fest-gateway 0.1.0

package/dist/server/api/oauth.js

@@ -0,0 +1,300 @@
+/**
+ * `/api/auth/oauth/*`: Google/GitHub sign-in, and `/api/auth/identity`.
+ *
+ * A GET-only surface, unlike the rest of `/api/auth/*` — the whole flow is a
+ * sequence of browser redirects, so there is no JSON body to receive and no
+ * Origin header to check (the provider's redirect back is a cross-site
+ * top-level navigation by definition, which is also why the state/verifier
+ * cookies below are `SameSite=Lax`, not `Strict`: a Strict cookie would not
+ * survive that navigation and every callback would fail state validation).
+ *
+ * One flow serves two callers, distinguished by whether `start` was called
+ * with `cli_redirect_uri`:
+ *   - dashboard: `start` -> provider -> `callback` -> session cookie -> `/`.
+ *   - CLI (`fest login`): `start?cli_redirect_uri=http://127.0.0.1:<port>/callback`
+ *     -> provider -> `callback` -> a freshly minted identity token -> redirect
+ *     to the CLI's own loopback server, which is what captures it.
+ *
+ * `/api/auth/identity` is separate from both: it's how `fest whoami` asks
+ * "is my token still good", authenticated the same way the proxy path is
+ * (`Authorization: Bearer` or `X-Fest-Token`), not by cookie.
+ */
+import { generateState, generateCodeVerifier } from "arctic";
+import { googleProvider, githubProvider, emailDomainAllowed } from "../auth/oauth.js";
+import { ensureUser } from "../store/bootstrap.js";
+import { normaliseEmail, hasAnyOwner } from "../auth/accounts.js";
+import { createSession, serializeCookie, parseCookies, ABSOLUTE_MS } from "../auth/session.js";
+import { createToken, resolveToken } from "../store/tokens.js";
+import { recordAudit } from "../store/audit.js";
+import { clientIp } from "../auth/guard.js";
+import { log } from "../log.js";
+const STATE_COOKIE = "fest_oauth_state";
+const VERIFIER_COOKIE = "fest_oauth_verifier";
+const CLI_REDIRECT_COOKIE = "fest_oauth_cli_redirect";
+const OAUTH_COOKIE_PATH = "/api/auth/oauth";
+const OAUTH_COOKIE_MAX_AGE_S = 600;
+function json(res, status, body) {
+    res.writeHead(status, { "content-type": "application/json", "cache-control": "no-store" });
+    res.end(JSON.stringify(body));
+}
+function oauthCookie(name, value, secure) {
+    const parts = [
+        `${name}=${encodeURIComponent(value)}`,
+        `Path=${OAUTH_COOKIE_PATH}`,
+        "HttpOnly",
+        "SameSite=Lax",
+        `Max-Age=${OAUTH_COOKIE_MAX_AGE_S}`,
+    ];
+    if (secure)
+        parts.push("Secure");
+    return parts.join("; ");
+}
+function clearOauthCookie(name, secure) {
+    const parts = [`${name}=`, `Path=${OAUTH_COOKIE_PATH}`, "HttpOnly", "SameSite=Lax", "Max-Age=0"];
+    if (secure)
+        parts.push("Secure");
+    return parts.join("; ");
+}
+/** Only ever a loopback URL: this cookie controls where a live identity token gets redirected. */
+function isLoopbackRedirect(raw) {
+    try {
+        const u = new URL(raw);
+        return u.protocol === "http:" && (u.hostname === "127.0.0.1" || u.hostname === "localhost");
+    }
+    catch {
+        return false;
+    }
+}
+async function fetchGoogleEmail(accessToken) {
+    const res = await fetch("https://openidconnect.googleapis.com/v1/userinfo", {
+        headers: { authorization: `Bearer ${accessToken}` },
+    });
+    if (!res.ok)
+        throw new Error(`google userinfo: HTTP ${res.status}`);
+    const body = (await res.json());
+    if (typeof body.email !== "string" || body.email_verified !== true) {
+        throw new Error("google account has no verified email");
+    }
+    return body.email;
+}
+async function fetchGithubEmail(accessToken) {
+    const res = await fetch("https://api.github.com/user/emails", {
+        headers: {
+            authorization: `Bearer ${accessToken}`,
+            "user-agent": "fest",
+            accept: "application/vnd.github+json",
+        },
+    });
+    if (!res.ok)
+        throw new Error(`github emails: HTTP ${res.status}`);
+    const rows = (await res.json());
+    const primary = rows.find((r) => r.primary && r.verified);
+    if (primary === undefined)
+        throw new Error("github account has no verified primary email");
+    return primary.email;
+}
+async function start(req, res, provider, deps) {
+    const cfg = deps.config;
+    if (cfg.allowedEmailDomains.length === 0) {
+        json(res, 503, { error: "OAuth sign-in is disabled: FEST_ALLOWED_EMAIL_DOMAINS is unset" });
+        return;
+    }
+    const url = new URL(req.url ?? "/", "http://internal");
+    const cliRedirect = url.searchParams.get("cli_redirect_uri");
+    if (cliRedirect !== null && !isLoopbackRedirect(cliRedirect)) {
+        json(res, 400, { error: "cli_redirect_uri must be http://127.0.0.1 or http://localhost" });
+        return;
+    }
+    const state = generateState();
+    const cookies = [oauthCookie(STATE_COOKIE, state, cfg.secureCookies)];
