clay-server 5.1.0 → 5.2.0-beta.1

package/lib/server-auth.js

@@ -66,71 +66,54 @@ function attachAuth(ctx) {
   // --- Multi-user auth tokens (persisted to disk) ---
   var TOKENS_FILE = path.join(CONFIG_DIR, _isDevMode ? "auth-tokens-dev.json" : "auth-tokens.json");
   var MULTI_USER_COOKIE = _isDevMode ? "relay_auth_user_dev" : "relay_auth_user";
-  var multiUserTokens = {};
-
-  function loadTokens() {
-    try {
-      var raw = fs.readFileSync(TOKENS_FILE, "utf8");
-      var data = JSON.parse(raw);
-      if (data && typeof data === "object") {
-        multiUserTokens = data;
-      }
-    } catch (e) {
-      multiUserTokens = {};
-    }
+  var accountPolicy = require('./account-auth-policy').attachPolicy(users);
+  var transport = require('./account-auth-transport').attachTransport({ users: users, tlsOptions: tlsOptions });
+  var sessionStore = require('./account-session-store').attachSessionStore({
+    file: TOKENS_FILE, managed: accountPolicy.available, clientAddress: transport.clientAddress,
+  });
+  var throttle = require('./account-auth-throttle').attachThrottle({
+    file: path.join(CONFIG_DIR, _isDevMode ? 'auth-attempts-dev.json' : 'auth-attempts.json'), clientAddress: transport.clientAddress,
+  });
+  function sessionToken(req) { return parseCookies(req)[MULTI_USER_COOKIE]; }
+  function createMultiUserSession(userId, credential, passkeyId, secure, req) {
+    var created = sessionStore.create(userId, credential, passkeyId, req, req && sessionToken(req));
+    var age = created.entry.expiresAt ? Math.max(0, Math.floor((created.entry.expiresAt - Date.now()) / 1000)) : 31536000;
+    var cookie = MULTI_USER_COOKIE + '=' + created.token + '; Path=/; HttpOnly; SameSite=Strict; Max-Age=' + age +
+      (tlsOptions || secure || req && transport.info(req).secure ? '; Secure' : '');
+    var rememberedCookie = rememberedAccounts.remember(userId, req);
+    return { token: created.token, cookie: cookie, cookies: rememberedCookie ? [cookie, rememberedCookie] : [cookie] };
   }
-
-  function saveTokens() {
-    try {
-      fs.mkdirSync(path.dirname(TOKENS_FILE), { recursive: true });
-      var tmpPath = TOKENS_FILE + ".tmp";
-      fs.writeFileSync(tmpPath, JSON.stringify(multiUserTokens));
-      fs.renameSync(tmpPath, TOKENS_FILE);
-    } catch (e) {}
+  function validSessionUser(record) {
+    var user = record && users.findUserById(record.userId);
+    if (!user) return null;
+    if (record.passkeyId && (!require('./account-passkey-policy').configured(users.loadUsers()) ||
+      !(user.passkeys || []).some(function (key) { return key.id === record.passkeyId; }))) return null;
+    if (accountPolicy.requiresPassword(user) && (!user.passwordHash || user.mustChangePin ||
+      record.credentialVersion !== require('./account-session-store').digest(user.passwordHash))) return null;
+    return user;
   }
-
-  loadTokens();
-
-  function createMultiUserSession(userId) {
-    var token = users.generateUserAuthToken(userId);
-    multiUserTokens[token] = userId;
-    saveTokens();
-    var cookie = MULTI_USER_COOKIE + "=" + token + "; Path=/; HttpOnly; SameSite=Strict; Max-Age=31536000" + (tlsOptions ? "; Secure" : "");
-    return { token: token, cookie: cookie };
-  }
-
   function getMultiUserFromReq(req) {
-    var cookies = parseCookies(req);
-    var token = cookies[MULTI_USER_COOKIE];
-    if (token) {
-      var userId = multiUserTokens[token];
-      if (userId) {
-        var user = users.findUserById(userId);
-        if (user) return user;
-      }
+    if (accountPolicy.enabled() && !transport.allows(req, false)) return null;
+    var token = sessionToken(req);
+    var record = sessionStore.get(token, false);
+    var user = validSessionUser(record);
+    if (user) {
+      if (!req.claySessionPassive) sessionStore.get(token, true, req);
+      return user;
     }
-    // Solo auto-login: exactly one user with no PIN => frictionless access, no
-    // login wall. Mirrors the old single-user onramp once single-user mode is
-    // absorbed into multi-user. Disabled the moment a PIN is set or a second
-    // user is added (then the normal token/login flow applies).
-    var solo = users.getSoloNoPinUser();
-    if (solo) return solo;
-    return null;
+    return users.getSoloNoPinUser() || null;
   }
-
-  function isMultiUserAuthed(req) {
-    return !!getMultiUserFromReq(req);
+  function touchSession(req) {
+    if (getMultiUserFromReq(req)) sessionStore.get(sessionToken(req), true, req);
   }
-
-  function revokeUserTokens(userId) {
-    var changed = false;
-    for (var token in multiUserTokens) {
-      if (multiUserTokens[token] === userId) {
-        delete multiUserTokens[token];
-        changed = true;
-      }
+  function isMultiUserAuthed(req) { return !!getMultiUserFromReq(req); }
+  function revokeUserTokens(userId) { sessionStore.revokeUser(userId); }
+  function allowAttempt(req, res, username) {
+    try { throttle.consume(req, username); return true; }
+    catch (error) {
+      res.writeHead(error.status || 503, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      res.end(JSON.stringify({ error: error.message })); return false;
     }
-    if (changed) saveTokens();
   }
 
