artifacty 0.15.0 → 0.16.0

package/src/lib/smtp-client.js

@@ -0,0 +1,206 @@
+import net from "node:net";
+import tls from "node:tls";
+import { randomUUID } from "node:crypto";
+
+const ERRORS = {
+  SMTP_CONFIG_INVALID: "SMTP configuration or message is invalid.",
+  SMTP_CONNECT_FAILED: "Could not connect to the SMTP server.",
+  SMTP_TLS_FAILED: "Could not establish a verified TLS connection to the SMTP server.",
+  SMTP_AUTH_FAILED: "SMTP authentication failed.",
+  SMTP_PROTOCOL_ERROR: "The SMTP server returned an invalid or unexpected response.",
+  SMTP_REJECTED: "The SMTP server rejected the message.",
+  SMTP_TIMEOUT: "The SMTP operation timed out.",
+  SMTP_DELIVERY_UNKNOWN: "The SMTP connection ended before message acceptance could be confirmed. Delivery may have occurred."
+};
+const MAX_REPLY_BYTES = 64 * 1024;
+
+function smtpError(code) {
+  return Object.assign(new Error(ERRORS[code]), { code, ...(code === "SMTP_DELIVERY_UNKNOWN" ? { deliveryUnknown: true } : {}) });
+}
+
+function mailbox(value) {
+  if (typeof value !== "string" || value.length > 254 || !/^[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]+@[A-Za-z0-9.-]+$/.test(value)) return false;
+  const [local, domain] = value.split("@");
+  return local.length <= 64 && !local.startsWith(".") && !local.endsWith(".") && !local.includes("..") &&
+    domain.split(".").every((label) => label.length > 0 && label.length <= 63 && /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/.test(label));
+}
+
+function validate(config, message) {
+  const bad = () => { throw smtpError("SMTP_CONFIG_INVALID"); };
+  if (!config || !message || typeof config.host !== "string" || !config.host || config.host.length > 253 ||
+      (!net.isIP(config.host) && !config.host.split(".").every((label) => /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/.test(label))) ||
+      !Number.isInteger(config.port) || config.port < 1 || config.port > 65535 || !["tls", "starttls"].includes(config.tlsMode)) bad();
+  if (!mailbox(config.from) || !mailbox(message.to)) bad();
+  for (const value of [config.username ?? "", config.password ?? "", message.subject]) {
+    if (typeof value !== "string" || Buffer.byteLength(value) > 4096 || /[\x00-\x1f\x7f]/.test(value)) bad();
+  }
+  if (Boolean(config.username) !== Boolean(config.password) || typeof message.text !== "string" || Buffer.byteLength(message.text) > 1024 * 1024) bad();
+}
+
+function encodedSubject(subject) {
+  if (!subject) return "";
+  const chunks = [];
+  let current = "";
+  for (const character of subject) {
+    if (Buffer.byteLength(current + character) > 42) { chunks.push(current); current = ""; }
+    current += character;
+  }
+  chunks.push(current);
+  return chunks.map((chunk) => `=?UTF-8?B?${Buffer.from(chunk).toString("base64")}?=`).join("\r\n ");
+}
+
+function encodeMessage(config, { to, subject, text }) {
+  const encoded = Buffer.from(text.replace(/\r\n|\r|\n/g, "\r\n"), "utf8").toString("base64");
+  const body = encoded.match(/.{1,76}/g)?.join("\r\n") || "";
+  return [
+    `From: ${config.from}`, `To: ${to}`, `Subject: ${encodedSubject(subject)}`,
+    `Date: ${new Date().toUTCString()}`, `Message-ID: <${randomUUID()}@${config.from.split("@")[1]}>`,
+    "MIME-Version: 1.0", 'Content-Type: text/plain; charset="UTF-8"', "Content-Transfer-Encoding: base64", "", body
+  ].join("\r\n").replace(/^\./gm, "..") + "\r\n.\r\n";
+}
+
+// One bounded response parser per transport; STARTTLS discards the plaintext
+// parser and its capabilities before sending a fresh EHLO over verified TLS.
+function replies(socket) {
+  let buffer = "";
+  let current = null;
+  let failed = null;
+  let pending = null;
+  const queued = [];
+  function fail(error = smtpError("SMTP_CONNECT_FAILED")) {
+    if (failed) return;
+    failed = error;
+    if (pending) { pending.reject(error); pending = null; }
+  }
+  function onData(data) {
+    buffer += data.toString("latin1");
+    if (buffer.length + (current?.bytes || 0) > MAX_REPLY_BYTES) { fail(smtpError("SMTP_PROTOCOL_ERROR")); socket.destroy(); return; }
+    let end;
+    while ((end = buffer.indexOf("\r\n")) >= 0) {
+      const line = buffer.slice(0, end);
+      buffer = buffer.slice(end + 2);
+      const match = /^([2-5]\d{2})([ -])([^\r\n]*)$/.exec(line);
+      if (!match || (current && current.code !== Number(match[1]))) { fail(smtpError("SMTP_PROTOCOL_ERROR")); socket.destroy(); return; }
+      current ||= { code: Number(match[1]), lines: [], bytes: 0 };
+      current.lines.push(match[3]);
+      current.bytes += line.length + 2;
+      if (match[2] === " ") {
+        const reply = current;
+        current = null;
+        if (pending) { pending.resolve(reply); pending = null; }
+        else queued.push(reply);
+        if (queued.length > 8) { fail(smtpError("SMTP_PROTOCOL_ERROR")); socket.destroy(); return; }
+      }
+    }
+  }
+  const onError = () => fail();
+  const onClose = () => fail();
+  socket.on("data", onData);
+  socket.on("error", onError);
+  socket.on("close", onClose);
+  return {
+    next() {
+      if (failed) return Promise.reject(failed);
