aicodeman 1.4.1 → 1.5.0

package/dist/web/middleware/auth.js

@@ -12,8 +12,83 @@ import { StaleExpirationMap } from '../../utils/index.js';
 import { isAllowedRequestHost, isAllowedRequestOrigin } from '../network-auth-policy.js';
 import { AUTH_SESSION_TTL_MS, MAX_AUTH_SESSIONS, AUTH_FAILURE_MAX, AUTH_FAILURE_WINDOW_MS, } from '../../config/auth-config.js';
 import { getHookSecret, HOOK_SECRET_HEADER } from '../../config/hook-secret.js';
+import { isMultiUserMode } from '../../config/multiuser.js';
+import { findUser, setPassword, touchLastLogin, verifyPassword } from '../../user-store.js';
+import { ApiErrorCode, createErrorResponse } from '../../types.js';
 // Auth session cookie name
 export const AUTH_COOKIE_NAME = 'codeman_session';
+/** Rate-limit response for a client that exceeded the failure cap. */
+function sendAuthRateLimit(reply, failures, key) {
+    const remainingMs = failures.getRemainingTtl(key) ?? AUTH_FAILURE_WINDOW_MS;
+    const retryAfterSeconds = Math.max(1, Math.ceil(remainingMs / 1000));
+    reply.header('Retry-After', String(retryAfterSeconds));
+    reply.code(429).send('Too Many Requests — try again later');
+}
+/** Parse a `Basic base64(user:pass)` header into its parts, or null if malformed. */
+function parseBasicAuth(header) {
+    if (!header || !header.startsWith('Basic '))
+        return null;
+    try {
+        const decoded = Buffer.from(header.slice(6), 'base64').toString('utf-8');
+        const idx = decoded.indexOf(':');
+        if (idx < 0)
+            return null;
+        return { username: decoded.slice(0, idx), password: decoded.slice(idx + 1) };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The `/api/hook-event` + `/api/status-telemetry` localhost bypass, shared by the
+ * single-user and multi-user auth hooks so the security-critical logic has ONE
+ * source of truth. Returns:
+ *  - 'bypass'   : loopback + valid hook secret; the caller should allow the request
+ *  - 'rejected' : a reply was already sent (wrong secret rate-limited / 401)
+ *  - 'continue' : not a hook request (or non-loopback); fall through to normal auth
+ *
+ * COD-91: the shared hook secret is required UNCONDITIONALLY on the loopback bypass
+ * (a user's own loopback reverse proxy is indistinguishable from a real local hook).
+ */
+function checkHookSecretBypass(req, reply, hookSecretFailures) {
+    if ((req.url === '/api/hook-event' || req.url === '/api/status-telemetry') && req.method === 'POST') {
+        const ip = req.ip;
+        const isLoopback = ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1';
+        if (isLoopback) {
+            const presented = Buffer.from(req.headers[HOOK_SECRET_HEADER.toLowerCase()]?.toString() ?? '');
+            const expected = Buffer.from(getHookSecret());
+            if (presented.length === expected.length && timingSafeEqual(presented, expected)) {
+                return 'bypass';
+            }
+            const hookIp = req.ip;
+            const hookFailures = hookSecretFailures.get(hookIp) ?? 0;
+            if (hookFailures >= AUTH_FAILURE_MAX) {
+                sendAuthRateLimit(reply, hookSecretFailures, hookIp);
+                return 'rejected';
+            }
+            hookSecretFailures.set(hookIp, hookFailures + 1);
+            reply.code(401).send('Unauthorized: hook secret required');
+            return 'rejected';
+        }
+        // Non-localhost hook requests fall through to normal auth
+    }
+    return 'continue';
+}
+/**
+ * Requests that a `mustChangePassword` user may still reach: the identity probe,
+ * the password-change endpoint, and any non-API path (static assets / index.html,
+ * so the browser can load the app and render the change-password modal).
+ */
+function isPasswordChangeExempt(req) {
+    const url = (req.url ?? '').split('?')[0];
+    if (url === '/api/me' || url === '/api/me/password')
+        return true;
+    // Security: the WebSocket terminal (/ws/...) is a functional channel, not a static
+    // asset, so it must NOT be exempt, or a locked user keeps a working terminal.
+    if (url.startsWith('/ws/'))
+        return false;
+    return !url.startsWith('/api/');
+}
 /**
  * Register HTTP Basic Auth middleware with session cookies and rate limiting.
  * Only active when CODEMAN_PASSWORD is set.
@@ -29,12 +104,19 @@ export function registerAuthMiddleware(app, https) {
         authFailures: null,
         qrAuthFailures: null,
         hookSecretFailures: null,
+        userFailures: null,
     };
+    // Always declare req.authUser so downstream reads are safe (single-user leaves it
+    // undefined; the ownership helpers then default to a synthetic admin).
