laneyard 0.2.0 → 0.3.0

package/dist/src/heuristics/readiness.js

@@ -20,6 +20,9 @@ const META = {
     appStoreConnect: { id: "app-store-connect", title: "App Store Connect authentication" },
     match: { id: "match", title: "match usable without intervention" },
     blockingActions: { id: "blocking-actions", title: "no action known to stop and ask" },
+    androidKeystore: { id: "android-keystore", title: "keystore reachable without a prompt" },
+    playStore: { id: "play-store", title: "Play Store service account" },
+    platforms: { id: "platforms", title: "what this project builds for" },
 };
 /**
  * Does the remote answer without asking anyone for credentials?
@@ -161,33 +164,173 @@ export function checkBlockingActions(uses) {
         [...new Set(findings.map((f) => f.finding.fix))].join(" ")),
     };
 }
+/** `build_android_app` is the newer name for the same action. */
+const GRADLE_ACTIONS = new Set(["gradle", "build_android_app"]);
+/**
+ * The arguments that say a lane hands gradle a keystore of its own.
+ *
+ * Read literally, like everything else here. `gradle(storePassword: ENV["PW"])`
+ * arrives with no `storePassword` at all — the sidecar drops what it cannot
+ * read — and this check says so rather than inventing a verdict.
+ */
+const KEYSTORE_ARGS = ["storeFile", "storePassword"];
+/** `ANDROID_KEYSTORE_PASSWORD`, `KEYSTORE_PASSWORD`, `STORE_PASSWORD`. */
+const KEYSTORE_PASSWORD = /(^|_)(KEYSTORE|STORE)_PASSWORD$/;
+const STORE_KEYSTORE_PASSWORD = "Store the keystore passphrase as `ANDROID_KEYSTORE_PASSWORD` from the secrets tab, " +
+    "and read it in the lane with `storePassword: ENV[\"ANDROID_KEYSTORE_PASSWORD\"]`.";
+export function checkAndroidKeystore(uses, secretKeys) {
+    if (!uses.ok) {
+        return { ...META.androidKeystore, ...undetermined(`could not read the lanes: ${uses.reason}`) };
+    }
+    const calls = uses.value.flatMap((lane) => lane.actions.filter((a) => GRADLE_ACTIONS.has(a.name)).map((action) => ({ lane: lane.lane, action })));
+    if (calls.length === 0) {
+        return { ...META.androidKeystore, ...ok("no lane builds with gradle.") };
+    }
+    const signing = calls.filter((c) => KEYSTORE_ARGS.some((arg) => arg in c.action.args));
+    if (signing.length === 0) {
+        // Deliberately a statement about what was read, not about the build: a
+        // keystore configured in `build.gradle` or through the environment is
+        // invisible from here, and claiming it is absent would be a guess.
+        return {
+            ...META.androidKeystore,
+            ...ok("no lane passes `storeFile` or `storePassword` to gradle: nothing here needs unlocking."),
+        };
+    }
+    const withoutPassphrase = signing.filter((c) => !("storePassword" in c.action.args));
+    if (withoutPassphrase.length === 0) {
+        return {
+            ...META.androidKeystore,
+            ...ok(`${nameList(signing.map((c) => c.lane))} passes \`storePassword\` in the call itself: ` +
+                "gradle has what it needs."),
+        };
+    }
+    if (secretKeys.some((key) => KEYSTORE_PASSWORD.test(key))) {
+        return { ...META.androidKeystore, ...ok("a keystore passphrase is in the vault.") };
+    }
+    return {
+        ...META.androidKeystore,
+        ...warn(`${nameList(withoutPassphrase.map((c) => c.lane))} hands gradle a keystore, but no keystore ` +
+            "passphrase is in the vault: gradle asks for it and waits.", STORE_KEYSTORE_PASSWORD, "secrets"),
+    };
+}
+/** The two names for the same action. `supply` is the older one. */
+const PLAY_UPLOAD_ACTIONS = new Set(["upload_to_play_store", "supply"]);
+/** `SUPPLY_JSON_KEY` and `SUPPLY_JSON_KEY_DATA`, the names fastlane itself reads. */
+const PLAY_JSON_KEY = /^SUPPLY_JSON_KEY/;
+/** The same credential, named in the call instead of in the vault. */
+const PLAY_KEY_ARGS = ["json_key", "json_key_data"];
