clay-server 5.1.1-beta.1 → 5.2.0-beta.10

package/lib/server-account-passkeys.js

@@ -0,0 +1,186 @@
+var crypto = require('crypto');
+var webauthn = require('@simplewebauthn/server');
+var passwords = require('./account-passwords');
+var policyStore = require('./account-passkey-policy');
+
+function attachAccountPasskeys(ctx) {
+  var users = ctx.users;
+  var http = ctx.http;
+  var challenges = require('./account-passkey-challenges').attachChallenges(ctx);
+  function policy() { return policyStore.configured(users.loadUsers()); }
+  function eligible(user) { return user && user.passwordHash && !user.mustChangePin; }
+  function current(req, original) {
+    var user = ctx.getUser(req);
+    if (!eligible(user) || original && (user.id !== original.id || user.passwordHash !== original.passwordHash)) {
+      throw new Error('Your account credentials changed. Sign in again.');
+    }
+    return user;
+  }
+  async function reauthenticate(req, data, admin) {
+    var user = current(req);
+    if (admin && user.role !== 'admin') throw new Error('Administrator access required.');
+    http.throttle(req, user.username);
+    if (!await passwords.verify(data.currentPassword, user.passwordHash)) throw new Error('Current password is incorrect.');
+    user = current(req, user);
+    if (admin && user.role !== 'admin') throw new Error('Administrator access required.');
+    http.clearAttempts(req, user.username);
+    return user;
+  }
+  function samePolicy(expected) {
+    var now = policy();
+    if (!now || now.origin !== expected.origin || now.rpID !== expected.rpID) throw new Error('Passkey settings changed. Please retry.');
+  }
+  function label(value) {
+    if (typeof value !== 'string' || !value.trim() || Array.from(value.trim()).length > 80) throw new Error('Give this passkey a name of 1–80 characters.');
+    return value.trim();
+  }
+  function responseData(data) {
+    var response = data.response;
+    if (!response || typeof response.id !== 'string' || !response.response || typeof response.response.clientDataJSON !== 'string') throw new Error('Invalid passkey response.');
+    var client = JSON.parse(Buffer.from(response.response.clientDataJSON, 'base64url').toString('utf8'));
+    if (client.crossOrigin || client.topOrigin) throw new Error('Open Clay directly to use a passkey.');
+    return response;
+  }
+  function list(user) {
+    return (user.passkeys || []).map(function (key) { return { id: key.id, name: key.name, createdAt: key.createdAt, lastUsedAt: key.lastUsedAt || null }; });
+  }
+  async function registerOptions(req, res, data, config) {
+    var user = await reauthenticate(req, data);
+    var name = label(data.name);
+    if ((user.passkeys || []).length >= 10) throw new Error('You can register up to 10 passkeys.');
+    var handle = user.passkeyUserHandle || crypto.randomBytes(32).toString('base64url');
+    var options = await webauthn.generateRegistrationOptions({
+      rpName: 'Clay', rpID: config.rpID, userID: Buffer.from(handle, 'base64url'), userName: user.username,
+      attestationType: 'none', timeout: 60000, supportedAlgorithmIDs: [-7, -257],
+      authenticatorSelection: { residentKey: 'required', userVerification: 'required' },
+      excludeCredentials: (user.passkeys || []).map(function (key) { return { id: key.id, transports: key.transports }; }),
+    });
+    current(req, user); samePolicy(config);
+    var cookie = challenges.issue(req, config, { purpose: 'register', challenge: options.challenge, userId: user.id,
+      passwordHash: user.passwordHash, session: ctx.sessionToken(req), handle: handle, name: name });
+    http.reply(res, 200, { options: options }, cookie);
+  }
+  async function registerVerify(req, res, data, config) {
+    var proof = challenges.take(req, config, 'register');
+    var user = current(req, { id: proof.userId, passwordHash: proof.passwordHash });
+    if (ctx.sessionToken(req) !== proof.session) throw new Error('Use the same signed-in session to register this passkey.');
+    var response = responseData(data);
+    var result;
+    try {
+      result = await webauthn.verifyRegistrationResponse({ response: response, expectedChallenge: proof.challenge,
+        expectedOrigin: config.origin, expectedRPID: config.rpID, requireUserVerification: true, supportedAlgorithmIDs: [-7, -257] });
+    } catch (error) { throw new Error('Could not verify this passkey. Please try registering again.'); }
+    if (!result.verified) throw new Error('Could not verify this passkey.');
+    current(req, user); samePolicy(config);