+    if (!app.hasRequestDecorator('authUser'))
+        app.decorateRequest('authUser', undefined);
+    const multiUser = isMultiUserMode();
     const authPassword = process.env.CODEMAN_PASSWORD;
-    if (!authPassword)
+    // No auth at all: single-user with no password (byte-identical to legacy). In
+    // multi-user mode auth is ALWAYS active (users authenticate individually), even
+    // without CODEMAN_PASSWORD.
+    if (!multiUser && !authPassword)
         return state;
-    const authUsername = process.env.CODEMAN_USERNAME || 'admin';
-    const expectedHeader = 'Basic ' + Buffer.from(`${authUsername}:${authPassword}`).toString('base64');
     // Session token store — active sessions extend TTL on access
     state.authSessions = new StaleExpirationMap({
         ttlMs: AUTH_SESSION_TTL_MS,
@@ -62,52 +144,27 @@ export function registerAuthMiddleware(app, https) {
     const authSessions = state.authSessions;
     const authFailures = state.authFailures;
     const hookSecretFailures = state.hookSecretFailures;
-    function sendAuthRateLimit(reply, clientIp, failures = authFailures) {
-        const remainingMs = failures.getRemainingTtl(clientIp) ?? AUTH_FAILURE_WINDOW_MS;
-        const retryAfterSeconds = Math.max(1, Math.ceil(remainingMs / 1000));
-        reply.header('Retry-After', String(retryAfterSeconds));
-        reply.code(429).send('Too Many Requests — try again later');
+    if (multiUser) {
+        // Per-username failure bucket: a botnet can't brute-force one account across
+        // many IPs, and one user behind a NAT can't lock out everyone else.
+        state.userFailures = new StaleExpirationMap({
+            ttlMs: AUTH_FAILURE_WINDOW_MS,
+            refreshOnGet: false,
+        });
+        registerMultiUserAuthHook(app, https, authSessions, authFailures, hookSecretFailures, state.userFailures);
+        return state;
     }
+    // ── Single-user Basic Auth (unchanged behavior; CODEMAN_PASSWORD required) ──
+    const authUsername = process.env.CODEMAN_USERNAME || 'admin';
+    const expectedHeader = 'Basic ' + Buffer.from(`${authUsername}:${authPassword}`).toString('base64');
     app.addHook('onRequest', (req, reply, done) => {
-        // Hook events + statusline telemetry come from local Claude Code (curl from
-        // localhost) — no Basic-Auth credentials available. Validated downstream by
-        // HookEventSchema / StatusTelemetrySchema. Same loopback+hook-secret gate.
-        //
-        // COD-54: the bare localhost bypass is unsafe while a tunnel is running, because
-        // `cloudflared --url http://127.0.0.1:port` proxies internet traffic INTO the
-        // loopback origin, so a tunneled request arrives with req.ip === 127.0.0.1 and
-        // would pass. COD-91: require the shared hook secret on the loopback bypass
-        // UNCONDITIONALLY (not just while the managed tunnel is up). Codeman can't detect
-        // a user's own loopback reverse proxy (their own `cloudflared --url`, `tailscale
-        // serve`, nginx → 127.0.0.1), so tunnel-gating left that path with the unsafe plain
-        // bypass. Managed-session hooks always present the secret (X-Codeman-Hook-Secret,
-        // from $CODEMAN_HOOK_SECRET_FILE — generated for every instance), so requiring it
-        // always closes the gap without breaking the legitimate hook channel.
-        if ((req.url === '/api/hook-event' || req.url === '/api/status-telemetry') && req.method === 'POST') {
-            const ip = req.ip;
-            const isLoopback = ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1';
-            if (isLoopback) {
-                // Always require the shared secret (constant-time compare).
-                const presented = Buffer.from(req.headers[HOOK_SECRET_HEADER.toLowerCase()]?.toString() ?? '');
-                const expected = Buffer.from(getHookSecret());
-                if (presented.length === expected.length && timingSafeEqual(presented, expected)) {
-                    done();
-                    return;
-                }
-                // Wrong/absent secret — rate-limit per IP in the DEDICATED hook bucket
-                // (never authFailures, which would lock out the login path).
-                const hookIp = req.ip;
-                const hookFailures = hookSecretFailures.get(hookIp) ?? 0;
-                if (hookFailures >= AUTH_FAILURE_MAX) {
-                    sendAuthRateLimit(reply, hookIp, hookSecretFailures);
-                    return;
-                }
-                hookSecretFailures.set(hookIp, hookFailures + 1);
-                reply.code(401).send('Unauthorized: hook secret required');
-                return;
-            }
-            // Non-localhost hook requests fall through to normal auth
+        const bypass = checkHookSecretBypass(req, reply, hookSecretFailures);
+        if (bypass === 'bypass') {
+            done();
+            return;
         }
+        if (bypass === 'rejected')
+            return;
         // QR auth path — handled by the route itself (token validation + rate limiting)
         if (req.url?.startsWith('/q/')) {
             done();
@@ -120,10 +177,6 @@ export function registerAuthMiddleware(app, https) {
         if (sessionToken && authSessions.get(sessionToken) !== undefined) {
             // Sliding cookie: re-issue on every authenticated request so the browser
             // cookie lifetime tracks the server-side sliding TTL (refreshOnGet above).
