laneyard 0.2.0 → 0.4.0

package/dist/src/secrets/vault.js

@@ -1,3 +1,4 @@
+import { fieldsOf } from "../credentials/kinds.js";
 import { scrub } from "../logs/redact.js";
 import { decrypt, encrypt } from "./cipher.js";
 import { loadOrCreateKey } from "./key.js";
@@ -11,12 +12,14 @@ import { loadOrCreateKey } from "./key.js";
 export class Vault {
     key;
     store;
-    constructor(key, store) {
+    credentials;
+    constructor(key, store, credentials) {
         this.key = key;
         this.store = store;
+        this.credentials = credentials;
     }
-    static async open(home, store) {
-        return new Vault(await loadOrCreateKey(home), store);
+    static async open(home, store, credentials) {
+        return new Vault(await loadOrCreateKey(home), store, credentials);
     }
     async set(projectSlug, key, value, masked) {
         this.store.set(projectSlug, key, encrypt(value, this.key), masked);
@@ -58,11 +61,109 @@ export class Vault {
         }
         return out;
     }
-    /** The values a run's output must not contain. */
+    /**
+     * One value, in the clear — and only when it was never declared secret.
+     *
+     * The refusal is the point. This vault has been write-only since it was
+     * written: the server never sent a value back, so the interface had nothing to
+     * uncover and no browser ever held one. That is worth keeping for anything
+     * anyone called a secret.
+     *
+     * But not everything stored here is one. `APP_VERSION`, `SENTRY_ORG`, an
+     * issuer id — those are identifiers, and being unable to check what was stored
+     * makes an import something you have to take on faith. The line between the
+     * two already existed and is the user's own: `masked` is "keep this out of the
+     * logs". A value that carries it is never returned, whoever asks.
+     *
+     * Returns null for an unknown key, and throws for a masked one — a caller
+     * that forgot to check must fail loudly rather than leak.
+     */
+    reveal(projectSlug, key) {
+        const row = this.store.find(projectSlug, key);
+        if (!row)
+            return null;
+        if (row.masked) {
+            throw new Error(`${key} is kept out of the logs, so its value is never sent back.`);
+        }
+        return decrypt(row.valueEnc, this.key);
+    }
+    /** Flips whether a value is kept out of the logs, leaving the value alone. */
+    setMasked(projectSlug, key, masked) {
+        return this.store.setMasked(projectSlug, key, masked);
+    }
+    /**
+     * Stores a signing block: the file, and the fields that make it usable.
+     *
+     * `cipher.ts` speaks strings and a `.jks` is bytes, so the file makes the trip
+     * as base64. The fields travel as one JSON object rather than one row each,
+     * because a keystore missing its alias is not a block with a gap in it — it is
+     * not a block.
+     */
+    async setCredential(projectSlug, kind, block) {
+        this.credentials.set(projectSlug, kind, {
+            fileName: block.fileName,
+            fileEnc: encrypt(block.fileBytes.toString("base64"), this.key),
+            fieldsEnc: encrypt(JSON.stringify(block.fields), this.key),
+            varNames: block.varNames,
+        });
+    }
+    /**
+     * One block that applies to a project, in the clear, or undefined if there is none.
+     *
+     * Unlike `resolve`, an unreadable row throws. The leniency there is earned: a
+     * missing variable makes fastlane stop and say which one. A block that quietly
+     * fails to decrypt costs a debug-signed artifact that builds, uploads, and is
+     * rejected by the store days later — by which point nobody is looking at this
+     * run's log. The kind is in the message because that is the part you need to
+     * know before you can act.
