laneyard 0.4.1 → 0.5.0

package/dist/src/db/runs.js

@@ -39,6 +39,17 @@ export class RunStore {
             .all(slug, limit);
         return rows.map(toRun);
     }
+    /**
+     * Deletes every run of a project, and returns how many rows went.
+     *
+     * The steps and the artifact records go with them, by the `ON DELETE CASCADE`
+     * on their foreign keys — with `foreign_keys = ON`, which `openDatabase` sets.
+     * The log files and the artifact folders live on disk, not here: the caller
+     * removes those, which is why it reads the run ids before calling this.
+     */
+    removeByProject(slug) {
+        return this.db.prepare("DELETE FROM run WHERE project_slug = ?").run(slug).changes;
+    }
     setStatus(id, status) {
         this.db.prepare("UPDATE run SET status = ? WHERE id = ?").run(status, id);
     }

package/dist/src/logs/store.js

@@ -1,5 +1,5 @@
 import { createReadStream } from "node:fs";
-import { mkdir, open, readFile } from "node:fs/promises";
+import { mkdir, open, readFile, rm } from "node:fs/promises";
 import { join } from "node:path";
 /**
  * Append-only writer for a run.
@@ -63,4 +63,12 @@ export class LogStore {
     stream(runId, fromOffset = 0) {
         return createReadStream(this.pathFor(runId), { start: fromOffset });
     }
+    /**
+     * Removes a run's log file. A run that never opened one is not an error:
+     * `force` makes a missing file a no-op, which is exactly the case for a run
+     * that failed before it wrote a line.
+     */
+    async remove(runId) {
+        await rm(this.pathFor(runId), { force: true });
+    }
 }

package/dist/src/main.js

@@ -7,6 +7,8 @@ import { bold, dim, field, heading } from "./cli/style.js";
 import { fileURLToPath } from "node:url";
 import { PromptAborted } from "./cli/prompt.js";
 import { runSetupCommand } from "./cli/setup.js";
+import { runRemoveCommand } from "./cli/remove.js";
+import { runResetCommand } from "./cli/reset.js";
 import { runSecretCommand } from "./cli/secret.js";
 import { runUninstallCommand } from "./cli/uninstall.js";
 import { runUserCommand } from "./cli/user.js";
@@ -21,7 +23,7 @@ import { Vault } from "./secrets/vault.js";
 import { makeInvoke } from "./sidecar/bridge.js";
 import { LaneReader } from "./sidecar/lanes.js";
 import { UsesReader } from "./sidecar/uses.js";
-export const version = "0.4.1";
+export const version = "0.5.0";
 /** Assembles the server from a data folder. */
 export async function createServerFromConfig(root) {
     const config = new ConfigStore(join(root, "config.yml"));
@@ -112,6 +114,11 @@ const USAGE = `laneyard — a self-hosted web UI for fastlane
                       store a secret, its value read from standard input
   laneyard user add NAME [--role admin|builder]
                       create an account, its password read from standard input
+  laneyard remove <slug>
+                      remove one project and everything Laneyard holds for it
+                      --dry-run shows what would go and stops
+  laneyard reset      wipe the data, keeping the accounts and the vault key
+                      --dry-run shows what would go and stops
   laneyard uninstall  remove Laneyard's data folder, after showing what is in it
                       --dry-run shows the inventory and stops
   laneyard            start the server
@@ -198,6 +205,21 @@ if (invokedDirectly()) {
             err: (text) => process.stderr.write(text),
         }));
     }
+    // No `mkdir` either: like `uninstall`, these read what is already there.
+    if (command === "remove") {
+        process.exit(await runRemoveCommand(homeDir(), rest, {
+            stdin: process.stdin,
+            out: (text) => process.stdout.write(text),
+            err: (text) => process.stderr.write(text),
+        }));
+    }
+    if (command === "reset") {
+        process.exit(await runResetCommand(homeDir(), rest, {
+            stdin: process.stdin,
+            out: (text) => process.stdout.write(text),
+            err: (text) => process.stderr.write(text),
+        }));
+    }
     // 0.1.0 shipped this as `add`. Anyone who learned that name deserves a
     // sentence rather than "Unknown command".
     if (command === "add") {

