clay-server 5.1.1-beta.1 → 5.2.0-beta.1

package/lib/account-auth-policy.js

@@ -0,0 +1,21 @@
+function attachPolicy(users) {
+  function enabled() { return users.loadUsers().accountAuthMethod === 'password'; }
+  function available() {
+    if (!users.isMultiUser() || users.getSoloNoPinUser()) return false;
+    var data = users.loadUsers();
+    var config = require('./config').loadConfig() || {};
+    return !(data.users.length === 1 && config.pinHash && config.singleUserMigratedUserId === data.users[0].id);
+  }
+  function requiresPassword(user) { return !!user && enabled(); }
+  function activate() {
+    if (!available()) throw new Error('Account password policy does not apply to solo or Server PIN access.');
+    var data = users.loadUsers();
+    if (data.users.some(function (user) { return !user.pinHash && !user.passwordHash; })) {
+      throw new Error('Some accounts have no account PIN. Set a temporary account PIN for them before enabling passwords.');
+    }
+    data.accountAuthMethod = 'password';
+    users.saveUsers(data);
+  }
+  return { enabled: enabled, available: available, requiresPassword: requiresPassword, activate: activate };
+}
+module.exports = { attachPolicy: attachPolicy };

package/lib/account-auth-socket.js

@@ -0,0 +1,29 @@
+function guardSocket(ws, req, isAuthed, touchSession) {
+  req.claySessionPassive = true;
+  var send = ws.send;
+  var emit = ws.emit;
+  var closed = false;
+  function check() {
+    if (closed) return false;
+    if (isAuthed(req)) return true;
+    closed = true;
+    if (ws.readyState === 1) send.call(ws, JSON.stringify({ type: 'account_auth_required' }));
+    ws.close(4001, 'Account sign-in required');
+    return false;
+  }
+  ws.send = function () { if (check()) return send.apply(ws, arguments); };
+  ws.emit = function (name) {
+    if (name === 'message') {
+      if (!check()) return false;
+      var message;
+      try { message = JSON.parse(String(arguments[1])); } catch (error) { message = null; }
+      if (touchSession && message && ['ping', 'pong', 'heartbeat'].indexOf(message.type) === -1) touchSession(req);
+    }
+    return emit.apply(ws, arguments);
+  };
+  var timer = setInterval(check, 1000);
+  if (timer.unref) timer.unref();
+  ws.on('close', function () { closed = true; clearInterval(timer); });
+  return check();
+}
+module.exports = { guardSocket: guardSocket };

package/lib/account-auth-throttle.js

@@ -0,0 +1,44 @@
+var fs = require('fs');
+var path = require('path');
+var crypto = require('crypto');
+var WINDOW = 15 * 60000;
+function attachThrottle(ctx) {
+  function key(value) { return crypto.createHash('sha256').update(value).digest('hex'); }
+  function load() {
+    try {
+      var data = JSON.parse(fs.readFileSync(ctx.file, 'utf8'));
+      if (!data || typeof data !== 'object' || Array.isArray(data) || Object.values(data).some(function (entry) { return !entry || !Number.isFinite(entry.count) || !Number.isFinite(entry.until); })) throw new Error('Invalid limiter data.');
+      return data;
+    }
+    catch (error) { if (error.code === 'ENOENT') return {}; throw new Error('Sign-in protection is unavailable. Please retry later.'); }
+  }
+  function save(data) {
+    try {
+      fs.mkdirSync(path.dirname(ctx.file), { recursive: true });
+      fs.writeFileSync(ctx.file + '.tmp', JSON.stringify(data), { mode: 0o600 }); fs.renameSync(ctx.file + '.tmp', ctx.file);
+    } catch (error) { throw new Error('Could not save sign-in protection. Please retry later.'); }
+  }
+  function prune(data) { Object.keys(data).forEach(function (id) { if (data[id].until <= Date.now()) delete data[id]; }); }
+  function consumeKeys(keys) {
+    var data = load(); prune(data);
+    if (Object.keys(data).length >= 10000) throw new Error('Sign-in is busy. Please retry later.');
+    keys.forEach(function (value) {
+      var id = key(value.name); var entry = data[id] || { count: 0, until: Date.now() + WINDOW };
+      if (entry.count >= value.max) { var error = new Error('Too many attempts. Retry in 15 minutes.'); error.status = 429; throw error; }
+      entry.count++; data[id] = entry;
+    });
+    save(data);
+  }
+  function consume(req, username) {
+    var keys = [{ name: 'ip:' + ctx.clientAddress(req), max: 100 }];
+    if (username) keys.push({ name: 'account:' + String(username).toLowerCase().slice(0, 100), max: 10 });
+    consumeKeys(keys);
+  }
+  function success(req, username) {
+    // Successful logins must not erase the IP budget for attacks against other accounts.
+    if (!username) return;
+    var data = load(); delete data[key('account:' + String(username).toLowerCase().slice(0, 100))]; prune(data); save(data);
+  }
+  return { consume: consume, success: success };
+}
+module.exports = { attachThrottle: attachThrottle };

