admindb 1.2.1 → 2.1.0

package/dist/auth/index.js

@@ -0,0 +1,22 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./types"), exports);
+__exportStar(require("./crypto"), exports);
+__exportStar(require("./config"), exports);
+__exportStar(require("./middleware"), exports);
+__exportStar(require("./routes"), exports);
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,2CAAyB;AACzB,2CAAyB;AACzB,+CAA6B;AAC7B,2CAAyB"}

package/dist/auth/middleware.d.ts

@@ -0,0 +1,14 @@
+import type { Request, Response, NextFunction } from 'express';
+import type { Logger } from '../utils/logger';
+import { type ResolvedAuthConfig } from './types';
+/**
+ * Checks incoming request headers and cookies for valid authentication.
+ */
+export declare function authenticateRequest(req: Request, config: ResolvedAuthConfig): {
+    authenticated: boolean;
+    user?: string;
+};
+/**
+ * Express middleware to protect routes.
+ */
+export declare function createAuthMiddleware(config: ResolvedAuthConfig, basePath: string, _logger: Logger): (req: Request, res: Response, next: NextFunction) => void;

package/dist/auth/middleware.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authenticateRequest = authenticateRequest;
+exports.createAuthMiddleware = createAuthMiddleware;
+const types_1 = require("./types");
+const crypto_1 = require("./crypto");
+/**
+ * Checks incoming request headers and cookies for valid authentication.
+ */
+function authenticateRequest(req, config) {
+    if (!config.enabled) {
+        return { authenticated: true, user: 'anonymous' };
+    }
+    // 1. Check HTTP Authorization header (Basic or Bearer)
+    const authHeader = req.headers.authorization;
+    if (authHeader) {
+        const [scheme, credentials] = authHeader.split(/\s+/, 2);
+        if (scheme && credentials) {
+            if (scheme.toLowerCase() === 'basic') {
+                try {
+                    const decoded = Buffer.from(credentials, 'base64').toString('utf8');
+                    const colonIdx = decoded.indexOf(':');
+                    if (colonIdx !== -1) {
+                        const user = decoded.slice(0, colonIdx);
+                        const pass = decoded.slice(colonIdx + 1);
+                        if ((0, crypto_1.constantTimeCompare)(user, config.username) && (0, crypto_1.verifyPassword)(pass, config.password)) {
+                            return { authenticated: true, user };
+                        }
+                    }
+                }
+                catch {
+                    // Ignore parse errors
+                }
+            }
+            else if (scheme.toLowerCase() === 'bearer') {
+                const user = (0, crypto_1.verifySessionToken)(credentials, config.secret, config.username);
+                if (user) {
+                    return { authenticated: true, user };
+                }
+                // Direct password comparison as bearer token
+                if ((0, crypto_1.verifyPassword)(credentials, config.password)) {
+                    return { authenticated: true, user: config.username };
+                }
+            }
+        }
+    }
+    // 2. Check Cookie session
+    const cookies = (0, crypto_1.parseCookies)(req.headers.cookie);
+    const sessionCookie = cookies[types_1.SESSION_COOKIE_NAME];
+    if (sessionCookie) {
+        const user = (0, crypto_1.verifySessionToken)(sessionCookie, config.secret, config.username);
+        if (user) {
+            return { authenticated: true, user };
+        }
+    }
+    return { authenticated: false };
+}
+/**
+ * Express middleware to protect routes.
+ */
+function createAuthMiddleware(config, basePath, _logger) {
+    return (req, res, next) => {
+        // Expose auth state to templates
+        res.locals.authEnabled = config.enabled;
+        res.locals.isDefaultPassword = config.isDefaultPassword;
+        if (!config.enabled) {
+            res.locals.authUser = null;
+            return next();
+        }
+        const p = req.path;
+        // Public static assets and auth endpoints bypass authentication
+        if (p.startsWith('/css/') ||
+            p.startsWith('/js/') ||
+            p === '/favicon.ico' ||
+            p === '/login' ||
+            p === '/logout') {
+            return next();
+        }
+        const auth = authenticateRequest(req, config);
+        if (auth.authenticated && auth.user) {
+            res.locals.authUser = auth.user;
+            req.user = auth.user;
+            return next();
+        }
+        // Unauthenticated: API requests get 401 JSON
+        if (p.startsWith('/api/') || req.xhr || (req.headers.accept && req.headers.accept.includes('application/json'))) {
+            res.setHeader('WWW-Authenticate', 'Basic realm="AdminDB", Bearer');
+            res.status(401).json({
+                success: false,
+                error: 'Authentication required. Please log in or provide valid credentials.',
+            });
+            return;
+        }
+        // Web UI: Redirect to login with return path
+        const returnUrl = req.originalUrl || `${basePath}${req.url}`;
+        const loginUrl = `${basePath}/login${returnUrl && returnUrl !== `${basePath}/` ? `?next=${encodeURIComponent(returnUrl)}` : ''}`;
+        res.redirect(loginUrl);
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/auth/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":";;AAQA,kDAmDC;AAKD,oDAkDC;AAhHD,mCAAuE;AACvE,qCAAiG;AAEjG;;GAEG;AACH,SAAgB,mBAAmB,CACjC,GAAY,EACZ,MAA0B;IAE1B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACpD,CAAC;IAED,uDAAuD;IACvD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACzD,IAAI,MAAM,IAAI,WAAW,EAAE,CAAC;YAC1B,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACtC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;wBACpB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;wBACxC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;wBACzC,IAAI,IAAA,4BAAmB,EAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAA,uBAAc,EAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;4BACxF,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;wBACvC,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,sBAAsB;gBACxB,CAAC;YACH,CAAC;iBAAM,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,IAAA,2BAAkB,EAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC7E,IAAI,IAAI,EAAE,CAAC;oBACT,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;gBACvC,CAAC;gBACD,6CAA6C;gBAC7C,IAAI,IAAA,uBAAc,EAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACjD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACxD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,MAAM,OAAO,GAAG,IAAA,qBAAY,EAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,aAAa,GAAG,OAAO,CAAC,2BAAmB,CAAC,CAAC;IACnD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,IAAA,2BAAkB,EAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/E,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAClC,MAA0B,EAC1B,QAAgB,EAChB,OAAe;IAEf,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,iCAAiC;QACjC,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAExD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;YAC3B,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC;QAEnB,gEAAgE;QAChE,IACE,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;YACrB,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;YACpB,CAAC,KAAK,cAAc;YACpB,CAAC,KAAK,QAAQ;YACd,CAAC,KAAK,SAAS,EACf,CAAC;YACD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;YAC/B,GAAoC,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;YAChH,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,+BAA+B,CAAC,CAAC;YACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,sEAAsE;aAC9E,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,6CAA6C;QAC7C,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,QAAQ,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,QAAQ,SAAS,SAAS,IAAI,SAAS,KAAK,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,SAAS,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACjI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/routes.d.ts

