libre-webui 0.22.0 → 0.23.0

package/backend/dist/routes/groups.js

@@ -0,0 +1,161 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import express from 'express';
+import rateLimit from '../middleware/sharedRateLimit.js';
+import { authenticate, requireAdmin, } from '../middleware/auth.js';
+import { addGroupMember, createGroup, deleteGroup, getGroup, GroupError, listGroupsWithMembers, removeGroupMember, updateGroup, } from '../services/groupService.js';
+import { explainEffectiveAccess } from '../services/authorizationService.js';
+import { userModel } from '../models/userModel.js';
+import { createLogger } from '../utils/logger.js';
+const router = express.Router();
+const logger = createLogger('groups-routes');
+const groupsRateLimiter = rateLimit({
+    keyPrefix: 'groups-admin',
+    windowMs: 15 * 60 * 1000,
+    max: 120,
+    message: { success: false, message: 'Too many requests' },
+    standardHeaders: true,
+    legacyHeaders: false,
+});
+router.use(groupsRateLimiter, authenticate, requireAdmin);
+const handleError = (res, error, fallback) => {
+    if (error instanceof GroupError) {
+        res
+            .status(error.statusCode)
+            .json({ success: false, message: error.message });
+        return;
+    }
+    logger.error(fallback, error);
+    res.status(500).json({ success: false, message: 'Internal server error' });
+};
+/** List groups with members. */
+router.get('/', async (_req, res) => {
+    try {
+        const groups = await listGroupsWithMembers();
+        res.json({ success: true, data: groups });
+    }
+    catch (error) {
+        handleError(res, error, 'Group list error:');
+    }
+});
+/** Create a group. */
+router.post('/', async (req, res) => {
+    try {
+        const { name, description } = req.body ?? {};
+        if (typeof name !== 'string') {
+            res.status(400).json({ success: false, message: 'name is required' });
+            return;
+        }
+        const group = await createGroup({
+            name,
+            description: typeof description === 'string' ? description : null,
+        }, req.user.userId);
+        res.status(201).json({ success: true, data: group });
+    }
+    catch (error) {
+        handleError(res, error, 'Group create error:');
+    }
+});
+/** Update a group's name or description. */
+router.patch('/:id', async (req, res) => {
+    try {
+        const { name, description } = req.body ?? {};
+        const group = await updateGroup(req.params.id, {
+            ...(typeof name === 'string' ? { name } : {}),
+            ...(description !== undefined
+                ? {
+                    description: typeof description === 'string' ? description : null,
+                }
+                : {}),
+        }, req.user.userId);
+        if (!group) {
+            res.status(404).json({ success: false, message: 'Group not found' });
+            return;
+        }
+        res.json({ success: true, data: group });
+    }
+    catch (error) {
+        handleError(res, error, 'Group update error:');
+    }
+});
+/** Delete a group; its grants and memberships go with it. */
+router.delete('/:id', async (req, res) => {
+    try {
+        const deleted = await deleteGroup(req.params.id, req.user.userId);
+        if (!deleted) {
+            res.status(404).json({ success: false, message: 'Group not found' });
+            return;
+        }
+        res.json({ success: true });
+    }
+    catch (error) {
+        handleError(res, error, 'Group delete error:');
+    }
+});
+/** Add a member. */
+router.post('/:id/members', async (req, res) => {
+    try {
+        const { userId } = req.body ?? {};
+        if (typeof userId !== 'string' || !userId) {
+            res.status(400).json({ success: false, message: 'userId is required' });
+            return;
+        }
+        const added = await addGroupMember(req.params.id, userId, req.user.userId);
+        res.status(added ? 201 : 200).json({ success: true, data: { added } });
+    }
+    catch (error) {
+        handleError(res, error, 'Group member add error:');
+    }
+});
+/** Remove a member; access via this group's grants ends immediately. */
+router.delete('/:id/members/:userId', async (req, res) => {
+    try {
+        if (!(await getGroup(req.params.id))) {
+            res.status(404).json({ success: false, message: 'Group not found' });
+            return;
+        }
+        const removed = await removeGroupMember(req.params.id, req.params.userId, req.user.userId);
+        res.json({ success: true, data: { removed } });
+    }
+    catch (error) {
+        handleError(res, error, 'Group member remove error:');
+    }
+});
+/**
+ * Effective access for one user: role, groups, feature gates, and every
+ * grant reaching them — the "why can this user access this?" view.
+ */
+router.get('/effective/:userId', async (req, res) => {
+    try {
+        const user = await userModel.getUserById(req.params.userId);
+        if (!user) {
+            res.status(404).json({ success: false, message: 'User not found' });
+            return;
+        }
+        const view = await explainEffectiveAccess({
+            id: user.id,
+            role: user.role,
+            status: user.status,
+        });
+        res.json({ success: true, data: { ...view, username: user.username } });
+    }
+    catch (error) {
+        handleError(res, error, 'Effective access error:');
+    }
+});
+export default router;
+//# sourceMappingURL=groups.js.map