+    if (proof.until <= Date.now()) throw new Error('Registration expired. Please try again.');
+    var state = users.loadUsers();
+    user = state.users.find(function (entry) { return entry.id === user.id; });
+    var info = result.registrationInfo; var key = info.credential;
+    if (key.id !== response.id || state.users.some(function (entry) { return (entry.passkeys || []).some(function (saved) { return saved.id === key.id; }); })) {
+      throw new Error('This passkey is already registered or has an invalid identifier.');
+    }
+    if ((user.passkeys || []).length >= 10 || user.passkeyUserHandle && user.passkeyUserHandle !== proof.handle) throw new Error('Passkeys changed. Please register again.');
+    user.passkeyUserHandle = proof.handle;
+    user.passkeys = (user.passkeys || []).concat([{ id: key.id, publicKey: Buffer.from(key.publicKey).toString('base64url'),
+      counter: key.counter, transports: key.transports, name: proof.name, createdAt: new Date().toISOString(),
+      deviceType: info.credentialDeviceType, backedUp: info.credentialBackedUp }]);
+    users.saveUsers(state);
+    http.reply(res, 200, { ok: true, passkeys: list(user) }, challenges.cookie('', config.origin));
+  }
+  async function loginOptions(req, res, config) {
+    http.throttle(req, 'passkey:' + ctx.clientAddress(req));
+    var options = await webauthn.generateAuthenticationOptions({ rpID: config.rpID, userVerification: 'required', timeout: 60000 });
+    samePolicy(config);
+    http.reply(res, 200, { options: options }, challenges.issue(req, config, { purpose: 'login', challenge: options.challenge }));
+  }
+  async function loginVerify(req, res, data, config) {
+    var proof = challenges.take(req, config, 'login');
+    var response = responseData(data);
+    var state = users.loadUsers();
+    var user = state.users.find(function (entry) { return (entry.passkeys || []).some(function (key) { return key.id === response.id; }); });
+    if (!eligible(user) || response.response.userHandle !== user.passkeyUserHandle) throw new Error('Could not sign in with this passkey.');
+    var key = user.passkeys.find(function (entry) { return entry.id === response.id; });
+    var result;
+    try {
+      result = await webauthn.verifyAuthenticationResponse({ response: response, expectedChallenge: proof.challenge,
+        expectedOrigin: config.origin, expectedRPID: config.rpID, requireUserVerification: true,
+        credential: { id: key.id, publicKey: new Uint8Array(Buffer.from(key.publicKey, 'base64url')), counter: key.counter, transports: key.transports } });
+    } catch (error) { throw new Error('Could not sign in with this passkey. Try again or use your password.'); }
+    if (!result.verified || result.authenticationInfo.credentialDeviceType !== key.deviceType) throw new Error('Could not sign in with this passkey.');
+    samePolicy(config);
+    state = users.loadUsers();
+    var latest = state.users.find(function (entry) { return entry.id === user.id; });
+    var latestKey = latest && (latest.passkeys || []).find(function (entry) { return entry.id === key.id; });
+    if (!eligible(latest) || latest.passwordHash !== user.passwordHash || !latestKey || latestKey.publicKey !== key.publicKey ||
+      latestKey.counter !== key.counter || proof.until <= Date.now()) throw new Error('Account credentials changed. Please try again.');
+    latestKey.counter = result.authenticationInfo.newCounter;
+    latestKey.backedUp = result.authenticationInfo.credentialBackedUp;
+    latestKey.lastUsedAt = new Date().toISOString();
+    users.saveUsers(state);
+    var session = ctx.createSession(latest.id, latest.passwordHash, key.id, config.origin.indexOf('https:') === 0, req);
+    http.clearAttempts(req, 'passkey:' + ctx.clientAddress(req));
+    http.reply(res, 200, { ok: true }, session.cookies.concat([challenges.cookie('', config.origin)]));
+  }
+  async function manage(req, res, data, config, remove) {
+    var user = await reauthenticate(req, data);
+    samePolicy(config);
+    var state = users.loadUsers();
+    user = state.users.find(function (entry) { return entry.id === user.id; });
+    var key = (user.passkeys || []).find(function (entry) { return entry.id === data.id; });
+    if (!key) throw new Error('Passkey not found.');
+    if (remove) user.passkeys = user.passkeys.filter(function (entry) { return entry.id !== key.id; });
+    else key.name = label(data.name);
+    users.saveUsers(state);
+    // Removing a passkey also invalidates its sessions through the live session gate.