+    let authUrl;
+    if (provider === "google") {
+        const built = googleProvider(cfg);
+        if (built === null) {
+            json(res, 404, { error: "google sign-in is not configured" });
+            return;
+        }
+        const verifier = generateCodeVerifier();
+        cookies.push(oauthCookie(VERIFIER_COOKIE, verifier, cfg.secureCookies));
+        authUrl = built.createAuthorizationURL(state, verifier, ["openid", "profile", "email"]);
+    }
+    else {
+        const built = githubProvider(cfg);
+        if (built === null) {
+            json(res, 404, { error: "github sign-in is not configured" });
+            return;
+        }
+        authUrl = built.createAuthorizationURL(state, ["user:email"]);
+    }
+    if (cliRedirect !== null)
+        cookies.push(oauthCookie(CLI_REDIRECT_COOKIE, cliRedirect, cfg.secureCookies));
+    res.setHeader("set-cookie", cookies);
+    res.writeHead(302, { location: authUrl.toString() });
+    res.end();
+}
+async function callback(req, res, provider, deps) {
+    const cfg = deps.config;
+    const cookies = parseCookies(req.headers.cookie);
+    const cliRedirect = cookies[CLI_REDIRECT_COOKIE] ?? null;
+    const clearCookies = [
+        clearOauthCookie(STATE_COOKIE, cfg.secureCookies),
+        clearOauthCookie(VERIFIER_COOKIE, cfg.secureCookies),
+        clearOauthCookie(CLI_REDIRECT_COOKIE, cfg.secureCookies),
+    ];
+    const fail = (message) => {
+        res.setHeader("set-cookie", clearCookies);
+        const location = cliRedirect !== null ? `${cliRedirect}?error=${encodeURIComponent(message)}` : `/?auth_error=${encodeURIComponent(message)}`;
+        res.writeHead(302, { location });
+        res.end();
+    };
+    const url = new URL(req.url ?? "/", "http://internal");
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    const expectedState = cookies[STATE_COOKIE];
+    if (code === null || state === null || expectedState === undefined || state !== expectedState) {
+        fail("invalid or expired sign-in attempt");
+        return;
+    }
+    let email;
+    try {
+        if (provider === "google") {
+            const built = googleProvider(cfg);
+            if (built === null) {
+                fail("google sign-in is not configured");
+                return;
+            }
+            const verifier = cookies[VERIFIER_COOKIE];
+            if (verifier === undefined) {
+                fail("invalid or expired sign-in attempt");
+                return;
+            }
+            const tokens = await built.validateAuthorizationCode(code, verifier);
+            email = await fetchGoogleEmail(tokens.accessToken());
+        }
+        else {
+            const built = githubProvider(cfg);
+            if (built === null) {
+                fail("github sign-in is not configured");
+                return;
+            }
+            const tokens = await built.validateAuthorizationCode(code);
+            email = await fetchGithubEmail(tokens.accessToken());
+        }
+    }
+    catch (err) {
+        log.warn("oauth callback failed", { provider, error: String(err).slice(0, 200) });
+        fail("sign-in failed");
+        return;
+    }
+    const normalised = normaliseEmail(email);
+    const ip = clientIp(req);
+    if (!emailDomainAllowed(cfg, normalised)) {
+        recordAudit(deps.store, {
+            orgId: deps.orgId,
+            actorLabel: normalised,
+            action: "auth.oauth_login",
+            outcome: "denied",
+            detail: { provider, reason: "domain_not_allowed" },
+            ip,
+        });
+        fail("this email domain is not permitted to sign in");
+        return;
+    }
+    const user = ensureUser(deps.store, { orgId: deps.orgId, email: normalised });
+    if (cliRedirect !== null) {
+        const created = createToken(deps.store, { orgId: deps.orgId, userId: user.id, name: "cli-login" });
+        recordAudit(deps.store, {
+            orgId: deps.orgId,
+            actorUserId: user.id,
+            actorLabel: user.email,
+            action: "auth.oauth_login",
+            target: created.id,
+            outcome: "ok",
+            detail: { provider, mode: "cli" },
+            ip,
+        });
+        res.setHeader("set-cookie", clearCookies);
+        res.writeHead(302, {
+            location: `${cliRedirect}?token=${encodeURIComponent(created.raw)}&email=${encodeURIComponent(user.email)}`,
+        });
+        res.end();
+        return;
+    }
+    // Dashboard, not CLI: the first person to complete a sign-in while nobody
+    // has claimed this deployment yet claims it, exactly as if they had run
+    // `fest admin create` from the host — this OAuth path exists specifically
+    // so that command is no longer the only way in. Never done on the CLI
+    // token-minting branch above: a `fest login` should never be able to grant
+    // dashboard ownership as a side effect.