package/dist/src/secrets/vault.js

@@ -51,12 +51,13 @@ export class Vault {
     /**
      * Forgets everything stored under one project's name.
      *
-     * Never called by removing a project: that route leaves the vault alone on
-     * purpose and says what stayed. This is the separate, deliberate act someone
-     * takes afterwards, once they have read what it is they are about to lose —
-     * a credential is the one thing here that cannot be looked at before it goes.
+     * Part of removing a project: that act clears the vault along with the clone,
+     * the artifacts and the run history, behind the one typed confirmation that
+     * covers all of it. What it forgets is Laneyard's own encrypted copy — the
+     * `.p8` and the keystore that went in are still wherever the user keeps them.
      *
-     * Scoped by slug, so a global secret or a global signing block survives it.
+     * Scoped by slug, so a global secret or a global signing block survives it:
+     * those are read by every project and are never one project's to remove.
      */
     forget(projectSlug) {
         return {

package/dist/src/server/app.js

@@ -4,7 +4,6 @@ import Fastify from "fastify";
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { LEGACY_ADMIN_NAME } from "../config/load.js";
 import { RunStore } from "../db/runs.js";
 import { SessionRecords } from "../db/sessions.js";
 import { Workspace } from "../git/workspace.js";
@@ -13,7 +12,7 @@ import { materialiseCredentials } from "../runner/materialise.js";
 import { executeRun } from "../runner/orchestrate.js";
 import { RunQueue } from "../runner/queue.js";
 import { authenticate, LoginThrottle, COOKIE_OPTIONS, SESSION_COOKIE, SessionStore } from "./auth.js";
-import { requiresAdmin } from "./permissions.js";
+import { accountMayReach, projectSlugOfRequest, requiresAdmin } from "./permissions.js";
 import { registerCredentialRoutes } from "./routes/credentials.js";
 import { registerFastfileRoutes } from "./routes/fastfile.js";
 import { registerProjectRoutes } from "./routes/projects.js";
@@ -130,13 +129,7 @@ export async function buildApp(deps) {
     const throttle = new LoginThrottle();
     app.post("/api/login", async (req, reply) => {
         const { name, password } = (req.body ?? {});
-        // A body with no name is the 0.2 login form, which knew only a password.
-        // It authenticates as `admin`, which is precisely the account a lone
-        // `server.password_hash` is loaded as — so an upgraded install keeps
-        // working, and the loader still owes nobody an answer about which form
-        // the file used.
-        const account = name ?? LEGACY_ADMIN_NAME;
-        const waitMs = throttle.retryAfterMs(account);
+        const waitMs = name ? throttle.retryAfterMs(name) : 0;
         if (waitMs > 0) {
             return reply
                 .code(429)
@@ -144,15 +137,16 @@ export async function buildApp(deps) {
                 .send({ error: `Too many attempts. Try again in ${Math.ceil(waitMs / 1000)}s.` });
         }
         const users = deps.config.server()?.users ?? [];
-        const identity = password ? await authenticate(users, account, password) : null;
+        const identity = name && password ? await authenticate(users, name, password) : null;
         if (!identity) {
-            throttle.recordFailure(account);
+            if (name)
+                throttle.recordFailure(name);
             // One message for a wrong password and for a name that does not exist:
             // telling them apart is telling a stranger which accounts are worth
             // attacking.
             return reply.code(401).send({ error: "Incorrect name or password" });
         }
-        throttle.recordSuccess(account);
+        throttle.recordSuccess(identity.name);
         const token = ctx.sessions.issue(identity);
         return reply
             .setCookie(SESSION_COOKIE, token, COOKIE_OPTIONS)
@@ -180,6 +174,17 @@ export async function buildApp(deps) {
         if (identity.role !== "admin" && requiresAdmin(req.method, req.url)) {
             return reply.code(403).send({ error: "This action requires the admin role" });
         }
+        // Per-project reach, for a non-admin only: a project this account may not
+        // reach is invisible, not shown-and-locked, so it answers 404 with the very
+        // body a genuinely unknown project gives. A 403 would confirm the project
+        // exists. The slug is resolved here, in the one hook, rather than in each
+        // run and project handler — the same reason `requiresAdmin` lives here.
+        if (identity.role !== "admin") {
+            const slug = projectSlugOfRequest(req.url, (id) => ctx.runs.get(id)?.projectSlug ?? null);
+            if (slug !== null && !accountMayReach(account, slug)) {
+                return reply.code(404).send({ error: "Unknown project" });
+            }
+        }
     });
     /**
      * Signing out ends this session and no other.