+const STORE_PLAY_KEY = "Store the service account JSON as `SUPPLY_JSON_KEY_DATA` from the secrets tab. " +
+    "A service account does not expire on its own.";
+export function checkPlayStore(uses, secretKeys) {
+    if (!uses.ok) {
+        return { ...META.playStore, ...undetermined(`could not read the lanes: ${uses.reason}`) };
+    }
+    const calls = uses.value.flatMap((lane) => lane.actions
+        .filter((a) => PLAY_UPLOAD_ACTIONS.has(a.name))
+        .map((action) => ({ lane: lane.lane, action })));
+    if (calls.length === 0) {
+        return { ...META.playStore, ...ok("no lane uploads to the Play Store.") };
+    }
+    if (secretKeys.some((key) => PLAY_JSON_KEY.test(key))) {
+        return { ...META.playStore, ...ok("a Play Store service account is in the vault.") };
+    }
+    const named = calls.filter((c) => PLAY_KEY_ARGS.some((arg) => arg in c.action.args));
+    if (named.length > 0) {
+        // A path in a Fastfile says nothing about whether that file exists on this
+        // machine. Neither a tick nor a warning would be honest.
+        return {
+            ...META.playStore,
+            ...undetermined(`${nameList(named.map((c) => c.lane))} passes \`json_key\` in the call: whether that file is ` +
+                "on this machine is not something a Fastfile says.", STORE_PLAY_KEY),
+        };
+    }
+    return {
+        ...META.playStore,
+        ...warn(`${nameList(calls.map((c) => c.lane))} uploads to the Play Store, but no service account is in ` +
+            "the vault: supply stops and asks which credentials to use.", STORE_PLAY_KEY, "secrets"),
+    };
+}
+/**
+ * The line a project with no platform gets instead of half a checklist.
+ *
+ * It is not a check — nothing was examined — and it is not a warning either.
+ * It says what is missing and where to write it down, and then the shared
+ * checks above it still stand on their own.
+ */
+function platformNote(platforms) {
+    return {
+        ...META.platforms,
+        ...undetermined(platforms.ok
+            ? "no platform detected: no Xcode project and no Gradle build in the repository, " +
+                "and laneyard.yml names none. Only the checks above apply."
+            : `could not tell: ${platforms.reason}. Only the checks above apply.`, "Add `platforms: [ios]`, `[android]` or both to laneyard.yml in the repository, " +
+            "and the checks for that platform appear here."),
+    };
+}
 /**
  * The checklist itself: a table, so that adding a check is adding a row.
  *
  * Exported because the order it declares is the order the interface shows, and
  * a test that checks that should read the same list.
  */
-export const CHECKS = [
-    { ...META.repository, run: (i) => checkRepository(i.probeRepository) },
-    { ...META.dependencies, run: (i) => checkDependencies(i.dependencies) },
-    { ...META.appStoreConnect, run: (i) => checkAppStoreConnect(i.secretKeys) },
-    { ...META.match, run: (i) => checkMatch(i.uses, i.secretKeys) },
-    { ...META.blockingActions, run: (i) => checkBlockingActions(i.uses) },
+export const SECTIONS = [
+    {
+        platform: "all",
+        checks: [
+            { ...META.repository, run: (i) => checkRepository(i.probeRepository) },
+            { ...META.dependencies, run: (i) => checkDependencies(i.dependencies) },
+            { ...META.blockingActions, run: (i) => checkBlockingActions(i.uses) },
+        ],
+    },
+    {
+        platform: "ios",
+        checks: [
+            { ...META.appStoreConnect, run: (i) => checkAppStoreConnect(i.secretKeys) },
+            { ...META.match, run: (i) => checkMatch(i.uses, i.secretKeys) },
+        ],
+    },
+    {
+        platform: "android",
+        checks: [
+            { ...META.androidKeystore, run: (i) => checkAndroidKeystore(i.uses, i.secretKeys) },
+            { ...META.playStore, run: (i) => checkPlayStore(i.uses, i.secretKeys) },
+        ],
+    },
 ];
 /**
- * Runs every check, and guarantees the list comes back whole.
