fest-gateway 0.1.0

package/dist/server/auth/accounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.js","sourceRoot":"","sources":["../../../server/auth/accounts.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEpE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAIlD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAEpF;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,KAAY,EAAE,KAAa;IACrD,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE;SACjB,OAAO,CACN;;gBAEU,CACX;SACA,GAAG,CAAC,KAAK,CAAqC,CAAC;IAClD,OAAO,GAAG,KAAK,SAAS,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAY,EAAE,KAAa;IAChE,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE;SACjB,OAAO,CAAC,gFAAgF,CAAC;SACzF,GAAG,CAAC,KAAK,CAA+B,CAAC;IAC5C,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAY,EACZ,IAA2F;IAE3F,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAE/C,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE;QAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,OAAO;QAC1B,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;KAC7E,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,KAAK,CAAC,EAAE;SACL,OAAO,CAAC,gFAAgF,CAAC;SACzF,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAEnC,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;AACnD,CAAC;AASD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAY,EACZ,KAAa,EACb,KAAa,EACb,QAAgB;IAEhB,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE;SACjB,OAAO,CACN;mDAC6C,CAC9C;SACA,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,CAStB,CAAC;IAEd,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,eAAe,EAAE,CAAC,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,eAAe,EAAE,CAAC,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IAC7D,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAElE,6EAA6E;IAC7E,wCAAwC;IACxC,IAAI,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC9C,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;QACzE,MAAM,EAAE,IAAI;KACb,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,IAAI,SAAS,GAA2B,IAAI,CAAC;AAC7C,SAAS,eAAe;IACtB,SAAS,KAAK,YAAY,CAAC,6CAA6C,CAAC,CAAC;IAC1E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/server/auth/gateway-401.js

@@ -0,0 +1,85 @@
+/**
+ * The message a developer sees when Fest cannot serve them.
+ *
+ * This is genuinely UI: Claude Code renders `error.message` verbatim, mid-task,
+ * to someone who was trying to get work done. An error that says "unauthorized"
+ * is a support ticket. One that says which variable to set is a fix.
+ *
+ * Two constraints learned by watching it render, both of which shape every
+ * message here:
+ *
+ *  1. **The client TRUNCATES the message.** It is shown on roughly one line, so
+ *     the first sentence has to carry the whole actionable point. Detail on
+ *     later lines is a bonus that may never be seen.
+ *  2. **The client RETRIES.** Its predicate is
+ *     `x-should-retry` first, then 408/409/429/5xx. A permanent configuration
+ *     problem returned as a retryable status produces ten escalating retries of
+ *     a request that cannot possibly succeed — the developer waits a minute to
+ *     be told something that was true immediately. So every failure here
+ *     carries `retryable`, and callers must send `x-should-retry: false`
+ *     accordingly.
+ *
+ * The messages differ by POSTURE because the remedies are opposite, and telling
+ * a subscription user to set `ANTHROPIC_AUTH_TOKEN` would be actively harmful —
+ * that variable is exactly what disables their subscription.
+ */
+const DO_NOT_SET = "Do not set ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN alongside it: either one makes " +
+    "Claude Code stop using your Claude subscription and bill an API key instead.";
+/** No identity token at all, on a deployment that requires one. */
+export function noIdentity(baseUrl) {
+    return {
+        status: 401,
+        type: "authentication_error",
+        retryable: false,
+        message: `Fest: no identity token — ask an admin for one, then set ANTHROPIC_BASE_URL=${baseUrl}/t/<your-token>.\n` +
+            `Ask an admin for a token, then either:\n` +
+            `  • point your base URL at it — ANTHROPIC_BASE_URL=${baseUrl}/t/<your-token>   (keeps your Claude subscription)\n` +
+            `  • or set ANTHROPIC_AUTH_TOKEN=<your-token>                                   (uses this gateway's own credentials instead)\n` +
+            `The first is preferred: it bills your own subscription rather than the team's.`,
+    };
+}
+/** A token was presented and did not resolve. */
+export function badIdentity() {
+    return {
+        status: 401,
+        type: "authentication_error",
+        retryable: false,
+        message: "Fest: that identity token is not valid (unknown, revoked, or expired). " +
+            "Ask an admin for a new one, then update whichever of ANTHROPIC_BASE_URL or " +
+            "ANTHROPIC_AUTH_TOKEN you set it in.",
+    };
+}
+/**
+ * Key posture, identity fine, but nothing can pay for the request.
+ *
+ * This is an OPERATOR problem surfacing to a developer, so the message says so
+ * explicitly. Otherwise the developer spends their afternoon re-checking their
+ * own token, which is the one thing here that is not wrong.
+ */
+export function noUpstreamCredential(model) {
+    const what = model === null ? "this model" : model;
+    return {
+        // NOT 401. A 401 invites the client's token-refresh-and-retry path, and
+        // nothing about refreshing a token fixes "the server has no credential
+        // configured" — the developer just waits through ten escalating retries to
+        // be told what was true at the first attempt.
+        status: 400,
+        type: "invalid_request_error",
+        retryable: false,
+        // First sentence carries it: the message is truncated in the client.
+        message: `Fest has no credential configured for ${what} — pick a different model, or ask whoever runs Fest to add a route for it. ` +
+            `(Your identity token is fine; this is a server configuration problem. ` +
+            `To use your own Claude subscription instead, unset ANTHROPIC_AUTH_TOKEN and set ANTHROPIC_BASE_URL=<fest>/t/<your-token>.)`,
+    };
+}
+/** Subscription posture with no bearer — rare, and usually a stale login. */
+export function noSubscriptionCredential() {
+    return {
+        status: 401,
+        type: "authentication_error",
+        retryable: false,
+        message: "Fest: no Claude credential arrived with this request. Run `claude /login` to refresh your " +
+            `subscription, and check your environment. ${DO_NOT_SET}`,
+    };
+}
+//# sourceMappingURL=gateway-401.js.map

