nebula-notebook 0.2.45 → 0.2.46

package/node-server/dist/auth/nebula-dir.js

@@ -0,0 +1,47 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveNebulaDir = resolveNebulaDir;
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/**
+ * Directory holding Nebula's auth material (auth.json, passkeys.json).
+ * `NEBULA_AUTH_DIR` relocates it — a test seam and a way to run a throwaway
+ * server without touching the real `~/.nebula`. Resolved at call time so a
+ * process that sets the variable before first use is honored.
+ */
+function resolveNebulaDir() {
+    return process.env.NEBULA_AUTH_DIR || path.join(os.homedir(), '.nebula');
+}

package/node-server/dist/auth/passkeys.d.ts

@@ -0,0 +1,133 @@
+/**
+ * Passkeys (WebAuthn) — biometric / security-key login that AUGMENTS TOTP.
+ *
+ * A verified assertion mints the same session JWT the TOTP path mints; TOTP
+ * stays as the fallback and as the way to authenticate before enrolling the
+ * first passkey. Credentials are stored per rpID (per hostname): a passkey
+ * enrolled at `localhost` (the ssh-tunnel case) works wherever the browser
+ * reaches Nebula as `localhost`, one enrolled at a tunnel domain works there.
+ *
+ * Storage: `<nebula dir>/passkeys.json`, mode 0600, next to auth.json.
+ */
+import type { IncomingHttpHeaders } from 'http';
+import type { AuthenticatorTransportFuture, PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/server';
+export interface PasskeyCredential {
+    /** Credential ID (base64url) — also what the authenticator presents at login. */
+    id: string;
+    /** COSE public key, base64url. Never leaves the server. */
+    publicKey: string;
+    counter: number;
+    transports: AuthenticatorTransportFuture[];
+    /** Hostname the credential was enrolled at; a passkey is only offered there. */
+    rpID: string;
+    label: string;
+    createdAt: string;
+    lastUsedAt: string | null;
+}
+export interface PasskeyStore {
+    /** Stable opaque user handle (base64url) shared by every credential. */
+    userId: string | null;
+    credentials: PasskeyCredential[];
+}
+/** What clients may see: everything except the public key. */
+export interface PublicPasskey {
+    id: string;
+    rpID: string;
+    label: string;
+    createdAt: string;
+    lastUsedAt: string | null;
+}
+export declare const PASSKEYS_FILENAME = "passkeys.json";
+export declare const MAX_LABEL_LENGTH = 60;
+export declare function passkeysFilePath(): string;
+export declare function toPublicPasskey(c: PasskeyCredential): PublicPasskey;
+/** Load the store; a missing or unreadable file is an empty store. */
+export declare function loadPasskeyStore(): PasskeyStore;
+/**
+ * Persist the store, private to the user (dir 0700, file 0600) and atomically
+ * (tmp + rename) so a failed write never leaves a truncated credential list.
+ */
+export declare function savePasskeyStore(store: PasskeyStore): void;
+export type ChallengeType = 'login' | 'register';
+export declare const CHALLENGE_TTL_MS = 120000;
+/**
+ * Outstanding WebAuthn challenges: in-memory, single-use, 120 s TTL, typed
+ * (a login challenge cannot complete a registration) and bound to the rpID
+ * they were issued for. The opaque token handed to the client is the map key.
+ */
+export declare class PasskeyChallenges {
+    private readonly now;
+    private readonly ttlMs;
+    private readonly entries;
+    constructor(now?: () => number, ttlMs?: number);
+    put(type: ChallengeType, rpID: string, challenge: string): string;
+    /** Consume a challenge. Returns null (and burns the token) on any mismatch. */
+    take(token: unknown, type: ChallengeType, rpID: string): string | null;
+    get size(): number;
+    private sweep;
+}
+export interface RpInfo {
+    /** Hostname only (no port) — what the browser scopes the credential to. */
+    rpID: string;
+    /** `${proto}://${host[:port]}` as the browser will report it in clientDataJSON. */
+    origin: string;
+}
+export declare class PasskeyRpError extends Error {
+    readonly code = "invalid_rp_id";
+}
+/**
+ * Derive rpID and origin from the request's own Host (or X-Forwarded-Host).