+ * Runs the sections that apply, and guarantees the list comes back whole.
  *
  * Each check already commits to not throwing. This wrapper exists because that
  * promise is worth exactly as much as the next person to edit a check: one
  * probe misbehaving must cost one line of the checklist, not the checklist.
  */
-export async function runChecks(input) {
-    return Promise.all(CHECKS.map(async ({ id, title, run }) => {
-        try {
-            return await run(input);
-        }
-        catch (cause) {
-            return { id, title, state: "unknown", detail: `the check itself failed: ${reasonOf(cause)}` };
-        }
-    }));
+export async function runChecklist(input) {
+    // Read once and defensively: this is the one value used outside a check body,
+    // and a malformed one must not be the thing that empties the whole screen.
+    const platforms = input.platforms && input.platforms.ok && Array.isArray(input.platforms.value)
+        ? input.platforms.value
+        : [];
+    const sections = await Promise.all(SECTIONS.filter((s) => s.platform === "all" || platforms.includes(s.platform)).map(async (section) => ({
+        platform: section.platform,
+        checks: await Promise.all(section.checks.map(async ({ id, title, run }) => {
+            try {
+                return await run(input);
+            }
+            catch (cause) {
+                return {
+                    id,
+                    title,
+                    state: "unknown",
+                    detail: `the check itself failed: ${reasonOf(cause)}`,
+                };
+            }
+        })),
+    })));
+    // The shared section is always first and always present, so the note about a
+    // missing platform sits under the checks that still applied.
+    const shared = sections[0];
+    if (platforms.length === 0 && shared) {
+        shared.checks.push(platformNote(input.platforms ?? { ok: true, value: [] }));
+    }
+    return sections;
 }

package/dist/src/main.js

@@ -3,9 +3,11 @@ import { realpathSync } from "node:fs";
 import { mkdir } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { bold, dim, field, heading } from "./cli/style.js";
 import { fileURLToPath } from "node:url";
-import { runAddCommand } from "./cli/add.js";
+import { runSetupCommand } from "./cli/setup.js";
 import { runSecretCommand } from "./cli/secret.js";
+import { runUserCommand } from "./cli/user.js";
 import { ConfigStore } from "./config/store.js";
 import { CacheStore } from "./db/cache.js";
 import { openDatabase } from "./db/open.js";
@@ -16,7 +18,7 @@ import { Vault } from "./secrets/vault.js";
 import { makeInvoke } from "./sidecar/bridge.js";
 import { LaneReader } from "./sidecar/lanes.js";
 import { UsesReader } from "./sidecar/uses.js";
-export const version = "0.2.0";
+export const version = "0.3.0";
 /** Assembles the server from a data folder. */
 export async function createServerFromConfig(root) {
     const config = new ConfigStore(join(root, "config.yml"));
@@ -61,7 +63,24 @@ async function main() {
     });
     const server = config.server();
     await app.listen({ port: server.port, host: server.bind });
-    console.log(`Laneyard is listening on http://localhost:${server.port}`);
+    const projects = config.projects();
+    process.stdout.write(heading(`laneyard ${version}`) +
+        field("listening", `http://localhost:${server.port}`) +
+        "\n" +
+        field("config", join(root, "config.yml")) +
+        "\n" +
+        field("projects", projects.length === 0
+            ? dim("none yet")
+            : projects.map((p) => p.slug).join(", ")) +
+        "\n" +
+        (projects.length === 0
+            ? // A server with nothing to build should say what to do next rather
+                // than sit there looking successful.
