clay-server 5.1.1-beta.1 → 5.2.0-beta.2

package/lib/server-account-passwords.js

@@ -0,0 +1,127 @@
+var crypto = require('crypto');
+var passwords = require('./account-passwords');
+var attachPolicy = require('./account-auth-policy').attachPolicy;
+
+function attachAccountPasswords(ctx) {
+  var users = ctx.users;
+  var policy = attachPolicy(users);
+  var pending = new Map();
+
+  var cookieName = ctx.devMode ? 'clay_password_transition_dev' : 'clay_password_transition';
+  function reply(res, code, data, cookies) {
+    var headers = { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' };
+    if (cookies) headers['Set-Cookie'] = cookies;
+    res.writeHead(code, headers); res.end(JSON.stringify(data));
+  }
+  function transitionCookie(token, req) {
+    return cookieName + '=' + token + '; Path=/; HttpOnly; SameSite=Strict; Max-Age=' + (token ? '600' : '0') + (ctx.tlsOptions || req && ctx.transport.info(req).secure ? '; Secure' : '');
+  }
+  function read(req, res, action, maxBytes) {
+    if ((req.headers['content-type'] || '').split(';')[0] !== 'application/json') { reply(res, 415, { error: 'JSON required.' }); return; }
+    var body = ''; var oversized = false;
+    req.on('data', function (chunk) { if (oversized) return; body += chunk; if (Buffer.byteLength(body) > (maxBytes || 4096)) { oversized = true; reply(res, 413, { error: 'Request too large.' }); } });
+    req.on('end', function () {
+      if (oversized) return;
+      var data; try { data = JSON.parse(body); } catch (error) { reply(res, 400, { error: 'Invalid request.' }); return; }
+      if (!data || typeof data !== 'object' || Array.isArray(data)) { reply(res, 400, { error: 'Invalid request.' }); return; }
+      Promise.resolve().then(function () { return action(data); }).catch(function (error) { reply(res, error.status || 400, { error: error.message || 'Could not complete sign-in.' }); });
+    });
+  }
+  function throttle(req, username) { ctx.throttle.consume(req, username); }
+  function clearAttempts(req, username) { ctx.throttle.success(req, username); }
+  function grant(user, res, req) {
+    var session = ctx.createSession(user.id, user.passwordHash, null, ctx.transport.info(req).secure, req);
+    reply(res, 200, { ok: true }, session.cookies.concat([transitionCookie('', req)]));
+  }
+  function startTransition(user, res, req) {
+    var now = Date.now();
+    pending.forEach(function (entry, key) { if (entry.until <= now) pending.delete(key); });
+    if (pending.size >= 1000) throw new Error('Sign-in is busy. Please retry shortly.');
+    var token = crypto.randomBytes(32).toString('hex');
+    pending.set(token, { userId: user.id, pinHash: user.pinHash, until: now + 600000, busy: false });
+    reply(res, 200, { ok: true, passwordRequired: true }, transitionCookie(token, req));
+  }
+  function handleRequest(req, res, url) {
+    if (req.method === 'POST' && url === '/auth/logout') pending.delete(ctx.parseCookies(req)[cookieName]);
+    if (url === '/api/account-auth-policy') {
+      var admin = ctx.getUser(req);
+      if (!admin || admin.role !== 'admin') { reply(res, 403, { error: 'Administrator access required.' }); return true; }
+      if (req.method === 'GET') { reply(res, 200, { method: policy.enabled() ? 'password' : 'pin', available: policy.available() }); return true; }
+      if (req.method !== 'PUT') { reply(res, 405, { error: 'Method not allowed.' }); return true; }
+      read(req, res, function (data) {
+        if (data.method !== 'password') throw new Error('Only the password transition is supported.');
+        policy.activate();
+        reply(res, 200, { ok: true, method: 'password' });
+        if (ctx.onPolicyChanged) ctx.onPolicyChanged();
+      });
+      return true;
+    }
+    if (!policy.enabled()) return false;
+    if (req.method === 'GET' && url === '/account/password') {
+      var signedIn = ctx.getUser(req);
