mikser-io-drive 11.4.0 → 11.6.2

package/README.md

@@ -209,6 +209,110 @@ fall straight through.
 The `<base>/<name>` surface is unchanged and still answers on every host. This
 adds a way in; it does not move the old one.
 
+### The root authenticates, and why that keeps your password
+
+`OPTIONS /` on the drive host answers **401 with a Basic challenge** unless the
+request already authenticates. That is not a hardening pass; it is what keeps a
+Windows client's stored credential usable.
+
+The redirector builds its session against the server root before it touches the
+path. An anonymous `200` there told it the session needed nothing, so
+credentials were attached later and reactively, when the `PROPFIND` came back
+401. That attachment did not survive the session: after a reboot, or after
+WebClient's idle teardown, the redirector asked again, got the same clean 200,
+reached the same conclusion, and at the PROPFIND prompted a human instead of
+replaying Credential Manager — with the credential sitting in `cmdkey` the
+whole time, and "Remember my credentials" making no difference. Apache
+`mod_dav` inside `Require valid-user` returns 401 on OPTIONS, and reconnects
+there are silent.
+
+Nothing was being protected by the anonymous answer: a `200` says "a WebDAV
+server is here", and a `401` says the same thing plus a realm. The endpoint
+names — the part that discloses something — were gated then and are gated now.
+
+If you have a health check or monitor pointed at `/`, keep the old answer:
+
+```js
+drive({ host: 'drive.example.com', anonymousDiscovery: true, … })
+```
+
+That relaxes discovery only. `PROPFIND /` still requires credentials.
+
+### The Basic challenge follows your auth configuration
+
+The drive writes its own `WWW-Authenticate: Basic` header rather than
+delegating to the verifier — a composite verifier challenges with whichever
+member can be satisfied interactively, and where OAuth discovery is configured
+that is Bearer, which Explorer and Finder do not speak.
+
+The `charset="UTF-8"` parameter is not a decision this package makes. It reads
+`basicCharset` from the auth plugin, so a deployment sets it once:
+
+```js
+auth({ basicCharset: false })   // on by default
+```
+
+It briefly defaulted off on a theory about the Windows redirector that did not
+survive measurement. See the auth package's README.
+
+### Compliance classes at the root
+
+The root advertises `DAV: 1, 2, 3` — the same classes as the endpoints
+beneath it — and that is deliberately more than this one resource can do on
+its own.
+
+RFC 4918 §18 defines the classes per **resource**, and §18.2 wants LOCK from a
+class 2 resource. The root is a read-only listing: its `Allow` says
+`OPTIONS, PROPFIND` and means it, and §18.3 spells out the strictly honest
+header for that situation, `DAV: 1, 3`.
+
+It claims 2 anyway because the clients this package exists for read capability
+at the **root** and decide the whole mount from it — Finder refuses a
+read-write mount without class 2, which is also why `locks: 'disallow'` carries
+a warning. Understating there costs a working mount; overstating costs a 405 to
+a LOCK nothing sends, since clients lock the files they edit and those live
+under the endpoints, which support locking for real. `Allow` stays truthful, so
+a client that asks what the root itself permits gets the right answer.
+
+### When Windows cannot keep the mount
+
+Everything above gets Explorer to mount the drive. Keeping it mounted across a
+restart is a separate problem, and on a machine that has to run unattended it
+is not solvable from this side.
+
+The redirector reads saved credentials from the **Domain Password** store.
+Basic credentials cannot be persisted there — [KB 2673544][kb] documents this
+as by design, because WinHTTP cannot retrieve a saved Basic credential — so
+"remember my credentials" quietly stores nothing the reconnect can use. It
+looks like a server fault and is not one. Measured against a live endpoint,
+a reconnect sent four requests, **none** of them carrying an `Authorization`
+header, and gave up; the credential was sitting in Credential Manager the whole
+time, in the `Generic` store that `cmdkey /generic:` writes and the redirector
+never reads. Apache `mod_dav` on the same host, with the same credential,
+failed identically — which is the useful part of the measurement.
+
+So for a machine that exports documents on its own, do not mount the drive.
+Have the application write to a local folder and push that folder up:
+
+```
+wscript rclone-outbox.vbs "C:\SkinCheck" SkinCheck:Janus 120
+```
+
+[`clients/windows/rclone-outbox.vbs`](clients/windows/rclone-outbox.vbs) is
+that loop — an [rclone][rclone] `move` on an interval, run by `wscript.exe` so
+no console window appears, and started by a shortcut in `shell:startup` so it
+needs no elevation and no Scheduled Task. rclone authenticates from its own
+config on every request and has no reconnect to lose, which is the whole reason
+it works where the mount does not.
+
+This trades a drive letter for a folder, and it is worth being clear about what
+that costs: nobody browses the server from the machine any more. In exchange an
+export can no longer fail because a mount dropped, and a server that is
+unreachable delays the upload instead of losing the document.
+
+[kb]: https://support.microsoft.com/help/2673544
+[rclone]: https://rclone.org/webdav/
+
 ## What the folder is called
 