+                "\n" +
+                    dim("  No project yet. From a folder that already uses fastlane:\n") +
+                    `  ${bold("laneyard setup")}\n`
+            : "") +
+        "\n");
 }
 /**
  * True when this file is what the user launched, rather than something that
@@ -84,9 +103,12 @@ function invokedDirectly() {
 }
 const USAGE = `laneyard — a self-hosted web UI for fastlane
 
-  laneyard add        adopt the project in the current directory
+  laneyard setup      set up the project in the current directory
+                      --yes accepts every detected value without asking
   laneyard secret set NAME [--project <slug>]
                       store a secret, its value read from standard input
+  laneyard user add NAME [--role admin|builder]
+                      create an account, its password read from standard input
   laneyard            start the server
   laneyard --version  print the version
 
@@ -101,7 +123,7 @@ function explainStartupFailure(cause) {
     if (message.includes("ENOENT") && message.includes("config.yml")) {
         return ("No configuration yet.\n\n" +
             "  cd into a project that already uses fastlane, then run:\n" +
-            "    laneyard add\n\n" +
+            "    laneyard setup\n\n" +
             "That writes " + join(homeDir(), "config.yml") + " for you.");
     }
     return message;
@@ -116,13 +138,16 @@ if (invokedDirectly()) {
         process.stdout.write(`${version}\n`);
         process.exit(0);
     }
-    if (command === "add") {
+    if (command === "setup") {
         const home = homeDir();
         await mkdir(home, { recursive: true });
         const slugIndex = rest.indexOf("--slug");
         const slug = slugIndex === -1 ? undefined : rest[slugIndex + 1];
+        // `--yes` accepts every proposal, for scripts and for anyone who has done
+        // this before. Interactive is the default because the values are guesses.
+        const yes = rest.includes("--yes") || rest.includes("-y");
         try {
-            process.exit(await runAddCommand(process.cwd(), join(home, "config.yml"), slug));
+            process.exit(await runSetupCommand(process.cwd(), join(home, "config.yml"), { slug, yes }));
         }
         catch (cause) {
             // A taken slug or an unreadable file are ordinary situations. A stack
@@ -142,6 +167,22 @@ if (invokedDirectly()) {
             err: (text) => process.stderr.write(text),
         }));
     }
+    if (command === "user") {
+        const home = homeDir();
+        await mkdir(home, { recursive: true });
+        process.exit(await runUserCommand(home, rest, {
+            stdin: process.stdin,
+            interactive: process.stdin.isTTY === true,
+            out: (text) => process.stdout.write(text),
+            err: (text) => process.stderr.write(text),
+        }));
+    }
+    // 0.1.0 shipped this as `add`. Anyone who learned that name deserves a
+    // sentence rather than "Unknown command".
+    if (command === "add") {
+        process.stderr.write("`laneyard add` is now `laneyard setup`.\n");
+        process.exit(1);
+    }
     if (command !== undefined) {
         process.stderr.write(`Unknown command: ${command}\n\n${USAGE}`);
         process.exit(1);

package/dist/src/server/app.js

@@ -4,21 +4,27 @@ import Fastify from "fastify";
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { LEGACY_ADMIN_NAME } from "../config/load.js";
 import { RunStore } from "../db/runs.js";
 import { Workspace } from "../git/workspace.js";
 import { LogStore } from "../logs/store.js";
 import { executeRun } from "../runner/orchestrate.js";
 import { RunQueue } from "../runner/queue.js";
-import { LoginThrottle, SESSION_COOKIE, SessionStore, verifyPassword } from "./auth.js";
+import { authenticate, LoginThrottle, SESSION_COOKIE, SessionStore } from "./auth.js";
+import { requiresAdmin } from "./permissions.js";
 import { registerFastfileRoutes } from "./routes/fastfile.js";
 import { registerProjectRoutes } from "./routes/projects.js";
 import { registerReadinessRoutes } from "./routes/readiness.js";
 import { registerRunRoutes } from "./routes/runs.js";
 import { registerSecretRoutes } from "./routes/secrets.js";
+import { registerUserRoutes } from "./routes/users.js";
 import { registerWebSocket } from "./ws.js";
 export async function buildApp(deps) {
     const app = Fastify({ logger: false });
     await app.register(cookie);
+    // Declared up front so every request carries the field on the same shape,
+    // rather than each one growing a property the first time a hook writes it.
+    app.decorateRequest("identity", undefined);
     const workspacePath = (slug) => join(deps.root, "workspaces", slug);
     const ctx = {
         ...deps,
@@ -98,32 +104,77 @@ export async function buildApp(deps) {
     app.addHook("onClose", async () => queue.close());
     const throttle = new LoginThrottle();
     app.post("/api/login", async (req, reply) => {
-        const { password } = req.body;
-        const hash = deps.config.server()?.password_hash;
-        const waitMs = throttle.retryAfterMs();
+        const { name, password } = (req.body ?? {});
+        // A body with no name is the 0.2 login form, which knew only a password.