package/dist/src/server/permissions.js

@@ -73,3 +73,53 @@ export function requiresAdmin(method, url) {
         return expected.every((seg, i) => seg.startsWith(":") || seg === parts[i]);
     });
 }
+/**
+ * May this account reach that project?
+ *
+ * The other half of the auth answer, and data-driven rather than a role: it is
+ * still two roles, with the builder's reach narrowed by a list. An `admin`
+ * reaches everything — managing the server is the whole role. A `builder` with
+ * no `projects` field reaches everything too (an old config, untouched by this
+ * feature); an empty list reaches nothing; a list reaches its slugs.
+ *
+ * Named and beside `REQUIRES_ADMIN` on purpose: the reach check is a permission,
+ * and a permission expressed as an `if` inside a handler is one nobody finds
+ * during an audit.
+ */
+export function accountMayReach(account, slug) {
+    if (account.role === "admin")
+        return true;
+    if (account.projects === undefined)
+        return true;
+    return account.projects.includes(slug);
+}
+/**
+ * The project a request concerns, or null when it concerns none.
+ *
+ * Two shapes carry a project:
+ *
+ *   `/api/projects/:slug/*` — the slug is in the path. The bare `/api/projects`
+ *     listing carries none: it is filtered in its own handler, per account.
+ *   `/api/runs/:id/*` — a run addresses a project by id, not a slug, so the id
+ *     is mapped through `runSlug`. An id that names no run yields null, and the
+ *     handler answers its own 404 for the unknown run.
+ *
+ * Everything else — the vault, the accounts, `/api/me` — concerns no single
+ * project and returns null, passing the reach check untouched.
+ *
+ * `runSlug` is handed in rather than the run store reached into, so the mapping
+ * this depends on stays a one-line lookup the caller owns and this stays a pure,
+ * testable function.
+ */
+export function projectSlugOfRequest(url, runSlug) {
+    const parts = segments(url);
+    if (parts[0] !== "api")
+        return null;
+    if (parts[1] === "projects" && parts.length >= 3)
+        return parts[2] ?? null;
+    if (parts[1] === "runs" && parts.length >= 3) {
+        const id = Number(parts[2]);
+        return Number.isInteger(id) ? runSlug(id) : null;
+    }
+    return null;
+}

package/dist/src/server/routes/account.js

@@ -1,4 +1,4 @@
-import { MIN_PASSWORD_LENGTH, upsertUserInConfig } from "../../config/accounts.js";
+import { MIN_PASSWORD_LENGTH, VALID_NAME, renameUserInConfig, upsertUserInConfig } from "../../config/accounts.js";
 import { COOKIE_OPTIONS, SESSION_COOKIE, authenticate } from "../auth.js";
 /**
  * What someone may do to their own account, whatever their role.
@@ -54,4 +54,59 @@ export async function registerAccountRoutes(app, ctx) {
             .code(204)
             .send();
     });
+    /**
+     * Changing your own name — the other thing only you can do for yourself.
+     *
+     * Everything the password route is careful about is careful here for the same
+     * reasons: the current password is asked for because a session is a cookie in
+     * a browser that may have been left open; the role comes from the session and
+     * never from the body, so a rename cannot smuggle in a promotion; and the
+     * account this touches is only ever the session's own, there being no name in
+     * the body to point anywhere else.
+     *
+     * The one thing that is not like the password route is the write. A rename is
+     * not `upsertUserInConfig`, which keys by name and would add a second account
+     * under the new name and leave the old one — and its `projects` grants —
+     * behind. `renameUserInConfig` edits the `name` field of the existing entry in
+     * place, so role, hash and grants ride along untouched.
+     */
+    app.post("/api/account/name", async (req, reply) => {
+        const { name, role } = req.identity;
+        const { current, next } = (req.body ?? {});
+        if (typeof next !== "string" || !VALID_NAME.test(next)) {
+            return reply.code(400).send({
+                error: "A name is letters, digits, dot, dash and underscore, starting with a letter or a digit.",
+            });
+        }
+        const users = ctx.config.server()?.users ?? [];
+        if (typeof current !== "string" || !(await authenticate(users, name, current))) {
+            // No throttle, for the same reason as the password route: reaching here
+            // already costs a valid session.
+            return reply.code(401).send({ error: "That is not your current password." });
+        }
+        if (next === name) {
+            return reply.code(400).send({ error: "That is the name you already have." });
+        }
+        // A collision is refused rather than allowed to collapse two accounts into
+        // one. The comparison is case-sensitive, because the stored names are: `Ci`
+        // and `ci` are two accounts, and a rename to either is a rename to that one.
+        if (users.some((u) => u.name === next)) {
+            return reply.code(409).send({ error: `${next} is already the name of another account.` });
+        }
+        await renameUserInConfig(ctx.config.configPath(), name, next);
+        // Every session under the old name goes — the auth hook matches a session's
+        // name against a live account, and after this there is no account by that
+        // name for it to match. A fresh session under the new name is issued at once,
+        // so the person who just did it stays signed in on this page.
+        ctx.sessions.revokeAllFor(name);
+        const token = ctx.sessions.issue({ name: next, role });
+        // The file is watched on a debounce; loading here is what makes the very next
+        // request see the account under its new name rather than its old one.
+        await ctx.config.load();
+        // The new name is returned so the interface can update the header and this
+        // page, now that the cookie it carries belongs to a different name.
+        return reply
+            .setCookie(SESSION_COOKIE, token, COOKIE_OPTIONS)
+            .send({ name: next, role });
+    });
 }

