libre-webui 0.22.1 → 0.23.0

package/backend/dist/routes/access.js

@@ -0,0 +1,134 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Resource-grant management (IAM-03). Owners (and grant-admins) manage
+ * shares on their own resources; a user can always list what is shared
+ * with them and leave a share.
+ */
+import express from 'express';
+import rateLimit from '../middleware/sharedRateLimit.js';
+import { authenticate } from '../middleware/auth.js';
+import { createGrant, deleteGrant, listGrantsForActor, listGrantsForResource, ResourceGrantError, } from '../services/resourceGrantService.js';
+import { createLogger } from '../utils/logger.js';
+const router = express.Router();
+const logger = createLogger('access-routes');
+const accessRateLimiter = rateLimit({
+    keyPrefix: 'resource-access',
+    windowMs: 15 * 60 * 1000,
+    max: 240,
+    message: { success: false, message: 'Too many requests' },
+    standardHeaders: true,
+    legacyHeaders: false,
+});
+router.use(accessRateLimiter, authenticate);
+const actorOf = (req) => ({
+    userId: req.user.userId,
+    role: req.user.role,
+});
+const handleError = (res, error, fallback) => {
+    if (error instanceof ResourceGrantError) {
+        res
+            .status(error.statusCode)
+            .json({ success: false, message: error.message });
+        return;
+    }
+    logger.error(fallback, error);
+    res.status(500).json({ success: false, message: 'Internal server error' });
+};
+const publicGrant = (grant) => ({
+    id: grant.id,
+    resourceType: grant.resource_type,
+    resourceId: grant.resource_id,
+    principalType: grant.principal_type,
+    principalId: grant.principal_id,
+    permission: grant.permission,
+    createdAt: new Date(grant.created_at).toISOString(),
+});
+/** Grants on one of the caller's resources. */
+router.get('/grants', async (req, res) => {
+    try {
+        const { type, id } = req.query;
+        if (typeof type !== 'string' || typeof id !== 'string') {
+            res
+                .status(400)
+                .json({ success: false, message: 'type and id are required' });
+            return;
+        }
+        const grants = await listGrantsForResource(actorOf(req), type, id);
+        res.json({ success: true, data: grants.map(publicGrant) });
+    }
+    catch (error) {
+        handleError(res, error, 'Grant list error:');
+    }
+});
+/** Share a resource with a user or group. */
+router.post('/grants', async (req, res) => {
+    try {
+        const { resourceType, resourceId, principalType, principalId, permission } = req.body ?? {};
+        for (const [field, value] of Object.entries({
+            resourceType,
+            resourceId,
+            principalType,
+            principalId,
+            permission,
+        })) {
+            if (typeof value !== 'string' || !value) {
+                res
+                    .status(400)
+                    .json({ success: false, message: `${field} is required` });
+                return;
+            }
+        }
+        const grant = await createGrant(actorOf(req), {
+            resourceType,
+            resourceId,
+            principalType,
+            principalId,
+            permission,
+        });
+        res.status(201).json({ success: true, data: publicGrant(grant) });
+    }
+    catch (error) {
+        handleError(res, error, 'Grant create error:');
+    }
+});
+/** Remove a grant (owner, grant-admin, or the granted user leaving). */
+router.delete('/grants/:id', async (req, res) => {
+    try {
+        const deleted = await deleteGrant(actorOf(req), req.params.id);
+        if (!deleted) {
+            res.status(404).json({ success: false, message: 'Grant not found' });
+            return;
+        }
+        res.json({ success: true });
+    }
+    catch (error) {
+        handleError(res, error, 'Grant delete error:');
+    }
+});
+/** Everything shared with the caller, directly or via groups. */
+router.get('/shared-with-me', async (req, res) => {
+    try {
+        const grants = await listGrantsForActor(actorOf(req));
+        res.json({ success: true, data: grants.map(publicGrant) });
