ework-web 0.10.24 → 0.10.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-web",
-  "version": "0.10.24",
+  "version": "0.10.26",
   "type": "module",
   "description": "ework-web — standalone multi-project issue tracker. Local SQLite-backed, no external API dependency. Bun + TypeScript + SSR HTML.",
   "license": "MIT",

package/src/auth-hook.ts

@@ -0,0 +1,81 @@
+import { provisionUser, type UserRow } from "./store";
+
+export interface AuthHookResult {
+  /** Must match /^[A-Za-z0-9_-]{1,64}$/ — enforced for cookie-safety. */
+  login: string;
+  /** If true, user is promoted to site-admin (one-way: never demotes). */
+  isAdmin?: boolean;
+  /** User kind for auto-provisioning. Defaults to "human". */
+  kind?: "human" | "bot" | "system";
+}
+
+export interface AuthProvider {
+  /**
+   * Return user identity or null. Do NOT throw on auth failure —
+   * return null. Exceptions are caught and logged by the caller.
+   */
+  authenticate(req: Request): Promise<AuthHookResult | null>;
+}
+
+const LOGIN_RE = /^[A-Za-z0-9_-]{1,64}$/;
+const hookCache = new Map<string, AuthProvider | null>();
+
+async function loadHook(hookPath: string): Promise<AuthProvider | null> {
+  const cached = hookCache.get(hookPath);
+  if (cached !== undefined) return cached;
+
+  try {
+    const path = await import("node:path");
+    const { pathToFileURL } = await import("node:url");
+    const abs = path.isAbsolute(hookPath) ? hookPath : path.resolve(process.cwd(), hookPath);
+    const mod = await import(pathToFileURL(abs).href);
+    const provider: AuthProvider = mod.default ?? mod;
+    if (!provider || typeof provider.authenticate !== "function") {
+      console.warn(`[auth-hook] ${hookPath}: must export an object with authenticate()`);
+      hookCache.set(hookPath, null);
+      return null;
+    }
+    hookCache.set(hookPath, provider);
+    return provider;
+  } catch (e) {
+    console.warn(`[auth-hook] failed to load ${hookPath}:`, e);
+    hookCache.set(hookPath, null);
+    return null;
+  }
+}
+
+export async function runAuthHook(hookPath: string, req: Request): Promise<UserRow | null> {
+  if (!hookPath) return null;
+
+  const provider = await loadHook(hookPath);
+  if (!provider) return null;
+
+  let result: AuthHookResult | null;
+  try {
+    result = await provider.authenticate(req);
+  } catch (e) {
+    console.warn(`[auth-hook] ${hookPath}: authenticate() threw:`, e);
+    return null;
+  }
+
+  if (!result?.login) return null;
+
+  // v2 cookies split on "." — LOGIN_RE prevents dots/special chars that
+  // would break the split or enable cookie injection.
+  if (!LOGIN_RE.test(result.login)) {
+    console.warn(`[auth-hook] ${hookPath}: invalid login format (must match ${LOGIN_RE})`);
+    return null;
+  }
+
+  const user = await provisionUser(result.login, {
+    kind: result.kind ?? "human",
+    isAdmin: result.isAdmin ?? false,
+  });
+
+  if (!user.is_active) return null;
+  return user;
+}
+
+export function clearAuthHookCache(): void {
+  hookCache.clear();
+}

package/src/auth.ts

@@ -1,5 +1,6 @@
 import type { Config } from "./config";
 import { getUserByLogin, ensureUser, verifyPat, type UserRow } from "./store";
+import { runAuthHook } from "./auth-hook";
 
 // Per-user token-cookie auth. Cookie value is HMAC-signed and carries login +
 // issued-at, so the server is stateless (no session table). Two cookie formats
@@ -135,6 +136,18 @@ export async function checkAuth(req: Request, cfg: Config, ip?: string | null):
     }
   }
 
