cartethyia 2.4.6 → 2.5.1

package/src/console/auth/account-reset-store.ts

@@ -0,0 +1,14 @@
+import type { CartethyiaDatabase } from "../../persistence/db-handle";
+import { consoleLockouts, consoleUsers } from "../../persistence/schema";
+
+/**
+ * Clears console lockouts and accounts atomically so a reset can be followed
+ * immediately by first-boot setup from the same client address.
+ */
+export function resetConsoleAuthState(db: CartethyiaDatabase): Promise<number> {
+  return db.transaction(async (tx) => {
+    await tx.delete(consoleLockouts);
+    const users = await tx.delete(consoleUsers);
+    return users.rowCount ?? 0;
+  });
+}

package/src/console/auth/account-reset.ts

@@ -5,8 +5,9 @@
  * `/console/api/auth/change-password` requires the current password, and
  * first-boot setup only runs when no console user exists. The only documented
  * escape was deleting the database by hand. This endpoint removes every console
- * user, which puts `requiresSetup()` back to true so the next visit to
- * `/console` runs the create-an-account wizard again.
+ * user and login lockouts, which puts `requiresSetup()` back to true so the
+ * next visit to `/console` runs the create-an-account wizard again without
+ * inheriting a stale failure lock.
  *
  * What it does not touch: providers, provider accounts, API keys, routing,
  * combos, aliases, usage, and telemetry. Those are not authentication state and

package/src/console/auth/setup-service.ts

@@ -15,7 +15,6 @@ import { hashSecret, encryptCredential } from "../../security/crypto";
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
 import {
   DEFAULT_API_KEY_LABEL,
-  DEFAULT_API_KEY_PREFIX,
   generateApiKeySecret,
 } from "../api-keys/contracts";
 import { resolveDefaultGatewayApiKey } from "../../config/runtime";
@@ -132,7 +131,8 @@ export class FirstBootSetupService {
       // encryption key, so an install that never touched the variable still
       // boots with a usable key instead of failing later with
       // "the default gateway API key is missing".
-      const secret = defaultApiKey ?? generateApiKeySecret().secret;
+      const generated = generateApiKeySecret();
+      const secret = defaultApiKey ?? generated.secret;
       const keyHash = hashSecret(secret);
       const existingApiKey = await db
         .select({ id: apiKeys.id })
@@ -146,7 +146,10 @@ export class FirstBootSetupService {
           keyHash,
           label: DEFAULT_API_KEY_LABEL,
           scopes: TENANT_KEY_SCOPES,
-          keyPrefix: defaultApiKey === undefined ? DEFAULT_API_KEY_PREFIX : secret.slice(0, 3),
+          // The generated prefix, not a slice of the secret: a slice assumed a
+          // fixed-width prefix, so a longer one would store a truncated value
+          // that no longer matches the key the operator was shown.
+          keyPrefix: defaultApiKey === undefined ? generated.prefix : secret.slice(0, 3),
           keyEncrypted: encryptCredential(secret),
           requestsPerMinute: 240,
           isDefault: true,

package/src/console/domain-registration.ts

@@ -180,6 +180,7 @@ export function registerConsoleDomains(
           if (slot) {
             return {
               fetch: ctx.networkBindingFactory.fetch(slot.poolId, tenantId),
+              http2Bidi: ctx.networkBindingFactory.http2Bidi(slot.poolId, tenantId),
               networkPoolId: slot.poolId,
               release: slot.release,
             };
@@ -195,7 +196,10 @@ export function registerConsoleDomains(
         }
       }
 
-      return { fetch: ctx.networkBindingFactory.fetch(undefined, tenantId) };
+      return {
+        fetch: ctx.networkBindingFactory.fetch(undefined, tenantId),
+        http2Bidi: ctx.networkBindingFactory.http2Bidi(undefined, tenantId),
+      };
     },
     snapshotInvalidator: ctx.routeSnapshotService,
     readAccountInflight: async (providerId, tenantId) =>
@@ -219,7 +223,10 @@ export function registerConsoleDomains(
   }));
   console.use(createLogRoutes({ accessResolver: ctx.accessResolver, auditSink: ctx.auditRecorder }));
   console.use(createPerformanceRoutes({ accessResolver: ctx.accessResolver }));
-  console.use(createUpdateRoutes());
+  console.use(createUpdateRoutes({
+    accessResolver: ctx.accessResolver,
+    observabilityStore,
+  }));
   console.use(createAuditRoutes({ store: auditReadStore, accessResolver: ctx.accessResolver }));
   if (ctx.modelStrikes) {
     console.use(createModelAbuseRoutes({