   // --- PIN rate limiting (per-instance state) ---
@@ -163,7 +146,7 @@ function attachAuth(ctx) {
   var recovery = null;
 
   function setRecovery(urlPath, password) {
-    recovery = { urlPath: urlPath, password: password };
+    recovery = { urlPath: urlPath, password: password, until: Date.now() + 15 * 60000 };
   }
 
   function clearRecovery() {
@@ -246,14 +229,11 @@ function attachAuth(ctx) {
   // --- Auth page selection ---
   var pinPage = pages.pinPageHtml();
   var adminSetupPage = pages.adminSetupPageHtml();
-  var loginPage = pages.multiUserLoginPageHtml();
-  var smtpLoginPage = pages.smtpLoginPageHtml();
 
   function getAuthPage() {
     if (!users.isMultiUser()) return pinPage;
     if (!users.hasAdmin()) return adminSetupPage;
-    if (smtp.isEmailLoginEnabled()) return smtpLoginPage;
-    return loginPage;
+    return require('./account-login-page').render({ password: accountPolicy.enabled(), email: !accountPolicy.enabled() && smtp.isEmailLoginEnabled() });
   }
 
   function isRequestAuthed(req) {
@@ -268,8 +248,22 @@ function attachAuth(ctx) {
   // --- Route handler ---
 