package/dist/src/server/routes/fastfile.js

@@ -1,6 +1,7 @@
 import { join } from "node:path";
 import { FastfileStore } from "../../fastfile/store.js";
 import { Workspace } from "../../git/workspace.js";
+import { assertFastlaneDir } from "../../sidecar/fastlane-dir.js";
 export async function registerFastfileRoutes(app, ctx) {
     // Stateless: the previous content it keeps in memory during a write lives
     // on the call stack, not on the instance, so sharing one across requests
@@ -40,6 +41,12 @@ export async function registerFastfileRoutes(app, ctx) {
         if (!r)
             return;
         try {
+            // The common case is not a hand-deleted Fastfile but a `fastlane_dir`
+            // that never reached the clone — a path only in someone's working copy,
+            // uncommitted or gitignored, or a stray local copy. `store.read` would
+            // surface that as a bare ENOENT; this turns it into the same sentence the
+            // sidecar gives, naming the directory and how to fix it.
+            await assertFastlaneDir(join(r.workspacePath, r.fastlaneDir), r.fastlaneDir);
             const [content, dirty, diff] = await Promise.all([
                 store.read(r.workspacePath, r.fastlaneDir),
                 r.workspace.isDirty(),

package/dist/src/server/routes/projects.js

@@ -1,40 +1,69 @@
-import { existsSync } from "node:fs";
-import { removeProjectFromConfig } from "../../cli/setup.js";
+import { accountMayReach } from "../permissions.js";
+import { removeProjectData } from "../../data/remove-project.js";
 export async function registerProjectRoutes(app, ctx) {
-    app.get("/api/projects", async () => ctx.config.projects().map((p) => {
-        const last = ctx.runs.listByProject(p.slug, 1)[0] ?? null;
-        return {
-            slug: p.slug,
-            name: p.name,
-            color: p.color,
-            lastRun: last && { id: last.id, status: last.status, lane: last.lane, finishedAt: last.finishedAt },
-        };
-    }));
+    // The listing every account is shown, filtered to what it may reach. This is
+    // the source of the invisibility the interface shows — the nav and the project
+    // list are driven by it, so a filtered response filters the UI with no change
+    // beyond what the data carries. The account is looked up fresh, the way the
+    // auth hook does, because config.yml is the truth on every request. An admin,
+    // and a builder with no `projects` field, are served every project.
+    app.get("/api/projects", async (req) => {
+        const account = ctx.config.server()?.users.find((u) => u.name === req.identity.name);
+        return ctx.config
+            .projects()
+            .filter((p) => account !== undefined && accountMayReach(account, p.slug))
+            .map((p) => {
+            const last = ctx.runs.listByProject(p.slug, 1)[0] ?? null;
+            return {
+                slug: p.slug,
+                name: p.name,
+                color: p.color,
+                lastRun: last && { id: last.id, status: last.status, lane: last.lane, finishedAt: last.finishedAt },
+            };
+        });
+    });
     /**
-     * Stops showing a project. It is the one destructive route in the product,
-     * and what it does not destroy is most of the point:
+     * Removes everything Laneyard holds for a project, in one confirmed act.
+     *
+     * It is the destructive route in the product, and it is destructive on
+     * purpose. The block leaves config.yml, through the YAML document so the rest
+     * of a hand-written file is untouched; the clone is deleted; every artifact
+     * folder goes; the run history — the rows and their logs — is deleted; and
+     * the project's own secrets and signing blocks are forgotten from the vault.
+     * The history is the one thing here that cannot be made again, which is why
+     * the whole act is behind a slug typed back rather than a click.
      *
-     *  - the project's block leaves config.yml, through the YAML document so the
-     *    rest of a hand-written file is untouched;
-     *  - its runs stay in the database, still reachable at their own URL — the
-     *    history of what this machine built is not the project's to take away;
-     *  - the clone and the artifacts stay on disk, named in the answer so they