package/lib/account-auth-transport.js

@@ -0,0 +1,48 @@
+var net = require('net');
+var normalizeOrigin = require('./network-origins').normalizeAllowedOrigins;
+function address(value) {
+  var result = String(value || '').replace(/^::ffff:/, '');
+  return net.isIP(result) ? result : '';
+}
+function loopback(value) { return value === '::1' || /^127\./.test(value); }
+function attachTransport(ctx) {
+  function settings() { return ctx.users.loadUsers().accountTransport || { origin: '', trustedProxies: [] }; }
+  function info(req) {
+    var config = settings(); var peer = address(req.socket && req.socket.remoteAddress);
+    var proxy = !!peer && (config.trustedProxies || []).indexOf(peer) !== -1 && req.headers['x-forwarded-proto'] !== undefined;
+    var secure = !!(ctx.tlsOptions || req.socket && req.socket.encrypted);
+    if (proxy) secure = req.headers['x-forwarded-proto'] === 'https';
+    var origin = '';
+    try { origin = proxy ? config.origin : normalizeOrigin([(secure ? 'https://' : 'http://') + req.headers.host])[0]; } catch (error) { /* Invalid Host is not an authentication origin. */ }
+    var local = false;
+    try { var hostname = new URL(origin).hostname; local = !proxy && loopback(peer) && (hostname === 'localhost' || hostname === '[::1]' || /^127\./.test(hostname)); } catch (error) { /* Invalid origin remains denied. */ }
+    var client = peer;
+    if (proxy) {
+      // The configured immediate proxy must overwrite this single-address header.
+      client = address(req.headers['x-real-ip']) || peer;
+    }
+    return { origin: origin, secure: secure, local: local, clientAddress: client, proxy: proxy };
+  }
+  function allows(req, write) {
+    var value = info(req);
+    if (!value.origin || !value.secure && !value.local) return false;
+    if (req.headers.origin && req.headers.origin !== value.origin) return false;
+    if (!write) return true;
+    if (req.headers['sec-fetch-site'] && ['same-origin', 'none'].indexOf(req.headers['sec-fetch-site']) === -1) return false;
+    // Fetch writes send Origin; same-origin legacy clients may send Referer instead.
+    if (req.headers.origin) return req.headers.origin === value.origin;
+    if (req.headers.referer) { try { return new URL(req.headers.referer).origin === value.origin; } catch (error) { return false; } }
+    return false;
+  }
+  function save(data) {
+    var origin = data.origin ? normalizeOrigin([data.origin])[0] : '';
+    if (origin && new URL(origin).protocol !== 'https:') throw new Error('The external account address must use HTTPS.');
+    if (!Array.isArray(data.trustedProxies) || data.trustedProxies.length > 16) throw new Error('Enter up to 16 exact proxy IP addresses.');
+    var proxies = data.trustedProxies.map(function (value) { var ip = address(value); if (!ip) throw new Error('Trusted proxies must be exact IP addresses.'); return ip; });
+    if (proxies.length && !origin) throw new Error('An HTTPS address is required for a trusted proxy.');
+    var state = ctx.users.loadUsers(); state.accountTransport = { origin: origin, trustedProxies: Array.from(new Set(proxies)) }; ctx.users.saveUsers(state);
+    return state.accountTransport;
+  }
+  return { info: info, allows: allows, settings: settings, save: save, clientAddress: function (req) { return info(req).clientAddress; } };
+}
+module.exports = { attachTransport: attachTransport };