+     */
+    resolveCredential(projectSlug, kind) {
+        const row = this.credentials.find(projectSlug, kind);
+        if (!row)
+            return undefined;
+        try {
+            return {
+                fileName: row.fileName,
+                fileBytes: Buffer.from(decrypt(row.fileEnc, this.key), "base64"),
+                fields: JSON.parse(decrypt(row.fieldsEnc, this.key)),
+                varNames: row.varNames,
+            };
+        }
+        catch {
+            throw new Error(`The stored ${kind} block cannot be decrypted. Its encryption key changed or the row is damaged; upload the credential again.`);
+        }
+    }
+    listCredentials(projectSlug) {
+        return this.credentials.list(projectSlug);
+    }
+    listGlobalCredentials() {
+        return this.credentials.listGlobal();
+    }
+    removeCredential(projectSlug, kind) {
+        return this.credentials.remove(projectSlug, kind);
+    }
+    /**
+     * The values a run's output must not contain.
+     *
+     * A block's secret fields belong here as much as a masked secret does: a
+     * keystore password reaches the build as an environment variable, and gradle
+     * is perfectly willing to echo one back on failure.
+     */
     maskedValues(projectSlug) {
         const masked = this.store.maskedKeys(projectSlug);
-        return Object.entries(this.resolve(projectSlug))
+        const values = Object.entries(this.resolve(projectSlug))
             .filter(([key]) => masked.has(key))
             .map(([, value]) => value);
+        for (const summary of this.credentials.list(projectSlug)) {
+            const block = this.resolveCredential(projectSlug, summary.kind);
+            if (!block)
+                continue;
+            for (const field of fieldsOf(summary.kind)) {
+                const value = block.fields[field.name];
+                if (field.secret && value)
+                    values.push(value);
+            }
+        }
+        return values;
     }
 }

package/dist/src/server/app.js

@@ -4,29 +4,40 @@ import Fastify from "fastify";
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { LEGACY_ADMIN_NAME } from "../config/load.js";
 import { RunStore } from "../db/runs.js";
+import { SessionRecords } from "../db/sessions.js";
 import { Workspace } from "../git/workspace.js";
 import { LogStore } from "../logs/store.js";
+import { materialiseCredentials } from "../runner/materialise.js";
 import { executeRun } from "../runner/orchestrate.js";
 import { RunQueue } from "../runner/queue.js";
-import { LoginThrottle, SESSION_COOKIE, SessionStore, verifyPassword } from "./auth.js";
+import { authenticate, LoginThrottle, COOKIE_OPTIONS, SESSION_COOKIE, SessionStore } from "./auth.js";
+import { requiresAdmin } from "./permissions.js";
+import { registerCredentialRoutes } from "./routes/credentials.js";
 import { registerFastfileRoutes } from "./routes/fastfile.js";
 import { registerProjectRoutes } from "./routes/projects.js";
+import { registerAccountRoutes } from "./routes/account.js";
 import { registerReadinessRoutes } from "./routes/readiness.js";
 import { registerRunRoutes } from "./routes/runs.js";
 import { registerSecretRoutes } from "./routes/secrets.js";
+import { registerUserRoutes } from "./routes/users.js";
 import { registerWebSocket } from "./ws.js";
 export async function buildApp(deps) {
     const app = Fastify({ logger: false });
     await app.register(cookie);
+    // Declared up front so every request carries the field on the same shape,
+    // rather than each one growing a property the first time a hook writes it.
+    app.decorateRequest("identity", undefined);
     const workspacePath = (slug) => join(deps.root, "workspaces", slug);
     const ctx = {
         ...deps,
         runs: new RunStore(deps.db),
         logs: new LogStore(join(deps.root, "logs")),
-        sessions: new SessionStore(),
+        sessions: new SessionStore(new SessionRecords(deps.db)),
         workspacePath,
         artifactsDir: (runId) => join(deps.root, "artifacts", String(runId)),
+        runSecretsDir: (runId) => join(deps.root, "runs", String(runId), "secrets"),
         ensureWorkspace: async (slug) => {
             const entry = deps.config.project(slug);
             if (!entry)
@@ -55,6 +66,23 @@ export async function buildApp(deps) {
             });
             return;
         }
+        // Before the run, and outside it: `executeRun` is handed plaintext and
+        // never the vault, a boundary worth more than the convenience of moving
+        // this one call inside. A block that will not decrypt stops the run here,
+        // with the reason, rather than producing an artifact signed by nothing.