+        // It authenticates as `admin`, which is precisely the account a lone
+        // `server.password_hash` is loaded as — so an upgraded install keeps
+        // working, and the loader still owes nobody an answer about which form
+        // the file used.
+        const account = name ?? LEGACY_ADMIN_NAME;
+        const waitMs = throttle.retryAfterMs(account);
         if (waitMs > 0) {
             return reply
                 .code(429)
                 .header("retry-after", Math.ceil(waitMs / 1000))
                 .send({ error: `Too many attempts. Try again in ${Math.ceil(waitMs / 1000)}s.` });
         }
-        if (!password || !hash || !(await verifyPassword(password, hash))) {
-            throttle.recordFailure();
-            return reply.code(401).send({ error: "Incorrect password" });
+        const users = deps.config.server()?.users ?? [];
+        const identity = password ? await authenticate(users, account, password) : null;
+        if (!identity) {
+            throttle.recordFailure(account);
+            // One message for a wrong password and for a name that does not exist:
+            // telling them apart is telling a stranger which accounts are worth
+            // attacking.
+            return reply.code(401).send({ error: "Incorrect name or password" });
         }
-        throttle.recordSuccess();
-        const token = ctx.sessions.issue();
+        throttle.recordSuccess(account);
+        const token = ctx.sessions.issue(identity);
         return reply
             .setCookie(SESSION_COOKIE, token, { path: "/", httpOnly: true, sameSite: "lax" })
-            .send({ ok: true });
+            .send({ ok: true, name: identity.name, role: identity.role });
     });
-    // Every /api route except /api/login requires a session.
+    // Every /api route except /api/login requires a session, and the routes on
+    // the admin list require an admin. Both decided here, once: a permission
+    // expressed as an `if` inside a handler is one nobody finds during an audit.
     app.addHook("onRequest", async (req, reply) => {
-        if (!req.url.startsWith("/api") || req.url === "/api/login")
+        if (!req.url.startsWith("/api") || req.url.split("?")[0] === "/api/login")
             return;
-        if (!ctx.sessions.valid(req.cookies[SESSION_COOKIE])) {
+        const session = ctx.sessions.get(req.cookies[SESSION_COOKIE]);
+        // The session holds who someone was when they signed in; the configuration
+        // holds who they are. They part company whenever config.yml is edited —
+        // from `laneyard user add`, which is another process entirely, or by hand.
+        // So the account is looked up again on every request: an account that is
+        // gone has no session, and a demotion takes effect at once rather than at
+        // the next restart. It is one find over a handful of entries.
+        const account = session && ctx.config.server()?.users.find((u) => u.name === session.name);
+        if (!session || !account) {
             return reply.code(401).send({ error: "Session required" });
         }
+        const identity = { name: account.name, role: account.role };
+        req.identity = identity;
+        if (identity.role !== "admin" && requiresAdmin(req.method, req.url)) {
+            return reply.code(403).send({ error: "This action requires the admin role" });
+        }
+    });
+    /**
+     * Signing out ends this session and no other.
+     *
+     * The same person may be signed in on a laptop and on a phone; pressing sign
+     * out on one of them must not be an act on the other. Only removing the
+     * account ends every session it has, and that is a different action with a
+     * different name.
+     */
+    app.post("/api/logout", async (req, reply) => {
+        const token = req.cookies[SESSION_COOKIE];
+        if (token)
+            ctx.sessions.revoke(token);
+        return reply.clearCookie(SESSION_COOKIE, { path: "/" }).code(204).send();
+    });
+    app.get("/api/me", async (req) => {
+        // Non-null because the hook above rejected every request that has no
+        // identity before this handler could be reached.
+        const { name, role } = req.identity;
+        return { name, role };
     });
     ctx.sockets = await registerWebSocket(app, ctx);
     await registerProjectRoutes(app, ctx);
@@ -131,6 +182,7 @@ export async function buildApp(deps) {
     await registerSecretRoutes(app, ctx);
     await registerReadinessRoutes(app, ctx);
     await registerFastfileRoutes(app, ctx);
+    await registerUserRoutes(app, ctx);
     // Resolved from the module's location, not from the data folder:
     // `deps.root` is ~/.laneyard, the built SPA lives in the repository. Two
     // relative positions, depending on whether we're running on the sources

package/dist/src/server/auth.js

@@ -37,45 +37,113 @@ export async function verifyPassword(password, stored) {
         return false;
     }
 }
+/**
+ * A hash no password matches, used to spend the same work on an unknown name.