+      if (queued.length) return Promise.resolve(queued.shift());
+      return new Promise((resolve, reject) => { pending = { resolve, reject }; });
+    },
+    detach() {
+      if (buffer || current || queued.length || pending) throw smtpError("SMTP_PROTOCOL_ERROR");
+      socket.off("data", onData); socket.off("error", onError); socket.off("close", onClose);
+    },
+    fail
+  };
+}
+
+/** Send one message, without retries. options.ca is solely an explicit caller
+ * trust override for isolated tests; production settings must not expose it. */
+export async function sendSmtpMail(config, message, options = {}) {
+  validate(config, message);
+  const timeoutMs = Math.min(15000, options.timeoutMs ?? 15000);
+  if (!Number.isFinite(timeoutMs) || timeoutMs < 1) throw smtpError("SMTP_CONFIG_INVALID");
+  let socket;
+  let reader;
+  let timer;
+  let deliveryStarted = false;
+  let accepted = false;
+  let timeoutReject;
+  const timeout = new Promise((_, reject) => { timeoutReject = reject; });
+  timer = setTimeout(() => {
+    const error = smtpError(deliveryStarted ? "SMTP_DELIVERY_UNKNOWN" : "SMTP_TIMEOUT");
+    timeoutReject(error);
+    reader?.fail(error);
+    socket?.destroy();
+  }, timeoutMs);
+  const bounded = async (operation) => {
+    let commandTimer;
+    try {
+      return await Promise.race([operation, timeout, new Promise((_, reject) => {
+        commandTimer = setTimeout(() => reject(smtpError(deliveryStarted ? "SMTP_DELIVERY_UNKNOWN" : "SMTP_TIMEOUT")), Math.min(timeoutMs, 5000));
+      })]);
+    } finally { clearTimeout(commandTimer); }
+  };
+  const connect = async (secure, underlying) => {
+    socket = secure ? tls.connect({
+      ...(underlying ? { socket: underlying } : { port: config.port }),
+      host: config.host, servername: net.isIP(config.host) ? undefined : config.host,
+      rejectUnauthorized: true, minVersion: "TLSv1.2", ...(options.ca ? { ca: options.ca } : {}),
+      checkServerIdentity: (_hostname, certificate) => tls.checkServerIdentity(config.host, certificate)
+    }) : net.connect({ host: config.host, port: config.port });
+    reader = replies(socket);
+    await bounded(new Promise((resolve, reject) => {
+      const event = secure ? "secureConnect" : "connect";
+      const onError = () => { socket.off(event, onReady); reject(smtpError(secure ? "SMTP_TLS_FAILED" : "SMTP_CONNECT_FAILED")); };
+      const onReady = () => { socket.off("error", onError); resolve(); };
+      socket.once(event, onReady); socket.once("error", onError);
+    }));
+  };
+  const expect = async (codes, code = "SMTP_PROTOCOL_ERROR") => {
+    const response = await bounded(reader.next());
+    if (!codes.includes(response.code)) throw smtpError(code);
+    return response;
+  };
+  const command = async (text, codes, errorCode) => {
+    socket.write(`${text}\r\n`);
+    return expect(codes, errorCode);
+  };
+  try {
+    await connect(config.tlsMode === "tls");
+    await expect([220]);
+    let hello = await command("EHLO artifacty.local", [250]);
+    if (config.tlsMode === "starttls") {
+      if (!hello.lines.some((line) => /^STARTTLS(?:\s|$)/i.test(line))) throw smtpError("SMTP_TLS_FAILED");
+      await command("STARTTLS", [220], "SMTP_TLS_FAILED");
+      reader.detach();
+      await connect(true, socket);
+      hello = await command("EHLO artifacty.local", [250]);
+    }
+    if (config.username) {
+      const methods = hello.lines.flatMap((line) => /^AUTH(?:=|\s+)(.*)$/i.exec(line)?.[1].toUpperCase().split(/\s+/) || []);
+      if (methods.includes("PLAIN")) {
+        const credentials = Buffer.from(`\0${config.username}\0${config.password}`).toString("base64");
+        const response = await command(`AUTH PLAIN ${credentials}`, [235, 334], "SMTP_AUTH_FAILED");
+        if (response.code === 334) await command(credentials, [235], "SMTP_AUTH_FAILED");
+      } else if (methods.includes("LOGIN")) {
+        await command("AUTH LOGIN", [334], "SMTP_AUTH_FAILED");
+        await command(Buffer.from(config.username).toString("base64"), [334], "SMTP_AUTH_FAILED");
+        await command(Buffer.from(config.password).toString("base64"), [235], "SMTP_AUTH_FAILED");
+      } else throw smtpError("SMTP_AUTH_FAILED");
+    }
+    await command(`MAIL FROM:<${config.from}>`, [250], "SMTP_REJECTED");
+    await command(`RCPT TO:<${message.to}>`, [250, 251, 252], "SMTP_REJECTED");
+    await command("DATA", [354], "SMTP_REJECTED");
+    deliveryStarted = true;
+    socket.write(encodeMessage(config, message));
+    await expect([250], "SMTP_REJECTED");
+    accepted = true;
+    // Acceptance is final; failed QUIT must never turn success into a retry.
+    try { socket.end("QUIT\r\n"); } catch { /* DATA acceptance remains final. */ }
+    return { accepted: true };
+  } catch (error) {
+    if (deliveryStarted && !accepted && error.code !== "SMTP_REJECTED") throw smtpError("SMTP_DELIVERY_UNKNOWN");
+    throw smtpError(Object.hasOwn(ERRORS, error.code) ? error.code : "SMTP_PROTOCOL_ERROR");
+  } finally {
+    clearTimeout(timer);
+    socket?.destroy();
+  }
+}

