admindb 2.1.0 → 2.1.1

package/dist/auth/crypto.js

@@ -1,133 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.hashPassword = hashPassword;
-exports.constantTimeCompare = constantTimeCompare;
-exports.verifyPassword = verifyPassword;
-exports.parseCookies = parseCookies;
-exports.createSessionToken = createSessionToken;
-exports.verifySessionToken = verifySessionToken;
-const node_crypto_1 = require("node:crypto");
-const types_1 = require("./types");
-/**
- * Generates a secure scrypt password hash with a random or provided salt.
- * Format: `scrypt:<saltHex>:<derivedKeyHex>`
- */
-function hashPassword(password, salt) {
-    const saltHex = salt || (0, node_crypto_1.randomBytes)(16).toString('hex');
-    const derivedKey = (0, node_crypto_1.scryptSync)(password, saltHex, 64).toString('hex');
-    return `scrypt:${saltHex}:${derivedKey}`;
-}
-/**
- * Constant-time comparison between two strings to prevent timing attacks.
- */
-function constantTimeCompare(a, b) {
-    try {
-        const bufA = Buffer.from(String(a), 'utf8');
-        const bufB = Buffer.from(String(b), 'utf8');
-        if (bufA.length !== bufB.length) {
-            // Dummy comparison to prevent timing leak on length mismatch
-            (0, node_crypto_1.timingSafeEqual)(bufA, bufA);
-            return false;
-        }
-        return (0, node_crypto_1.timingSafeEqual)(bufA, bufB);
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Verifies a candidate plaintext password against a stored password or scrypt hash.
- */
-function verifyPassword(candidatePassword, storedPasswordOrHash) {
-    if (typeof candidatePassword !== 'string' || typeof storedPasswordOrHash !== 'string') {
-        return false;
-    }
-    // Handle scrypt formatted hash: `scrypt:<salt>:<hash>`
-    if (storedPasswordOrHash.startsWith('scrypt:')) {
-        const parts = storedPasswordOrHash.split(':');
-        if (parts.length === 3 && parts[1] && parts[2]) {
-            const salt = parts[1];
-            const expectedKeyHex = parts[2];
-            try {
-                const derivedKey = (0, node_crypto_1.scryptSync)(candidatePassword, salt, 64).toString('hex');
-                return constantTimeCompare(derivedKey, expectedKeyHex);
-            }
-            catch {
-                return false;
-            }
-        }
-    }
-    // Fallback for plaintext passwords (legacy or plain string configs)
-    return constantTimeCompare(candidatePassword, storedPasswordOrHash);
-}
-/**
- * Parses raw Cookie header string into key-value map.
- */
-function parseCookies(cookieHeader) {
-    const cookies = {};
-    if (!cookieHeader)
-        return cookies;
-    for (const pair of cookieHeader.split(';')) {
-        const idx = pair.indexOf('=');
-        if (idx === -1)
-            continue;
-        const key = pair.slice(0, idx).trim();
-        let val = pair.slice(idx + 1).trim();
-        if (val.startsWith('"') && val.endsWith('"') && val.length >= 2) {
-            val = val.slice(1, -1);
-        }
-        if (key) {
-            try {
-                cookies[key] = decodeURIComponent(val);
-            }
-            catch {
-                cookies[key] = val;
-            }
-        }
-    }
-    return cookies;
-}
-/**
- * Creates a tamper-proof signed session token using HMAC-SHA256.
- * Format: `<base64url(username)>.<expiresAtTimestamp>.<hmacSignature>`
- */
-function createSessionToken(username, secret, durationMs = types_1.DEFAULT_SESSION_DURATION_MS) {
-    const expiresAt = Date.now() + durationMs;
-    const userPayload = Buffer.from(username, 'utf8').toString('base64url');
-    const data = `${userPayload}.${expiresAt}`;
-    const signature = (0, node_crypto_1.createHmac)('sha256', secret).update(data).digest('base64url');
-    return `${data}.${signature}`;
-}
-/**