 The endpoint key is the name, and the mount reports it as `displayname`:

package/clients/windows/rclone-outbox.vbs

@@ -0,0 +1,79 @@
+' rclone-outbox.vbs - hidden, looping uploader for a mikser-io-drive endpoint.
+'
+' Windows cannot mount this drive unattended. The WebDAV redirector reads its
+' credentials from the Domain Password store and refuses to persist Basic
+' credentials there at all (KB 2673544), so a mapped drive re-prompts after
+' every restart and an export silently lands on a dead letter. Measured against
+' a live endpoint: four redirector requests during a reconnect, none of them
+' carrying an Authorization header, while rclone authenticated on its first.
+'
+' So the export never touches the network. The exporting application writes to
+' a local folder and this moves the folder's contents up, which means an export
+' cannot fail because a mount dropped, and an unreachable server only delays
+' the upload instead of losing the file.
+'
+' This is a .vbs and not a .cmd because wscript.exe runs with no console at
+' all. A .cmd on a two-minute timer flashes a window on the desktop every two
+' minutes, and on a shared machine someone eventually turns it off. The other
+' way to run a console tool quietly is a Scheduled Task, which needs elevation
+' to register in the root task folder - this needs none: put a shortcut to it
+' in shell:startup and it begins with the session.
+'
+' Usage:
+'   wscript rclone-outbox.vbs <outbox folder> <rclone remote> [interval seconds]
+'
+' For example, against an endpoint declared as `SkinCheck: { folder: ... }`:
+'   wscript rclone-outbox.vbs "C:\SkinCheck" SkinCheck:Janus 120
+
+Option Explicit
+
+Dim shell, arguments, outbox, remote, interval, rclone, logFile, command
+
+Set shell = CreateObject("WScript.Shell")
+Set arguments = WScript.Arguments
+
+If arguments.Count < 2 Then
+    WScript.Echo "usage: wscript rclone-outbox.vbs <outbox folder> <remote> [interval seconds]"
+    WScript.Quit 1
+End If
+
+outbox = arguments(0)
+remote = arguments(1)
+If arguments.Count > 2 Then
+    interval = CLng(arguments(2))
+Else
+    interval = 120
+End If
+
+rclone = shell.ExpandEnvironmentStrings("%LOCALAPPDATA%\rclone\rclone.exe")
+logFile = shell.ExpandEnvironmentStrings("%LOCALAPPDATA%\rclone\outbox.log")
+
+' move, not copy: the server is the system of record, the same as the mapped
+' drive it replaces, and it keeps the exported documents off a shared desktop.
+' It also gives whoever works at the machine a correct indicator that needs no
+' explaining - an empty outbox means everything is up, and a failing upload
+' makes files visibly pile up instead of failing where nobody looks.
+'
+' --min-age keeps a file that is still being written out of the transfer. The
+' exporting application is long finished with it by the time it ages in, and a
+' half-written document uploaded and then deleted locally is unrecoverable.
+' --ignore-times because the server reports no modification-time support
+' (rclone prints a Precision of 100 years for it), which leaves size as the
+' only thing rclone can compare. A re-export under the same name and the same
+' size - a corrected document for the same patient and date - would otherwise
+' be treated as already uploaded, skipped, and deleted locally. Measured: a
+' 3.773 MiB export was removed with "There was nothing to transfer".
+'
+' It costs nothing here. move empties the outbox, so a document is offered
+' once and uploaded once; this only removes a skip decision that cannot be
+' made safely.
+command = """" & rclone & """ move """ & outbox & """ " & remote & _
+          " --min-age 1m --ignore-times --transfers 2" & _
+          " --log-level INFO --log-file """ & logFile & """"
+
+Do
+    ' 0 hides the window; True waits for the run to finish, so a slow upload
+    ' delays the next pass instead of overlapping with it.
+    shell.Run command, 0, True
+    WScript.Sleep interval * 1000
+Loop

package/index.js

@@ -68,6 +68,22 @@ export const writeCapability = (name) => `drive:${name}:write`
  * handler (server.js), so an endpoint at `/content` would silently shadow a
  * real page at /content/ in the built site.
  */
+// Does this deployment's auth want charset="UTF-8" on the Basic challenge?
+//
+// Asked of the auth plugin rather than configured here, so the decision is
+// made once per deployment. mikser-io-auth exposes `basicCharset` and
+// defaults it ON; anything else — a bare static token, no auth at all — has
+// no opinion, and falls back to the same default rather than to silence.
+//
+// Not delegated to the verifier's own `challenge()`, which would be the
+// tidier shape: a composite verifier challenges with whichever member can be
+// satisfied interactively, and where OAuth discovery is configured that is
+// Bearer. Explorer and Finder speak Basic and nothing else, so the scheme
+// here is not negotiable — only the parameter is.
+function basicCharsetOf(auth) {
+    return auth?.basicCharset ?? true
+}
+
 export function drive(options = {}) {
     const {
         base      = '/drive',
@@ -87,6 +103,10 @@ export function drive(options = {}) {
         host,
         auth,
         realm     = 'mikser',
+        // `charset="UTF-8"` on the Basic challenge, RFC 7617 §2.1, is not a
+        // knob of this package's own: it follows whatever the auth plugin was
+        // configured with, so a deployment decides it once. See
+        // basicChallenge in mikser-io for why the default is on.
         // Nephele defaults both to 'meta-files', which writes sidecars INTO
         // the folder being served. The sidecars are filtered out of the
         // catalog now (see registerJunk above), so the remaining reason to
@@ -123,6 +143,14 @@ export function drive(options = {}) {
         // read-write mount without it.
         properties = 'emulate',
         locks      = 'emulate',
+        // Answer OPTIONS at the host root without authentication.
+        //
+        // Off, because an anonymous 200 there costs Windows its stored
+        // credential: the redirector builds its session at the root, is told
+        // it needs nothing, and re-prompts after every reboot and every idle
+        // teardown. See lib/root-listing.js. Turn it on for a deployment
+        // that wants an unauthenticated probe at `/`.
+        anonymousDiscovery = false,
     } = options
 