+    }
+    catch (error) {
+        handleError(res, error, 'Shared list error:');
+    }
+});
+export default router;
+//# sourceMappingURL=access.js.map

package/backend/dist/routes/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/routes/access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;GAIG;AAEH,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,SAAS,MAAM,kCAAkC,CAAC;AACzD,OAAO,EAAE,YAAY,EAAwB,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EACL,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;AAChC,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAE7C,MAAM,iBAAiB,GAAG,SAAS,CAAC;IAClC,SAAS,EAAE,iBAAiB;IAC5B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,GAAG,EAAE,GAAG;IACR,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE;IACzD,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,KAAK;CACrB,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;AAE5C,MAAM,OAAO,GAAG,CAAC,GAAyB,EAAc,EAAE,CAAC,CAAC;IAC1D,MAAM,EAAE,GAAG,CAAC,IAAK,CAAC,MAAM;IACxB,IAAI,EAAE,GAAG,CAAC,IAAK,CAAC,IAAI;CACrB,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAClB,GAAqB,EACrB,KAAc,EACd,QAAgB,EACV,EAAE;IACR,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;QACxC,GAAG;aACA,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;aACxB,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;AAC7E,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,KAQpB,EAAE,EAAE,CAAC,CAAC;IACL,EAAE,EAAE,KAAK,CAAC,EAAE;IACZ,YAAY,EAAE,KAAK,CAAC,aAAa;IACjC,UAAU,EAAE,KAAK,CAAC,WAAW;IAC7B,aAAa,EAAE,KAAK,CAAC,cAAc;IACnC,WAAW,EAAE,KAAK,CAAC,YAAY;IAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;IAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;CACpD,CAAC,CAAC;AAEH,+CAA+C;AAC/C,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IAC7D,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;QAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YACvD,GAAG;iBACA,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,6CAA6C;AAC7C,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IAC9D,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,GACxE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;YAC1C,YAAY;YACZ,UAAU;YACV,aAAa;YACb,WAAW;YACX,UAAU;SACX,CAAC,EAAE,CAAC;YACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;gBACxC,GAAG;qBACA,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,cAAc,EAAE,CAAC,CAAC;gBAC7D,OAAO;YACT,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;YAC5C,YAAY;YACZ,UAAU;YACV,aAAa;YACb,WAAW;YACX,UAAU;SACX,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACjD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,wEAAwE;AACxE,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACpE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACjD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iEAAiE;AACjE,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACrE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}

package/backend/dist/routes/audit.d.ts

@@ -0,0 +1,3 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;
+//# sourceMappingURL=audit.d.ts.map

package/backend/dist/routes/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/routes/audit.ts"],"names":[],"mappings":"AAuBA,QAAA,MAAM,MAAM,4CAAmB,CAAC;eAkEjB,MAAM"}

package/backend/dist/routes/audit.js

@@ -0,0 +1,82 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import express from 'express';
+import rateLimit from '../middleware/sharedRateLimit.js';
+import { authenticate, requireAdmin } from '../middleware/auth.js';
+import { queryAuditEvents } from '../services/securityAuditService.js';
+import { createLogger } from '../utils/logger.js';
+const router = express.Router();
+const logger = createLogger('audit-routes');
+const auditRateLimiter = rateLimit({
+    keyPrefix: 'security-audit',
+    windowMs: 15 * 60 * 1000,
+    max: 120,
+    message: { success: false, message: 'Too many requests' },
+    standardHeaders: true,
+    legacyHeaders: false,
+});
+router.use(auditRateLimiter, authenticate, requireAdmin);
+/** Query the security audit log (admin only, redacted at write time). */
+router.get('/', async (req, res) => {