-            // Without this the cookie has a fixed lifetime from login; the browser
-            // drops it mid-use, the next request arrives cookie-less and falls through
-            // to Basic Auth — popping the native username/password dialog, which reads
-            // as a random logout while actively working.
             reply.setCookie(AUTH_COOKIE_NAME, sessionToken, {
                 httpOnly: true,
                 secure: https,
@@ -168,7 +221,7 @@ export function registerAuthMiddleware(app, https) {
         // Rate limit only requests that failed to authenticate on this attempt.
         const failures = authFailures.get(clientIp) ?? 0;
         if (failures >= AUTH_FAILURE_MAX) {
-            sendAuthRateLimit(reply, clientIp);
+            sendAuthRateLimit(reply, authFailures, clientIp);
             return;
         }
         // Auth failed — track failure count
@@ -178,6 +231,152 @@ export function registerAuthMiddleware(app, https) {
     });
     return state;
 }
+/**
+ * Multi-user auth hook (async, because password verification runs scrypt). Verifies
+ * `username:password` against the user store, mints an identity-carrying cookie,
+ * decorates `req.authUser`, enforces the per-IP + per-username rate limits, and the
+ * `mustChangePassword` lockbox. The single-user hook above is left untouched.
+ */
+function registerMultiUserAuthHook(app, https, authSessions, authFailures, hookSecretFailures, userFailures) {
+    const setSessionCookie = (reply, token) => reply.setCookie(AUTH_COOKIE_NAME, token, {
+        httpOnly: true,
+        secure: https,
+        sameSite: 'lax',
+        maxAge: AUTH_SESSION_TTL_MS / 1000,
+        path: '/',
+    });
+    // Evict the oldest cookie session of the SAME user first (so one user logging in
+    // 100 times cannot flush everyone else's sessions), falling back to global-oldest.
+    const evictForCapacity = (username) => {
+        let userKey;
+        let userTs = Infinity;
+        let globalKey;
+        let globalTs = Infinity;
+        for (const [k, v] of authSessions) {
+            if (v.createdAt < globalTs) {
+                globalTs = v.createdAt;
+                globalKey = k;
+            }
+            if (v.username === username && v.createdAt < userTs) {
+                userTs = v.createdAt;
+                userKey = k;
+            }
+        }
+        const key = userKey ?? globalKey;
+        if (key !== undefined)
+            authSessions.delete(key);
+    };
+    const enforcePasswordChange = (req, reply, mustChange) => {
+        if (mustChange && !isPasswordChangeExempt(req)) {
+            reply.code(403).send(createErrorResponse(ApiErrorCode.PASSWORD_CHANGE_REQUIRED));
+            return true;
+        }
+        return false;
+    };
+    app.addHook('onRequest', async (req, reply) => {
+        const bypass = checkHookSecretBypass(req, reply, hookSecretFailures);
+        if (bypass === 'bypass' || bypass === 'rejected')
+            return;
+        // QR redemption path — handled by the route itself.
+        if (req.url?.startsWith('/q/'))
+            return;
+        const clientIp = req.ip;
+        // 1. Cookie session (carries identity + mustChangePassword snapshot).
+        const sessionToken = req.cookies[AUTH_COOKIE_NAME];
+        const record = sessionToken ? authSessions.get(sessionToken) : undefined;
+        if (record && record.username) {
+            // Security: re-validate the cookie identity against the store on every request so
+            // an out-of-band mutation the in-memory map can't see (the `codeman users` CLI,
+            // a separate process, deleting/disabling/demoting a user) takes effect promptly
+            // instead of riding the 24h cookie. findUser is cached ~1s, so this is cheap.
+            let live;
+            try {
+                live = await findUser(record.username);
+            }
+            catch {
+                // The store is transiently unreadable/corrupt (readUsers throws on a non-ENOENT
+                // read, #23). Fall back to the cookie's snapshot for THIS request rather than
+                // 500-ing an already-authenticated client (pre-#24 behaviour); a persistently
+                // corrupt store still fails all WRITES loudly at the mutator/bootstrap layer.
+                req.authUser = { username: record.username, role: record.role ?? 'user' };
+                setSessionCookie(reply, sessionToken);
+                enforcePasswordChange(req, reply, !!record.mustChangePassword);
+                return;
+            }
+            if (!live || live.disabled) {
+                authSessions.delete(sessionToken);
+                reply.clearCookie(AUTH_COOKIE_NAME, { path: '/' });
+                reply.code(401).send('Unauthorized');
+                return;
+            }
+            // Trust the LIVE role/mustChangePassword, not the (possibly stale) cookie snapshot
+            // (also defends #9/#13: a CLI demotion is reflected without a revoke).