package/backend/dist/routes/groups.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groups.js","sourceRoot":"","sources":["../../src/routes/groups.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,SAAS,MAAM,kCAAkC,CAAC;AACzD,OAAO,EACL,YAAY,EACZ,YAAY,GAEb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,cAAc,EACd,WAAW,EACX,WAAW,EACX,QAAQ,EACR,UAAU,EACV,qBAAqB,EACrB,iBAAiB,EACjB,WAAW,GACZ,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;AAChC,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAE7C,MAAM,iBAAiB,GAAG,SAAS,CAAC;IAClC,SAAS,EAAE,cAAc;IACzB,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,GAAG,EAAE,GAAG;IACR,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE;IACzD,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,KAAK;CACrB,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAE1D,MAAM,WAAW,GAAG,CAClB,GAAqB,EACrB,KAAc,EACd,QAAgB,EACV,EAAE;IACR,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,GAAG;aACA,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;aACxB,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;AAC7E,CAAC,CAAC;AAEF,gCAAgC;AAChC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,sBAAsB;AACtB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACxD,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC7C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAC7B;YACE,IAAI;YACJ,WAAW,EAAE,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;SAClE,EACD,GAAG,CAAC,IAAK,CAAC,MAAM,CACjB,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACjD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,4CAA4C;AAC5C,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,WAAW,CAC7B,GAAG,CAAC,MAAM,CAAC,EAAY,EACvB;YACE,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,WAAW,KAAK,SAAS;gBAC3B,CAAC,CAAC;oBACE,WAAW,EAAE,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;iBAClE;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,EACD,GAAG,CAAC,IAAK,CAAC,MAAM,CACjB,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACjD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IAC7D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAC/B,GAAG,CAAC,MAAM,CAAC,EAAY,EACvB,GAAG,CAAC,IAAK,CAAC,MAAM,CACjB,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACjD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,oBAAoB;AACpB,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACnE,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAClC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,cAAc,CAChC,GAAG,CAAC,MAAM,CAAC,EAAY,EACvB,MAAM,EACN,GAAG,CAAC,IAAK,CAAC,MAAM,CACjB,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,yBAAyB,CAAC,CAAC;IACrD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,wEAAwE;AACxE,MAAM,CAAC,MAAM,CACX,sBAAsB,EACtB,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACvC,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CACrC,GAAG,CAAC,MAAM,CAAC,EAAY,EACvB,GAAG,CAAC,MAAM,CAAC,MAAgB,EAC3B,GAAG,CAAC,IAAK,CAAC,MAAM,CACjB,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,4BAA4B,CAAC,CAAC;IACxD,CAAC;AACH,CAAC,CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAClD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC;YACxC,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,yBAAyB,CAAC,CAAC;IACrD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}

package/backend/dist/routes/jobs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jobs.d.ts","sourceRoot":"","sources":["../../src/routes/jobs.ts"],"names":[],"mappings":"AAcA,QAAA,MAAM,MAAM,4CAAmB,CAAC;eA2HjB,MAAM"}
+{"version":3,"file":"jobs.d.ts","sourceRoot":"","sources":["../../src/routes/jobs.ts"],"names":[],"mappings":"AAeA,QAAA,MAAM,MAAM,4CAAmB,CAAC;eAsIjB,MAAM"}

package/backend/dist/routes/jobs.js

@@ -5,9 +5,18 @@
  */
 import express from 'express';
 import { authenticate } from '../middleware/auth.js';
+import rateLimit from '../middleware/sharedRateLimit.js';
 import { DurableJobError, getDurableJobRuntime, } from '../platform/jobs/index.js';
 const router = express.Router();
 router.use(authenticate);
+router.use(rateLimit({
+    keyPrefix: 'durable-jobs',
+    windowMs: 60000,
+    max: 240,
+    keyGenerator: req => req.user?.userId || 'unauthenticated',
+    standardHeaders: true,
+    legacyHeaders: false,
+}));
 const identity = (req) => {
     if (!req.user)
         throw new Error('Authenticated user context is required');

