@shamar/adonis 0.1.3 → 0.1.4

package/dist/auth/ldap.js

@@ -0,0 +1,275 @@
+import { mapGroupsToRoleIds, parseLdapUsername, } from '@shamar/cherubim';
+export const LDAP_TIMEOUT_MESSAGE = 'Directory server timed out. Please try again.';
+/** Thrown / rethrown when ldapts (or the network) times out contacting a domain. */
+export class LdapTimeoutError extends Error {
+    domainId;
+    constructor(domainId, cause) {
+        const detail = cause instanceof Error && cause.message.trim()
+            ? cause.message.trim()
+            : 'operation timed out';
+        super(`LDAP domain "${domainId}" timed out: ${detail}`);
+        this.name = 'LdapTimeoutError';
+        this.domainId = domainId;
+        if (cause !== undefined) {
+            this.cause = cause;
+        }
+    }
+}
+export function isLdapTimeoutError(error) {
+    if (error instanceof LdapTimeoutError)
+        return true;
+    if (!error || typeof error !== 'object')
+        return false;
+    const err = error;
+    const code = String(err.code ?? '').toUpperCase();
+    if (code === 'ETIMEDOUT' || code === 'TIMEOUT' || code === 'ECONNABORTED') {
+        return true;
+    }
+    const name = String(err.name ?? '');
+    if (/timeout/i.test(name))
+        return true;
+    const message = String(err.message ?? '').toLowerCase();
+    return (message.includes('timed out') ||
+        message.includes('timeout') ||
+        message.includes('connect timeout'));
+}
+export function resolveLdapProvisioning(mode) {
+    return mode === 'create' ? 'create' : 'existing';
+}
+export function resolveAuthLoginMode(mode, domains) {
+    if (mode === 'local' || mode === 'ldap' || mode === 'both')
+        return mode;
+    return domains?.length ? 'both' : 'local';
+}
+/**
+ * Order domains: hinted matches first, then remaining config order.
+ */
+export function orderLdapDomains(usernameInput, domains) {
+    const parsed = parseLdapUsername(usernameInput);
+    const preferred = [];
+    const rest = [];
+    for (const domain of domains) {
+        let match = false;
+        if (parsed.netbios && domain.netbios) {
+            match = domain.netbios.toUpperCase() === parsed.netbios.toUpperCase();
+        }
+        if (!match && parsed.emailDomain && domain.emailDomains?.length) {
+            const needle = parsed.emailDomain.toLowerCase();
+            match = domain.emailDomains.some((d) => d.toLowerCase() === needle);
+        }
+        if (match)
+            preferred.push(domain);
+        else
+            rest.push(domain);
+    }
+    return [...preferred, ...rest];
+}
+export function searchUsernameForDomain(usernameInput, _domain) {
+    const parsed = parseLdapUsername(usernameInput);
+    return parsed.username || usernameInput.trim();
+}
+/**
+ * Try domains in order until one authenticates.
+ * Returns `{ identity: null }` when none succeed (caller decides local fallback).
+ * Sets `timedOut` when any domain attempt hit a connect/operation timeout.
+ */
+export async function authenticateLdap(usernameInput, password, domains, client) {
+    if (!password || !usernameInput.trim() || domains.length === 0) {
+        return { identity: null, timedOut: false };
+    }
+    const ordered = orderLdapDomains(usernameInput, domains);
+    let timedOut = false;
+    for (const domain of ordered) {
+        const username = searchUsernameForDomain(usernameInput, domain);
+        try {
+            const identity = await client.authenticate(username, password, domain);
+            if (identity)
+                return { identity, timedOut };
+        }
+        catch (error) {
+            if (isLdapTimeoutError(error)) {
+                timedOut = true;
+                console.warn(`[shamar/ldap] domain "${domain.id}" timed out:`, error instanceof Error ? error.message : error);
+                continue;
+            }
+            // Unreachable / misconfigured domain — try the next one.
+            console.warn(`[shamar/ldap] domain "${domain.id}" failed:`, error instanceof Error ? error.message : error);
+        }
+    }
+    return { identity: null, timedOut };
+}
+/**
+ * Orchestrate local / LDAP / both login modes.
+ *
+ * After a successful directory bind, {@link linkFromLdap} must resolve a local
+ * user (matched by sync UID / externalId). When `provisioning` is `existing`
+ * and no local row exists, LDAP login fails (or falls through to local when
+ * `loginMode` is `both`).
+ */
+export async function resolvePasswordLogin(options) {
+    const mode = resolveAuthLoginMode(options.loginMode, options.domains);
+    const domains = options.domains ?? [];
+    const provisioning = resolveLdapProvisioning(options.provisioning);
+    if (mode === 'local') {
+        const user = await options.verifyLocal(options.username, options.password);
+        if (!user)
+            return { ok: false, message: 'Invalid user credentials' };
+        return { ok: true, user, method: 'local' };
+    }
+    if (domains.length === 0) {
+        return {
+            ok: false,
+            message: 'LDAP login is enabled but no domains are configured',
+        };
+    }
+    const { identity, timedOut } = await authenticateLdap(options.username, options.password, domains, options.client);
+    if (identity) {
+        const user = await options.linkFromLdap(identity);
+        if (user) {
+            return { ok: true, user, method: 'ldap' };
+        }
+        if (provisioning === 'existing') {