+    try {
+        const { action, actor, result, targetType, before, after, limit } = req.query;
+        const parseEpoch = (value) => {
+            if (typeof value !== 'string' || !value)
+                return undefined;
+            const asNumber = Number(value);
+            if (Number.isFinite(asNumber) && asNumber > 0)
+                return asNumber;
+            const asDate = Date.parse(value);
+            return Number.isFinite(asDate) ? asDate : undefined;
+        };
+        const isResult = (value) => value === 'success' || value === 'denied' || value === 'failure';
+        const events = await queryAuditEvents({
+            ...(typeof action === 'string' && action ? { action } : {}),
+            ...(typeof actor === 'string' && actor ? { actorUserId: actor } : {}),
+            ...(isResult(result) ? { result } : {}),
+            ...(typeof targetType === 'string' && targetType ? { targetType } : {}),
+            ...(parseEpoch(before) !== undefined
+                ? { before: parseEpoch(before) }
+                : {}),
+            ...(parseEpoch(after) !== undefined ? { after: parseEpoch(after) } : {}),
+            ...(typeof limit === 'string' && Number.isFinite(Number(limit))
+                ? { limit: Number(limit) }
+                : {}),
+        });
+        res.json({
+            success: true,
+            data: events.map(event => ({
+                id: event.id,
+                occurredAt: new Date(event.occurred_at).toISOString(),
+                actorUserId: event.actor_user_id,
+                actorKind: event.actor_kind,
+                action: event.action,
+                targetType: event.target_type,
+                targetId: event.target_id,
+                result: event.result,
+                requestId: event.request_id,
+                details: event.details ? JSON.parse(event.details) : null,
+            })),
+        });
+    }
+    catch (error) {
+        logger.error('Audit query error:', error);
+        res.status(500).json({ success: false, message: 'Internal server error' });
+    }
+});
+export default router;
+//# sourceMappingURL=audit.js.map

package/backend/dist/routes/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/routes/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,SAAS,MAAM,kCAAkC,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;AAChC,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;AAE5C,MAAM,gBAAgB,GAAG,SAAS,CAAC;IACjC,SAAS,EAAE,gBAAgB;IAC3B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,GAAG,EAAE,GAAG;IACR,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE;IACzD,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,KAAK;CACrB,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAEzD,yEAAyE;AACzE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACjC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAC/D,GAAG,CAAC,KAAK,CAAC;QACZ,MAAM,UAAU,GAAG,CAAC,KAAc,EAAsB,EAAE;YACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;gBAAE,OAAO,QAAQ,CAAC;YAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACtD,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,CACf,KAAc,EAC6B,EAAE,CAC7C,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,CAAC;QAEnE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;YACpC,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,SAAS;gBAClC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAE,EAAE;gBACjC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7D,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;gBAC1B,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACzB,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,UAAU,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;gBACrD,WAAW,EAAE,KAAK,CAAC,aAAa;gBAChC,SAAS,EAAE,KAAK,CAAC,UAAU;gBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,WAAW;gBAC7B,QAAQ,EAAE,KAAK,CAAC,SAAS;gBACzB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,UAAU;gBAC3B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;aAC1D,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;QAC1C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}