package/dist/server/auth/gateway-401.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-401.js","sourceRoot":"","sources":["../../../server/auth/gateway-401.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAaH,MAAM,UAAU,GACd,sFAAsF;IACtF,8EAA8E,CAAC;AAEjF,mEAAmE;AACnE,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,sBAAsB;QAC5B,SAAS,EAAE,KAAK;QAChB,OAAO,EACL,+EAA+E,OAAO,oBAAoB;YAC1G,0CAA0C;YAC1C,sDAAsD,OAAO,sDAAsD;YACnH,gIAAgI;YAChI,gFAAgF;KACnF,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,sBAAsB;QAC5B,SAAS,EAAE,KAAK;QAChB,OAAO,EACL,yEAAyE;YACzE,6EAA6E;YAC7E,qCAAqC;KACxC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAoB;IACvD,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC;IACnD,OAAO;QACL,wEAAwE;QACxE,uEAAuE;QACvE,2EAA2E;QAC3E,8CAA8C;QAC9C,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,uBAAuB;QAC7B,SAAS,EAAE,KAAK;QAChB,qEAAqE;QACrE,OAAO,EACL,yCAAyC,IAAI,6EAA6E;YAC1H,wEAAwE;YACxE,4HAA4H;KAC/H,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,wBAAwB;IACtC,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,sBAAsB;QAC5B,SAAS,EAAE,KAAK;QAChB,OAAO,EACL,4FAA4F;YAC5F,6CAA6C,UAAU,EAAE;KAC5D,CAAC;AACJ,CAAC"}

