laneyard 0.1.0 → 0.3.0

package/dist/src/runner/orchestrate.js

@@ -2,6 +2,7 @@ import { rm } from "node:fs/promises";
 import { join } from "node:path";
 import { Workspace } from "../git/workspace.js";
 import { summarizeFailure } from "../heuristics/error-summary.js";
+import { Redactor, scrub } from "../logs/redact.js";
 import { collectArtifacts } from "./artifacts.js";
 import { LiveStepTracker } from "./live-steps.js";
 import { startPty } from "./pty.js";
@@ -17,19 +18,47 @@ export async function executeRun(opts) {
     const { runId, runs, logs } = opts;
     const writer = await logs.open(runId);
     const tracker = new LiveStepTracker();
+    const redactor = new Redactor(opts.maskedValues ?? []);
+    // Redaction happens here and nowhere else: this is the single point through
+    // which every byte of output passes on its way to the file, the step tracker
+    // and the browser. Filtering further downstream would mean filtering three
+    // times, and forgetting one of them eventually.
     const emit = async (text) => {
-        const offset = await writer.append(text);
-        tracker.consume(text, offset);
-        opts.onChunk(text, offset);
+        const safe = redactor.push(text);
+        if (safe === "")
+            return;
+        const offset = await writer.append(safe);
+        tracker.consume(safe, offset);
+        opts.onChunk(safe, offset);
     };
-    const fail = async (message) => {
+    const emitRest = async () => {
+        const rest = redactor.flush();
+        if (rest === "")
+            return;
+        const offset = await writer.append(rest);
+        tracker.consume(rest, offset);
+        opts.onChunk(rest, offset);
+    };
+    // The error summary is stored in the database and rendered in the interface
+    // without passing through the stream above, so it needs its own, one-shot pass.
+    const hide = (text) => scrub(text, opts.maskedValues ?? []);
+    // Shared by every early exit, so flushing and closing the log writer cannot
+    // drift between the failure path and the two cancellation checkpoints below.
+    const finishAs = async (status, message) => {
         await emit(`\n${message}\n`);
+        await emitRest();
         await writer.close();
-        runs.finish(runId, { status: "failed", exitCode: null, errorSummary: message });
-        return { status: "failed" };
+        runs.finish(runId, { status, exitCode: null, errorSummary: hide(message) });
+        return { status };
     };
+    const fail = (message) => finishAs("failed", message);
     // --- Preparation --------------------------------------------------------
     runs.setStatus(runId, "preparing");
+    // Cancelled before it even started: no point cloning or fetching a
+    // workspace nobody wants built anymore.
+    if (opts.signal?.aborted) {
+        return finishAs("cancelled", "Cancelled");
+    }
     const workspace = new Workspace(opts.workspacePath, opts.gitUrl, opts.gitAuth);
     let commitSha;
     try {
@@ -50,6 +79,10 @@ export async function executeRun(opts) {
     catch (cause) {
         return fail(`Unreadable project settings: ${cause.message}`);
     }
+    // Cancelled during preparation: fastlane never gets to start.
+    if (opts.signal?.aborted) {
+        return finishAs("cancelled", "Cancelled");
+    }
     // --- Execution -----------------------------------------------------------
     const useBundle = settings.runtime === "bundle";
     const reportPath = join(opts.workspacePath, settings.fastlane_dir, "report.xml");
@@ -65,16 +98,20 @@ export async function executeRun(opts) {
         cwd: opts.workspacePath,
         env: {
             ...opts.env,
-            // A non-interactive run fails fast instead of freezing on an invisible prompt.
+            ...(opts.secrets ?? {}),
+            // Order matters: secrets come after opts.env so a stored secret wins over
+            // a variable that happens to exist in the server's own environment, and
+            // before these three fixed variables so no secret can override CI.
             CI: "true",
             FASTLANE_SKIP_UPDATE_CHECK: "1",
             FORCE_COLOR: "1",
         },
         onData: (chunk) => void emit(chunk),
         timeoutMs: settings.timeout_minutes * 60_000,
+        signal: opts.signal,
     });
     const outcome = await done;
-    await writer.close();
+    await emitRest();
     // --- Timeline -------------------------------------------------------------
     // Everything that follows is after-sales service: the timeline and the
     // artifacts embellish a run that's already finished. A database that
@@ -86,14 +123,27 @@ export async function executeRun(opts) {
     }
     catch (cause) {
         await emit(`\nIncomplete timeline or artifacts: ${cause.message}\n`);
+        await emitRest();
     }
+    await writer.close();
     if (outcome.exitCode === 0 && !outcome.timedOut) {
         runs.finish(runId, { status: "success", exitCode: 0, errorSummary: null });
         return { status: "success" };
     }
+    if (opts.signal?.aborted) {
+        // Checked ahead of the failure case: the SIGINT/SIGKILL escalation leaves
+        // fastlane with a nonzero exit code, which would otherwise read as a crash
+        // rather than the cancellation it actually was.
+        runs.finish(runId, {
+            status: "cancelled",
+            exitCode: outcome.exitCode,
+            errorSummary: "Cancelled",
+        });
+        return { status: "cancelled" };
+    }
     const summary = outcome.timedOut
-        ? `Run interrupted after ${settings.timeout_minutes} minutes`
-        : summarizeFailure(await logs.read(runId), outcome.exitCode);
+        ? hide(`Run interrupted after ${settings.timeout_minutes} minutes`)
+        : hide(summarizeFailure(await logs.read(runId), outcome.exitCode));
     runs.finish(runId, { status: "failed", exitCode: outcome.exitCode, errorSummary: summary });
     return { status: "failed" };
     async function recordOutcome() {