+      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' });
+      res.end(signedIn ? require('./account-password-page').render(true) : require('./account-login-page').render({ password: true }));
+      return true;
+    }
+    if (req.method === 'POST' && url === '/auth/password-change') {
+      read(req, res, async function (data) {
+        var user = ctx.getUser(req);
+        if (!user) throw new Error('Sign in again to change your password.');
+        throttle(req, user.username);
+        if (!await passwords.verify(data.currentPassword, user.passwordHash)) throw new Error('Current password is incorrect.');
+        if (data.password !== data.confirmPassword) throw new Error('Passwords do not match.');
+        var hash = await passwords.hash(data.password);
+        var state = users.loadUsers();
+        var current = state.users.find(function (entry) { return entry.id === user.id; });
+        if (!current || current.passwordHash !== user.passwordHash || current.mustChangePin) throw new Error('Credentials changed. Sign in again.');
+        current.passwordHash = hash; users.saveUsers(state);
+        ctx.revokeSessions(user.id); clearAttempts(req, user.username); grant(current, res, req);
+      });
+      return true;
+    }
+    if (url === '/api/user/pin') {
+      reply(res, 409, { error: 'This server uses account passwords. Contact an administrator for credential recovery.' });
+      return true;
+    }
+    if (req.method === 'POST' && url === '/auth/login') {
+      read(req, res, async function (data) {
+        throttle(req, data.username);
+        var user = typeof data.username === 'string' ? users.findUserByUsername(data.username) : null;
+        if (data.pin !== undefined) {
+          if (!user || user.passwordHash && !user.mustChangePin || typeof data.pin !== 'string' || !/^\d{6}$/.test(data.pin) || !users.verifyPin(data.pin, user.pinHash, user)) throw new Error('Invalid username or account PIN.');
+          clearAttempts(req, user.username); startTransition(user, res, req); return;
+        }
+        var originalHash = user && user.passwordHash;
+        if (!await passwords.verify(data.password, originalHash)) throw new Error('Invalid username or password.');
+        user = users.findUserById(user.id);
+        if (!user || user.passwordHash !== originalHash || user.mustChangePin) throw new Error('Account credentials changed. Please sign in again.');
+        clearAttempts(req, user.username); grant(user, res, req);
+      });
+      return true;
+    }
+    if (req.method === 'POST' && url === '/auth/password-transition') {
+      read(req, res, async function (data) {
+        var token = ctx.parseCookies(req)[cookieName];
+        var proof = pending.get(token);
+        if (!proof || proof.until <= Date.now() || proof.busy) throw new Error('Verify your account PIN again.');
+        proof.busy = true;
+        try {
+          if (data.password !== data.confirmPassword) throw new Error('Passwords do not match.');
+          var hash = await passwords.hash(data.password);
+          var state = users.loadUsers();
+          var user = state.users.find(function (entry) { return entry.id === proof.userId; });
+          if (!user || user.pinHash !== proof.pinHash || user.passwordHash && !user.mustChangePin || proof.until <= Date.now()) throw new Error('Account credentials changed. Verify your PIN again.');
+          user.passwordHash = hash; user.pinHash = null; user.mustChangePin = false;
+          users.saveUsers(state);
+          pending.delete(token);
+          ctx.revokeSessions(user.id);
+          grant(user, res, req);
+        } finally { proof.busy = false; }
+      });
+      return true;
+    }
+    return false;
+  }
+  return { handleRequest: handleRequest, policy: policy, http: { read: read, reply: reply, throttle: throttle, clearAttempts: clearAttempts } };
+}
+module.exports = { attachAccountPasswords: attachAccountPasswords };