package/dist/server/auth/guard.js

@@ -0,0 +1,74 @@
+/**
+ * Who may call the dashboard API.
+ *
+ * This guards `/api/*` only. The proxy path (`/v1/*`) authenticates completely
+ * differently — an identity token presented by a developer's Claude Code — and
+ * must never require a browser session. Conflating them would mean a developer
+ * has to log in to a web page before their editor works.
+ *
+ * ── The unclaimed state ──────────────────────────────────────────────────────
+ *
+ * Before anyone has run `fest admin create`, there is no account to sign in
+ * with. Rather than ship a well-known default password, Fest serves the
+ * dashboard open *only while bound to loopback*, and refuses to serve it at all
+ * on any other interface. So the single-developer trial still works with no
+ * setup, and the failure mode "I bound it to 0.0.0.0 and forgot to add a
+ * password" cannot happen quietly — it cannot happen at all.
+ */
+import { parseCookies, cookieName, resolveSession } from "./session.js";
+import { hasAnyOwner } from "./accounts.js";
+const LOOPBACK = new Set(["127.0.0.1", "::1", "localhost"]);
+export function isLoopbackHost(host) {
+    return LOOPBACK.has(host.trim().toLowerCase());
+}
+export function sessionFromRequest(store, req, secureCookies) {
+    const cookies = parseCookies(req.headers.cookie);
+    return resolveSession(store, cookies[cookieName(secureCookies)] ?? null);
+}
+/** Decide whether this `/api/*` request may proceed. */
+export function authorizeApi(req, deps) {
+    const session = sessionFromRequest(deps.store, req, deps.secureCookies);
+    if (session !== null)
+        return { allow: true, session, unclaimed: false };
+    if (!hasAnyOwner(deps.store, deps.orgId)) {
+        if (isLoopbackHost(deps.bindHost))
+            return { allow: true, session: null, unclaimed: true };
+        return {
+            allow: false,
+            status: 503,
+            error: "Fest has no owner account yet, and refuses to serve an unauthenticated dashboard " +
+                "off loopback. Run: fest admin create <email>",
+        };
+    }
+    return { allow: false, status: 401, error: "authentication required" };
+}
+/**
+ * Cross-site request forgery, handled by origin rather than by token.
+ *
+ * A double-submit token would add a second secret to manage for no gain here:
+ * the session cookie is already `SameSite=Strict`, so a browser will not attach
+ * it to a cross-site request at all, and this is the belt to that's braces. A
+ * form POSTed from another origin cannot control `Origin`.
+ *
+ * A missing `Origin` is rejected rather than waved through. Browsers always
+ * send it on POST; the only callers it inconveniences are scripts, which can
+ * set it, and that is the right way round — waving it through would restore the
+ * exact hole this closes for any browser that omits it.
+ */
+export function originAllowed(req) {
+    const origin = req.headers.origin;
+    const host = req.headers.host;
+    if (typeof origin !== "string" || origin === "" || typeof host !== "string")
+        return false;
+    try {
+        return new URL(origin).host === host;
+    }
+    catch {
+        return false;
+    }
+}
+/** Best-effort client address, for the audit trail only — never for access. */
+export function clientIp(req) {
+    return req.socket.remoteAddress ?? "";
+}
+//# sourceMappingURL=guard.js.map

package/dist/server/auth/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../../server/auth/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAM5C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;AAE5D,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAY,EACZ,GAAoB,EACpB,aAAsB;IAEtB,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,OAAO,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;AAC3E,CAAC;AASD,wDAAwD;AACxD,MAAM,UAAU,YAAY,CAAC,GAAoB,EAAE,IAAe;IAChE,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IACxE,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAExE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC1F,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,GAAG;YACX,KAAK,EACH,mFAAmF;gBACnF,8CAA8C;SACjD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAAC,GAAoB;IAChD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1F,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,QAAQ,CAAC,GAAoB;IAC3C,OAAO,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;AACxC,CAAC"}

package/dist/server/auth/oauth.js

@@ -0,0 +1,43 @@
+/**
+ * Google/GitHub OAuth provider construction.
+ *
+ * Returns null rather than throwing when a provider's client id/secret are
+ * unset — a deployment may intentionally run with only one provider
+ * configured, or with neither and password-only dashboard login. Same shape
+ * as an unconfigured routing upstream (Phase 4): a feature that refuses to
+ * activate, not a boot failure.
+ */
+import { Google, GitHub } from "arctic";
+export function oauthRedirectUri(cfg, provider) {
+    return `${cfg.publicUrl}/api/auth/oauth/${provider}/callback`;
+}
+export function googleProvider(cfg) {
+    if (cfg.googleClientId === null || cfg.googleClientSecret === null)
+        return null;
+    return new Google(cfg.googleClientId, cfg.googleClientSecret, oauthRedirectUri(cfg, "google"));
+}
+export function githubProvider(cfg) {
+    if (cfg.githubClientId === null || cfg.githubClientSecret === null)
+        return null;
+    return new GitHub(cfg.githubClientId, cfg.githubClientSecret, oauthRedirectUri(cfg, "github"));
+}
+export function configuredProviders(cfg) {
+    const out = [];
+    if (googleProvider(cfg) !== null)
+        out.push("google");
+    if (githubProvider(cfg) !== null)
+        out.push("github");
+    return out;
+}
+/**
+ * Empty allow-list refuses every OAuth login, deliberately. Self-service token
+ * minting spends server-held credentials on the substitute path, so "nobody
+ * configured a domain" must mean "OAuth login is off", not "everyone is in".
+ */
+export function emailDomainAllowed(cfg, email) {
+    if (cfg.allowedEmailDomains.length === 0)
+        return false;
+    const domain = email.split("@")[1]?.toLowerCase() ?? "";
+    return cfg.allowedEmailDomains.includes(domain);
+}
+//# sourceMappingURL=oauth.js.map