+    var cookie = remove ? ctx.createSession(user.id, user.passwordHash, null, config.origin.indexOf('https:') === 0, req).cookies : undefined;
+    http.reply(res, 200, { ok: true, passkeys: list(user) }, cookie);
+  }
+  function handleRequest(req, res, url) {
+    if (url === '/auth/passkey-browser.js' && req.method === 'GET') {
+      res.writeHead(200, { 'Content-Type': 'text/javascript; charset=utf-8', 'Cache-Control': 'no-cache' });
+      res.end(require('fs').readFileSync(require('path').join(__dirname, 'public/modules/passkey-browser.js'), 'utf8')); return true;
+    }
+    if (url === '/auth/logout' && req.method === 'POST') challenges.clear(req);
+    if (url === '/account/passkeys' && req.method === 'GET') {
+      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store', 'Content-Security-Policy': "frame-ancestors 'none'" });
+      res.end(eligible(ctx.getUser(req)) ? require('./account-passkey-page').render() : require('./account-password-page').render());
+      return true;
+    }
+    if (url === '/auth/passkeys/status' && req.method === 'GET') { http.reply(res, 200, { origin: policy() && policy().origin }); return true; }
+    if (url === '/api/passkey-policy') {
+      var admin = ctx.getUser(req);
+      if (!admin || admin.role !== 'admin') { http.reply(res, 403, { error: 'Administrator access required.' }); return true; }
+      if (req.method === 'GET') {
+        var state = users.loadUsers();
+        http.reply(res, 200, { available: state.accountAuthMethod === 'password', origin: policy() && policy().origin, locked: policyStore.count(state) > 0 }); return true;
+      }
+      if (req.method !== 'PUT') { http.reply(res, 405, { error: 'Method not allowed.' }); return true; }
+      http.read(req, res, async function (data) {
+        if (req.headers['sec-fetch-site'] === 'cross-site') throw new Error('Open Clay directly to change passkey settings.');
+        await reauthenticate(req, data, true);
+        var saved = policyStore.save(users, data.origin);
+        http.reply(res, 200, { ok: true, available: true, origin: saved.origin, locked: policyStore.count(users.loadUsers()) > 0 });
+      }); return true;
+    }
+    if (url.indexOf('/api/passkeys') !== 0 && url.indexOf('/auth/passkeys/') !== 0) return false;
+    var config = policy();
+    if (!config) { http.reply(res, 409, { error: 'Your administrator needs to configure passkeys first.' }); return true; }
+    if (url === '/api/passkeys' && req.method === 'GET') {
+      var user = ctx.getUser(req);
+      http.reply(res, eligible(user) ? 200 : 401, eligible(user) ? { origin: config.origin, passkeys: list(user) } : { error: 'Sign in to manage passkeys.' }); return true;
+    }
+    if (req.method !== 'POST') { http.reply(res, 405, { error: 'Method not allowed.' }); return true; }
+    if (req.headers.origin !== config.origin || req.headers['sec-fetch-site'] === 'cross-site') { http.reply(res, 403, { error: 'Use the configured Clay address to use passkeys.' }); return true; }
+    http.read(req, res, async function (data) {
+      if (url === '/api/passkeys/register/options') return registerOptions(req, res, data, config);
+      if (url === '/api/passkeys/register/verify') return registerVerify(req, res, data, config);
+      if (url === '/auth/passkeys/login/options') return loginOptions(req, res, config);
+      if (url === '/auth/passkeys/login/verify') return loginVerify(req, res, data, config);
+      if (url === '/api/passkeys/remove' || url === '/api/passkeys/rename') return manage(req, res, data, config, url.endsWith('/remove'));
+      http.reply(res, 404, { error: 'Passkey endpoint not found.' });
+    }, 32768);
+    return true;
+  }
+  return { handleRequest: handleRequest };
+}
+module.exports = { attachAccountPasskeys: attachAccountPasskeys };

package/lib/server-account-passwords.js

@@ -0,0 +1,127 @@
+var crypto = require('crypto');
+var passwords = require('./account-passwords');
+var attachPolicy = require('./account-auth-policy').attachPolicy;
+
+function attachAccountPasswords(ctx) {
+  var users = ctx.users;