package/dist/src/runner/pty.js

@@ -28,30 +28,42 @@ export function startPty(opts) {
     let timedOut = false;
     let timer;
     proc.onData(opts.onData);
+    /**
+     * SIGINT first so fastlane can clean up after itself; SIGKILL five seconds
+     * later if it will not. One path, so cancelling and timing out cannot drift
+     * apart — and so neither can leave the single worker blocked.
+     */
+    const stop = () => {
+        try {
+            proc.kill("SIGINT");
+        }
+        catch {
+            /* already gone */
+        }
+        setTimeout(() => {
+            try {
+                proc.kill("SIGKILL");
+            }
+            catch {
+                /* already gone */
+            }
+        }, 5000);
+    };
+    opts.signal?.addEventListener("abort", stop, { once: true });
     const done = new Promise((resolve) => {
         if (opts.timeoutMs !== undefined) {
             timer = setTimeout(() => {
                 timedOut = true;
-                // SIGINT first: fastlane cleans up after itself. SIGKILL if it keeps stalling.
-                try {
-                    proc.kill("SIGINT");
-                }
-                catch {
-                    /* the process may have died in the meantime */
-                }
-                setTimeout(() => {
-                    try {
-                        proc.kill("SIGKILL");
-                    }
-                    catch {
-                        /* same */
-                    }
-                }, 5000);
+                stop();
             }, opts.timeoutMs);
         }
         proc.onExit(({ exitCode, signal }) => {
             if (timer)
                 clearTimeout(timer);
+            // The listener would otherwise accumulate on every run sharing a
+            // long-lived signal (the queue's per-run AbortController is not one,
+            // but nothing here should depend on that).
+            opts.signal?.removeEventListener("abort", stop);
             // `waitpid` only reports an exit code for a normal end: a process
             // killed by a signal leaves 0, which would pass a cancellation off
             // as a success. We apply the shell convention, 128 + signal, so an