+            // Bound in LDAP but no local sync row — do not invent a user.
+            if (mode === 'ldap') {
+                return {
+                    ok: false,
+                    message: 'No local account is linked to this directory user',
+                };
+            }
+            // both: fall through to local password check
+        }
+        else {
+            // create mode with null link is a host bug
+            return {
+                ok: false,
+                message: 'Unable to provision local account for directory user',
+            };
+        }
+    }
+    if (mode === 'ldap') {
+        if (timedOut) {
+            return { ok: false, message: LDAP_TIMEOUT_MESSAGE, code: 'ldap_timeout' };
+        }
+        return { ok: false, message: 'Invalid user credentials' };
+    }
+    // both → local fallback (also when LDAP user is not linked locally)
+    const user = await options.verifyLocal(options.username, options.password);
+    if (user)
+        return { ok: true, user, method: 'local' };
+    if (timedOut) {
+        return { ok: false, message: LDAP_TIMEOUT_MESSAGE, code: 'ldap_timeout' };
+    }
+    return { ok: false, message: 'Invalid user credentials' };
+}
+/** Apply domain groupRoleMap to an identity's groups. */
+export function roleIdsFromLdapIdentity(identity, domain) {
+    return mapGroupsToRoleIds(identity.groups, domain.groupRoleMap ?? {});
+}
+function attrValue(entry, name) {
+    const raw = entry[name] ?? entry[name.toLowerCase()];
+    if (raw == null)
+        return undefined;
+    if (Array.isArray(raw)) {
+        const first = raw[0];
+        return first != null ? String(first) : undefined;
+    }
+    return String(raw);
+}
+function attrValues(entry, name) {
+    const raw = entry[name] ?? entry[name.toLowerCase()];
+    if (raw == null)
+        return [];
+    if (Array.isArray(raw)) {
+        return raw
+            .filter((item) => item != null && String(item).trim() !== '')
+            .map((item) => String(item));
+    }
+    const value = String(raw).trim();
+    return value ? [value] : [];
+}
+function buildSearchFilter(template, username) {
+    const escaped = username.replace(/[\\*()]/g, (ch) => `\\${ch}`);
+    return template.replaceAll('{{username}}', escaped);
+}
+/**
+ * Default ldapts-backed client. Requires the optional `ldapts` peer dependency.
+ */
+export function createLdaptsDirectoryClient() {
+    return {
+        async authenticate(username, password, domain) {
+            let Client;
+            try {
+                ({ Client } = await import('ldapts'));
+            }
+            catch {
+                throw new Error('LDAP login requires the optional peer dependency "ldapts". Install it in your app.');
+            }
+            const timeout = domain.timeoutMs ?? 10_000;
+            const client = new Client({
+                url: domain.url,
+                timeout,
+                connectTimeout: domain.connectTimeoutMs ?? timeout,
+                tlsOptions: domain.tls,
+            });
+            try {
+                if (domain.bindDn) {
+                    await client.bind(domain.bindDn, domain.bindPassword ?? '');
+                }
+                const filter = buildSearchFilter(domain.searchFilter || '(uid={{username}})', username);
+                const emailAttr = domain.emailAttribute ?? 'mail';
+                const nameAttr = domain.nameAttribute ?? 'cn';
+                const groupsAttr = domain.groupsAttribute ?? 'memberOf';
+                const { searchEntries } = await client.search(domain.searchBase, {
+                    scope: 'sub',
+                    filter,
+                    attributes: [
+                        'dn',
+                        'distinguishedName',
+                        emailAttr,
+                        nameAttr,
+                        groupsAttr,
+                        'uid',
+                        'sAMAccountName',
+                    ],
+                    sizeLimit: 1,
+                });
+                const entry = searchEntries[0];
+                if (!entry)
+                    return null;
+                const dn = (typeof entry.dn === 'string' && entry.dn) ||
+                    attrValue(entry, 'distinguishedName') ||
+                    attrValue(entry, 'dn');
+                if (!dn)
+                    return null;
+                // Re-bind as the user to verify credentials.
+                await client.bind(dn, password);
+                const groups = attrValues(entry, groupsAttr);
+                return {
+                    provider: 'ldap',
+                    domainId: domain.id,
+                    subject: dn,
+                    username,
+                    email: attrValue(entry, emailAttr),
+                    name: attrValue(entry, nameAttr),
+                    groups,
+                    raw: { ...entry },
+                };
+            }
+            catch (error) {
+                if (isLdapTimeoutError(error)) {
+                    throw new LdapTimeoutError(domain.id, error);
+                }
+                return null;
+            }
+            finally {
+                try {
+                    await client.unbind();
+                }
+                catch {
+                    /* ignore */
+                }
+            }
+        },
+    };
+}
+//# sourceMappingURL=ldap.js.map