     return ({ runtime, onLoaded, useLogger }) => {
@@ -217,6 +245,7 @@ export function drive(options = {}) {
                     // ReadOnlyPlugin refuses every mutation regardless.
                     writeCapability: readOnly ? null : writeCapability(name),
                     realm,
+                    charset: basicCharsetOf(auth),
                     logger,
                 })
 
@@ -401,8 +430,10 @@ export function drive(options = {}) {
                                 allowRemote:   true,
                                 trustLoopback: !auth,
                                 realm,
+                                charset: basicCharsetOf(auth),
                             },
                             logger,
+                            anonymousDiscovery,
                         })(req, res, next)
                         : next()))
 

package/lib/authenticator.js

@@ -1,5 +1,5 @@
 import { UnauthorizedError, ForbiddenError } from 'nephele'
-import { authorize } from 'mikser-io'
+import { authorize, basicChallenge } from 'mikser-io'
 // The one implementation of "does this principal hold it", including the
 // `*` wildcard — checked here rather than re-derived, because two gates in
 // this file and one in mikser-io-auth each had their own `.includes` and a
@@ -39,11 +39,15 @@ export class MikserAuthenticator {
     #capability
     #writeCapability
     #realm
+    // Whether the Basic challenge carries charset="UTF-8". Follows the
+    // deployment's auth configuration rather than being decided here — see
+    // basicChallenge in mikser-io.
+    #charset
     #logger
 
     constructor({
         verifier, trustLoopback = false, allowRemote = false,
-        capability, writeCapability, realm = 'mikser', logger,
+        capability, writeCapability, realm = 'mikser', charset = false, logger,
     } = {}) {
         this.#verifier        = verifier
         this.#trustLoopback   = trustLoopback
@@ -51,6 +55,7 @@ export class MikserAuthenticator {
         this.#capability      = capability
         this.#writeCapability = writeCapability
         this.#realm           = realm
+        this.#charset         = charset
         this.#logger          = logger
     }
 
@@ -72,7 +77,8 @@ export class MikserAuthenticator {
             // challenge has to be set here — and it must offer Basic, because
             // that is the only scheme Finder and Explorer speak.
             if (outcome.status === 401) {
-                response.set('WWW-Authenticate', `Basic realm="${this.#realm}", charset="UTF-8"`)
+                response.set('WWW-Authenticate',
+                    basicChallenge({ realm: this.#realm, charset: this.#charset }))
                 throw new UnauthorizedError(outcome.error)
             }
             // 403: the credential was never the problem — the caller's origin

package/lib/root-listing.js

@@ -16,7 +16,7 @@
 // server with its own authenticator — so per-endpoint auth stays exactly where
 // it was rather than hanging off a shared root.
 
-import { authorize, hasCapability } from 'mikser-io'
+import { authorize, hasCapability, basicChallenge } from 'mikser-io'
 
 const escape = (text) => String(text)
     .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
@@ -41,31 +41,83 @@ const collection = (href, displayName) =>
  * @param {string} input.rootName  what the root collection calls itself
  * @param {object} input.auth      { verifier, allowRemote, trustLoopback, realm }
  * @param {object} input.logger
+ * @param {boolean} [input.anonymousDiscovery]  answer OPTIONS without auth
  */
-export function rootListing({ entries, rootName, auth, logger }) {
+// The OPTIONS answer itself.
+//
+// `DAV: 1, 2, 3` — the same classes the endpoints advertise, and this is a
+// deliberate compatibility choice against a literal reading of the spec, so
+// it is worth being plain about.
+//
+// RFC 4918 §18 defines the classes per RESOURCE, not per server, so a root
+// advertising less than its endpoints is not in itself incoherent. But §18.2
+// is explicit that a class 2 resource MUST support LOCK, and this collection
+// does not: its `Allow` below says OPTIONS and PROPFIND and means it. §18.3
+// even spells out the honest header for exactly this resource — `DAV: 1, 3`,
+// "all the requirements in this specification except possibly those that
+// involve locking support".
+//
+// It advertises 2 anyway, because the clients this package exists to serve
+// read capability at the ROOT and decide the whole mount from it: Finder
+// refuses a read-write mount without class 2 (the same reason `locks:
+// 'disallow'` carries a warning in index.js), and the redirector was
+// observed treating the tree as the root described it. Understating here
+// costs a working mount; overstating costs a 405 to a LOCK nothing sends,
+// because clients lock the files they edit and those live under the
+// endpoints, which support it for real.
+//
+// `Allow` stays truthful, so a client that asks what this resource permits
+// gets the right answer.
+function respondOptions(res) {
+    res.set('DAV', '1, 2, 3')
+    res.set('MS-Author-Via', 'DAV')
+    res.set('Allow', 'OPTIONS, PROPFIND')
+    // No caching of a discovery answer — the same rule as the mounts, and for
+    // the same reason: a client that cached a refusal keeps it.
+    res.set('Cache-Control', 'no-cache')
+    return res.status(200).end()
+}
+
+export function rootListing({ entries, rootName, auth, logger, anonymousDiscovery = false }) {
     return async (req, res, next) => {
         // Only the root itself. Everything below is a real endpoint mount.
         if (req.path !== '/') return next()
 
