clay-server 2.8.2 → 2.9.0

package/lib/server.js

@@ -3,8 +3,10 @@ var crypto = require("crypto");
 var fs = require("fs");
 var path = require("path");
 var { WebSocketServer } = require("ws");
-var { pinPageHtml, setupPageHtml } = require("./pages");
+var { pinPageHtml, setupPageHtml, adminSetupPageHtml, multiUserLoginPageHtml, smtpLoginPageHtml, invitePageHtml, smtpInvitePageHtml, noProjectsPageHtml } = require("./pages");
+var smtp = require("./smtp");
 var { createProjectContext } = require("./project");
+var users = require("./users");
 
 var { CONFIG_DIR } = require("./config");
 
@@ -178,7 +180,25 @@ var MIME_TYPES = {
 };
 
 function generateAuthToken(pin) {
-  return crypto.createHash("sha256").update("clay:" + pin).digest("hex");
+  var salt = crypto.randomBytes(16).toString("hex");
+  var hash = crypto.scryptSync("clay:" + pin, salt, 64).toString("hex");
+  return salt + ":" + hash;
+}
+
+function verifyPin(pin, storedHash) {
+  if (!storedHash) return false;
+  // New scrypt format: salt_hex:hash_hex (contains colon)
+  if (storedHash.indexOf(":") !== -1) {
+    var parts = storedHash.split(":");
+    var salt = parts[0];
+    var hash = parts[1];
+    var derived = crypto.scryptSync("clay:" + pin, salt, 64).toString("hex");
+    return crypto.timingSafeEqual(Buffer.from(derived, "hex"), Buffer.from(hash, "hex"));
+  }
+  // Legacy SHA256 format (no colon)
+  var legacyHash = crypto.createHash("sha256").update("clay:" + pin).digest("hex");
+  var match = crypto.timingSafeEqual(Buffer.from(legacyHash, "hex"), Buffer.from(storedHash, "hex"));
+  return match;
 }
 
 function parseCookies(req) {
@@ -197,6 +217,31 @@ function isAuthed(req, authToken) {
   return cookies["relay_auth"] === authToken;
 }
 
+// --- Multi-user auth helpers ---
+// Multi-user auth tokens: userId:randomToken stored in memory
+var multiUserTokens = {}; // token → userId
+
+function createMultiUserSession(userId, tlsOptions) {
+  var token = users.generateUserAuthToken(userId);
+  multiUserTokens[token] = userId;
+  var cookie = "relay_auth_user=" + token + "; Path=/; HttpOnly; SameSite=Strict; Max-Age=31536000" + (tlsOptions ? "; Secure" : "");
+  return { token: token, cookie: cookie };
+}
+
+function getMultiUserFromReq(req) {
+  var cookies = parseCookies(req);
+  var token = cookies["relay_auth_user"];
+  if (!token) return null;
+  var userId = multiUserTokens[token];
+  if (!userId) return null;
+  var user = users.findUserById(userId);
+  return user || null;
+}
+
+function isMultiUserAuthed(req) {
+  return !!getMultiUserFromReq(req);
+}
+
 // --- PIN rate limiting ---
 var pinAttempts = {}; // ip → { count, lastAttempt }
 var PIN_MAX_ATTEMPTS = 5;
@@ -302,6 +347,10 @@ function createServer(opts) {
   var onSetPin = opts.onSetPin || null;
   var onSetKeepAwake = opts.onSetKeepAwake || null;
   var onShutdown = opts.onShutdown || null;
+  var onUpgradePin = opts.onUpgradePin || null;
+  var onSetProjectVisibility = opts.onSetProjectVisibility || null;
+  var onSetProjectAllowedUsers = opts.onSetProjectAllowedUsers || null;
+  var onGetProjectAccess = opts.onGetProjectAccess || null;
 
   var authToken = pinHash || null;
   var realVersion = require("../package.json").version;
@@ -309,6 +358,23 @@ function createServer(opts) {
 
   var caContent = caPath ? (function () { try { return fs.readFileSync(caPath); } catch (e) { return null; } })() : null;
   var pinPage = pinPageHtml();
+  var adminSetupPage = adminSetupPageHtml();
+  var loginPage = multiUserLoginPageHtml();
+  var smtpLoginPage = smtpLoginPageHtml();
+
+  // Multi-user auth: determine which page to show for unauthenticated requests
+  function getAuthPage() {
+    if (!users.isMultiUser()) return pinPage;
+    if (!users.hasAdmin()) return adminSetupPage;
+    if (smtp.isEmailLoginEnabled()) return smtpLoginPage;
+    return loginPage;
+  }
+
+  // Unified auth check: works in both single-user and multi-user mode
+  function isRequestAuthed(req) {
+    if (users.isMultiUser()) return isMultiUserAuthed(req);
+    return isAuthed(req, authToken);
+  }
 
   // --- Project registry ---
   var projects = new Map(); // slug → projectContext
@@ -320,8 +386,26 @@ function createServer(opts) {
     pushModule = initPush();
   } catch (e) {}
 