+ * The rpID is the hostname with the port stripped; the origin keeps the port.
+ * Protocol honors X-Forwarded-Proto and otherwise defaults to https — except
+ * for localhost, which browsers treat as a secure context over plain http and
+ * which is the common case (ssh tunnel to localhost:3000).
+ *
+ * WebAuthn forbids IP-literal rpIDs, so `127.0.0.1` is rejected with advice
+ * to use `http://localhost:PORT` instead.
+ */
+export declare function deriveRpInfo(headers: IncomingHttpHeaders): RpInfo;
+export type OptionsResult<T> = {
+    ok: true;
+    token: string;
+    options: T;
+} | {
+    ok: false;
+    error: string;
+};
+export type LoginResult = {
+    ok: true;
+    credential: PasskeyCredential;
+} | {
+    ok: false;
+    error: string;
+};
+export type RegisterResult = {
+    ok: true;
+    passkey: PublicPasskey;
+} | {
+    ok: false;
+    error: string;
+};
+export declare class PasskeyService {
+    readonly challenges: PasskeyChallenges;
+    constructor(challenges?: PasskeyChallenges);
+    /** Credentials enrolled at this rpID. */
+    credentialsFor(rpID: string, store?: PasskeyStore): PasskeyCredential[];
+    /** Unauthenticated: a login challenge, or `ok:false` when nothing is enrolled here. */
+    loginOptions(rp: RpInfo): Promise<OptionsResult<PublicKeyCredentialRequestOptionsJSON>>;
+    /**
+     * Unauthenticated: verify an assertion against a stored credential. On
+     * success the counter and lastUsedAt are persisted. The caller mints the
+     * session and applies rate limiting.
+     */
+    login(rp: RpInfo, body: unknown): Promise<LoginResult>;
+    /** Authenticated: a registration challenge for this rpID. */
+    registerOptions(rp: RpInfo): Promise<OptionsResult<PublicKeyCredentialCreationOptionsJSON>>;
+    /** Authenticated: verify an attestation and store the new credential. */
+    register(rp: RpInfo, body: unknown): Promise<RegisterResult>;
+    /** Authenticated: every enrolled passkey, public fields only. */
+    list(): PublicPasskey[];
+    /** Authenticated: remove a credential by id. Returns whether one was removed. */
+    delete(id: string): boolean;
+}
+export declare const passkeyService: PasskeyService;

package/node-server/dist/auth/passkeys.js

@@ -0,0 +1,374 @@
+"use strict";
+/**
+ * Passkeys (WebAuthn) — biometric / security-key login that AUGMENTS TOTP.
+ *
+ * A verified assertion mints the same session JWT the TOTP path mints; TOTP
+ * stays as the fallback and as the way to authenticate before enrolling the
+ * first passkey. Credentials are stored per rpID (per hostname): a passkey
+ * enrolled at `localhost` (the ssh-tunnel case) works wherever the browser
+ * reaches Nebula as `localhost`, one enrolled at a tunnel domain works there.