+        let credentials;
+        try {
+            credentials = await materialiseCredentials(ctx.vault, slug, ctx.runSecretsDir(runId));
+        }
+        catch (cause) {
+            ctx.runs.finish(runId, {
+                status: "failed",
+                exitCode: null,
+                errorSummary: ctx.vault.scrub(slug, cause.message),
+            });
+            ctx.sockets?.finish(runId, "failed");
+            return;
+        }
         await executeRun({
             runId,
             runs: ctx.runs,
@@ -71,6 +99,9 @@ export async function buildApp(deps) {
             },
             env: process.env,
             secrets: ctx.vault.resolve(slug),
+            credentialEnv: credentials.env,
+            androidKeystore: credentials.keystore,
+            cleanup: credentials.cleanup,
             maskedValues: ctx.vault.maskedValues(slug),
             signal,
             onChunk: (chunk, offset) => app.broadcastRunChunk?.(runId, chunk, offset),
@@ -98,39 +129,87 @@ export async function buildApp(deps) {
     app.addHook("onClose", async () => queue.close());
     const throttle = new LoginThrottle();
     app.post("/api/login", async (req, reply) => {
-        const { password } = req.body;
-        const hash = deps.config.server()?.password_hash;
-        const waitMs = throttle.retryAfterMs();
+        const { name, password } = (req.body ?? {});
+        // A body with no name is the 0.2 login form, which knew only a password.
+        // It authenticates as `admin`, which is precisely the account a lone
+        // `server.password_hash` is loaded as — so an upgraded install keeps
+        // working, and the loader still owes nobody an answer about which form
+        // the file used.
+        const account = name ?? LEGACY_ADMIN_NAME;
+        const waitMs = throttle.retryAfterMs(account);
         if (waitMs > 0) {
             return reply
                 .code(429)
                 .header("retry-after", Math.ceil(waitMs / 1000))
                 .send({ error: `Too many attempts. Try again in ${Math.ceil(waitMs / 1000)}s.` });
         }
-        if (!password || !hash || !(await verifyPassword(password, hash))) {
-            throttle.recordFailure();
-            return reply.code(401).send({ error: "Incorrect password" });
+        const users = deps.config.server()?.users ?? [];
+        const identity = password ? await authenticate(users, account, password) : null;
+        if (!identity) {
+            throttle.recordFailure(account);
+            // One message for a wrong password and for a name that does not exist:
+            // telling them apart is telling a stranger which accounts are worth
+            // attacking.
+            return reply.code(401).send({ error: "Incorrect name or password" });
         }
-        throttle.recordSuccess();
-        const token = ctx.sessions.issue();
+        throttle.recordSuccess(account);
+        const token = ctx.sessions.issue(identity);
         return reply
-            .setCookie(SESSION_COOKIE, token, { path: "/", httpOnly: true, sameSite: "lax" })
-            .send({ ok: true });
+            .setCookie(SESSION_COOKIE, token, COOKIE_OPTIONS)
+            .send({ ok: true, name: identity.name, role: identity.role });
     });
-    // Every /api route except /api/login requires a session.
+    // Every /api route except /api/login requires a session, and the routes on
+    // the admin list require an admin. Both decided here, once: a permission
+    // expressed as an `if` inside a handler is one nobody finds during an audit.
     app.addHook("onRequest", async (req, reply) => {
-        if (!req.url.startsWith("/api") || req.url === "/api/login")
+        if (!req.url.startsWith("/api") || req.url.split("?")[0] === "/api/login")
             return;
-        if (!ctx.sessions.valid(req.cookies[SESSION_COOKIE])) {
+        const session = ctx.sessions.get(req.cookies[SESSION_COOKIE]);
+        // The session holds who someone was when they signed in; the configuration
+        // holds who they are. They part company whenever config.yml is edited —
+        // from `laneyard user add`, which is another process entirely, or by hand.
+        // So the account is looked up again on every request: an account that is
+        // gone has no session, and a demotion takes effect at once rather than at
+        // the next restart. It is one find over a handful of entries.