+  // --- Security headers ---
+  var securityHeaders = {
+    "X-Content-Type-Options": "nosniff",
+    "X-Frame-Options": "DENY",
+    "Content-Security-Policy": "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://esm.sh; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net; img-src 'self' data: blob: https://cdn.jsdelivr.net https://api.dicebear.com; connect-src 'self' ws: wss: https://cdn.jsdelivr.net https://esm.sh; font-src 'self' data: https://fonts.gstatic.com https://cdn.jsdelivr.net;",
+  };
+  if (tlsOptions) {
+    securityHeaders["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains";
+  }
+
+  function setSecurityHeaders(res) {
+    var keys = Object.keys(securityHeaders);
+    for (var i = 0; i < keys.length; i++) {
+      res.setHeader(keys[i], securityHeaders[keys[i]]);
+    }
+  }
+
   // --- HTTP handler ---
   var appHandler = function (req, res) {
+    setSecurityHeaders(res);
     var fullUrl = req.url.split("?")[0];
 
     // Global auth endpoint
@@ -338,8 +422,16 @@ function createServer(opts) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
-          if (authToken && generateAuthToken(data.pin) === authToken) {
+          if (authToken && verifyPin(data.pin, authToken)) {
             clearPinFailures(ip);
+            // Auto-upgrade legacy SHA256 hash to scrypt
+            if (authToken.indexOf(":") === -1) {
+              var upgraded = generateAuthToken(data.pin);
+              authToken = upgraded;
+              if (typeof onUpgradePin === "function") {
+                onUpgradePin(upgraded);
+              }
+            }
             res.writeHead(200, {
               "Set-Cookie": "relay_auth=" + authToken + "; Path=/; HttpOnly; SameSite=Strict; Max-Age=31536000" + (tlsOptions ? "; Secure" : ""),
               "Content-Type": "application/json",
@@ -359,6 +451,318 @@ function createServer(opts) {
       return;
     }
 