+ *
+ * Storage: `<nebula dir>/passkeys.json`, mode 0600, next to auth.json.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.passkeyService = exports.PasskeyService = exports.PasskeyRpError = exports.PasskeyChallenges = exports.CHALLENGE_TTL_MS = exports.MAX_LABEL_LENGTH = exports.PASSKEYS_FILENAME = void 0;
+exports.passkeysFilePath = passkeysFilePath;
+exports.toPublicPasskey = toPublicPasskey;
+exports.loadPasskeyStore = loadPasskeyStore;
+exports.savePasskeyStore = savePasskeyStore;
+exports.deriveRpInfo = deriveRpInfo;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const net = __importStar(require("net"));
+const crypto_1 = require("crypto");
+const server_1 = require("@simplewebauthn/server");
+const nebula_dir_1 = require("./nebula-dir");
+exports.PASSKEYS_FILENAME = 'passkeys.json';
+exports.MAX_LABEL_LENGTH = 60;
+function passkeysFilePath() {
+    return path.join((0, nebula_dir_1.resolveNebulaDir)(), exports.PASSKEYS_FILENAME);
+}
+function toPublicPasskey(c) {
+    return { id: c.id, rpID: c.rpID, label: c.label, createdAt: c.createdAt, lastUsedAt: c.lastUsedAt ?? null };
+}
+function sanitizeCredential(raw) {
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const c = raw;
+    if (typeof c.id !== 'string' || typeof c.publicKey !== 'string' || typeof c.rpID !== 'string')
+        return null;
+    return {
+        id: c.id,
+        publicKey: c.publicKey,
+        counter: Number.isFinite(Number(c.counter)) ? Number(c.counter) : 0,
+        transports: Array.isArray(c.transports) ? c.transports.filter((t) => typeof t === 'string') : [],
+        rpID: c.rpID,
+        label: typeof c.label === 'string' ? c.label : `passkey · ${c.rpID}`,
+        createdAt: typeof c.createdAt === 'string' ? c.createdAt : new Date(0).toISOString(),
+        lastUsedAt: typeof c.lastUsedAt === 'string' ? c.lastUsedAt : null,
+    };
+}
+/** Load the store; a missing or unreadable file is an empty store. */
+function loadPasskeyStore() {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(passkeysFilePath(), 'utf8'));
+        const credentials = Array.isArray(parsed?.credentials)
+            ? parsed.credentials.map(sanitizeCredential).filter(Boolean)
+            : [];
+        return { userId: typeof parsed?.userId === 'string' ? parsed.userId : null, credentials };
+    }
+    catch {
+        return { userId: null, credentials: [] };
+    }
+}
+/**
+ * Persist the store, private to the user (dir 0700, file 0600) and atomically
+ * (tmp + rename) so a failed write never leaves a truncated credential list.
+ */
+function savePasskeyStore(store) {
+    const file = passkeysFilePath();
+    const dir = path.dirname(file);
+    if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const tmp = `${file}.${process.pid}.tmp`;
+    try {
+        fs.writeFileSync(tmp, JSON.stringify(store, null, 2), { mode: 0o600 });
+        fs.chmodSync(tmp, 0o600); // mode above is subject to umask; be explicit
+        fs.renameSync(tmp, file);
+    }
+    catch (err) {
+        try {
+            fs.unlinkSync(tmp);
+        }
+        catch { /* nothing partial to clean */ }
+        throw err;
+    }
+}
+exports.CHALLENGE_TTL_MS = 120_000;
+/**
+ * Outstanding WebAuthn challenges: in-memory, single-use, 120 s TTL, typed
+ * (a login challenge cannot complete a registration) and bound to the rpID
+ * they were issued for. The opaque token handed to the client is the map key.
+ */
+class PasskeyChallenges {
+    now;
+    ttlMs;
+    entries = new Map();
+    constructor(now = Date.now, ttlMs = exports.CHALLENGE_TTL_MS) {
+        this.now = now;
+        this.ttlMs = ttlMs;
+    }
+    put(type, rpID, challenge) {
+        this.sweep();
+        const token = (0, crypto_1.randomBytes)(16).toString('hex');
+        this.entries.set(token, { challenge, type, rpID, expiresAt: this.now() + this.ttlMs });
+        return token;
+    }
+    /** Consume a challenge. Returns null (and burns the token) on any mismatch. */
+    take(token, type, rpID) {
+        const key = typeof token === 'string' ? token : '';
+        const entry = this.entries.get(key);
+        this.entries.delete(key);
+        if (!entry || entry.type !== type || entry.rpID !== rpID || entry.expiresAt < this.now())
+            return null;
+        return entry.challenge;
+    }
+    get size() {
+        this.sweep();
+        return this.entries.size;
+    }
+    sweep() {
+        const now = this.now();
+        for (const [k, v] of this.entries) {
+            if (v.expiresAt < now)
+                this.entries.delete(k);
+        }
+    }
+}
+exports.PasskeyChallenges = PasskeyChallenges;
+class PasskeyRpError extends Error {
+    code = 'invalid_rp_id';
+}
+exports.PasskeyRpError = PasskeyRpError;
+function firstHeader(value) {
+    const raw = Array.isArray(value) ? value[0] : value;
+    return String(raw ?? '').split(',')[0].trim();
+}
+/**
+ * Derive rpID and origin from the request's own Host (or X-Forwarded-Host).