   function handleRequest(req, res, fullUrl) {
+    if (require('./account-login-page').handleAsset(req, res, fullUrl)) return true;
+    if (accountPolicy.enabled() && transport.info(req).secure && typeof res.setHeader === 'function') res.setHeader('Strict-Transport-Security', 'max-age=31536000');
+    if ((accountPolicy.enabled() || fullUrl === '/api/account-auth-policy' && req.method === 'PUT') && /^(?:\/auth\/(?!passkey-browser\.js)|\/api\/(?:account-auth-policy|passkey-policy|passkeys|account-sessions|account-transport|user\/pin|admin\/users|profile)|\/recover\/)/.test(fullUrl) &&
+      !transport.allows(req, ['GET', 'HEAD', 'OPTIONS'].indexOf(req.method) === -1)) {
+      res.writeHead(403, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      res.end(JSON.stringify({ error: 'Use HTTPS and the same Clay address for account requests. Reverse proxies must be explicitly configured.' })); return true;
+    }
+    if (rememberedAccounts.handleRequest(req, res, fullUrl)) return true;
+    if (accountSecurity.handleRequest(req, res, fullUrl)) return true;
+    if (accountPasskeys.handleRequest(req, res, fullUrl)) return true;
+    if (accountPasswords.handleRequest(req, res, fullUrl)) return true;
     // Admin password recovery
     if (recovery && fullUrl === "/recover/" + recovery.urlPath) {
+      if (recovery.until <= Date.now()) {
+        recovery = null; res.writeHead(410, { 'Content-Type': 'application/json' }); res.end('{"error":"Recovery expired. Enable a new recovery link from the server terminal."}'); return true;
+      }
       if (req.method === "GET") {
         res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
         res.end(recoveryPageHtml());
@@ -288,6 +282,8 @@ function attachAuth(ctx) {
         req.on("end", function () {
           try {
             var data = JSON.parse(body);
+            if (!allowAttempt(req, res, 'admin-recovery')) return;
+            if (!recovery || recovery.until <= Date.now()) throw new Error('Recovery expired.');
             if (data.step === "verify") {
               if (!data.password || data.password !== recovery.password) {
                 recordPinFailure(ip);
@@ -315,7 +311,9 @@ function attachAuth(ctx) {
                 res.end('{"error":"No admin account found"}');
                 return;
               }
-              users.updateUserPin(admin.id, data.pin);
+              var reset = users.updateUserPin(admin.id, data.pin);
+              if (!reset.ok) throw new Error('Could not reset the administrator account.');
+              revokeUserTokens(admin.id);
               recovery = null;
               res.writeHead(200, { "Content-Type": "application/json" });
               res.end('{"ok":true}');
@@ -334,6 +332,11 @@ function attachAuth(ctx) {
 