+    // --- Multi-user auth endpoints ---
+
+    // Admin setup (first-time multi-user setup)
+    if (req.method === "POST" && fullUrl === "/auth/setup") {
+      if (!users.isMultiUser()) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end('{"error":"Multi-user mode is not enabled"}');
+        return;
+      }
+      if (users.hasAdmin()) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end('{"error":"Admin already exists"}');
+        return;
+      }
+      var body = "";
+      req.on("data", function (chunk) { body += chunk; });
+      req.on("end", function () {
+        try {
+          var data = JSON.parse(body);
+          if (!users.validateSetupCode(data.setupCode)) {
+            res.writeHead(401, { "Content-Type": "application/json" });
+            res.end('{"error":"Invalid setup code"}');
+            return;
+          }
+          if (!data.username || data.username.trim().length < 1 || data.username.length > 100) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end('{"error":"Username is required"}');
+            return;
+          }
+          if (!data.pin || !/^\d{6}$/.test(data.pin)) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end('{"error":"PIN must be exactly 6 digits"}');
+            return;
+          }
+          // Migrate existing profile.json to admin profile
+          var adminProfile = undefined;
+          try {
+            var existingProfile = JSON.parse(fs.readFileSync(path.join(CONFIG_DIR, "profile.json"), "utf8"));
+            adminProfile = {
+              name: data.displayName || data.username,
+              lang: existingProfile.lang || "en-US",
+              avatarColor: existingProfile.avatarColor || "#7c3aed",
+              avatarStyle: existingProfile.avatarStyle || "thumbs",
+              avatarSeed: existingProfile.avatarSeed || crypto.randomBytes(4).toString("hex"),
+            };
+          } catch (e) {}
+          var result = users.createAdmin({
+            username: data.username.trim(),
+            displayName: data.displayName || data.username.trim(),
+            pin: data.pin,
+            profile: adminProfile,
+          });
+          if (result.error) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: result.error }));
+            return;
+          }
+          users.clearSetupCode();
+          var session = createMultiUserSession(result.user.id, tlsOptions);
+          res.writeHead(200, {
+            "Set-Cookie": session.cookie,
+            "Content-Type": "application/json",
+          });
+          res.end(JSON.stringify({ ok: true, user: { id: result.user.id, username: result.user.username, role: result.user.role } }));
+        } catch (e) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end('{"error":"Invalid request"}');
+        }
+      });
+      return;
+    }
+
+    // Multi-user login
+    if (req.method === "POST" && fullUrl === "/auth/login") {
+      if (!users.isMultiUser()) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end('{"error":"Multi-user mode is not enabled"}');
+        return;
+      }
+      var ip = req.socket.remoteAddress || "";
+      var remaining = checkPinRateLimit(ip);
+      if (remaining !== null) {
+        res.writeHead(429, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ ok: false, locked: true, retryAfter: remaining }));
+        return;
+      }
+      var body = "";
+      req.on("data", function (chunk) { body += chunk; });
+      req.on("end", function () {
+        try {
+          var data = JSON.parse(body);
+          var user = users.authenticateUser(data.username, data.pin);
+          if (!user) {
+            recordPinFailure(ip);
+            var attemptsLeft = PIN_MAX_ATTEMPTS - (pinAttempts[ip] ? pinAttempts[ip].count : 0);
+            res.writeHead(401, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: "Invalid username or PIN", attemptsLeft: Math.max(attemptsLeft, 0) }));
+            return;
+          }
+          clearPinFailures(ip);
+          var session = createMultiUserSession(user.id, tlsOptions);
+          res.writeHead(200, {
+            "Set-Cookie": session.cookie,
+            "Content-Type": "application/json",
+          });
+          res.end(JSON.stringify({ ok: true, user: { id: user.id, username: user.username, role: user.role } }));
+        } catch (e) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end('{"error":"Invalid request"}');
+        }
+      });
+      return;
+    }
+
+    // Request OTP code (SMTP login)
+    if (req.method === "POST" && fullUrl === "/auth/request-otp") {
+      if (!users.isMultiUser() || !smtp.isEmailLoginEnabled()) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end('{"error":"OTP login not available"}');
+        return;
+      }
+      var ip = req.socket.remoteAddress || "";
+      var remaining = checkPinRateLimit(ip);
+      if (remaining !== null) {
+        res.writeHead(429, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ ok: false, locked: true, retryAfter: remaining }));
+        return;
+      }
+      var body = "";
+      req.on("data", function (chunk) { body += chunk; });
+      req.on("end", function () {
+        try {
+          var data = JSON.parse(body);
+          if (!data.email) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end('{"error":"Email is required"}');
+            return;
+          }
+          var user = users.findUserByEmail(data.email);
+          if (!user) {
+            // Don't reveal whether user exists — still say ok
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end('{"ok":true}');
+            return;
+          }
+          var result = smtp.requestOtp(data.email);
+          if (result.error) {
+            res.writeHead(429, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: result.error }));
+            return;
+          }
+          smtp.sendOtpEmail(data.email, result.code).then(function () {
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end('{"ok":true}');
+          }).catch(function () {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end('{"error":"Failed to send email"}');
+          });
+        } catch (e) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end('{"error":"Invalid request"}');
+        }
+      });
+      return;
+    }
+
+    // Verify OTP code (SMTP login)
+    if (req.method === "POST" && fullUrl === "/auth/verify-otp") {
+      if (!users.isMultiUser() || !smtp.isEmailLoginEnabled()) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end('{"error":"OTP login not available"}');
+        return;
+      }
+      var ip = req.socket.remoteAddress || "";
+      var remaining = checkPinRateLimit(ip);
+      if (remaining !== null) {
+        res.writeHead(429, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ ok: false, locked: true, retryAfter: remaining }));
+        return;
+      }
+      var body = "";
+      req.on("data", function (chunk) { body += chunk; });
+      req.on("end", function () {
+        try {
+          var data = JSON.parse(body);
+          if (!data.email || !data.code) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end('{"error":"Email and code are required"}');
+            return;
+          }
+          var otpResult = smtp.verifyOtp(data.email, data.code);
+          if (!otpResult.valid) {
+            recordPinFailure(ip);
+            res.writeHead(401, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: otpResult.error, attemptsLeft: otpResult.attemptsLeft }));
+            return;
+          }
+          var user = users.findUserByEmail(data.email);
+          if (!user) {
+            res.writeHead(401, { "Content-Type": "application/json" });
+            res.end('{"ok":false,"error":"Account not found"}');
+            return;
+          }
+          clearPinFailures(ip);
+          var session = createMultiUserSession(user.id, tlsOptions);
+          res.writeHead(200, {
+            "Set-Cookie": session.cookie,
+            "Content-Type": "application/json",
+          });
+          res.end(JSON.stringify({ ok: true, user: { id: user.id, username: user.username, role: user.role } }));
+        } catch (e) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end('{"error":"Invalid request"}');
+        }
+      });
+      return;
+    }
+
+    // Invite registration
+    if (req.method === "POST" && fullUrl === "/auth/register") {
+      if (!users.isMultiUser()) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end('{"error":"Multi-user mode is not enabled"}');
+        return;
+      }
+      var body = "";
+      req.on("data", function (chunk) { body += chunk; });
+      req.on("end", function () {
+        try {
+          var data = JSON.parse(body);
+          var validation = users.validateInvite(data.inviteCode);
+          if (!validation.valid) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: validation.error }));
+            return;
+          }
+          if (!data.username || data.username.trim().length < 1 || data.username.length > 100) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end('{"error":"Username is required"}');
+            return;
+          }
+          var result;
+          if (smtp.isEmailLoginEnabled() && !data.pin) {
+            // SMTP mode: username + email required, no PIN
+            if (!data.email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(data.email)) {
+              res.writeHead(400, { "Content-Type": "application/json" });
+              res.end('{"error":"A valid email address is required"}');
+              return;
+            }
+            result = users.createUserWithoutPin({
+              username: data.username.trim(),
+              email: data.email,
+              displayName: data.displayName || data.username.trim(),
+              role: "user",
+            });
+          } else {
+            // PIN mode: username + PIN, no email required
+            if (!data.pin || !/^\d{6}$/.test(data.pin)) {
+              res.writeHead(400, { "Content-Type": "application/json" });
+              res.end('{"error":"PIN must be exactly 6 digits"}');
+              return;
+            }
+            result = users.createUser({
+              username: data.username.trim(),
+              email: data.email || null,
+              displayName: data.displayName || data.username.trim(),
+              pin: data.pin,
+              role: "user",
+            });
+          }
+          if (result.error) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: result.error }));
+            return;
+          }
+          users.markInviteUsed(data.inviteCode);
+          var session = createMultiUserSession(result.user.id, tlsOptions);
+          res.writeHead(200, {
+            "Set-Cookie": session.cookie,
+            "Content-Type": "application/json",
+          });
+          res.end(JSON.stringify({ ok: true, user: { id: result.user.id, username: result.user.username, role: result.user.role } }));
+        } catch (e) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end('{"error":"Invalid request"}');
+        }
+      });
+      return;
+    }
+
+    // Invite page (magic link)
+    if (req.method === "GET" && fullUrl.indexOf("/invite/") === 0) {
+      var inviteCode = fullUrl.substring("/invite/".length);
+      if (!users.isMultiUser()) {
+        res.writeHead(404, { "Content-Type": "text/plain" });
+        res.end("Not found");
+        return;
+      }
+      var validation = users.validateInvite(inviteCode);
+      if (!validation.valid) {
+        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+        res.end('<!DOCTYPE html><html><head><title>Clay</title>' +
+          '<style>body{background:#2F2E2B;color:#E8E5DE;font-family:system-ui;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0}' +
+          '.c{text-align:center;max-width:360px;padding:20px}h1{color:#DA7756;margin-bottom:16px}p{color:#908B81}</style></head>' +
+          '<body><div class="c"><h1>Clay</h1><p>' + (validation.error === "Invite expired" ? "This invite link has expired." : validation.error === "Invite already used" ? "This invite link has already been used." : "Invalid invite link.") + '</p></div></body></html>');
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(smtp.isEmailLoginEnabled() ? smtpInvitePageHtml(inviteCode) : invitePageHtml(inviteCode));
+      return;
+    }
+
     // CA certificate download
     if (req.url === "/ca/download" && req.method === "GET" && caContent) {
       res.writeHead(200, {
@@ -454,10 +858,25 @@ function createServer(opts) {
       return;
     }
 