package/lib/account-login-page.js

@@ -0,0 +1,28 @@
+var fs = require('fs');
+var path = require('path');
+var assets = {
+  '/auth/account-login.js': ['public/auth/account-login.js', 'text/javascript'],
+  '/auth/account-login.css': ['public/auth/account-login.css', 'text/css'],
+  '/auth/login-symbol.png': ['public/clay-studio-symbol.png', 'image/png'],
+  '/auth/login-wordmark.svg': ['public/clay-studio-wordmark-bold.svg', 'image/svg+xml'],
+  '/auth/login-font.woff2': ['public/fonts/geist/Geist-Variable.woff2', 'font/woff2'],
+};
+function handleAsset(req, res, url) {
+  if (req.method !== 'GET' || !Object.prototype.hasOwnProperty.call(assets, url)) return false;
+  res.writeHead(200, { 'Content-Type': assets[url][1], 'Cache-Control': 'no-cache', 'X-Content-Type-Options': 'nosniff' });
+  res.end(fs.readFileSync(path.join(__dirname, assets[url][0]))); return true;
+}
+function render(options) {
+  return '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sign in · Clay</title><link rel="stylesheet" href="/auth/account-login.css"></head><body>' +
+    '<main id="login" data-stage="welcome" data-password="' + !!options.password + '" data-email="' + !!options.email + '">' +
+    '<header class="brand"><div class="brand-lockup"><img class="symbol" src="/auth/login-symbol.png" alt=""><img class="wordmark" src="/auth/login-wordmark.svg" alt="Clay Studio" width="4742" height="1156"></div></header>' +
+    '<section class="panel"><div class="panel-header"><button id="back" class="back" aria-label="Back" title="Back" hidden><svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="m12 5-7 7 7 7M5 12h14"/></svg></button><h1 id="heading" tabindex="-1">Sign in</h1></div><p id="description">Choose how to sign in.</p>' +
+    '<div id="welcome" class="view"><div id="accounts" aria-label="Remembered accounts"></div><button id="passkey" class="primary method" hidden>Continue with a passkey</button><button id="account" class="primary method">Sign in with an account</button><button id="email-method" class="quiet" hidden>Email me a sign-in code</button></div>' +
+    '<form id="identity" class="view" hidden><label for="username">Username</label><input id="username" name="username" autocomplete="username" autocapitalize="off" spellcheck="false" maxlength="100" required><button class="primary">Continue</button></form>' +
+    '<form id="credential" class="view" hidden><div class="identity-chip"><span id="selected-avatar" class="avatar"></span><div><strong id="selected-name"></strong><small id="selected-username"></small></div></div><input id="credential-username" class="offscreen" aria-label="Username" name="username" autocomplete="username" tabindex="-1"><label id="secret-label" for="secret">Password</label><div class="secret-field"><input id="secret" name="password" type="password" autocomplete="current-password" maxlength="256" required><button id="reveal" type="button" aria-pressed="false">Show</button></div><button class="primary">Sign in</button><button id="use-pin" class="quiet" type="button" hidden>I still use an account PIN</button></form>' +
+    '<form id="enroll" class="view" hidden><label for="new-password">New password</label><input id="new-password" type="password" autocomplete="new-password" maxlength="256" required><label for="confirm-password">Confirm password</label><input id="confirm-password" type="password" autocomplete="new-password" maxlength="256" required><button class="primary">Save password and continue</button></form>' +
+    '<form id="email" class="view" hidden><label for="email-address">Email address</label><input id="email-address" type="email" autocomplete="email" maxlength="100" required><button class="primary">Send sign-in code</button></form>' +
+    '<form id="code" class="view" hidden><label for="otp">Sign-in code</label><input id="otp" inputmode="numeric" pattern="[0-9]{6}" maxlength="6" autocomplete="one-time-code" required><button class="primary">Sign in</button><button id="resend" class="quiet" type="button">Send another code</button></form>' +
+    '<p id="status" role="status"></p><p id="error" role="alert"></p></section><footer><details><summary>Help signing in</summary><p>Contact your server administrator if you cannot sign in. You can forget a remembered account on this browser without deleting the account.</p></details><span id="server-address"></span></footer></main><script type="module" src="/auth/account-login.js"></script></body></html>';
+}
+module.exports = { render: render, handleAsset: handleAsset };

package/lib/account-passkey-challenges.js

@@ -0,0 +1,31 @@
+var crypto = require('crypto');
+
+function attachChallenges(ctx) {
+  var entries = new Map();
+  var name = ctx.devMode ? 'clay_passkey_dev' : 'clay_passkey';
+  function cookie(token, origin) {
+    return name + '=' + token + '; Path=/; HttpOnly; SameSite=Strict; Max-Age=' + (token ? '300' : '0') +
+      (origin.indexOf('https:') === 0 ? '; Secure' : '');
+  }
+  function clear(req) { entries.delete(ctx.parseCookies(req)[name]); }
+  function issue(req, policy, proof) {
+    var now = Date.now();
+    entries.forEach(function (entry, token) { if (entry.until <= now) entries.delete(token); });
+    clear(req);
+    if (entries.size >= 1000) throw new Error('Passkey sign-in is busy. Please retry shortly.');
+    var token = crypto.randomBytes(32).toString('hex');
+    entries.set(token, Object.assign({}, proof, policy, { until: now + 300000 }));
+    return cookie(token, policy.origin);
+  }
+  function take(req, policy, purpose) {
+    var token = ctx.parseCookies(req)[name];
+    var proof = entries.get(token);
+    entries.delete(token);
+    if (!proof || proof.until <= Date.now() || proof.purpose !== purpose || proof.origin !== policy.origin || proof.rpID !== policy.rpID) {
+      throw new Error('This passkey request expired or was already used. Please try again.');
+    }
+    return proof;
+  }
+  return { issue: issue, take: take, clear: clear, cookie: cookie };
+}
+module.exports = { attachChallenges: attachChallenges };