package/src/lib/smtp-settings.js

@@ -0,0 +1,109 @@
+import { randomBytes, createCipheriv, createDecipheriv } from "node:crypto";
+import { mkdirSync, lstatSync, readFileSync, openSync, writeFileSync, closeSync, fsyncSync } from "node:fs";
+import path from "node:path";
+import { openDatabase, transaction, insertAuditRow } from "./storage.js";
+
+const AAD = Buffer.from("artifacty:smtp-settings:v1");
+const defaults = () => ({ enabled: false, host: "", port: 587, tlsMode: "starttls", username: "", password: "", from: "" });
+const fail = (code, statusCode = 500) => Object.assign(new Error(code === "SMTP_KEY_UNAVAILABLE"
+  ? "SMTP encryption key is unavailable. Restore the original secrets/smtp.key before changing settings."
+  : code === "SMTP_SETTINGS_INVALID" ? "Invalid SMTP settings. Check required fields and TLS configuration."
+  : "SMTP settings could not be accessed securely."), { code, statusCode });
+
+function checkedPath(file, directory, mode) {
+  let info;
+  try { info = lstatSync(file); } catch (error) { if (error.code === "ENOENT") return false; throw fail("SMTP_KEY_UNAVAILABLE"); }
+  if (info.isSymbolicLink() || (directory ? !info.isDirectory() : !info.isFile()) ||
+      (process.platform !== "win32" && ((info.mode & 0o777) !== mode || (process.getuid && info.uid !== process.getuid())))) {
+    throw fail("SMTP_KEY_UNSAFE");
+  }
+  return true;
+}
+
+function keyFor(store, create) {
+  const directory = path.join(store.home, "secrets");
+  const file = path.join(directory, "smtp.key");
+  if (!checkedPath(directory, true, 0o700)) {
+    if (!create) throw fail("SMTP_KEY_UNAVAILABLE");
+    mkdirSync(directory, { mode: 0o700 });
+    checkedPath(directory, true, 0o700);
+  }
+  if (!checkedPath(file, false, 0o600)) {
+    if (!create) throw fail("SMTP_KEY_UNAVAILABLE");
+    let descriptor;
+    try {
+      descriptor = openSync(file, "wx", 0o600);
+      writeFileSync(descriptor, randomBytes(32));
+      fsyncSync(descriptor);
+    } catch (error) { if (error.code !== "EEXIST") throw fail("SMTP_KEY_UNAVAILABLE"); }
+    finally { if (descriptor !== undefined) closeSync(descriptor); }
+  }
+  checkedPath(file, false, 0o600);
+  let key;
+  try { key = readFileSync(file); } catch { throw fail("SMTP_KEY_UNAVAILABLE"); }
+  if (key.length !== 32) throw fail("SMTP_KEY_UNAVAILABLE");
+  return key;
+}
+
+function validate(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input) || typeof input.enabled !== "boolean") throw fail("SMTP_SETTINGS_INVALID", 400);
+  for (const field of ["host", "username", "password", "from"]) {
+    if (typeof input[field] !== "string" || Buffer.byteLength(input[field], "utf8") > 4096 || /[\r\n\0]/.test(input[field])) throw fail("SMTP_SETTINGS_INVALID", 400);
+  }
+  if (Boolean(input.username) !== Boolean(input.password)) throw fail("SMTP_SETTINGS_INVALID", 400);
+  if (!input.host.trim() || /[\s/@?#]/.test(input.host) || !/^[^\s<>@,;]+@[^\s<>@,;]+\.[^\s<>@,;]+$/.test(input.from) ||
+      !Number.isInteger(input.port) || input.port < 1 || input.port > 65535 || !["tls", "starttls"].includes(input.tlsMode)) throw fail("SMTP_SETTINGS_INVALID", 400);
+  return { enabled: input.enabled, host: input.host, port: input.port, tlsMode: input.tlsMode, username: input.username, password: input.password, from: input.from };
+}
+
+function readConfig(db, store) {
+  const row = db.prepare("SELECT value FROM meta WHERE key='smtp_settings'").get();
+  if (!row) return defaults();
+  const key = keyFor(store, false);
+  try {
+    const envelope = JSON.parse(row.value);
+    if (envelope.v !== 1 || !["iv", "tag", "ciphertext"].every((field) => typeof envelope[field] === "string")) throw new Error();
+    const iv = Buffer.from(envelope.iv, "base64");
+    const tag = Buffer.from(envelope.tag, "base64");
+    if (iv.length !== 12 || tag.length !== 16) throw new Error();
+    const decipher = createDecipheriv("aes-256-gcm", key, iv);
+    decipher.setAAD(AAD);
+    decipher.setAuthTag(tag);
+    return validate(JSON.parse(Buffer.concat([decipher.update(Buffer.from(envelope.ciphertext, "base64")), decipher.final()]).toString("utf8")));
+  } catch { throw fail("SMTP_SETTINGS_UNREADABLE"); }
+}
+
+function redact(config) {
+  const { password, ...settings } = config;
+  return { ...settings, hasPassword: Boolean(password) };
+}
+
+export async function getSmtpDeliveryConfig(store) {
+  const db = openDatabase(store);
+  try { return readConfig(db, store); } finally { db.close(); }
+}
+
+export async function getSmtpSettings(store) {
+  return redact(await getSmtpDeliveryConfig(store));
+}
+
+export async function saveSmtpSettings(store, input, { access, audit } = {}) {
+  const db = openDatabase(store);
+  try {
+    return transaction(db, () => {
+      const actor = db.prepare("SELECT id,email FROM users WHERE id=? AND active=1 AND role='admin'").get(access?.userId || "");
+      if (!actor) throw Object.assign(new Error("An active administrator is required"), { code: "ADMIN_REQUIRED", statusCode: 403 });
+      const previous = readConfig(db, store);
+      const config = validate({ ...input, password: input?.username === "" ? "" : input?.password === "" ? previous.password : input?.password });
+      const key = keyFor(store, true);
+      const iv = randomBytes(12);
+      const cipher = createCipheriv("aes-256-gcm", key, iv);
+      cipher.setAAD(AAD);
+      const ciphertext = Buffer.concat([cipher.update(JSON.stringify(config), "utf8"), cipher.final()]);
+      const envelope = { v: 1, iv: iv.toString("base64"), tag: cipher.getAuthTag().toString("base64"), ciphertext: ciphertext.toString("base64") };
+      db.prepare("INSERT OR REPLACE INTO meta(key,value) VALUES ('smtp_settings',?)").run(JSON.stringify(envelope));
+      insertAuditRow(db, { action: "smtp-settings-change", artifactId: "", audit: { surface: audit?.surface, actor: actor.email, userId: actor.id }, metadata: { enabled: config.enabled, tlsMode: config.tlsMode } });
+      return redact(config);
+    });
+  } finally { db.close(); }
+}

package/src/lib/storage.js

@@ -85,7 +85,7 @@ export const ARTIFACT_TYPES = [
 
 export const RELATION_TYPES = ["derived-from", "supersedes", "reviews", "references", "part-of"];
 
-export const VISIBILITY_VALUES = ["private", "team"];
+export const VISIBILITY_VALUES = ["private", "team", "public"];
 
 // Allowlisted filter keys a saved view may capture. Keeps saved views forward
 // compatible with filters that are recognized but not yet acted on (e.g.
@@ -216,13 +216,13 @@ export function visibilityClause(prefix, access) {
   const isAdmin = access.role === "admin" ? 1 : 0;
   return {
     sql: `((COALESCE((SELECT value FROM meta WHERE key = 'access_mode'), 'public') != 'private'
-      AND ${prefix}visibility != 'private')
+      AND (${prefix}visibility = 'public' OR (${prefix}visibility = 'team' AND ? != '')))
       OR (? != '' AND ${prefix}owner_user_id = ?) OR ? = 1
       OR (COALESCE((SELECT value FROM meta WHERE key = 'access_mode'), 'public') = 'private'
         AND ? != '' AND EXISTS (SELECT 1 FROM artifact_shares s
           WHERE s.artifact_id = ${prefix}id AND
           (s.user_id = ? OR s.team_id IN (SELECT team_id FROM team_members WHERE user_id = ?)))))`,
-    params: [userId, userId, isAdmin, userId, userId, userId]
+    params: [userId, userId, userId, isAdmin, userId, userId, userId]
   };
 }
 