package/dist/server/auth/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../server/auth/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAKxC,MAAM,UAAU,gBAAgB,CAAC,GAAe,EAAE,QAAuB;IACvE,OAAO,GAAG,GAAG,CAAC,SAAS,mBAAmB,QAAQ,WAAW,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAe;IAC5C,IAAI,GAAG,CAAC,cAAc,KAAK,IAAI,IAAI,GAAG,CAAC,kBAAkB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChF,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAe;IAC5C,IAAI,GAAG,CAAC,cAAc,KAAK,IAAI,IAAI,GAAG,CAAC,kBAAkB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChF,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAe;IACjD,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAe,EAAE,KAAa;IAC/D,IAAI,GAAG,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACxD,OAAO,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAClD,CAAC"}

package/dist/server/auth/password.js

@@ -0,0 +1,104 @@
+/**
+ * Dashboard passwords: scrypt, with the parameters stored alongside the hash.
+ *
+ * Why scrypt here and sha256 for identity tokens (see store/tokens.ts): a
+ * 32-byte random token has no dictionary to attack, so a slow KDF buys nothing
+ * and costs every proxied request. A human-chosen password is the opposite on
+ * both counts — it is guessable, and it is verified once per login, off the hot
+ * path entirely.
+ *
+ * The encoded form is `scrypt$N$r$p$salt$hash`, all base64url. Storing the
+ * parameters rather than assuming them means today's cost factor can be raised
+ * later without invalidating existing passwords: an old hash still verifies
+ * with the parameters it was written with, and `needsRehash` says when to
+ * upgrade it on next successful login.
+ */
+import { randomBytes, scrypt as scryptCb, timingSafeEqual } from "node:crypto";
+import { promisify } from "node:util";
+const scrypt = promisify(scryptCb);
+/** ~100ms on a 2024 laptop, and within Node's default maxmem at r=8. */
+export const CURRENT_PARAMS = { N: 16_384, r: 8, p: 1 };
+const KEY_BYTES = 32;
+const SALT_BYTES = 16;
+/** N=16384,r=8 needs ~16MB; the headroom covers a future raise of N. */
+const MAXMEM = 128 * 1024 * 1024;
+const b64 = (b) => b.toString("base64url");
+/**
+ * Minimum length only — no composition rules.
+ *
+ * Character-class requirements measurably push people toward `Password1!` and
+ * are not what stands between this database and an attacker; a slow KDF and a
+ * non-guessable length are. `fest admin create` generates a random password by
+ * default, which is the path most operators should take.
+ */
+export const MIN_PASSWORD_LENGTH = 12;
+export function validatePassword(password) {
+    if (password.length < MIN_PASSWORD_LENGTH) {
+        return `password must be at least ${MIN_PASSWORD_LENGTH} characters`;
+    }
+    if (password.length > 1024) {
+        // Not a policy, a denial-of-service bound: scrypt cost scales with input.
+        return "password must be at most 1024 characters";
+    }
+    return null;
+}
+export async function hashPassword(password, params = CURRENT_PARAMS) {
+    const salt = randomBytes(SALT_BYTES);
+    const key = await scrypt(password, salt, KEY_BYTES, { ...params, maxmem: MAXMEM });
+    return ["scrypt", params.N, params.r, params.p, b64(salt), b64(key)].join("$");
+}
+/**
+ * Verify a password against an encoded hash.
+ *
+ * Returns false rather than throwing for a malformed stored value: a corrupted
+ * row must read as "this password does not match", not as a 500 that tells an
+ * attacker they found something interesting.
+ */
+export async function verifyPassword(password, encoded) {
+    const parts = encoded.split("$");
+    if (parts.length !== 6 || parts[0] !== "scrypt")
+        return false;
+    const N = Number(parts[1]);
+    const r = Number(parts[2]);
+    const p = Number(parts[3]);
+    if (!Number.isInteger(N) || !Number.isInteger(r) || !Number.isInteger(p))
+        return false;
+    // A hostile row could otherwise name parameters that hang the process.
+    if (N > 1 << 20 || r > 32 || p > 16)
+        return false;
+    let salt;
+    let expected;
+    try {
+        salt = Buffer.from(parts[4] ?? "", "base64url");
+        expected = Buffer.from(parts[5] ?? "", "base64url");
+    }
+    catch {
+        return false;
+    }
+    if (salt.length === 0 || expected.length === 0)
+        return false;
+    let actual;
+    try {
+        actual = await scrypt(password, salt, expected.length, { N, r, p, maxmem: MAXMEM });
+    }
+    catch {
+        return false;
+    }
+    return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+/** True when a stored hash was written with weaker parameters than today's. */
+export function needsRehash(encoded, params = CURRENT_PARAMS) {
+    const parts = encoded.split("$");
+    if (parts.length !== 6 || parts[0] !== "scrypt")
+        return true;
+    return Number(parts[1]) < params.N || Number(parts[2]) < params.r;
+}
+/**
+ * A password nobody has to invent. ~103 bits of entropy in a shape that
+ * survives being read aloud once and pasted into a password manager.
+ */
+export function generatePassword() {
+    const raw = randomBytes(16).toString("base64url").replace(/[-_]/g, "");
+    return (raw.match(/.{1,6}/g) ?? [raw]).slice(0, 4).join("-");
+}
+//# sourceMappingURL=password.js.map