package/lib/server-account-security.js

@@ -0,0 +1,53 @@
+var passwords = require('./account-passwords');
+function attachAccountSecurity(ctx) {
+  function sessionList(req, user) {
+    var current = ctx.sessions.get(ctx.sessionToken(req), false);
+    return ctx.sessions.list(user.id).filter(function (entry) { return !!ctx.validSessionUser(entry); }).map(function (entry) {
+      return { id: entry.id, current: !!current && entry.id === current.id, userAgent: entry.userAgent || '',
+        address: entry.address, createdAt: entry.migrated ? null : entry.createdAt,
+        lastSeenAt: entry.migrated ? entry.observedAt || null : entry.lastSeenAt,
+        unknownDevice: !!entry.migrated && !entry.observedAt,
+        expiresAt: entry.expiresAt, method: entry.passkeyId ? 'Passkey' : entry.credentialVersion ? 'Password' : 'Account sign-in', migrated: !!entry.migrated };
+    }).sort(function (a, b) { return Number(b.current) - Number(a.current) || (b.lastSeenAt || 0) - (a.lastSeenAt || 0); });
+  }
+  async function verify(req, data, original) {
+    ctx.http.throttle(req, original.username);
+    if (!original.passwordHash || !await passwords.verify(data.currentPassword, original.passwordHash)) throw new Error('Current password is incorrect.');
+    var current = ctx.getUser(req);
+    if (!current || current.id !== original.id || current.passwordHash !== original.passwordHash) throw new Error('Sign in again to continue.');
+    ctx.http.clearAttempts(req, current.username); return current;
+  }
+  function handleRequest(req, res, url) {
+    if (url !== '/api/account-sessions' && url !== '/api/account-transport' && url !== '/account/sessions') return false;
+    var user = ctx.getUser(req);
+    if (!user) { ctx.http.reply(res, 401, { error: 'Sign in again to manage your account.' }); return true; }
+    if (url === '/account/sessions' && req.method === 'GET') {
+      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store', 'Content-Security-Policy': "frame-ancestors 'none'" });
+      res.end(require('./account-session-page').render()); return true;
+    }
+    if (url === '/api/account-transport') {
+      if (user.role !== 'admin') { ctx.http.reply(res, 403, { error: 'Administrator access required.' }); return true; }
+      if (req.method === 'GET') { ctx.http.reply(res, 200, ctx.transport.settings()); return true; }
+      if (req.method !== 'PUT') { ctx.http.reply(res, 405, { error: 'Method not allowed.' }); return true; }
+      ctx.http.read(req, res, async function (data) {
+        var admin = await verify(req, data, user);
+        if (admin.role !== 'admin') throw new Error('Administrator access required.');
+        var saved = ctx.transport.save(data); ctx.http.reply(res, 200, Object.assign({ ok: true }, saved));
+      }); return true;
+    }
+    if (req.method === 'GET') { ctx.http.reply(res, 200, { sessions: sessionList(req, user), maximumDays: 30, idleDays: 7 }); return true; }
+    if (req.method !== 'POST') { ctx.http.reply(res, 405, { error: 'Method not allowed.' }); return true; }
+    ctx.http.read(req, res, function (data) {
+      var active = ctx.getUser(req);
+      if (!active || active.id !== user.id) throw new Error('Sign in again to manage sessions.');
+      var current = ctx.sessions.get(ctx.sessionToken(req), false);
+      if (!current || typeof data.id !== 'string') throw new Error('Invalid session.');
+      if (data.id !== 'others' && !ctx.sessions.list(user.id).some(function (entry) { return entry.id === data.id; })) throw new Error('Session not found.');
+      ctx.sessions.revoke(user.id, data.id, current.id);
+      ctx.http.reply(res, 200, { ok: true, signedOut: data.id === current.id, sessions: sessionList(req, user) });
+    });
+    return true;
+  }
+  return { handleRequest: handleRequest };
+}
+module.exports = { attachAccountSecurity: attachAccountSecurity };