+        const account = session && ctx.config.server()?.users.find((u) => u.name === session.name);
+        if (!session || !account) {
             return reply.code(401).send({ error: "Session required" });
         }
+        const identity = { name: account.name, role: account.role };
+        req.identity = identity;
+        if (identity.role !== "admin" && requiresAdmin(req.method, req.url)) {
+            return reply.code(403).send({ error: "This action requires the admin role" });
+        }
+    });
+    /**
+     * Signing out ends this session and no other.
+     *
+     * The same person may be signed in on a laptop and on a phone; pressing sign
+     * out on one of them must not be an act on the other. Only removing the
+     * account ends every session it has, and that is a different action with a
+     * different name.
+     */
+    app.post("/api/logout", async (req, reply) => {
+        const token = req.cookies[SESSION_COOKIE];
+        if (token)
+            ctx.sessions.revoke(token);
+        return reply.clearCookie(SESSION_COOKIE, { path: "/" }).code(204).send();
+    });
+    app.get("/api/me", async (req) => {
+        // Non-null because the hook above rejected every request that has no
+        // identity before this handler could be reached.
+        const { name, role } = req.identity;
+        return { name, role };
     });
     ctx.sockets = await registerWebSocket(app, ctx);
     await registerProjectRoutes(app, ctx);
     await registerRunRoutes(app, ctx);
     await registerSecretRoutes(app, ctx);
+    await registerCredentialRoutes(app, ctx);
     await registerReadinessRoutes(app, ctx);
     await registerFastfileRoutes(app, ctx);
+    await registerUserRoutes(app, ctx);
+    await registerAccountRoutes(app, ctx);
     // Resolved from the module's location, not from the data folder:
     // `deps.root` is ~/.laneyard, the built SPA lives in the repository. Two
     // relative positions, depending on whether we're running on the sources

package/dist/src/server/auth.js

@@ -37,45 +37,153 @@ export async function verifyPassword(password, stored) {
         return false;
     }
 }
-/** In-memory sessions: they don't survive a restart, and that's just fine. */
+/**
+ * A hash no password matches, used to spend the same work on an unknown name.
+ *
+ * Built from random bytes rather than by hashing something: `hashPassword` is
+ * synchronous and would freeze the server for its duration. The shape is what
+ * matters — `verifyPassword` derives a 32-byte key with the same parameters and
+ * then fails the comparison, which is exactly what a wrong password costs.
+ */
+const DECOY_HASH = `scrypt$${randomBytes(16).toString("hex")}$${randomBytes(32).toString("hex")}`;
+/**
+ * Turns a name and a password into who that is, or into nothing.
+ *
+ * An unknown name is verified against a decoy hash instead of returning early.
+ * Without that, a refusal for a name that does not exist comes back in
+ * microseconds while a wrong password takes the thirty milliseconds scrypt
+ * costs — and the login form becomes a way to enumerate accounts before trying
+ * a single password against them.
+ */
+export async function authenticate(users, name, password) {
+    const user = users.find((u) => u.name === name);
+    if (!user) {
+        await verifyPassword(password, DECOY_HASH);
+        return null;
+    }
+    if (!(await verifyPassword(password, user.password_hash)))
+        return null;
+    return { name: user.name, role: user.role };
+}
+/**
+ * How long a session lasts, and how long the cookie is kept for.
+ *
+ * Thirty days, not forever: a browser left on a desk is the reason the password
+ * change asks for the current password, and a session that never ended would
+ * make that precaution pointless. The cookie carries the same figure, so the
+ * browser stops presenting a token the server would refuse anyway.
+ */
+export const SESSION_TTL_DAYS = 30;
+export const SESSION_TTL_MS = SESSION_TTL_DAYS * 24 * 60 * 60 * 1000;
+/**
+ * Sessions, kept in the database so they outlive a restart.