+    let owner = user;
+    if (!hasAnyOwner(deps.store, deps.orgId)) {
+        deps.store.db.prepare(`UPDATE users SET role = 'owner' WHERE id = ?`).run(user.id);
+        owner = { ...user, role: "owner" };
+    }
+    const created = createSession(deps.store, {
+        orgId: deps.orgId,
+        userId: owner.id,
+        userAgent: String(req.headers["user-agent"] ?? ""),
+        ip,
+    });
+    recordAudit(deps.store, {
+        orgId: deps.orgId,
+        actorUserId: owner.id,
+        actorLabel: owner.email,
+        action: "auth.oauth_login",
+        target: created.sessionId,
+        outcome: "ok",
+        detail: { provider, mode: "dashboard", role: owner.role },
+        ip,
+    });
+    res.setHeader("set-cookie", [
+        ...clearCookies,
+        serializeCookie(created.raw, { secure: cfg.secureCookies, maxAgeSeconds: Math.floor(ABSOLUTE_MS / 1000) }),
+    ]);
+    // The dashboard root as the browser sees it, which is not `/` when Fest is
+    // mounted under a path — redirecting there would leave the prefix behind.
+    res.writeHead(302, { location: `${cfg.basePath}/` });
+    res.end();
+}
+async function identity(req, res, deps) {
+    if ((req.method ?? "GET") !== "GET") {
+        json(res, 405, { error: "method not allowed" });
+        return;
+    }
+    const auth = req.headers.authorization;
+    const bearer = typeof auth === "string" && auth.startsWith("Bearer ") ? auth.slice(7) : null;
+    const headerToken = req.headers["x-fest-token"];
+    const raw = bearer ?? (typeof headerToken === "string" ? headerToken : null);
+    const resolved = resolveToken(deps.store, raw);
+    if (resolved === null) {
+        json(res, 401, { error: "invalid or revoked token" });
+        return;
+    }
+    const row = deps.store.db.prepare(`SELECT email FROM users WHERE id = ?`).get(resolved.userId);
+    json(res, 200, { email: row?.email ?? "", orgId: resolved.orgId });
+}
+const ROUTE = /^\/api\/auth\/oauth\/(google|github)\/(start|callback)$/;
+/** Handles `/api/auth/oauth/*` and `/api/auth/identity`. Returns false when the path is not ours. */
+export async function handleOauth(req, res, path, deps) {
+    if (path === "/api/auth/identity") {
+        await identity(req, res, deps);
+        return true;
+    }
+    const m = ROUTE.exec(path);
+    if (m === null)
+        return false;
+    if ((req.method ?? "GET") !== "GET") {
+        json(res, 405, { error: "method not allowed" });
+        return true;
+    }
+    const provider = m[1];
+    const step = m[2];
+    if (step === "start") {
+        await start(req, res, provider, deps);
+    }
+    else {
+        await callback(req, res, provider, deps);
+    }
+    return true;
+}
+//# sourceMappingURL=oauth.js.map

package/dist/server/api/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../server/api/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAG7D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtF,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAQhC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AACxC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAC9C,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AACtD,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAC5C,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3F,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa,EAAE,MAAe;IAC/D,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QACtC,QAAQ,iBAAiB,EAAE;QAC3B,UAAU;QACV,cAAc;QACd,WAAW,sBAAsB,EAAE;KACpC,CAAC;IACF,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAe;IACrD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,QAAQ,iBAAiB,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IACjG,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,kGAAkG;AAClG,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,WAAmB;IACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,kDAAkD,EAAE;QAC1E,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiD,CAAC;IAChF,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,WAAmB;IACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oCAAoC,EAAE;QAC5D,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,WAAW,EAAE;YACtC,YAAY,EAAE,MAAM;YACpB,MAAM,EAAE,6BAA6B;SACtC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkE,CAAC;IACjG,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC3F,OAAO,OAAO,CAAC,KAAK,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,KAAK,CAClB,GAAoB,EACpB,GAAmB,EACnB,QAAuB,EACvB,IAAe;IAEf,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACxB,IAAI,GAAG,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gEAAgE,EAAE,CAAC,CAAC;QAC5F,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC7D,IAAI,WAAW,KAAK,IAAI,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,+DAA+D,EAAE,CAAC,