package/lib/server-auth.js

@@ -66,71 +66,54 @@ function attachAuth(ctx) {
   // --- Multi-user auth tokens (persisted to disk) ---
   var TOKENS_FILE = path.join(CONFIG_DIR, _isDevMode ? "auth-tokens-dev.json" : "auth-tokens.json");
   var MULTI_USER_COOKIE = _isDevMode ? "relay_auth_user_dev" : "relay_auth_user";
-  var multiUserTokens = {};
-
-  function loadTokens() {
-    try {
-      var raw = fs.readFileSync(TOKENS_FILE, "utf8");
-      var data = JSON.parse(raw);
-      if (data && typeof data === "object") {
-        multiUserTokens = data;
-      }
-    } catch (e) {
-      multiUserTokens = {};
-    }
+  var accountPolicy = require('./account-auth-policy').attachPolicy(users);
+  var transport = require('./account-auth-transport').attachTransport({ users: users, tlsOptions: tlsOptions });
+  var sessionStore = require('./account-session-store').attachSessionStore({
+    file: TOKENS_FILE, managed: accountPolicy.available, clientAddress: transport.clientAddress,
+  });
+  var throttle = require('./account-auth-throttle').attachThrottle({
+    file: path.join(CONFIG_DIR, _isDevMode ? 'auth-attempts-dev.json' : 'auth-attempts.json'), clientAddress: transport.clientAddress,
+  });
+  function sessionToken(req) { return parseCookies(req)[MULTI_USER_COOKIE]; }
+  function createMultiUserSession(userId, credential, passkeyId, secure, req) {
+    var created = sessionStore.create(userId, credential, passkeyId, req, req && sessionToken(req));
+    var age = created.entry.expiresAt ? Math.max(0, Math.floor((created.entry.expiresAt - Date.now()) / 1000)) : 31536000;
+    var cookie = MULTI_USER_COOKIE + '=' + created.token + '; Path=/; HttpOnly; SameSite=Strict; Max-Age=' + age +
+      (tlsOptions || secure || req && transport.info(req).secure ? '; Secure' : '');
+    var rememberedCookie = rememberedAccounts.remember(userId, req);
+    return { token: created.token, cookie: cookie, cookies: rememberedCookie ? [cookie, rememberedCookie] : [cookie] };
   }
-
-  function saveTokens() {
-    try {
-      fs.mkdirSync(path.dirname(TOKENS_FILE), { recursive: true });
-      var tmpPath = TOKENS_FILE + ".tmp";
-      fs.writeFileSync(tmpPath, JSON.stringify(multiUserTokens));
-      fs.renameSync(tmpPath, TOKENS_FILE);
-    } catch (e) {}
+  function validSessionUser(record) {
+    var user = record && users.findUserById(record.userId);
+    if (!user) return null;
+    if (record.passkeyId && (!require('./account-passkey-policy').configured(users.loadUsers()) ||
+      !(user.passkeys || []).some(function (key) { return key.id === record.passkeyId; }))) return null;
+    if (accountPolicy.requiresPassword(user) && (!user.passwordHash || user.mustChangePin ||
+      record.credentialVersion !== require('./account-session-store').digest(user.passwordHash))) return null;
+    return user;
   }
-
-  loadTokens();
-
-  function createMultiUserSession(userId) {
-    var token = users.generateUserAuthToken(userId);
-    multiUserTokens[token] = userId;
-    saveTokens();
-    var cookie = MULTI_USER_COOKIE + "=" + token + "; Path=/; HttpOnly; SameSite=Strict; Max-Age=31536000" + (tlsOptions ? "; Secure" : "");
-    return { token: token, cookie: cookie };
-  }
-
   function getMultiUserFromReq(req) {
-    var cookies = parseCookies(req);
-    var token = cookies[MULTI_USER_COOKIE];
-    if (token) {
-      var userId = multiUserTokens[token];
-      if (userId) {
-        var user = users.findUserById(userId);
-        if (user) return user;
-      }
+    if (accountPolicy.enabled() && !transport.allows(req, false)) return null;
+    var token = sessionToken(req);
+    var record = sessionStore.get(token, false);
+    var user = validSessionUser(record);
+    if (user) {
+      if (!req.claySessionPassive) sessionStore.get(token, true, req);
+      return user;
     }
-    // Solo auto-login: exactly one user with no PIN => frictionless access, no
-    // login wall. Mirrors the old single-user onramp once single-user mode is
-    // absorbed into multi-user. Disabled the moment a PIN is set or a second
-    // user is added (then the normal token/login flow applies).
-    var solo = users.getSoloNoPinUser();
-    if (solo) return solo;
-    return null;
+    return users.getSoloNoPinUser() || null;
   }
-
-  function isMultiUserAuthed(req) {
-    return !!getMultiUserFromReq(req);
+  function touchSession(req) {
+    if (getMultiUserFromReq(req)) sessionStore.get(sessionToken(req), true, req);
   }
-
-  function revokeUserTokens(userId) {
-    var changed = false;
-    for (var token in multiUserTokens) {
-      if (multiUserTokens[token] === userId) {
-        delete multiUserTokens[token];
-        changed = true;
-      }
+  function isMultiUserAuthed(req) { return !!getMultiUserFromReq(req); }
+  function revokeUserTokens(userId) { sessionStore.revokeUser(userId); }
+  function allowAttempt(req, res, username) {
+    try { throttle.consume(req, username); return true; }
+    catch (error) {
+      res.writeHead(error.status || 503, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      res.end(JSON.stringify({ error: error.message })); return false;
     }
-    if (changed) saveTokens();
   }
 
   // --- PIN rate limiting (per-instance state) ---
@@ -163,7 +146,7 @@ function attachAuth(ctx) {
   var recovery = null;
 
   function setRecovery(urlPath, password) {
-    recovery = { urlPath: urlPath, password: password };
+    recovery = { urlPath: urlPath, password: password, until: Date.now() + 15 * 60000 };
   }
 
   function clearRecovery() {
@@ -246,14 +229,11 @@ function attachAuth(ctx) {
   // --- Auth page selection ---
   var pinPage = pages.pinPageHtml();
   var adminSetupPage = pages.adminSetupPageHtml();
-  var loginPage = pages.multiUserLoginPageHtml();
-  var smtpLoginPage = pages.smtpLoginPageHtml();
 
   function getAuthPage() {
     if (!users.isMultiUser()) return pinPage;
     if (!users.hasAdmin()) return adminSetupPage;
-    if (smtp.isEmailLoginEnabled()) return smtpLoginPage;
-    return loginPage;
+    return require('./account-login-page').render({ password: accountPolicy.enabled(), email: !accountPolicy.enabled() && smtp.isEmailLoginEnabled() });
   }
 