+  var policy = attachPolicy(users);
+  var pending = new Map();
+
+  var cookieName = ctx.devMode ? 'clay_password_transition_dev' : 'clay_password_transition';
+  function reply(res, code, data, cookies) {
+    var headers = { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' };
+    if (cookies) headers['Set-Cookie'] = cookies;
+    res.writeHead(code, headers); res.end(JSON.stringify(data));
+  }
+  function transitionCookie(token, req) {
+    return cookieName + '=' + token + '; Path=/; HttpOnly; SameSite=Strict; Max-Age=' + (token ? '600' : '0') + (ctx.tlsOptions || req && ctx.transport.info(req).secure ? '; Secure' : '');
+  }
+  function read(req, res, action, maxBytes) {
+    if ((req.headers['content-type'] || '').split(';')[0] !== 'application/json') { reply(res, 415, { error: 'JSON required.' }); return; }
+    var body = ''; var oversized = false;
+    req.on('data', function (chunk) { if (oversized) return; body += chunk; if (Buffer.byteLength(body) > (maxBytes || 4096)) { oversized = true; reply(res, 413, { error: 'Request too large.' }); } });
+    req.on('end', function () {
+      if (oversized) return;
+      var data; try { data = JSON.parse(body); } catch (error) { reply(res, 400, { error: 'Invalid request.' }); return; }
+      if (!data || typeof data !== 'object' || Array.isArray(data)) { reply(res, 400, { error: 'Invalid request.' }); return; }
+      Promise.resolve().then(function () { return action(data); }).catch(function (error) { reply(res, error.status || 400, { error: error.message || 'Could not complete sign-in.' }); });
+    });
+  }
+  function throttle(req, username) { ctx.throttle.consume(req, username); }
+  function clearAttempts(req, username) { ctx.throttle.success(req, username); }
+  function grant(user, res, req) {
+    var session = ctx.createSession(user.id, user.passwordHash, null, ctx.transport.info(req).secure, req);
+    reply(res, 200, { ok: true }, session.cookies.concat([transitionCookie('', req)]));
+  }
+  function startTransition(user, res, req) {
+    var now = Date.now();
+    pending.forEach(function (entry, key) { if (entry.until <= now) pending.delete(key); });
+    if (pending.size >= 1000) throw new Error('Sign-in is busy. Please retry shortly.');
+    var token = crypto.randomBytes(32).toString('hex');
+    pending.set(token, { userId: user.id, pinHash: user.pinHash, until: now + 600000, busy: false });
+    reply(res, 200, { ok: true, passwordRequired: true }, transitionCookie(token, req));
+  }
+  function handleRequest(req, res, url) {
+    if (req.method === 'POST' && url === '/auth/logout') pending.delete(ctx.parseCookies(req)[cookieName]);
+    if (url === '/api/account-auth-policy') {
+      var admin = ctx.getUser(req);
+      if (!admin || admin.role !== 'admin') { reply(res, 403, { error: 'Administrator access required.' }); return true; }
+      if (req.method === 'GET') { reply(res, 200, { method: policy.enabled() ? 'password' : 'pin', available: policy.available() }); return true; }
+      if (req.method !== 'PUT') { reply(res, 405, { error: 'Method not allowed.' }); return true; }
+      read(req, res, function (data) {
+        if (data.method !== 'password') throw new Error('Only the password transition is supported.');
+        policy.activate();
+        reply(res, 200, { ok: true, method: 'password' });
+        if (ctx.onPolicyChanged) ctx.onPolicyChanged();
+      });
+      return true;
+    }
+    if (!policy.enabled()) return false;
+    if (req.method === 'GET' && url === '/account/password') {
+      var signedIn = ctx.getUser(req);
+      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' });
+      res.end(signedIn ? require('./account-password-page').render(true) : require('./account-login-page').render({ password: true }));
+      return true;
+    }
+    if (req.method === 'POST' && url === '/auth/password-change') {
+      read(req, res, async function (data) {
+        var user = ctx.getUser(req);
+        if (!user) throw new Error('Sign in again to change your password.');
+        throttle(req, user.username);