package/dist/auth/ldap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ldap.js","sourceRoot":"","sources":["../../src/auth/ldap.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAGlB,MAAM,kBAAkB,CAAC;AA2E1B,MAAM,CAAC,MAAM,oBAAoB,GAAG,+CAA+C,CAAC;AAEpF,oFAAoF;AACpF,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,QAAQ,CAAS;IAE1B,YAAY,QAAgB,EAAE,KAAe;QAC3C,MAAM,MAAM,GACV,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;YAC5C,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;YACtB,CAAC,CAAC,qBAAqB,CAAC;QAC5B,KAAK,CAAC,gBAAgB,QAAQ,gBAAgB,MAAM,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACvB,IAAoC,CAAC,KAAK,GAAG,KAAK,CAAC;QACtD,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,KAAK,YAAY,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEtD,MAAM,GAAG,GAAG,KAA2D,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACpC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACxD,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CACpC,CAAC;AACJ,CAAC;AAQD,MAAM,UAAU,uBAAuB,CACrC,IAAsC;IAEtC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAA+B,EAC/B,OAAuC;IAEvC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACxE,OAAO,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,aAAqB,EACrB,OAA2B;IAE3B,MAAM,MAAM,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAChD,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,MAAM,IAAI,GAAuB,EAAE,CAAC;IAEpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACrC,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;YAChE,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;YAChD,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,KAAK;YAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;;YAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,CAAC,GAAG,SAAS,EAAE,GAAG,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,aAAqB,EACrB,OAAyB;IAEzB,MAAM,MAAM,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,QAAQ,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,QAAgB,EAChB,OAA2B,EAC3B,MAA2B;IAE3B,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvE,IAAI,QAAQ;gBAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,QAAQ,GAAG,IAAI,CAAC;gBAChB,OAAO,CAAC,IAAI,CACV,yBAAyB,MAAM,CAAC,EAAE,cAAc,EAChD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC/C,CAAC;gBACF,SAAS;YACX,CAAC;YACD,yDAAyD;YACzD,OAAO,CAAC,IAAI,CACV,yBAAyB,MAAM,CAAC,EAAE,WAAW,EAC7C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC/C,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAQ,OAcjD;IACC,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,YAAY,GAAG,uBAAuB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAEnE,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC7C,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,qDAAqD;SAC/D,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CACnD,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,QAAQ,EAChB,OAAO,EACP,OAAO,CAAC,MAAM,CACf,CAAC;IAEF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5C,CAAC;QACD,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;YAChC,8DAA8D;YAC9D,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,mDAAmD;iBAC7D,CAAC;YACJ,CAAC;YACD,6CAA6C;QAC/C,CAAC;aAAM,CAAC;YACN,2CAA2C;YAC3C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,sDAAsD;aAChE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAC5E,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IAC5D,CAAC;IAED,oEAAoE;IACpE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAErD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;AAC5D,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,uBAAuB,CAAC,QAA0B,EAAE,MAAwB;IAC1F,OAAO,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,IAAY;IAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACrD,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,UAAU,CAAC,KAA8B,EAAE,IAAY;IAC9D,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACrD,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG;aACP,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;aAC5D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB,EAAE,QAAgB;IAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChE,OAAO,QAAQ,CAAC,UAAU,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM;YAC3C,IAAI,MAAsC,CAAC;YAC3C,IAAI,CAAC;gBACH,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;gBACxB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,OAAO;gBACP,cAAc,EAAE,MAAM,CAAC,gBAAgB,IAAI,OAAO;gBAClD,UAAU,EAAE,MAAM,CAAC,GAAG;aACvB,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;oBAClB,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBAED,MAAM,MAAM,GAAG,iBAAiB,CAC9B,MAAM,CAAC,YAAY,IAAI,oBAAoB,EAC3C,QAAQ,CACT,CAAC;gBACF,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC;gBAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC;gBAC9C,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,IAAI,UAAU,CAAC;gBAExD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE;oBAC/D,KAAK,EAAE,KAAK;oBACZ,MAAM;oBACN,UAAU,EAAE;wBACV,IAAI;wBACJ,mBAAmB;wBACnB,SAAS;wBACT,QAAQ;wBACR,UAAU;wBACV,KAAK;wBACL,gBAAgB;qBACjB;oBACD,SAAS,EAAE,CAAC;iBACb,CAAC,CAAC;gBAEH,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAEhB,CAAC;gBACd,IAAI,CAAC,KAAK;oBAAE,OAAO,IAAI,CAAC;gBAExB,MAAM,EAAE,GACN,CAAC,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC;oBAC1C,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC;oBACrC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACzB,IAAI,CAAC,EAAE;oBAAE,OAAO,IAAI,CAAC;gBAErB,6CAA6C;gBAC7C,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;gBAEhC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;gBAC7C,OAAO;oBACL,QAAQ,EAAE,MAAe;oBACzB,QAAQ,EAAE,MAAM,CAAC,EAAE;oBACnB,OAAO,EAAE,EAAE;oBACX,QAAQ;oBACR,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC;oBAClC,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC;oBAChC,MAAM;oBACN,GAAG,EAAE,EAAE,GAAG,KAAK,EAAE;iBAClB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC9B,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;gBAC/C,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/masquerade.d.ts