   function isRequestAuthed(req) {
@@ -268,8 +248,22 @@ function attachAuth(ctx) {
   // --- Route handler ---
 
   function handleRequest(req, res, fullUrl) {
+    if (require('./account-login-page').handleAsset(req, res, fullUrl)) return true;
+    if (accountPolicy.enabled() && transport.info(req).secure && typeof res.setHeader === 'function') res.setHeader('Strict-Transport-Security', 'max-age=31536000');
+    if ((accountPolicy.enabled() || fullUrl === '/api/account-auth-policy' && req.method === 'PUT') && /^(?:\/auth\/(?!passkey-browser\.js)|\/api\/(?:account-auth-policy|passkey-policy|passkeys|account-sessions|account-transport|user\/pin|admin\/users|profile)|\/recover\/)/.test(fullUrl) &&
+      !transport.allows(req, ['GET', 'HEAD', 'OPTIONS'].indexOf(req.method) === -1)) {
+      res.writeHead(403, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      res.end(JSON.stringify({ error: 'Use HTTPS and the same Clay address for account requests. Reverse proxies must be explicitly configured.' })); return true;
+    }
+    if (rememberedAccounts.handleRequest(req, res, fullUrl)) return true;
+    if (accountSecurity.handleRequest(req, res, fullUrl)) return true;
+    if (accountPasskeys.handleRequest(req, res, fullUrl)) return true;
+    if (accountPasswords.handleRequest(req, res, fullUrl)) return true;
     // Admin password recovery
     if (recovery && fullUrl === "/recover/" + recovery.urlPath) {
+      if (recovery.until <= Date.now()) {
+        recovery = null; res.writeHead(410, { 'Content-Type': 'application/json' }); res.end('{"error":"Recovery expired. Enable a new recovery link from the server terminal."}'); return true;
+      }
       if (req.method === "GET") {
         res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
         res.end(recoveryPageHtml());
@@ -288,6 +282,8 @@ function attachAuth(ctx) {
         req.on("end", function () {
           try {
             var data = JSON.parse(body);
+            if (!allowAttempt(req, res, 'admin-recovery')) return;
+            if (!recovery || recovery.until <= Date.now()) throw new Error('Recovery expired.');
             if (data.step === "verify") {
               if (!data.password || data.password !== recovery.password) {
                 recordPinFailure(ip);
@@ -315,7 +311,9 @@ function attachAuth(ctx) {
                 res.end('{"error":"No admin account found"}');
                 return;
               }
-              users.updateUserPin(admin.id, data.pin);
+              var reset = users.updateUserPin(admin.id, data.pin);
+              if (!reset.ok) throw new Error('Could not reset the administrator account.');
+              revokeUserTokens(admin.id);
               recovery = null;
               res.writeHead(200, { "Content-Type": "application/json" });
               res.end('{"ok":true}');
@@ -334,6 +332,11 @@ function attachAuth(ctx) {
 