+            req.authUser = { username: live.username, role: live.role };
+            setSessionCookie(reply, sessionToken); // sliding re-issue
+            enforcePasswordChange(req, reply, !!live.mustChangePassword);
+            return;
+        }
+        // 2. Basic Auth against the user store (scrypt verify).
+        // Per-IP pre-gate bounds scrypt CPU cost from one source (does NOT gate on the
+        // per-username bucket here; see below).
+        const ipFail = authFailures.get(clientIp) ?? 0;
+        if (ipFail >= AUTH_FAILURE_MAX) {
+            sendAuthRateLimit(reply, authFailures, clientIp);
+            return;
+        }
+        const creds = parseBasicAuth(req.headers.authorization);
+        if (creds) {
+            const normUser = creds.username.trim().toLowerCase();
+            // Security: VERIFY FIRST, then throttle only FAILED attempts. Consulting the
+            // per-username bucket before verifying let throwaway IPs lock out a known account
+            // (incl. admin) even with the correct password. A correct password must always
+            // win and self-heal both buckets, regardless of the username-failure count.
+            const result = await verifyPassword(creds.username, creds.password);
+            if (result) {
+                const { user, needsRehash: rehash } = result;
+                if (rehash)
+                    void setPassword(user.username, creds.password).catch(() => { });
+                void touchLastLogin(user.username).catch(() => { });
+                authFailures.delete(clientIp);
+                userFailures.delete(normUser);
+                const token = randomBytes(32).toString('hex');
+                if (authSessions.size >= MAX_AUTH_SESSIONS)
+                    evictForCapacity(user.username);
+                authSessions.set(token, {
+                    ip: clientIp,
+                    ua: req.headers['user-agent'] ?? '',
+                    createdAt: Date.now(),
+                    method: 'basic',
+                    username: user.username,
+                    role: user.role,
+                    mustChangePassword: !!user.mustChangePassword,
+                });
+                req.authUser = { username: user.username, role: user.role };
+                setSessionCookie(reply, token);
+                enforcePasswordChange(req, reply, !!user.mustChangePassword);
+                return;
+            }
+            // Failed guess: count it against BOTH buckets. Once the per-username bucket
+            // reaches the cap, further FAILED attempts get 429 (throttles distributed
+            // brute-force), but this path is only reached on a wrong password, so it can
+            // never deny a correct one.
+            const uFail = (userFailures.get(normUser) ?? 0) + 1;
+            userFailures.set(normUser, uFail);
+            authFailures.set(clientIp, ipFail + 1);
+            if (uFail >= AUTH_FAILURE_MAX) {
+                sendAuthRateLimit(reply, userFailures, normUser);
+                return;
+            }
+            reply.header('WWW-Authenticate', 'Basic realm="Codeman"');
+            reply.code(401).send('Unauthorized');
+            return;
+        }
+        // No credentials presented: count against the per-IP bucket and challenge.
+        authFailures.set(clientIp, ipFail + 1);
+        reply.header('WWW-Authenticate', 'Basic realm="Codeman"');
+        reply.code(401).send('Unauthorized');
+    });
+}
 /** Methods that don't change server state and so skip the cross-site Origin check. */
 const SAFE_HTTP_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
 /**

package/dist/web/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/web/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAmB,MAAM,2BAA2B,CAAC;AAC1G,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEhF,2BAA2B;AAC3B,MAAM,CAAC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAUlD;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAoB,EAAE,KAAc;IACzE,MAAM,KAAK,GAAc;QACvB,YAAY,EAAE,IAAI;QAClB,YAAY,EAAE,IAAI;QAClB,cAAc,EAAE,IAAI;QACpB,kBAAkB,EAAE,IAAI;KACzB,CAAC;IAEF,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAClD,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAEhC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC;IAC7D,MAAM,cAAc,GAAG,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEpG,6DAA6D;IAC7D,KAAK,CAAC,YAAY,GAAG,IAAI,kBAAkB,CAA4B;QACrE,KAAK,EAAE,mBAAmB;QAC1B,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IAEH,4DAA4D;IAC5D,KAAK,CAAC,YAAY,GAAG,IAAI,kBAAkB,CAAiB;QAC1D,KAAK,EAAE,sBAAsB;QAC7B,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IAEH,0EAA0E;IAC1E,KAAK,CAAC,cAAc,GAAG,IAAI,kBAAkB,CAAiB;QAC5D,KAAK,EAAE,sBAAsB;QAC7B,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IAEH,8EAA8E;IAC9E,gFAAgF;IAChF,gFAAgF;IAChF,iFAAiF;IACjF,6DAA6D;IAC7D,KAAK,CAAC,kBAAkB,GAAG,IAAI,kBAAkB,CAAiB;QAChE,KAAK,EAAE,sBAAsB;QAC7B,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,MAAM,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,CAAC;IAEpD,SAAS,iBAAiB,CACxB,KAAmB,EACnB,QAAgB,EAChB,WAA+C,YAAY;QAE3D,MAAM,WAAW,GAAG,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,sBAAsB,CAAC;QACjF,