package/backend/dist/routes/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"AA2CA,QAAA,MAAM,MAAM,4CAAmB,CAAC;eAsoBjB,MAAM"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"AAgEA,QAAA,MAAM,MAAM,4CAAmB,CAAC;eAs/BjB,MAAM"}

package/backend/dist/routes/auth.js

@@ -22,11 +22,15 @@ import { authService } from '../services/authService.js';
 import { authenticate, requireAdmin, } from '../middleware/auth.js';
 import { encryptionService } from '../services/encryptionService.js';
 import { turnstileService } from '../services/turnstileService.js';
-import { beginOAuthFlow, consumeOAuthSessionCookie, consumeOAuthState, setOAuthSessionCookie, } from '../services/oauthSecurity.js';
+import { beginOAuthFlow, beginOAuthFlowWithPayload, consumeOAuthSessionCookie, consumeOAuthState, consumeOAuthStatePayload, setOAuthSessionCookie, } from '../services/oauthSecurity.js';
 import { validatePasswordStrength } from '../utils/hash.js';
 import { createLogger } from '../utils/logger.js';
 import { WebSocketTicketRateLimitError, websocketTicketService, } from '../services/websocketTicketService.js';
 import { coordinatedRateLimit } from '../middleware/coordinatedRateLimit.js';
+import { findSessionById, listSessionsForUser, revokeAllAuthSessions, revokeAuthSession, } from '../services/authSessionService.js';
+import { createApiToken, findTokenById, isApiTokenScope, listTokensForUser, revokeApiToken, toPublicToken, } from '../services/apiTokenService.js';
+import { hashClientIp, recordAuditEvent, } from '../services/securityAuditService.js';
+import { OidcError, oidcOAuthService } from '../services/simpleOidcOAuth.js';
 const router = express.Router();
 const logger = createLogger('auth-routes');
 // Fallback frontend URL for OAuth redirects
@@ -100,7 +104,7 @@ router.post('/websocket-ticket', generalAuthRateLimiter, authenticate, async (re
     }
     const sessionExpiresAt = (req.user?.exp ?? 0) * 1000;
     try {
-        const ticket = await websocketTicketService.issue(req.user.userId, sessionExpiresAt, audience, audience === 'work-terminal' ? taskId.trim() : undefined);
+        const ticket = await websocketTicketService.issue(req.user.userId, sessionExpiresAt, audience, audience === 'work-terminal' ? taskId.trim() : undefined, req.auth?.kind === 'session' ? req.auth.sessionId : undefined);
         res.json({ success: true, data: ticket });
     }
     catch (error) {
@@ -136,14 +140,31 @@ router.post('/login', loginRateLimiter, async (req, res) => {
             });
             return;
         }
-        const result = await authService.login(username, password);
+        const result = await authService.login(username, password, {
+            kind: 'password',
+            ip: getClientIp(req),
+            userAgent: req.headers['user-agent'],
+        });
         if (!result) {
+            void recordAuditEvent({
+                action: 'auth.login',
+                result: 'failure',
+                ipHash: hashClientIp(getClientIp(req)),
+                details: { username: String(username).slice(0, 64) },
+            });
             res.status(401).json({
                 success: false,
                 message: 'Invalid credentials',
             });
             return;
         }
+        void recordAuditEvent({
+            action: 'auth.login',
+            result: result.status === 'authenticated' ? 'success' : 'denied',
+            actorUserId: result.user.id,
+            ipHash: hashClientIp(getClientIp(req)),
+            details: { method: 'password', status: result.status },
+        });
         if (result.status === 'pending') {
             res.status(403).json({
                 success: false,
@@ -175,9 +196,16 @@ router.post('/login', loginRateLimiter, async (req, res) => {
  */
 router.post('/logout', generalAuthRateLimiter, authenticate, async (req, res) => {
     try {
-        // In a stateless JWT system, logout is handled client-side
-        // But we can log it for audit purposes
-        logger.debug(`User ${req.user?.username} logged out`);
+        // Revoke the server-side session so the JWT stops working everywhere,
+        // not just in this browser.