-     *    can be removed by hand. Deleting files someone may still want, from a
-     *    web page, on one click, is not a thing to do;
-     *  - its secrets and its signing blocks stay in the vault, counted in the
-     *    answer. They are the one thing here that cannot be looked at from the
-     *    interface — no route ever sends a credential back — so if this does not
-     *    say they are there, nothing ever will. They are also scoped by slug: a
-     *    project set up later under the same name would find the old keystore
-     *    waiting for it, and sign with a credential nobody uploaded. Removing
-     *    them is `DELETE /api/projects/:slug/vault`, below, and it is a second
-     *    act on purpose.
+     * What it still does not reach, and why each is out of scope:
+     *
+     *  - the git remote. The repository is on GitHub and on the user's disk. It
+     *    is theirs, not Laneyard's, and nothing here reads or writes it.
+     *  - the credential originals. Laneyard removes its own encrypted copy of a
+     *    `.p8` or a keystore; the file that went in is still in the password
+     *    manager or the safe it came from. The answer says so, the way
+     *    `uninstall` does, so nobody is left thinking their keystore is gone.
+     *  - global secrets and global signing blocks. They are read by every project
+     *    on the machine, not this one's to take — `vault.forget` touches only
+     *    slug-scoped rows, and the answer counts the global ones it left alone.
+     *
+     * The confirmation is the project's own slug, sent back as `?confirm=`.
+     * Without a match nothing is removed: a bare DELETE is a refusal, not a
+     * deletion. This is the gate `laneyard uninstall` uses for the same reason —
+     * the one irreversible thing must not be reachable by a reflex.
      */
     app.delete("/api/projects/:slug", async (req, reply) => {
         const { slug } = req.params;
+        const { confirm } = req.query;
         const entry = ctx.config.project(slug);
         if (!entry)
             return reply.code(404).send({ error: "Unknown project" });
+        // The slug typed back is the confirmation. This deletes the run history,
+        // which nothing can rebuild, so a request that does not carry the slug
+        // removes nothing and says why.
+        if (confirm !== slug) {
+            return reply.code(400).send({
+                error: `Removing "${slug}" deletes its runs, its clone, its artifacts and its stored secrets, and cannot be undone. Send the project's slug as confirmation to remove it. Nothing was removed.`,
+            });
+        }
         // A run that has begun is reading the workspace this project points at.
         // Queued runs are not: the queue already fails a run whose project went
         // away, so waiting on them would only mean refusing for longer.
@@ -43,69 +72,49 @@ export async function registerProjectRoutes(app, ctx) {
                 error: `"${slug}" has a run in flight. Wait for it to finish, or cancel it, then remove the project.`,
             });
         }
-        const removed = await removeProjectFromConfig(ctx.config.configPath(), slug);
-        if (!removed)
+        // The global counts are read now — the last moment anyone is looking — so
+        // the answer can say what it left alone. They are shared by every project
+        // and survive one of them going away, which is why the removal never takes
+        // them and the reply names them apart.
+        const globalSecrets = ctx.vault.listGlobal().length;
+        const globalSigningBlocks = ctx.vault.listGlobalCredentials().length;
+        // The removal itself lives in one place, shared with `laneyard remove`: the
+        // route confirms and shapes the reply, the core does the deleting.
+        const result = await removeProjectData({
+            configPath: ctx.config.configPath(),
+            // The file is watched, but on a debounce: reloading here is what makes
+            // the very next request — the listing this page is about to ask for —
+            // truthful.
+            reloadConfig: () => ctx.config.load(),
+            runs: ctx.runs,
+            logs: ctx.logs,
+            vault: ctx.vault,
+            workspacePath: ctx.workspacePath,