CAAC;QAC3F,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,CAAC,WAAW,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAEtE,IAAI,OAAY,CAAC;IACjB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,EAAE,QAAQ,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;QACxE,OAAO,GAAG,KAAK,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1F,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,OAAO,GAAG,KAAK,CAAC,sBAAsB,CAAC,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAEzG,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACrD,GAAG,CAAC,GAAG,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,GAAoB,EACpB,GAAmB,EACnB,QAAuB,EACvB,IAAe;IAEf,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACxB,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC;IACzD,MAAM,YAAY,GAAG;QACnB,gBAAgB,CAAC,YAAY,EAAE,GAAG,CAAC,aAAa,CAAC;QACjD,gBAAgB,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,CAAC;QACpD,gBAAgB,CAAC,mBAAmB,EAAE,GAAG,CAAC,aAAa,CAAC;KACzD,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,OAAe,EAAQ,EAAE;QACrC,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAC1C,MAAM,QAAQ,GACZ,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,WAAW,UAAU,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/H,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjC,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE5C,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,aAAa,KAAK,SAAS,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QAC9F,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IAED,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,IAAI,CAAC,kCAAkC,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC,oCAAoC,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,yBAAyB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACrE,KAAK,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,IAAI,CAAC,kCAAkC,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;YAC3D,KAAK,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACvB,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAEzB,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC;QACzC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE;YACtB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,UAAU;YACtB,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE;YAClD,EAAE;SACH,CAAC,CAAC;QACH,IAAI,CAAC,+CAA+C,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAE9E,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACnG,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE;YACtB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,EAAE;YACpB,UAAU,EAAE,IAAI,CAAC,KAAK;YACtB,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,OAAO,CAAC,EAAE;YAClB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;YACjC,EAAE;SACH,CAAC,CAAC;QACH,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAC1C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,QAAQ,EAAE,GAAG,WAAW,UAAU,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;SAC5G,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,sEAAsE;IACtE,2EAA2E;IAC3E,wCAAwC;IACxC,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnF,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACrC,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE;QACxC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,KAAK,CAAC,EAAE;QAChB,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAClD,EAAE;KACH,CAAC,CAAC;IACH,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE;QACtB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,WAAW,EAAE,KAAK,CAAC,EAAE;QACrB,UAAU,EAAE,KAAK,CAAC,KAAK;QACvB,MAAM,EAAE,kBAAkB;QAC1B,MAAM,EAAE,OAAO,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;QACzD,EAAE;KACH,CAAC,CAAC;IACH,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE;QAC1B,GAAG,YAAY;QACf,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC;KAC3G,CAAC,CAAC;IACH,2EAA2E;IAC3E,0EAA0E;IAC1E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC;IACrD,GAAG,CAAC,GAAG,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAoB,EAAE,GAAmB,EAAE,IAAe;IAChF,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QACpC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAEhF,CAAC;IACd,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,KAAK,GAAG,yDAAyD,CAAC;AAExE,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAoB,EACpB,GAAmB,EACnB,IAAY,EACZ,IAAe;IAEf,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAClC,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAE7B,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QACpC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAkB,CAAC;IACvC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAyB,CAAC;IAC1C,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/server/api/routes.js

@@ -0,0 +1,164 @@
+/**
+ * JSON API for the dashboard.