- * Verifies a signed session token in constant time.
- * Returns the authenticated username if valid and non-expired, or null otherwise.
- */
-function verifySessionToken(token, secret, expectedUser) {
-    if (!token || typeof token !== 'string')
-        return null;
-    const parts = token.split('.');
-    if (parts.length !== 3)
-        return null;
-    const [userPayload, expiresStr, providedSignature] = parts;
-    const data = `${userPayload}.${expiresStr}`;
-    const expectedSignature = (0, node_crypto_1.createHmac)('sha256', secret).update(data).digest('base64url');
-    if (!constantTimeCompare(providedSignature, expectedSignature)) {
-        return null;
-    }
-    const expiresAt = Number.parseInt(expiresStr, 10);
-    if (!Number.isFinite(expiresAt) || Date.now() > expiresAt) {
-        return null; // Expired
-    }
-    let username;
-    try {
-        username = Buffer.from(userPayload, 'base64url').toString('utf8');
-    }
-    catch {
-        return null;
-    }
-    if (expectedUser && !constantTimeCompare(username, expectedUser)) {
-        return null;
-    }
-    return username;
-}
-//# sourceMappingURL=crypto.js.map
+Object.defineProperty(exports,"__esModule",{value:!0}),exports.hashPassword=function(password,salt){const saltHex=salt||(0,node_crypto_1.randomBytes)(16).toString("hex"),derivedKey=(0,node_crypto_1.scryptSync)(password,saltHex,64).toString("hex");return`scrypt:${saltHex}:${derivedKey}`},exports.constantTimeCompare=constantTimeCompare,exports.verifyPassword=function(candidatePassword,storedPasswordOrHash){if("string"!=typeof candidatePassword||"string"!=typeof storedPasswordOrHash)return!1;if(storedPasswordOrHash.startsWith("scrypt:")){const parts=storedPasswordOrHash.split(":");if(3===parts.length&&parts[1]&&parts[2]){const salt=parts[1],expectedKeyHex=parts[2];try{return constantTimeCompare((0,node_crypto_1.scryptSync)(candidatePassword,salt,64).toString("hex"),expectedKeyHex)}catch{return!1}}}return constantTimeCompare(candidatePassword,storedPasswordOrHash)},exports.parseCookies=function(cookieHeader){const cookies={};if(!cookieHeader)return cookies;for(const pair of cookieHeader.split(";")){const idx=pair.indexOf("=");if(-1===idx)continue;const key=pair.slice(0,idx).trim();let val=pair.slice(idx+1).trim();if(val.startsWith('"')&&val.endsWith('"')&&val.length>=2&&(val=val.slice(1,-1)),key)try{cookies[key]=decodeURIComponent(val)}catch{cookies[key]=val}}return cookies},exports.createSessionToken=function(username,secret,durationMs=types_1.DEFAULT_SESSION_DURATION_MS){const expiresAt=Date.now()+durationMs,data=`${Buffer.from(username,"utf8").toString("base64url")}.${expiresAt}`,signature=(0,node_crypto_1.createHmac)("sha256",secret).update(data).digest("base64url");return`${data}.${signature}`},exports.verifySessionToken=function(token,secret,expectedUser){if(!token||"string"!=typeof token)return null;const parts=token.split(".");if(3!==parts.length)return null;const[userPayload,expiresStr,providedSignature]=parts,data=`${userPayload}.${expiresStr}`,expectedSignature=(0,node_crypto_1.createHmac)("sha256",secret).update(data).digest("base64url");if(!constantTimeCompare(providedSignature,expectedSignature))return null;const expiresAt=Number.parseInt(expiresStr,10);if(!Number.isFinite(expiresAt)||Date.now()>expiresAt)return null;let username;try{username=Buffer.from(userPayload,"base64url").toString("utf8")}catch{return null}if(expectedUser&&!constantTimeCompare(username,expectedUser))return null;return username};const node_crypto_1=require("node:crypto"),types_1=require("./types");function constantTimeCompare(a,b){try{const bufA=Buffer.from(String(a),"utf8"),bufB=Buffer.from(String(b),"utf8");return bufA.length!==bufB.length?((0,node_crypto_1.timingSafeEqual)(bufA,bufA),!1):(0,node_crypto_1.timingSafeEqual)(bufA,bufB)}catch{return!1}}