     // Global auth endpoint (single-user PIN)
     if (req.method === "POST" && req.url === "/auth") {
+      if (users.isMultiUser()) {
+        res.writeHead(403, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+        res.end(JSON.stringify({ ok: false, error: 'Server PIN sign-in is unavailable. Sign in with your account.' }));
+        return true;
+      }
       var ip = req.socket.remoteAddress || "";
       var remaining = checkPinRateLimit(ip);
       if (remaining !== null) {
@@ -439,9 +442,9 @@ function attachAuth(ctx) {
             }
           }
           users.clearSetupCode();
-          var session = createMultiUserSession(result.user.id);
+          var session = createMultiUserSession(result.user.id, null, null, false, req);
           res.writeHead(200, {
-            "Set-Cookie": session.cookie,
+            "Set-Cookie": session.cookies,
             "Content-Type": "application/json",
           });
           res.end(JSON.stringify({ ok: true, user: { id: result.user.id, username: result.user.username, role: result.user.role } }));
@@ -472,6 +475,7 @@ function attachAuth(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
+          if (!allowAttempt(req, res, data.username)) return;
           var user = users.authenticateUser(data.username, data.pin);
           if (!user) {
             recordPinFailure(ip);
@@ -481,11 +485,12 @@ function attachAuth(ctx) {
             return;
           }
           clearPinFailures(ip);
-          var session = createMultiUserSession(user.id);
+          throttle.success(req, data.username);
+          var session = createMultiUserSession(user.id, null, null, false, req);
           var loginResp = { ok: true, user: { id: user.id, username: user.username, role: user.role } };
           if (user.mustChangePin) loginResp.mustChangePin = true;
           res.writeHead(200, {
-            "Set-Cookie": session.cookie,
+            "Set-Cookie": session.cookies,
             "Content-Type": "application/json",
           });
           res.end(JSON.stringify(loginResp));
@@ -528,6 +533,7 @@ function attachAuth(ctx) {
             res.end('{"ok":true}');
             return;
           }
+          if (!allowAttempt(req, res, 'email:' + String(data.email).toLowerCase())) return;
           var result = smtp.requestOtp(data.email);
           if (result.error) {
             res.writeHead(429, { "Content-Type": "application/json" });
@@ -573,6 +579,7 @@ function attachAuth(ctx) {
             res.end('{"error":"Email and code are required"}');
             return;
           }
+          if (!allowAttempt(req, res, 'email:' + String(data.email).toLowerCase())) return;
           var otpResult = smtp.verifyOtp(data.email, data.code);
           if (!otpResult.valid) {
             recordPinFailure(ip);
@@ -587,9 +594,9 @@ function attachAuth(ctx) {
             return;
           }
           clearPinFailures(ip);
-          var session = createMultiUserSession(user.id);
+          var session = createMultiUserSession(user.id, null, null, false, req);
           res.writeHead(200, {
-            "Set-Cookie": session.cookie,
+            "Set-Cookie": session.cookies,
             "Content-Type": "application/json",
           });
           res.end(JSON.stringify({ ok: true, user: { id: user.id, username: user.username, role: user.role } }));
@@ -625,7 +632,7 @@ function attachAuth(ctx) {
             return;
           }
           var result;
-          if (smtp.isEmailLoginEnabled() && !data.pin) {
+          if (smtp.isEmailLoginEnabled() && !data.pin && !accountPasswords.policy.enabled()) {
             // SMTP mode: username + email required, no PIN
             if (!data.email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(data.email)) {
               res.writeHead(400, { "Content-Type": "application/json" });
@@ -667,9 +674,9 @@ function attachAuth(ctx) {
             }
           }
           users.markInviteUsed(data.inviteCode);
-          var session = createMultiUserSession(result.user.id);
+          var session = createMultiUserSession(result.user.id, null, null, false, req);
           res.writeHead(200, {
-            "Set-Cookie": session.cookie,
+            "Set-Cookie": session.cookies,
             "Content-Type": "application/json",
           });
           res.end(JSON.stringify({ ok: true, user: { id: result.user.id, username: result.user.username, role: result.user.role } }));
@@ -686,17 +693,16 @@ function attachAuth(ctx) {
       if (users.isMultiUser()) {
         var cookies = parseCookies(req);
         var token = cookies[MULTI_USER_COOKIE];
-        if (token && multiUserTokens[token]) {
-          delete multiUserTokens[token];
-          saveTokens();
+        try { sessionStore.revokeToken(token); } catch (error) {
+          res.writeHead(503, { 'Content-Type': 'application/json' }); res.end('{"error":"Could not persist sign-out. Please retry."}'); return true;
         }
         res.writeHead(200, {
-          "Set-Cookie": MULTI_USER_COOKIE + "=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0" + (tlsOptions ? "; Secure" : ""),
+          "Set-Cookie": MULTI_USER_COOKIE + "=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0" + (tlsOptions || transport.info(req).secure ? "; Secure" : ""),
           "Content-Type": "application/json",
         });
       } else {
         res.writeHead(200, {
-          "Set-Cookie": "relay_auth=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0" + (tlsOptions ? "; Secure" : ""),
+          "Set-Cookie": "relay_auth=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0" + (tlsOptions || transport.info(req).secure ? "; Secure" : ""),
           "Content-Type": "application/json",
         });
       }
@@ -722,14 +728,36 @@ function attachAuth(ctx) {
         return true;
       }
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      res.end(smtp.isEmailLoginEnabled() ? pages.smtpInvitePageHtml(inviteCode) : pages.invitePageHtml(inviteCode));
+      res.end(smtp.isEmailLoginEnabled() && !accountPasswords.policy.enabled() ? pages.smtpInvitePageHtml(inviteCode) : pages.invitePageHtml(inviteCode));
       return true;
     }
 