package/lib/account-passkey-page.js

@@ -0,0 +1,89 @@
+function client(api) {
+  var list = document.getElementById('passkeys');
+  var form = document.getElementById('passkey-form');
+  var name = document.getElementById('passkey-name');
+  var password = document.getElementById('current-password');
+  var button = document.getElementById('save');
+  var cancel = document.getElementById('cancel');
+  var status = document.getElementById('status');
+  var selected = null;
+  var action = 'register';
+  var canRegister = api.supported();
+  function reset() {
+    selected = null; action = 'register'; name.value = ''; password.value = '';
+    document.getElementById('editor-heading').textContent = 'Add a passkey';
+    document.getElementById('name-row').hidden = false;
+    name.required = true; button.textContent = 'Add passkey'; cancel.hidden = true;
+    document.getElementById('editor-hint').textContent = 'Verify your current password to add a passkey.';
+    form.hidden = !canRegister;
+  }
+  function edit(key, mode) {
+    form.hidden = false;
+    selected = key.id; action = mode; password.value = ''; name.value = key.name;
+    document.getElementById('editor-heading').textContent = (mode === 'remove' ? 'Remove ' : 'Rename ') + key.name;
+    document.getElementById('name-row').hidden = mode === 'remove'; name.required = mode !== 'remove';
+    button.textContent = mode === 'remove' ? 'Remove passkey' : 'Save name'; cancel.hidden = false;
+    document.getElementById('editor-hint').textContent = mode === 'remove' ? 'Sessions signed in with this passkey will end. Your password will still work.' : 'Verify your current password to rename this passkey.';
+    (mode === 'remove' ? password : name).focus();
+  }
+  function render(keys) {
+    list.replaceChildren();
+    if (!keys.length) { var empty = document.createElement('p'); empty.textContent = 'No passkeys registered yet.'; list.appendChild(empty); }
+    keys.forEach(function (key) {
+      var row = document.createElement('li'); var detail = document.createElement('div');
+      var title = document.createElement('strong'); title.textContent = key.name;
+      var last = document.createElement('small'); last.textContent = key.lastUsedAt ? 'Last used ' + new Date(key.lastUsedAt).toLocaleDateString() : 'Not used to sign in yet';
+      detail.append(title, last); row.appendChild(detail);
+      ['rename', 'remove'].forEach(function (mode) {
+        var control = document.createElement('button'); control.type = 'button'; control.className = 'secondary';
+        control.textContent = mode === 'rename' ? 'Rename' : 'Remove';
+        control.setAttribute('aria-label', control.textContent + ' ' + key.name);
+        control.onclick = function () { edit(key, mode); }; row.appendChild(control);
+      });
+      list.appendChild(row);
+    });
+  }
+  function busy(value) {
+    document.querySelectorAll('button, input').forEach(function (element) { element.disabled = value; });
+  }
+  cancel.onclick = function () { reset(); name.focus(); };
+  form.onsubmit = async function (event) {
+    event.preventDefault(); busy(true); status.textContent = 'Verifying…';
+    try {
+      var result;
+      if (action === 'register') {
+        result = await api.request('/api/passkeys/register/options', { name: name.value, currentPassword: password.value });
+        password.value = '';
+        status.textContent = 'Follow your device’s instructions to create a passkey.';
+        var response = await api.createPasskey(result.options);
+        result = await api.request('/api/passkeys/register/verify', { response: response });
+      } else result = await api.request('/api/passkeys/' + action, { id: selected, name: name.value, currentPassword: password.value });
+      render(result.passkeys); reset(); status.textContent = 'Passkeys updated.';
+    } catch (error) { status.textContent = api.passkeyError(error); }
+    finally { password.value = ''; busy(false); }
+  };
+  busy(true);
+  api.request('/api/passkeys').then(function (data) {
+    render(data.passkeys);
+    if (data.origin !== location.origin) {
+      status.textContent = 'Open ' + data.origin + ' to manage your passkeys.';
+      busy(true); form.hidden = true; return;
+    }
+    busy(false);
+    if (!canRegister) {
+      status.textContent = 'This browser cannot create passkeys. You can still rename or remove registered passkeys, or sign in with your password.';
+      form.hidden = true;
+    }
+  }).catch(function (error) { status.textContent = error.message; });
+}
+function render() {
+  return require('./account-password-page').shell('Passkeys',
+    '<h1>Passkeys</h1><p>Sign in using your device’s fingerprint, face recognition or screen lock. Your password remains available.</p>' +
+    '<ul id="passkeys" aria-label="Registered passkeys"></ul><form id="passkey-form"><h2 id="editor-heading">Add a passkey</h2>' +
+    '<p id="editor-hint">Verify your current password to add a passkey.</p><div id="name-row"><label for="passkey-name">Passkey name</label><input id="passkey-name" maxlength="80" placeholder="For example, personal laptop" required></div>' +
+    '<label for="current-password">Current password</label><input id="current-password" type="password" autocomplete="current-password" required>' +
+    '<div class="actions"><button id="save" type="submit">Add passkey</button><button id="cancel" type="button" class="secondary" hidden>Cancel</button></div></form>' +
+    '<p id="status" role="status" aria-live="polite"></p><a href="/">Back to Clay</a>' +
+    '<script type="module">import * as api from "/auth/passkey-browser.js";(' + client.toString() + ')(api);</script>');
+}
+module.exports = { render: render };