package/dist/auth/index.d.ts

@@ -1,5 +1 @@
-export * from './types';
-export * from './crypto';
-export * from './config';
-export * from './middleware';
-export * from './routes';
+export * from './types';export * from './crypto';export * from './config';export * from './middleware';export * from './routes';

package/dist/auth/index.js

@@ -1,22 +1 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./types"), exports);
-__exportStar(require("./crypto"), exports);
-__exportStar(require("./config"), exports);
-__exportStar(require("./middleware"), exports);
-__exportStar(require("./routes"), exports);
-//# sourceMappingURL=index.js.map
+var __createBinding=this&&this.__createBinding||(Object.create?function(o,m,k,k2){void 0===k2&&(k2=k);var desc=Object.getOwnPropertyDescriptor(m,k);desc&&!("get"in desc?!m.__esModule:desc.writable||desc.configurable)||(desc={enumerable:!0,get:function(){return m[k]}}),Object.defineProperty(o,k2,desc)}:function(o,m,k,k2){void 0===k2&&(k2=k),o[k2]=m[k]}),__exportStar=this&&this.__exportStar||function(m,exports){for(var p in m)"default"===p||Object.prototype.hasOwnProperty.call(exports,p)||__createBinding(exports,m,p)};Object.defineProperty(exports,"__esModule",{value:!0}),__exportStar(require("./types"),exports),__exportStar(require("./crypto"),exports),__exportStar(require("./config"),exports),__exportStar(require("./middleware"),exports),__exportStar(require("./routes"),exports);

package/dist/auth/middleware.d.ts

@@ -1,14 +1 @@
-import type { Request, Response, NextFunction } from 'express';
-import type { Logger } from '../utils/logger';
-import { type ResolvedAuthConfig } from './types';
-/**
- * Checks incoming request headers and cookies for valid authentication.
- */
-export declare function authenticateRequest(req: Request, config: ResolvedAuthConfig): {
-    authenticated: boolean;
-    user?: string;
-};
-/**
- * Express middleware to protect routes.
- */
-export declare function createAuthMiddleware(config: ResolvedAuthConfig, basePath: string, _logger: Logger): (req: Request, res: Response, next: NextFunction) => void;
+import type {Request,Response,NextFunction} from 'express';import type {Logger} from '../utils/logger';import{type ResolvedAuthConfig} from './types';export declare function authenticateRequest(req:Request,config:ResolvedAuthConfig):{authenticated:boolean;user?:string;};export declare function createAuthMiddleware(config:ResolvedAuthConfig,basePath:string,_logger:Logger):(req:Request,res:Response,next:NextFunction)=>void;