     return false;
   }
 
+  var accountPasswords = require('./server-account-passwords').attachAccountPasswords({
+    users: users, devMode: _isDevMode, tlsOptions: tlsOptions, parseCookies: parseCookies,
+    getUser: getMultiUserFromReq, createSession: createMultiUserSession, revokeSessions: revokeUserTokens,
+    onPolicyChanged: ctx.onAccountPolicyChanged, throttle: throttle, transport: transport,
+  });
+  var accountPasskeys = require('./server-account-passkeys').attachAccountPasskeys({
+    users: users, devMode: _isDevMode, parseCookies: parseCookies, http: accountPasswords.http,
+    getUser: getMultiUserFromReq, createSession: createMultiUserSession,
+    sessionToken: sessionToken, clientAddress: transport.clientAddress,
+  });
+
+  var rememberedAccounts = require('./account-remembered').attachRemembered({
+    users: users, devMode: _isDevMode, parseCookies: parseCookies, transport: transport,
+    file: path.join(CONFIG_DIR, _isDevMode ? 'remembered-accounts-dev.json' : 'remembered-accounts.json'), read: accountPasswords.http.read,
+  });
+
+  var accountSecurity = require('./server-account-security').attachAccountSecurity({
+    users: users, getUser: getMultiUserFromReq, sessionToken: sessionToken, sessions: sessionStore,
+    validSessionUser: validSessionUser, http: accountPasswords.http, transport: transport,
+  });
+
   return {
+    touchSession: touchSession,
     handleRequest: handleRequest,
     getMultiUserFromReq: getMultiUserFromReq,
     isRequestAuthed: isRequestAuthed,

package/lib/server-settings.js

@@ -56,6 +56,7 @@ function attachSettings(ctx) {
         profile.userId = mu.id;
         profile.role = mu.role;
         profile.pinEnabled = !!mu.pinHash;
+        profile.passwordEnabled = !!mu.passwordHash;
         profile.autoContinueOnRateLimit = !!mu.autoContinueOnRateLimit;
         profile.chatLayout = mu.chatLayout || "channel";
         profile.projectMateFilterMode = users.getProjectMateFilterMode(mu.id);
@@ -395,7 +396,7 @@ function attachSettings(ctx) {
               res.end('{"error":"Current PIN is required"}');
               return;
             }
-            if (mu.pinHash !== users.hashPin(data.currentPin)) {
+            if (!users.verifyPin(data.currentPin, mu.pinHash, mu)) {
               res.writeHead(400, { "Content-Type": "application/json" });
               res.end('{"error":"Current PIN is incorrect"}');
               return;

package/lib/server.js

@@ -1182,6 +1182,7 @@ function createServer(opts) {
       }
       var globalUser = users.isMultiUser() ? getMultiUserFromReq(req) : null;
       wss.handleUpgrade(req, socket, head, function (ws) {
+        if (!require('./account-auth-socket').guardSocket(ws, req, isRequestAuthed, auth.touchSession)) return;
         ws._clayPane = wsRequest.pane;
         ws._clayPaneSession = wsRequest.paneSession;
         globalWs.handleConnection(ws, globalUser);
@@ -1223,6 +1224,7 @@ function createServer(opts) {
     }
 
     wss.handleUpgrade(req, socket, head, function (ws) {
+      if (!require('./account-auth-socket').guardSocket(ws, req, isRequestAuthed, auth.touchSession)) return;
       // Apply rate limiting to WS messages
       applyWsRateLimit(ws, WS_RATE_LIMIT);
       ws._clayUser = wsUser; // attach user context