package/dist/src/runner/queue.js

@@ -0,0 +1,114 @@
+/** Statuses from which a run never moves again. */
+const TERMINAL = ["success", "failed", "cancelled", "interrupted"];
+/**
+ * Drains queued runs, one at a time.
+ *
+ * The queue is not held in memory: a run's `queued` status in the database *is*
+ * its place in line. That is what lets the server restart mid-queue and carry
+ * on, and what makes the position shown in the interface the truth rather than
+ * a second copy of it.
+ *
+ * One at a time, globally. A mobile build saturates the machine it runs on, and
+ * two at once are frequently slower than two in sequence.
+ */
+export class RunQueue {
+    runs;
+    job;
+    draining = false;
+    pending = false;
+    closed = false;
+    idlePromise = Promise.resolve();
+    running = new Map();
+    constructor(runs, job) {
+        this.runs = runs;
+        this.job = job;
+    }
+    /** Tells the queue there may be work. Safe to call at any time, from anywhere. */
+    wake() {
+        if (this.closed)
+            return;
+        if (this.draining) {
+            // A call arriving mid-drain is remembered rather than dropped: the drain
+            // may already have read an empty queue and be on its way out.
+            this.pending = true;
+            return;
+        }
+        this.draining = true;
+        this.idlePromise = this.drainUntilQuiet().finally(() => {
+            this.draining = false;
+        });
+    }
+    async drainUntilQuiet() {
+        do {
+            this.pending = false;
+            await this.drain();
+        } while (this.pending && !this.closed);
+    }
+    /** Resolves when the queue has nothing left to do. For tests and shutdown. */
+    async idle() {
+        await this.idlePromise;
+    }
+    async drain() {
+        for (;;) {
+            if (this.closed)
+                return;
+            // One at a time: if something is already in flight — including a run this
+            // process did not start — the queue waits rather than doubling up.
+            if (this.runs.activeCount() > 0)
+                return;
+            const next = this.runs.queued()[0];
+            if (!next)
+                return;
+            const controller = new AbortController();
+            this.running.set(next.id, controller);
+            try {
+                await this.job(next.id, controller.signal);
+            }
+            catch {
+                // A job that throws must not stall every run behind it. `executeRun`
+                // promises not to, but the queue cannot afford to depend on that.
+            }
+            finally {
+                this.running.delete(next.id);
+                // Whatever happened, the run must not still be waiting or in flight.
+                //
+                // Two failures hide here, and both are worse than a wrong status. If the
+                // job returns without moving the run out of `queued` — a project deleted
+                // from config.yml while its run waited, say — the next iteration reads
+                // the same row and calls the job again, forever. And a job that throws
+                // after `executeRun` reached `preparing` leaves a run with no end, which
+                // the interface polls until someone gives up.
+                const after = this.runs.get(next.id);
+                if (after && !TERMINAL.includes(after.status)) {
+                    this.runs.finish(next.id, {
+                        status: "failed",
+                        exitCode: null,
+                        errorSummary: "The run ended unexpectedly",
+                    });
+                }
+            }
+        }
+    }
+    /**
+     * Cancels a run whether it has started or not.
+     *
+     * A run still waiting is finished on the spot: there is nothing to signal, and
+     * making someone wait for a build they have cancelled would be absurd.
+     */
+    cancel(runId) {
+        const active = this.running.get(runId);
+        if (active) {
+            active.abort();
+            return true;
+        }
+        const run = this.runs.get(runId);
+        if (run?.status !== "queued")
+            return false;
+        this.runs.finish(runId, { status: "cancelled", exitCode: null, errorSummary: "Cancelled before it started" });
+        return true;
+    }
+    /** Stops taking new work; the run in flight is left to finish. */
+    close() {
+        this.closed = true;
+    }
+}

package/dist/src/secrets/cipher.js

@@ -0,0 +1,28 @@
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+/**
+ * AES-256-GCM, from Node's standard library — no dependency to audit.
+ *
+ * GCM is authenticated: a modified ciphertext fails to decrypt rather than
+ * producing plausible rubbish, which is what you want for a value that will be
+ * handed to a build as a password.
+ *
+ * Payload format: `v1.<iv>.<tag>.<ciphertext>`, each part base64. The version
+ * prefix exists so the format can be changed without guessing what old rows are.
+ */
+const VERSION = "v1";
+const IV_BYTES = 12; // 96 bits, the size GCM is specified for.
+export function encrypt(plaintext, key) {
+    const iv = randomBytes(IV_BYTES);
+    const cipher = createCipheriv("aes-256-gcm", key, iv);
+    const body = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    return [VERSION, iv.toString("base64"), cipher.getAuthTag().toString("base64"), body.toString("base64")].join(".");
+}
+export function decrypt(payload, key) {
+    const [version, ivB64, tagB64, bodyB64] = payload.split(".");
+    if (version !== VERSION || !ivB64 || !tagB64 || bodyB64 === undefined) {
+        throw new Error("Unrecognised secret format");
+    }
+    const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(ivB64, "base64"));
+    decipher.setAuthTag(Buffer.from(tagB64, "base64"));
+    return Buffer.concat([decipher.update(Buffer.from(bodyB64, "base64")), decipher.final()]).toString("utf8");
+}