+ *
+ * They used to be a Map, with a comment saying they did not survive a restart
+ * "and that's just fine". It was not: restarting the server to pick up an edit
+ * to config.yml signed everybody out, which on a machine still being set up is
+ * several times an hour. The API is unchanged — every caller still issues, gets
+ * and revokes — only the shelf underneath is different.
+ */
 export class SessionStore {
-    tokens = new Set();
-    issue() {
+    records;
+    constructor(records) {
+        this.records = records;
+    }
+    issue(identity, now = new Date()) {
         const token = randomBytes(32).toString("hex");
-        this.tokens.add(token);
+        this.records.insert(token, identity, new Date(now.getTime() + SESSION_TTL_MS));
         return token;
     }
+    /** Who the token belongs to, or undefined if it belongs to nobody. */
+    get(token) {
+        if (token === undefined)
+            return undefined;
+        const owner = this.records.find(token);
+        return owner ? { name: owner.name, role: owner.role } : undefined;
+    }
     valid(token) {
-        return token !== undefined && this.tokens.has(token);
+        return this.get(token) !== undefined;
     }
     revoke(token) {
-        this.tokens.delete(token);
+        this.records.remove(token);
+    }
+    /**
+     * Drops every session belonging to a name.
+     *
+     * The identity is snapshotted when the session is issued, which is what makes
+     * a request cheap — but it also means removing an account or changing its role
+     * leaves the old answer live in whatever browsers already had it. Without this,
+     * "remove the account" and "revoke access" are two different things, while
+     * every interface that offers the first implies the second.
+     */
+    revokeAllFor(name) {
+        this.records.removeAllFor(name);
     }
 }
 export const SESSION_COOKIE = "laneyard_session";
 /**
- * Slows down repeated login attempts.
+ * How the session cookie is written, in one place so the two routes that issue
+ * one cannot disagree.
+ *
+ * `maxAge` is the half that was missing: without it the browser treats this as
+ * a session cookie and forgets it the moment the window closes, so signing in
+ * again was the price of quitting Chrome. It matches the server's own TTL, so
+ * the browser stops presenting a token the server would refuse anyway.
+ *
+ * Not `secure`: Laneyard is commonly reached over plain HTTP on a local
+ * network, and a cookie the browser refuses to send is a login page that never
+ * goes away.
+ */
+export const COOKIE_OPTIONS = {
+    path: "/",
+    httpOnly: true,
+    sameSite: "lax",
+    maxAge: SESSION_TTL_MS / 1000,
+};
+/** Past this many tracked names, the entries that no longer delay anyone go. */
+const THROTTLE_PRUNE_ABOVE = 1_000;
+/**
+ * Slows down repeated login attempts, one account at a time.
  *
  * Without this, a network neighbour could try passwords as fast as the
  * server responds. The delay grows with failures and resets to zero on a
  * success: the legitimate user who mistypes once doesn't feel it.
+ *
+ * Counted per name rather than globally: a single counter means anyone able to
+ * reach the login form can lock out every account on the server by hammering
+ * one name — a denial of service disguised as a security measure.
  */
 export class LoginThrottle {
-    failures = 0;
-    until = 0;
-    /** Milliseconds left to wait, 0 if the way is clear. */
-    retryAfterMs(now = Date.now()) {
-        return Math.max(0, this.until - now);
+    perName = new Map();
+    /** Milliseconds left to wait for that name, 0 if the way is clear. */
+    retryAfterMs(name, now = Date.now()) {
+        return Math.max(0, (this.perName.get(name)?.until ?? 0) - now);
     }
-    recordFailure(now = Date.now()) {
-        this.failures += 1;
+    recordFailure(name, now = Date.now()) {
+        const state = this.perName.get(name) ?? { failures: 0, until: 0 };
+        state.failures += 1;
         // 0, 0, 0, then 1s, 2s, 4s… capped at one minute.
-        if (this.failures > 3) {
-            this.until = now + Math.min(60_000, 2 ** (this.failures - 4) * 1000);
+        if (state.failures > 3) {
+            state.until = now + Math.min(60_000, 2 ** (state.failures - 4) * 1000);
         }
+        this.perName.set(name, state);
+        // The key is whatever the caller sent, so an attacker chooses how many
+        // entries exist. Dropping those whose delay has run out bounds the map by
+        // how fast someone can be delayed, not by how many names they can invent.