@@ -451,9 +451,14 @@ export async function previewAccessMode(store = createStore(), mode, { access }
   if (!["public", "private"].includes(mode)) throw Object.assign(new Error("Access mode must be public or private"), { statusCode: 400 });
   const db = openDatabase(store);
   try {
-    const count = mode === "private" ? 0 : db.prepare(`SELECT COUNT(*) AS count FROM artifacts
-      WHERE visibility != 'private' OR (SELECT COUNT(*) FROM users) = 0`).get().count;
-    return { mode, anonymousArtifactCount: count };
+    // Simulate anonymous dashboard visibility under the proposed mode without
+    // consulting or changing the currently configured access mode.
+    if (mode === "private") return { mode, anonymousArtifactCount: 0, total: 0, artifacts: [] };
+    const eligibility = "archived_at IS NULL AND (visibility = 'public' OR (SELECT COUNT(*) FROM users) = 0)";
+    const count = db.prepare(`SELECT COUNT(*) AS count FROM artifacts WHERE ${eligibility}`).get().count;
+    const rows = db.prepare(`SELECT ${artifactColumns()} FROM artifacts WHERE ${eligibility}
+      ORDER BY updated_at DESC, created_at DESC, id ASC LIMIT 50`).all();
+    return { mode, anonymousArtifactCount: count, total: count, artifacts: rows.map((row) => toArtifactSummary(artifactFromRow(db, row))) };
   } finally { db.close(); }
 }
 
@@ -482,9 +487,8 @@ function canReadArtifactMeta(db, artifact, access) {
       AND (user_id = ? OR team_id IN (SELECT team_id FROM team_members WHERE user_id = ?)) LIMIT 1`)
       .get(artifact.id, access.userId, access.userId));
   }
-  if (artifactVisibilityOf(artifact) !== "private") {
-    return true;
-  }
+  if (artifactVisibilityOf(artifact) === "public") return true;
+  if (artifactVisibilityOf(artifact) === "team" && access.userId) return true;
   return isOwnerOrAdmin(access, artifact.ownerUserId);
 }
 
@@ -492,12 +496,10 @@ function canWriteArtifactMeta(db, artifact, access) {
   if (!access || isSingleUserMode(db)) {
     return true;
   }
-  if (accessModeInDb(db) === "private" || artifactVisibilityOf(artifact) === "private") {
+  if (accessModeInDb(db) === "private" || artifactVisibilityOf(artifact) !== "team") {
     return isOwnerOrAdmin(access, artifact.ownerUserId);
   }
-  if (access.anonymous) {
-    return !teamWriteRestrictedToOwner();
-  }
+  if (access.anonymous || !access.userId) return access.role === "admin";
   if (teamWriteRestrictedToOwner()) {
     return isOwnerOrAdmin(access, artifact.ownerUserId);
   }
@@ -2526,10 +2528,14 @@ export async function canReadArtifactEvent(store = createStore(), event, access
   if (!access) return true;
   const db = openDatabase(store);
   try {
-    if (access.userId && !db.prepare("SELECT id FROM users WHERE id = ? AND active = 1").get(access.userId)) return false;
+    if (access.userId) {
+      const user = db.prepare("SELECT role FROM users WHERE id = ? AND active = 1").get(access.userId);
+      if (!user) return false;
+      access = { ...access, role: user.role };
+    }
     const row = event.artifactId ? db.prepare("SELECT id, visibility, owner_user_id FROM artifacts WHERE id = ?").get(event.artifactId) : null;
     if (row) return canReadArtifactMeta(db, { id: row.id, visibility: row.visibility, ownerUserId: row.owner_user_id }, access);
-    return accessModeInDb(db) !== "private" && eventVisibleTo(event, access);
+    return isSingleUserMode(db) || (accessModeInDb(db) !== "private" && eventVisibleTo(event, access));
   } finally { db.close(); }
 }
 
@@ -2582,7 +2588,7 @@ export async function listEventsSince(store = createStore(), sinceSeq = 0, filte
         ? (row.live_visibility != null
           ? canReadArtifactMeta(db, { id: row.artifact_id, visibility: row.live_visibility, ownerUserId: row.live_owner_user_id }, access)
           : access.role === "admin")
-        : eventVisibleTo(event, access);
+        : (isSingleUserMode(db) || eventVisibleTo(event, access));
       if (matchesFilter(event, filter) && visible) {
         matched.push(event);
         if (matched.length >= limit) {
@@ -3059,6 +3065,30 @@ export async function listUsers(store = createStore()) {
   }
 }
 
