co-maintainer 0.4.2 → 0.4.3

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "co-maintainer",
-    "version": "0.4.2",
+    "version": "0.4.3",
     "description": "Analyzes a GitHub repository and writes repository-specific contribution guidance.",
     "license": "MIT",
     "repository": {

package/dist/src/cli/commands/serve.d.ts

@@ -1,9 +1,12 @@
 import type { UserConfig } from "../../config.ts";
-import type { AuthMethods } from "../../server/auth.ts";
+import type { AuthMethods, PasswordStore } from "../../server/auth.ts";
 import { type Platform } from "../../util/runtime.ts";
 /** `undefined` on Linux, otherwise one line naming the platform (a pure
  * function so it is testable without actually being off Linux). */
 export declare function platformWarning(os: Platform): string | undefined;
+/** `--password=` replaces the stored password. With no flag the stored one is
+ * kept, and a first start generates one, returned so the caller can print it. */
+export declare function ensureDashboardPassword(args: string[], hasStoredPassword: boolean, store: PasswordStore): Promise<string | undefined>;
 /** `--disable-auth=password` / `--enable-auth=github` always win over the
  * config defaults `co-maintainer set` persisted; dies if the result would
  * leave no sign-in method active. Pure so it is testable without a server. */

package/dist/src/cli/commands/serve.js

@@ -1,12 +1,14 @@
 import { readConfig } from "../../config.js";
 import { appDbPath, closeAppDb, openAppDb } from "../../store/app_db.js";
 import { createApp } from "../../server/app.js";
+import { configPasswordStore } from "../../server/auth.js";
 import { recoverOrphans, startWorkerLoop, stopWorkerLoop, } from "../../services/jobs.js";
 import { registerSetupJobHandler } from "../../services/setup.js";
 import { registerReviewJobHandler } from "../../services/review.js";
 import { recoverReplyRequests, registerReplyJobHandler, } from "../../services/replies.js";
 import { registerRemoteReviewHandler } from "../../services/remote_review.js";
 import { startRemoteWatchdog } from "../../remote/server/sessions.js";
+import { passwordProblem } from "../../util/password.js";
 import { serveHttp } from "../../server/http.js";
 import { currentPlatform, getEnv } from "../../util/runtime.js";
 /** `undefined` on Linux, otherwise one line naming the platform (a pure
@@ -24,6 +26,25 @@ function generatePassword() {
     crypto.getRandomValues(bytes);
     return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
+/** `--password=` replaces the stored password. With no flag the stored one is
+ * kept, and a first start generates one, returned so the caller can print it. */
+export async function ensureDashboardPassword(args, hasStoredPassword, store) {
+    const flag = args
+        .find((arg) => arg.startsWith("--password="))
+        ?.slice("--password=".length);
+    if (flag !== undefined) {
+        const problem = passwordProblem(flag);
+        if (problem)
+            die(`--password: ${problem}`);
+        await store.set(flag);
+        return undefined;
+    }
+    if (hasStoredPassword)
+        return undefined;
+    const generated = generatePassword();
+    await store.set(generated);
+    return generated;
+}
 /** `--disable-auth=password` / `--enable-auth=github` always win over the
  * config defaults `co-maintainer set` persisted; dies if the result would
  * leave no sign-in method active. Pure so it is testable without a server. */
@@ -117,6 +138,13 @@ export async function runServe(args) {
             allowedUser: config.githubOAuthAllowedUser,
         };
     }
+    const passwordStore = configPasswordStore();
+    if (auth.password) {
+        const generated = await ensureDashboardPassword(args, Boolean(config.dashboardPasswordHash), passwordStore);
+        console.log(generated
+            ? `[serve] dashboard password: ${generated}`
+            : "[serve] dashboard password is stored in config.json, change it in Settings");
+    }
     const warning = platformWarning(currentPlatform());
     if (warning)
         console.log(`[serve] warning: ${warning}`);
@@ -136,13 +164,6 @@ export async function runServe(args) {
         console.log(`[serve] requeued ${recoveredReplies} unfinished conversation repl${recoveredReplies === 1 ? "y" : "ies"}`);
     }
     startWorkerLoop();
-    const password = auth.password
-        ? (args
-            .find((arg) => arg.startsWith("--password="))
-            ?.slice("--password=".length) ?? generatePassword())
-        : "";
-    if (auth.password)
-        console.log(`[serve] dashboard password: ${password}`);
     if (auth.github)
         console.log(`[serve] GitHub sign-in enabled for ${githubOAuth.allowedUser}`);
     const inject500 = args.includes("--inject-500") || getEnv("CM_INJECT_500") === "1";
@@ -150,7 +171,8 @@ export async function runServe(args) {
         console.log("[serve] --inject-500 is on. Mutating /api requests return 500.");
     }
     const app = createApp({
-        password,
+        password: "",
+        passwordStore,
         webhookUrl,
         inject500,
         auth,