+        if (!await passwords.verify(data.currentPassword, user.passwordHash)) throw new Error('Current password is incorrect.');
+        if (data.password !== data.confirmPassword) throw new Error('Passwords do not match.');
+        var hash = await passwords.hash(data.password);
+        var state = users.loadUsers();
+        var current = state.users.find(function (entry) { return entry.id === user.id; });
+        if (!current || current.passwordHash !== user.passwordHash || current.mustChangePin) throw new Error('Credentials changed. Sign in again.');
+        current.passwordHash = hash; users.saveUsers(state);
+        ctx.revokeSessions(user.id); clearAttempts(req, user.username); grant(current, res, req);
+      });
+      return true;
+    }
+    if (url === '/api/user/pin') {
+      reply(res, 409, { error: 'This server uses account passwords. Contact an administrator for credential recovery.' });
+      return true;
+    }
+    if (req.method === 'POST' && url === '/auth/login') {
+      read(req, res, async function (data) {
+        throttle(req, data.username);
+        var user = typeof data.username === 'string' ? users.findUserByUsername(data.username) : null;
+        if (data.pin !== undefined) {
+          if (!user || user.passwordHash && !user.mustChangePin || typeof data.pin !== 'string' || !/^\d{6}$/.test(data.pin) || !users.verifyPin(data.pin, user.pinHash, user)) throw new Error('Invalid username or account PIN.');
+          clearAttempts(req, user.username); startTransition(user, res, req); return;
+        }
+        var originalHash = user && user.passwordHash;
+        if (!await passwords.verify(data.password, originalHash)) throw new Error('Invalid username or password.');
+        user = users.findUserById(user.id);
+        if (!user || user.passwordHash !== originalHash || user.mustChangePin) throw new Error('Account credentials changed. Please sign in again.');
+        clearAttempts(req, user.username); grant(user, res, req);
+      });
+      return true;
+    }
+    if (req.method === 'POST' && url === '/auth/password-transition') {
+      read(req, res, async function (data) {
+        var token = ctx.parseCookies(req)[cookieName];
+        var proof = pending.get(token);
+        if (!proof || proof.until <= Date.now() || proof.busy) throw new Error('Verify your account PIN again.');
+        proof.busy = true;
+        try {
+          if (data.password !== data.confirmPassword) throw new Error('Passwords do not match.');
+          var hash = await passwords.hash(data.password);
+          var state = users.loadUsers();
+          var user = state.users.find(function (entry) { return entry.id === proof.userId; });
+          if (!user || user.pinHash !== proof.pinHash || user.passwordHash && !user.mustChangePin || proof.until <= Date.now()) throw new Error('Account credentials changed. Verify your PIN again.');
+          user.passwordHash = hash; user.pinHash = null; user.mustChangePin = false;
+          users.saveUsers(state);
+          pending.delete(token);
+          ctx.revokeSessions(user.id);
+          grant(user, res, req);
+        } finally { proof.busy = false; }
+      });
+      return true;
+    }
+    return false;
+  }
+  return { handleRequest: handleRequest, policy: policy, http: { read: read, reply: reply, throttle: throttle, clearAttempts: clearAttempts } };
+}
+module.exports = { attachAccountPasswords: attachAccountPasswords };

package/lib/server-account-security.js

@@ -0,0 +1,53 @@
+var passwords = require('./account-passwords');
+function attachAccountSecurity(ctx) {
+  function sessionList(req, user) {
+    var current = ctx.sessions.get(ctx.sessionToken(req), false);
+    return ctx.sessions.list(user.id).filter(function (entry) { return !!ctx.validSessionUser(entry); }).map(function (entry) {
+      return { id: entry.id, current: !!current && entry.id === current.id, userAgent: entry.userAgent || '',
+        address: entry.address, createdAt: entry.migrated ? null : entry.createdAt,
+        lastSeenAt: entry.migrated ? entry.observedAt || null : entry.lastSeenAt,