+export async function setUserRole(store = createStore(), id, role, { access, audit } = {}) {
+  if (!["admin", "user"].includes(role)) {
+    throw Object.assign(new Error("Role must be admin or user"), { statusCode: 400, code: "INVALID_USER_ROLE" });
+  }
+  const db = openDatabase(store);
+  try {
+    return transaction(db, () => {
+      const actor = db.prepare("SELECT id, email, role, active FROM users WHERE id = ?").get(access?.userId || "");
+      if (!actor?.active || actor.role !== "admin") {
+        throw Object.assign(new Error("An active administrator is required"), { statusCode: 403, code: "ADMIN_REQUIRED" });
+      }
+      const target = db.prepare("SELECT * FROM users WHERE id = ?").get(id);
+      if (!target) throw Object.assign(new Error(`User not found: ${id}`), { statusCode: 404, code: "USER_NOT_FOUND" });
+      if (target.role === role) return userFromRow(target);
+      if (target.active && target.role === "admin" && role === "user" && !db.prepare("SELECT id FROM users WHERE active = 1 AND role = 'admin' AND id != ? LIMIT 1").get(id)) {
+        throw Object.assign(new Error("At least one active administrator must remain"), { statusCode: 409, code: "LAST_ADMIN_REQUIRED" });
+      }
+      db.prepare("UPDATE users SET role = ?, updated_at = ? WHERE id = ?").run(role, new Date().toISOString(), id);
+      insertAuditRow(db, { action: "user-role-change", artifactId: "", audit: { ...audit, actor: actor.email, userId: actor.id }, metadata: { targetUserId: id, fromRole: target.role, toRole: role, actorUserId: actor.id } });
+      return userFromRow(db.prepare("SELECT * FROM users WHERE id = ?").get(id));
+    });
+  } finally { db.close(); }
+}
+
 export async function setUserActive(store = createStore(), id, active) {
   const db = openDatabase(store);
   try {
@@ -3075,6 +3105,28 @@ export async function setUserActive(store = createStore(), id, active) {
   }
 }
 
+export async function resetUserPassword(store = createStore(), id, { access, audit } = {}) {
+  const db = openDatabase(store);
+  try {
+    return transaction(db, () => {
+      const actor = db.prepare("SELECT id, email, role, active FROM users WHERE id = ?").get(access?.userId || "");
+      if (!actor?.active || actor.role !== "admin") {
+        throw Object.assign(new Error("An active administrator is required"), { statusCode: 403, code: "ADMIN_REQUIRED" });
+      }
+      if (!db.prepare("SELECT id FROM users WHERE id = ?").get(id)) {
+        throw Object.assign(new Error(`User not found: ${id}`), { statusCode: 404, code: "USER_NOT_FOUND" });
+      }
+      const temporaryPassword = generateTemporaryPassword();
+      const now = new Date().toISOString();
+      db.prepare("UPDATE users SET password_hash = ?, password_reset_required = 1, updated_at = ? WHERE id = ?")
+        .run(hashPassword(temporaryPassword), now, id);
+      db.prepare("UPDATE sessions SET revoked_at = ? WHERE user_id = ? AND revoked_at IS NULL").run(now, id);
+      insertAuditRow(db, { action: "user-password-reset", artifactId: "", audit: { ...audit, actor: actor.email, userId: actor.id }, metadata: { targetUserId: id } });
+      return { user: userFromRow(db.prepare("SELECT * FROM users WHERE id = ?").get(id)), temporaryPassword };
+    });
+  } finally { db.close(); }
+}
+
 export async function changeUserPassword(store = createStore(), userId, input = {}) {
   const password = String(input.password || input.newPassword || "");
   if (password.length < 8) {
@@ -3258,7 +3310,9 @@ export async function authenticateApiToken(store = createStore(), token) {
       actor: row.email,
       tokenId: row.token_id,
       tokenName: row.token_name,
-      scopes: row.token_scopes_json ? parseJson(row.token_scopes_json, ["read", "write"]) : ["read", "write"],
+      // A stored admin grant must not outlive the owner's current admin role.
+      scopes: (row.token_scopes_json ? parseJson(row.token_scopes_json, ["read", "write"]) : ["read", "write"])
+        .filter((scope) => scope !== "admin" || row.role === "admin"),
       user: userFromRow(row)
     };
   } finally {