package/backend/dist/routes/jobs.js.map

@@ -1 +1 @@
-{"version":3,"file":"jobs.js","sourceRoot":"","sources":["../../src/routes/jobs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,YAAY,EAA6B,MAAM,uBAAuB,CAAC;AAChF,OAAO,EACL,eAAe,EACf,oBAAoB,GAErB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;AAChC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AAEzB,MAAM,QAAQ,GAAG,CACf,GAAyB,EACW,EAAE;IACtC,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACzE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;AACvE,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,KAAK,EAAE,GAAyB,EAAE,EAAU,EAAE,EAAE;IACrE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,oBAAoB,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC,CAAC;AAEF,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACvD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,KAAK,GACT,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3E,MAAM,eAAe,GACnB,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS;YACrC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,oBAAoB,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;YACzD,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;gBAC3C,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE;gBAC/B,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,KAAK;YACL,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,KAAK,YAAY,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC5D,OAAO,EAAE,KAAK;YACd,OAAO,EACL,KAAK,YAAY,eAAe;gBAC9B,CAAC,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC,6BAA6B;SACpC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IAC7D,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3E,OAAO;IACT,CAAC;IACD,GAAG,CAAC,IAAI,CAAC;QACP,OAAO,EAAE,IAAI;QACb,IAAI,EAAE;YACJ,GAAG;YACH,QAAQ,EAAE,MAAM,oBAAoB,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;SACpE;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACpE,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3E,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE;YACtE,QAAQ,EAAE,OAAO,GAAG,CAAC,EAAE,EAAE;YACzB,KAAK;SACN,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,IAAI;YACb,IAAI,EAAE;gBACJ,MAAM;gBACN,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;aACrE;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EACL,KAAK,YAAY,eAAe;gBAC9B,CAAC,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC,8BAA8B;SACrC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACrE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3E,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,oBAAoB,EAAE,CAAC,OAAO,CAAC,MAAM,CAC3D,GAAG,CAAC,EAAE,EACN,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAC5C,gBAAgB,CACjB,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG;aACA,MAAM,CACL,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;YAC5D,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,GAAG,CACR;aACA,IAAI,CAAC;YACJ,OAAO,EAAE,KAAK;YACd,OAAO,EACL,KAAK,YAAY,eAAe;gBAC9B,CAAC,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC,8BAA8B;SACrC,CAAC,CAAC;IACP,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}
+{"version":3,"file":"jobs.js","sourceRoot":"","sources":["../../src/routes/jobs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,YAAY,EAA6B,MAAM,uBAAuB,CAAC;AAChF,OAAO,SAAS,MAAM,kCAAkC,CAAC;AACzD,OAAO,EACL,eAAe,EACf,oBAAoB,GAErB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;AAChC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AACzB,MAAM,CAAC,GAAG,CACR,SAAS,CAAC;IACR,SAAS,EAAE,cAAc;IACzB,QAAQ,EAAE,KAAM;IAChB,GAAG,EAAE,GAAG;IACR,YAAY,EAAE,GAAG,CAAC,EAAE,CACjB,GAA4B,CAAC,IAAI,EAAE,MAAM,IAAI,iBAAiB;IACjE,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,KAAK;CACrB,CAAC,CACH,CAAC;AAEF,MAAM,QAAQ,GAAG,CACf,GAAyB,EACW,EAAE;IACtC,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACzE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;AACvE,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,KAAK,EAAE,GAAyB,EAAE,EAAU,EAAE,EAAE;IACrE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,oBAAoB,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC,CAAC;AAEF,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACvD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,KAAK,GACT,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3E,MAAM,eAAe,GACnB,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS;YACrC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,oBAAoB,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;YACzD,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;gBAC3C,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE;gBAC/B,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,KAAK;YACL,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,KAAK,YAAY,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC5D,OAAO,EAAE,KAAK;YACd,OAAO,EACL,KAAK,YAAY,eAAe;gBAC9B,CAAC,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC,6BAA6B;SACpC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IAC7D,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3E,OAAO;IACT,CAAC;IACD,GAAG,CAAC,IAAI,CAAC;QACP,OAAO,EAAE,IAAI;QACb,IAAI,EAAE;YACJ,GAAG;YACH,QAAQ,EAAE,MAAM,oBAAoB,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;SACpE;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACpE,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3E,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE;YACtE,QAAQ,EAAE,OAAO,GAAG,CAAC,EAAE,EAAE;YACzB,KAAK;SACN,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,IAAI;YACb,IAAI,EAAE;gBACJ,MAAM;gBACN,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;aACrE;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EACL,KAAK,YAAY,eAAe;gBAC9B,CAAC,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC,8BAA8B;SACrC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACrE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3E,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,oBAAoB,EAAE,CAAC,OAAO,CAAC,MAAM,CAC3D,GAAG,CAAC,EAAE,EACN,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAC5C,gBAAgB,CACjB,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG;aACA,MAAM,CACL,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;YAC5D,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,GAAG,CACR;aACA,IAAI,CAAC;YACJ,OAAO,EAAE,KAAK;YACd,OAAO,EACL,KAAK,YAAY,eAAe;gBAC9B,CAAC,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC,8BAA8B;SACrC,CAAC,CAAC;IACP,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}