+  // Internal auth hook (daemon / machine-to-machine — permanent credentials).
+  if (cfg.internalAuthHook) {
+    const user = await runAuthHook(cfg.internalAuthHook, req);
+    if (user) return { ok: true, user };
+  }
+
+  // User auth hook (human users — may expire, e.g. SSO/OAuth sessions).
+  if (cfg.userAuthHook) {
+    const user = await runAuthHook(cfg.userAuthHook, req);
+    if (user) return { ok: true, user };
+  }
+
   return { ok: false, user: null };
 }
 

package/src/config.ts

@@ -79,6 +79,8 @@ export const configSchema = z.object({
   daemonWebhookUrl: z.string().default(""),
   daemonWebhookSecret: z.string().default(""),
   routerAdminToken: z.string().default(""),
+  internalAuthHook: z.string().default(""),
+  userAuthHook: z.string().default(""),
   // Default "provider/model" string passed to `opencode run --model <X>`.
   // Empty = let opencode pick per its own opencode.json + env. ework-daemon
   // pushes this (or the per-project override) on every spawn to defend
@@ -178,7 +180,9 @@ export async function loadConfig(): Promise<Config> {
     daemonBotLogin: process.env.WORK_DAEMON_BOT_LOGIN ?? "",
   daemonWebhookUrl: process.env.WORK_DAEMON_WEBHOOK_URL ?? "",
   daemonWebhookSecret: process.env.WORK_DAEMON_WEBHOOK_SECRET ?? "",
-  routerAdminToken: process.env.WORK_ROUTER_ADMIN_TOKEN ?? "",
+    routerAdminToken: process.env.WORK_ROUTER_ADMIN_TOKEN ?? "",
+    internalAuthHook: process.env.WORK_INTERNAL_AUTH_HOOK ?? "",
+    userAuthHook: process.env.WORK_USER_AUTH_HOOK ?? "",
     defaultModel: db.defaultModel ?? process.env.WORK_DEFAULT_MODEL,
     autowireActive: process.env.WORK_AUTOWIRE_ACTIVE !== "false",
     webhookMaxConcurrent: Number(process.env.WORK_WEBHOOK_MAX_CONCURRENT ?? "6"),

package/src/index.ts

@@ -454,6 +454,8 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
   if (url.pathname === "/static/app.js") return staticAsset("app.js", "text/javascript; charset=utf-8", req);
   if (url.pathname === "/static/db-wizard.js") return staticAsset("db-wizard.js", "text/javascript; charset=utf-8", req);
   if (url.pathname === "/static/daemon-mgr.js") return staticAsset("daemon-mgr.js", "text/javascript; charset=utf-8", req);
+  if (url.pathname === "/static/daemon-groups.js") return staticAsset("daemon-groups.js", "text/javascript; charset=utf-8", req);
+  if (url.pathname === "/static/label-picker.js") return staticAsset("label-picker.js", "text/javascript; charset=utf-8", req);
   if (url.pathname === "/static/session.js") return staticAsset("session.js", "text/javascript; charset=utf-8", req);
   if (url.pathname === "/static/file.js") return staticAsset("file.js", "text/javascript; charset=utf-8", req);
   if (url.pathname === "/static/tts.js") return staticAsset("tts.js", "text/javascript; charset=utf-8", req);

package/src/store.ts

@@ -138,6 +138,22 @@ export async function ensureUser(login: string, kind: UserKind = "human"): Promi
   };
 }
 
+export async function provisionUser(
+  login: string,
+  opts: { kind?: UserKind; isAdmin?: boolean },
+): Promise<UserRow> {
+  const user = await ensureUser(login, opts.kind ?? "human");
+  if (opts.isAdmin && !user.is_admin) {
+    const db = getDB();
+    await db.run("UPDATE {{users}} SET is_admin = 1, updated_at = ? WHERE login = ?", [
+      now(),
+      login,
+    ]);
+    return { ...user, is_admin: 1 };
+  }
+  return user;
+}
+
 export async function getProject(owner: string, name: string): Promise<ProjectRow | null> {
   return (await getDB().get<ProjectRow>("SELECT * FROM {{projects}} WHERE owner = ? AND name = ?", [owner, name])) ?? null;
 }