package/dist/src/secrets/key.js

@@ -0,0 +1,40 @@
+import { randomBytes } from "node:crypto";
+import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+const KEY_BYTES = 32;
+/**
+ * Reads the vault key, creating it on first use.
+ *
+ * The key lives beside the database but never inside it: someone who walks off
+ * with `laneyard.db` gets ciphertext and nothing else.
+ *
+ * A key another user can read is treated as an error rather than a warning —
+ * the same stance `ssh` takes on private keys, and for the same reason: silently
+ * carrying on would make the encryption decorative.
+ */
+export async function loadOrCreateKey(home) {
+    const path = join(home, "key");
+    try {
+        const info = await stat(path);
+        if ((info.mode & 0o077) !== 0) {
+            throw new Error(`Vault key ${path} is readable by other users. Run \`chmod 600 ${path}\` and start again.`);
+        }
+        const key = await readFile(path);
+        if (key.byteLength !== KEY_BYTES) {
+            throw new Error(`Vault key ${path} is ${key.byteLength} bytes, expected ${KEY_BYTES}. ` +
+                "Refusing to guess: move it aside and Laneyard will create a new one, " +
+                "but every stored secret will have to be entered again.");
+        }
+        return key;
+    }
+    catch (cause) {
+        if (cause.code !== "ENOENT")
+            throw cause;
+    }
+    await mkdir(home, { recursive: true });
+    const key = randomBytes(KEY_BYTES);
+    // The mode is set at creation, not after: a `chmod` afterwards leaves a window
+    // during which the key exists and is world-readable.
+    await writeFile(path, key, { mode: 0o600 });
+    return key;
+}

package/dist/src/secrets/vault.js

@@ -0,0 +1,68 @@
+import { scrub } from "../logs/redact.js";
+import { decrypt, encrypt } from "./cipher.js";
+import { loadOrCreateKey } from "./key.js";
+/**
+ * The only component that ever holds a decrypted secret.
+ *
+ * Everything else — the store, the API, the interface — deals in names and
+ * ciphertext. Keeping plaintext to one small file is what makes "a secret never
+ * reaches a log" a claim you can check by reading, rather than a hope.
+ */
+export class Vault {
+    key;
+    store;
+    constructor(key, store) {
+        this.key = key;
+        this.store = store;
+    }
+    static async open(home, store) {
+        return new Vault(await loadOrCreateKey(home), store);
+    }
+    async set(projectSlug, key, value, masked) {
+        this.store.set(projectSlug, key, encrypt(value, this.key), masked);
+    }
+    remove(projectSlug, key) {
+        return this.store.remove(projectSlug, key);
+    }
+    list(projectSlug) {
+        return this.store.list(projectSlug);
+    }
+    listGlobal() {
+        return this.store.listGlobal();
+    }
+    /**
+     * Removes this project's secret values from a piece of text, in one shot.
+     *
+     * Separate from `Redactor`, which is stateful and belongs to a live stream:
+     * reusing that instance here would corrupt its buffer mid-run.
+     */
+    scrub(projectSlug, text) {
+        return scrub(text, this.maskedValues(projectSlug));
+    }
+    /**
+     * Every secret that applies to a project, ready to become environment variables.
+     *
+     * A row that will not decrypt is skipped rather than thrown: a key that was
+     * rotated or a corrupted row should cost one variable, not the whole build.
+     * The run then fails on its own terms, with fastlane saying what was missing.
+     */
+    resolve(projectSlug) {
+        const out = {};
+        for (const [key, payload] of Object.entries(this.store.encrypted(projectSlug))) {
+            try {
+                out[key] = decrypt(payload, this.key);
+            }
+            catch {
+                // Deliberately silent here; the interface reports unreadable secrets.
+            }
+        }
+        return out;
+    }
+    /** The values a run's output must not contain. */
+    maskedValues(projectSlug) {
+        const masked = this.store.maskedKeys(projectSlug);
+        return Object.entries(this.resolve(projectSlug))
+            .filter(([key]) => masked.has(key))
+            .map(([, value]) => value);
+    }
+}