-    // User profile
+    // User profile — user-scoped in multi-user mode, global in single-user mode
     var profilePath = path.join(CONFIG_DIR, "profile.json");
 
     if (req.method === "GET" && fullUrl === "/api/profile") {
+      if (users.isMultiUser()) {
+        var mu = getMultiUserFromReq(req);
+        if (!mu) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end('{"error":"unauthorized"}');
+          return;
+        }
+        var profile = mu.profile || { name: "", lang: "en-US", avatarColor: "#7c3aed", avatarStyle: "thumbs", avatarSeed: "" };
+        profile.username = mu.username;
+        profile.userId = mu.id;
+        profile.role = mu.role;
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(profile));
+        return;
+      }
       var profile = { name: "", lang: "en-US", avatarColor: "#7c3aed", avatarStyle: "thumbs", avatarSeed: "" };
       try {
         var raw = fs.readFileSync(profilePath, "utf8");
@@ -487,7 +906,24 @@ function createServer(opts) {
           }
           if (typeof data.avatarStyle === "string") profile.avatarStyle = data.avatarStyle.substring(0, 30);
           if (typeof data.avatarSeed === "string") profile.avatarSeed = data.avatarSeed.substring(0, 30);
-          fs.writeFileSync(profilePath, JSON.stringify(profile, null, 2), "utf8");
+          if (users.isMultiUser()) {
+            var mu = getMultiUserFromReq(req);
+            if (!mu) {
+              res.writeHead(401, { "Content-Type": "application/json" });
+              res.end('{"error":"unauthorized"}');
+              return;
+            }
+            users.updateUserProfile(mu.id, profile);
+            // Broadcast updated avatar/presence to all projects
+            projects.forEach(function (pCtx) {
+              pCtx.refreshUserProfile(mu.id);
+            });
+          } else {
+            fs.writeFileSync(profilePath, JSON.stringify(profile, null, 2), "utf8");
+            if (process.platform !== "win32") {
+              try { fs.chmodSync(profilePath, 0o600); } catch (chmodErr) {}
+            }
+          }
           res.writeHead(200, { "Content-Type": "application/json" });
           res.end(JSON.stringify(profile));
         } catch (e) {
@@ -498,6 +934,440 @@ function createServer(opts) {
       return;
     }
 