package/dist/src/cli/commands/set.js

@@ -1,4 +1,5 @@
 import { writeUserConfig } from "../../config.js";
+import { hashPassword, passwordProblem } from "../../util/password.js";
 import { readTextFile } from "../../util/runtime.js";
 function die(message) {
     throw new Error(message);
@@ -15,6 +16,7 @@ const secretFields = new Set([
     "githubWebhookSecret",
     "githubOAuthClientSecret",
     "remoteToken",
+    "dashboardPasswordHash",
 ]);
 /** `co-maintainer set --token=... --ai=... --low-model=... --high-model=...
  * --auth=... --github-app-id=... --github-app-private-key=... (or
@@ -28,7 +30,7 @@ export async function runSet(args) {
         console.log("                        --github-app-id=... --github-app-private-key=... | --github-app-private-key-file=path");
         console.log("                        --github-webhook-secret=...");
         console.log("                        --github-oauth-client-id=... --github-oauth-client-secret=... --github-oauth-allowed-user=...");
-        console.log("                        --disable-auth=password --enable-auth=github");
+        console.log("                        --password=... --disable-auth=password --enable-auth=github");
         console.log("Writes to the user config file; unset an entry with --unset=name (e.g. --unset=token).");
         return;
     }
@@ -50,6 +52,7 @@ export async function runSet(args) {
         "enable-auth",
         "remote-host",
         "remote-token",
+        "password",
         "unset",
     ];
     for (const arg of args) {
@@ -87,6 +90,7 @@ export async function runSet(args) {
         "enable-auth": "githubAuthEnabled",
         "remote-host": "remoteHost",
         "remote-token": "remoteToken",
+        password: "dashboardPasswordHash",
     };
     const unset = new Set(args
         .filter((arg) => arg.startsWith("--unset="))
@@ -157,11 +161,18 @@ export async function runSet(args) {
     const remoteToken = text(args, "remote-token");
     if (remoteToken)
         patch.remoteToken = remoteToken;
+    const password = text(args, "password");
+    if (password) {
+        const problem = passwordProblem(password);
+        if (problem)
+            die(`--password: ${problem}`);
+        patch.dashboardPasswordHash = await hashPassword(password);
+    }
     if (Object.keys(patch).length === 0) {
         die("Nothing to set; pass --token=, --ai=, --low-model=, --high-model=, --auth=, --github-pat=, " +
             "--github-app-id=, --github-app-private-key(-file)=, --github-webhook-secret=, " +
             "--github-oauth-client-id=, --github-oauth-client-secret=, --github-oauth-allowed-user=, " +
-            "--disable-auth=password, --enable-auth=github, or --unset=name");
+            "--password=, --disable-auth=password, --enable-auth=github, or --unset=name");
     }
     await writeUserConfig(patch);
     const summary = Object.entries(patch).map(([key, value]) => value === undefined

package/dist/src/config.d.ts

@@ -45,6 +45,8 @@ export type UserConfig = {
      * `--enable-auth` flag on the `serve` command overrides these per run. */
     passwordAuthDisabled?: boolean;
     githubAuthEnabled?: boolean;
+    /** scrypt hash of the dashboard password, never the password itself. */
+    dashboardPasswordHash?: string;
     defaults?: {
         maxCommits?: number;
         maxPrMonths?: number;