-        if (req.method === 'OPTIONS') {
-            // Answered WITHOUT authentication, on purpose: this is discovery,
-            // and it is what the redirector asks before it has credentials to
-            // offer. It discloses that a WebDAV server is here and nothing
-            // about what is in it — the listing below is the gated part.
-            //
-            // Class 1 only. This collection supports reading its own children
-            // and nothing else; the endpoints inside it advertise their own
-            // classes, including locking.
-            res.set('DAV', '1')
-            res.set('MS-Author-Via', 'DAV')
-            res.set('Allow', 'OPTIONS, PROPFIND')
-            // No caching of a discovery answer — the same rule as the mounts,
-            // and for the same reason: a client that cached a refusal keeps it.
-            res.set('Cache-Control', 'no-cache')
-            return res.status(200).end()
-        }
+        if (req.method !== 'OPTIONS' && req.method !== 'PROPFIND') return next()
 
-        if (req.method !== 'PROPFIND') return next()
+        // Both methods authenticate, and OPTIONS doing so is the fix for a
+        // Windows credential lifecycle, not a tightening for its own sake.
+        //
+        // The redirector establishes its session against the SERVER ROOT
+        // before it touches the path — the reason this root exists at all.
+        // Answering that OPTIONS with an anonymous 200 told it the session
+        // needed nothing, so credentials were attached later and reactively,
+        // when the PROPFIND 401'd. That attachment did not survive the
+        // session: after a reboot, or after WebClient's idle teardown, the
+        // redirector asked again, got the same clean 200, concluded the same
+        // thing, and at the PROPFIND prompted a human instead of replaying
+        // Credential Manager. Measured on a live Windows 11 client: the
+        // credential was in cmdkey the whole time and never sent.
+        //
+        // Apache mod_dav with the DAV location inside `Require valid-user`
+        // 401s on OPTIONS, and reconnects there are silent. That comparison
+        // is what identified this.
+        //
+        // The disclosure argument the old comment made does not survive
+        // contact: an anonymous 200 says "a WebDAV server is here", and a 401
+        // says the same thing plus a realm. Neither says anything about the
+        // contents, so nothing was being protected — while the cost was a
+        // password prompt after every reboot.
+        //
+        // RFC 4918 does not forbid it. §8.1 points the other way if anything:
+        // "Servers MUST return authorization errors in preference to other
+        // errors." And no CORS preflight is at stake, which is the one case
+        // where challenging OPTIONS would be wrong — the drive's routes are
+        // registered `cors: false`.
+        //
+        // `anonymousDiscovery: true` restores the old behaviour for a
+        // deployment that wants an unauthenticated probe at the root.
+        if (req.method === 'OPTIONS' && anonymousDiscovery) return respondOptions(res)
 
         let outcome
         try {
@@ -76,7 +128,7 @@ export function rootListing({ entries, rootName, auth, logger }) {
         } catch (err) {
             logger?.error?.('drive: verifier threw at the root — %s', err.message)
             return res.status(401)
-                .set('WWW-Authenticate', `Basic realm="${auth.realm}", charset="UTF-8"`)
+                .set('WWW-Authenticate', basicChallenge({ realm: auth.realm, charset: auth.charset }))
                 .end()
         }
 
@@ -85,12 +137,17 @@ export function rootListing({ entries, rootName, auth, logger }) {
             // and without the challenge a DAV client never prompts.
             if (outcome.status === 401) {
                 return res.status(401)
-                    .set('WWW-Authenticate', `Basic realm="${auth.realm}", charset="UTF-8"`)
+                    .set('WWW-Authenticate', basicChallenge({ realm: auth.realm, charset: auth.charset }))
                     .end()
             }
+            // Authenticated and not permitted. NEVER 401 here: a client that
+            // is told to authenticate again by credentials that already
+            // worked prompts forever.
             return res.status(403).end()
         }
 