package/dist/src/server/app.js

@@ -4,16 +4,27 @@ import Fastify from "fastify";
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { LEGACY_ADMIN_NAME } from "../config/load.js";
 import { RunStore } from "../db/runs.js";
 import { Workspace } from "../git/workspace.js";
 import { LogStore } from "../logs/store.js";
-import { LoginThrottle, SESSION_COOKIE, SessionStore, verifyPassword } from "./auth.js";
+import { executeRun } from "../runner/orchestrate.js";
+import { RunQueue } from "../runner/queue.js";
+import { authenticate, LoginThrottle, SESSION_COOKIE, SessionStore } from "./auth.js";
+import { requiresAdmin } from "./permissions.js";
+import { registerFastfileRoutes } from "./routes/fastfile.js";
 import { registerProjectRoutes } from "./routes/projects.js";
+import { registerReadinessRoutes } from "./routes/readiness.js";
 import { registerRunRoutes } from "./routes/runs.js";
+import { registerSecretRoutes } from "./routes/secrets.js";
+import { registerUserRoutes } from "./routes/users.js";
 import { registerWebSocket } from "./ws.js";
 export async function buildApp(deps) {
     const app = Fastify({ logger: false });
     await app.register(cookie);
+    // Declared up front so every request carries the field on the same shape,
+    // rather than each one growing a property the first time a hook writes it.
+    app.decorateRequest("identity", undefined);
     const workspacePath = (slug) => join(deps.root, "workspaces", slug);
     const ctx = {
         ...deps,
@@ -29,38 +40,149 @@ export async function buildApp(deps) {
             await new Workspace(workspacePath(slug), entry.git_url, entry.git_auth).ensureCloned();
         },
     };
+    // The queue is assembled here rather than in `createServerFromConfig`: its job
+    // needs `runs`, `logs`, the workspace and artifact paths and the sockets, none
+    // of which exist before `ctx` does. It is assigned after the context literal
+    // because the job it drives closes over that very context — hence the field
+    // being optional in the type rather than a cast pretending it is already set.
+    ctx.queue = new RunQueue(ctx.runs, async (runId, signal) => {
+        const run = ctx.runs.get(runId);
+        if (!run)
+            return;
+        const slug = run.projectSlug;
+        const entry = deps.config.project(slug);
+        if (!entry) {
+            // The project was removed from config.yml while this run waited. Ending it
+            // here is what keeps the queue from re-reading the same row for ever.
+            ctx.runs.finish(runId, {
+                status: "failed",
+                exitCode: null,
+                errorSummary: `Project "${slug}" is no longer in the configuration`,
+            });
+            return;
+        }
+        await executeRun({
+            runId,
+            runs: ctx.runs,
+            logs: ctx.logs,
+            workspacePath: ctx.workspacePath(slug),
+            artifactsDir: ctx.artifactsDir(runId),
+            gitUrl: entry.git_url,
+            gitAuth: entry.git_auth,
+            branch: entry.default_branch,
+            // Resolved after the clone, once the repository's laneyard.yml is finally readable.
+            resolveSettings: async () => {
+                const r = await ctx.config.resolve(slug, ctx.workspacePath(slug));
+                return r.settings;
+            },
+            env: process.env,
+            secrets: ctx.vault.resolve(slug),
+            maskedValues: ctx.vault.maskedValues(slug),
+            signal,
+            onChunk: (chunk, offset) => app.broadcastRunChunk?.(runId, chunk, offset),
+        })
+            .then((r) => ctx.sockets?.finish(runId, r.status))
+            .catch((cause) => {
+            // Last safety net. `executeRun` commits to never throwing, but the queue
+            // cannot afford to depend on that: a run left neither finished nor
+            // failed is a row the interface polls until someone gives up.
+            ctx.runs.finish(runId, {
+                status: "failed",
+                exitCode: null,
+                errorSummary: ctx.vault.scrub(slug, `Unexpected failure: ${cause.message}`),
+            });
+            ctx.sockets?.finish(runId, "failed");
+        });
+    });
+    // `ctx.queue` is assigned immediately above; naming it here rather than
+    // reaching through the optional field is what lets every route treat the
+    // queue as simply present.
+    const queue = ctx.queue;
+    app.decorate("queue", queue);
+    // A closed server must stop taking new work: the run in flight is left to
+    // finish, but nothing behind it starts on a server nobody is listening to.
+    app.addHook("onClose", async () => queue.close());
     const throttle = new LoginThrottle();
     app.post("/api/login", async (req, reply) => {
-        const { password } = req.body;
-        const hash = deps.config.server()?.password_hash;
-        const waitMs = throttle.retryAfterMs();