@@ -0,0 +1,31 @@
+/** Session flag set after a successful masquerade login. */
+export declare const MASQUERADE_SESSION_KEY = "shamar_masquerade";
+/**
+ * True when a non-empty masquerade password is configured and
+ * `NODE_ENV` is not `production`. Production never activates.
+ */
+export declare function isMasqueradeEnabled(config?: {
+    auth?: {
+        masquerade?: {
+            password?: string;
+        };
+    };
+} | null, env?: NodeJS.ProcessEnv): boolean;
+/** Timing-safe string compare (false when lengths differ or either is empty). */
+export declare function passwordsMatch(provided: string, expected: string): boolean;
+/**
+ * Whether the submitted password matches the configured masquerade
+ * password while masquerade is enabled.
+ */
+export declare function isMasqueradePassword(provided: string, config?: {
+    auth?: {
+        masquerade?: {
+            password?: string;
+        };
+    };
+} | null, env?: NodeJS.ProcessEnv): boolean;
+/** Read the session flag set at masquerade login. */
+export declare function isMasqueradeSession(session: {
+    get?(key: string): unknown;
+}): boolean;
+//# sourceMappingURL=masquerade.d.ts.map

package/dist/auth/masquerade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"masquerade.d.ts","sourceRoot":"","sources":["../../src/auth/masquerade.ts"],"names":[],"mappings":"AAEA,4DAA4D;AAC5D,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAE1D;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,EACjE,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAIT;AAED,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAK1E;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,EACjE,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAIT;AAED,qDAAqD;AACrD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAC3C,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC5B,GAAG,OAAO,CAEV"}

package/dist/auth/masquerade.js

@@ -0,0 +1,36 @@
+import { timingSafeEqual } from 'node:crypto';
+/** Session flag set after a successful masquerade login. */
+export const MASQUERADE_SESSION_KEY = 'shamar_masquerade';
+/**
+ * True when a non-empty masquerade password is configured and
+ * `NODE_ENV` is not `production`. Production never activates.
+ */
+export function isMasqueradeEnabled(config, env = process.env) {
+    if (String(env.NODE_ENV ?? '').toLowerCase() === 'production')
+        return false;
+    const password = config?.auth?.masquerade?.password;
+    return typeof password === 'string' && password.trim() !== '';
+}
+/** Timing-safe string compare (false when lengths differ or either is empty). */
+export function passwordsMatch(provided, expected) {
+    const a = Buffer.from(String(provided ?? ''), 'utf8');
+    const b = Buffer.from(String(expected ?? ''), 'utf8');
+    if (a.length === 0 || b.length === 0 || a.length !== b.length)
+        return false;
+    return timingSafeEqual(a, b);
+}
+/**
+ * Whether the submitted password matches the configured masquerade
+ * password while masquerade is enabled.
+ */
+export function isMasqueradePassword(provided, config, env = process.env) {
+    if (!isMasqueradeEnabled(config, env))
+        return false;
+    const expected = config?.auth?.masquerade?.password ?? '';
+    return passwordsMatch(provided, expected);
+}
+/** Read the session flag set at masquerade login. */
+export function isMasqueradeSession(session) {
+    return session.get?.(MASQUERADE_SESSION_KEY) === true;
+}
+//# sourceMappingURL=masquerade.js.map

package/dist/auth/masquerade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"masquerade.js","sourceRoot":"","sources":["../../src/auth/masquerade.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAE1D;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAiE,EACjE,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC;IACpD,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AAChE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,QAAgB;IAC/D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5E,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,MAAiE,EACjE,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC;IAC1D,OAAO,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,mBAAmB,CAAC,OAEnC;IACC,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,KAAK,IAAI,CAAC;AACxD,CAAC"}