+        if (req.auth?.kind === 'session' && req.user) {
+            await revokeAuthSession(req.auth.sessionId, req.user.userId);
+        }
+        void recordAuditEvent({
+            action: 'auth.logout',
+            result: 'success',
+            actorUserId: req.user?.userId ?? null,
+        });
         res.json({
             success: true,
             message: 'Logged out successfully',
@@ -191,6 +219,167 @@ router.post('/logout', generalAuthRateLimiter, authenticate, async (req, res) =>
         });
     }
 });
+/** List this account's sessions, newest activity first. */
+router.get('/sessions', generalAuthRateLimiter, authenticate, async (req, res) => {
+    try {
+        const sessions = await listSessionsForUser(req.user.userId);
+        const currentSessionId = req.auth?.kind === 'session' ? req.auth.sessionId : null;
+        res.json({
+            success: true,
+            data: sessions.map(session => ({
+                id: session.id,
+                kind: session.kind,
+                userAgent: session.user_agent,
+                createdAt: new Date(session.created_at).toISOString(),
+                lastSeenAt: new Date(session.last_seen_at).toISOString(),
+                expiresAt: new Date(session.expires_at).toISOString(),
+                revokedAt: session.revoked_at
+                    ? new Date(session.revoked_at).toISOString()
+                    : null,
+                current: session.id === currentSessionId,
+            })),
+        });
+    }
+    catch (error) {
+        logger.error('Session inventory error:', error);
+        res
+            .status(500)
+            .json({ success: false, message: 'Internal server error' });
+    }
+});
+/** Revoke every other session ("sign out everywhere else"). */
+router.post('/sessions/revoke-others', generalAuthRateLimiter, authenticate, async (req, res) => {
+    try {
+        const currentSessionId = req.auth?.kind === 'session' ? req.auth.sessionId : undefined;
+        const revoked = await revokeAllAuthSessions(req.user.userId, req.user.userId, currentSessionId);
+        void recordAuditEvent({
+            action: 'session.revoke-others',
+            result: 'success',
+            actorUserId: req.user.userId,
+            details: { revokedCount: revoked.length },
+        });
+        res.json({ success: true, data: { revokedCount: revoked.length } });
+    }
+    catch (error) {
+        logger.error('Session revocation error:', error);
+        res
+            .status(500)
+            .json({ success: false, message: 'Internal server error' });
+    }
+});
+/** Revoke one session by id (own sessions only; admins may revoke any). */
+router.delete('/sessions/:id', generalAuthRateLimiter, authenticate, async (req, res) => {
+    try {
+        const session = await findSessionById(req.params.id);
+        const isOwn = session?.user_id === req.user.userId;
+        const isAdmin = req.user.role === 'admin';
+        if (!session || (!isOwn && !isAdmin)) {
+            res.status(404).json({ success: false, message: 'Session not found' });
+            return;
+        }
+        const revoked = await revokeAuthSession(session.id, req.user.userId);
+        void recordAuditEvent({
+            action: 'session.revoke',
+            result: 'success',
+            actorUserId: req.user.userId,
+            targetType: 'auth-session',
+            targetId: session.id,
+            details: { targetUserId: session.user_id },
+        });
+        res.json({ success: true, data: { revoked } });
+    }
+    catch (error) {
+        logger.error('Session revocation error:', error);
+        res
+            .status(500)
+            .json({ success: false, message: 'Internal server error' });
+    }
+});
+/** List this account's API tokens (hashes never leave the server). */
+router.get('/tokens', generalAuthRateLimiter, authenticate, async (req, res) => {
+    try {
+        const tokens = await listTokensForUser(req.user.userId);
+        res.json({ success: true, data: tokens.map(toPublicToken) });
+    }
+    catch (error) {
+        logger.error('Token list error:', error);
+        res
+            .status(500)
+            .json({ success: false, message: 'Internal server error' });
+    }
+});
+/** Create a scoped API token; the secret is returned exactly once. */
+router.post('/tokens', generalAuthRateLimiter, authenticate, async (req, res) => {
+    try {
+        if (req.auth?.kind === 'api-token') {
+            res.status(403).json({
+                success: false,
+                message: 'API tokens cannot create other tokens',
+            });
+            return;
+        }