package/backend/dist/services/apiTokenService.d.ts

@@ -0,0 +1,51 @@
+import type { StoredApiTokenRecord } from '../persistence/index.js';
+export declare const API_TOKEN_PREFIX = "lwk_";
+export declare const API_TOKEN_SCOPES: readonly ['chat', 'models', 'documents', 'notes', 'personas', 'media', 'work', 'admin'];
+export type ApiTokenScope = (typeof API_TOKEN_SCOPES)[number];
+export declare const isApiTokenScope: (value: unknown) => value is ApiTokenScope;
+export declare class ApiTokenScopeError extends Error {
+    readonly requiredScope: ApiTokenScope | null;
+    constructor(requiredScope: ApiTokenScope | null);
+}
+export declare class ApiTokenRateLimitError extends Error {
+    constructor();
+}
+export declare const hashApiToken: (token: string) => string;
+export declare const looksLikeApiToken: (bearer: string) => boolean;
+export declare const parseTokenScopes: (record: StoredApiTokenRecord) => ApiTokenScope[];
+export interface CreatedApiToken {
+    token: string;
+    record: StoredApiTokenRecord;
+}
+export declare const createApiToken: (userId: string, input: {
+    name: string;
+    scopes: ApiTokenScope[];
+    expiresInDays?: number;
+}) => Promise<CreatedApiToken>;
+/** Resolve a presented bearer to a live token record, or null. */
+export declare const resolveApiToken: (bearer: string) => Promise<StoredApiTokenRecord | null>;
+/** Distributed per-token rate limit; skipped when no coordinator exists. */
+export declare const consumeApiTokenRateLimit: (tokenId: string) => Promise<void>;
+export declare const touchApiTokenUse: (record: StoredApiTokenRecord) => Promise<void>;
+/**
+ * The scope a request path requires, or an error when tokens are barred
+ * from the route family entirely.
+ */
+export declare const requiredScopeForPath: (path: string) => ApiTokenScope | null;
+export declare const assertTokenAllowsPath: (record: StoredApiTokenRecord, path: string) => ApiTokenScope[];
+export declare const listTokensForUser: (userId: string) => Promise<StoredApiTokenRecord[]>;
+export declare const listAllTokens: () => Promise<StoredApiTokenRecord[]>;
+export declare const findTokenById: (tokenId: string) => Promise<StoredApiTokenRecord | null>;
+export declare const revokeApiToken: (tokenId: string) => Promise<boolean>;
+/** Public projection: never exposes the hash. */
+export declare const toPublicToken: (record: StoredApiTokenRecord) => {
+    id: string;
+    name: string;
+    tokenPrefix: string;
+    scopes: ("admin" | "chat" | "documents" | "media" | "models" | "notes" | "personas" | "work")[];
+    createdAt: string;
+    expiresAt: string | null;
+    lastUsedAt: string | null;
+    revokedAt: string | null;
+};
+//# sourceMappingURL=apiTokenService.d.ts.map

package/backend/dist/services/apiTokenService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiTokenService.d.ts","sourceRoot":"","sources":["../../src/services/apiTokenService.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAOpE,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC,eAAO,MAAM,gBAAgB,YAC3B,MAAM,EACN,QAAQ,EACR,WAAW,EACX,OAAO,EACP,UAAU,EACV,OAAO,EACP,MAAM,EACN,OAAO,CACC,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,eAAO,MAAM,eAAe,UAAW,OAAO,KAAG,KAAK,IAAI,aAED,CAAC;AAoC1D,qBAAa,kBAAmB,SAAQ,KAAK;IAC/B,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI;IAAxD,YAAqB,aAAa,EAAE,aAAa,GAAG,IAAI,EAOvD;CACF;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,cAGC;CACF;AAKD,eAAO,MAAM,YAAY,UAAW,MAAM,KAAG,MACK,CAAC;AAEnD,eAAO,MAAM,iBAAiB,WAAY,MAAM,KAAG,OACd,CAAC;AAEtC,eAAO,MAAM,gBAAgB,WACnB,oBAAoB,KAC3B,aAAa,EAQf,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,oBAAoB,CAAC;CAC9B;AAED,eAAO,MAAM,cAAc,WACjB,MAAM,SACP;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,KACvE,OAAO,CAAC,eAAe,CAmCzB,CAAC;AAEF,kEAAkE;AAClE,eAAO,MAAM,eAAe,WAClB,MAAM,KACb,OAAO,CAAC,oBAAoB,GAAG,IAAI,CASrC,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,wBAAwB,YAC1B,MAAM,KACd,OAAO,CAAC,IAAI,CAgBd,CAAC;AAEF,eAAO,MAAM,gBAAgB,WACnB,oBAAoB,KAC3B,OAAO,CAAC,IAAI,CAWd,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,SAAU,MAAM,KAAG,aAAa,GAAG,IAInE,CAAC;AAEF,eAAO,MAAM,qBAAqB,WACxB,oBAAoB,QACtB,MAAM,KACX,aAAa,EAMf,CAAC;AAEF,eAAO,MAAM,iBAAiB,WACpB,MAAM,KACb,OAAO,CAAC,oBAAoB,EAAE,CAAgC,CAAC;AAElE,eAAO,MAAM,aAAa,QAAO,OAAO,CAAC,oBAAoB,EAAE,CAC3C,CAAC;AAErB,eAAO,MAAM,aAAa,YACf,MAAM,KACd,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAA+B,CAAC;AAEtE,eAAO,MAAM,cAAc,YAAmB,MAAM,KAAG,OAAO,CAAC,OAAO,CAChC,CAAC;AAEvC,iDAAiD;AACjD,eAAO,MAAM,aAAa,WAAY,oBAAoB;IACxD,EAAE;IACF,IAAI;IACJ,WAAW;IACX,MAAM;IACN,SAAS;IACT,SAAS;IAGT,UAAU;IAGV,SAAS;CAGT,CAAC"}