package/dist/auth/middleware.js

@@ -1,100 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.authenticateRequest = authenticateRequest;
-exports.createAuthMiddleware = createAuthMiddleware;
-const types_1 = require("./types");
-const crypto_1 = require("./crypto");
-/**
- * Checks incoming request headers and cookies for valid authentication.
- */
-function authenticateRequest(req, config) {
-    if (!config.enabled) {
-        return { authenticated: true, user: 'anonymous' };
-    }
-    // 1. Check HTTP Authorization header (Basic or Bearer)
-    const authHeader = req.headers.authorization;
-    if (authHeader) {
-        const [scheme, credentials] = authHeader.split(/\s+/, 2);
-        if (scheme && credentials) {
-            if (scheme.toLowerCase() === 'basic') {
-                try {
-                    const decoded = Buffer.from(credentials, 'base64').toString('utf8');
-                    const colonIdx = decoded.indexOf(':');
-                    if (colonIdx !== -1) {
-                        const user = decoded.slice(0, colonIdx);
-                        const pass = decoded.slice(colonIdx + 1);
-                        if ((0, crypto_1.constantTimeCompare)(user, config.username) && (0, crypto_1.verifyPassword)(pass, config.password)) {
-                            return { authenticated: true, user };
-                        }
-                    }
-                }
-                catch {
-                    // Ignore parse errors
-                }
-            }
-            else if (scheme.toLowerCase() === 'bearer') {
-                const user = (0, crypto_1.verifySessionToken)(credentials, config.secret, config.username);
-                if (user) {
-                    return { authenticated: true, user };
-                }
-                // Direct password comparison as bearer token
-                if ((0, crypto_1.verifyPassword)(credentials, config.password)) {
-                    return { authenticated: true, user: config.username };
-                }
-            }
-        }
-    }
-    // 2. Check Cookie session
-    const cookies = (0, crypto_1.parseCookies)(req.headers.cookie);
-    const sessionCookie = cookies[types_1.SESSION_COOKIE_NAME];
-    if (sessionCookie) {
-        const user = (0, crypto_1.verifySessionToken)(sessionCookie, config.secret, config.username);
-        if (user) {
-            return { authenticated: true, user };
-        }
-    }
-    return { authenticated: false };
-}
-/**
- * Express middleware to protect routes.
- */
-function createAuthMiddleware(config, basePath, _logger) {
-    return (req, res, next) => {
-        // Expose auth state to templates
-        res.locals.authEnabled = config.enabled;
-        res.locals.isDefaultPassword = config.isDefaultPassword;
-        if (!config.enabled) {
-            res.locals.authUser = null;
-            return next();
-        }
-        const p = req.path;
-        // Public static assets and auth endpoints bypass authentication
-        if (p.startsWith('/css/') ||
-            p.startsWith('/js/') ||
-            p === '/favicon.ico' ||
-            p === '/login' ||
-            p === '/logout') {
-            return next();
-        }
-        const auth = authenticateRequest(req, config);
-        if (auth.authenticated && auth.user) {
-            res.locals.authUser = auth.user;
-            req.user = auth.user;
-            return next();
-        }
-        // Unauthenticated: API requests get 401 JSON
-        if (p.startsWith('/api/') || req.xhr || (req.headers.accept && req.headers.accept.includes('application/json'))) {
-            res.setHeader('WWW-Authenticate', 'Basic realm="AdminDB", Bearer');
-            res.status(401).json({
-                success: false,
-                error: 'Authentication required. Please log in or provide valid credentials.',
-            });
-            return;
-        }
-        // Web UI: Redirect to login with return path
-        const returnUrl = req.originalUrl || `${basePath}${req.url}`;
-        const loginUrl = `${basePath}/login${returnUrl && returnUrl !== `${basePath}/` ? `?next=${encodeURIComponent(returnUrl)}` : ''}`;
-        res.redirect(loginUrl);
-    };
-}
-//# sourceMappingURL=middleware.js.map
+Object.defineProperty(exports,"__esModule",{value:!0}),exports.authenticateRequest=authenticateRequest,exports.createAuthMiddleware=function(config,basePath,_logger){return(req,res,next)=>{if(res.locals.authEnabled=config.enabled,res.locals.isDefaultPassword=config.isDefaultPassword,!config.enabled)return res.locals.authUser=null,next();const p=req.path;if(p.startsWith("/css/")||p.startsWith("/js/")||"/favicon.ico"===p||"/login"===p||"/logout"===p)return next();const auth=authenticateRequest(req,config);if(auth.authenticated&&auth.user)return res.locals.authUser=auth.user,req.user=auth.user,next();if(p.startsWith("/api/")||req.xhr||req.headers.accept&&req.headers.accept.includes("application/json"))return res.setHeader("WWW-Authenticate",'Basic realm="AdminDB", Bearer'),void res.status(401).json({success:!1,error:"Authentication required. Please log in or provide valid credentials."});const returnUrl=req.originalUrl||`${basePath}${req.url}`,loginUrl=`${basePath}/login${returnUrl&&returnUrl!==`${basePath}/`?`?next=${encodeURIComponent(returnUrl)}`:""}`;res.redirect(loginUrl)}};const types_1=require("./types"),crypto_1=require("./crypto");function authenticateRequest(req,config){if(!config.enabled)return{authenticated:!0,user:"anonymous"};const authHeader=req.headers.authorization;if(authHeader){const[scheme,credentials]=authHeader.split(/\s+/,2);if(scheme&&credentials)if("basic"===scheme.toLowerCase())try{const decoded=Buffer.from(credentials,"base64").toString("utf8"),colonIdx=decoded.indexOf(":");if(-1!==colonIdx){const user=decoded.slice(0,colonIdx),pass=decoded.slice(colonIdx+1);if((0,crypto_1.constantTimeCompare)(user,config.username)&&(0,crypto_1.verifyPassword)(pass,config.password))return{authenticated:!0,user:user}}}catch{}else if("bearer"===scheme.toLowerCase()){const user=(0,crypto_1.verifySessionToken)(credentials,config.secret,config.username);if(user)return{authenticated:!0,user:user};if((0,crypto_1.verifyPassword)(credentials,config.password))return{authenticated:!0,user:config.username}}}const sessionCookie=(0,crypto_1.parseCookies)(req.headers.cookie)[types_1.SESSION_COOKIE_NAME];if(sessionCookie){const user=(0,crypto_1.verifySessionToken)(sessionCookie,config.secret,config.username);if(user)return{authenticated:!0,user:user}}return{authenticated:!1}}