+    // --- Admin API endpoints (multi-user mode only) ---
+
+    // List all users (admin only)
+    if (req.method === "GET" && fullUrl === "/api/admin/users") {
+      if (!users.isMultiUser()) {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end('{"error":"Not found"}');
+        return;
+      }
+      var mu = getMultiUserFromReq(req);
+      if (!mu || mu.role !== "admin") {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end('{"error":"Admin access required"}');
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ users: users.getAllUsers() }));
+      return;
+    }
+
+    // Remove user (admin only)
+    if (req.method === "DELETE" && fullUrl.indexOf("/api/admin/users/") === 0) {
+      if (!users.isMultiUser()) {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end('{"error":"Not found"}');
+        return;
+      }
+      var mu = getMultiUserFromReq(req);
+      if (!mu || mu.role !== "admin") {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end('{"error":"Admin access required"}');
+        return;
+      }
+      var targetUserId = fullUrl.substring("/api/admin/users/".length);
+      if (targetUserId === mu.id) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end('{"error":"Cannot remove yourself"}');
+        return;
+      }
+      var result = users.removeUser(targetUserId);
+      if (result.error) {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: result.error }));
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end('{"ok":true}');
+      return;
+    }
+
+    // Create invite (admin only)
+    if (req.method === "POST" && fullUrl === "/api/admin/invites") {
+      if (!users.isMultiUser()) {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end('{"error":"Not found"}');
+        return;
+      }
+      var mu = getMultiUserFromReq(req);
+      if (!mu || mu.role !== "admin") {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end('{"error":"Admin access required"}');
+        return;
+      }
+      var invite = users.createInvite(mu.id);
+      var proto = tlsOptions ? "https" : "http";
+      var host = req.headers.host || ("localhost:" + portNum);
+      var inviteUrl = proto + "://" + host + "/invite/" + invite.code;
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ ok: true, invite: invite, url: inviteUrl }));
+      return;
+    }
+
+    // List invites (admin only)
+    if (req.method === "GET" && fullUrl === "/api/admin/invites") {
+      if (!users.isMultiUser()) {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end('{"error":"Not found"}');
+        return;
+      }
+      var mu = getMultiUserFromReq(req);
+      if (!mu || mu.role !== "admin") {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end('{"error":"Admin access required"}');
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ invites: users.getInvites() }));
+      return;
+    }
+
+    // Revoke invite (admin only)
+    if (req.method === "DELETE" && fullUrl.indexOf("/api/admin/invites/") === 0) {
+      if (!users.isMultiUser()) {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end('{"error":"Not found"}');
+        return;
+      }
+      var mu = getMultiUserFromReq(req);
+      if (!mu || mu.role !== "admin") {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end('{"error":"Admin access required"}');
+        return;
+      }
+      var inviteCode = decodeURIComponent(fullUrl.replace("/api/admin/invites/", ""));
+      if (!inviteCode) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end('{"error":"Invite code is required"}');
+        return;
+      }
+      var result = users.revokeInvite(inviteCode);
+      if (result.error) {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: result.error }));
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end('{"ok":true}');
+      return;
+    }
+
+    // Send invite via email (admin only)
+    if (req.method === "POST" && fullUrl === "/api/admin/invites/email") {
+      if (!users.isMultiUser() || !smtp.isSmtpConfigured()) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end('{"error":"SMTP not configured"}');
+        return;
+      }
+      var mu = getMultiUserFromReq(req);
+      if (!mu || mu.role !== "admin") {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end('{"error":"Admin access required"}');
+        return;
+      }
+      var body = "";
+      req.on("data", function (chunk) { body += chunk; });
+      req.on("end", function () {
+        try {
+          var data = JSON.parse(body);
+          if (!data.email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(data.email)) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end('{"error":"Valid email is required"}');
+            return;
+          }
+          var invite = users.createInvite(mu.id, data.email);
+          var proto = tlsOptions ? "https" : "http";
+          var host = req.headers.host || ("localhost:" + portNum);
+          var inviteUrl = proto + "://" + host + "/invite/" + invite.code;
+          smtp.sendInviteEmail(data.email, inviteUrl, mu.displayName || mu.username).then(function () {
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: true, invite: invite, url: inviteUrl }));
+          }).catch(function (err) {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Failed to send email: " + (err.message || "unknown error") }));
+          });
+        } catch (e) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end('{"error":"Invalid request"}');
+        }
+      });
+      return;
+    }
+
+    // Get SMTP config (admin only)
+    if (req.method === "GET" && fullUrl === "/api/admin/smtp") {
+      if (!users.isMultiUser()) {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end('{"error":"Not found"}');
+        return;
+      }
+      var mu = getMultiUserFromReq(req);
+      if (!mu || mu.role !== "admin") {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end('{"error":"Admin access required"}');
+        return;
+      }
+      var cfg = smtp.getSmtpConfig();
+      if (cfg) {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ smtp: { host: cfg.host, port: cfg.port, secure: cfg.secure, user: cfg.user, pass: "••••••••", from: cfg.from, emailLoginEnabled: !!cfg.emailLoginEnabled } }));
+      } else {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end('{"smtp":null}');
+      }
+      return;
+    }
+
+    // Save SMTP config (admin only)
+    if (req.method === "POST" && fullUrl === "/api/admin/smtp") {
+      if (!users.isMultiUser()) {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end('{"error":"Not found"}');
+        return;
+      }
+      var mu = getMultiUserFromReq(req);
+      if (!mu || mu.role !== "admin") {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end('{"error":"Admin access required"}');
+        return;
+      }
+      var body = "";
+      req.on("data", function (chunk) { body += chunk; });
+      req.on("end", function () {
+        try {
+          var data = JSON.parse(body);
+          // Allow clearing SMTP config by sending empty fields
+          if (!data.host && !data.user && !data.pass && !data.from) {
+            smtp.saveSmtpConfig(null);
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end('{"ok":true}');
+            return;
+          }
+          if (!data.host || !data.user || !data.pass || !data.from) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end('{"error":"Host, user, password, and from address are required"}');
+            return;
+          }
+          // If password is masked, keep existing
+          var existingCfg = smtp.getSmtpConfig();
+          var pass = data.pass;
+          if (pass === "••••••••" && existingCfg) {
+            pass = existingCfg.pass;
+          }
+          smtp.saveSmtpConfig({
+            host: data.host,
+            port: parseInt(data.port, 10) || 587,
+            secure: !!data.secure,
+            user: data.user,
+            pass: pass,
+            from: data.from,
+            emailLoginEnabled: !!data.emailLoginEnabled,
+          });
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end('{"ok":true}');
+        } catch (e) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end('{"error":"Invalid request"}');
+        }
+      });
+      return;
+    }
+
+    // Test SMTP connection (admin only)
+    if (req.method === "POST" && fullUrl === "/api/admin/smtp/test") {
+      if (!users.isMultiUser()) {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end('{"error":"Not found"}');
+        return;
+      }
+      var mu = getMultiUserFromReq(req);
+      if (!mu || mu.role !== "admin") {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end('{"error":"Admin access required"}');
+        return;
+      }
+      var body = "";
+      req.on("data", function (chunk) { body += chunk; });
+      req.on("end", function () {
+        try {
+          var data = JSON.parse(body);
+          // Use provided config or fall back to saved
+          var existingCfg = smtp.getSmtpConfig();
+          var pass = data.pass;
+          if (pass === "••••••••" && existingCfg) {
+            pass = existingCfg.pass;
+          }
+          var cfg = {
+            host: data.host || (existingCfg && existingCfg.host),
+            port: parseInt(data.port, 10) || (existingCfg && existingCfg.port) || 587,
+            secure: data.secure !== undefined ? !!data.secure : (existingCfg && !!existingCfg.secure),
+            user: data.user || (existingCfg && existingCfg.user),
+            pass: pass || (existingCfg && existingCfg.pass),
+            from: data.from || (existingCfg && existingCfg.from),
+          };
+          if (!cfg.host || !cfg.user || !cfg.pass || !cfg.from) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end('{"error":"SMTP configuration is incomplete"}');
+            return;
+          }
+          var testTo = mu.email || cfg.from;
+          smtp.sendTestEmail(cfg, testTo).then(function (result) {
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: true, message: "Test email sent to " + testTo }));
+          }).catch(function (err) {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: err.message || "Connection failed" }));
+          });
+        } catch (e) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end('{"error":"Invalid request"}');
+        }
+      });
+      return;
+    }
+
+    // --- Project access control (admin only, multi-user) ---
+
+    // Set project visibility (admin only)
+    if (req.method === "PUT" && /^\/api\/admin\/projects\/[a-z0-9_-]+\/visibility$/.test(fullUrl)) {
+      if (!users.isMultiUser()) {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end('{"error":"Not found"}');
+        return;
+      }
+      var mu = getMultiUserFromReq(req);
+      if (!mu || mu.role !== "admin") {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end('{"error":"Admin access required"}');
+        return;
+      }
+      var projSlug = fullUrl.split("/")[4];
+      var body = "";
+      req.on("data", function (chunk) { body += chunk; });
+      req.on("end", function () {
+        try {
+          var data = JSON.parse(body);
+          if (data.visibility !== "public" && data.visibility !== "private") {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end('{"error":"Visibility must be public or private"}');
+            return;
+          }
+          if (!onSetProjectVisibility) {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end('{"error":"Visibility handler not configured"}');
+            return;
+          }
+          var result = onSetProjectVisibility(projSlug, data.visibility);
+          if (result && result.error) {
+            res.writeHead(404, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: result.error }));
+            return;
+          }
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end('{"ok":true}');
+        } catch (e) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end('{"error":"Invalid request"}');
+        }
+      });
+      return;
+    }
+
+    // Set project allowed users (admin only)
+    if (req.method === "PUT" && /^\/api\/admin\/projects\/[a-z0-9_-]+\/users$/.test(fullUrl)) {
+      if (!users.isMultiUser()) {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end('{"error":"Not found"}');
+        return;
+      }
+      var mu = getMultiUserFromReq(req);
+      if (!mu || mu.role !== "admin") {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end('{"error":"Admin access required"}');
+        return;
+      }
+      var projSlug = fullUrl.split("/")[4];
+      var body = "";
+      req.on("data", function (chunk) { body += chunk; });
+      req.on("end", function () {
+        try {
+          var data = JSON.parse(body);
+          if (!Array.isArray(data.allowedUsers)) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end('{"error":"allowedUsers must be an array"}');
+            return;
+          }
+          if (!onSetProjectAllowedUsers) {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end('{"error":"AllowedUsers handler not configured"}');
+            return;
+          }
+          var result = onSetProjectAllowedUsers(projSlug, data.allowedUsers);
+          if (result && result.error) {
+            res.writeHead(404, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: result.error }));
+            return;
+          }
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end('{"ok":true}');
+        } catch (e) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end('{"error":"Invalid request"}');
+        }
+      });
+      return;
+    }
+
+    // Get project access info (admin only)
+    if (req.method === "GET" && /^\/api\/admin\/projects\/[a-z0-9_-]+\/access$/.test(fullUrl)) {
+      if (!users.isMultiUser()) {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end('{"error":"Not found"}');
+        return;
+      }
+      var mu = getMultiUserFromReq(req);
+      if (!mu || mu.role !== "admin") {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end('{"error":"Admin access required"}');
+        return;
+      }
+      var projSlug = fullUrl.split("/")[4];
+      if (!onGetProjectAccess) {
+        res.writeHead(500, { "Content-Type": "application/json" });
+        res.end('{"error":"Access handler not configured"}');
+        return;
+      }
+      var access = onGetProjectAccess(projSlug);
+      if (access && access.error) {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: access.error }));
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify(access));
+      return;
+    }
+
+    // Multi-user info endpoint (who am I?)
+    if (req.method === "GET" && fullUrl === "/api/me") {
+      if (!users.isMultiUser()) {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end('{"multiUser":false}');
+        return;
+      }
+      var mu = getMultiUserFromReq(req);
+      if (!mu) {
+        res.writeHead(401, { "Content-Type": "application/json" });
+        res.end('{"error":"unauthorized"}');
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ multiUser: true, smtpEnabled: smtp.isSmtpConfigured(), emailLoginEnabled: smtp.isEmailLoginEnabled(), user: { id: mu.id, username: mu.username, email: mu.email || null, displayName: mu.displayName, role: mu.role } }));
+      return;
+    }
+
     // Skills proxy: leaderboard list
     if (req.method === "GET" && fullUrl === "/api/skills") {
       var qs = req.url.indexOf("?") >= 0 ? req.url.substring(req.url.indexOf("?")) : "";
@@ -593,17 +1463,37 @@ function createServer(opts) {
       return;
     }
 