+            artifactsDir: ctx.artifactsDir,
+        }, slug);
+        if (!result.found)
             return reply.code(404).send({ error: "Unknown project" });
-        // The file is watched, but on a debounce: reloading here is what makes the
-        // very next request — the listing this page is about to ask for — truthful.
-        await ctx.config.load();
-        // -1 is SQLite's "no limit": the answer names every artifact folder left
-        // behind, and a project with sixty runs must not be told about fifty of them.
-        const runs = ctx.runs.listByProject(slug, -1);
-        const leftOnDisk = [
-            ctx.workspacePath(slug),
-            ...runs.map((run) => ctx.artifactsDir(run.id)),
-        ].filter((path) => existsSync(path));
-        // Counted after the block is gone, and read from the vault rather than
-        // inferred: the two stores are the only thing that knows, and this is the
-        // last moment anyone is looking.
-        const owned = ctx.vault.ownedBy(slug);
+        // The slug is also stripped from every account's access grants, in the core
+        // beside the other "forget for this slug" steps: a grant pointing at a
+        // project that no longer exists is dead data, and a project re-created later
+        // under the same slug must not silently inherit an old grant.
         return reply.send({
             slug,
             name: entry.name,
-            runsKept: runs.length,
-            leftOnDisk,
-            vaultKept: {
-                secrets: owned.secrets.length,
-                signingBlocks: owned.credentials.length,
-                // Named separately because they are not this project's to lose. A
-                // global secret is read by every project on the machine, and an answer
-                // that folded them into one number would invite removing them.
-                globalSecrets: ctx.vault.listGlobal().length,
-                globalSigningBlocks: ctx.vault.listGlobalCredentials().length,
+            removed: {
+                runs: result.runs,
+                artifacts: result.artifacts,
+                workspace: result.workspace,
+                secrets: result.secrets,
+                signingBlocks: result.signingBlocks,
+            },
+            // Named, not removed. The git remote and the credential originals are the
+            // user's and are never touched here; the global rows are shared by every
+            // project and survive one of them going away.
+            untouched: {
+                globalSecrets,
+                globalSigningBlocks,
             },
-        });
-    });
-    /**
-     * Removes what the vault still holds under a removed project's name.
-     *
-     * Deliberately not part of removing the project. That route destroys nothing,
-     * and the reason is the one this route has to earn instead: a signing block
-     * cannot be read back out of Laneyard — the `.p8` and the keystore that went
-     * in are the only copies it ever had — so deleting one on the same click that
-     * hides a project from a list would be destroying something unrecoverable as
-     * a side effect of tidying up.
-     *
-     * Refused while the slug is still a project, so this can only ever be the
-     * clean-up after a removal. A live project's secrets and blocks are removed
-     * one at a time, from the tabs that show them, where the user can see what
-     * each one is.
-     *
-     * Only rows carrying this slug go. A global secret and a global signing block
-     * are shared by every project and survive it.
-     */
-    app.delete("/api/projects/:slug/vault", async (req, reply) => {
-        const { slug } = req.params;
-        if (ctx.config.project(slug)) {
-            return reply.code(409).send({
-                error: `"${slug}" is still a project on this machine. Remove the project first, or remove its secrets and signing blocks one at a time from its own tabs.`,
-            });
-        }
-        const removed = ctx.vault.forget(slug);
-        return reply.send({
-            slug,
-            secretsRemoved: removed.secrets,
-            signingBlocksRemoved: removed.credentials,
         });
     });
     app.get("/api/projects/:slug/lanes", async (req, reply) => {