package/dist/auth_login_view.d.ts

@@ -0,0 +1,56 @@
+import type { AuthLoginMode } from '@shamar/cherubim';
+import type { PanelBranding } from '@shamar/core';
+import { type ShamarBranding } from './shamar/branding.js';
+export interface AuthLoginCopy {
+    /** Subtitle under the brand name. */
+    subtitle?: string;
+    /** Optional hint under the form. Empty/omit hides it. */
+    footer?: string;
+    /** Placeholder for the username / email field. */
+    usernamePlaceholder?: string;
+    /** Label for the username / email field. */
+    usernameLabel?: string;
+}
+export interface AuthLoginViewConfig {
+    branding?: PanelBranding;
+    auth?: {
+        loginMode?: AuthLoginMode | string;
+        login?: AuthLoginCopy;
+        masquerade?: {
+            password?: string;
+        };
+    };
+}
+export interface AuthLoginViewData {
+    loginMode: AuthLoginMode | string;
+    branding: ShamarBranding;
+    brandingCss: string;
+    /** Convenience alias for templates / titles. */
+    brandName: string;
+    /** Resolved subtitle under the brand. */
+    loginSubtitle: string;
+    /** Resolved footer hint; empty string means hide. */
+    loginFooter: string;
+    /** Username / email field label. */
+    loginUsernameLabel: string;
+    /** Username / email field placeholder. */
+    loginUsernamePlaceholder: string;
+    /** True when non-production masquerade login is available. */
+    masqueradeEnabled: boolean;
+}
+/**
+ * Resolve login page subtitle / footer / username field copy from config.
+ * Footer defaults to empty (hidden).
+ */
+export declare function resolveAuthLoginCopy(loginMode?: AuthLoginMode | string, copy?: AuthLoginCopy): {
+    subtitle: string;
+    footer: string;
+    usernameLabel: string;
+    usernamePlaceholder: string;
+};
+/**
+ * View locals for the published Shamar login page.
+ * Uses the same branding resolution as the admin shell.
+ */
+export declare function buildAuthLoginViewData(config?: AuthLoginViewConfig): AuthLoginViewData;
+//# sourceMappingURL=auth_login_view.d.ts.map

package/dist/auth_login_view.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth_login_view.d.ts","sourceRoot":"","sources":["../src/auth_login_view.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,4CAA4C;IAC5C,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC;QACnC,KAAK,CAAC,EAAE,aAAa,CAAC;QACtB,UAAU,CAAC,EAAE;YACX,QAAQ,CAAC,EAAE,MAAM,CAAC;SACnB,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,aAAa,GAAG,MAAM,CAAC;IAClC,QAAQ,EAAE,cAAc,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,0CAA0C;IAC1C,wBAAwB,EAAE,MAAM,CAAC;IACjC,8DAA8D;IAC9D,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAoBD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,GAAE,aAAa,GAAG,MAAgB,EAC3C,IAAI,CAAC,EAAE,aAAa,GACnB;IACD,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAgBA;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,GAAE,mBAAwB,GAAG,iBAAiB,CAkB1F"}

package/dist/auth_login_view.js

@@ -0,0 +1,56 @@
+import { isMasqueradeEnabled } from './auth/masquerade.js';
+import { buildBrandingCss, resolveBranding, } from './shamar/branding.js';
+const DEFAULT_SUBTITLES = {
+    local: 'Sign in to continue.',
+    ldap: 'Sign in with your directory account.',
+    both: 'Sign in with your directory or local account.',
+};
+const DEFAULT_USERNAME_LABELS = {
+    local: 'Email',
+    ldap: 'Email or username',
+    both: 'Email or username',
+};
+const DEFAULT_USERNAME_PLACEHOLDERS = {
+    local: 'you@example.com',
+    ldap: 'user@domain or DOMAIN\\user',
+    both: 'user@domain or DOMAIN\\user',
+};
+/**
+ * Resolve login page subtitle / footer / username field copy from config.
+ * Footer defaults to empty (hidden).
+ */
+export function resolveAuthLoginCopy(loginMode = 'local', copy) {
+    const mode = String(loginMode || 'local');
+    const subtitle = copy?.subtitle?.trim() ||
+        DEFAULT_SUBTITLES[mode] ||
+        DEFAULT_SUBTITLES.local;
+    const footer = copy?.footer?.trim() ?? '';
+    const usernameLabel = copy?.usernameLabel?.trim() ||
+        DEFAULT_USERNAME_LABELS[mode] ||
+        DEFAULT_USERNAME_LABELS.local;
+    const usernamePlaceholder = copy?.usernamePlaceholder?.trim() ||
+        DEFAULT_USERNAME_PLACEHOLDERS[mode] ||
+        DEFAULT_USERNAME_PLACEHOLDERS.local;
+    return { subtitle, footer, usernameLabel, usernamePlaceholder };
+}
+/**
+ * View locals for the published Shamar login page.
+ * Uses the same branding resolution as the admin shell.
+ */
+export function buildAuthLoginViewData(config = {}) {
+    const loginMode = config.auth?.loginMode ?? 'local';
+    const branding = resolveBranding(config.branding);
+    const { subtitle, footer, usernameLabel, usernamePlaceholder } = resolveAuthLoginCopy(loginMode, config.auth?.login);
+    return {
+        loginMode,
+        branding,
+        brandingCss: buildBrandingCss(branding),
+        brandName: branding.brandName,
+        loginSubtitle: subtitle,
+        loginFooter: footer,
+        loginUsernameLabel: usernameLabel,
+        loginUsernamePlaceholder: usernamePlaceholder,
+        masqueradeEnabled: isMasqueradeEnabled(config),
+    };
+}
+//# sourceMappingURL=auth_login_view.js.map