package/dist/server/auth/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../../server/auth/password.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,IAAI,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAKb,CAAC;AAQrB,wEAAwE;AACxE,MAAM,CAAC,MAAM,cAAc,GAAiB,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAEtE,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,wEAAwE;AACxE,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QAC1C,OAAO,6BAA6B,mBAAmB,aAAa,CAAC;IACvE,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QAC3B,0EAA0E;QAC1E,OAAO,0CAA0C,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,SAAuB,cAAc;IACxF,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnF,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,OAAe;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE9D,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACvF,uEAAuE;IACvE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAElD,IAAI,IAAY,CAAC;IACjB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;QAChD,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE7D,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAChF,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,SAAuB,cAAc;IAChF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/D,CAAC"}

package/dist/server/auth/posture.js

@@ -0,0 +1,145 @@
+/**
+ * Inbound credential posture and identity detection.
+ *
+ * Every request carries up to TWO independent credentials, and conflating them
+ * is the bug that breaks subscription auth:
+ *
+ *  1. The developer's *upstream* credential — their own Claude Max/Team OAuth
+ *     bearer (`Authorization: Bearer sk-ant-oat…`) or an API key (`x-api-key`,
+ *     or `Authorization: Bearer sk-ant-api…`). This is forwarded to Anthropic.
+ *  2. Fest's own *identity* token — "which developer is this?" — which is never
+ *     forwarded upstream. It arrives as a URL path prefix (`/t/<token>/…`) or as
+ *     an `X-Fest-Token` header.
+ *
+ * On the SUBSCRIPTION posture the identity token cannot ride in
+ * `ANTHROPIC_API_KEY`/`ANTHROPIC_AUTH_TOKEN`: setting either of those makes
+ * Claude Code silently abandon subscription auth, so the developer's Max token
+ * never arrives and we bill the org instead. Hence the two out-of-band
+ * carriers.
+ *
+ * On the KEY posture that objection does not apply — there is no subscription
+ * left to protect — so a Fest token may also arrive as
+ * `Authorization: Bearer fest_…`. Whichever position it arrives in, a Fest
+ * token is IDENTITY and is never forwarded upstream. Relaying our own bearer to
+ * Anthropic would authenticate nothing and disclose a credential that can
+ * impersonate a developer on this gateway.
+ */
+import { classifyCredential, fingerprint } from "../secret/fingerprint.js";
+/**
+ * Header positions that may hold the *upstream* credential, in preference order.
+ *
+ * `x-fest-token` is deliberately absent even though it is a secret header
+ * (see SECRET_HEADERS): it is Fest's identity token, not Anthropic's, and
+ * forwarding it upstream would authenticate nothing and leak our own bearer.
+ */
+const UPSTREAM_CREDENTIAL_HEADERS = ["authorization", "x-api-key"];
+/** Path prefixes that carry an identity token. `/t/` is the short form. */
+const IDENTITY_PATH_PREFIX = /^\/(?:t|fest)\/([^/?#]+)(\/[^?#]*)?(\?.*|#.*)?$/;
+/**
+ * Split a leading `/t/<token>` or `/fest/<token>` segment off the request URL.
+ *
+ * The query string belongs to the remainder, because Claude Code sends
+ * `POST /v1/messages?beta=true` and dropping `?beta=true` changes the upstream
+ * request shape. A URL with no identity prefix is returned untouched — note the
+ * anchored regex, so a normal `/v1/messages` can never be mistaken for a token
+ * (its first segment is not `t` or `fest`).
+ */
+export function parseIdentityPath(url) {
+    const match = IDENTITY_PATH_PREFIX.exec(url);
+    if (!match)
+        return { token: null, remainder: url };
+    const token = match[1] ?? "";
+    if (token.length === 0)