package/backend/dist/services/apiTokenService.js

@@ -0,0 +1,220 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Scoped personal API tokens (IAM-05).
+ *
+ * Tokens are shown once at creation and stored only as a SHA-256 digest.
+ * Each token carries an explicit scope list; the auth middleware maps the
+ * requested route to a required scope, so a leaked notes-only token cannot
+ * touch chats, media, or administration. Expiry, revocation, and last-use
+ * are enforced and tracked server-side.
+ */
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { getPersistence } from '../persistence/index.js';
+import { getInitializedCoordinator } from '../platform/coordination/service.js';
+import { encryptionService } from './encryptionService.js';
+import { createLogger } from '../utils/logger.js';
+const logger = createLogger('services:api-tokens');
+export const API_TOKEN_PREFIX = 'lwk_';
+export const API_TOKEN_SCOPES = [
+    'chat',
+    'models',
+    'documents',
+    'notes',
+    'personas',
+    'media',
+    'work',
+    'admin',
+];
+export const isApiTokenScope = (value) => typeof value === 'string' &&
+    API_TOKEN_SCOPES.includes(value);
+/** Requests per minute allowed per token across every replica. */
+const API_TOKEN_RATE_LIMIT = 600;
+const API_TOKEN_RATE_WINDOW_MS = 60000;
+const LAST_USED_THROTTLE_MS = 60000;
+const MAX_TOKENS_PER_USER = 25;
+/**
+ * Route-prefix to scope mapping. Session management and account routes are
+ * deliberately unreachable with an API token; unknown prefixes require the
+ * admin scope so a new route family fails closed until mapped here.
+ */
+const PATH_SCOPES = [
+    { prefix: '/api/chat', scope: 'chat' },
+    { prefix: '/api/preferences', scope: 'chat' },
+    { prefix: '/api/search', scope: 'chat' },
+    { prefix: '/api/jobs', scope: 'chat' },
+    { prefix: '/api/ollama', scope: 'models' },
+    { prefix: '/api/huggingface-hub', scope: 'models' },
+    { prefix: '/api/documents', scope: 'documents' },
+    { prefix: '/api/embeddings', scope: 'documents' },
+    { prefix: '/api/notes', scope: 'notes' },
+    { prefix: '/api/personas', scope: 'personas' },
+    { prefix: '/api/tts', scope: 'media' },
+    { prefix: '/api/stt', scope: 'media' },
+    { prefix: '/api/image-gen', scope: 'media' },
+    { prefix: '/api/media', scope: 'media' },
+    { prefix: '/api/artifacts', scope: 'media' },
+    { prefix: '/api/work', scope: 'work' },
+    { prefix: '/api/agent-clis', scope: 'work' },
+    { prefix: '/api/health', scope: 'chat' },
+];
+const FORBIDDEN_PREFIXES = ['/api/auth'];
+export class ApiTokenScopeError extends Error {
+    constructor(requiredScope) {
+        super(requiredScope
+            ? `This API token is missing the '${requiredScope}' scope`
+            : 'This route cannot be used with an API token');
+        this.requiredScope = requiredScope;
+        this.name = 'ApiTokenScopeError';
+    }
+}
+export class ApiTokenRateLimitError extends Error {
+    constructor() {
+        super('API token rate limit exceeded');
+        this.name = 'ApiTokenRateLimitError';
+    }
+}
+const tokens = () => getPersistence(encryptionService).repositories.security.apiTokens;
+export const hashApiToken = (token) => createHash('sha256').update(token).digest('hex');
+export const looksLikeApiToken = (bearer) => bearer.startsWith(API_TOKEN_PREFIX);
+export const parseTokenScopes = (record) => {
+    try {
+        const parsed = JSON.parse(record.scopes);
+        if (Array.isArray(parsed))
+            return parsed.filter(isApiTokenScope);
+    }
+    catch {
+        // fall through to empty scopes: an unreadable list must fail closed.
+    }
+    return [];
+};
+export const createApiToken = async (userId, input) => {
+    const name = input.name.trim();
+    if (!name || name.length > 128) {
+        throw new Error('Token name must be between 1 and 128 characters');
+    }
+    const scopes = [...new Set(input.scopes)].filter(isApiTokenScope);
+    if (scopes.length === 0) {
+        throw new Error('At least one valid scope is required');
+    }
+    const existing = await tokens().listByUser(userId);