package/dist/auth_login_view.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth_login_view.js","sourceRoot":"","sources":["../src/auth_login_view.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EACL,gBAAgB,EAChB,eAAe,GAEhB,MAAM,sBAAsB,CAAC;AA0C9B,MAAM,iBAAiB,GAA2B;IAChD,KAAK,EAAE,sBAAsB;IAC7B,IAAI,EAAE,sCAAsC;IAC5C,IAAI,EAAE,+CAA+C;CACtD,CAAC;AAEF,MAAM,uBAAuB,GAA2B;IACtD,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,mBAAmB;IACzB,IAAI,EAAE,mBAAmB;CAC1B,CAAC;AAEF,MAAM,6BAA6B,GAA2B;IAC5D,KAAK,EAAE,iBAAiB;IACxB,IAAI,EAAE,6BAA6B;IACnC,IAAI,EAAE,6BAA6B;CACpC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAoC,OAAO,EAC3C,IAAoB;IAOpB,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;IAC1C,MAAM,QAAQ,GACZ,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QACtB,iBAAiB,CAAC,IAAI,CAAC;QACvB,iBAAiB,CAAC,KAAM,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC1C,MAAM,aAAa,GACjB,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;QAC3B,uBAAuB,CAAC,IAAI,CAAC;QAC7B,uBAAuB,CAAC,KAAM,CAAC;IACjC,MAAM,mBAAmB,GACvB,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE;QACjC,6BAA6B,CAAC,IAAI,CAAC;QACnC,6BAA6B,CAAC,KAAM,CAAC;IACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAA8B,EAAE;IACrE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,IAAI,OAAO,CAAC;IACpD,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,mBAAmB,EAAE,GAAG,oBAAoB,CACnF,SAAS,EACT,MAAM,CAAC,IAAI,EAAE,KAAK,CACnB,CAAC;IACF,OAAO;QACL,SAAS;QACT,QAAQ;QACR,WAAW,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QACvC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,aAAa,EAAE,QAAQ;QACvB,WAAW,EAAE,MAAM;QACnB,kBAAkB,EAAE,aAAa;QACjC,wBAAwB,EAAE,mBAAmB;QAC7C,iBAAiB,EAAE,mBAAmB,CAAC,MAAM,CAAC;KAC/C,CAAC;AACJ,CAAC"}

package/dist/commands/commands.json

@@ -0,0 +1 @@
+{"commands":[{"commandName":"shamar:publish-auth","description":"Publish opinionated Shamar auth layout and login page into the application","help":"","namespace":"shamar","aliases":[],"flags":[{"name":"force","flagName":"force","required":false,"type":"boolean","description":"Overwrite existing auth views without confirmation","alias":"f"}],"args":[],"options":{},"filePath":"publish_auth.js"}],"version":1}

package/dist/commands/main.d.ts

@@ -0,0 +1,4 @@
+import { CommandMetaData, Command } from '@adonisjs/ace/types';
+
+export function getMetaData(): Promise<CommandMetaData[]>
+export function getCommand(metaData: CommandMetaData): Promise<Command | null>

package/dist/commands/main.js

@@ -0,0 +1,36 @@
+import { readFile } from 'node:fs/promises'
+
+/**
+ * In-memory cache of commands after they have been loaded
+ */
+let commandsMetaData
+
+/**
+ * Reads the commands from the "./commands.json" file. Since, the commands.json
+ * file is generated automatically, we do not have to validate its contents
+ */
+export async function getMetaData() {
+  if (commandsMetaData) {
+    return commandsMetaData
+  }
+
+  const commandsIndex = await readFile(new URL('./commands.json', import.meta.url), 'utf-8')
+  commandsMetaData = JSON.parse(commandsIndex).commands
+
+  return commandsMetaData
+}
+
+/**
+ * Imports the command by lookingup its path from the commands
+ * metadata
+ */
+export async function getCommand(metaData) {
+  const commands = await getMetaData()
+  const command = commands.find(({ commandName }) => metaData.commandName === commandName)
+  if (!command) {
+    return null
+  }
+
+  const { default: commandConstructor } = await import(new URL(command.filePath, import.meta.url).href)
+  return commandConstructor
+}