package/lib/user-knowledge-service.js

@@ -22,6 +22,7 @@ function attachUserKnowledgeService(deps) {
       if (record.seen) result.seen[record.seen.ref] = Math.max(result.seen[record.seen.ref] || 0, record.seen.revision);
       if (record.entry) result.entries[record.entry.ref] = record.entry;
       if (record.report) result.reports[record.report.ref] = record.report;
+      (Array.isArray(record.reports) ? record.reports : []).forEach(function (report) { result.reports[report.ref] = report; });
       if (record.activity) result.activity.push(record.activity);
     });
     return result;
@@ -73,6 +74,26 @@ function attachUserKnowledgeService(deps) {
     });
     return Object.assign({}, entry, { comments: comments, commentCount: comments.length });
   }
+  function remove(id,args) {
+    var state = snapshot(id);
+    var previous = state.entries[args.ref];
+    if (!previous || previous.archived || previous.deleted) throw new Error('User knowledge not found.');
+    if (!Number.isInteger(args.expectedRevision) || args.expectedRevision !== previous.revisions) throw new Error('Knowledge changed. Read it again before deleting.');
+    var now = Date.now();
+    var entry = Object.assign({}, previous, { archived: true, deleted: true, deletedAt: now, updatedAt: now,
+      revisions: previous.revisions + 1, updatedBy: { type: 'user', displayName: 'You' }, reason: 'Deleted by the account owner.' });
+    var reports = Object.values(state.reports).filter(function (report) {
+      return report.status === 'pending' && (report.entryRef === previous.ref || report.commentEntryRef === previous.ref);
+    });
+    var reportUpdates = reports.map(function (report) { return Object.assign({}, report, {
+      status: 'declined', reviewedAt: now, reason: 'The knowledge entry was deleted by the account owner.'
+    }); });
+    var activity = { id: crypto.randomBytes(12).toString('hex'), ref: previous.ref, title: previous.title,
+      summary: previous.summary, at: now, action: 'delete', revision: entry.revisions, deleted: true };
+    storage(id).append({ kind: 'user-knowledge', entry: entry, reports: reportUpdates, activity: activity });
+    try { deps.onChange(owner(id), activity); } catch (error) { /* The deletion survives notification failures. */ }
+    return { entry: entry, activity: activity };
+  }
   function comment(id,args,source) {
     var entry = read(id,args.ref);
     return report(id,{observation:args.body,evidence:'Comment on '+entry.ref+': '+args.body,evidenceType:'explicit'},source,entry.ref);
@@ -141,6 +162,7 @@ function attachUserKnowledgeService(deps) {
         var reason=text(args.reason,2000,true);
         var previous=args.ref ? state.entries[args.ref]:null;
         if (args.ref && !previous) throw new Error('User knowledge not found.');
+        if (previous && (previous.archived || previous.deleted)) throw new Error('User knowledge not found.');
         if (previous && args.expectedRevision!==previous.revisions) throw new Error('Knowledge changed. Read it again before updating.');
         var entry=null;
         var now=Date.now();
@@ -162,6 +184,6 @@ function attachUserKnowledgeService(deps) {
       }
     };
   }
-  return {bind:bind,list:list,read:read,report:report,comment:comment,attention:attention,acknowledge:acknowledge,activity:function(id,args){return page(snapshot(id).activity.slice().reverse(),args);},pendingCount:function(id){return Object.values(snapshot(id).reports).filter(function(r){return r.status==='pending';}).length;}};
+  return {bind:bind,list:list,read:read,remove:remove,report:report,comment:comment,attention:attention,acknowledge:acknowledge,activity:function(id,args){return page(snapshot(id).activity.slice().reverse(),args);},pendingCount:function(id){return Object.values(snapshot(id).reports).filter(function(r){return r.status==='pending';}).length;}};
 }
 module.exports={attachUserKnowledgeService:attachUserKnowledgeService};

package/lib/users-auth.js

@@ -1,4 +1,5 @@
 var crypto = require("crypto");
+var serverPin = require('./users-server-pin');
 
 function attachAuth(deps) {
   var loadUsers = deps.loadUsers;
@@ -80,7 +81,29 @@ function attachAuth(deps) {
   // --- Pin hashing ---
 