+ *
+ * Phase 3 (Vite + React + TanStack Query) consumes these. Kept deliberately
+ * thin: every endpoint is a direct projection of one function in
+ * `store/queries.ts`, which is where org/member scoping is enforced. No handler
+ * builds SQL, so a forgotten filter in a route cannot leak another tenant's
+ * data.
+ *
+ * Authentication is decided before this file runs (see auth/guard.ts) and the
+ * result arrives as `scope`. Every query takes that scope explicitly, so there
+ * is no ambient "current org" a handler could forget to apply.
+ */
+import { listRequests, usageTotals, usageByUser, usageByModel, usageByCredentialOrigin, usageSeries, errorBreakdown, latencySummary, latestQuotaByUser, } from "../store/queries.js";
+import { explainRoutes } from "./routing-view.js";
+import { ADAPTER_TRANSFORMS } from "../adapters/registry.js";
+import { handleLive } from "./live.js";
+import { listAudit } from "../store/audit.js";
+const DEFAULT_RANGE_MS = 24 * 3_600_000;
+const MAX_RANGE_MS = 400 * 86_400_000;
+function intParam(params, name) {
+    const raw = params.get(name);
+    if (raw === null || raw.trim() === "")
+        return undefined;
+    const n = Number(raw);
+    return Number.isFinite(n) ? Math.trunc(n) : undefined;
+}
+/**
+ * Ranges come from a query string, so they are clamped rather than trusted: an
+ * absurd `fromMs` would otherwise turn a dashboard refresh into a full-table
+ * scan, and on single-writer SQLite that stalls the metering flush behind it.
+ */
+export function parseRange(params, now = Date.now()) {
+    const toMs = intParam(params, "to") ?? now;
+    const fromRaw = intParam(params, "from") ?? toMs - DEFAULT_RANGE_MS;
+    const fromMs = Math.max(fromRaw, toMs - MAX_RANGE_MS);
+    return { fromMs: Math.min(fromMs, toMs), toMs };
+}
+function strParam(params, name) {
+    const raw = params.get(name);
+    return raw === null || raw.trim() === "" ? undefined : raw;
+}
+function json(res, status, body) {
+    const payload = JSON.stringify(body);
+    res.writeHead(status, {
+        "content-type": "application/json",
+        "cache-control": "no-store",
+    });
+    res.end(payload);
+}
+/**
+ * Handle an `/api/*` request. Returns false when the path is not ours, so the
+ * caller can fall through to its own 404.
+ */
+export function handleApi(req, res, path, deps) {
+    if (!path.startsWith("/api/"))
+        return false;
+    if ((req.method ?? "GET") !== "GET") {
+        json(res, 405, { error: "method not allowed" });
+        return true;
+    }
+    const url = new URL(req.url ?? "/", "http://fest.local");
+    const params = url.searchParams;
+    const range = parseRange(params);
+    const scope = deps.scope;
+    // SSE, so it owns its own response lifecycle and must not fall through to
+    // the JSON writer below.
+    if (path === "/api/live") {
+        handleLive(req, res, deps.bus);
+        return true;
+    }
+    switch (path) {
+        case "/api/overview":
+            json(res, 200, {
+                range,
+                totals: usageTotals(deps.store, scope, range),
+                series: usageSeries(deps.store, scope, range),
+                byCredentialOrigin: usageByCredentialOrigin(deps.store, scope, range),
+                latency: latencySummary(deps.store, scope, range),
+                sink: deps.sink.stats(),
+            });
+            return true;
+        case "/api/requests": {
+            const filter = {
+                ...(strParam(params, "userId") !== undefined ? { userId: strParam(params, "userId") } : {}),
+                ...(strParam(params, "model") !== undefined ? { servedModel: strParam(params, "model") } : {}),
+                ...(strParam(params, "credentialOrigin") !== undefined
+                    ? { credentialOrigin: strParam(params, "credentialOrigin") }
+                    : {}),
+                ...(strParam(params, "sessionId") !== undefined ? { sessionId: strParam(params, "sessionId") } : {}),
+                ...(params.get("errorsOnly") === "1" ? { errorsOnly: true } : {}),
+                ...(intParam(params, "before") !== undefined ? { beforeSeq: intParam(params, "before") } : {}),
+                ...(intParam(params, "limit") !== undefined ? { limit: intParam(params, "limit") } : {}),
+            };
+            json(res, 200, listRequests(deps.store, scope, filter));
+            return true;
+        }
+        case "/api/users":
+            json(res, 200, { range, rows: usageByUser(deps.store, scope, range) });
+            return true;
+        case "/api/models":
+            json(res, 200, { range, rows: usageByModel(deps.store, scope, range) });
+            return true;
+        case "/api/errors":
+            json(res, 200, {
+                range,
+                rows: errorBreakdown(deps.store, scope, range),
+                latency: latencySummary(deps.store, scope, range),
+            });
+            return true;
+        // For a subscription developer this, not cost, is the scarce resource.