     // Global auth endpoint (single-user PIN)
     if (req.method === "POST" && req.url === "/auth") {
+      if (users.isMultiUser()) {
+        res.writeHead(403, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+        res.end(JSON.stringify({ ok: false, error: 'Server PIN sign-in is unavailable. Sign in with your account.' }));
+        return true;
+      }
       var ip = req.socket.remoteAddress || "";
       var remaining = checkPinRateLimit(ip);
       if (remaining !== null) {
@@ -439,9 +442,9 @@ function attachAuth(ctx) {
             }
           }
           users.clearSetupCode();
-          var session = createMultiUserSession(result.user.id);
+          var session = createMultiUserSession(result.user.id, null, null, false, req);
           res.writeHead(200, {
-            "Set-Cookie": session.cookie,
+            "Set-Cookie": session.cookies,
             "Content-Type": "application/json",
           });
           res.end(JSON.stringify({ ok: true, user: { id: result.user.id, username: result.user.username, role: result.user.role } }));
@@ -472,6 +475,7 @@ function attachAuth(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
+          if (!allowAttempt(req, res, data.username)) return;
           var user = users.authenticateUser(data.username, data.pin);
           if (!user) {
             recordPinFailure(ip);
@@ -481,11 +485,12 @@ function attachAuth(ctx) {
             return;
           }
           clearPinFailures(ip);
-          var session = createMultiUserSession(user.id);
+          throttle.success(req, data.username);
+          var session = createMultiUserSession(user.id, null, null, false, req);
           var loginResp = { ok: true, user: { id: user.id, username: user.username, role: user.role } };
           if (user.mustChangePin) loginResp.mustChangePin = true;
           res.writeHead(200, {
-            "Set-Cookie": session.cookie,
+            "Set-Cookie": session.cookies,
             "Content-Type": "application/json",
           });
           res.end(JSON.stringify(loginResp));
@@ -528,6 +533,7 @@ function attachAuth(ctx) {
             res.end('{"ok":true}');
             return;
           }
+          if (!allowAttempt(req, res, 'email:' + String(data.email).toLowerCase())) return;
           var result = smtp.requestOtp(data.email);
           if (result.error) {
             res.writeHead(429, { "Content-Type": "application/json" });
@@ -573,6 +579,7 @@ function attachAuth(ctx) {
             res.end('{"error":"Email and code are required"}');
             return;
           }
+          if (!allowAttempt(req, res, 'email:' + String(data.email).toLowerCase())) return;
           var otpResult = smtp.verifyOtp(data.email, data.code);
           if (!otpResult.valid) {
             recordPinFailure(ip);
@@ -587,9 +594,9 @@ function attachAuth(ctx) {
             return;
           }
           clearPinFailures(ip);
-          var session = createMultiUserSession(user.id);
+          var session = createMultiUserSession(user.id, null, null, false, req);
           res.writeHead(200, {
-            "Set-Cookie": session.cookie,
+            "Set-Cookie": session.cookies,
             "Content-Type": "application/json",
           });
           res.end(JSON.stringify({ ok: true, user: { id: user.id, username: user.username, role: user.role } }));
@@ -625,7 +632,7 @@ function attachAuth(ctx) {
             return;
           }
           var result;
-          if (smtp.isEmailLoginEnabled() && !data.pin) {
+          if (smtp.isEmailLoginEnabled() && !data.pin && !accountPasswords.policy.enabled()) {
             // SMTP mode: username + email required, no PIN
             if (!data.email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(data.email)) {
               res.writeHead(400, { "Content-Type": "application/json" });
@@ -667,9 +674,9 @@ function attachAuth(ctx) {
             }
           }
           users.markInviteUsed(data.inviteCode);
-          var session = createMultiUserSession(result.user.id);
+          var session = createMultiUserSession(result.user.id, null, null, false, req);
           res.writeHead(200, {
-            "Set-Cookie": session.cookie,
+            "Set-Cookie": session.cookies,
             "Content-Type": "application/json",
           });
           res.end(JSON.stringify({ ok: true, user: { id: result.user.id, username: result.user.username, role: result.user.role } }));
@@ -686,17 +693,16 @@ function attachAuth(ctx) {
       if (users.isMultiUser()) {
         var cookies = parseCookies(req);
         var token = cookies[MULTI_USER_COOKIE];
-        if (token && multiUserTokens[token]) {
-          delete multiUserTokens[token];
-          saveTokens();
+        try { sessionStore.revokeToken(token); } catch (error) {
+          res.writeHead(503, { 'Content-Type': 'application/json' }); res.end('{"error":"Could not persist sign-out. Please retry."}'); return true;
         }
         res.writeHead(200, {
-          "Set-Cookie": MULTI_USER_COOKIE + "=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0" + (tlsOptions ? "; Secure" : ""),
+          "Set-Cookie": MULTI_USER_COOKIE + "=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0" + (tlsOptions || transport.info(req).secure ? "; Secure" : ""),
           "Content-Type": "application/json",
         });
       } else {
         res.writeHead(200, {
-          "Set-Cookie": "relay_auth=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0" + (tlsOptions ? "; Secure" : ""),
+          "Set-Cookie": "relay_auth=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0" + (tlsOptions || transport.info(req).secure ? "; Secure" : ""),
           "Content-Type": "application/json",
         });
       }
@@ -722,14 +728,36 @@ function attachAuth(ctx) {
         return true;
       }
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      res.end(smtp.isEmailLoginEnabled() ? pages.smtpInvitePageHtml(inviteCode) : pages.invitePageHtml(inviteCode));
+      res.end(smtp.isEmailLoginEnabled() && !accountPasswords.policy.enabled() ? pages.smtpInvitePageHtml(inviteCode) : pages.invitePageHtml(inviteCode));
       return true;
     }
 