-    // Root path — redirect to first project
+    // Root path — redirect to first accessible project
     if (fullUrl === "/" && req.method === "GET") {
-      if (!isAuthed(req, authToken)) {
+      if (!isRequestAuthed(req)) {
         res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-        res.end(pinPage);
+        res.end(getAuthPage());
         return;
       }
       if (projects.size > 0) {
-        var slug = projects.keys().next().value;
-        res.writeHead(302, { "Location": "/p/" + slug + "/" });
-        res.end();
+        var targetSlug = null;
+        var reqUser = users.isMultiUser() ? getMultiUserFromReq(req) : null;
+        projects.forEach(function (ctx, s) {
+          if (targetSlug) return;
+          if (reqUser && onGetProjectAccess) {
+            var access = onGetProjectAccess(s);
+            if (access && !access.error && users.canAccessProject(reqUser.id, access)) {
+              targetSlug = s;
+            }
+          } else {
+            targetSlug = s;
+          }
+        });
+        if (targetSlug) {
+          res.writeHead(302, { "Location": "/p/" + targetSlug + "/" });
+          res.end();
+          return;
+        }
+      }
+      // No accessible projects — show info page
+      if (users.isMultiUser()) {
+        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(noProjectsPageHtml());
         return;
       }
       res.writeHead(200, { "Content-Type": "text/plain" });
@@ -611,21 +1501,22 @@ function createServer(opts) {
       return;
     }
 