+    if (existing.filter(item => item.revoked_at === null).length >=
+        MAX_TOKENS_PER_USER) {
+        throw new Error(`A user may hold at most ${MAX_TOKENS_PER_USER} tokens`);
+    }
+    const secret = `${API_TOKEN_PREFIX}${randomBytes(32).toString('base64url')}`;
+    const now = Date.now();
+    const record = {
+        id: randomUUID(),
+        user_id: userId,
+        name,
+        token_hash: hashApiToken(secret),
+        token_prefix: secret.slice(0, 12),
+        scopes: JSON.stringify(scopes),
+        created_at: now,
+        expires_at: input.expiresInDays && input.expiresInDays > 0
+            ? now + Math.min(input.expiresInDays, 3650) * 24 * 60 * 60 * 1000
+            : null,
+        last_used_at: null,
+        revoked_at: null,
+    };
+    await tokens().insert(record);
+    return { token: secret, record };
+};
+/** Resolve a presented bearer to a live token record, or null. */
+export const resolveApiToken = async (bearer) => {
+    if (!looksLikeApiToken(bearer))
+        return null;
+    const record = await tokens().findByHash(hashApiToken(bearer));
+    if (!record)
+        return null;
+    if (record.revoked_at !== null)
+        return null;
+    if (record.expires_at !== null && record.expires_at <= Date.now()) {
+        return null;
+    }
+    return record;
+};
+/** Distributed per-token rate limit; skipped when no coordinator exists. */
+export const consumeApiTokenRateLimit = async (tokenId) => {
+    const coordinator = getInitializedCoordinator();
+    if (!coordinator)
+        return;
+    try {
+        const result = await coordinator.consumeRateLimit(`api-token:${tokenId}`, API_TOKEN_RATE_LIMIT, API_TOKEN_RATE_WINDOW_MS);
+        if (!result.allowed)
+            throw new ApiTokenRateLimitError();
+    }
+    catch (error) {
+        if (error instanceof ApiTokenRateLimitError)
+            throw error;
+        // Coordinator trouble must not take API access down with it; the shared
+        // HTTP limiters still bound abuse.
+        logger.warn('API token rate limit check failed', { error });
+    }
+};
+export const touchApiTokenUse = async (record) => {
+    const now = Date.now();
+    if (record.last_used_at !== null &&
+        now - record.last_used_at < LAST_USED_THROTTLE_MS) {
+        return;
+    }
+    await tokens()
+        .touchLastUsed(record.id, now)
+        .catch(() => undefined);
+};
+/**
+ * The scope a request path requires, or an error when tokens are barred
+ * from the route family entirely.
+ */
+export const requiredScopeForPath = (path) => {
+    if (FORBIDDEN_PREFIXES.some(prefix => path.startsWith(prefix)))
+        return null;
+    const match = PATH_SCOPES.find(entry => path.startsWith(entry.prefix));
+    return match ? match.scope : 'admin';
+};
+export const assertTokenAllowsPath = (record, path) => {
+    const scopes = parseTokenScopes(record);
+    const required = requiredScopeForPath(path);
+    if (required === null)
+        throw new ApiTokenScopeError(null);
+    if (scopes.includes('admin') || scopes.includes(required))
+        return scopes;
+    throw new ApiTokenScopeError(required);
+};
+export const listTokensForUser = (userId) => tokens().listByUser(userId);
+export const listAllTokens = () => tokens().listAll();
+export const findTokenById = (tokenId) => tokens().findById(tokenId);
+export const revokeApiToken = async (tokenId) => tokens().revoke(tokenId, Date.now());
+/** Public projection: never exposes the hash. */
+export const toPublicToken = (record) => ({
+    id: record.id,
+    name: record.name,
+    tokenPrefix: record.token_prefix,
+    scopes: parseTokenScopes(record),
+    createdAt: new Date(record.created_at).toISOString(),
+    expiresAt: record.expires_at
+        ? new Date(record.expires_at).toISOString()
+        : null,
+    lastUsedAt: record.last_used_at
+        ? new Date(record.last_used_at).toISOString()
+        : null,
+    revokedAt: record.revoked_at
+        ? new Date(record.revoked_at).toISOString()
+        : null,
+});
+//# sourceMappingURL=apiTokenService.js.map