package/dist/src/server/api/settings.d.ts

@@ -1 +1,2 @@
-export declare function handleSettingsRoute(request: Request, url: URL, webhookUrl: string): Promise<Response>;
+import type { PasswordStore } from "../auth.ts";
+export declare function handleSettingsRoute(request: Request, url: URL, webhookUrl: string, passwords: PasswordStore, ip: string): Promise<Response>;

package/dist/src/server/api/settings.js

@@ -1,6 +1,9 @@
 import { errorResponse } from "../errors.js";
 import { readConfig, writeUserConfig } from "../../config.js";
 import { testAppAccess, testGithubAccess } from "../../services/credentials.js";
+import { checkPassword, readSessionToken, revokeOtherSessions, } from "../auth.js";
+import { passwordProblem } from "../../util/password.js";
+import { readJsonObject } from "./json_body.js";
 function validateWebhookUrl(value) {
     if (typeof value !== "string" || !value.trim()) {
         return "webhook URL is required";
@@ -16,7 +19,28 @@ function validateWebhookUrl(value) {
     }
     return undefined;
 }
-export async function handleSettingsRoute(request, url, webhookUrl) {
+async function changePassword(request, passwords, ip) {
+    const body = await readJsonObject(request);
+    if (body instanceof Response)
+        return body;
+    const next = typeof body.newPassword === "string" ? body.newPassword : "";
+    const problem = passwordProblem(next);
+    if (problem)
+        return errorResponse(422, "weak_password", problem);
+    const current = String(body.currentPassword ?? "");
+    if (!(await checkPassword(current, passwords, ip))) {
+        return errorResponse(403, "wrong_password", "the current password is wrong");
+    }
+    await passwords.set(next);
+    const token = readSessionToken(request);
+    if (token)
+        await revokeOtherSessions(token);
+    return Response.json({ ok: true });
+}
+export async function handleSettingsRoute(request, url, webhookUrl, passwords, ip) {
+    if (url.pathname === "/api/settings/password" && request.method === "POST") {
+        return await changePassword(request, passwords, ip);
+    }
     if (url.pathname === "/api/settings" && request.method === "GET") {
         const config = readConfig();
         return Response.json({

package/dist/src/server/app.d.ts

@@ -1,8 +1,9 @@
-import type { AuthMethods } from "./auth.ts";
-/** `password` is the dashboard password `serve` generates or takes via
- * `--password`. */
+import type { AuthMethods, PasswordStore } from "./auth.ts";
+/** `password` seeds an in-memory store. `serve` passes `passwordStore` so the
+ * password lives in config.json instead. */
 export type AppDeps = {
     password: string;
+    passwordStore?: PasswordStore;
     webhookUrl?: string;
     secureCookie?: boolean;
     inject500?: boolean;