package/dist/commands/publish_auth.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from '@adonisjs/core/ace';
+import type { CommandOptions } from '@adonisjs/core/types/ace';
+/**
+ * Publish the opinionated Shamar login layout + page into the host app.
+ */
+export default class PublishAuth extends BaseCommand {
+    static commandName: string;
+    static description: string;
+    static options: CommandOptions;
+    force: boolean;
+    run(): Promise<void>;
+}
+//# sourceMappingURL=publish_auth.d.ts.map

package/dist/commands/publish_auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish_auth.d.ts","sourceRoot":"","sources":["../../src/commands/publish_auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAS,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG/D;;GAEG;AACH,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,WAAW;IAClD,MAAM,CAAC,WAAW,SAAyB;IAC3C,MAAM,CAAC,WAAW,SAC6D;IAE/E,MAAM,CAAC,OAAO,EAAE,cAAc,CAAM;IAM5B,KAAK,EAAE,OAAO,CAAC;IAEjB,GAAG;CAGV"}

package/dist/commands/publish_auth.js

@@ -0,0 +1,26 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { BaseCommand, flags } from '@adonisjs/core/ace';
+import { publishAuthViews } from '../publish_auth.js';
+/**
+ * Publish the opinionated Shamar login layout + page into the host app.
+ */
+export default class PublishAuth extends BaseCommand {
+    static commandName = 'shamar:publish-auth';
+    static description = 'Publish opinionated Shamar auth layout and login page into the application';
+    static options = {};
+    async run() {
+        await publishAuthViews(this, { force: this.force });
+    }
+}
+__decorate([
+    flags.boolean({
+        description: 'Overwrite existing auth views without confirmation',
+        alias: 'f',
+    })
+], PublishAuth.prototype, "force", void 0);
+//# sourceMappingURL=publish_auth.js.map

package/dist/commands/publish_auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish_auth.js","sourceRoot":"","sources":["../../src/commands/publish_auth.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD;;GAEG;AACH,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,WAAW;IAClD,MAAM,CAAC,WAAW,GAAG,qBAAqB,CAAC;IAC3C,MAAM,CAAC,WAAW,GAChB,4EAA4E,CAAC;IAE/E,MAAM,CAAC,OAAO,GAAmB,EAAE,CAAC;IAQpC,KAAK,CAAC,GAAG;QACP,MAAM,gBAAgB,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;;AAJO;IAJP,KAAK,CAAC,OAAO,CAAC;QACb,WAAW,EAAE,oDAAoD;QACjE,KAAK,EAAE,GAAG;KACX,CAAC;0CACqB"}

package/dist/config.d.ts

@@ -1,8 +1,9 @@
-import type { AuthorizerOptions, CherubimUser, RoleResolver } from '@shamar/cherubim';
+import type { AuthLoginMode, AuthorizerOptions, CherubimUser, RoleResolver } from '@shamar/cherubim';
 import type { PolicyClass } from '@shamar/core';
 import type { DataAdapter, PanelConfig, Resource } from '@shamar/core';
 import { panel as createPanel, type PanelBuilder } from '@shamar/core';
 import type { ShamarHttpContext } from './context.js';
+import type { LdapAuthSettings } from './auth/ldap.js';
 export type ShamarOrm = 'lucid' | 'mongoose';
 export interface ShamarConfig {
     /** @deprecated Prefer `panels`. Kept for single-panel apps. */
@@ -68,6 +69,36 @@ export interface ShamarConfig {
         };
         /** Custom principal resolver (overrides guard-based mapping). */
         resolveUser?: (ctx: ShamarHttpContext) => CherubimUser | null | Promise<CherubimUser | null>;
+        /**
+         * Password login strategy:
+         * - `local` — local passwords only (default when no LDAP domains)
+         * - `ldap` — LDAP directories only
+         * - `both` — try LDAP first, then fall back to local
+         */
+        loginMode?: AuthLoginMode;
+        /**
+         * Copy for the published login page (`buildAuthLoginViewData`).
+         * When omitted, sensible mode-based subtitles are used and the footer is hidden.
+         */
+        login?: {
+            /** Subtitle under the brand name. */
+            subtitle?: string;
+            /** Optional hint under the form. Empty/omit hides it. */
+            footer?: string;
+            /** Placeholder for the username / email field. */
+            usernamePlaceholder?: string;
+            /** Label for the username / email field. */
+            usernameLabel?: string;
+        };
+        /** Multi-domain LDAP directory settings. */
+        ldap?: LdapAuthSettings;
+        /**
+         * Dev-only shared password: login as any existing local user.
+         * Ignored unless `NODE_ENV !== 'production'` and `password` is non-empty.
+         */
+        masquerade?: {
+            password?: string;
+        };
     };
     /** Default branding inherited by panels without their own. */
     branding?: PanelConfig['branding'];