package/src/lib/ui-icons.js

@@ -0,0 +1,32 @@
+// Generated from @tabler/icons v3.49.0 (MIT), by npm run build:ui.
+const paths = {
+  "layout-sidebar-left-collapse": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M4 6a2 2 0 0 1 2 -2h12a2 2 0 0 1 2 2v12a2 2 0 0 1 -2 2h-12a2 2 0 0 1 -2 -2l0 -12\" /> <path d=\"M9 4v16\" /> <path d=\"M15 10l-2 2l2 2\" />",
+  "layout-sidebar-left-expand": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M4 6a2 2 0 0 1 2 -2h12a2 2 0 0 1 2 2v12a2 2 0 0 1 -2 2h-12a2 2 0 0 1 -2 -2l0 -12\" /> <path d=\"M9 4v16\" /> <path d=\"M14 10l2 2l-2 2\" />",
+  "files": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M15 3v4a1 1 0 0 0 1 1h4\" /> <path d=\"M18 17h-7a2 2 0 0 1 -2 -2v-10a2 2 0 0 1 2 -2h4l5 5v7a2 2 0 0 1 -2 2\" /> <path d=\"M16 17v2a2 2 0 0 1 -2 2h-7a2 2 0 0 1 -2 -2v-10a2 2 0 0 1 2 -2h2\" />",
+  "inbox": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M4 6a2 2 0 0 1 2 -2h12a2 2 0 0 1 2 2v12a2 2 0 0 1 -2 2h-12a2 2 0 0 1 -2 -2l0 -12\" /> <path d=\"M4 13h3l3 3h4l3 -3h3\" />",
+  "plus": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M12 5l0 14\" /> <path d=\"M5 12l14 0\" />",
+  "upload": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M4 17v2a2 2 0 0 0 2 2h12a2 2 0 0 0 2 -2v-2\" /> <path d=\"M7 9l5 -5l5 5\" /> <path d=\"M12 4l0 12\" />",
+  "settings": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M10.325 4.317c.426 -1.756 2.924 -1.756 3.35 0a1.724 1.724 0 0 0 2.573 1.066c1.543 -.94 3.31 .826 2.37 2.37a1.724 1.724 0 0 0 1.065 2.572c1.756 .426 1.756 2.924 0 3.35a1.724 1.724 0 0 0 -1.066 2.573c.94 1.543 -.826 3.31 -2.37 2.37a1.724 1.724 0 0 0 -2.572 1.065c-.426 1.756 -2.924 1.756 -3.35 0a1.724 1.724 0 0 0 -2.573 -1.066c-1.543 .94 -3.31 -.826 -2.37 -2.37a1.724 1.724 0 0 0 -1.065 -2.572c-1.756 -.426 -1.756 -2.924 0 -3.35a1.724 1.724 0 0 0 1.066 -2.573c-.94 -1.543 .826 -3.31 2.37 -2.37c1 .608 2.296 .07 2.572 -1.065\" /> <path d=\"M9 12a3 3 0 1 0 6 0a3 3 0 0 0 -6 0\" />",
+  "users": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M5 7a4 4 0 1 0 8 0a4 4 0 1 0 -8 0\" /> <path d=\"M3 21v-2a4 4 0 0 1 4 -4h4a4 4 0 0 1 4 4v2\" /> <path d=\"M16 3.13a4 4 0 0 1 0 7.75\" /> <path d=\"M21 21v-2a4 4 0 0 0 -3 -3.85\" />",
+  "database-export": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M4 6c0 1.657 3.582 3 8 3s8 -1.343 8 -3s-3.582 -3 -8 -3s-8 1.343 -8 3\" /> <path d=\"M4 6v6c0 1.657 3.582 3 8 3c1.118 0 2.183 -.086 3.15 -.241\" /> <path d=\"M20 12v-6\" /> <path d=\"M4 12v6c0 1.657 3.582 3 8 3c.157 0 .312 -.002 .466 -.005\" /> <path d=\"M16 19h6\" /> <path d=\"M19 16l3 3l-3 3\" />",
+  "archive": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M3 6a2 2 0 0 1 2 -2h14a2 2 0 0 1 2 2a2 2 0 0 1 -2 2h-14a2 2 0 0 1 -2 -2\" /> <path d=\"M5 8v10a2 2 0 0 0 2 2h10a2 2 0 0 0 2 -2v-10\" /> <path d=\"M10 12l4 0\" />",
+  "webhook": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M4.876 13.61a4 4 0 1 0 6.124 3.39h6\" /> <path d=\"M15.066 20.502a4 4 0 1 0 1.934 -7.502c-.706 0 -1.424 .179 -2 .5l-3 -5.5\" /> <path d=\"M16 8a4 4 0 1 0 -8 0c0 1.506 .77 2.818 2 3.5l-3 5.5\" />",
