clay-server 5.1.0 → 5.2.0-beta.1

package/lib/users.js

@@ -71,50 +71,6 @@ function ensureUserBuiltinMates(userId) {
   }
 }
 
-function createUser(opts) {
-  var data = loadUsers();
-  // Check username uniqueness
-  for (var i = 0; i < data.users.length; i++) {
-    if (data.users[i].username.toLowerCase() === opts.username.toLowerCase()) {
-      return { error: "This username is already taken" };
-    }
-  }
-  // Check email uniqueness (when provided)
-  if (opts.email) {
-    for (var i = 0; i < data.users.length; i++) {
-      if (data.users[i].email && data.users[i].email.toLowerCase() === opts.email.toLowerCase()) {
-        return { error: "This email is already registered" };
-      }
-    }
-  }
-  var user = {
-    id: generateUserId(),
-    username: opts.username,
-    email: opts.email || null,
-    displayName: opts.displayName || opts.username,
-    pinHash: auth.hashPin(opts.pin),
-    role: opts.role || "user",
-    mustChangePin: !!opts.mustChangePin,
-    createdAt: Date.now(),
-    linuxUser: opts.linuxUser || null,
-    profile: opts.profile || {
-      name: opts.displayName || opts.username,
-      lang: "en-US",
-      avatarColor: "#5857fc",
-      avatarStyle: "imprint",
-      avatarSeed: crypto.randomBytes(4).toString("hex"),
-    },
-  };
-  data.users.push(user);
-  saveUsers(data);
-
-  // Seed immediately for ordinary multi-user storage. OS-user provisioning
-  // calls this again after the Linux mapping exists, targeting its final home.
-  ensureUserBuiltinMates(user.id);
-
-  return { ok: true, user: user };
-}
-
 function createAdmin(opts) {
   return createUser({
     username: opts.username,
@@ -188,7 +144,7 @@ function getSoloNoPinUser() {
   var data = loadUsers();
   if (!data.users || data.users.length !== 1) return null;
   var u = data.users[0];
-  if (u.pinHash) return null;
+  if (u.pinHash || u.passwordHash || data.accountAuthMethod === 'password') return null;
   return u;
 }
 
@@ -224,6 +180,11 @@ function updateUserPin(userId, newPin) {
   for (var i = 0; i < data.users.length; i++) {
     if (data.users[i].id === userId) {
       data.users[i].pinHash = auth.hashPin(newPin);
+      if (data.accountAuthMethod === 'password') {
+        delete data.users[i].passwordHash;
+        delete data.users[i].passkeys;
+        delete data.users[i].passkeyUserHandle;
+      }
       data.users[i].mustChangePin = false;
       saveUsers(data);
       return { ok: true };
@@ -306,44 +267,6 @@ function createInvite(createdByUserId, targetEmail) {
   return invite;
 }
 
-function createUserWithoutPin(opts) {
-  var data = loadUsers();
-  for (var i = 0; i < data.users.length; i++) {
-    if (data.users[i].username.toLowerCase() === opts.username.toLowerCase()) {
-      return { error: "This username is already taken" };
-    }
-  }
-  if (opts.email) {
-    for (var i = 0; i < data.users.length; i++) {
-      if (data.users[i].email && data.users[i].email.toLowerCase() === opts.email.toLowerCase()) {
-        return { error: "This email is already registered" };
-      }
-    }
-  }
-  var user = {
-    id: generateUserId(),
-    username: opts.username,
-    email: opts.email || null,
-    displayName: opts.displayName || opts.username,
-    pinHash: null,
-    role: opts.role || "user",
-    createdAt: Date.now(),
-    profile: opts.profile || {
-      name: opts.displayName || opts.username,
-      lang: "en-US",
-      avatarColor: "#5857fc",
-      avatarStyle: "imprint",
-      avatarSeed: crypto.randomBytes(4).toString("hex"),
-    },
-  };
-  data.users.push(user);
-  saveUsers(data);
-
-  ensureUserBuiltinMates(user.id);
-
-  return { ok: true, user: user };
-}
-
 function findInvite(code) {
   var data = loadUsers();
   for (var i = 0; i < data.invites.length; i++) {
@@ -400,7 +323,10 @@ function removeExpiredInvites() {
 
 // --- Wire extracted modules ---
 
-var auth = attachAuth({ loadUsers: loadUsers, saveUsers: saveUsers, findAdmin: findAdmin });
+var auth = attachAuth({ loadUsers: loadUsers, saveUsers: saveUsers, findAdmin: findAdmin, loadConfig: require('./config').loadConfig });
+var creation = require("./users-create").attachCreation({ loadUsers: loadUsers, saveUsers: saveUsers, generateUserId: generateUserId, ensureUserBuiltinMates: ensureUserBuiltinMates, auth: auth });
+var createUser = creation.createUser;
+var createUserWithoutPin = creation.createUserWithoutPin;
 var permissions = attachPermissions({ loadUsers: loadUsers, saveUsers: saveUsers, findUserById: findUserById });
 var preferences = attachPreferences({ loadUsers: loadUsers, saveUsers: saveUsers });
 var projectMateFilterPreferences = attachProjectMateFilterPreferences({ loadUsers: loadUsers, saveUsers: saveUsers });
@@ -489,6 +415,7 @@ module.exports = {
   validateSetupCode: validateSetupCode,
   generateUserId: generateUserId,
   hashPin: hashPin,
+  verifyPin: auth.verifyPin,
   createUser: createUser,
   createAdmin: createAdmin,
   findAdmin: findAdmin,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "5.1.0",
+  "version": "5.2.0-beta.1",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js"
@@ -60,6 +60,7 @@
     "@modelcontextprotocol/sdk": "^1.32.1",
     "@openai/codex": "^0.162.1",
     "@seald-io/nedb": "^4.1.2",
+    "@simplewebauthn/server": "13.3.3",
     "codemirror": "^5.65.21",
     "imapflow": "^1.7.8",
     "ipaddr.js": "^2.5.0",