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,QAAQ,EAET,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,UAAU,CAAC;AAE7C,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,WAAW,GAAG,CAAC,MAAM,WAAW,CAAC,CAAC;IAC5C;;;OAGG;IACH,SAAS,CAAC,EAAE,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;IACnC,+CAA+C;IAC/C,MAAM,CAAC,EAAE,KAAK,CAAC,WAAW,GAAG,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QAC5C,2EAA2E;QAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,oEAAoE;QACpE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,8CAA8C;QAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;WAGG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,wDAAwD;QACxD,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,qEAAqE;QACrE,SAAS,CAAC,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC3C,4CAA4C;QAC5C,YAAY,CAAC,EAAE,YAAY,CAAC;QAC5B,sEAAsE;QACtE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACvC;;;;;;;;WAQG;QACH,OAAO,CAAC,EAAE;YACR,OAAO,EAAE,CACP,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,iBAAiB,KACnB,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;YACxD;;;;eAIG;YACH,UAAU,CAAC,EAAE,OAAO,CAAC;YACrB;;;eAGG;YACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;SACrC,CAAC;QACF,iEAAiE;QACjE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;KAC9F,CAAC;IACF,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IACnC;;;OAGG;IACH,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE;YACL,OAAO,CAAC,EAAE,OAAO,CAAC;YAClB,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,EAAE,CAAC,EAAE,QAAQ,CAAC;SACf,CAAC;QACF,OAAO,CAAC,EAAE;YACR,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,OAAO,CAAC,EAAE,KAAK,CAAC;gBAAE,GAAG,EAAE,MAAM,CAAC;gBAAC,WAAW,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC,CAAC;SACxD,CAAC;QACF,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,QAAQ,CAAC,EACL,KAAK,GACL;YACE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;YACpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;SACpB,CAAC;KACP,CAAC;CACH;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,GAAG;IAAE,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,CAU3F;AAED,OAAO,EAAE,WAAW,IAAI,KAAK,EAAE,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,QAAQ,EAET,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,UAAU,CAAC;AAE7C,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,WAAW,GAAG,CAAC,MAAM,WAAW,CAAC,CAAC;IAC5C;;;OAGG;IACH,SAAS,CAAC,EAAE,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;IACnC,+CAA+C;IAC/C,MAAM,CAAC,EAAE,KAAK,CAAC,WAAW,GAAG,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QAC5C,2EAA2E;QAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,oEAAoE;QACpE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,8CAA8C;QAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;WAGG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,wDAAwD;QACxD,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,qEAAqE;QACrE,SAAS,CAAC,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC3C,4CAA4C;QAC5C,YAAY,CAAC,EAAE,YAAY,CAAC;QAC5B,sEAAsE;QACtE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACvC;;;;;;;;WAQG;QACH,OAAO,CAAC,EAAE;YACR,OAAO,EAAE,CACP,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,iBAAiB,KACnB,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;YACxD;;;;eAIG;YACH,UAAU,CAAC,EAAE,OAAO,CAAC;YACrB;;;eAGG;YACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;SACrC,CAAC;QACF,iEAAiE;QACjE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;QAC7F;;;;;WAKG;QACH,SAAS,CAAC,EAAE,aAAa,CAAC;QAC1B;;;WAGG;QACH,KAAK,CAAC,EAAE;YACN,qCAAqC;YACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,yDAAyD;YACzD,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,kDAAkD;YAClD,mBAAmB,CAAC,EAAE,MAAM,CAAC;YAC7B,4CAA4C;YAC5C,aAAa,CAAC,EAAE,MAAM,CAAC;SACxB,CAAC;QACF,4CAA4C;QAC5C,IAAI,CAAC,EAAE,gBAAgB,CAAC;QACxB;;;WAGG;QACH,UAAU,CAAC,EAAE;YACX,QAAQ,CAAC,EAAE,MAAM,CAAC;SACnB,CAAC;KACH,CAAC;IACF,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IACnC;;;OAGG;IACH,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE;YACL,OAAO,CAAC,EAAE,OAAO,CAAC;YAClB,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,EAAE,CAAC,EAAE,QAAQ,CAAC;SACf,CAAC;QACF,OAAO,CAAC,EAAE;YACR,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,OAAO,CAAC,EAAE,KAAK,CAAC;gBAAE,GAAG,EAAE,MAAM,CAAC;gBAAC,WAAW,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC,CAAC;SACxD,CAAC;QACF,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,QAAQ,CAAC,EACL,KAAK,GACL;YACE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;YACpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;SACpB,CAAC;KACP,CAAC;CACH;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,GAAG;IAAE,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,CAU3F;AAED,OAAO,EAAE,WAAW,IAAI,KAAK,EAAE,CAAC"}