+ * The rpID is the hostname with the port stripped; the origin keeps the port.
+ * Protocol honors X-Forwarded-Proto and otherwise defaults to https — except
+ * for localhost, which browsers treat as a secure context over plain http and
+ * which is the common case (ssh tunnel to localhost:3000).
+ *
+ * WebAuthn forbids IP-literal rpIDs, so `127.0.0.1` is rejected with advice
+ * to use `http://localhost:PORT` instead.
+ */
+function deriveRpInfo(headers) {
+    const hostHeader = firstHeader(headers['x-forwarded-host']) || firstHeader(headers.host);
+    let hostname = hostHeader;
+    let port = '';
+    if (hostHeader.startsWith('[')) {
+        // IPv6 literal, e.g. [::1]:3000 — rejected below, parsed only for the message.
+        const end = hostHeader.indexOf(']');
+        hostname = end > 0 ? hostHeader.slice(1, end) : hostHeader;
+        port = end > 0 ? hostHeader.slice(end + 1).replace(/^:/, '') : '';
+    }
+    else {
+        const m = /^([^:]*)(?::(\d+))?$/.exec(hostHeader);
+        if (m) {
+            hostname = m[1];
+            port = m[2] ?? '';
+        }
+    }
+    hostname = hostname.toLowerCase() || 'localhost';
+    if (net.isIP(hostname)) {
+        const suggested = `http://localhost${port ? `:${port}` : ''}`;
+        throw new PasskeyRpError(`Passkeys cannot be used at an IP address (${hostname}) — WebAuthn requires a hostname. ` +
+            `Open ${suggested} instead of ${hostname}.`);
+    }
+    const isLocal = hostname === 'localhost' || hostname.endsWith('.localhost');
+    const forwardedProto = firstHeader(headers['x-forwarded-proto']).toLowerCase();
+    const proto = forwardedProto === 'http' || forwardedProto === 'https' ? forwardedProto : (isLocal ? 'http' : 'https');
+    const defaultPort = proto === 'https' ? '443' : '80';
+    const originHost = port && port !== defaultPort ? `${hostname}:${port}` : hostname;
+    return { rpID: hostname, origin: `${proto}://${originHost}` };
+}
+const RP_NAME = 'Nebula Notebook';
+const USER_NAME = 'nebula';
+function asObject(body) {
+    return body && typeof body === 'object' ? body : {};
+}
+class PasskeyService {
+    challenges;
+    constructor(challenges = new PasskeyChallenges()) {
+        this.challenges = challenges;
+    }
+    /** Credentials enrolled at this rpID. */
+    credentialsFor(rpID, store = loadPasskeyStore()) {
+        return store.credentials.filter((c) => c.rpID === rpID);
+    }
+    /** Unauthenticated: a login challenge, or `ok:false` when nothing is enrolled here. */
+    async loginOptions(rp) {
+        const creds = this.credentialsFor(rp.rpID);
+        if (creds.length === 0) {
+            return { ok: false, error: `No passkeys enrolled for ${rp.rpID}` };
+        }
+        const options = await (0, server_1.generateAuthenticationOptions)({
+            rpID: rp.rpID,
+            userVerification: 'preferred',
+            allowCredentials: creds.map((c) => ({
+                id: c.id,
+                transports: c.transports.length ? c.transports : undefined,
+            })),
+        });
+        return { ok: true, token: this.challenges.put('login', rp.rpID, options.challenge), options };
+    }
+    /**
+     * Unauthenticated: verify an assertion against a stored credential. On
+     * success the counter and lastUsedAt are persisted. The caller mints the
+     * session and applies rate limiting.