+        if (req.method === 'OPTIONS') return respondOptions(res)
+
         // What this user may read. A `capability: null` entry is not
         // capability-scoped — no map configured, or a bare static token —
         // which passes, the same rule every other surface applies.
@@ -113,7 +170,7 @@ export function rootListing({ entries, rootName, auth, logger }) {
 
         res.status(207)
             .set('Content-Type', 'application/xml; charset=utf-8')
-            .set('DAV', '1')
+            .set('DAV', '1, 2, 3')
             .send(`<?xml version="1.0" encoding="utf-8"?>\n`
                 + `<D:multistatus xmlns:D="DAV:">\n${responses.join('\n')}\n</D:multistatus>\n`)
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mikser-io-drive",
-  "version": "11.4.0",
+  "version": "11.6.2",
   "description": "WebDAV for mikser-io. Exposes working-folder directories as WebDAV endpoints via Nephele, authenticated through mikser-io-auth's htpasswd identity — so content can be edited from Finder, Explorer or any DAV client and the build picks the change up.",
   "main": "index.js",
   "type": "module",
@@ -8,7 +8,7 @@
     "better-sqlite3": true
   },
   "scripts": {
-    "test": "node --no-warnings --test --test-reporter=spec 'test/**/*.test.js'"
+    "test": "node --no-warnings --test --test-timeout=120000 --test-reporter=spec 'test/**/*.test.js'"
   },
   "repository": {
     "type": "git",
@@ -28,7 +28,7 @@
   },
   "homepage": "https://github.com/almero-digital-marketing/mikser-io-drive#readme",
   "peerDependencies": {
-    "mikser-io": "^11.7.0",
+    "mikser-io": "^11.11.1",
     "zod": "^4.0.0"
   },
   "dependencies": {
@@ -41,7 +41,7 @@
     "bcryptjs": "^3.0.0",
     "express": "^5.2.1",
     "globby": "^15.0.0",
-    "mikser-io": "^11.7.0",
+    "mikser-io": "^11.11.1",
     "mikser-io-auth": "^11.0.1",
     "mikser-io-mcp": "^11.0.1",
     "webdav": "^5.10.0",

package/test/anonymous-discovery.test.js

@@ -0,0 +1,102 @@
+// The escape hatch for a deployment that wants an unauthenticated probe at
+// the root.
+//
+// Challenging OPTIONS is the default because an anonymous 200 there costs a
+// Windows client its stored credential — see lib/root-listing.js. But it is
+// a change to who may touch `/`, and a deployment with a health check or a
+// monitor pointed at the root should be able to keep the old answer rather
+// than being told its monitoring is wrong.
+
+import { describe, it, before, after } from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, writeFile, rm, mkdir } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import bcrypt from 'bcryptjs'
+import http from 'node:http'
+
+import { runtime } from 'mikser-io'
+import { auth } from 'mikser-io-auth'
+import { drive } from '../index.js'
+
+const HOST = 'anon.example.test'
+let server, port, dir
+
+// Raw http: the Host header is what selects the drive's domain, and fetch()
+// drops it — `Host` is forbidden in undici.
+function request(method, urlPath, headers = {}) {
+    return new Promise((resolve, reject) => {
+        const req = http.request(
+            { host: '127.0.0.1', port, path: urlPath, method, headers: { Host: HOST, ...headers } },
+            (res) => {
+                let body = ''
+                res.on('data', (chunk) => { body += chunk })
+                res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body }))
+            })
+        req.on('error', reject)
+        req.end()
+    })
+}
+
+before(async () => {
+    dir = await mkdtemp(path.join(tmpdir(), 'mikser-drive-anon-'))
+    for (const folder of ['documents', 'runtime']) {
+        await mkdir(path.join(dir, folder), { recursive: true })
+    }
+    await writeFile(path.join(dir, 'users.htpasswd'),
+        `alice:${bcrypt.hashSync('alice-pw', 10)}\n`)
+    await writeFile(path.join(dir, 'groups.htgroup'), 'editors: alice\n')
+
+    const { default: express } = await import('express')
+    const app = express()
+    runtime.options = { ...runtime.options, app, workingFolder: dir, runtimeFolder: path.join(dir, 'runtime') }
+    runtime.config = { ...runtime.config }
+    runtime.engine = { ...runtime.engine, logger: { info(){}, warn(){}, error(){}, debug(){}, trace(){}, fatal(){} } }
+
+    const identity = auth({ capabilities: { editors: ['drive:SkinCheck'] } })
+    const plugin = drive({
+        host: HOST,
+        auth: identity,
+        anonymousDiscovery: true,
+        endpoints: { SkinCheck: { folder: 'documents' } },
+    })
+
+    const load = [], loaded = []
+    const core = {
+        runtime,
+        onLoad:    (cb) => load.push(cb),
+        onLoaded:  (cb) => loaded.push(cb),
+        useLogger: () => ({ info(){}, warn(){}, error(){}, debug(){}, trace(){} }),
+    }
+    identity(core)
+    plugin(core)
+    for (const cb of load)   await cb()
+    for (const cb of loaded) await cb()
+
+    server = await new Promise(resolve => { const s = app.listen(0, () => resolve(s)) })
+    port = server.address().port
+})
+
+after(async () => {
+    server?.closeAllConnections?.()
+    await new Promise(r => server?.close(r))
+    await rm(dir, { recursive: true, force: true })
+})
+
+describe('anonymousDiscovery: true', () => {
+    it('answers OPTIONS at the root without credentials', async () => {
+        const res = await request('OPTIONS', '/')
+        assert.equal(res.status, 200)
+        assert.match(res.headers.dav ?? '', /\b1\b/)
+        assert.match(res.headers.allow ?? '', /PROPFIND/)
+    })
+
+    it('still gates the listing, which is the part that discloses anything', async () => {
+        // The flag relaxes DISCOVERY, not access. An anonymous 200 says a
+        // WebDAV server is here; the endpoint names are what a caller has to
+        // earn, and that is unchanged.
+        const res = await request('PROPFIND', '/', { depth: '1' })
+        assert.equal(res.status, 401)
+        assert.match(res.headers['www-authenticate'] ?? '', /^Basic /)
+    })
+})