package/backend/dist/services/apiTokenService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiTokenService.js","sourceRoot":"","sources":["../../src/services/apiTokenService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAC;AAEnD,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,MAAM;IACN,QAAQ;IACR,WAAW;IACX,OAAO;IACP,UAAU;IACV,OAAO;IACP,MAAM;IACN,OAAO;CACC,CAAC;AAIX,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAc,EAA0B,EAAE,CACxE,OAAO,KAAK,KAAK,QAAQ;IACxB,gBAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAE1D,kEAAkE;AAClE,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,wBAAwB,GAAG,KAAM,CAAC;AACxC,MAAM,qBAAqB,GAAG,KAAM,CAAC;AACrC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B;;;;GAIG;AACH,MAAM,WAAW,GAA4D;IAC3E,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE;IACtC,EAAE,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE;IAC7C,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE;IACxC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE;IACtC,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC1C,EAAE,MAAM,EAAE,sBAAsB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACnD,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,WAAW,EAAE;IAChD,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,EAAE;IACjD,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE;IACxC,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE;IAC9C,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE;IACtC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE;IACtC,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE;IAC5C,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE;IACxC,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE;IAC5C,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE;IACtC,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE;IAC5C,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE;CACzC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,WAAW,CAAC,CAAC;AAEzC,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAqB,aAAmC;QACtD,KAAK,CACH,aAAa;YACX,CAAC,CAAC,kCAAkC,aAAa,SAAS;YAC1D,CAAC,CAAC,6CAA6C,CAClD,CAAC;6BALiB,aAAa;QAMhC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C;QACE,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,MAAM,GAAG,GAAG,EAAE,CAClB,cAAc,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC;AAEpE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAa,EAAU,EAAE,CACpD,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAW,EAAE,CAC3D,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AAEtC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,MAA4B,EACX,EAAE;IACnB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,MAAc,EACd,KAAwE,EAC9C,EAAE;IAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACnD,IACE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,MAAM;QACxD,mBAAmB,EACnB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,mBAAmB,SAAS,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,gBAAgB,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAyB;QACnC,EAAE,EAAE,UAAU,EAAE;QAChB,OAAO,EAAE,MAAM;QACf,IAAI;QACJ,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC;QAChC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QAC9B,UAAU,EAAE,GAAG;QACf,UAAU,EACR,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC;YAC5C,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;YACjE,CAAC,CAAC,IAAI;QACV,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,IAAI;KACjB,CAAC;IACF,MAAM,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC,CAAC;AAEF,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,MAAc,EACwB,EAAE;IACxC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAC3C,OAAe,EACA,EAAE;IACjB,MAAM,WAAW,GAAG,yBAAyB,EAAE,CAAC;IAChD,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,gBAAgB,CAC/C,aAAa,OAAO,EAAE,EACtB,oBAAoB,EACpB,wBAAwB,CACzB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAsB,EAAE,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,sBAAsB;YAAE,MAAM,KAAK,CAAC;QACzD,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,MAA4B,EACb,EAAE;IACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IACE,MAAM,CAAC,YAAY,KAAK,IAAI;QAC5B,GAAG,GAAG,MAAM,CAAC,YAAY,GAAG,qBAAqB,EACjD,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,MAAM,EAAE;SACX,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC;SAC7B,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAwB,EAAE;IACzE,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;AACvC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,MAA4B,EAC5B,IAAY,EACK,EAAE;IACnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,IAAI;QAAE,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC;IACzE,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAC;AACzC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,MAAc,EACmB,EAAE,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAElE,MAAM,CAAC,MAAM,aAAa,GAAG,GAAoC,EAAE,CACjE,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;AAErB,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,OAAe,EACuB,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAEtE,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,OAAe,EAAoB,EAAE,CACxE,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAEvC,iDAAiD;AACjD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAA4B,EAAE,EAAE,CAAC,CAAC;IAC9D,EAAE,EAAE,MAAM,CAAC,EAAE;IACb,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,WAAW,EAAE,MAAM,CAAC,YAAY;IAChC,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC;IAChC,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;IACpD,SAAS,EAAE,MAAM,CAAC,UAAU;QAC1B,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;QAC3C,CAAC,CAAC,IAAI;IACR,UAAU,EAAE,MAAM,CAAC,YAAY;QAC7B,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE;QAC7C,CAAC,CAAC,IAAI;IACR,SAAS,EAAE,MAAM,CAAC,UAAU;QAC1B,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;QAC3C,CAAC,CAAC,IAAI;CACT,CAAC,CAAC"}