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;QACrE,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAC9D,CAAC;IAED,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC5C,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,EAAE;QACF,iFAAiF;QACjF,8EAA8E;QAC9E,+EAA+E;QAC/E,4EAA4E;QAC5E,kFAAkF;QAClF,iFAAiF;QACjF,oFAAoF;QACpF,kFAAkF;QAClF,kFAAkF;QAClF,sEAAsE;QACtE,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,iBAAiB,IAAI,GAAG,CAAC,GAAG,KAAK,uBAAuB,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACpG,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,UAAU,GAAG,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,kBAAkB,CAAC;YACnF,IAAI,UAAU,EAAE,CAAC;gBACf,4DAA4D;gBAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/F,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;gBAC9C,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;oBACjF,IAAI,EAAE,CAAC;oBACP,OAAO;gBACT,CAAC;gBACD,uEAAuE;gBACvE,6DAA6D;gBAC7D,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACzD,IAAI,YAAY,IAAI,gBAAgB,EAAE,CAAC;oBACrC,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;oBACrD,OAAO;gBACT,CAAC;gBACD,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC;gBACjD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;gBAC3D,OAAO;YACT,CAAC;YACD,0DAA0D;QAC5D,CAAC;QAED,gFAAgF;QAChF,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC;QAExB,8EAA8E;QAC9E,gFAAgF;QAChF,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnD,IAAI,YAAY,IAAI,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,SAAS,EAAE,CAAC;YACjE,yEAAyE;YACzE,2EAA2E;YAC3E,uEAAuE;YACvE,2EAA2E;YAC3E,2EAA2E;YAC3E,6CAA6C;YAC7C,KAAK,CAAC,SAAS,CAAC,gBAAgB,EAAE,YAAY,EAAE;gBAC9C,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,KAAK;gBACb,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,mBAAmB,GAAG,IAAI,EAAE,UAAU;gBAC9C,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;YACH,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,mFAAmF;QACnF,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,IAAI,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;YACnF,4EAA4E;YAC5E,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAE9C,yDAAyD;YACzD,IAAI,YAAY,CAAC,IAAI,IAAI,iBAAiB,EAAE,CAAC;gBAC3C,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBACnD,IAAI,SAAS,KAAK,SAAS;oBAAE,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9D,CAAC;YAED,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE;gBACtB,EAAE,EAAE,QAAQ;gBACZ,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE;gBACnC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,MAAM,EAAE,OAAO;aAChB,CAAC,CAAC;YAEH,yCAAyC;YACzC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAE9B,KAAK,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,EAAE;gBACvC,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,KAAK;gBACb,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,mBAAmB,GAAG,IAAI,EAAE,UAAU;gBAC9C,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;YACH,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,QAAQ,IAAI,gBAAgB,EAAE,CAAC;YACjC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QAED,oCAAoC;QACpC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;QAEzC,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sFAAsF;AACtF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAoB,EAAE,SAA2B;IACjF,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YACpD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9F,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAoB,EAAE,KAAc;IAC1E,+EAA+E;IAC/E,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,6CAA6C;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,GAAG,CAAC;IACpD,MAAM,SAAS,GACb,4DAA4D,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxG,MAAM,UAAU,GAAG,2CAA2C,CAAC;IAC/D,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,8BAA8B;IAC9B,MAAM,SAAS,GAAG,2BAA2B,CAAC;IAC9C,MAAM,GAAG,GACP,uBAAuB,SAAS,+DAA+D;QAC/F,+BAA+B,UAAU,qEAAqE,SAAS,EAAE,CAAC;IAE5H,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC5C,KAAK,CAAC,MAAM,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAClD,KAAK,CAAC,MAAM,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;QAC9C,KAAK,CAAC,MAAM,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;QAC7C,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,MAAM,CAAC,2BAA2B,EAAE,qCAAqC,CAAC,CAAC;QACnF,CAAC;QAED,iDAAiD;QACjD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;oBAC3F,KAAK,CAAC,MAAM,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;oBACpD,KAAK,CAAC,MAAM,CAAC,8BAA8B,EAAE,wCAAwC,CAAC,CAAC;oBACvF,KAAK,CAAC,MAAM,CAAC,8BAA8B,EAAE,6BAA6B,CAAC,CAAC;oBAC5E,KAAK,CAAC,MAAM,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,kDAAkD;YACpD,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/web/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAmB,MAAM,2BAA2B,CAAC;AAC1G,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC5F,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAiB,MAAM,gBAAgB,CAAC;AAUlF,2BAA2B;AAC3B,MAAM,CAAC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAYlD,sEAAsE;AACtE,SAAS,iBAAiB,CAAC,KAAmB,EAAE,QAA4C,EAAE,GAAW;IACvG,MAAM,WAAW,GAAG,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,sBAAsB,CAAC;IAC5E,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;IACrE,