+        return { token: null, remainder: url };
+    // `/t/<tok>` with nothing after it still has to address a path upstream.
+    const path = match[2] ?? "/";
+    const suffix = match[3] ?? "";
+    return { token, remainder: `${path === "" ? "/" : path}${suffix}` };
+}
+/** `Bearer xyz` -> `xyz`; anything else unchanged. */
+function stripBearer(raw) {
+    const match = /^Bearer\s+(.*)$/i.exec(raw.trim());
+    return (match ? (match[1] ?? "") : raw).trim();
+}
+function headerValue(headers, name) {
+    // Node lowercases incoming header names, but this is also called with
+    // hand-built objects (tests, internal replays), so match case-insensitively.
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() !== name)
+            continue;
+        const joined = Array.isArray(value) ? value.join(", ") : value;
+        if (joined === undefined)
+            return null;
+        return joined;
+    }
+    return null;
+}
+/**
+ * Classify a request's two credential positions in one pass.
+ *
+ * Posture is *detected*, never configured: it is a property of the developer's
+ * own client environment, which Fest does not control.
+ */
+export function detectInbound(url, headers) {
+    let upstreamCredential = null;
+    /**
+     * A Fest token found in an upstream-credential position.
+     *
+     * It is pulled OUT of that position rather than left there: everything
+     * downstream treats `upstreamCredential` as "the thing to forward", and our
+     * own identity token must never be forwarded. Recording it here keeps the
+     * loop's preference order intact while removing it from the forward path.
+     */
+    let tokenFromAuthHeader = null;
+    for (const name of UPSTREAM_CREDENTIAL_HEADERS) {
+        const raw = headerValue(headers, name);
+        if (raw === null)
+            continue;
+        const info = classifyCredential(name, raw);
+        // An empty or whitespace-only header is the same as no credential; fall
+        // through so a present-but-blank `authorization` does not mask `x-api-key`.
+        if (info.kind === "EMPTY")
+            continue;
+        if (info.kind === "FEST_IDENTITY_TOKEN") {
+            // Identity, not an upstream credential. Keep scanning: a developer could
+            // conceivably present a Fest token AND a real provider key, and the key
+            // is still the thing to forward.
+            tokenFromAuthHeader ??= stripBearer(raw);
+            continue;
+        }
+        upstreamCredential = info;
+        break;
+    }
+    const posture = upstreamCredential?.kind === "ANTHROPIC_OAUTH_SUBSCRIPTION" ? "subscription" : "key";
+    const fromPath = parseIdentityPath(url);
+    const fromHeader = headerValue(headers, "x-fest-token");
+    // Path wins: it is the form we hand developers (`ANTHROPIC_BASE_URL=…/t/<tok>`),
+    // so if both are present the URL is the deliberate one.
+    //
+    // Precedence: path, then X-Fest-Token, then the auth header. The path form is
+    // what we hand developers, so when several are present the URL is the
+    // deliberate one; the auth header is last because it is the only position a
+    // token can end up in by accident (a developer pasting a key into the wrong
+    // variable).
+    const headerToken = fromHeader !== null && fromHeader.trim() !== "" ? fromHeader.trim() : null;
+    const identityToken = fromPath.token ?? headerToken ?? tokenFromAuthHeader;
+    const carrier = fromPath.token !== null
+        ? "path"
+        : headerToken !== null
+            ? "header"
+            : tokenFromAuthHeader !== null
+                ? "auth_header"
+                : "none";
+    const identity = {
+        carrier,
+        tokenFingerprint: identityToken === null ? null : fingerprint(identityToken),
+    };
+    return {
+        posture,
+        upstreamCredential,
+        identity,
+        identityToken,
+        effectivePath: fromPath.remainder,
+    };
+}
+//# sourceMappingURL=posture.js.map