-    // Global info endpoint (auth required)
+    // Global info endpoint (projects only for authenticated requests)
     if (req.method === "GET" && req.url === "/info") {
-      if (!isAuthed(req, authToken)) {
+      if (!isRequestAuthed(req)) {
         res.writeHead(401, {
           "Content-Type": "application/json",
           "Access-Control-Allow-Origin": "*",
         });
-        res.end('{"error":"unauthorized"}');
+        res.end(JSON.stringify({ version: currentVersion, authenticated: false }));
         return;
       }
       var projectList = [];
       projects.forEach(function (ctx, slug) {
         projectList.push({ slug: slug, project: ctx.project });
       });
-      res.end(JSON.stringify({ projects: projectList, version: currentVersion }));
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ projects: projectList, version: currentVersion, authenticated: true }));
       return;
     }
 
@@ -658,12 +1549,25 @@ function createServer(opts) {
     }
 
     // Auth check for project routes
-    if (!isAuthed(req, authToken)) {
+    if (!isRequestAuthed(req)) {
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      res.end(pinPage);
+      res.end(getAuthPage());
       return;
     }
 
+    // Multi-user: check project access for HTTP requests
+    if (users.isMultiUser() && onGetProjectAccess) {
+      var httpUser = getMultiUserFromReq(req);
+      if (httpUser) {
+        var httpAccess = onGetProjectAccess(slug);
+        if (httpAccess && !httpAccess.error && !users.canAccessProject(httpUser.id, httpAccess)) {
+          res.writeHead(302, { "Location": "/" });
+          res.end();
+          return;
+        }
+      }
+    }
+
     // Strip prefix for project-scoped handling
     var projectUrl = stripPrefix(req.url.split("?")[0], slug);
     // Re-attach query string for API routes
@@ -777,7 +1681,7 @@ function createServer(opts) {
       }
     }
 
-    if (!isAuthed(req, authToken)) {
+    if (!isRequestAuthed(req)) {
       socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
       socket.destroy();
       return;
@@ -796,8 +1700,49 @@ function createServer(opts) {
       return;
     }
 
+    // Attach user info to the WS connection for multi-user filtering
+    var wsUser = null;
+    if (users.isMultiUser()) {
+      wsUser = getMultiUserFromReq(req);
+      // Check project access for multi-user mode
+      if (wsUser && onGetProjectAccess) {
+        var projectAccess = onGetProjectAccess(wsSlug);
+        if (projectAccess && !projectAccess.error) {
+          if (!users.canAccessProject(wsUser.id, projectAccess)) {
+            socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
+            socket.destroy();
+            return;
+          }
+        }
+      }
+    }
+
     wss.handleUpgrade(req, socket, head, function (ws) {
-      ctx.handleConnection(ws);
+      // Apply rate limiting to WS messages
+      var msgCount = 0;
+      var msgWindowStart = Date.now();
+      var WS_RATE_LIMIT = 60; // messages per second
+      var origEmit = ws.emit;
+      ws.emit = function (event) {
+        if (event === "message") {
+          var now = Date.now();
+          if (now - msgWindowStart >= 1000) {
+            msgCount = 0;
+            msgWindowStart = now;
+          }
+          msgCount++;
+          if (msgCount > WS_RATE_LIMIT) {
+            try {
+              ws.send(JSON.stringify({ type: "error", message: "Rate limit exceeded. Connection will be closed." }));
+              ws.close(1008, "Rate limit exceeded");
+            } catch (e) {}
+            return false;
+          }
+        }
+        return origEmit.apply(ws, arguments);
+      };
+      ws._clayUser = wsUser; // attach user context
+      ctx.handleConnection(ws, wsUser);
     });
   });
 