package/dist/src/server/app.js

@@ -3,6 +3,7 @@
 import { VERSION } from "../version.js";
 import { errorResponse } from "./errors.js";
 import { hasCsrfHeader, login, logout, readSessionToken, sessionCookieHeader, verifySession, } from "./auth.js";
+import { memoryPasswordStore } from "./auth.js";
 import { readConfig } from "../config.js";
 import { listJobs } from "../store/jobs.js";
 import { handleJobsRoute } from "./api/jobs.js";
@@ -33,7 +34,7 @@ async function requireSession(request) {
         return undefined;
     return await verifySession(token);
 }
-async function handleLogin(request, deps, ip) {
+async function handleLogin(request, deps, passwords, ip) {
     if (deps.auth?.password === false) {
         return errorResponse(403, "password_disabled", "password sign-in is disabled");
     }
@@ -44,7 +45,7 @@ async function handleLogin(request, deps, ip) {
     catch {
         return errorResponse(400, "bad_request", "expected a JSON body");
     }
-    const result = await login(String(body.password ?? ""), deps.password, ip);
+    const result = await login(String(body.password ?? ""), passwords, ip);
     if (!result)
         return errorResponse(401, "unauthorized", "wrong password");
     return Response.json(result, {
@@ -93,6 +94,7 @@ function liveGithubConfig() {
     };
 }
 export function createApp(deps) {
+    const passwords = deps.passwordStore ?? memoryPasswordStore(deps.password);
     return {
         async fetch(request, remoteAddr = "unknown") {
             const url = new URL(request.url);
@@ -104,7 +106,7 @@ export function createApp(deps) {
             if (url.pathname === "/github/webhook" && request.method === "POST") {
                 return await handleWebhookRequest(request, webhookSecret);
             }
-            const page = await handlePageRequest(request, { ...deps, githubApp }, remoteAddr);
+            const page = await handlePageRequest(request, { ...deps, githubApp, passwordStore: passwords }, remoteAddr);
             if (page)
                 return page;
             if (url.pathname.startsWith("/api/remote/")) {
@@ -115,7 +117,7 @@ export function createApp(deps) {
                     return errorResponse(403, "csrf", `every mutating request needs the X-Requested-With header`);
                 }
                 if (url.pathname === "/api/login" && request.method === "POST") {
-                    return await handleLogin(request, deps, remoteAddr);
+                    return await handleLogin(request, deps, passwords, remoteAddr);
                 }
                 const session = await requireSession(request);
                 if (!session) {
@@ -143,7 +145,7 @@ export function createApp(deps) {
                     return await handleInstallationsRoute(request, githubApp);
                 }
                 if (url.pathname.startsWith("/api/settings")) {
-                    return await handleSettingsRoute(request, url, deps.webhookUrl ?? "");
+                    return await handleSettingsRoute(request, url, deps.webhookUrl ?? "", passwords, remoteAddr);
                 }
                 if (url.pathname.startsWith("/api/activity")) {
                     return handleActivityRoute(request, url);

package/dist/src/server/auth.d.ts

@@ -19,9 +19,21 @@ export type LoginResult = {
     username: string;
     expiresAt: string;
 };
+export type PasswordStore = {
+    verify(password: string): Promise<boolean>;
+    set(password: string): Promise<void>;
+};
+/** Holds the password in memory only: what `createApp` uses when `serve` did
+ * not hand it a config-backed store. */
+export declare function memoryPasswordStore(initial: string): PasswordStore;
+/** Reads the hash on every check, so a change made from the dashboard or
+ * `co-maintainer set` applies without restarting `serve`. */
+export declare function configPasswordStore(): PasswordStore;
 /** A locked-out attempt is indistinguishable from a wrong password to the
- * caller — both return `undefined` — so a probe gains nothing either way. */
-export declare function login(password: string, expected: string, ip: string): Promise<LoginResult | undefined>;
+ * caller, so a probe gains nothing either way. */
+export declare function checkPassword(password: string, store: PasswordStore, ip: string): Promise<boolean>;
+export declare function login(password: string, store: PasswordStore, ip: string): Promise<LoginResult | undefined>;
+export declare function revokeOtherSessions(keepToken: string): Promise<void>;
 /** Issues a session for the one dashboard identity, bypassing the password
  * check — used after GitHub OAuth has already verified the caller. */
 export declare function createSession(): Promise<LoginResult>;