package/backend/dist/services/authService.d.ts

@@ -4,13 +4,22 @@ import { TurnstilePublicConfig } from './turnstileService.js';
 export declare const JWT_SECRET: string;
 export declare const parseJwtLifetime: (value?: string | undefined) => SignOptions['expiresIn'];
 export declare const JWT_EXPIRES_IN: number | import("ms").StringValue | undefined;
+/** The configured JWT lifetime in milliseconds. */
+export declare const jwtLifetimeMs: (lifetime?: SignOptions['expiresIn']) => number;
 export interface AuthTokenPayload {
     userId: string;
     username: string;
     role: 'admin' | 'user';
+    /** Server-side auth session id; absent only on legacy tokens. */
+    sid?: string;
     iat?: number;
     exp?: number;
 }
+export interface SessionMetadata {
+    kind: string;
+    ip?: string | undefined;
+    userAgent?: string | undefined;
+}
 export type AuthResult = {
     status: 'authenticated';
     user: UserPublic;
@@ -30,9 +39,16 @@ export interface SystemInfo {
 }
 export declare class AuthService {
     /**
-     * Generate JWT token for user
+     * Generate JWT token for user. When a server-side session id is provided
+     * the token carries it as `sid`, making the token revocable.
+     */
+    generateToken(user: UserPublic, sessionId?: string): string;
+    /**
+     * Create a server-side auth session and mint the JWT bound to it. All
+     * login paths (password, signup bootstrap, OAuth, OIDC) issue through
+     * here so every new token is revocable from the session inventory.
      */
-    generateToken(user: UserPublic): string;
+    issueSession(user: UserPublic, metadata: SessionMetadata): Promise<string>;
     /**
      * Verify JWT token
      */
@@ -40,7 +56,7 @@ export declare class AuthService {
     /**
      * Login user
      */
-    login(username: string, password: string): Promise<AuthResult | null>;
+    login(username: string, password: string, metadata?: SessionMetadata): Promise<AuthResult | null>;
     /**
      * Get system information
      */
@@ -60,7 +76,7 @@ export declare class AuthService {
     /**
      * Signup user
      */
-    signup(username: string, password: string, email?: string): Promise<AuthResult | null>;
+    signup(username: string, password: string, email?: string, metadata?: SessionMetadata): Promise<AuthResult | null>;
 }
 export declare const authService: AuthService;
 //# sourceMappingURL=authService.d.ts.map

package/backend/dist/services/authService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authService.d.ts","sourceRoot":"","sources":["../../src/services/authService.ts"],"names":[],"mappings":"AAiBA,OAAY,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAa,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAK/D,OAAO,EAAoB,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAyBhF,eAAO,MAAM,UAAU,QAWjB,CAAC;AAEP,eAAO,MAAM,gBAAgB,kCAE1B,WAAW,CAAC,WAAW,CAWzB,CAAC;AAEF,eAAO,MAAM,cAAc,+CAAqB,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAE5C,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,qBAAqB,CAAC;CAClC;AAED,qBAAa,WAAW;IACtB;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAYtC;IAED;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAelD;IAED;;OAEG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAY1E;IAED;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,UAAU,CAAC,CAYzC;IAED,+DAA+D;IAC/D,2BAA2B,IAAI,OAAO,CAErC;IAED,yEAAyE;IACnE,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAE9C;IAED;;OAEG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAMhE;IAED;;OAEG;IACG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAKpE;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAsC5B;CACF;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}
+{"version":3,"file":"authService.d.ts","sourceRoot":"","sources":["../../src/services/authService.ts"],"names":[],"mappings":"AAiBA,OAAY,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAa,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAK/D,OAAO,EAAoB,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAyBhF,eAAO,MAAM,UAAU,QAWjB,CAAC;AAEP,eAAO,MAAM,gBAAgB,kCAE1B,WAAW,CAAC,WAAW,CAWzB,CAAC;AAEF,eAAO,MAAM,cAAc,+CAAqB,CAAC;AAEjD,mDAAmD;AACnD,eAAO,MAAM,aAAa,cACd,WAAW,CAAC,WAAW,CAAC,KACjC,MAgBF,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAE5C,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,qBAAqB,CAAC;CAClC;AAED,qBAAa,WAAW;IACtB;;;OAGG;IACH,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAa1D;IAED;;;;OAIG;IACG,YAAY,CAChB,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,MAAM,CAAC,CAQjB;IAED;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAelD;IAED;;OAEG;IACG,KAAK,CACT,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,eAAe,GACzB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAe5B;IAED;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,UAAU,CAAC,CAYzC;IAED,+DAA+D;IAC/D,2BAA2B,IAAI,OAAO,CAErC;IAED,yEAAyE;IACnE,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAE9C;IAED;;OAEG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAMhE;IAED;;OAEG;IACG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAKpE;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,eAAe,GACzB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAyC5B;CACF;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}