+  "refresh": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M20 11a8.1 8.1 0 0 0 -15.5 -2m-.5 -4v4h4\" /> <path d=\"M4 13a8.1 8.1 0 0 0 15.5 2m.5 4v-4h-4\" />",
+  "language": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M9 6.371c0 4.418 -2.239 6.629 -5 6.629\" /> <path d=\"M4 6.371h7\" /> <path d=\"M5 9c0 2.144 2.252 3.908 6 4\" /> <path d=\"M12 20l4 -9l4 9\" /> <path d=\"M19.1 18h-6.2\" /> <path d=\"M6.694 3l.793 .582\" />",
+  "mail": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M3 7a2 2 0 0 1 2 -2h14a2 2 0 0 1 2 2v10a2 2 0 0 1 -2 2h-14a2 2 0 0 1 -2 -2v-10\" /> <path d=\"M3 7l9 6l9 -6\" />",
+  "user-circle": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0 -18 0\" /> <path d=\"M9 10a3 3 0 1 0 6 0a3 3 0 1 0 -6 0\" /> <path d=\"M6.168 18.849a4 4 0 0 1 3.832 -2.849h4a4 4 0 0 1 3.834 2.855\" />",
+  "key": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M16.555 3.843l3.602 3.602a2.877 2.877 0 0 1 0 4.069l-2.643 2.643a2.877 2.877 0 0 1 -4.069 0l-.301 -.301l-6.558 6.558a2 2 0 0 1 -1.239 .578l-.175 .008h-1.172a1 1 0 0 1 -.993 -.883l-.007 -.117v-1.172a2 2 0 0 1 .467 -1.284l.119 -.13l.414 -.414h2v-2h2v-2l2.144 -2.144l-.301 -.301a2.877 2.877 0 0 1 0 -4.069l2.643 -2.643a2.877 2.877 0 0 1 4.069 0\" /> <path d=\"M15 9h.01\" />",
+  "logout": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M14 8v-2a2 2 0 0 0 -2 -2h-7a2 2 0 0 0 -2 2v12a2 2 0 0 0 2 2h7a2 2 0 0 0 2 -2v-2\" /> <path d=\"M9 12h12l-3 -3\" /> <path d=\"M18 15l3 -3\" />",
+  "login": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M15 8v-2a2 2 0 0 0 -2 -2h-7a2 2 0 0 0 -2 2v12a2 2 0 0 0 2 2h7a2 2 0 0 0 2 -2v-2\" /> <path d=\"M21 12h-13l3 -3\" /> <path d=\"M11 15l-3 -3\" />",
+  "code": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M7 8l-4 4l4 4\" /> <path d=\"M17 8l4 4l-4 4\" /> <path d=\"M14 4l-4 16\" />",
+  "chevron-down": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M6 9l6 6l6 -6\" />",
+  "device-desktop": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M3 5a1 1 0 0 1 1 -1h16a1 1 0 0 1 1 1v10a1 1 0 0 1 -1 1h-16a1 1 0 0 1 -1 -1v-10\" /> <path d=\"M7 20h10\" /> <path d=\"M9 16v4\" /> <path d=\"M15 16v4\" />",
+  "sun": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0 -8 0\" /> <path d=\"M3 12h1m8 -9v1m8 8h1m-9 8v1m-6.4 -15.4l.7 .7m12.1 -.7l-.7 .7m0 11.4l.7 .7m-12.1 -.7l-.7 .7\" />",
+  "moon": "<path stroke=\"none\" d=\"M0 0h24v24H0z\" fill=\"none\" /> <path d=\"M12 3c.132 0 .263 0 .393 0a7.5 7.5 0 0 0 7.92 12.446a9 9 0 1 1 -8.313 -12.454l0 .008\" />"
+};
+
+export function uiIcon(name, { size = 18 } = {}) {
+  if (!Object.hasOwn(paths, name)) throw new Error('Unknown UI icon');
+  const dimension = [16, 18, 20, 24].includes(size) ? size : 18;
+  return '<svg class="ui-icon" width="' + dimension + '" height="' + dimension + '" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" focusable="false">' + paths[name] + '</svg>';
+}