+        const { name, password } = (req.body ?? {});
+        // A body with no name is the 0.2 login form, which knew only a password.
+        // It authenticates as `admin`, which is precisely the account a lone
+        // `server.password_hash` is loaded as — so an upgraded install keeps
+        // working, and the loader still owes nobody an answer about which form
+        // the file used.
+        const account = name ?? LEGACY_ADMIN_NAME;
+        const waitMs = throttle.retryAfterMs(account);
         if (waitMs > 0) {
             return reply
                 .code(429)
                 .header("retry-after", Math.ceil(waitMs / 1000))
                 .send({ error: `Too many attempts. Try again in ${Math.ceil(waitMs / 1000)}s.` });
         }
-        if (!password || !hash || !(await verifyPassword(password, hash))) {
-            throttle.recordFailure();
-            return reply.code(401).send({ error: "Incorrect password" });
+        const users = deps.config.server()?.users ?? [];
+        const identity = password ? await authenticate(users, account, password) : null;
+        if (!identity) {
+            throttle.recordFailure(account);
+            // One message for a wrong password and for a name that does not exist:
+            // telling them apart is telling a stranger which accounts are worth
+            // attacking.
+            return reply.code(401).send({ error: "Incorrect name or password" });
         }
-        throttle.recordSuccess();
-        const token = ctx.sessions.issue();
+        throttle.recordSuccess(account);
+        const token = ctx.sessions.issue(identity);
         return reply
             .setCookie(SESSION_COOKIE, token, { path: "/", httpOnly: true, sameSite: "lax" })
-            .send({ ok: true });
+            .send({ ok: true, name: identity.name, role: identity.role });
     });
-    // Every /api route except /api/login requires a session.
+    // Every /api route except /api/login requires a session, and the routes on
+    // the admin list require an admin. Both decided here, once: a permission
+    // expressed as an `if` inside a handler is one nobody finds during an audit.
     app.addHook("onRequest", async (req, reply) => {
-        if (!req.url.startsWith("/api") || req.url === "/api/login")
+        if (!req.url.startsWith("/api") || req.url.split("?")[0] === "/api/login")
             return;
-        if (!ctx.sessions.valid(req.cookies[SESSION_COOKIE])) {
+        const session = ctx.sessions.get(req.cookies[SESSION_COOKIE]);
+        // The session holds who someone was when they signed in; the configuration
+        // holds who they are. They part company whenever config.yml is edited —
+        // from `laneyard user add`, which is another process entirely, or by hand.
+        // So the account is looked up again on every request: an account that is
+        // gone has no session, and a demotion takes effect at once rather than at
+        // the next restart. It is one find over a handful of entries.
+        const account = session && ctx.config.server()?.users.find((u) => u.name === session.name);
+        if (!session || !account) {
             return reply.code(401).send({ error: "Session required" });
         }
+        const identity = { name: account.name, role: account.role };
+        req.identity = identity;
+        if (identity.role !== "admin" && requiresAdmin(req.method, req.url)) {
+            return reply.code(403).send({ error: "This action requires the admin role" });
+        }
+    });
+    /**
+     * Signing out ends this session and no other.
+     *
+     * The same person may be signed in on a laptop and on a phone; pressing sign
+     * out on one of them must not be an act on the other. Only removing the
+     * account ends every session it has, and that is a different action with a
+     * different name.
+     */
+    app.post("/api/logout", async (req, reply) => {
+        const token = req.cookies[SESSION_COOKIE];
+        if (token)
+            ctx.sessions.revoke(token);
+        return reply.clearCookie(SESSION_COOKIE, { path: "/" }).code(204).send();
+    });
+    app.get("/api/me", async (req) => {
+        // Non-null because the hook above rejected every request that has no
+        // identity before this handler could be reached.
+        const { name, role } = req.identity;
+        return { name, role };
     });
     ctx.sockets = await registerWebSocket(app, ctx);
     await registerProjectRoutes(app, ctx);
     await registerRunRoutes(app, ctx);
+    await registerSecretRoutes(app, ctx);
+    await registerReadinessRoutes(app, ctx);
+    await registerFastfileRoutes(app, ctx);
+    await registerUserRoutes(app, ctx);
     // Resolved from the module's location, not from the data folder:
     // `deps.root` is ~/.laneyard, the built SPA lives in the repository. Two
     // relative positions, depending on whether we're running on the sources