   function hashPin(pin) {
-    return crypto.createHash("sha256").update("clay-user:" + pin).digest("hex");
+    var salt = crypto.randomBytes(16).toString("hex");
+    var hash = crypto.scryptSync("clay-user:" + pin, salt, 64, { N: 16384, r: 8, p: 1 }).toString("hex");
+    return "scrypt-v1:" + salt + ":" + hash;
+  }
+
+  function verifyPin(pin, storedHash, user) {
+    // Older JSON clients could submit a numeric PIN; preserve that spelling.
+    if (typeof pin === "number" && Number.isSafeInteger(pin) && pin >= 0) pin = String(pin);
+    if (typeof pin !== "string" || typeof storedHash !== "string") return false;
+    var migratedHash = serverPin.resolve(storedHash, user, deps.loadConfig);
+    if (migratedHash) return serverPin.verify(pin, migratedHash);
+    var expected;
+    var actual;
+    if (/^[a-f0-9]{64}$/.test(storedHash)) {
+      expected = Buffer.from(storedHash, "hex");
+      actual = crypto.createHash("sha256").update("clay-user:" + pin).digest();
+    } else {
+      var parts = /^scrypt-v1:([a-f0-9]{32}):([a-f0-9]{128})$/.exec(storedHash);
+      if (!parts) return false;
+      expected = Buffer.from(parts[2], "hex");
+      actual = crypto.scryptSync("clay-user:" + pin, parts[1], 64, { N: 16384, r: 8, p: 1 });
+    }
+    return crypto.timingSafeEqual(actual, expected);
   }
 
   // Generate a random 6-digit PIN
@@ -96,6 +119,7 @@ function attachAuth(deps) {
   // --- Authentication ---
 
   function authenticateUser(username, pin) {
+    if (typeof username !== "string") return null;
     var data = loadUsers();
     var user = null;
     for (var i = 0; i < data.users.length; i++) {
@@ -105,8 +129,18 @@ function attachAuth(deps) {
       }
     }
     if (!user) return null;
-    var pinH = hashPin(pin);
-    if (user.pinHash !== pinH) return null;
+    if (!verifyPin(pin, user.pinHash, user)) return null;
+    if (user.pinHash.indexOf('scrypt-v1:') !== 0) {
+      var previousHash = user.pinHash;
+      try {
+        user.pinHash = hashPin(pin);
+        saveUsers(data);
+      } catch (e) {
+        // A best-effort upgrade must never reject a verified existing PIN.
+        user.pinHash = previousHash;
+        console.error("[users] PIN hash upgrade could not be saved; it will be retried on login.");
+      }
+    }
     return user;
   }
 
@@ -136,6 +170,7 @@ function attachAuth(deps) {
     clearSetupCode: clearSetupCode,
     validateSetupCode: validateSetupCode,
     hashPin: hashPin,
+    verifyPin: verifyPin,
     generatePin: generatePin,
     authenticateUser: authenticateUser,
     generateUserAuthToken: generateUserAuthToken,