+        // The routing table, so an operator can see what Fest will do without
+        // reading the config file on the server. No secret can appear here: the
+        // table holds references, not values.
+        case "/api/routing":
+            json(res, 200, {
+                version: deps.routes.version,
+                enabled: deps.routes.routes.length > 0,
+                upstreams: [...deps.routes.upstreams.values()].map((u) => ({
+                    id: u.id,
+                    adapter: u.adapter,
+                    baseUrl: u.baseUrl,
+                    credentialSource: u.credential.source,
+                    credentialPresent: deps.secrets.resolve(u.credential) !== null,
+                    transforms: ADAPTER_TRANSFORMS[u.adapter] ?? [],
+                })),
+                // Already in evaluation order, each row carrying what it claims and
+                // what it adds — see `routing-view.ts` for why the dashboard is not
+                // left to infer either from the pattern.
+                routes: explainRoutes(deps.routes).map(({ route, shadows, outranked, menuIds }) => ({
+                    id: route.id,
+                    match: route.match,
+                    upstream: route.upstream,
+                    model: route.model,
+                    expose: route.expose,
+                    shadows,
+                    outranked,
+                    menuIds,
+                })),
+            });
+            return true;
+        // Admin-only. A member can see the traffic they are part of; who was
+        // granted console access, and whose login failed, is not that.
+        case "/api/audit": {
+            if (scope.role === "member") {
+                json(res, 403, { error: "admin access required" });
+                return true;
+            }
+            const opts = {
+                ...(intParam(params, "limit") !== undefined ? { limit: intParam(params, "limit") } : {}),
+                ...(intParam(params, "before") !== undefined ? { beforeSeq: intParam(params, "before") } : {}),
+            };
+            json(res, 200, { rows: listAudit(deps.store, scope.orgId, opts) });
+            return true;
+        }
+        case "/api/quota":
+            json(res, 200, { rows: latestQuotaByUser(deps.store, scope) });
+            return true;
+        default:
+            json(res, 404, { error: `no such endpoint: ${path}` });
+            return true;
+    }
+}
+//# sourceMappingURL=routes.js.map

package/dist/server/api/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../server/api/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,EACL,YAAY,EACZ,WAAW,EACX,WAAW,EACX,YAAY,EACZ,uBAAuB,EACvB,WAAW,EACX,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAY9C,MAAM,gBAAgB,GAAG,EAAE,GAAG,SAAS,CAAC;AACxC,MAAM,YAAY,GAAG,GAAG,GAAG,UAAU,CAAC;AAEtC,SAAS,QAAQ,CAAC,MAAuB,EAAE,IAAY;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,MAAuB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC;IAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,IAAI,GAAG,gBAAgB,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,GAAG,YAAY,CAAC,CAAC;IACtD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,QAAQ,CAAC,MAAuB,EAAE,IAAY;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;AAC7D,CAAC;AAgBD,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,kBAAkB;QAClC,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CACvB,GAAoB,EACpB,GAAmB,EACnB,IAAY,EACZ,IAAa;IAEb,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QACpC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,mBAAmB,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC;IAChC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAEzB,0EAA0E;IAC1E,yBAAyB;IACzB,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,eAAe;YAClB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACb,KAAK;gBACL,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;gBAC7C,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;gBAC7C,kBAAkB,EAAE,uBAAuB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;gBACrE,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;gBACjD,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE;aACG,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC;QAEd,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,MAAM,GAAG;gBACb,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3F,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9F,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC,KAAK,SAAS;oBACpD,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAAE;oBAC5D,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9F,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzF,CAAC;YACF,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAA4B,CAAC,CAAC;YACnF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,YAAY;YACf,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAA0B,CAAC,CAAC;YAC/F,OAAO,IAAI,CAAC;QAEd,KAAK,aAAa;YAChB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAA2B,CAAC,CAAC;YACjG,OAAO,IAAI,CAAC;QAEd,KAAK,aAAa;YAChB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACb,KAAK;gBACL,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;gBAC9C,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;aACzB,CAAC,CAAC;YAC5B,OAAO,IAAI,CAAC;QAEd,uEAAuE;QACvE,sEAAsE;QACtE,wEAAwE;QACxE,sCAAsC;QACtC,KAAK,cAAc;YACjB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACb,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;gBAC5B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;gBACtC,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACzD,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,gBAAgB,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM;oBACrC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI;oBAC9D,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE;iBAChD,CAAC,CAAC;gBACH,oEAAoE;gBACpE,oEAAoE;gBACpE,yCAAyC;gBACzC,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;oBAClF,EAAE,EAAE,KAAK,CAAC,EAAE;oBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,OAAO;oBACP,SAAS;oBACT,OAAO;iBACR,CAAC,CAAC;aACsB,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QAEd,qEAAqE;QACrE,+DAA+D;QAC/D,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;gBACnD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG;gBACX,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxF,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/F,CAAC;YACF,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,EAA0B,CAAC,CAAC;YAC3F,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,YAAY;YACf,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAA0B,CAAC,CAAC;YACvF,OAAO,IAAI,CAAC;QAEd;YACE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,IAAI,EAAE,EAAE,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/server/api/routing-view.js

@@ -0,0 +1,47 @@
+/**
+ * The routing table, explained for a reader rather than for the router.