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACvD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;AAC9D,CAAC;AAED,qFAAqF;AACrF,SAAS,cAAc,CAAC,MAAe;IACrC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,qBAAqB,CAC5B,GAAmB,EACnB,KAAmB,EACnB,kBAAsD;IAEtD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,iBAAiB,IAAI,GAAG,CAAC,GAAG,KAAK,uBAAuB,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACpG,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,kBAAkB,CAAC;QACnF,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/F,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YAC9C,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACjF,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,YAAY,IAAI,gBAAgB,EAAE,CAAC;gBACrC,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;gBACrD,OAAO,UAAU,CAAC;YACpB,CAAC;YACD,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC;YACjD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YAC3D,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,0DAA0D;IAC5D,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,GAAmB;IACjD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACjE,mFAAmF;IACnF,8EAA8E;IAC9E,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAoB,EAAE,KAAc;IACzE,MAAM,KAAK,GAAc;QACvB,YAAY,EAAE,IAAI;QAClB,YAAY,EAAE,IAAI;QAClB,cAAc,EAAE,IAAI;QACpB,kBAAkB,EAAE,IAAI;QACxB,YAAY,EAAE,IAAI;KACnB,CAAC;IAEF,kFAAkF;IAClF,uEAAuE;IACvE,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,UAAU,CAAC;QAAE,GAAG,CAAC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAErF,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAElD,8EAA8E;IAC9E,gFAAgF;IAChF,4BAA4B;IAC5B,IAAI,CAAC,SAAS,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAE9C,6DAA6D;IAC7D,KAAK,CAAC,YAAY,GAAG,IAAI,kBAAkB,CAA4B;QACrE,KAAK,EAAE,mBAAmB;QAC1B,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IAEH,4DAA4D;IAC5D,KAAK,CAAC,YAAY,GAAG,IAAI,kBAAkB,CAAiB;QAC1D,KAAK,EAAE,sBAAsB;QAC7B,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IAEH,0EAA0E;IAC1E,KAAK,CAAC,cAAc,GAAG,IAAI,kBAAkB,CAAiB;QAC5D,KAAK,EAAE,sBAAsB;QAC7B,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IAEH,8EAA8E;IAC9E,gFAAgF;IAChF,gFAAgF;IAChF,iFAAiF;IACjF,6DAA6D;IAC7D,KAAK,CAAC,kBAAkB,GAAG,IAAI,kBAAkB,CAAiB;QAChE,KAAK,EAAE,sBAAsB;QAC7B,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,MAAM,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,CAAC;IAEpD,IAAI,SAAS,EAAE,CAAC;QACd,6EAA6E;QAC7E,oEAAoE;QACpE,KAAK,CAAC,YAAY,GAAG,IAAI,kBAAkB,CAAiB;YAC1D,KAAK,EAAE,sBAAsB;YAC7B,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;QACH,yBAAyB,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC1G,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+EAA+E;IAC/E,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC;IAC7D,MAAM,cAAc,GAAG,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEpG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,MAAM,KAAK,UAAU;YAAE,OAAO;QAElC,gFAAgF;QAChF,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC;QAExB,8EAA8E;QAC9E,gFAAgF;QAChF,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnD,IAAI,YAAY,IAAI,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,SAAS,EAAE,CAAC;YACjE,yEAAyE;YACzE,2EAA2E;YAC3E,KAAK,CAAC,SAAS,CAAC,gBAAgB,EAAE,YAAY,EAAE;gBAC9C,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,KAAK;gBACb,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,mBAAmB,GAAG,IAAI,EAAE,UAAU;gBAC9C,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;YACH,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,mFAAmF;QACnF,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,IAAI,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;YACnF,4EAA4E;YAC5E,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAE9C,yDAAyD;YACzD,IAAI,YAAY,CAAC,IAAI,IAAI,iBAAiB,EAAE,CAAC;gBAC3C,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBACnD,IAAI,SAAS,KAAK,SAAS;oBAAE,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9D,CAAC;YAED,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE;gBACtB,EAAE,EAAE,QAAQ;gBACZ,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE;gBACnC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,MAAM,EAAE,OAAO;aAChB,CAAC,CAAC;YAEH,yCAAyC;YACzC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAE9B,KAAK,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,EAAE;gBACvC,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,KAAK;gBACb,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,mBAAmB,GAAG,IAAI,EAAE,UAAU;gBAC9C,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;YACH,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,QAAQ,IAAI,gBAAgB,EAAE,CAAC;YACjC,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QAED,oCAAoC;QACpC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;QAEzC,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAChC,GAAoB,EACpB,KAAc,EACd,YAA2D,EAC3D,YAAgD,EAChD,kBAAsD,EACtD,YAAgD;IAEhD,MAAM,gBAAgB,GAAG,CAAC,KAAmB,EAAE,KAAa,EAAE,EAAE,CAC9D,KAAK,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,EAAE;QACvC,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,mBAAmB,GAAG,IAAI;QAClC,IAAI,EAAE,GAAG;KACV,CAAC,CAAC;IAEL,iFAAiF;IACjF,mFAAmF;IACnF,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAE,EAAE;QAC5C,IAAI,OAA2B,CAAC;QAChC,IAAI,MAAM,GAAG,QAAQ,CAAC;QACtB,IAAI,SAA6