@@ -807,11 +1752,34 @@ function createServer(opts) {
     if (processingUpdateTimer) clearTimeout(processingUpdateTimer);
     processingUpdateTimer = setTimeout(function () {
       processingUpdateTimer = null;
-      broadcastAll({
-        type: "projects_updated",
-        projects: getProjects(),
-        projectCount: projects.size,
-      });
+      if (users.isMultiUser() && onGetProjectAccess) {
+        // Per-client filtered project list
+        var allProjectsList = getProjects();
+        projects.forEach(function (ctx) {
+          ctx.forEachClient(function (ws) {
+            var wsUser = ws._clayUser;
+            var filtered = allProjectsList;
+            if (wsUser) {
+              filtered = allProjectsList.filter(function (p) {
+                var access = onGetProjectAccess(p.slug);
+                if (!access || access.error) return true;
+                return users.canAccessProject(wsUser.id, access);
+              });
+            }
+            ws.send(JSON.stringify({
+              type: "projects_updated",
+              projects: filtered,
+              projectCount: filtered.length,
+            }));
+          });
+        });
+      } else {
+        broadcastAll({
+          type: "projects_updated",
+          projects: getProjects(),
+          projectCount: projects.size,
+        });
+      }
     }, 200);
   }
 
@@ -829,9 +1797,16 @@ function createServer(opts) {
       currentVersion: currentVersion,
       lanHost: lanHost,
       getProjectCount: function () { return projects.size; },
-      getProjectList: function () {
+      getProjectList: function (userId) {
         var list = [];
-        projects.forEach(function (ctx) { list.push(ctx.getStatus()); });
+        projects.forEach(function (ctx, s) {
+          var status = ctx.getStatus();
+          if (userId && users.isMultiUser() && onGetProjectAccess) {
+            var access = onGetProjectAccess(s);
+            if (access && !access.error && !users.canAccessProject(userId, access)) return;
+          }
+          list.push(status);
+        });
         return list;
       },
       getHubSchedules: function () {
@@ -896,6 +1871,7 @@ function createServer(opts) {
         if (!ctx) return 0;
         return ctx.getSchedules().length;
       },
+      onPresenceChange: broadcastPresenceChange,
       onProcessingChanged: broadcastProcessingChange,
       onAddProject: onAddProject,
       onRemoveProject: onRemoveProject,
@@ -974,6 +1950,78 @@ function createServer(opts) {
     authToken = hash;
   }
 
+  // Collect all unique users across all projects (for topbar server-wide presence)
+  function getServerUsers() {
+    var seen = {};
+    var list = [];
+    projects.forEach(function (ctx) {
+      ctx.forEachClient(function (ws) {
+        if (!ws._clayUser) return;
+        var u = ws._clayUser;
+        if (seen[u.id]) return;
+        seen[u.id] = true;
+        var p = u.profile || {};
+        list.push({
+          id: u.id,
+          displayName: p.name || u.displayName || u.username,
+          username: u.username,
+          avatarStyle: p.avatarStyle || "thumbs",
+          avatarSeed: p.avatarSeed || u.username,
+        });
+      });
+    });
+    return list;
+  }
+
+  // Debounced broadcast of projects_updated when presence changes
+  // Sends per-user filtered project lists + server-wide user list
+  var presenceTimer = null;
+  function broadcastPresenceChange() {
+    if (presenceTimer) return;
+    presenceTimer = setTimeout(function () {
+      presenceTimer = null;
+      if (!users.isMultiUser()) {
+        broadcastAll({
+          type: "projects_updated",
+          projects: getProjects(),
+          projectCount: projects.size,
+        });
+        return;
+      }
+      var serverUsers = getServerUsers();
+      // Build per-user filtered lists, send individually
+      var sentUsers = {};
+      projects.forEach(function (ctx) {
+        ctx.forEachClient(function (ws) {
+          var userId = ws._clayUser ? ws._clayUser.id : null;
+          var key = userId || "__anon__";
+          if (sentUsers[key]) {
+            // Already computed for this user, just send the cached msg
+            ws.send(sentUsers[key]);
+            return;
+          }
+          var filteredProjects = [];
+          projects.forEach(function (pCtx, s) {
+            var status = pCtx.getStatus();
+            if (userId && onGetProjectAccess) {
+              var access = onGetProjectAccess(s);
+              if (access && !access.error && !users.canAccessProject(userId, access)) return;
+            }
+            filteredProjects.push(status);
+          });
+          var msgStr = JSON.stringify({
+            type: "projects_updated",
+            projects: filteredProjects,
+            projectCount: projects.size,
+            serverUsers: serverUsers,
+          });
+          sentUsers[key] = msgStr;
+          ws.send(msgStr);
+        });
+      });
+    }, 300);
+  }
+
   function broadcastAll(msg) {
     projects.forEach(function (ctx) {
       ctx.send(msg);
@@ -1004,4 +2052,4 @@ function createServer(opts) {
   };
 }
 
-module.exports = { createServer: createServer, generateAuthToken: generateAuthToken };
+module.exports = { createServer: createServer, generateAuthToken: generateAuthToken, verifyPin: verifyPin };