hash(process.argv[1]))' 'your-password'");
+        }
+        if (!process.env.COOKIE_SECRET) {
+            throw new Error("AUTH_MODE=password requires COOKIE_SECRET (a long random string used to " +
+                "sign the session cookie). Generate one with:\n  openssl rand -hex 32");
+        }
+    }
+    // Deliberately NOT gated on NODE_ENV: a forgotten env var must never be the
+    // difference between "auth required" and "agent with file-write access
+    // exposed to the network".
+    if (mode === "none" && !loopback) {
+        if (process.env.BRAIN_UI_DANGEROUSLY_DISABLE_AUTH === "1") {
+            console.warn("[auth] AUTH_MODE=none on a non-loopback host, allowed by " +
+                "BRAIN_UI_DANGEROUSLY_DISABLE_AUTH=1 — every network peer has full " +
+                "agent access. Do not run this on anything but a trusted network.");
+        }
+        else {
+            throw new Error("AUTH_MODE=none refuses to start unless HOST is loopback " +
+                `(got HOST="${host}"). Running with no auth would expose an agent with ` +
+                "write access to your files to the whole network. Set AUTH_MODE=password " +
+                "(recommended), tailscale, or proxy — or bind HOST to 127.0.0.1. " +
+                "To intentionally run unauthenticated on a trusted network, set " +
+                "BRAIN_UI_DANGEROUSLY_DISABLE_AUTH=1.");
+        }
+    }
+    if (mode === "proxy") {
+        if (process.env.TRUST_PROXY !== "1") {
+            throw new Error("AUTH_MODE=proxy requires TRUST_PROXY=1 — the proxy-auth header is only " +
+                "trustworthy when a fronting proxy is guaranteed to set it and strip " +
+                "any client-supplied copy. Set TRUST_PROXY=1 once that holds.");
+        }
+        console.log(`[auth] mode: proxy (trusting header "${proxyHeaderName()}"; ensure your ` +
+            "upstream proxy sets it and strips any client-supplied copy)");
+        return;
+    }
+    console.log(`[auth] mode: ${mode}`);
+}
+/** Middleware guarding /api/* according to the resolved mode. */
+export function authGuard(mode) {
+    switch (mode) {
+        case "tailscale":
+            return async (c, next) => {
+                if (isTailscaleAllowed(c, process.env.TRUST_PROXY === "1")) {
+                    await next();
+                }
+                else {
+                    return c.json({ error: "VPN access required" }, 403);
+                }
+            };
+        case "proxy":
+            return async (c, next) => {
+                if (hasProxyAuth(c)) {
+                    await next();
+                }
+                else {
+                    return c.json({ error: "Authentication required", authRequired: true }, 401);
+                }
+            };
+        case "password":
+            return async (c, next) => {
+                if (await hasValidSession(c)) {
+                    await next();
+                }
+                else {
+                    return c.json({ error: "Authentication required", authRequired: true }, 401);
+                }
+            };
+        case "none":
+            return async (_c, next) => {
+                await next();
+            };
+    }
+}
+/**
+ * Authorize a WebSocket upgrade. The upgrade handler must call this itself —
+ * browsers can't set headers on the WS handshake, so the session cookie (sent
+ * automatically same-origin) is the credential, and no header-modifying
+ * middleware may sit on the WS route (immutable-header errors). Mirrors
+ * {@link authGuard} without emitting a response.
+ */
+export async function isWsAuthorized(c, mode) {
+    switch (mode) {
+        case "none":
+            return true;
+        case "tailscale":
+            return isTailscaleAllowed(c, process.env.TRUST_PROXY === "1");
+        case "proxy":
+            return hasProxyAuth(c);
+        case "password":
+            return hasValidSession(c);
+    }
+}
+// --- password mode helpers ---
+/**
+ * Mint the session cookie. The single place a session comes into existence —
+ * both password login and passkey login (middleware/passkeys.ts) call this, so
+ * authGuard / isWsAuthorized / TTL semantics stay identical across methods.
+ */
+export async function issueSessionCookie(c) {
+    const secret = process.env.COOKIE_SECRET ?? "";
+    await setSignedCookie(c, COOKIE_NAME, String(Date.now()), secret, {
+        httpOnly: true,
+        sameSite: "Strict",
+        // Always Secure — every real deployment serves over HTTPS, and we do not
+        // want a missing NODE_ENV to silently drop the flag and expose the cookie
+        // over plaintext. (Local password testing must use https/localhost.)
+        secure: true,
+        path: "/",
+        maxAge: SESSION_TTL_SECONDS,
+    });
+}
+async function hasValidSession(c) {
+    const secret = process.env.COOKIE_SECRET ?? "";
+    if (!secret)
+        return false;
+    try {
+        const value = await getSignedCookie(c, secret, COOKIE_NAME);
+        if (typeof value !== "string" || value.length === 0)
+            return false;
+        // The cookie value is the issue timestamp. Validate its age server-side:
+        // Max-Age is client-discardable, so the signature alone does not bound a
+        // session's lifetime — this does.