package/lib/account-passkey-policy.js

@@ -0,0 +1,39 @@
+var net = require('net');
+var normalizeOrigin = require('./network-origins').normalizeAllowedOrigins;
+
+function parseOrigin(value) {
+  var origin = normalizeOrigin([value])[0];
+  var url = new URL(origin);
+  if (url.protocol !== 'https:' && !(url.protocol === 'http:' && url.hostname === 'localhost')) {
+    throw new Error('Use an HTTPS address, or http://localhost for local development.');
+  }
+  if (net.isIP(url.hostname) || url.hostname[0] === '[') throw new Error('Passkeys require a hostname, not an IP address.');
+  return { origin: origin, rpID: url.hostname };
+}
+
+function configured(data) {
+  if (data.accountAuthMethod !== 'password' || !data.passkeyPolicy) return null;
+  try {
+    var policy = parseOrigin(data.passkeyPolicy.origin);
+    return policy.rpID === data.passkeyPolicy.rpID ? policy : null;
+  } catch (error) { return null; }
+}
+
+function count(data) {
+  return data.users.reduce(function (total, user) { return total + (user.passkeys || []).length; }, 0);
+}
+
+function save(users, origin) {
+  var next = parseOrigin(origin);
+  var data = users.loadUsers();
+  if (data.accountAuthMethod !== 'password') throw new Error('Enable account passwords first.');
+  var previous = configured(data);
+  if (count(data) && (!previous || previous.origin !== next.origin)) {
+    throw new Error('Remove existing passkeys before changing the sign-in address. Password sign-in remains available.');
+  }
+  data.passkeyPolicy = next;
+  users.saveUsers(data);
+  return next;
+}
+
+module.exports = { parseOrigin: parseOrigin, configured: configured, count: count, save: save };