@@ -0,0 +1,7 @@
+import type { Router } from 'express';
+import type { Logger } from '../utils/logger';
+import { type ResolvedAuthConfig } from './types';
+/**
+ * Registers /login and /logout routes.
+ */
+export declare function registerAuthRoutes(router: Router, config: ResolvedAuthConfig, basePath: string, logger: Logger): void;

package/dist/auth/routes.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerAuthRoutes = registerAuthRoutes;
+const types_1 = require("./types");
+const middleware_1 = require("./middleware");
+const crypto_1 = require("./crypto");
+/**
+ * Registers /login and /logout routes.
+ */
+function registerAuthRoutes(router, config, basePath, logger) {
+    // GET /login - render login screen
+    router.get('/login', (req, res) => {
+        if (!config.enabled) {
+            return res.redirect(`${basePath}/`);
+        }
+        const auth = (0, middleware_1.authenticateRequest)(req, config);
+        if (auth.authenticated) {
+            const nextUrl = String(req.query.next ?? '').trim();
+            return res.redirect(nextUrl.startsWith('/') ? nextUrl : `${basePath}/`);
+        }
+        const nextUrl = String(req.query.next ?? '').trim();
+        res.render('pages/login', {
+            title: 'Sign in',
+            noSidebar: true,
+            next: nextUrl.startsWith('/') ? nextUrl : '',
+            isDefaultPassword: config.isDefaultPassword,
+            error: req.query.error ? String(req.query.error) : null,
+        });
+    });
+    // POST /login - process login submission
+    router.post('/login', (req, res) => {
+        if (!config.enabled) {
+            return res.redirect(`${basePath}/`);
+        }
+        const username = String(req.body?.username ?? '').trim();
+        const password = String(req.body?.password ?? '').trim();
+        const nextUrl = String(req.body?.next ?? req.query.next ?? '').trim();
+        const isValid = (0, crypto_1.constantTimeCompare)(username, config.username) &&
+            (0, crypto_1.verifyPassword)(password, config.password);
+        if (!isValid) {
+            logger.warn(`Failed login attempt for user "${username || '<empty>'}"`);
+            if (req.xhr || (req.headers.accept && req.headers.accept.includes('application/json'))) {
+                return res.status(401).json({ success: false, error: 'Invalid username or password.' });
+            }
+            return res.status(401).render('pages/login', {
+                title: 'Sign in',
+                noSidebar: true,
+                username,
+                next: nextUrl.startsWith('/') ? nextUrl : '',
+                isDefaultPassword: config.isDefaultPassword,
+                error: 'Invalid username or password. Please check your credentials.',
+            });
+        }
+        // Successful authentication: issue signed session cookie
+        const token = (0, crypto_1.createSessionToken)(config.username, config.secret, config.sessionDurationMs);
+        const maxAgeSec = Math.floor(config.sessionDurationMs / 1000);
+        const expiresUtc = new Date(Date.now() + config.sessionDurationMs).toUTCString();
+        const cookiePath = basePath || '/';
+        res.setHeader('Set-Cookie', `${types_1.SESSION_COOKIE_NAME}=${encodeURIComponent(token)}; Path=${cookiePath}; Max-Age=${maxAgeSec}; Expires=${expiresUtc}; HttpOnly; SameSite=Lax`);
+        if (req.xhr || (req.headers.accept && req.headers.accept.includes('application/json'))) {
+            return res.json({ success: true, message: 'Logged in successfully.', user: config.username, token });
+        }
+        const target = nextUrl.startsWith('/') ? nextUrl : `${basePath}/`;
+        res.redirect(target);
+    });
+    // POST & GET /logout - clear session and redirect to login
+    const handleLogout = (req, res) => {
+        const cookiePath = basePath || '/';
+        res.setHeader('Set-Cookie', `${types_1.SESSION_COOKIE_NAME}=; Path=${cookiePath}; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; HttpOnly; SameSite=Lax`);
+        if (req.xhr || (req.headers.accept && req.headers.accept.includes('application/json'))) {
+            return res.json({ success: true, message: 'Logged out successfully.' });
+        }
+        res.redirect(`${basePath}/login`);
+    };
+    router.post('/logout', handleLogout);
+    router.get('/logout', handleLogout);
+}
+//# sourceMappingURL=routes.js.map