package/dist/src/server/auth.js

@@ -1,6 +1,8 @@
 /** Only a token's hash ever reaches `store/sessions.ts`; the raw token is
  * handed back once, at login, and never stored. */
-import { deleteSession, getSession, insertSession } from "../store/sessions.js";
+import { readConfig, writeUserConfig } from "../config.js";
+import { hashPassword, verifyPasswordHash } from "../util/password.js";
+import { deleteOtherSessions, deleteSession, getSession, insertSession, } from "../store/sessions.js";
 const SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 const LOCKOUT_THRESHOLD = 5;
 const LOCKOUT_WINDOW_MS = 10 * 60 * 1000;
@@ -69,16 +71,50 @@ function recordSuccess(ip) {
 export function hasCsrfHeader(request) {
     return request.headers.get(CSRF_HEADER) === CSRF_VALUE;
 }
+/** Holds the password in memory only: what `createApp` uses when `serve` did
+ * not hand it a config-backed store. */
+export function memoryPasswordStore(initial) {
+    let current = initial;
+    return {
+        verify: async (password) => current !== "" && (await constantTimeEqual(password, current)),
+        set: async (password) => {
+            current = password;
+        },
+    };
+}
+/** Reads the hash on every check, so a change made from the dashboard or
+ * `co-maintainer set` applies without restarting `serve`. */
+export function configPasswordStore() {
+    return {
+        verify: async (password) => {
+            const stored = readConfig().dashboardPasswordHash;
+            return stored ? await verifyPasswordHash(password, stored) : false;
+        },
+        set: async (password) => {
+            await writeUserConfig({
+                dashboardPasswordHash: await hashPassword(password),
+            });
+        },
+    };
+}
 /** A locked-out attempt is indistinguishable from a wrong password to the
- * caller — both return `undefined` — so a probe gains nothing either way. */
-export async function login(password, expected, ip) {
-    if (isLockedOut(ip) || !(await constantTimeEqual(password, expected))) {
+ * caller, so a probe gains nothing either way. */
+export async function checkPassword(password, store, ip) {
+    if (isLockedOut(ip) || !(await store.verify(password))) {
         recordFailure(ip);
-        return undefined;
+        return false;
     }
     recordSuccess(ip);
+    return true;
+}
+export async function login(password, store, ip) {
+    if (!(await checkPassword(password, store, ip)))
+        return undefined;
     return await createSession();
 }
+export async function revokeOtherSessions(keepToken) {
+    deleteOtherSessions(await sha256Hex(keepToken));
+}
 /** Issues a session for the one dashboard identity, bypassing the password
  * check — used after GitHub OAuth has already verified the caller. */
 export async function createSession() {

package/dist/src/server/pages/router.d.ts

@@ -1,6 +1,6 @@
-import type { AuthMethods } from "../auth.ts";
+import type { AuthMethods, PasswordStore } from "../auth.ts";
 export type PageDeps = {
-    password: string;
+    passwordStore: PasswordStore;
     webhookUrl?: string;
     secureCookie?: boolean;
     githubApp?: {

package/dist/src/server/pages/router.js

@@ -266,7 +266,7 @@ async function handleLoginForm(request, deps, ip, auth) {
             showGithub: auth.github,
         });
     }
-    const result = await login(password, deps.password, ip);
+    const result = await login(password, deps.passwordStore, ip);
     if (!result) {
         return renderLogin({
             next,