     return false;
   }
 
+  var accountPasswords = require('./server-account-passwords').attachAccountPasswords({
+    users: users, devMode: _isDevMode, tlsOptions: tlsOptions, parseCookies: parseCookies,
+    getUser: getMultiUserFromReq, createSession: createMultiUserSession, revokeSessions: revokeUserTokens,
+    onPolicyChanged: ctx.onAccountPolicyChanged, throttle: throttle, transport: transport,
+  });
+  var accountPasskeys = require('./server-account-passkeys').attachAccountPasskeys({
+    users: users, devMode: _isDevMode, parseCookies: parseCookies, http: accountPasswords.http,
+    getUser: getMultiUserFromReq, createSession: createMultiUserSession,
+    sessionToken: sessionToken, clientAddress: transport.clientAddress,
+  });
+
+  var rememberedAccounts = require('./account-remembered').attachRemembered({
+    users: users, devMode: _isDevMode, parseCookies: parseCookies, transport: transport,
+    file: path.join(CONFIG_DIR, _isDevMode ? 'remembered-accounts-dev.json' : 'remembered-accounts.json'), read: accountPasswords.http.read,
+  });
+
+  var accountSecurity = require('./server-account-security').attachAccountSecurity({
+    users: users, getUser: getMultiUserFromReq, sessionToken: sessionToken, sessions: sessionStore,
+    validSessionUser: validSessionUser, http: accountPasswords.http, transport: transport,
+  });
+
   return {
+    touchSession: touchSession,
     handleRequest: handleRequest,
     getMultiUserFromReq: getMultiUserFromReq,
     isRequestAuthed: isRequestAuthed,

package/lib/server-home-chat.js

@@ -418,7 +418,7 @@ function attachHomeChat(deps) {
     return sessionReferenceValue;
   }
 
-  function handleMessage(ws, msg) {
+  function handleMessage(ws, msg, routedProjectSlug) {
     if (!msg || typeof msg.type !== "string") return false;
     if (msg.type === "home_mate_stop" || msg.type === "home_mate_permission_response") {
       var controlUserId = ws._clayUser ? ws._clayUser.id : null;
@@ -477,8 +477,8 @@ function attachHomeChat(deps) {
     if (msg.type === "issue_reference_resolve") { resolveIssueLink(ws, msg); return true; }
     if (homeDebates.handle(ws, userId, msg)) return true;
     if (msg.type === "home_clay_ask") { homeClayEntry.start(ws, userId, msg); return true; }
-    if (msg.type === "home_clay_session_resolve") { homeClaySessionLinks.resolve(ws, msg); return true; }
-    if (msg.type === "home_clay_log_resolve") { homeClaySessionLinks.resolveLog(ws, msg); return true; }
+    if (msg.type === "home_clay_session_resolve") { homeClaySessionLinks.resolve(ws, msg, routedProjectSlug); return true; }
+    if (msg.type === "home_clay_log_resolve") { homeClaySessionLinks.resolveLog(ws, msg, routedProjectSlug); return true; }
 
     if (msg.type === "home_mate_debate_plan") {
       homeDebate.start(ws, userId, msg);

package/lib/server-home-clay-session-links.js

@@ -2,23 +2,31 @@
 // owner-bound source session.
 
 function attachHomeClaySessionLinks(ctx) {
-  function source(ws, msg) {
+  function source(ws, msg, routedProjectSlug) {
     var tap = msg.surface === "search" ? ws._searchClayTap : ws._homeChatTap;
+    if (!tap && routedProjectSlug) {
+      var routedProject = ctx.projects.get(routedProjectSlug);
+      var routedManager = routedProject && routedProject.getSessionManager ? routedProject.getSessionManager() : null;
+      var routedSession = routedManager && ws._clayActiveSession ? routedManager.sessions.get(ws._clayActiveSession) : null;
+      return { tap: { mateSlug: routedProjectSlug, sessionId: ws._clayActiveSession }, project: routedProject, session: routedSession };
+    }
     var sourceProject = tap && tap.mateSlug ? ctx.projects.get(tap.mateSlug) : null;
     var sourceManager = sourceProject && sourceProject.getSessionManager ? sourceProject.getSessionManager() : null;
     var sourceSession = sourceManager && tap ? sourceManager.sessions.get(tap.sessionId) : null;
     return { tap: tap, project: sourceProject, session: sourceSession };
   }
 