+ *
+ * A routing file does two quite different things with the same syntax, and
+ * conflating them is how an operator misreads their own config:
+ *
+ *  - it **substitutes** — a model the developer already has a name for now
+ *    comes from somewhere else, on a credential the server holds;
+ *  - it **adds** — an id that exists nowhere but this gateway appears in the
+ *    `/model` menu, and choosing it is a deliberate act.
+ *
+ * The first is the one that needs watching. The second is a feature. A single
+ * table of `match → upstream` rows shows both as the same kind of line.
+ *
+ * Both classifications are derived by ASKING the real resolver and the real
+ * menu builder, never by re-reading the pattern here. Pattern-reading would
+ * ignore precedence: `claude-*` looks like it claims Opus right up until an
+ * exact `claude-opus-5` rule sits above it, and a dashboard that said
+ * otherwise would be confidently wrong in exactly the case an operator checks.
+ */
+import { claimsModel, evaluationOrder, resolveRoute } from "../routes/resolve.js";
+import { buildModelMenu } from "./models.js";
+import { BASE_MODELS } from "../../shared/base-models.js";
+/** Routes in evaluation order, each with what it claims and what it adds. */
+export function explainRoutes(table) {
+    const baseIds = new Set(BASE_MODELS.map((m) => m.id));
+    // What the client would actually be shown. An id Fest cannot serve in the key
+    // posture is not in here, and must not be reported as a model this gateway
+    // adds — the menu is a promise, and so is this screen.
+    const menu = new Set(buildModelMenu(table).map((e) => e.id));
+    return evaluationOrder(table).map((route) => {
+        const shadows = [];
+        const outranked = [];
+        for (const { id } of BASE_MODELS) {
+            if (!claimsModel(route, id))
+                continue;
+            const winner = resolveRoute(table, id).route;
+            if (winner === route)
+                shadows.push(id);
+            else if (winner !== null)
+                outranked.push({ model: id, takenBy: winner.id });
+        }
+        const menuIds = [route.match.includes("*") ? null : route.match, route.expose].filter((id) => id !== null && !baseIds.has(id) && menu.has(id));
+        return { route, shadows, outranked, menuIds };
+    });
+}
+//# sourceMappingURL=routing-view.js.map

package/dist/server/api/routing-view.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routing-view.js","sourceRoot":"","sources":["../../../server/api/routing-view.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAoB1D,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,8EAA8E;IAC9E,2EAA2E;IAC3E,uDAAuD;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAE7D,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAyC,EAAE,CAAC;QAC3D,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,WAAW,EAAE,CAAC;YACjC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC;gBAAE,SAAS;YACtC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;YAC7C,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;iBAClC,IAAI,MAAM,KAAK,IAAI;gBAAE,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CACnF,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CACtE,CAAC;QAEF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/auth/accounts.js

@@ -0,0 +1,111 @@
+/**
+ * Dashboard accounts: granting sign-in, and checking a sign-in attempt.
+ *
+ * A `users` row is an attribution target — `fest token create` makes one for
+ * every developer so their usage has somewhere to land. Being able to sign in
+ * to the console is a *separate* grant, represented by a non-null
+ * `password_hash`. Nobody acquires an admin console account as a side effect of
+ * being metered.