+     */
+    async login(rp, body) {
+        const { token, response } = asObject(body);
+        const challenge = this.challenges.take(token, 'login', rp.rpID);
+        const assertion = response;
+        const store = loadPasskeyStore();
+        const cred = assertion?.id
+            ? store.credentials.find((c) => c.id === assertion.id && c.rpID === rp.rpID)
+            : undefined;
+        if (!challenge || !cred) {
+            return { ok: false, error: 'Passkey not recognized' };
+        }
+        let verified = false;
+        let newCounter = cred.counter;
+        try {
+            const verification = await (0, server_1.verifyAuthenticationResponse)({
+                response: assertion,
+                expectedChallenge: challenge,
+                expectedOrigin: rp.origin,
+                expectedRPID: rp.rpID,
+                credential: {
+                    id: cred.id,
+                    publicKey: new Uint8Array(Buffer.from(cred.publicKey, 'base64url')),
+                    counter: cred.counter,
+                    transports: cred.transports,
+                },
+                requireUserVerification: false,
+            });
+            verified = verification.verified;
+            newCounter = verification.authenticationInfo?.newCounter ?? cred.counter;
+        }
+        catch {
+            verified = false;
+        }
+        if (!verified) {
+            return { ok: false, error: 'Passkey verification failed' };
+        }
+        cred.counter = newCounter;
+        cred.lastUsedAt = new Date().toISOString();
+        savePasskeyStore(store);
+        return { ok: true, credential: cred };
+    }
+    /** Authenticated: a registration challenge for this rpID. */
+    async registerOptions(rp) {
+        const store = loadPasskeyStore();
+        if (!store.userId) {
+            store.userId = (0, crypto_1.randomBytes)(16).toString('base64url');
+            savePasskeyStore(store); // the user handle must survive restarts
+        }
+        const options = await (0, server_1.generateRegistrationOptions)({
+            rpName: RP_NAME,
+            rpID: rp.rpID,
+            userID: new Uint8Array(Buffer.from(store.userId, 'base64url')),
+            userName: USER_NAME,
+            userDisplayName: `Nebula @ ${rp.rpID}`,
+            attestationType: 'none',
+            excludeCredentials: this.credentialsFor(rp.rpID, store).map((c) => ({
+                id: c.id,
+                transports: c.transports.length ? c.transports : undefined,
+            })),
+            authenticatorSelection: { residentKey: 'preferred', userVerification: 'preferred' },
+        });
+        return { ok: true, token: this.challenges.put('register', rp.rpID, options.challenge), options };
+    }
+    /** Authenticated: verify an attestation and store the new credential. */
+    async register(rp, body) {
+        const { token, response, label } = asObject(body);
+        const challenge = this.challenges.take(token, 'register', rp.rpID);
+        if (!challenge) {
+            return { ok: false, error: 'Challenge expired — try again' };
+        }
+        const attestation = response;
+        if (!attestation?.id) {
+            return { ok: false, error: 'Missing attestation response' };
+        }
+        let registered;
+        try {
+            const verification = await (0, server_1.verifyRegistrationResponse)({
+                response: attestation,
+                expectedChallenge: challenge,
+                expectedOrigin: rp.origin,
+                expectedRPID: rp.rpID,
+                requireUserVerification: false,
+            });
+            registered = verification.verified ? verification.registrationInfo?.credential : undefined;
+        }
+        catch {
+            registered = undefined;
+        }
+        if (!registered) {
+            return { ok: false, error: 'Attestation verification failed' };
+        }
+        const store = loadPasskeyStore();
+        const existing = store.credentials.find((c) => c.id === registered.id);
+        if (existing) {
+            return { ok: true, passkey: toPublicPasskey(existing) };
+        }