B,CAAC;QAClC,IAAI,QAAQ,GAAG,QAAQ,CAAC;QACxB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,SAAS,GAAG,QAAQ,EAAE,CAAC;gBAC3B,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvB,SAAS,GAAG,CAAC,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC;gBACpD,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC;gBACrB,OAAO,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,IAAI,SAAS,CAAC;QACjC,IAAI,GAAG,KAAK,SAAS;YAAE,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC,CAAC;IAEF,MAAM,qBAAqB,GAAG,CAAC,GAAmB,EAAE,KAAmB,EAAE,UAAmB,EAAW,EAAE;QACvG,IAAI,UAAU,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC,CAAC;YACjF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,UAAU;YAAE,OAAO;QAEzD,oDAAoD;QACpD,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO;QAEvC,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC;QAExB,sEAAsE;QACtE,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC9B,kFAAkF;YAClF,gFAAgF;YAChF,gFAAgF;YAChF,8EAA8E;YAC9E,IAAI,IAA0C,CAAC;YAC/C,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,gFAAgF;gBAChF,8EAA8E;gBAC9E,8EAA8E;gBAC9E,8EAA8E;gBAC9E,GAAG,CAAC,QAAQ,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC1E,gBAAgB,CAAC,KAAK,EAAE,YAAa,CAAC,CAAC;gBACvC,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;gBAC/D,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC3B,YAAY,CAAC,MAAM,CAAC,YAAa,CAAC,CAAC;gBACnC,KAAK,CAAC,WAAW,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBACnD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBACrC,OAAO;YACT,CAAC;YACD,mFAAmF;YACnF,uEAAuE;YACvE,GAAG,CAAC,QAAQ,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5D,gBAAgB,CAAC,KAAK,EAAE,YAAa,CAAC,CAAC,CAAC,mBAAmB;YAC3D,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,wDAAwD;QACxD,+EAA+E;QAC/E,wCAAwC;QACxC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,MAAM,IAAI,gBAAgB,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACxD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrD,6EAA6E;YAC7E,kFAAkF;YAClF,+EAA+E;YAC/E,4EAA4E;YAC5E,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACpE,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;gBAC7C,IAAI,MAAM;oBAAE,KAAK,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAC5E,KAAK,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACnD,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC9B,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAE9B,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC9C,IAAI,YAAY,CAAC,IAAI,IAAI,iBAAiB;oBAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC5E,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE;oBACtB,EAAE,EAAE,QAAQ;oBACZ,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE;oBACnC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;oBACrB,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB;iBAC9C,CAAC,CAAC;gBACH,GAAG,CAAC,QAAQ,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5D,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBAC/B,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBAC7D,OAAO;YACT,CAAC;YACD,4EAA4E;YAC5E,0EAA0E;YAC1E,6EAA6E;YAC7E,4BAA4B;YAC5B,MAAM,KAAK,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACpD,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAClC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;YACvC,IAAI,KAAK,IAAI,gBAAgB,EAAE,CAAC;gBAC9B,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QAED,2EAA2E;QAC3E,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;QACvC,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,sFAAsF;AACtF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAoB,EAAE,SAA2B;IACjF,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YACpD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9F,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAoB,EAAE,KAAc;IAC1E,+EAA+E;IAC/E,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,6CAA6C;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,GAAG,CAAC;IACpD,MAAM,SAAS,GACb,4DAA4D,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxG,MAAM,UAAU,GAAG,2CAA2C,CAAC;IAC/D,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,8BAA8B;IAC9B,MAAM,SAAS,GAAG,2BAA2B,CAAC;IAC9C,MAAM,GAAG,GACP,uBAAuB,SAAS,+DAA+D;QAC/F,+BAA+B,UAAU,qEAAqE,SAAS,EAAE,CAAC;IAE5H,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC5C,KAAK,CAAC,MAAM,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAClD,KAAK,CAAC,MAAM,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;QAC9C,KAAK,CAAC,MAAM,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;QAC7C,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,MAAM,CAAC,2BAA2B,EAAE,qCAAqC,CAAC,CAAC;QACnF,CAAC;QAED,iDAAiD;QACjD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;oBAC3F,KAAK,CAAC,MAAM,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;oBACpD,KAAK,CAAC,MAAM,CAAC,8BAA8B,EAAE,wCAAwC,CAAC,CAAC;oBACvF,KAAK,CAAC,MAAM,CAAC,8BAA8B,EAAE,6BAA6B,CAAC,CAAC;oBAC5E,KAAK,CAAC,MAAM,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,kDAAkD;YACpD,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/web/ports/auth-port.d.ts

@@ -9,6 +9,19 @@ export interface AuthSessionRecord {
     ua: string;
     createdAt: number;
     method: 'qr' | 'basic';
+    /**
+     * Multi-user identity carried by the cookie (single-user leaves these unset).