+        const issuedAt = Number(value);
+        if (!Number.isFinite(issuedAt))
+            return false;
+        const ageSeconds = (Date.now() - issuedAt) / 1000;
+        return ageSeconds >= 0 && ageSeconds < SESSION_TTL_SECONDS;
+    }
+    catch {
+        return false;
+    }
+}
+// --- proxy mode helpers ---
+function proxyHeaderName() {
+    return (process.env.PROXY_AUTH_HEADER || DEFAULT_PROXY_HEADER).toLowerCase();
+}
+function hasProxyAuth(c) {
+    // The proxy-auth header is only meaningful when a trusted proxy fronts the app
+    // and TRUST_PROXY says so; otherwise a client could set it directly. Gate on
+    // TRUST_PROXY, consistent with tailscale-mode XFF trust. (assertAuthConfig
+    // already refuses to boot proxy mode without it — this is belt-and-braces.)
+    if (process.env.TRUST_PROXY !== "1")
+        return false;
+    const user = c.req.header(proxyHeaderName());
+    return !!user && user.trim().length > 0;
+}
+const loginBuckets = new Map();
+/** Test-only: clear all rate-limit buckets (they are module-global state). */
+export function resetLoginRateLimiter() {
+    loginBuckets.clear();
+}
+export function consumeLoginToken(key, limit) {
+    const now = Date.now();
+    let bucket = loginBuckets.get(key);
+    if (!bucket || now >= bucket.resetAt) {
+        bucket = { tokens: limit, resetAt: now + LOGIN_RATE_WINDOW_MS };
+        loginBuckets.set(key, bucket);
+    }
+    if (bucket.tokens <= 0)
+        return false;
+    bucket.tokens--;
+    return true;
+}
+/** Login/logout routes. Only functional in `password` mode. */
+export function authRoutes(mode, deps = {}) {
+    const app = new Hono();
+    app.post("/auth/login", async (c) => {
+        if (mode !== "password") {
+            return c.json({ error: "Password login is not enabled" }, 400);
+        }
+        const key = clientIp(c, process.env.TRUST_PROXY === "1") || "unknown";
+        const perIpOk = consumeLoginToken(`ip:${key}`, LOGIN_RATE_LIMIT);
+        const globalOk = consumeLoginToken("global", GLOBAL_LOGIN_RATE_LIMIT);
+        if (!perIpOk || !globalOk) {
+            return c.json({ error: "Too many attempts. Try again in a minute." }, 429);
+        }
+        if (deps.passwordDisabled?.(c)) {
+            return c.json({ error: "Password login is disabled — sign in with a passkey." }, 403);
+        }
+        const hash = process.env.BRAIN_UI_PASSWORD_HASH ?? "";
+        const secret = process.env.COOKIE_SECRET ?? "";
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            return c.json({ error: "Invalid request body" }, 400);
+        }
+        const password = typeof body.password === "string" ? body.password : "";
+        if (!password || !hash || !secret) {
+            return c.json({ error: "Invalid credentials" }, 401);
+        }
+        const ok = await Bun.password.verify(password, hash).catch(() => false);
+        if (!ok) {
+            return c.json({ error: "Invalid credentials" }, 401);
+        }
+        await issueSessionCookie(c);
+        return c.json({ ok: true });
+    });
+    app.post("/auth/logout", (c) => {
+        deleteCookie(c, COOKIE_NAME, { path: "/" });
+        return c.json({ ok: true });
+    });
+    return app;
+}
+//# sourceMappingURL=auth.js.map

package/dist/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAuB9D,MAAM,WAAW,GAAG,kBAAkB,CAAC;AACvC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,CAAC,qCAAqC;AACxE,MAAM,oBAAoB,GAAG,MAAM,CAAC,CAAC,aAAa;AAClD,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,qDAAqD;AACrD,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC,CAAC,wCAAwC;AACnF,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEhD,MAAM,UAAU,eAAe;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7D,IACE,QAAQ,KAAK,UAAU;QACvB,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,MAAM,EACnB,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,6BAA6B,QAAQ,4BAA4B,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAAE,OAAO,UAAU,CAAC;IAC1D,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAc;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC;IAEhF,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,0EAA0E;gBACxE,kFAAkF,CACrF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,0EAA0E;gBACxE,sEAAsE,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,2BAA2B;IAC3B,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,GAAG,CAAC,iCAAiC,KAAK,GAAG,EAAE,CAAC;YAC1D,OAAO,CAAC,IAAI,CACV,2DAA2D;gBACzD,oEAAoE;gBACpE,kEAAkE,CACrE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,0DAA0D;gBACxD,cAAc,IAAI,sDAAsD;gBACxE,0EAA0E;gBAC1E,kEAAkE;gBAClE,iEAAiE;gBACjE,sCAAsC,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,yEAAyE;gBACvE,sEAAsE;gBACtE,8DAA8D,CACjE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CACT,wCAAwC,eAAe,EAAE,iBAAiB;YACxE,6DAA6D,CAChE,CAAC;QACF,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,WAAW;YACd,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,kBAAkB,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,EAAE,CAAC;oBAC3D,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC,CAAC;QACJ,KAAK,OAAO;YACV,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpB,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,IAAI,EAAE,EACxD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,MAAM,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,IAAI,EAAE,EACxD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;QACJ,KAAK,MAAM;YACT,OAAO,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;gBACxB,MAAM,IAAI,EAAE,CAAC;YACf,CAAC,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,CAAU,EAAE,IAAc;IAC7D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;QACd,KAAK,WAAW;YACd,OAAO,kBAAkB,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC;QAChE,KAAK,OAAO;YACV,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;QACzB,KAAK,UAAU;YACb,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,gCAAgC;AAEhC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,CAAU;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IAC/C,MAAM,eAAe,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE;QAChE,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,QAAQ;QAClB,yEAAyE;QACzE,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,mBAAmB;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,CAAU;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,yEAAyE;QACzE,yEAAyE;QACzE,kCAAkC;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7C,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC;QAClD,OAAO,UAAU,IAAI,CAAC,IAAI,UAAU,GAAG,mBAAmB,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,6BAA6B;AAE7B,SAAS,eAAe;IACtB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,oBAAoB,CAAC,CAAC,WAAW,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,YAAY,CAAC,CAAU;IAC9B,+EAA+E;IAC/E,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC1C,CAAC;AAQD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE/C,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB;IACnC,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,KAAa;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,oBAAoB,EAAE,CAAC;QAChE,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,CAAC,MAAM,EAAE,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,UAAU,CACxB,IAAc,EACd,OAQI,EAAE;IAEN,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,IAAI,SAAS,CAAC;QACtE,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,GAAG,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,sDAAsD,EAAE,EACjE,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;QAC/C,IAAI,IAA4B,CAAC;QACjC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE;QAC7B,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/middleware/passkeys.d.ts

@@ -0,0 +1,36 @@
+import { Hono } from "hono";
+import type { Context } from "hono";
+import { verifyAuthenticationResponse as realVerifyAuthentication, verifyRegistrationResponse as realVerifyRegistration } from "@simplewebauthn/server";
+import { type AuthMode } from "./auth.js";
+/**
+ * Refuse to boot on a WebAuthn user handle the browser would reject. Called
+ * from createApp(): an oversized handle otherwise produces registration
+ * options that look fine server-side and fail silently in every browser.
+ */
+export declare function assertPasskeyConfig(): void;
+/** Injectable seams for tests; production callers pass nothing. */
+export interface PasskeyDeps {
+    verifyRegistrationResponse?: typeof realVerifyRegistration;
+    verifyAuthenticationResponse?: typeof realVerifyAuthentication;
+    now?: () => number;
+}
+/**
+ * Once a passkey exists for the request's RP, password login is disabled —
+ * the password becomes registration-bootstrap and break-glass recovery only
+ * (set BRAIN_UI_ALLOW_PASSWORD=1 to re-enable it, e.g. after losing every
+ * authenticator). Scoped per RP so e.g. localhost dev keeps password login
+ * until it has its own credential. Host-derived rpID is fine here: a forged
+ * Host can at most re-enable password auth, which still requires the password.
+ */
+export declare function passwordLoginDisabled(c: Context): boolean;
+/**
+ * Unauthenticated passkey routes. Mount BEFORE the auth guard, next to
+ * authRoutes.
+ */
+export declare function passkeyPublicRoutes(mode: AuthMode, deps?: PasskeyDeps): Hono;
+/**
+ * Session-gated passkey routes. Mount AFTER the auth guard — gating comes from
+ * mount position, not per-route checks.
+ */
+export declare function passkeyManagementRoutes(mode: AuthMode, deps?: PasskeyDeps): Hono;
+//# sourceMappingURL=passkeys.d.ts.map

package/dist/middleware/passkeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeys.d.ts","sourceRoot":"","sources":["../../src/middleware/passkeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAGL,4BAA4B,IAAI,wBAAwB,EACxD,0BAA0B,IAAI,sBAAsB,EACrD,MAAM,wBAAwB,CAAC;AAMhC,OAAO,EACL,KAAK,QAAQ,EAKd,MAAM,WAAW,CAAC;AAkDnB;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAQ1C;AAQD,mEAAmE;AACnE,MAAM,WAAW,WAAW;IAC1B,0BAA0B,CAAC,EAAE,OAAO,sBAAsB,CAAC;IAC3D,4BAA4B,CAAC,EAAE,OAAO,wBAAwB,CAAC;IAC/D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAkKD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAMzD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,GAAE,WAAgB,GAAG,IAAI,CAqGhF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,GAAE,WAAgB,GAAG,IAAI,CA6HpF"}