+        if (this.perName.size > THROTTLE_PRUNE_ABOVE)
+            this.prune(now);
     }
-    recordSuccess() {
-        this.failures = 0;
-        this.until = 0;
+    recordSuccess(name) {
+        this.perName.delete(name);
+    }
+    /** Number of names currently tracked. Exposed so the pruning can be tested. */
+    size() {
+        return this.perName.size;
+    }
+    prune(now) {
+        for (const [name, state] of this.perName) {
+            if (state.until <= now)
+                this.perName.delete(name);
+        }
     }
 }

package/dist/src/server/permissions.js

@@ -0,0 +1,75 @@
+/**
+ * Who can do what — the whole answer, in one file.
+ *
+ * A permission expressed as an `if` inside a handler is a permission nobody
+ * finds when it matters: during an audit, or after an incident. So there are no
+ * such `if`s. Every route that needs more than a session is named below, and the
+ * single hook in `app.ts` is the only thing that reads this.
+ *
+ * Two roles, and only two. `admin` may do everything; `builder` may start a
+ * build, watch it, cancel it and download what it produced — nothing that
+ * changes what a build does, and nothing that reveals a credential.
+ */
+/**
+ * What each route needs. Everything absent from this list needs only a session.
+ *
+ * Reading the Fastfile is deliberately not here: a builder who can start a lane
+ * benefits from seeing what it does, and it contains no credential — anything
+ * that does is in the vault, which is.
+ */
+export const REQUIRES_ADMIN = [
+    { method: "*", path: "/api/secrets" },
+    { method: "*", path: "/api/projects/:slug/secrets" },
+    { method: "*", path: "/api/credentials" },
+    { method: "*", path: "/api/projects/:slug/credentials" },
+    { method: "PUT", path: "/api/projects/:slug/fastfile" },
+    { method: "POST", path: "/api/projects/:slug/commit" },
+    { method: "POST", path: "/api/projects/:slug/push" },
+    { method: "DELETE", path: "/api/projects/:slug" },
+    { method: "*", path: "/api/users" },
+];
+/**
+ * `/api/secrets/APP_KEY?x=1` → `["api", "secrets", "APP_KEY"]`.
+ *
+ * Each segment is percent-decoded, because the router decodes before it matches
+ * and this must see the same path the router did. Comparing the raw text sent
+ * `GET /api/%73ecrets` straight past the admin list and into the vault: Fastify
+ * routed it to `/api/secrets`, and this function had been looking at `%73ecrets`.
+ */
+function segments(url) {
+    return (url.split("?")[0] ?? "")
+        .split("/")
+        .filter((s) => s !== "")
+        .map((s) => {
+        try {
+            return decodeURIComponent(s);
+        }
+        catch {
+            // Malformed escapes reach no route either; left as-is rather than
+            // swallowed, so a segment is never silently emptied into a match.
+            return s;
+        }
+    });
+}
+/**
+ * Does this request need an admin?
+ *
+ * A pattern matches a request whose path *starts with* it, segment by segment,
+ * with `:name` standing for any one segment. The prefix is deliberate:
+ * `/api/secrets` means the vault, not one URL, and a table naming every key's
+ * route separately would be a table someone forgets to extend the next time a
+ * route is added under it. It only ever errs towards refusing, since every
+ * entry here is a restriction.