+        const { name, scopes, expiresInDays } = req.body ?? {};
+        const requestedScopes = Array.isArray(scopes)
+            ? scopes.filter(isApiTokenScope)
+            : [];
+        if (requestedScopes.includes('admin') && req.user.role !== 'admin') {
+            res.status(403).json({
+                success: false,
+                message: 'Only administrators may mint admin-scoped tokens',
+            });
+            return;
+        }
+        const created = await createApiToken(req.user.userId, {
+            name: typeof name === 'string' ? name : '',
+            scopes: requestedScopes,
+            ...(typeof expiresInDays === 'number' ? { expiresInDays } : {}),
+        });
+        void recordAuditEvent({
+            action: 'token.create',
+            result: 'success',
+            actorUserId: req.user.userId,
+            targetType: 'api-token',
+            targetId: created.record.id,
+            details: { name: created.record.name, scopes: requestedScopes },
+        });
+        res.status(201).json({
+            success: true,
+            data: { token: created.token, record: toPublicToken(created.record) },
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'Internal server error';
+        res.status(400).json({ success: false, message });
+    }
+});
+/** Revoke an API token (own tokens; admins may revoke any). */
+router.delete('/tokens/:id', generalAuthRateLimiter, authenticate, async (req, res) => {
+    try {
+        const record = await findTokenById(req.params.id);
+        const isOwn = record?.user_id === req.user.userId;
+        const isAdmin = req.user.role === 'admin';
+        if (!record || (!isOwn && !isAdmin)) {
+            res.status(404).json({ success: false, message: 'Token not found' });
+            return;
+        }
+        const revoked = await revokeApiToken(record.id);
+        void recordAuditEvent({
+            action: 'token.revoke',
+            result: 'success',
+            actorUserId: req.user.userId,
+            targetType: 'api-token',
+            targetId: record.id,
+            details: { targetUserId: record.user_id },
+        });
+        res.json({ success: true, data: { revoked } });
+    }
+    catch (error) {
+        logger.error('Token revocation error:', error);
+        res
+            .status(500)
+            .json({ success: false, message: 'Internal server error' });
+    }
+});
 /**
  * Verify token endpoint
  */
@@ -312,7 +501,11 @@ router.post('/signup', signupRateLimiter, async (req, res) => {
             });
             return;
         }
-        const result = await authService.signup(username, password, email);
+        const result = await authService.signup(username, password, email, {
+            kind: 'signup',
+            ip: getClientIp(req),
+            userAgent: req.headers['user-agent'],
+        });
         if (!result) {
             res.status(500).json({
                 success: false,
@@ -320,6 +513,13 @@ router.post('/signup', signupRateLimiter, async (req, res) => {
             });
             return;
         }
+        void recordAuditEvent({
+            action: 'auth.signup',
+            result: 'success',
+            actorUserId: result.user.id,
+            ipHash: hashClientIp(getClientIp(req)),
+            details: { status: result.status },
+        });
         const systemInfo = await authService.getSystemInfo();
         if (result.status === 'pending') {
             res.status(202).json({
@@ -397,8 +597,19 @@ router.get('/oauth/github/callback', generalAuthRateLimiter, async (req, res) =>
         if (user.status !== 'active') {
             return res.redirect(pendingApprovalRedirect());
         }
-        // Generate JWT token using existing auth service
-        const token = authService.generateToken(user);
+        // Issue a revocable session-bound JWT
+        const token = await authService.issueSession(user, {
+            kind: 'oauth:github',
+            ip: getClientIp(req),
+            userAgent: req.headers['user-agent'],
+        });
+        void recordAuditEvent({
+            action: 'auth.login',
+            result: 'success',
+            actorUserId: user.id,
+            ipHash: hashClientIp(getClientIp(req)),
+            details: { method: 'oauth:github' },
+        });
         logger.debug('GitHub OAuth successful for user:', user.username);
         setOAuthSessionCookie(req, res, token);
         res.redirect(frontendRedirect('?auth=success'));
@@ -462,8 +673,19 @@ router.get('/oauth/huggingface/callback', generalAuthRateLimiter, async (req, re
         if (user.status !== 'active') {
             return res.redirect(pendingApprovalRedirect());