package/dist/auth/routes.d.ts

@@ -1,7 +1 @@
-import type { Router } from 'express';
-import type { Logger } from '../utils/logger';
-import { type ResolvedAuthConfig } from './types';
-/**
- * Registers /login and /logout routes.
- */
-export declare function registerAuthRoutes(router: Router, config: ResolvedAuthConfig, basePath: string, logger: Logger): void;
+import type {Router} from 'express';import type {Logger} from '../utils/logger';import{type ResolvedAuthConfig} from './types';export declare function registerAuthRoutes(router:Router,config:ResolvedAuthConfig,basePath:string,logger:Logger):void;

package/dist/auth/routes.js

@@ -1,78 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.registerAuthRoutes = registerAuthRoutes;
-const types_1 = require("./types");
-const middleware_1 = require("./middleware");
-const crypto_1 = require("./crypto");
-/**
- * Registers /login and /logout routes.
- */
-function registerAuthRoutes(router, config, basePath, logger) {
-    // GET /login - render login screen
-    router.get('/login', (req, res) => {
-        if (!config.enabled) {
-            return res.redirect(`${basePath}/`);
-        }
-        const auth = (0, middleware_1.authenticateRequest)(req, config);
-        if (auth.authenticated) {
-            const nextUrl = String(req.query.next ?? '').trim();
-            return res.redirect(nextUrl.startsWith('/') ? nextUrl : `${basePath}/`);
-        }
-        const nextUrl = String(req.query.next ?? '').trim();
-        res.render('pages/login', {
-            title: 'Sign in',
-            noSidebar: true,
-            next: nextUrl.startsWith('/') ? nextUrl : '',
-            isDefaultPassword: config.isDefaultPassword,
-            error: req.query.error ? String(req.query.error) : null,
-        });
-    });
-    // POST /login - process login submission
-    router.post('/login', (req, res) => {
-        if (!config.enabled) {
-            return res.redirect(`${basePath}/`);
-        }
-        const username = String(req.body?.username ?? '').trim();
-        const password = String(req.body?.password ?? '').trim();
-        const nextUrl = String(req.body?.next ?? req.query.next ?? '').trim();
-        const isValid = (0, crypto_1.constantTimeCompare)(username, config.username) &&
-            (0, crypto_1.verifyPassword)(password, config.password);
-        if (!isValid) {
-            logger.warn(`Failed login attempt for user "${username || '<empty>'}"`);
-            if (req.xhr || (req.headers.accept && req.headers.accept.includes('application/json'))) {
-                return res.status(401).json({ success: false, error: 'Invalid username or password.' });
-            }
-            return res.status(401).render('pages/login', {
-                title: 'Sign in',
-                noSidebar: true,
-                username,
-                next: nextUrl.startsWith('/') ? nextUrl : '',
-                isDefaultPassword: config.isDefaultPassword,
-                error: 'Invalid username or password. Please check your credentials.',
-            });
-        }
-        // Successful authentication: issue signed session cookie
-        const token = (0, crypto_1.createSessionToken)(config.username, config.secret, config.sessionDurationMs);
-        const maxAgeSec = Math.floor(config.sessionDurationMs / 1000);
-        const expiresUtc = new Date(Date.now() + config.sessionDurationMs).toUTCString();
-        const cookiePath = basePath || '/';
-        res.setHeader('Set-Cookie', `${types_1.SESSION_COOKIE_NAME}=${encodeURIComponent(token)}; Path=${cookiePath}; Max-Age=${maxAgeSec}; Expires=${expiresUtc}; HttpOnly; SameSite=Lax`);