package/lib/account-password-page.js

@@ -0,0 +1,69 @@
+function client(changing) {
+  var form = document.getElementById('account-form');
+  var username = document.getElementById('username');
+  var secret = document.getElementById('secret');
+  var confirm = document.getElementById('confirm-password');
+  var mode = document.getElementById('use-pin');
+  var button = document.getElementById('submit');
+  var error = document.getElementById('error');
+  var enrolling = false;
+  if (changing) {
+    enrolling = true;
+    document.getElementById('heading').textContent = 'Change your password';
+    document.getElementById('description').textContent = 'Use 15–128 characters. Saving signs out your other sessions.';
+    document.getElementById('username-row').hidden = true; username.required = false;
+    document.getElementById('mode-row').hidden = true;
+    document.getElementById('current-row').hidden = false;
+    document.getElementById('confirm-row').hidden = false;
+    document.getElementById('secret-label').textContent = 'New password or passphrase';
+    secret.autocomplete = 'new-password'; button.textContent = 'Save password';
+  }
+  function update() {
+    document.getElementById('secret-label').textContent = mode.checked ? 'Current account PIN' : 'Password';
+    secret.autocomplete = mode.checked ? 'off' : 'current-password';
+    secret.value = ''; error.textContent = '';
+    button.textContent = mode.checked ? 'Verify PIN' : 'Sign in';
+  }
+  mode.onchange = update;
+  form.onsubmit = async function (event) {
+    event.preventDefault(); button.disabled = true; error.textContent = '';
+    try {
+      var body = enrolling ? { password: secret.value, confirmPassword: confirm.value } : { username: username.value };
+      if (!enrolling) body[mode.checked ? 'pin' : 'password'] = secret.value;
+      if (changing) body.currentPassword = document.getElementById('current-password').value;
+      var response = await fetch(changing ? '/auth/password-change' : enrolling ? '/auth/password-transition' : '/auth/login', { method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) });
+      var data = await response.json();
+      if (!response.ok || !data.ok) throw new Error(data.error || 'Could not sign in.');
+      secret.value = '';
+      if (!data.passwordRequired) { location.href = '/'; return; }
+      enrolling = true;
+      document.getElementById('passkey-login').hidden = true;
+      document.getElementById('heading').textContent = 'Set your password';
+      document.getElementById('description').textContent = 'Use 15–128 characters. A long passphrase works well. Your account PIN is replaced only after saving.';
+      username.readOnly = true;
+      document.getElementById('mode-row').hidden = true;
+      document.getElementById('secret-label').textContent = 'New password or passphrase';
+      secret.autocomplete = 'new-password';
+      document.getElementById('confirm-row').hidden = false;
+      button.textContent = 'Save password and continue'; secret.focus();
+    } catch (failure) { error.textContent = failure.message; }
+    finally { button.disabled = false; }
+  };
+}
+function shell(title, body) {
+  return '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>' + title + ' — Clay</title>' +
+    '<style>:root{color-scheme:light dark}*{box-sizing:border-box}body{margin:0;min-height:100vh;display:grid;place-items:center;background:light-dark(#f2f2ef,#171717);color:light-dark(#171717,#eee);font:14px system-ui}main{width:min(100%,400px);padding:24px}h1{font-size:20px;margin:0 0 8px}p{font-size:13px;line-height:1.5;opacity:.75}label{display:block;font-size:13px;margin:16px 0 6px}input:not([type=checkbox]){width:100%;height:36px;border:1px solid #8886;border-radius:8px;padding:0 10px;background:light-dark(#fff,#242424);color:inherit;font:inherit}button{min-height:36px;width:100%;border:0;border-radius:8px;background:#5857fc;color:white;font:inherit;padding:8px 12px;margin-top:20px;cursor:pointer}button:disabled{opacity:.6;cursor:wait}:focus-visible{outline:2px solid #5857fc;outline-offset:3px}#error{color:light-dark(#a12c2c,#ff9292);min-height:20px;opacity:1}a{color:inherit}h2{font-size:16px;margin:24px 0 8px}ul{list-style:none;padding:0}li{display:flex;align-items:center;gap:8px;padding:12px 0;border-bottom:1px solid #8884}li div{flex:1;min-width:0;overflow-wrap:anywhere}small{display:block;opacity:.7;margin-top:4px}.secondary{background:transparent;color:inherit;border:1px solid #8886}li button{width:auto;margin:0;font-size:12px;min-height:32px;padding:4px 8px}.actions{display:flex;gap:8px}#status{overflow-wrap:anywhere}[hidden]{display:none!important}</style></head><body><main>' +
+    body + '</main></body></html>';
+}
+function render(changing) {
+  return shell('Account sign-in',
+    '<h1 id="heading">Account sign-in</h1><p id="description">This server uses account passwords. Still using an account PIN? Verify it once to set your password.</p>' +
+    '<form id="account-form"><div id="username-row"><label for="username">Username</label><input id="username" autocomplete="username" maxlength="100" required autofocus></div>' +
+    '<div id="current-row" hidden><label for="current-password">Current password</label><input id="current-password" type="password" autocomplete="current-password" maxlength="256"></div>' +
+    '<label id="mode-row"><input id="use-pin" type="checkbox"> I still use an account PIN</label>' +
+    '<label id="secret-label" for="secret">Password</label><input id="secret" type="password" autocomplete="current-password" required maxlength="256">' +
+    '<div id="confirm-row" hidden><label for="confirm-password">Confirm password</label><input id="confirm-password" type="password" autocomplete="new-password" maxlength="256"></div>' +
+    '<p id="error" role="alert"></p><button id="submit" type="submit">Sign in</button></form><button id="passkey-login" type="button" class="secondary" hidden>Sign in with a passkey</button><p>Forgot your credentials? Contact your server administrator for account recovery.</p><a href="/">Start again</a>' +
+    '<script>(' + client.toString() + ')(' + (changing ? 'true' : 'false') + ');</script><script type="module">import {initPasskeyLogin} from "/auth/passkey-browser.js";initPasskeyLogin();</script>');
+}
+module.exports = { render: render, shell: shell };

package/lib/account-passwords.js

@@ -0,0 +1,36 @@
+var crypto = require('crypto');
+var active = 0;
+var PREFIX = 'password-scrypt-v1:';
+
+function validate(password) {
+  if (typeof password !== 'string' || Array.from(password).length < 15 || Array.from(password).length > 128) {
+    throw new Error('Use 15–128 characters. Spaces and passphrases are welcome.');
+  }
+}
+
+function derive(password, salt) {
+  if (active >= 2) return Promise.reject(new Error('Sign-in is busy. Please retry shortly.'));
+  active++;
+  return new Promise(function (resolve, reject) {
+    crypto.scrypt(password, salt, 64, { N: 32768, r: 8, p: 3, maxmem: 64 * 1024 * 1024 }, function (error, key) {
+      active--;
+      if (error) reject(error); else resolve(key);
+    });
+  });
+}
+
+async function hash(password) {
+  validate(password);
+  var salt = crypto.randomBytes(16).toString('hex');
+  return PREFIX + salt + ':' + (await derive(password, salt)).toString('hex');
+}
+
+async function verify(password, stored) {
+  if (typeof password !== 'string' || password.length > 512) return false;
+  var parts = /^password-scrypt-v1:([a-f0-9]{32}):([a-f0-9]{128})$/.exec(stored || '');
+  // Unknown accounts still perform the same bounded work.
+  var key = await derive(password, parts ? parts[1] : '0'.repeat(32));
+  return !!parts && crypto.timingSafeEqual(key, Buffer.from(parts[2], 'hex'));
+}
+
+module.exports = { hash: hash, verify: verify, validate: validate };