         }
-        // Generate JWT token
-        const token = authService.generateToken(user);
+        // Issue a revocable session-bound JWT
+        const token = await authService.issueSession(user, {
+            kind: 'oauth:huggingface',
+            ip: getClientIp(req),
+            userAgent: req.headers['user-agent'],
+        });
+        void recordAuditEvent({
+            action: 'auth.login',
+            result: 'success',
+            actorUserId: user.id,
+            ipHash: hashClientIp(getClientIp(req)),
+            details: { method: 'oauth:huggingface' },
+        });
         logger.debug('Hugging Face OAuth successful for user:', user.username);
         setOAuthSessionCookie(req, res, token);
         res.redirect(frontendRedirect('?auth=success'));
@@ -479,6 +701,95 @@ router.get('/oauth/huggingface/callback', generalAuthRateLimiter, async (req, re
 router.get('/oauth/huggingface/status', generalAuthRateLimiter, (req, res) => {
     res.json({ configured: isHuggingFaceConfigured });
 });
+/**
+ * Generic OIDC - Start authentication (PKCE + state + nonce)
+ */
+router.get('/oauth/oidc', generalAuthRateLimiter, async (req, res) => {
+    if (!oidcOAuthService.isConfigured()) {
+        return res.status(404).json({ error: 'OIDC is not configured' });
+    }
+    try {
+        const pkce = oidcOAuthService.createPkcePair();
+        const nonce = oidcOAuthService.createNonce();
+        const state = beginOAuthFlowWithPayload(req, res, 'oidc', {
+            verifier: pkce.verifier,
+            nonce,
+        });
+        const authUrl = await oidcOAuthService.getAuthUrl(state, nonce, pkce.challenge);
+        res.redirect(authUrl);
+    }
+    catch (error) {
+        logger.error('OIDC start error:', error);
+        res.redirect(oauthErrorRedirect('oauth_failed'));
+    }
+});
+/**
+ * Generic OIDC - Handle callback: verify state, exchange with PKCE,
+ * validate the ID token against JWKS, then issue a session-bound JWT.
+ */
+router.get('/oauth/oidc/callback', generalAuthRateLimiter, async (req, res) => {
+    try {
+        if (!oidcOAuthService.isConfigured()) {
+            return res.redirect(oauthErrorRedirect('oauth_not_configured'));
+        }
+        const { code, state } = req.query;
+        const payload = consumeOAuthStatePayload(req, res, 'oidc', typeof state === 'string' ? state : '');
+        if (!payload ||
+            !payload.verifier ||
+            !payload.nonce ||
+            !code ||
+            typeof code !== 'string') {
+            return res.redirect(oauthErrorRedirect('oauth_failed'));
+        }
+        const exchanged = await oidcOAuthService.exchangeCode(code, payload.verifier);
+        const claims = await oidcOAuthService.verifyIdToken(exchanged.idToken, payload.nonce);
+        const user = await oidcOAuthService.processClaims(claims);
+        if (user.status !== 'active') {
+            return res.redirect(pendingApprovalRedirect());
+        }
+        const token = await authService.issueSession(user, {
+            kind: 'oidc',
+            ip: getClientIp(req),
+            userAgent: req.headers['user-agent'],
+        });
+        void recordAuditEvent({
+            action: 'auth.login',
+            result: 'success',
+            actorUserId: user.id,
+            ipHash: hashClientIp(getClientIp(req)),
+            details: { method: 'oidc' },
+        });
+        setOAuthSessionCookie(req, res, token);
+        res.redirect(frontendRedirect('?auth=success'));
+    }
+    catch (error) {
+        logger.error('OIDC callback error:', error);
+        void recordAuditEvent({
+            action: 'auth.login',
+            result: 'failure',
+            ipHash: hashClientIp(getClientIp(req)),
+            details: {
+                method: 'oidc',
+                reason: error instanceof OidcError ? error.code : 'unknown',
+            },
+        });
+        const reason = error instanceof OidcError &&
+            (error.code === 'registration-disabled' || error.code === 'email-in-use')
+            ? error.code.replace(/-/g, '_')
+            : 'oauth_failed';
+        res.redirect(oauthErrorRedirect(reason));
+    }
+});
+/**
+ * Check if generic OIDC is configured (includes the login button label)
+ */
+router.get('/oauth/oidc/status', generalAuthRateLimiter, (req, res) => {
+    const configured = oidcOAuthService.isConfigured();
+    res.json({
+        configured,
+        ...(configured ? { displayName: oidcOAuthService.displayName } : {}),
+    });
+});
 /**
  * Exchange the short-lived HttpOnly OAuth transfer cookie for the application's
  * normal bearer-token response. The cookie is cleared even when it is invalid.