+        unknownDevice: !!entry.migrated && !entry.observedAt,
+        expiresAt: entry.expiresAt, method: entry.passkeyId ? 'Passkey' : entry.credentialVersion ? 'Password' : 'Account sign-in', migrated: !!entry.migrated };
+    }).sort(function (a, b) { return Number(b.current) - Number(a.current) || (b.lastSeenAt || 0) - (a.lastSeenAt || 0); });
+  }
+  async function verify(req, data, original) {
+    ctx.http.throttle(req, original.username);
+    if (!original.passwordHash || !await passwords.verify(data.currentPassword, original.passwordHash)) throw new Error('Current password is incorrect.');
+    var current = ctx.getUser(req);
+    if (!current || current.id !== original.id || current.passwordHash !== original.passwordHash) throw new Error('Sign in again to continue.');
+    ctx.http.clearAttempts(req, current.username); return current;
+  }
+  function handleRequest(req, res, url) {
+    if (url !== '/api/account-sessions' && url !== '/api/account-transport' && url !== '/account/sessions') return false;
+    var user = ctx.getUser(req);
+    if (!user) { ctx.http.reply(res, 401, { error: 'Sign in again to manage your account.' }); return true; }
+    if (url === '/account/sessions' && req.method === 'GET') {
+      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store', 'Content-Security-Policy': "frame-ancestors 'none'" });
+      res.end(require('./account-session-page').render()); return true;
+    }
+    if (url === '/api/account-transport') {
+      if (user.role !== 'admin') { ctx.http.reply(res, 403, { error: 'Administrator access required.' }); return true; }
+      if (req.method === 'GET') { ctx.http.reply(res, 200, ctx.transport.settings()); return true; }
+      if (req.method !== 'PUT') { ctx.http.reply(res, 405, { error: 'Method not allowed.' }); return true; }
+      ctx.http.read(req, res, async function (data) {
+        var admin = await verify(req, data, user);
+        if (admin.role !== 'admin') throw new Error('Administrator access required.');
+        var saved = ctx.transport.save(data); ctx.http.reply(res, 200, Object.assign({ ok: true }, saved));
+      }); return true;
+    }
+    if (req.method === 'GET') { ctx.http.reply(res, 200, { sessions: sessionList(req, user), maximumDays: 30, idleDays: 7 }); return true; }
+    if (req.method !== 'POST') { ctx.http.reply(res, 405, { error: 'Method not allowed.' }); return true; }
+    ctx.http.read(req, res, function (data) {
+      var active = ctx.getUser(req);
+      if (!active || active.id !== user.id) throw new Error('Sign in again to manage sessions.');
+      var current = ctx.sessions.get(ctx.sessionToken(req), false);
+      if (!current || typeof data.id !== 'string') throw new Error('Invalid session.');
+      if (data.id !== 'others' && !ctx.sessions.list(user.id).some(function (entry) { return entry.id === data.id; })) throw new Error('Session not found.');
+      ctx.sessions.revoke(user.id, data.id, current.id);
+      ctx.http.reply(res, 200, { ok: true, signedOut: data.id === current.id, sessions: sessionList(req, user) });
+    });
+    return true;
+  }
+  return { handleRequest: handleRequest };
+}
+module.exports = { attachAccountSecurity: attachAccountSecurity };

package/lib/server-admin.js

@@ -18,6 +18,13 @@ function attachAdmin(ctx) {
   var onGetProjectAccess = ctx.onGetProjectAccess;
   var onProjectOwnerChanged = ctx.onProjectOwnerChanged;
 
+  function verifyCurrentOwner(req, route) {
+    if (!route || req.method === "GET" || !users.isMultiUser()) return;
+    var actor = getMultiUserFromReq(req);
+    var access = onGetProjectAccess && onGetProjectAccess(route[1]);
+    if (!actor || !access || access.ownerId !== actor.id || !users.findUserById(access.ownerId)) throw new Error("Project owner access required");
+  }
+
   function handleRequest(req, res, fullUrl) {
     var mateAccessRoute = /^\/api\/admin\/projects\/([^/]+)\/(visibility|owner|users|access)$/.exec(fullUrl);
     if (mateAccessRoute) {
@@ -31,6 +38,25 @@ function attachAdmin(ctx) {
     }
 
 
+    // Project content authority belongs to the valid owner, never the role.