+ *
+ * Built from random bytes rather than by hashing something: `hashPassword` is
+ * synchronous and would freeze the server for its duration. The shape is what
+ * matters — `verifyPassword` derives a 32-byte key with the same parameters and
+ * then fails the comparison, which is exactly what a wrong password costs.
+ */
+const DECOY_HASH = `scrypt$${randomBytes(16).toString("hex")}$${randomBytes(32).toString("hex")}`;
+/**
+ * Turns a name and a password into who that is, or into nothing.
+ *
+ * An unknown name is verified against a decoy hash instead of returning early.
+ * Without that, a refusal for a name that does not exist comes back in
+ * microseconds while a wrong password takes the thirty milliseconds scrypt
+ * costs — and the login form becomes a way to enumerate accounts before trying
+ * a single password against them.
+ */
+export async function authenticate(users, name, password) {
+    const user = users.find((u) => u.name === name);
+    if (!user) {
+        await verifyPassword(password, DECOY_HASH);
+        return null;
+    }
+    if (!(await verifyPassword(password, user.password_hash)))
+        return null;
+    return { name: user.name, role: user.role };
+}
 /** In-memory sessions: they don't survive a restart, and that's just fine. */
 export class SessionStore {
-    tokens = new Set();
-    issue() {
+    tokens = new Map();
+    issue(identity) {
         const token = randomBytes(32).toString("hex");
-        this.tokens.add(token);
+        this.tokens.set(token, identity);
         return token;
     }
+    /** Who the token belongs to, or undefined if it belongs to nobody. */
+    get(token) {
+        return token === undefined ? undefined : this.tokens.get(token);
+    }
     valid(token) {
-        return token !== undefined && this.tokens.has(token);
+        return this.get(token) !== undefined;
     }
     revoke(token) {
         this.tokens.delete(token);
     }
+    /**
+     * Drops every session belonging to a name.
+     *
+     * The identity is snapshotted when the session is issued, which is what makes
+     * a request cheap — but it also means removing an account or changing its role
+     * leaves the old answer live in whatever browsers already had it. Without this,
+     * "remove the account" and "revoke access" are two different things, while
+     * every interface that offers the first implies the second.
+     */
+    revokeAllFor(name) {
+        for (const [token, identity] of this.tokens) {
+            if (identity.name === name)
+                this.tokens.delete(token);
+        }
+    }
 }
 export const SESSION_COOKIE = "laneyard_session";
+/** Past this many tracked names, the entries that no longer delay anyone go. */
+const THROTTLE_PRUNE_ABOVE = 1_000;
 /**
- * Slows down repeated login attempts.
+ * Slows down repeated login attempts, one account at a time.
  *
  * Without this, a network neighbour could try passwords as fast as the
  * server responds. The delay grows with failures and resets to zero on a
  * success: the legitimate user who mistypes once doesn't feel it.
+ *
+ * Counted per name rather than globally: a single counter means anyone able to
+ * reach the login form can lock out every account on the server by hammering
+ * one name — a denial of service disguised as a security measure.
  */
 export class LoginThrottle {
-    failures = 0;
-    until = 0;
-    /** Milliseconds left to wait, 0 if the way is clear. */
-    retryAfterMs(now = Date.now()) {
-        return Math.max(0, this.until - now);
+    perName = new Map();
+    /** Milliseconds left to wait for that name, 0 if the way is clear. */
+    retryAfterMs(name, now = Date.now()) {
+        return Math.max(0, (this.perName.get(name)?.until ?? 0) - now);
     }
-    recordFailure(now = Date.now()) {
-        this.failures += 1;
+    recordFailure(name, now = Date.now()) {
+        const state = this.perName.get(name) ?? { failures: 0, until: 0 };
+        state.failures += 1;
         // 0, 0, 0, then 1s, 2s, 4s… capped at one minute.