package/test/derived.test.js

@@ -124,11 +124,17 @@ before(async (t) => {
         + '    ],\n'
         + '})\n')
 
+    // `detached` so this gets its own process GROUP, which is what the
+    // teardown kills. mikser under --watch --server runs render workers, and
+    // they inherit the pipes below: signalling the parent alone can leave a
+    // worker holding the write end open, which keeps THIS process's read
+    // handles alive and the test run never ends. Killing the group takes the
+    // whole tree.
     server = spawn(process.execPath, [
         path.join(dir, 'node_modules/mikser-io/app.js'),
         '--working-folder', dir, '--output-folder', 'out', '--runtime-folder', 'runtime',
         '--watch', '--server', String(PORT), '--url', `http://127.0.0.1:${PORT}`,
-    ], { cwd: dir, stdio: ['ignore', 'pipe', 'pipe'] })
+    ], { cwd: dir, stdio: ['ignore', 'pipe', 'pipe'], detached: true })
 
     // Kept so a server that never comes up says WHY. Throwing this away left
     // the failure as a bare ECONNREFUSED, which names the symptom and hides
@@ -155,6 +161,15 @@ before(async (t) => {
     await new Promise(r => setTimeout(r, 3000))
 })
 
+// Signal the whole process GROUP, not just the child.
+//
+// `detached: true` above put the server in its own group, so a negative pid
+// reaches it and everything it started. Falls back to the child alone if the
+// group is already gone, which is the ordinary case and not an error.
+function killTree(child, signal) {
+    try { process.kill(-child.pid, signal) } catch { try { child.kill(signal) } catch { /* already gone */ } }
+}
+
 after(async () => {
     // WAIT for it to die, and escalate. `kill()` only sends the signal; the
     // child's stdout/stderr are pipes we hold, so until it actually exits
@@ -167,16 +182,30 @@ after(async () => {
     // close() does not come back.
     if (server && server.exitCode === null && server.signalCode === null) {
         const exited = new Promise(resolve => server.once('exit', resolve))
-        server.kill()
+        killTree(server, 'SIGTERM')
         const inTime = await Promise.race([
             exited.then(() => true),
             new Promise(resolve => setTimeout(() => resolve(false), 5000)),
         ])
         if (!inTime) {
-            server.kill('SIGKILL')
-            await exited
+            killTree(server, 'SIGKILL')
+            // Bounded. `await exited` alone assumes the child is the only
+            // thing that can hold this up, and the whole failure being fixed
+            // here is that it is not.
+            await Promise.race([
+                exited,
+                new Promise(resolve => setTimeout(resolve, 5000)),
+            ])
         }
     }
+    // The pipes, explicitly, and this is the actual fix rather than belt and
+    // braces. A worker that inherited the write end keeps this side readable
+    // even once the server is gone, and a readable stream handle is enough to
+    // keep node alive: every test passes, nothing is left to run, and the
+    // process simply sits there. On CI that was fifteen minutes of silence
+    // ended by the job timeout and "Terminate orphan process", twice.
+    server?.stdout?.destroy()
+    server?.stderr?.destroy()
     if (dir) await rm(dir, { recursive: true, force: true })
 })
 

package/test/drive.test.js

@@ -101,8 +101,11 @@ describe('auth', () => {
     it('challenges an anonymous request with Basic, so a DAV client prompts', async () => {
         const res = await dav('PROPFIND', '/drive/content/', { headers: { depth: '0' } })
         assert.equal(res.status, 401)
-        assert.match(res.headers.get('www-authenticate'), /^Basic realm="mikser"/)
-        assert.match(res.headers.get('www-authenticate'), /charset="UTF-8"/)
+        // Exact bytes: the drive follows the deployment's auth configuration
+        // rather than hardcoding the parameter, and this fixture leaves it at
+        // the default. See basicChallenge in mikser-io.
+        assert.equal(res.headers.get('www-authenticate'),
+            'Basic realm="mikser", charset="UTF-8"')
     })
 