package/lib/account-remembered.js

@@ -0,0 +1,77 @@
+var fs = require('fs');
+var path = require('path');
+var crypto = require('crypto');
+var AGE = 90 * 86400000;
+function attachRemembered(ctx) {
+  var name = ctx.devMode ? 'clay_accounts_dev' : 'clay_accounts';
+  function digest(token) { return crypto.createHash('sha256').update(token).digest('hex'); }
+  function token(req) { var value = ctx.parseCookies(req)[name]; return /^[a-f0-9]{64}$/.test(value || '') ? value : null; }
+  function load() {
+    try {
+      var data = JSON.parse(fs.readFileSync(ctx.file, 'utf8'));
+      if (!data || typeof data !== 'object' || Array.isArray(data)) throw new Error('Invalid remembered account data.');
+      Object.keys(data).forEach(function (key) {
+        var entry = data[key];
+        if (!/^[a-f0-9]{64}$/.test(key) || !entry || !Number.isFinite(entry.until) || !Array.isArray(entry.ids)) delete data[key];
+      });
+      return data;
+    }
+    catch (error) { if (error.code === 'ENOENT') return {}; throw error; }
+  }
+  function save(data) {
+    Object.keys(data).forEach(function (key) { if (!data[key] || data[key].until <= Date.now()) delete data[key]; });
+    fs.mkdirSync(path.dirname(ctx.file), { recursive: true });
+    fs.writeFileSync(ctx.file + '.tmp', JSON.stringify(data), { mode: 0o600 }); fs.renameSync(ctx.file + '.tmp', ctx.file);
+  }
+  function cookie(value, req) {
+    return name + '=' + value + '; Path=/; HttpOnly; SameSite=Strict; Max-Age=' + (value ? AGE / 1000 : 0) + (ctx.transport.info(req).secure ? '; Secure' : '');
+  }
+  function remember(userId, req) {
+    if (!req) return null;
+    // Remembering a name is optional; a storage failure must not fail a valid login.
+    try {
+      var data = load(); var previous = token(req); var old = previous && data[digest(previous)];
+      var ids = old && old.until > Date.now() && Array.isArray(old.ids) ? old.ids : [];
+      var next = crypto.randomBytes(32).toString('hex');
+      if (previous) delete data[digest(previous)];
+      data[digest(next)] = { until: Date.now() + AGE, ids: [userId].concat(ids.filter(function (id) { return id !== userId; })).slice(0, 5) };
+      var keys = Object.keys(data).sort(function (a, b) { return data[a].until - data[b].until; });
+      keys.slice(0, Math.max(0, keys.length - 10000)).forEach(function (key) { delete data[key]; });
+      save(data); return cookie(next, req);
+    } catch (error) { return null; }
+  }
+  function accounts(req) {
+    var value = token(req); var entry = value && load()[digest(value)];
+    if (!entry || entry.until <= Date.now() || !Array.isArray(entry.ids)) return [];
+    return entry.ids.map(function (id) { return ctx.users.findUserById(id); }).filter(Boolean).map(function (user) {
+      return { id: user.id, username: user.username, name: user.profile && user.profile.name || user.displayName || user.username };
+    });
+  }
+  function handleRequest(req, res, url) {
+    if (url !== '/auth/accounts') return false;
+    function reply(code, data, cookies) { var headers = { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }; if (cookies) headers['Set-Cookie'] = cookies; res.writeHead(code, headers); res.end(JSON.stringify(data)); }
+    if (!ctx.users.isMultiUser()) { reply(200, { accounts: [] }); return true; }
+    var origin = ctx.transport.info(req).origin;
+    if ((req.headers.origin && req.headers.origin !== origin) || req.headers['sec-fetch-site'] === 'cross-site') { reply(403, { error: 'Use the same Clay address.' }); return true; }
+    if (req.method === 'GET') {
+      try { reply(200, { accounts: accounts(req) }); } catch (error) { reply(503, { error: 'Remembered accounts are unavailable. You can still sign in.' }); }
+      return true;
+    }
+    if (req.method !== 'POST') { reply(405, { error: 'Method not allowed.' }); return true; }
+    if (!origin || req.headers.origin !== origin) { reply(403, { error: 'Use the same Clay address.' }); return true; }
+    ctx.read(req, res, function (body) {
+      if (typeof body.forget !== 'string' || !body.forget) { reply(400, { error: 'Choose an account to forget.' }); return; }
+      try {
+      var value = token(req); var data = load(); var key = value && digest(value); var entry = key && data[key];
+      if (entry) {
+        entry.ids = entry.ids.filter(function (id) { return id !== body.forget; });
+        if (!entry.ids.length) delete data[key];
+        save(data);
+      }
+      reply(200, { accounts: accounts(req) }, !entry || !entry.ids.length ? cookie('', req) : undefined);
+      } catch (error) { reply(503, { error: 'Could not forget this account. Please try again.' }); }
+    }); return true;
+  }
+  return { remember: remember, handleRequest: handleRequest };
+}
+module.exports = { attachRemembered: attachRemembered };