-        if (req.xhr || (req.headers.accept && req.headers.accept.includes('application/json'))) {
-            return res.json({ success: true, message: 'Logged in successfully.', user: config.username, token });
-        }
-        const target = nextUrl.startsWith('/') ? nextUrl : `${basePath}/`;
-        res.redirect(target);
-    });
-    // POST & GET /logout - clear session and redirect to login
-    const handleLogout = (req, res) => {
-        const cookiePath = basePath || '/';
-        res.setHeader('Set-Cookie', `${types_1.SESSION_COOKIE_NAME}=; Path=${cookiePath}; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; HttpOnly; SameSite=Lax`);
-        if (req.xhr || (req.headers.accept && req.headers.accept.includes('application/json'))) {
-            return res.json({ success: true, message: 'Logged out successfully.' });
-        }
-        res.redirect(`${basePath}/login`);
-    };
-    router.post('/logout', handleLogout);
-    router.get('/logout', handleLogout);
-}
-//# sourceMappingURL=routes.js.map
+Object.defineProperty(exports,"__esModule",{value:!0}),exports.registerAuthRoutes=function(router,config,basePath,logger){router.get("/login",(req,res)=>{if(!config.enabled)return res.redirect(`${basePath}/`);if((0,middleware_1.authenticateRequest)(req,config).authenticated){const nextUrl=String(req.query.next??"").trim();return res.redirect(nextUrl.startsWith("/")?nextUrl:`${basePath}/`)}const nextUrl=String(req.query.next??"").trim();res.render("pages/login",{title:"Sign in",noSidebar:!0,next:nextUrl.startsWith("/")?nextUrl:"",isDefaultPassword:config.isDefaultPassword,error:req.query.error?String(req.query.error):null})}),router.post("/login",(req,res)=>{if(!config.enabled)return res.redirect(`${basePath}/`);const username=String(req.body?.username??"").trim(),password=String(req.body?.password??"").trim(),nextUrl=String(req.body?.next??req.query.next??"").trim();if(!((0,crypto_1.constantTimeCompare)(username,config.username)&&(0,crypto_1.verifyPassword)(password,config.password)))return logger.warn(`Failed login attempt for user "${username||"<empty>"}"`),req.xhr||req.headers.accept&&req.headers.accept.includes("application/json")?res.status(401).json({success:!1,error:"Invalid username or password."}):res.status(401).render("pages/login",{title:"Sign in",noSidebar:!0,username:username,next:nextUrl.startsWith("/")?nextUrl:"",isDefaultPassword:config.isDefaultPassword,error:"Invalid username or password. Please check your credentials."});const token=(0,crypto_1.createSessionToken)(config.username,config.secret,config.sessionDurationMs),maxAgeSec=Math.floor(config.sessionDurationMs/1e3),expiresUtc=new Date(Date.now()+config.sessionDurationMs).toUTCString(),cookiePath=basePath||"/";if(res.setHeader("Set-Cookie",`${types_1.SESSION_COOKIE_NAME}=${encodeURIComponent(token)}; Path=${cookiePath}; Max-Age=${maxAgeSec}; Expires=${expiresUtc}; HttpOnly; SameSite=Lax`),req.xhr||req.headers.accept&&req.headers.accept.includes("application/json"))return res.json({success:!0,message:"Logged in successfully.",user:config.username,token:token});const target=nextUrl.startsWith("/")?nextUrl:`${basePath}/`;res.redirect(target)});const handleLogout=(req,res)=>{const cookiePath=basePath||"/";if(res.setHeader("Set-Cookie",`${types_1.SESSION_COOKIE_NAME}=; Path=${cookiePath}; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; HttpOnly; SameSite=Lax`),req.xhr||req.headers.accept&&req.headers.accept.includes("application/json"))return res.json({success:!0,message:"Logged out successfully."});res.redirect(`${basePath}/login`)};router.post("/logout",handleLogout),router.get("/logout",handleLogout)};const types_1=require("./types"),middleware_1=require("./middleware"),crypto_1=require("./crypto");