     it('refuses a wrong password', async () => {

package/test/root-denial.test.js

@@ -0,0 +1,93 @@
+// A caller who authenticated and is still not permitted must get 403, never
+// 401 — at OPTIONS as well as at PROPFIND.
+//
+// This is the prompt loop from the other direction, and it is why OPTIONS
+// now shares PROPFIND's authorization path rather than getting a challenge
+// of its own: telling a client to authenticate again with credentials that
+// just worked makes Explorer prompt forever. The distinction is the
+// verifier's to make — `rejectionFor` is how it refines "presented and
+// invalid" into "refreshing will not help" — so this drives the middleware
+// directly with such a verifier, which is the only way to reach that branch.
+
+import { describe, it } from 'node:test'
+import assert from 'node:assert/strict'
+
+import { rootListing } from '../lib/root-listing.js'
+
+// The middleware only touches these.
+function fakeResponse() {
+    const res = {
+        statusCode: null, headers: {}, ended: false,
+        status(code) { res.statusCode = code; return res },
+        set(name, value) { res.headers[name.toLowerCase()] = value; return res },
+        end() { res.ended = true; return res },
+        send() { res.ended = true; return res },
+    }
+    return res
+}
+
+const middleware = (verifier) => rootListing({
+    entries:  [{ name: 'SkinCheck', displayName: 'SkinCheck', capability: 'drive:SkinCheck' }],
+    rootName: 'drive',
+    auth:     { verifier, allowRemote: true, trustLoopback: false, realm: 'mikser' },
+    logger:   { debug() {}, error() {} },
+})
+
+const request = (method) => ({
+    path: '/', method, ip: '203.0.113.9',
+    get: (name) => (name.toLowerCase() === 'depth' ? '1' : undefined),
+    headers: { authorization: 'Bearer stale' },
+})
+
+// Presented a credential, rejected, and the verifier says refreshing will
+// not help.
+const insufficient = {
+    verify: async () => false,
+    rejectionFor: () => ({ status: 403, code: 'insufficient_scope' }),
+}
+// Presented a credential, rejected, no refinement — the ordinary 401.
+const invalid = { verify: async () => false }
+
+// A verifier that throws — a store that cannot be read, a hash library that
+// blew up. The root answers 401 rather than 500, because a client that can
+// retry with credentials is more use than a stack trace, and this branch has
+// its own `res.set` call that a mutation can change independently of the
+// ordinary one.
+const throwing = { verify: async () => { throw new Error('store unreadable') } }
+
+describe('when the verifier itself fails', () => {
+    for (const method of ['OPTIONS', 'PROPFIND']) {
+        it(`challenges with the configured bytes on ${method}`, async () => {
+            const res = fakeResponse()
+            await middleware(throwing)(request(method), res, () => {
+                assert.fail('the root must answer, not fall through')
+            })
+            assert.equal(res.statusCode, 401)
+            assert.equal(res.headers['www-authenticate'], 'Basic realm="mikser", charset="UTF-8"',
+                'the error path must emit what the happy path emits, not its own header')
+        })
+    }
+})
+
+describe('an authenticated caller who is not permitted', () => {
+    for (const method of ['OPTIONS', 'PROPFIND']) {
+        it(`gets 403 and no challenge on ${method}`, async () => {
+            const res = fakeResponse()
+            await middleware(insufficient)(request(method), res, () => {
+                assert.fail('the root must answer, not fall through')
+            })
+            assert.equal(res.statusCode, 403)
+            assert.equal(res.headers['www-authenticate'], undefined,
+                're-challenging credentials that already worked is an infinite prompt')
+        })
+
+        it(`still gets 401 with a challenge on ${method} when the credential is merely invalid`, async () => {
+            const res = fakeResponse()
+            await middleware(invalid)(request(method), res, () => {
+                assert.fail('the root must answer, not fall through')
+            })
+            assert.equal(res.statusCode, 401)
+            assert.match(res.headers['www-authenticate'] ?? '', /^Basic /)
+        })
+    }
+})

package/test/root-listing.test.js

@@ -140,18 +140,63 @@ describe('host in the wrong place', () => {
 })
 
 describe('the drive root on its own host', () => {
-    it('announces itself as WebDAV, which is what the redirector asks first', async () => {
-        // Answered without credentials on purpose: this is discovery, and it
-        // is what the redirector asks BEFORE it has anything to offer. It
-        // discloses that a DAV server is here and nothing about what is in it.
+    it('challenges an anonymous OPTIONS, so the session authenticates at the root', async () => {
+        // This used to answer 200 without credentials, and that is what cost
+        // Windows its stored credential. The redirector builds its session
+        // against the SERVER ROOT before it touches the path; told the root
+        // needed nothing, it established the session anonymously and attached
+        // credentials only reactively at the PROPFIND 401. That attachment did
+        // not survive a reboot or WebClient's idle teardown — the redirector
+        // asked again, got the same clean 200, and prompted a human rather
+        // than replaying Credential Manager, with the credential sitting in
+        // cmdkey the whole time.
+        //
+        // Apache mod_dav inside `Require valid-user` 401s here, and reconnects
+        // there are silent.
         const res = await request('OPTIONS', '/')
+        assert.equal(res.status, 401)
+        assert.match(res.headers['www-authenticate'] ?? '', /^Basic /,
+            'Basic is the only scheme Explorer and Finder speak')
+    })
+
+    it('announces itself as WebDAV once the request authenticates', async () => {
+        const res = await request('OPTIONS', '/', { headers: { authorization: as('alice') } })
         assert.equal(res.status, 200)
-        assert.match(res.headers.dav ?? '', /\b1\b/, 'the root must claim class 1')
         assert.match(res.headers.allow ?? '', /PROPFIND/)
+        assert.equal(res.headers['ms-author-via'], 'DAV')
         assert.equal(res.headers['cache-control'], 'no-cache',
             'a discovery answer that can be cached is one a client keeps refusing')
     })
 