package/dist/auth/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/auth/routes.ts"],"names":[],"mappings":";;AASA,gDA6FC;AApGD,mCAAuE;AACvE,6CAAmD;AACnD,qCAAmF;AAEnF;;GAEG;AACH,SAAgB,kBAAkB,CAChC,MAAc,EACd,MAA0B,EAC1B,QAAgB,EAChB,MAAc;IAEd,mCAAmC;IACnC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,gCAAmB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACpD,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE;YACxB,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,IAAI;YACf,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;YAC5C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;SACxD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,yCAAyC;IACzC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAEtE,MAAM,OAAO,GACX,IAAA,4BAAmB,EAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;YAC9C,IAAA,uBAAc,EAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,kCAAkC,QAAQ,IAAI,SAAS,GAAG,CAAC,CAAC;YACxE,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;gBACvF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE;gBAC3C,KAAK,EAAE,SAAS;gBAChB,SAAS,EAAE,IAAI;gBACf,QAAQ;gBACR,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;gBAC5C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,KAAK,EAAE,8DAA8D;aACtE,CAAC,CAAC;QACL,CAAC;QAED,yDAAyD;QACzD,MAAM,KAAK,GAAG,IAAA,2BAAkB,EAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC,WAAW,EAAE,CAAC;QACjF,MAAM,UAAU,GAAG,QAAQ,IAAI,GAAG,CAAC;QAEnC,GAAG,CAAC,SAAS,CACX,YAAY,EACZ,GAAG,2BAAmB,IAAI,kBAAkB,CAAC,KAAK,CAAC,UAAU,UAAU,aAAa,SAAS,aAAa,UAAU,0BAA0B,CAC/I,CAAC;QAEF,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;YACvF,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,yBAAyB,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAC;QAClE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,2DAA2D;IAC3D,MAAM,YAAY,GAAG,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACnD,MAAM,UAAU,GAAG,QAAQ,IAAI,GAAG,CAAC;QACnC,GAAG,CAAC,SAAS,CACX,YAAY,EACZ,GAAG,2BAAmB,WAAW,UAAU,4EAA4E,CACxH,CAAC;QAEF,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;YACvF,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,GAAG,CAAC,QAAQ,CAAC,GAAG,QAAQ,QAAQ,CAAC,CAAC;IACpC,CAAC,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;AACtC,CAAC"}