package/lib/account-session-page.js

@@ -0,0 +1,51 @@
+function client() {
+  var list = document.getElementById('sessions'); var status = document.getElementById('status');
+  var confirmation = document.getElementById('confirmation'); var target = null; var otherCount = 0;
+  async function request(data) {
+    var response = await fetch('/api/account-sessions', data ? { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(data) } : {});
+    var result = await response.json(); if (!response.ok) throw new Error(result.error || 'Could not manage sessions.'); return result;
+  }
+  function describe(value) {
+    if (!value) return 'Unknown device';
+    var browser = /Edg\//.test(value) ? 'Edge' : /Firefox\//.test(value) ? 'Firefox' : /Chrome\//.test(value) ? 'Chrome' : /Safari\//.test(value) ? 'Safari' : 'Browser';
+    var system = /Android/.test(value) ? 'Android' : /iPhone|iPad/.test(value) ? 'iOS' : /Windows/.test(value) ? 'Windows' : /Macintosh/.test(value) ? 'macOS' : /Linux/.test(value) ? 'Linux' : '';
+    return value === 'Earlier session' ? value : browser + (system ? ' on ' + system : '');
+  }
+  function choose(id) { target = id; confirmation.hidden = false; document.getElementById('confirm').focus(); }
+  function render(entries) {
+    list.replaceChildren();
+    entries.forEach(function (entry) {
+      var row = document.createElement('li'); var detail = document.createElement('div'); var title = document.createElement('strong');
+      title.textContent = describe(entry.userAgent) + (entry.current ? ' · This session' : ''); detail.appendChild(title);
+      var info = document.createElement('small');
+      info.textContent = entry.method + (entry.lastSeenAt ? ' · Last active ' + new Date(entry.lastSeenAt).toLocaleString() : ' · Previous activity unknown') + (entry.address ? ' · Last observed IP ' + entry.address : ''); detail.appendChild(info);
+      var expiry = document.createElement('small');
+      expiry.textContent = entry.expiresAt ? 'Expires ' + new Date(entry.expiresAt).toLocaleDateString() + (entry.migrated ? ' · Earlier session given a transition period' : '') : 'Compatibility session'; detail.appendChild(expiry);
+      var button = document.createElement('button'); button.className = 'secondary'; button.textContent = 'Sign out';
+      button.setAttribute('aria-label', 'Sign out ' + describe(entry.userAgent) + (entry.current ? ' current session' : ''));
+      button.onclick = function () { choose(entry.id); }; row.append(detail, button); list.appendChild(row);
+    });
+    otherCount = entries.filter(function (entry) { return !entry.current; }).length;
+    document.getElementById('others').disabled = otherCount === 0;
+  }
+  document.getElementById('others').onclick = function () { choose('others'); };
+  document.getElementById('cancel').onclick = function () { target = null; confirmation.hidden = true; document.getElementById('others').focus(); };
+  document.getElementById('confirm').onclick = async function () {
+    document.querySelectorAll('button').forEach(function (button) { button.disabled = true; });
+    status.textContent = 'Signing out…';
+    try {
+      var result = await request({ id: target });
+      if (result.signedOut) { location.href = '/'; return; }
+      confirmation.hidden = true; target = null; render(result.sessions); status.textContent = 'Selected sessions signed out.';
+    } catch (error) { status.textContent = error.message; }
+    finally { document.querySelectorAll('button').forEach(function (button) { button.disabled = false; }); document.getElementById('others').disabled = otherCount === 0; }
+  };
+  request().then(function (data) { render(data.sessions); }).catch(function (error) { status.textContent = error.message; });
+}
+function render() {
+  return require('./account-password-page').shell('Signed-in devices', '<h1>Signed-in devices</h1><p>Account sessions expire after 30 days, or after 7 days without use. Each entry is a browser session, not a verified physical device.</p>' +
+    '<ul id="sessions" aria-label="Signed-in sessions"></ul><button id="others" class="secondary" disabled>Sign out other sessions</button>' +
+    '<div id="confirmation" role="group" aria-label="Confirm sign-out" hidden><p>Sign out the selected sessions? Their open connections will close.</p><div class="actions"><button id="confirm">Sign out</button><button id="cancel" class="secondary">Cancel</button></div></div>' +
+    '<p id="status" role="status"></p><a href="/">Back to Clay</a><script>(' + client.toString() + ')();</script>');
+}
+module.exports = { render: render };