+    it('advertises the same compliance classes as the endpoints beneath it', async () => {
+        // Finder refuses a read-write mount without class 2, and both it and
+        // the redirector read capability at the ROOT and decide the whole
+        // mount from it. Deliberately more than this resource can do on its
+        // own — RFC 4918 §18.2 wants LOCK from a class 2 resource and `Allow`
+        // says this one serves OPTIONS and PROPFIND. See respondOptions.
+        const res = await request('OPTIONS', '/', { headers: { authorization: as('alice') } })
+        for (const compliance of ['1', '2', '3']) {
+            assert.match(res.headers.dav ?? '', new RegExp(`\\b${compliance}\\b`),
+                `the root must claim class ${compliance}, as the endpoints do`)
+        }
+    })
+
+    it('keeps Allow truthful about what the root itself serves', async () => {
+        // The other half of advertising class 2: a client that asks what this
+        // resource permits must not be told it can LOCK here.
+        const res = await request('OPTIONS', '/', { headers: { authorization: as('alice') } })
+        assert.doesNotMatch(res.headers.allow ?? '', /LOCK/,
+            'the root is read-only and must say so')
+    })
+
+    it('answers an authenticated OPTIONS on the listing too', async () => {
+        // The 207 carries a DAV header of its own, and a client reading class
+        // from either answer must get the same story.
+        const res = await propfind({ headers: { authorization: as('alice') } })
+        assert.equal(res.status, 207)
+        assert.match(res.headers.dav ?? '', /\b2\b/)
+    })
+
     it('challenges an anonymous listing, so a DAV client prompts', async () => {
         const res = await propfind()
         assert.equal(res.status, 401)
@@ -159,6 +204,47 @@ describe('the drive root on its own host', () => {
             'Basic is the only scheme Explorer and Finder speak')
     })
 
+    it('challenges an unknown user, which is what a challenge is for', async () => {
+        const res = await request('OPTIONS', '/', { headers: { authorization: as('dave') } })
+        assert.equal(res.status, 401)
+    })
+
+    it('challenges with the exact bytes this deployment configured', async () => {
+        // Exact, because the parameter that is NOT here is the finding:
+        // `charset="UTF-8"` is advisory (RFC 7617 §2.1) and the Windows
+        // WebDAV redirector appears not to parse it — a mapped drive carrying
+        // it never reconnects from stored credentials. The root follows the
+        // auth plugin's choice rather than carrying a knob of its own, and
+        // this fixture leaves it at the default.
+        for (const method of ['OPTIONS', 'PROPFIND']) {
+            const res = await request(method, '/', { headers: { depth: '1' } })
+            assert.equal(res.status, 401, `${method} must challenge`)
+            assert.equal(res.headers['www-authenticate'], 'Basic realm="mikser", charset="UTF-8"',
+                `${method} must carry what this deployment's auth configured`)
+        }
+    })
+
+    it('accepts a bearer-carrying client at the root', async () => {
+        // rclone and curl carry a token rather than Basic. Challenging
+        // OPTIONS must not turn them away — the verifier already accepts
+        // them, and OPTIONS now goes through the same verifier PROPFIND does.
+        const listing = await propfind({ headers: { authorization: as('carol') } })
+        assert.equal(listing.status, 207, 'precondition: this principal can list')
+        const res = await request('OPTIONS', '/', { headers: { authorization: as('carol') } })
+        assert.equal(res.status, 200, 'the same credentials must satisfy OPTIONS')
+    })
+
+    it('leaves the endpoint mounts beneath it untouched', async () => {
+        // A different code path — the Nephele mounts, not this middleware —
+        // and the report asked for it to stay exactly as it was.
+        const res = await request('OPTIONS', '/SkinCheck',
+            { headers: { authorization: as('alice') } })
+        assert.equal(res.status, 200)
+        for (const compliance of ['1', '2']) {
+            assert.match(res.headers.dav ?? '', new RegExp(`\\b${compliance}\\b`))
+        }
+    })
+
     it('lists only the endpoints the user may read', async () => {
         const xml = (await propfind({ headers: { authorization: as('alice') } })).body
         assert.match(xml, /<D:href>\/SkinCheck\/<\/D:href>/, xml)