package/src/mcp-server.js

@@ -100,7 +100,7 @@ const nativeArtifactInputSchema = {
     visibility: {
       type: "string",
       enum: VISIBILITY_VALUES,
-      description: "'team' (default) is visible to any authenticated user; 'private' is visible only to the owner and admins."
+      description: "In public server mode, 'public' allows anonymous reading, 'team' (default) requires a signed-in user, and 'private' is owner/admin only. Private server mode always requires owner/admin or explicit sharing."
     },
     relations: relationsInputSchema
   },
@@ -264,7 +264,7 @@ const tools = [
         visibility: {
           type: "string",
           enum: VISIBILITY_VALUES,
-          description: "'team' (default) is visible to any authenticated user; 'private' is visible only to the owner and admins. Prefer artifacty_set_visibility to change visibility on its own."
+          description: "In public server mode, 'public' allows anonymous reading, 'team' (default) requires a signed-in user, and 'private' is owner/admin only. Private server mode always requires owner/admin or explicit sharing. Prefer artifacty_set_visibility to change visibility on its own."
         },
         relations: relationsInputSchema
       },
@@ -280,7 +280,7 @@ const tools = [
   {
     name: "artifacty_set_visibility",
     title: "Set Artifact Visibility",
-    description: "Change an artifact's visibility between 'team' and 'private'. Requires the artifact's owner or an admin.",
+    description: "Change an artifact's visibility to 'public', 'team', or 'private'. Requires the artifact's owner or an admin.",
     inputSchema: {
       type: "object",
       properties: {