package/dist/server/auth/posture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"posture.js","sourceRoot":"","sources":["../../../server/auth/posture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAuB,MAAM,0BAA0B,CAAC;AAahG;;;;;;GAMG;AACH,MAAM,2BAA2B,GAAsB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;AAEtF,2EAA2E;AAC3E,MAAM,oBAAoB,GAAG,iDAAiD,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAC/D,yEAAyE;IACzE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,MAAM,EAAE,EAAE,CAAC;AACtE,CAAC;AAED,sDAAsD;AACtD,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAClB,OAAgE,EAChE,IAAY;IAEZ,sEAAsE;IACtE,6EAA6E;IAC7E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI;YAAE,SAAS;QACzC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/D,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAW,EACX,OAAgE;IAEhE,IAAI,kBAAkB,GAA0B,IAAI,CAAC;IACrD;;;;;;;OAOG;IACH,IAAI,mBAAmB,GAAkB,IAAI,CAAC;IAE9C,KAAK,MAAM,IAAI,IAAI,2BAA2B,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,GAAG,KAAK,IAAI;YAAE,SAAS;QAC3B,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3C,wEAAwE;QACxE,4EAA4E;QAC5E,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;YAAE,SAAS;QAEpC,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;YACxC,yEAAyE;YACzE,wEAAwE;YACxE,iCAAiC;YACjC,mBAAmB,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC;YACzC,SAAS;QACX,CAAC;QAED,kBAAkB,GAAG,IAAI,CAAC;QAC1B,MAAM;IACR,CAAC;IAED,MAAM,OAAO,GACX,kBAAkB,EAAE,IAAI,KAAK,8BAA8B,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC;IAEvF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACxD,iFAAiF;IACjF,wDAAwD;IACxD,EAAE;IACF,8EAA8E;IAC9E,sEAAsE;IACtE,4EAA4E;IAC5E,4EAA4E;IAC5E,aAAa;IACb,MAAM,WAAW,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/F,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,IAAI,WAAW,IAAI,mBAAmB,CAAC;IAC3E,MAAM,OAAO,GACX,QAAQ,CAAC,KAAK,KAAK,IAAI;QACrB,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,WAAW,KAAK,IAAI;YACpB,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,mBAAmB,KAAK,IAAI;gBAC5B,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,MAAM,CAAC;IAEjB,MAAM,QAAQ,GAAa;QACzB,OAAO;QACP,gBAAgB,EAAE,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC;KAC7E,CAAC;IAEF,OAAO;QACL,OAAO;QACP,kBAAkB;QAClB,QAAQ;QACR,aAAa;QACb,aAAa,EAAE,QAAQ,CAAC,SAAS;KAClC,CAAC;AACJ,CAAC"}