package/dist/src/server/pages/settings.js

@@ -144,7 +144,7 @@ Leave blank to keep the current key"></textarea></div>
       <div class="bd">
         <p class="muted" style="margin:0 0 16px">A <code>--disable-auth</code>/<code>--enable-auth</code> flag on <code>serve</code> overrides these for that run.</p>
         <div class="field wide"><label><input type="checkbox" id="password-auth"${config.passwordAuthDisabled ? "" : " checked"}> Password sign-in</label>
-          <div class="hint">Set with <code>--password</code> when you start serve, or printed to the console if you omit the flag.</div></div>
+          <div class="hint">The first start prints a generated password to the console. Change it in the Password card below.</div></div>
         <div class="field wide"><label><input type="checkbox" id="github-auth"${config.githubAuthEnabled ? " checked" : ""}> GitHub sign-in</label></div>
         <div class="two" style="max-width:none">
           <div class="field"><label>OAuth client ID</label>
@@ -160,6 +160,23 @@ Leave blank to keep the current key"></textarea></div>
       </div>
       <div class="ft"><button class="primary" id="save-access">Save</button></div>
     </div>
+    <div class="card" id="password" data-async>
+      ${skSlot()}
+      <div class="hd"><h2>Password</h2></div>
+      <div class="bd">
+        <p class="muted" style="margin:0 0 16px">Changing it signs out every other browser session.</p>
+        <div class="field wide"><label>Current password</label>
+          <input id="pw-current" type="password" autocomplete="current-password"></div>
+        <div class="two" style="max-width:none">
+          <div class="field"><label>New password</label>
+            <input id="pw-new" type="password" autocomplete="new-password">
+            <div class="hint">8 to 200 characters.</div></div>
+          <div class="field"><label>Repeat new password</label>
+            <input id="pw-repeat" type="password" autocomplete="new-password"></div>
+        </div>
+      </div>
+      <div class="ft"><button class="primary" id="save-password">Change password</button></div>
+    </div>
     <div class="card" id="about">
       <div class="hd"><h2>About</h2></div>
       <div class="bd">
@@ -215,6 +232,25 @@ document.getElementById("save-access").addEventListener("click", function() {
     githubOAuthAllowedUser: document.getElementById("oauth-allowed-user").value
   });
 });
+document.getElementById("save-password").addEventListener("click", function() {
+  var btn = this;
+  var card = btn.closest("[data-async]");
+  var next = document.getElementById("pw-new").value;
+  if (next !== document.getElementById("pw-repeat").value) {
+    fail(card, "The two new passwords do not match.", function () {});
+    return;
+  }
+  run(btn, card, async function() {
+    await api("POST", "/api/settings/password", {
+      currentPassword: document.getElementById("pw-current").value,
+      newPassword: next
+    });
+    ["pw-current", "pw-new", "pw-repeat"].forEach(function(id) {
+      document.getElementById(id).value = "";
+    });
+    toast("Password changed");
+  });
+});
 function positiveOrNull(raw, label) {
   if (raw === "") return { ok: true, value: null };
   var n = Number(raw);

package/dist/src/store/sessions.d.ts

@@ -6,3 +6,4 @@ export declare function insertSession(tokenHash: string, username: string, expir
 export declare function getSession(tokenHash: string): SessionRow | undefined;
 export declare function deleteSession(tokenHash: string): void;
 export declare function deleteExpiredSessions(): void;
+export declare function deleteOtherSessions(keepTokenHash: string): void;

package/dist/src/store/sessions.js

@@ -32,3 +32,8 @@ export function deleteExpiredSessions() {
         .prepare(`DELETE FROM sessions WHERE expires_at <= ?`)
         .run(nowIso());
 }
+export function deleteOtherSessions(keepTokenHash) {
+    getAppDb()
+        .prepare(`DELETE FROM sessions WHERE token_hash != ?`)
+        .run(keepTokenHash);
+}

package/dist/src/util/password.d.ts

@@ -0,0 +1,3 @@
+export declare function passwordProblem(password: string): string | undefined;
+export declare function hashPassword(password: string): Promise<string>;
+export declare function verifyPasswordHash(password: string, stored: string): Promise<boolean>;

package/dist/src/util/password.js

@@ -0,0 +1,29 @@
+import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+const KEY_LENGTH = 32;
+const MIN_LENGTH = 8;
+const MAX_LENGTH = 200;
+function derive(password, salt, length) {
+    return new Promise((resolve, reject) => {
+        scrypt(password, salt, length, (error, key) => error ? reject(error) : resolve(key));
+    });
+}
+export function passwordProblem(password) {
+    if (password.length < MIN_LENGTH || password.length > MAX_LENGTH) {
+        return `the password must be ${MIN_LENGTH} to ${MAX_LENGTH} characters`;
+    }
+}
+export async function hashPassword(password) {
+    const salt = randomBytes(16);
+    const key = await derive(password, salt, KEY_LENGTH);
+    return `scrypt$${salt.toString("hex")}$${key.toString("hex")}`;
+}
+export async function verifyPasswordHash(password, stored) {
+    const [scheme, saltHex, keyHex] = stored.split("$");
+    if (scheme !== "scrypt" || !saltHex || !keyHex)
+        return false;
+    const expected = Buffer.from(keyHex, "hex");
+    if (expected.length === 0)
+        return false;
+    const key = await derive(password, Buffer.from(saltHex, "hex"), expected.length);
+    return timingSafeEqual(key, expected);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "co-maintainer",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Analyzes a GitHub repository and writes repository-specific contribution guidance.",
   "license": "MIT",
   "repository": {