package/dist/auth/types.d.ts

@@ -0,0 +1,35 @@
+export interface AuthConfig {
+    /**
+     * Whether authentication is enabled.
+     * Set to `false` to disable protection entirely (e.g. for development or custom upstream auth).
+     * Defaults to `true`.
+     */
+    enabled?: boolean;
+    /** Admin username. Defaults to `process.env.ADMINDB_USERNAME` or `'admin'`. */
+    username?: string;
+    /**
+     * Admin password or password hash (e.g. `scrypt:<salt>:<hash>`).
+     * Generate a hash using `npm run generatehash`.
+     * Defaults to `process.env.ADMINDB_PASSWORD` or the hardcoded default hash for `'admin'`.
+     */
+    password?: string;
+    /** Secret key used to sign session cookies. Defaults to `process.env.ADMINDB_SECRET` or auto-generated. */
+    secret?: string;
+    /** Session expiration time in milliseconds. Defaults to 7 days (604800000 ms). */
+    sessionDurationMs?: number;
+}
+export interface ResolvedAuthConfig {
+    enabled: boolean;
+    username: string;
+    password: string;
+    secret: string;
+    sessionDurationMs: number;
+    isDefaultPassword: boolean;
+}
+export declare const DEFAULT_USERNAME = "admin";
+/**
+ * Hardcoded default scrypt hash for password 'admin' (salt: d9f2e64b8a1c3d5e7f0a2b4c6e801357, keyLen: 64).
+ */
+export declare const DEFAULT_PASSWORD_HASH = "scrypt:d9f2e64b8a1c3d5e7f0a2b4c6e801357:cb3032b16f29c8d44f75c779f070c61c846b17eb333d07596ceb8470fc1b4c06cc720c08796ebc86937dab28a3ef580ced38a71c940fd4a169fd2e9cb9fa40e2";
+export declare const DEFAULT_SESSION_DURATION_MS: number;
+export declare const SESSION_COOKIE_NAME = "admindb_session";

package/dist/auth/types.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SESSION_COOKIE_NAME = exports.DEFAULT_SESSION_DURATION_MS = exports.DEFAULT_PASSWORD_HASH = exports.DEFAULT_USERNAME = void 0;
+exports.DEFAULT_USERNAME = 'admin';
+/**
+ * Hardcoded default scrypt hash for password 'admin' (salt: d9f2e64b8a1c3d5e7f0a2b4c6e801357, keyLen: 64).
+ */
+exports.DEFAULT_PASSWORD_HASH = 'scrypt:d9f2e64b8a1c3d5e7f0a2b4c6e801357:cb3032b16f29c8d44f75c779f070c61c846b17eb333d07596ceb8470fc1b4c06cc720c08796ebc86937dab28a3ef580ced38a71c940fd4a169fd2e9cb9fa40e2';
+exports.DEFAULT_SESSION_DURATION_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
+exports.SESSION_COOKIE_NAME = 'admindb_session';
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":";;;AA8Ba,QAAA,gBAAgB,GAAG,OAAO,CAAC;AAExC;;GAEG;AACU,QAAA,qBAAqB,GAChC,0KAA0K,CAAC;AAEhK,QAAA,2BAA2B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,SAAS;AAChE,QAAA,mBAAmB,GAAG,iBAAiB,CAAC"}

package/dist/cli/args.d.ts

@@ -0,0 +1,45 @@
+import type { LogLevel } from '../utils/logger';
+export interface CliArgs {
+    help: boolean;
+    version: boolean;
+    /** Bind host/interface (`--host`, `-H`). */
+    host?: string;
+    /** Port to listen on (`--port`, `-p`). */
+    port?: number;
+    /** A single database file to open directly (`--open`/`--db`/`--file`/`--db-path`). */
+    dbPath?: string;
+    /** PostgreSQL or database connection string (`--connection`/`--conn`/`--pg`). */
+    connection?: string;
+    /** Database connections map (from JSON config file). */
+    connections?: Record<string, string>;
+    /** Path to a JSON configuration file (`--config`, `-C`). */
+    configPath?: string;
+    /** Directory of database files to manage (`--dir`/`--folder`/`--db-dir`, `-d`). */
+    dbDir?: string;
+    /** Explicit database file paths (`--files`/`--db-files`). */
+    dbFiles?: string[];
+    /** URL prefix to serve under (`--base-path`/`--base`, `-b`). */
+    basePath?: string;
+    /** Log level filter (`--log-level`, `-l`). */
+    logLevel?: LogLevel;
+    /** Open databases read-only (`--readonly`, `-r`). */
+    readonly: boolean;
+    /** Serverless mode (enforces read-only database operations) (`--serverless`). */
+    serverless?: boolean;
+    /** Whether authentication is enabled (defaults to true). Set to false via `--no-auth`. */
+    auth?: boolean;
+    /** Custom admin username (`--username`/`--user`/`--auth-username`, `-u`). */
+    authUsername?: string;
+    /** Custom admin password (`--password`/`--pass`/`--auth-password`, `-P`). */
+    authPassword?: string;
+    /** Secret key for session cookie signing (`--auth-secret`/`--secret`). */
+    authSecret?: string;
+}
+export declare function helpText(): string;
+/** The installed `admindb` package version (from package.json), or '' when unknown. */
+export declare function getPackageVersion(): string;
+export declare function versionText(): string;
+export declare function parseArgs(argv: string[]): {
+    args: CliArgs;
+    error?: string;
+};