package/dist/src/server/routes/users.js

@@ -1,4 +1,6 @@
-import { MIN_PASSWORD_LENGTH, VALID_NAME, refusalFor, removeUserFromConfig, upsertUserInConfig, } from "../../config/accounts.js";
+import { MIN_PASSWORD_LENGTH, VALID_NAME, refusalFor, removeUserFromConfig, setUserProjectsInConfig, upsertUserInConfig, } from "../../config/accounts.js";
+/** The same slug rule the schema enforces, stated once for the grant route. */
+const VALID_SLUG = /^[a-z0-9][a-z0-9-]*$/;
 const ROLES = ["admin", "builder"];
 /**
  * The accounts, as the interface sees them.
@@ -9,9 +11,12 @@ const ROLES = ["admin", "builder"];
  */
 export async function registerUserRoutes(app, ctx) {
     const accounts = () => ctx.config.server()?.users ?? [];
-    // Name and role, and that is the whole shape. The hash is not truncated or
-    // masked on the way out — it is simply never put on the wire.
-    app.get("/api/users", async () => accounts().map((u) => ({ name: u.name, role: u.role })));
+    // Name, role, and the project grants — never the hash, which is simply never
+    // put on the wire. `projects` is sent as it stands: an array when the account
+    // carries a grant list, `null` when it has no field at all (every project),
+    // the same three-way the storage keeps. The accounts screen ticks a checkbox
+    // from it; an admin's is `null` and its checklist is not drawn.
+    app.get("/api/users", async () => accounts().map((u) => ({ name: u.name, role: u.role, projects: u.projects ?? null })));
     app.post("/api/users", async (req, reply) => {
         const { name, role, password } = (req.body ?? {});
         if (typeof name !== "string" || !VALID_NAME.test(name)) {
@@ -46,6 +51,44 @@ export async function registerUserRoutes(app, ctx) {
         await ctx.config.load();
         return reply.code(created ? 201 : 200).send({ name, role });
     });
+    /**
+     * Sets which projects an account may reach.
+     *
+     * Admin-only, like every route in this file: it is covered by the
+     * `/api/users` prefix in `REQUIRES_ADMIN`, so nothing here checks a role. The
+     * list is written through the YAML document and takes effect on the next
+     * request, since the auth hook re-reads config.yml every time — no session is
+     * revoked, because the role has not changed, only what it reaches.
+     *
+     * An admin has no reach to restrict: the field is ignored for them, so writing
+     * one would be a lie the server does not tell. The request is refused rather
+     * than quietly written and forgotten.
+     */
+    app.put("/api/users/:name/projects", async (req, reply) => {
+        const { name } = req.params;
+        const { projects } = (req.body ?? {});
+        if (!Array.isArray(projects) ||
+            !projects.every((p) => typeof p === "string" && VALID_SLUG.test(p))) {
+            return reply
+                .code(400)
+                .send({ error: "Projects is a list of slugs: lowercase letters, digits and hyphens." });
+        }
+        const account = accounts().find((u) => u.name === name);
+        if (!account)
+            return reply.code(404).send({ error: "Unknown account" });
+        if (account.role === "admin") {
+            return reply
+                .code(400)
+                .send({ error: "An admin reaches every project; there is no access list to set." });
+        }
+        const written = await setUserProjectsInConfig(ctx.config.configPath(), name, projects);
+        if (!written)
+            return reply.code(404).send({ error: "Unknown account" });
+        // The file is watched on a debounce; reloading here makes the very next
+        // request — and the reach check in the hook — see the grant at once.
+        await ctx.config.load();
+        return reply.code(200).send({ name, projects });
+    });
     app.delete("/api/users/:name", async (req, reply) => {
         const { name } = req.params;
         if (!accounts().some((u) => u.name === name)) {

package/dist/src/sidecar/fastlane-dir.js

@@ -6,18 +6,18 @@ import { stat } from "node:fs/promises";
  * '…/workspaces/popotheque-app/fastlane'` — technically accurate and no help at
  * all, because the interesting part is *why* it was looking there.
  *
- * It is nearly always the same story. `laneyard setup` writes `laneyard.yml`
- * into the working copy, and Laneyard builds from a clone of the remote, so the
- * file that says where fastlane lives does not reach the clone until it is
- * committed and pushed. Until then `fastlane_dir` falls back to `fastlane`,
- * which in a monorepo is not where anything is.
+ * It is nearly always the same story: the configured fastlane folder is in the
+ * working copy setup ran against, but not in the clone Laneyard builds from. A
+ * folder only present locally — never committed, not yet pushed, or gitignored
+ * — does not reach the clone, and neither does a `laneyard.yml` that would
+ * point at it until it too is committed and pushed.
  */
 export async function assertFastlaneDir(dir, configured) {
     const found = await stat(dir).then((s) => s.isDirectory(), () => false);
     if (found)
         return;
     throw new Error(`No ${configured}/ in the clone. Laneyard builds from a clone of the remote, ` +
-        "so `laneyard.yml` only takes effect once it is committed and pushed — " +
-        "until then this falls back to `fastlane`. Push it, or set `fastlane_dir` " +
-        "on the project's block in config.yml.");
+        "so a fastlane folder that exists only in your working copy — uncommitted, " +
+        "unpushed, or gitignored — never reaches it. Commit and push it, or set " +
+        "`fastlane_dir` on the project's block in config.yml.");
 }