+ */
+import { ensureUser, findUserByEmail } from "../store/bootstrap.js";
+import { hashPassword, verifyPassword, needsRehash, validatePassword } from "./password.js";
+import { revokeUserSessions } from "./session.js";
+/** Normalised so `Ada@Corp.test` and `ada@corp.test` are the same account. */
+export const normaliseEmail = (email) => email.trim().toLowerCase();
+/**
+ * Is this deployment claimed?
+ *
+ * Deliberately not "has a password": an owner claimed via OAuth (see
+ * `server/api/oauth.ts`) never gets a `password_hash` at all, and the whole
+ * point of that self-service path is to satisfy this same check — so tying it
+ * to password auth specifically would leave Fest refusing to bind on any
+ * non-loopback interface even after someone had legitimately claimed it.
+ * Ownership is a role, not an auth method.
+ */
+export function hasAnyOwner(store, orgId) {
+    const row = store.db
+        .prepare(`SELECT 1 AS present FROM users
+        WHERE org_id = ? AND role = 'owner' AND disabled_at IS NULL
+        LIMIT 1`)
+        .get(orgId);
+    return row !== undefined;
+}
+export function countDashboardAccounts(store, orgId) {
+    const row = store.db
+        .prepare(`SELECT COUNT(*) AS n FROM users WHERE org_id = ? AND password_hash IS NOT NULL`)
+        .get(orgId);
+    return Number(row?.n ?? 0);
+}
+/**
+ * Grant or re-grant console access. Idempotent on (org, email).
+ *
+ * Every password change revokes that user's existing sessions. A password is
+ * changed because it may be known to someone else; leaving their cookies
+ * working would make the change ceremonial.
+ */
+export async function grantDashboardAccess(store, args) {
+    const problem = validatePassword(args.password);
+    if (problem !== null)
+        throw new Error(problem);
+    const email = normaliseEmail(args.email);
+    const user = ensureUser(store, {
+        orgId: args.orgId,
+        email,
+        role: args.role ?? "admin",
+        ...(args.displayName === undefined ? {} : { displayName: args.displayName }),
+    });
+    const encoded = await hashPassword(args.password);
+    store.db
+        .prepare(`UPDATE users SET password_hash = ?, password_set_at = ?, role = ? WHERE id = ?`)
+        .run(encoded, Date.now(), args.role ?? user.role, user.id);
+    revokeUserSessions(store, user.id);
+    return { ...user, role: args.role ?? user.role };
+}
+/**
+ * Check an email/password pair.
+ *
+ * A miss still runs one scrypt over a dummy hash. Without it, "no such account"
+ * returns in microseconds while a real account takes ~100ms, which enumerates
+ * valid emails from a stopwatch.
+ */
+export async function authenticate(store, orgId, email, password) {
+    const row = store.db
+        .prepare(`SELECT id, org_id, email, role, password_hash, disabled_at
+         FROM users WHERE org_id = ? AND email = ?`)
+        .get(orgId, normaliseEmail(email));
+    if (row === undefined || row.password_hash === null) {
+        await verifyPassword(password, await timingEqualiser());
+        return { ok: false, user: null, reason: row === undefined ? "no_such_account" : "no_password" };
+    }
+    if (row.disabled_at !== null) {
+        await verifyPassword(password, await timingEqualiser());
+        return { ok: false, user: null, reason: "disabled" };
+    }
+    const ok = await verifyPassword(password, row.password_hash);
+    if (!ok)
+        return { ok: false, user: null, reason: "bad_password" };
+    // Opportunistic upgrade: the only moment the plaintext is available with the
+    // user's consent is a successful login.
+    if (needsRehash(row.password_hash)) {
+        const upgraded = await hashPassword(password);
+        store.db.prepare(`UPDATE users SET password_hash = ? WHERE id = ?`).run(upgraded, row.id);
+    }
+    return {
+        ok: true,
+        user: { id: row.id, orgId: row.org_id, email: row.email, role: row.role },
+        reason: "ok",
+    };
+}
+/**
+ * A real, valid encoding of a password nobody knows, so the miss path costs the
+ * same as the hit path. Computed on first use rather than at import, so the
+ * ~100ms scrypt lands on the first login attempt instead of on every CLI
+ * invocation that happens to import this module.
+ */
+let dummyHash = null;
+function timingEqualiser() {
+    dummyHash ??= hashPassword("fest-dummy-password-for-timing-equalisation");
+    return dummyHash;
+}
+export { findUserByEmail };
+//# sourceMappingURL=accounts.js.map