package/dist/server/auth/session.js

@@ -0,0 +1,161 @@
+/**
+ * Dashboard sessions: an opaque cookie, hashed at rest.
+ *
+ * A cookie rather than a JWT. Fest already has a database on the cold path, and
+ * the property that matters for an admin console is *instant revocation* —
+ * "sign out everywhere" has to mean it. A stateless token cannot do that
+ * without a revocation table, at which point it is a session with extra steps
+ * and a signing key to lose.
+ *
+ * Two clocks, deliberately:
+ *   - `last_seen_at` + IDLE_MS   — an unattended console stops working.
+ *   - `expires_at`   (absolute)  — a stolen cookie has a bounded life even if
+ *                                  the thief keeps it warm.
+ *
+ * NOT ON THE HOT PATH. These are synchronous SQLite reads, which is only
+ * acceptable because the proxy path never calls them — see the guardrail
+ * comment in store/db.ts.
+ */
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { newId } from "../store/ids.js";
+const TOKEN_BYTES = 32;
+export const IDLE_MS = 12 * 3_600_000;
+export const ABSOLUTE_MS = 14 * 86_400_000;
+/**
+ * `__Host-` is not cosmetic: it makes the browser refuse the cookie unless it
+ * is Secure, host-only and path `/`, which removes cookie-fixation from a
+ * sibling subdomain. It requires HTTPS, so plain-HTTP deployments (a loopback
+ * trial) get the unprefixed name.
+ */
+export const COOKIE_NAME = "fest_session";
+export const SECURE_COOKIE_NAME = "__Host-fest_session";
+const hash = (raw) => createHash("sha256").update(raw, "utf8").digest("hex");
+export function cookieName(secure) {
+    return secure ? SECURE_COOKIE_NAME : COOKIE_NAME;
+}
+export function parseCookies(header) {
+    const out = {};
+    if (header === undefined)
+        return out;
+    for (const part of header.split(";")) {
+        const eq = part.indexOf("=");
+        if (eq === -1)
+            continue;
+        const k = part.slice(0, eq).trim();
+        if (k !== "")
+            out[k] = decodeURIComponent(part.slice(eq + 1).trim());
+    }
+    return out;
+}
+export function serializeCookie(raw, opts) {
+    const parts = [
+        `${cookieName(opts.secure)}=${raw}`,
+        "Path=/",
+        "HttpOnly",
+        // Strict, not Lax. The dashboard is never linked to from elsewhere, so
+        // nothing legitimate arrives cross-site, and Strict is a second line behind
+        // the Origin check for unsafe methods.
+        "SameSite=Strict",
+        `Max-Age=${opts.maxAgeSeconds}`,
+    ];
+    if (opts.secure)
+        parts.push("Secure");
+    return parts.join("; ");
+}
+export function clearedCookie(secure) {
+    const parts = [`${cookieName(secure)}=`, "Path=/", "HttpOnly", "SameSite=Strict", "Max-Age=0"];
+    if (secure)
+        parts.push("Secure");
+    return parts.join("; ");
+}
+export function createSession(store, args) {
+    const now = args.now ?? Date.now();
+    const raw = randomBytes(TOKEN_BYTES).toString("base64url");
+    const sessionId = newId("ses");
+    const expiresAt = now + ABSOLUTE_MS;
+    store.db
+        .prepare(`INSERT INTO sessions
+         (id, org_id, user_id, token_hash, created_at, expires_at, last_seen_at, user_agent, ip)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+        .run(sessionId, args.orgId, args.userId, hash(raw), now, expiresAt, now, (args.userAgent ?? "").slice(0, 200), (args.ip ?? "").slice(0, 64));
+    return { sessionId, raw, expiresAt };
+}
+/**
+ * Resolve a presented cookie, rolling the idle clock forward.
+ *
+ * Returns null for absent, unknown, revoked, idle-expired and absolutely
+ * expired alike. The caller cannot tell them apart, and must not be able to:
+ * distinguishing "revoked" from "never existed" is an oracle for which sessions
+ * once existed.
+ *
+ * The role and email are read through a join rather than copied into the
+ * session at login, so a demotion or a disabled account takes effect on the
+ * next request instead of whenever the operator happens to sign out.
+ */
+export function resolveSession(store, raw, now = Date.now()) {
+    if (raw === null || raw === undefined || raw.length === 0)
+        return null;
+    const presented = hash(raw);
+    const row = store.db
+        .prepare(`SELECT s.id, s.org_id, s.user_id, s.token_hash, s.expires_at, s.last_seen_at, s.revoked_at,
+              u.email, u.role, u.disabled_at
+         FROM sessions s
+         JOIN users u ON u.id = s.user_id
+        WHERE s.token_hash = ?`)
+        .get(presented);
+    if (row === undefined)
+        return null;
+    const a = Buffer.from(presented, "hex");
+    const b = Buffer.from(row.token_hash, "hex");
+    if (a.length !== b.length || !timingSafeEqual(a, b))
+        return null;
+    if (row.revoked_at !== null)
+        return null;
+    if (row.disabled_at !== null)
+        return null;
+    if (row.expires_at <= now)
+        return null;
+    if (now - row.last_seen_at > IDLE_MS)
+        return null;
+    // Coarse: rewriting last_seen_at on every poll would turn a dashboard
+    // refreshing every few seconds into a steady write stream competing with the
+    // metering writer for the single SQLite writer.
+    if (now - row.last_seen_at > 60_000) {
+        store.db.prepare(`UPDATE sessions SET last_seen_at = ? WHERE id = ?`).run(now, row.id);
+    }
+    return {
+        sessionId: row.id,
+        orgId: row.org_id,
+        userId: row.user_id,
+        email: row.email,
+        role: row.role,
+        expiresAt: row.expires_at,
+    };
+}
+export function revokeSession(store, sessionId, now = Date.now()) {
+    const res = store.db
+        .prepare(`UPDATE sessions SET revoked_at = ? WHERE id = ? AND revoked_at IS NULL`)
+        .run(now, sessionId);
+    return Number(res.changes) > 0;
+}
+/** "Sign out everywhere" — and what a password change must do. */
+export function revokeUserSessions(store, userId, now = Date.now()) {
+    const res = store.db
+        .prepare(`UPDATE sessions SET revoked_at = ? WHERE user_id = ? AND revoked_at IS NULL`)
+        .run(now, userId);
+    return Number(res.changes);
+}
+/**
+ * Delete sessions that can no longer authenticate anything.
+ *
+ * Rows are removed rather than left as tombstones: an expired session hash has
+ * no evidentiary value — the audit log holds the record of who signed in — and
+ * an unbounded table on a long-lived deployment is just a slower index.
+ */
+export function sweepSessions(store, now = Date.now()) {
+    const res = store.db
+        .prepare(`DELETE FROM sessions WHERE expires_at <= ? OR last_seen_at < ? OR revoked_at IS NOT NULL`)
+        .run(now, now - IDLE_MS);
+    return Number(res.changes);
+}
+//# sourceMappingURL=session.js.map