package/dist/auth/types.d.ts

@@ -1,35 +1 @@
-export interface AuthConfig {
-    /**
-     * Whether authentication is enabled.
-     * Set to `false` to disable protection entirely (e.g. for development or custom upstream auth).
-     * Defaults to `true`.
-     */
-    enabled?: boolean;
-    /** Admin username. Defaults to `process.env.ADMINDB_USERNAME` or `'admin'`. */
-    username?: string;
-    /**
-     * Admin password or password hash (e.g. `scrypt:<salt>:<hash>`).
-     * Generate a hash using `npm run generatehash`.
-     * Defaults to `process.env.ADMINDB_PASSWORD` or the hardcoded default hash for `'admin'`.
-     */
-    password?: string;
-    /** Secret key used to sign session cookies. Defaults to `process.env.ADMINDB_SECRET` or auto-generated. */
-    secret?: string;
-    /** Session expiration time in milliseconds. Defaults to 7 days (604800000 ms). */
-    sessionDurationMs?: number;
-}
-export interface ResolvedAuthConfig {
-    enabled: boolean;
-    username: string;
-    password: string;
-    secret: string;
-    sessionDurationMs: number;
-    isDefaultPassword: boolean;
-}
-export declare const DEFAULT_USERNAME = "admin";
-/**
- * Hardcoded default scrypt hash for password 'admin' (salt: d9f2e64b8a1c3d5e7f0a2b4c6e801357, keyLen: 64).
- */
-export declare const DEFAULT_PASSWORD_HASH = "scrypt:d9f2e64b8a1c3d5e7f0a2b4c6e801357:cb3032b16f29c8d44f75c779f070c61c846b17eb333d07596ceb8470fc1b4c06cc720c08796ebc86937dab28a3ef580ced38a71c940fd4a169fd2e9cb9fa40e2";
-export declare const DEFAULT_SESSION_DURATION_MS: number;
-export declare const SESSION_COOKIE_NAME = "admindb_session";
+export interface AuthConfig{enabled?:boolean;username?:string;password?:string;secret?:string;sessionDurationMs?:number;}export interface ResolvedAuthConfig{enabled:boolean;username:string;password:string;secret:string;sessionDurationMs:number;isDefaultPassword:boolean;}export declare const DEFAULT_USERNAME="admin";export declare const DEFAULT_PASSWORD_HASH="scrypt:d9f2e64b8a1c3d5e7f0a2b4c6e801357:cb3032b16f29c8d44f75c779f070c61c846b17eb333d07596ceb8470fc1b4c06cc720c08796ebc86937dab28a3ef580ced38a71c940fd4a169fd2e9cb9fa40e2";export declare const DEFAULT_SESSION_DURATION_MS:number;export declare const SESSION_COOKIE_NAME="admindb_session";