+     * Snapshotted at mint time. Authorization-relevant admin changes (password reset,
+     * disable, delete, role change, bypass-grant change) revoke the user's sessions so
+     * a stale snapshot can't outlive the change; additionally the cookie fast-path
+     * re-reads role/disabled/mustChangePassword live from the store each request, so an
+     * out-of-band CLI mutation also takes effect promptly. See docs/multi-user-plan.md
+     * section 5.
+     */
+    username?: string;
+    role?: 'admin' | 'user';
+    /** Whether this user must change their password before other actions are allowed. */
+    mustChangePassword?: boolean;
 }
 export interface AuthPort {
     readonly authSessions: StaleExpirationMap<string, AuthSessionRecord> | null;

package/dist/web/ports/auth-port.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-port.d.ts","sourceRoot":"","sources":["../../../src/web/ports/auth-port.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,oEAAoE;AACpE,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,IAAI,CAAC;IAC5E,QAAQ,CAAC,cAAc,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACnE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB"}
+{"version":3,"file":"auth-port.d.ts","sourceRoot":"","sources":["../../../src/web/ports/auth-port.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,oEAAoE;AACpE,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;IACvB;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,qFAAqF;IACrF,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,IAAI,CAAC;IAC5E,QAAQ,CAAC,cAAc,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACnE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB"}

package/dist/web/ports/config-port.d.ts

@@ -22,7 +22,10 @@ export interface ConfigPort {
     }>;
     getTerminalHistoryConfig(): Promise<TerminalHistoryConfig>;
     getDefaultClaudeMdPath(): Promise<string | undefined>;
-    getLightState(): unknown;
+    getLightState(identity?: {
+        username: string;
+        role: 'admin' | 'user';
+    }): unknown;
     getLightSessionsState(): unknown[];
     startTranscriptWatcher(sessionId: string, transcriptPath: string): void;
     stopTranscriptWatcher(sessionId: string): void;

package/dist/web/ports/config-port.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-port.d.ts","sourceRoot":"","sources":["../../../src/web/ports/config-port.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAE9E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,mBAAmB,IAAI,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACvD,cAAc,IAAI,OAAO,CAAC;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACzG,mBAAmB,IAAI,OAAO,CAAC;QAAE,UAAU,CAAC,EAAE,UAAU,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnF,wBAAwB,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC3D,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACtD,aAAa,IAAI,OAAO,CAAC;IACzB,qBAAqB,IAAI,OAAO,EAAE,CAAC;IACnC,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACxE,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAChD"}
+{"version":3,"file":"config-port.d.ts","sourceRoot":"","sources":["../../../src/web/ports/config-port.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAE9E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,mBAAmB,IAAI,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACvD,cAAc,IAAI,OAAO,CAAC;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACzG,mBAAmB,IAAI,OAAO,CAAC;QAAE,UAAU,CAAC,EAAE,UAAU,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnF,wBAAwB,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC3D,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACtD,aAAa,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;IAChF,qBAAqB,IAAI,OAAO,EAAE,CAAC;IACnC,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACxE,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAChD"}

package/dist/web/ports/infra-port.d.ts

@@ -21,6 +21,9 @@ export interface ScheduledRun {
     completedTasks: number;
     totalCost: number;
     logs: string[];
+    /** Multi-user owner (username) — undefined in single-user mode. Used to scope
+     * list/delete and to downgrade the spawned Session's permission mode. */
+    owner?: string;
 }
 export interface InfraPort {
     readonly mux: TerminalMultiplexer;
@@ -30,7 +33,7 @@ export interface InfraPort {
     readonly teamWatcher: TeamWatcher;
     readonly tunnelManager: TunnelManager;
     readonly pushStore: PushSubscriptionStore;
-    startScheduledRun(prompt: string, workingDir: string, durationMinutes: number): Promise<ScheduledRun>;
+    startScheduledRun(prompt: string, workingDir: string, durationMinutes: number, owner?: string): Promise<ScheduledRun>;
     stopScheduledRun(id: string): Promise<void>;
 }
 //# sourceMappingURL=infra-port.d.ts.map

package/dist/web/ports/infra-port.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infra-port.d.ts","sourceRoot":"","sources":["../../../src/web/ports/infra-port.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;IACvD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC;IAClC,QAAQ,CAAC,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC5D,QAAQ,CAAC,uBAAuB,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAChE,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAClD,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;IAC1C,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACtG,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C"}
+{"version":3,"file":"infra-port.d.ts","sourceRoot":"","sources":["../../../src/web/ports/infra-port.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;IACvD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;6EACyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC;IAClC,QAAQ,CAAC,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC5D,QAAQ,CAAC,uBAAuB,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAChE,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAClD,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;IAC1C,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACtH,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C"}