+    if (mateAccessRoute && users.isMultiUser()) {
+      var actor = getMultiUserFromReq(req);
+      var governing = onGetProjectAccess && onGetProjectAccess(mateAccessRoute[1]);
+      var validOwner = governing && governing.ownerId && users.findUserById(governing.ownerId);
+      var owns = actor && validOwner && actor.id === validOwner.id;
+      if (req.method !== "GET" && !owns) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Only the valid project owner can change access." }));
+        return true;
+      }
+      if (req.method === "GET" && !owns && actor && actor.role === "admin") {
+        var overview = require("./project-admin-overview").metadataFor(actor, target && target.getStatus(), governing, users);
+        res.writeHead(overview ? 200 : 404, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+        res.end(JSON.stringify(overview || { error: "Project not found" }));
+        return true;
+      }
+    }
+
     // --- Admin API endpoints (multi-user mode only) ---
 
     // List all users (admin only)
@@ -83,6 +109,16 @@ function attachAdmin(ctx) {
       // Look up the user before deletion to get linuxUser for deactivation
       var targetUser = users.findUserById(targetUserId);
       var targetLinuxUser = targetUser ? targetUser.linuxUser : null;
+      var owned = false;
+      projects.forEach(function (project, slug) {
+        var access = onGetProjectAccess && onGetProjectAccess(slug);
+        if (access && !access.isMate && access.ownerId === targetUserId) owned = true;
+      });
+      if (owned) {
+        res.writeHead(409, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "The owner must transfer ordinary projects before account deletion." }));
+        return true;
+      }
       var result = users.removeUser(targetUserId);
       if (result.error) {
         res.writeHead(404, { "Content-Type": "application/json" });
@@ -118,6 +154,7 @@ function attachAdmin(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
+          verifyCurrentOwner(req, mateAccessRoute);
           if (!data.username || typeof data.username !== "string" || data.username.trim().length < 1) {
             res.writeHead(400, { "Content-Type": "application/json" });
             res.end('{"error":"Username is required"}');
@@ -182,6 +219,11 @@ function attachAdmin(ctx) {
         res.end('{"error":"User not found"}');
         return true;
       }
+      if (mu.id !== targetUserId) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Use account-owner credential recovery. Administrators cannot impersonate another account." }));
+        return true;
+      }
       var newPin = users.generatePin();
       var pinResult = users.updateUserPin(targetUserId, newPin);
       if (pinResult.error) {
@@ -222,15 +264,10 @@ function attachAdmin(ctx) {
       req.on("data", function(chunk) { body += chunk; });
       req.on("end", function() {
         try {
-          var parsed = JSON.parse(body);
-          var result = users.updateLinuxUser(targetUserId, parsed.linuxUser || null);
-          if (result.error) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: result.error }));
-          } else {
-            res.writeHead(200, { "Content-Type": "application/json" });
-            res.end('{"ok":true}');
-          }
+          JSON.parse(body);
+          res.writeHead(403, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "OS identity mapping requires server-side verified provisioning." }));
+          return;
         } catch (e) {
           res.writeHead(400, { "Content-Type": "application/json" });
           res.end('{"error":"Invalid request body"}');
@@ -363,6 +400,7 @@ function attachAdmin(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
+          verifyCurrentOwner(req, mateAccessRoute);
           if (!data.email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(data.email)) {
             res.writeHead(400, { "Content-Type": "application/json" });
             res.end('{"error":"Valid email is required"}');
@@ -429,6 +467,7 @@ function attachAdmin(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
+          verifyCurrentOwner(req, mateAccessRoute);