+        const cleanLabel = typeof label === 'string' ? label.trim().slice(0, exports.MAX_LABEL_LENGTH) : '';
+        const cred = {
+            id: registered.id,
+            publicKey: Buffer.from(registered.publicKey).toString('base64url'),
+            counter: Number(registered.counter) || 0,
+            transports: registered.transports ?? attestation.response?.transports ?? [],
+            rpID: rp.rpID,
+            label: cleanLabel || `passkey · ${rp.rpID}`,
+            createdAt: new Date().toISOString(),
+            lastUsedAt: null,
+        };
+        store.credentials.push(cred);
+        savePasskeyStore(store);
+        console.log(`[Auth] Passkey enrolled for ${rp.rpID} (${store.credentials.length} total)`);
+        return { ok: true, passkey: toPublicPasskey(cred) };
+    }
+    /** Authenticated: every enrolled passkey, public fields only. */
+    list() {
+        return loadPasskeyStore().credentials.map(toPublicPasskey);
+    }
+    /** Authenticated: remove a credential by id. Returns whether one was removed. */
+    delete(id) {
+        const store = loadPasskeyStore();
+        const before = store.credentials.length;
+        store.credentials = store.credentials.filter((c) => c.id !== id);
+        if (store.credentials.length === before)
+            return false;
+        savePasskeyStore(store);
+        console.log(`[Auth] Passkey removed (${store.credentials.length} remaining)`);
+        return true;
+    }
+}
+exports.PasskeyService = PasskeyService;
+exports.passkeyService = new PasskeyService();

package/node-server/dist/index.js

@@ -81,6 +81,7 @@ const mock_scheduler_1 = require("./scheduler/mock-scheduler");
 const arch_1 = require("./scheduler/arch");
 // Import auth
 const auth_2 = require("./auth");
+const auth_middleware_1 = require("./auth/auth-middleware");
 const fs_service_1 = require("./fs/fs-service");
 const update_check_1 = require("./update-check");
 const environment_1 = require("./environment");
@@ -357,20 +358,16 @@ async function createApp() {
         }
         return reply.send({ status: 'ready' });
     });
-    // Auth routes (public - no auth required)
+    // Auth routes. Login endpoints are public; passkey management
+    // (enroll/list/delete) lives under the same prefix but needs a session.
     await fastify.register(auth_1.default, { prefix: '/api' });
     // Auth middleware - protect all other API routes
-    // Applied as an onRequest hook for /api/* routes (excluding public ones)
+    // Applied as an onRequest hook for /api/* routes (excluding public ones).
+    // The public list (health, ready, TOTP + passkey login) and the non-API
+    // static paths are decided in one place: isPublicRoute().
     fastify.addHook('onRequest', async (request, reply) => {
         const pathname = request.url.split('?')[0];
-        // Skip health, ready, and auth routes (they are public)
-        if (pathname === '/api/health' ||
-            pathname === '/api/ready' ||
-            pathname.startsWith('/api/auth/')) {
-            return;
-        }
-        // Skip non-API routes (static files etc)
-        if (!pathname.startsWith('/api/')) {
+        if ((0, auth_middleware_1.isPublicRoute)(pathname)) {
             return;
         }
         // Apply auth middleware

package/node-server/dist/routes/auth.d.ts

@@ -1,5 +1,16 @@
 /**
- * Auth Routes - API endpoints for 2FA authentication
+ * Auth Routes - API endpoints for 2FA (TOTP) and passkey (WebAuthn) login
+ *
+ * Public (no session required): /auth/status, /auth/verify,
+ * /auth/passkeys/login-options, /auth/passkeys/login.
+ * Everything else under /auth/passkeys requires a valid session — the auth
+ * middleware enforces that (see PUBLIC_ROUTES in auth-middleware.ts).
  */
 import { FastifyInstance } from 'fastify';
+/**
+ * Session length flag. Absent → long (30-day) session; only an explicit
+ * `false` (or "false"/0) asks for the 24 h one. Accepts both the historical
+ * `trustBrowser` key the UI sends and the shorter `trusted`.
+ */
+export declare function parseTrusted(body: unknown): boolean;
 export default function authRoutes(fastify: FastifyInstance): Promise<void>;