-        if (this.failures > 3) {
-            this.until = now + Math.min(60_000, 2 ** (this.failures - 4) * 1000);
+        if (state.failures > 3) {
+            state.until = now + Math.min(60_000, 2 ** (state.failures - 4) * 1000);
         }
+        this.perName.set(name, state);
+        // The key is whatever the caller sent, so an attacker chooses how many
+        // entries exist. Dropping those whose delay has run out bounds the map by
+        // how fast someone can be delayed, not by how many names they can invent.
+        if (this.perName.size > THROTTLE_PRUNE_ABOVE)
+            this.prune(now);
     }
-    recordSuccess() {
-        this.failures = 0;
-        this.until = 0;
+    recordSuccess(name) {
+        this.perName.delete(name);
+    }
+    /** Number of names currently tracked. Exposed so the pruning can be tested. */
+    size() {
+        return this.perName.size;
+    }
+    prune(now) {
+        for (const [name, state] of this.perName) {
+            if (state.until <= now)
+                this.perName.delete(name);
+        }
     }
 }

package/dist/src/server/permissions.js

@@ -0,0 +1,73 @@
+/**
+ * Who can do what — the whole answer, in one file.
+ *
+ * A permission expressed as an `if` inside a handler is a permission nobody
+ * finds when it matters: during an audit, or after an incident. So there are no
+ * such `if`s. Every route that needs more than a session is named below, and the
+ * single hook in `app.ts` is the only thing that reads this.
+ *
+ * Two roles, and only two. `admin` may do everything; `builder` may start a
+ * build, watch it, cancel it and download what it produced — nothing that
+ * changes what a build does, and nothing that reveals a credential.
+ */
+/**
+ * What each route needs. Everything absent from this list needs only a session.
+ *
+ * Reading the Fastfile is deliberately not here: a builder who can start a lane
+ * benefits from seeing what it does, and it contains no credential — anything
+ * that does is in the vault, which is.
+ */
+export const REQUIRES_ADMIN = [
+    { method: "*", path: "/api/secrets" },
+    { method: "*", path: "/api/projects/:slug/secrets" },
+    { method: "PUT", path: "/api/projects/:slug/fastfile" },
+    { method: "POST", path: "/api/projects/:slug/commit" },
+    { method: "POST", path: "/api/projects/:slug/push" },
+    { method: "DELETE", path: "/api/projects/:slug" },
+    { method: "*", path: "/api/users" },
+];
+/**
+ * `/api/secrets/APP_KEY?x=1` → `["api", "secrets", "APP_KEY"]`.
+ *
+ * Each segment is percent-decoded, because the router decodes before it matches
+ * and this must see the same path the router did. Comparing the raw text sent
+ * `GET /api/%73ecrets` straight past the admin list and into the vault: Fastify
+ * routed it to `/api/secrets`, and this function had been looking at `%73ecrets`.
+ */
+function segments(url) {
+    return (url.split("?")[0] ?? "")
+        .split("/")
+        .filter((s) => s !== "")
+        .map((s) => {
+        try {
+            return decodeURIComponent(s);
+        }
+        catch {
+            // Malformed escapes reach no route either; left as-is rather than
+            // swallowed, so a segment is never silently emptied into a match.
+            return s;
+        }
+    });
+}
+/**
+ * Does this request need an admin?
+ *
+ * A pattern matches a request whose path *starts with* it, segment by segment,
+ * with `:name` standing for any one segment. The prefix is deliberate:
+ * `/api/secrets` means the vault, not one URL, and a table naming every key's
+ * route separately would be a table someone forgets to extend the next time a
+ * route is added under it. It only ever errs towards refusing, since every
+ * entry here is a restriction.
+ */
+export function requiresAdmin(method, url) {
+    const parts = segments(url);
+    const verb = method.toUpperCase();
+    return REQUIRES_ADMIN.some((pattern) => {
+        if (pattern.method !== "*" && pattern.method.toUpperCase() !== verb)
+            return false;
+        const expected = segments(pattern.path);
+        if (parts.length < expected.length)
+            return false;
+        return expected.every((seg, i) => seg.startsWith(":") || seg === parts[i]);
+    });
+}