package/dist/auth/types.js

@@ -1,11 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SESSION_COOKIE_NAME = exports.DEFAULT_SESSION_DURATION_MS = exports.DEFAULT_PASSWORD_HASH = exports.DEFAULT_USERNAME = void 0;
-exports.DEFAULT_USERNAME = 'admin';
-/**
- * Hardcoded default scrypt hash for password 'admin' (salt: d9f2e64b8a1c3d5e7f0a2b4c6e801357, keyLen: 64).
- */
-exports.DEFAULT_PASSWORD_HASH = 'scrypt:d9f2e64b8a1c3d5e7f0a2b4c6e801357:cb3032b16f29c8d44f75c779f070c61c846b17eb333d07596ceb8470fc1b4c06cc720c08796ebc86937dab28a3ef580ced38a71c940fd4a169fd2e9cb9fa40e2';
-exports.DEFAULT_SESSION_DURATION_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
-exports.SESSION_COOKIE_NAME = 'admindb_session';
-//# sourceMappingURL=types.js.map
+Object.defineProperty(exports,"__esModule",{value:!0}),exports.SESSION_COOKIE_NAME=exports.DEFAULT_SESSION_DURATION_MS=exports.DEFAULT_PASSWORD_HASH=exports.DEFAULT_USERNAME=void 0,exports.DEFAULT_USERNAME="admin",exports.DEFAULT_PASSWORD_HASH="scrypt:d9f2e64b8a1c3d5e7f0a2b4c6e801357:cb3032b16f29c8d44f75c779f070c61c846b17eb333d07596ceb8470fc1b4c06cc720c08796ebc86937dab28a3ef580ced38a71c940fd4a169fd2e9cb9fa40e2",exports.DEFAULT_SESSION_DURATION_MS=6048e5,exports.SESSION_COOKIE_NAME="admindb_session";

package/dist/cli/args.d.ts

@@ -1,45 +1 @@
-import type { LogLevel } from '../utils/logger';
-export interface CliArgs {
-    help: boolean;
-    version: boolean;
-    /** Bind host/interface (`--host`, `-H`). */
-    host?: string;
-    /** Port to listen on (`--port`, `-p`). */
-    port?: number;
-    /** A single database file to open directly (`--open`/`--db`/`--file`/`--db-path`). */
-    dbPath?: string;
-    /** PostgreSQL or database connection string (`--connection`/`--conn`/`--pg`). */
-    connection?: string;
-    /** Database connections map (from JSON config file). */
-    connections?: Record<string, string>;
-    /** Path to a JSON configuration file (`--config`, `-C`). */
-    configPath?: string;
-    /** Directory of database files to manage (`--dir`/`--folder`/`--db-dir`, `-d`). */
-    dbDir?: string;
-    /** Explicit database file paths (`--files`/`--db-files`). */
-    dbFiles?: string[];
-    /** URL prefix to serve under (`--base-path`/`--base`, `-b`). */
-    basePath?: string;
-    /** Log level filter (`--log-level`, `-l`). */
-    logLevel?: LogLevel;
-    /** Open databases read-only (`--readonly`, `-r`). */
-    readonly: boolean;
-    /** Serverless mode (enforces read-only database operations) (`--serverless`). */
-    serverless?: boolean;
-    /** Whether authentication is enabled (defaults to true). Set to false via `--no-auth`. */
-    auth?: boolean;
-    /** Custom admin username (`--username`/`--user`/`--auth-username`, `-u`). */
-    authUsername?: string;
-    /** Custom admin password (`--password`/`--pass`/`--auth-password`, `-P`). */
-    authPassword?: string;
-    /** Secret key for session cookie signing (`--auth-secret`/`--secret`). */
-    authSecret?: string;
-}
-export declare function helpText(): string;
-/** The installed `admindb` package version (from package.json), or '' when unknown. */
-export declare function getPackageVersion(): string;
-export declare function versionText(): string;
-export declare function parseArgs(argv: string[]): {
-    args: CliArgs;
-    error?: string;
-};
+import type {LogLevel} from '../utils/logger';export interface CliArgs{help:boolean;version:boolean;host?:string;port?:number;dbPath?:string;connection?:string;connections?:Record<string,string>;configPath?:string;dbDir?:string;dbFiles?:string[];basePath?:string;logLevel?:LogLevel;readonly :boolean;serverless?:boolean;auth?:boolean;authUsername?:string;authPassword?:string;authSecret?:string;}export declare function helpText():string;export declare function getPackageVersion():string;export declare function versionText():string;export declare function parseArgs(argv:string[]):{args:CliArgs;error?:string;};