+ */
+export function requiresAdmin(method, url) {
+    const parts = segments(url);
+    const verb = method.toUpperCase();
+    return REQUIRES_ADMIN.some((pattern) => {
+        if (pattern.method !== "*" && pattern.method.toUpperCase() !== verb)
+            return false;
+        const expected = segments(pattern.path);
+        if (parts.length < expected.length)
+            return false;
+        return expected.every((seg, i) => seg.startsWith(":") || seg === parts[i]);
+    });
+}

package/dist/src/server/required-secrets.js

@@ -0,0 +1,30 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parseEnvExample } from "../heuristics/env-example.js";
+export async function requiredSecrets(input) {
+    const fromExample = await envExampleNames(input.workspacePath, input.fastlaneDir);
+    const required = [
+        ...new Set([...input.lanes.flatMap((l) => l.env ?? []), ...input.declared, ...fromExample]),
+    ].sort();
+    const supplied = new Set([...input.vaultKeys, ...input.blockNames, ...input.serverEnv]);
+    return {
+        required,
+        missing: required.filter((name) => !supplied.has(name)),
+    };
+}
+/**
+ * The names a committed `.env.example` advertises, if there is one.
+ *
+ * Two conventional filenames and no more: a convenience for the common case,
+ * not a search. Never throws — an absent file is the ordinary situation and
+ * means "nothing declared", not a failure.
+ */
+export async function envExampleNames(workspacePath, fastlaneDir) {
+    const names = [];
+    for (const file of [".env.example", ".env.sample"]) {
+        const text = await readFile(join(workspacePath, fastlaneDir, file), "utf8").catch(() => null);
+        if (text !== null)
+            names.push(...parseEnvExample(text));
+    }
+    return names;
+}

package/dist/src/server/routes/account.js

@@ -0,0 +1,57 @@
+import { MIN_PASSWORD_LENGTH, upsertUserInConfig } from "../../config/accounts.js";
+import { COOKIE_OPTIONS, SESSION_COOKIE, authenticate } from "../auth.js";
+/**
+ * What someone may do to their own account, whatever their role.
+ *
+ * Deliberately not under `/api/users`: that prefix is on the admin list in
+ * `permissions.ts`, and it means "the accounts on this machine". This is the
+ * other thing entirely — one person, their own password — and a builder must be
+ * able to reach it. Changing the password of somebody *else* stays admin-only,
+ * and stays over there.
+ *
+ * The current password is required even though the session already proves who
+ * this is. A session is a cookie in a browser that may have been left open on a
+ * desk; a password is the one thing that says the person at the keyboard is
+ * still the person who signed in.
+ */
+export async function registerAccountRoutes(app, ctx) {
+    app.post("/api/account/password", async (req, reply) => {
+        // Non-null: the hook in `app.ts` rejected every request without a session
+        // before this handler could run.
+        const { name, role } = req.identity;
+        const { current, next } = (req.body ?? {});
+        if (typeof next !== "string" || next.length < MIN_PASSWORD_LENGTH) {
+            return reply
+                .code(400)
+                .send({ error: `A password is at least ${MIN_PASSWORD_LENGTH} characters.` });
+        }
+        const users = ctx.config.server()?.users ?? [];
+        if (typeof current !== "string" || !(await authenticate(users, name, current))) {
+            // No throttle here, unlike `/api/login`: reaching this route already costs
+            // a valid session, so there is nobody to slow down who is not already in.
+            return reply.code(401).send({ error: "That is not your current password." });
+        }
+        if (next === current) {
+            return reply.code(400).send({ error: "That is the password you already have." });
+        }
+        // The role is carried over rather than read from the body: this route
+        // changes a password and nothing else, and an account that could hand
+        // itself `admin` in a field named `role` would make the whole permission
+        // table decorative.
+        await upsertUserInConfig(ctx.config.configPath(), { name, role, password: next });
+        // Every session this account has, gone — including this one. That is the
+        // point: changing a password is what someone does when they think another
+        // browser somewhere should stop being signed in. A fresh session is issued
+        // immediately afterwards, so the person who just did it is not signed out
+        // of the page they did it on.
+        ctx.sessions.revokeAllFor(name);
+        const token = ctx.sessions.issue({ name, role });
+        // The file is watched on a debounce; loading here is what makes the very
+        // next request see the new hash instead of the old one.
+        await ctx.config.load();
+        return reply
+            .setCookie(SESSION_COOKIE, token, COOKIE_OPTIONS)
+            .code(204)
+            .send();
+    });
+}