-  function resolve(ws, msg) {
-    var selected = source(ws, msg);
-    var bound = ctx.workspaceQueryService && selected.session
-      ? ctx.workspaceQueryService.bindProjectSession({ projectSlug: selected.tap.mateSlug, session: selected.session })
-      : null;
+  function resolve(ws, msg, routedProjectSlug) {
+    var selected = source(ws, msg, routedProjectSlug);
     var payload = { type: "home_clay_session_target", requestId: msg.requestId || null, sessionRef: msg.sessionRef || null, status: "error" };
     try {
+      var binding = selected.session ? { projectSlug: selected.tap.mateSlug, session: selected.session } : null;
+      if (binding && ws && ws._clayUser) binding.viewerId = ws._clayUser.id;
+      var bound = ctx.workspaceQueryService && binding
+        ? ctx.workspaceQueryService.bindProjectSession(binding)
+        : null;
       if (!bound) throw new Error("The source conversation is no longer available.");
-      payload.target = bound.resolveSessionNavigation({ sessionRef: msg.sessionRef });
+      payload.target = bound.resolveSessionNavigation({ sessionRef: msg.sessionRef, entryIndex: msg.entryIndex });
       payload.status = "ready";
     } catch (error) {
       payload.error = error.message || "Session not available.";
@@ -26,8 +34,8 @@ function attachHomeClaySessionLinks(ctx) {
     ctx.sendMessage(ws, payload);
   }
 
-  function resolveLog(ws, msg) {
-    var selected = source(ws, msg);
+  function resolveLog(ws, msg, routedProjectSlug) {
+    var selected = source(ws, msg, routedProjectSlug);
     var status = selected.project && selected.project.getStatus ? selected.project.getStatus() : null;
     var bound = ctx.projectLogsService && selected.session && status
       ? ctx.projectLogsService.bindMate({

package/lib/server-settings.js

@@ -56,6 +56,7 @@ function attachSettings(ctx) {
         profile.userId = mu.id;
         profile.role = mu.role;
         profile.pinEnabled = !!mu.pinHash;
+        profile.passwordEnabled = !!mu.passwordHash;
         profile.autoContinueOnRateLimit = !!mu.autoContinueOnRateLimit;
         profile.chatLayout = mu.chatLayout || "channel";
         profile.projectMateFilterMode = users.getProjectMateFilterMode(mu.id);
@@ -395,7 +396,7 @@ function attachSettings(ctx) {
               res.end('{"error":"Current PIN is required"}');
               return;
             }
-            if (mu.pinHash !== users.hashPin(data.currentPin)) {
+            if (!users.verifyPin(data.currentPin, mu.pinHash, mu)) {
               res.writeHead(400, { "Content-Type": "application/json" });
               res.end('{"error":"Current PIN is incorrect"}');
               return;

package/lib/server.js

@@ -1182,6 +1182,7 @@ function createServer(opts) {
       }
       var globalUser = users.isMultiUser() ? getMultiUserFromReq(req) : null;
       wss.handleUpgrade(req, socket, head, function (ws) {
+        if (!require('./account-auth-socket').guardSocket(ws, req, isRequestAuthed, auth.touchSession)) return;
         ws._clayPane = wsRequest.pane;
         ws._clayPaneSession = wsRequest.paneSession;
         globalWs.handleConnection(ws, globalUser);
@@ -1223,6 +1224,7 @@ function createServer(opts) {
     }
 
     wss.handleUpgrade(req, socket, head, function (ws) {
+      if (!require('./account-auth-socket').guardSocket(ws, req, isRequestAuthed, auth.touchSession)) return;
       // Apply rate limiting to WS messages
       applyWsRateLimit(ws, WS_RATE_LIMIT);
       ws._clayUser = wsUser; // attach user context
@@ -1628,7 +1630,7 @@ function createServer(opts) {
     if (dmHandler.handleMessage(ws, msg)) return true;
     if (mateHandler && mateHandler.handleMessage(ws, msg)) return true;
     if (emailHandler.handleMessage(ws, msg)) return true;
-    if (homeChatHandler.handleMessage(ws, msg)) return true;
+    if (homeChatHandler.handleMessage(ws, msg, routedProjectSlug)) return true;
     if (homePreferencesHandler.handleMessage(ws, msg)) return true;
     if (toolsHandler.handleMessage(ws, msg)) return true;
     return false;

package/lib/sessions.js

@@ -864,7 +864,9 @@ function createSessionManager(opts) {
       if (_item && (_item.type === "mention_user" || _item.type === "mention_response")) {
         console.log("[DEBUG replayHistory] sending mention at index=" + i + " from=" + fromIndex + " total=" + total + " type=" + _item.type + " mate=" + (_item.mateName || ""));
       }
-      _send(transform ? transform(_item) : _item);
+      var replayItem = transform ? transform(_item) : _item;
+      if (replayItem && typeof replayItem === "object") replayItem = Object.assign({}, replayItem, { _historyIndex: i });
+      _send(replayItem);
     }
 
     // Find the last result message in the full history for accurate context data