           // Allow clearing SMTP config by sending empty fields
           if (!data.host && !data.user && !data.pass && !data.from) {
             smtp.saveSmtpConfig(null);
@@ -484,6 +523,7 @@ function attachAdmin(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
+          verifyCurrentOwner(req, mateAccessRoute);
           // Use provided config or fall back to saved
           var existingCfg = smtp.getSmtpConfig();
           var pass = data.pass;
@@ -548,6 +588,7 @@ function attachAdmin(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
+          verifyCurrentOwner(req, mateAccessRoute);
           if (data.visibility !== "public" && data.visibility !== "private") {
             res.writeHead(400, { "Content-Type": "application/json" });
             res.end('{"error":"Visibility must be public or private"}');
@@ -582,9 +623,10 @@ function attachAdmin(ctx) {
         return true;
       }
       var mu = getMultiUserFromReq(req);
-      if (!mu || mu.role !== "admin") {
+      var ownerAccess = onGetProjectAccess && onGetProjectAccess(fullUrl.split("/")[4]);
+      if (!mu || !ownerAccess || mu.id !== ownerAccess.ownerId) {
         res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin access required"}');
+        res.end('{"error":"Project owner access required"}');
         return true;
       }
       var projSlug = fullUrl.split("/")[4];
@@ -598,17 +640,21 @@ function attachAdmin(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
+          verifyCurrentOwner(req, mateAccessRoute);
           var targetCtx = projects.get(projSlug);
           if (!targetCtx) {
             res.writeHead(404, { "Content-Type": "application/json" });
             res.end('{"error":"Project not found"}');
             return;
           }
-          var ownerId = data.userId || null;
+          var ownerId = data.userId;
+          if (typeof ownerId !== "string" || !users.findUserById(ownerId)) throw new Error("A valid owner is required");
+          var currentAccess = onGetProjectAccess && onGetProjectAccess(projSlug);
+          if (!currentAccess || currentAccess.ownerId !== mu.id) throw new Error("Project owner access required");
+          if (!onProjectOwnerChanged) throw new Error("Ownership persistence is unavailable");
+          var saved = onProjectOwnerChanged(projSlug, ownerId);
+          if (saved && saved.error) throw new Error(saved.error);
           targetCtx.setProjectOwner(ownerId);
-          if (onProjectOwnerChanged) {
-            onProjectOwnerChanged(projSlug, ownerId);
-          }
           // Broadcast to project clients
           var ownerName = null;
           if (ownerId) {
@@ -653,7 +699,8 @@ function attachAdmin(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
-          if (!Array.isArray(data.allowedUsers)) {
+          verifyCurrentOwner(req, mateAccessRoute);
+          if (!Array.isArray(data.allowedUsers) || data.allowedUsers.some(function (id) { return typeof id !== "string" || !users.findUserById(id); })) {
             res.writeHead(400, { "Content-Type": "application/json" });
             res.end('{"error":"allowedUsers must be an array"}');
             return;

package/lib/server-appearance-settings.js

@@ -34,6 +34,18 @@ function attachAppearanceSettings(ctx) {
       fs.renameSync(defaultPath + '.tmp', defaultPath);
     }
   }
+  function getInitialAppearance(req) {
+    var user = identity(req);
+    if (!user) return null;
+    var saved = read(user);
+    return {
+      configured: saved.configured,
+      theme: saved.theme,
+      mode: saved.mode,
+      lightTheme: saved.lightTheme || null,
+      darkTheme: saved.darkTheme || null
+    };
+  }
   function handleRequest(req, res, url) {
     if (url !== '/api/user/appearance') return false;
     var user = identity(req);
@@ -66,6 +78,6 @@ function attachAppearanceSettings(ctx) {
     });
     return true;
   }
-  return { handleRequest: handleRequest };
+  return { handleRequest: handleRequest, getInitialAppearance: getInitialAppearance };
 }
 module.exports = { attachAppearanceSettings: attachAppearanceSettings };