package/lib/users-create.js

@@ -0,0 +1,97 @@
+var crypto = require("crypto");
+var serverPin = require("./users-server-pin");
+
+function attachCreation(deps) {
+  var loadUsers = deps.loadUsers;
+  var saveUsers = deps.saveUsers;
+  var generateUserId = deps.generateUserId;
+  var ensureUserBuiltinMates = deps.ensureUserBuiltinMates;
+  var auth = deps.auth;
+
+  function createUser(opts) {
+    var data = loadUsers();
+    // Check username uniqueness
+    for (var i = 0; i < data.users.length; i++) {
+      if (data.users[i].username.toLowerCase() === opts.username.toLowerCase()) {
+        return { error: "This username is already taken" };
+      }
+    }
+    // Check email uniqueness (when provided)
+    if (opts.email) {
+      for (var i = 0; i < data.users.length; i++) {
+        if (data.users[i].email && data.users[i].email.toLowerCase() === opts.email.toLowerCase()) {
+          return { error: "This email is already registered" };
+        }
+      }
+    }
+    var user = {
+      id: generateUserId(),
+      username: opts.username,
+      email: opts.email || null,
+      displayName: opts.displayName || opts.username,
+      pinHash: auth.hashPin(opts.pin),
+      role: opts.role || "user",
+      mustChangePin: !!opts.mustChangePin,
+      createdAt: Date.now(),
+      linuxUser: opts.linuxUser || null,
+      profile: opts.profile || {
+        name: opts.displayName || opts.username,
+        lang: "en-US",
+        avatarColor: "#5857fc",
+        avatarStyle: "imprint",
+        avatarSeed: crypto.randomBytes(4).toString("hex"),
+      },
+    };
+    data.users.push(user);
+    saveUsers(data);
+
+    // Seed immediately for ordinary multi-user storage. OS-user provisioning
+    // calls this again after the Linux mapping exists, targeting its final home.
+    ensureUserBuiltinMates(user.id);
+
+    return { ok: true, user: user };
+  }
+
+  function createUserWithoutPin(opts, migration) {
+    var data = loadUsers();
+    for (var i = 0; i < data.users.length; i++) {
+      if (data.users[i].username.toLowerCase() === opts.username.toLowerCase()) {
+        return { error: "This username is already taken" };
+      }
+    }
+    if (opts.email) {
+      for (var i = 0; i < data.users.length; i++) {
+        if (data.users[i].email && data.users[i].email.toLowerCase() === opts.email.toLowerCase()) {
+          return { error: "This email is already registered" };
+        }
+      }
+    }
+    var user = {
+      id: generateUserId(),
+      username: opts.username,
+      email: opts.email || null,
+      displayName: opts.displayName || opts.username,
+      pinHash: migration && migration.pinHash ? serverPin.tag(migration.pinHash) : null,
+      role: opts.role || "user",
+      createdAt: Date.now(),
+      profile: opts.profile || {
+        name: opts.displayName || opts.username,
+        lang: "en-US",
+        avatarColor: "#5857fc",
+        avatarStyle: "imprint",
+        avatarSeed: crypto.randomBytes(4).toString("hex"),
+      },
+    };
+    data.users.push(user);
+    if (migration) { data.multiUser = true; data.setupCode = null; }
+    saveUsers(data);
+
+    ensureUserBuiltinMates(user.id);
+
+    return { ok: true, user: user };
+  }
+
+  return { createUser: createUser, createUserWithoutPin: createUserWithoutPin };
+}
+
+module.exports = { attachCreation: attachCreation };

package/lib/users-server-pin.js

@@ -0,0 +1,37 @@
+var crypto = require('crypto');
+var PREFIX = 'server-pin-v1:';
+
+function isServerHash(hash) {
+  return typeof hash === 'string' && (/^[a-f0-9]{64}$/.test(hash) || /^[a-f0-9]{32}:[a-f0-9]{128}$/.test(hash));
+}
+
+function tag(hash) {
+  if (!isServerHash(hash)) throw new Error('Invalid legacy server PIN hash');
+  return PREFIX + hash;
+}
+
+function resolve(hash, user, loadConfig) {
+  if (typeof hash !== 'string') return null;
+  if (hash.indexOf(PREFIX) === 0) {
+    var original = hash.slice(PREFIX.length);
+    return isServerHash(original) ? original : null;
+  }
+  if (!user || !isServerHash(hash) || typeof loadConfig !== 'function') return null;
+  // Only the recorded migrated owner may use an untagged server credential.
+  var config;
+  try { config = loadConfig(); } catch (e) { return null; }
+  if (config && config.singleUserMigratedAt && config.singleUserMigratedUserId === user.id && config.pinHash === hash) return hash;
+  return null;
+}
+
+function verify(pin, hash) {
+  if (!isServerHash(hash)) return false;
+  var parts = hash.split(':');
+  var expected = Buffer.from(parts.length === 2 ? parts[1] : hash, 'hex');
+  var actual = parts.length === 2
+    ? crypto.scryptSync('clay:' + pin, parts[0], 64)
+    : crypto.createHash('sha256').update('clay:' + pin).digest();
+  return crypto.timingSafeEqual(actual, expected);
+}
+
+module.exports = { tag: tag, resolve: resolve, verify: verify };