notifkit 0.1.7 → 0.1.9

package/dist/{main-CFSukWm8.mjs → main-JdOvJ70b.mjs}

@@ -1,8 +1,11 @@
-import { Bt as PreferencesSchema, C as ProjectRepository, D as WorkflowRepository, E as UserRepository, Ft as ContactChannelSchema, G as normaliseTarget, Ht as SyncTemplatesSchema, It as CreateWorkflowSchema, K as LRUCache, Kt as UpdateUserSchema, Nt as AddUserSchema, Pt as BatchAddContactsSchema, Q as metrics, T as TemplateRepository, W as getPriorityBucket, Wt as TriggerWorkflowSchema, X as StreamProducer, Xt as buildStreamEvent, Z as getMetricsRegistry, _n as readBaseConfig, ct as projectApiKeys, dt as suppressions, et as createLogger, ft as userTopicPreferences, hn as loadEnv, it as createDatabase, k as RedisClient, lt as projects, mt as workflowDefinitions, nn as STREAMS, p as verifyUnsubscribeToken, pt as users, q as globalEmitter, st as messageLogs, tn as PUBSUB_CHANNELS, ut as scheduledPayloads, w as SegmentRepository, x as ContactRepository, zt as NotifyRequestSchema } from "./src-CPMwsUCJ.mjs";
+import { $ as metrics, A as RedisClient, Bt as NotifyRequestSchema, D as UserRepository, E as TemplateRepository, Ft as BatchAddContactsSchema, G as getPriorityBucket, Gt as TriggerWorkflowSchema, It as ContactChannelSchema, J as globalEmitter, K as normaliseTarget, Lt as CreateWorkflowSchema, O as WorkflowRepository, Pt as AddUserSchema, Q as getMetricsRegistry, S as ContactRepository, T as SegmentRepository, Ut as SyncTemplatesSchema, Vt as PreferencesSchema, Z as StreamProducer, Zt as buildStreamEvent, at as createDatabase, ct as messageLogs, dt as scheduledPayloads, ft as suppressions, gn as loadEnv, ht as workflowDefinitions, lt as projectApiKeys, mt as users, nn as PUBSUB_CHANNELS, p as verifyUnsubscribeToken, pt as userTopicPreferences, q as LRUCache, qt as UpdateUserSchema, rn as STREAMS, st as deliveryOutbox, tt as createLogger, ut as projects, vn as readBaseConfig, w as ProjectRepository, x as AdminUserRepository } from "./src-CGmXRfsM.mjs";
+import { extname, isAbsolute, join, relative, resolve } from "node:path";
 import { z } from "zod";
-import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { createHash, randomBytes, randomUUID, scrypt, timingSafeEqual } from "node:crypto";
 import { and, desc, eq, gte, inArray, isNotNull, like, lt, lte, or, sql } from "drizzle-orm";
-import { createServer } from "node:http";
+import { createServer, request } from "node:http";
+import { promisify } from "node:util";
+import { createReadStream, existsSync, statSync } from "node:fs";
 //#region src/services/api/http.ts
 async function readRawBody(req) {
 	return await new Promise((resolve, reject) => {
@@ -104,7 +107,12 @@ var Router = class {
 			for (let i = 0; i < route.segments.length; i++) {
 				const seg = route.segments[i];
 				const part = parts[i];
-				if (seg.startsWith(":")) params[seg.slice(1)] = decodeURIComponent(part);
+				if (seg.startsWith(":")) try {
+					params[seg.slice(1)] = decodeURIComponent(part);
+				} catch {
+					ok = false;
+					break;
+				}
 				else if (seg !== part) {
 					ok = false;
 					break;
@@ -122,6 +130,79 @@ function split(path) {
 	return path.split("/").filter((s) => s.length > 0);
 }
 //#endregion
+//#region src/services/auth/index.ts
+const scryptAsync = promisify(scrypt);
+const DEFAULT_SESSION_TTL_SECONDS = 604800;
+const SESSION_PREFIX = "notif:session:";
+/**
+* Pre-computed dummy hash conforming to salt(16 bytes hex):hash(64 bytes hex).
+* Used during authentication failure to equalize execution time and prevent
+* user enumeration via scrypt timing side-channels.
+*/
+const DUMMY_PASSWORD_HASH = "00000000000000000000000000000000:00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000";
+/**
+* Hashes a plaintext password using crypto.scrypt with a random 16-byte salt.
+* Returns salt and hash separated by a colon.
+*/
+async function hashPassword(password) {
+	const salt = randomBytes(16).toString("hex");
+	return `${salt}:${(await scryptAsync(password, salt, 64)).toString("hex")}`;
+}
+/**
+* Verifies a plaintext password against a stored salt:hash string using constant-time comparison.
+*/
+async function verifyPassword(password, storedHash) {
+	const [salt, key] = storedHash.split(":");
+	if (!salt || !key) return false;
+	const keyBuffer = Buffer.from(key, "hex");
+	const derivedKey = await scryptAsync(password, salt, keyBuffer.length);
+	if (derivedKey.length !== keyBuffer.length) return false;
+	return timingSafeEqual(derivedKey, keyBuffer);
+}
+/**
+* Creates a secure session in Redis for an authenticated admin user.
+*/
+async function createAdminSession(redis, user, ttlSeconds = DEFAULT_SESSION_TTL_SECONDS) {
+	const token = `nk_sess_${randomBytes(32).toString("hex")}`;
+	const now = Date.now();
+	const session = {
+		token,
+		adminId: user.id,
+		email: user.email,
+		username: user.username,
+		role: user.role,
+		createdAt: now,
+		expiresAt: now + ttlSeconds * 1e3
+	};
+	await redis.set(`${SESSION_PREFIX}${token}`, JSON.stringify(session), "EX", ttlSeconds);
+	return session;
+}
+/**
+* Retrieves an admin session from Redis if valid and unexpired.
+*/
+async function getAdminSession(redis, token) {
+	if (!token || !token.startsWith("nk_sess_")) return null;
+	const raw = await redis.get(`${SESSION_PREFIX}${token}`);
+	if (!raw) return null;
+	try {
+		const session = JSON.parse(raw);
+		if (session.expiresAt <= Date.now()) {
+			await redis.del(`${SESSION_PREFIX}${token}`);
+			return null;
+		}
+		return session;
+	} catch {
+		return null;
+	}
+}
+/**
+* Revokes an active admin session.
+*/
+async function revokeAdminSession(redis, token) {
+	if (!token) return;
+	await redis.del(`${SESSION_PREFIX}${token}`);
+}
+//#endregion
 //#region src/services/api/handlers.ts
 const IngestEventSchema = z.object({
 	name: z.string().min(1),
@@ -804,43 +885,63 @@ function createHandlers(deps) {
 			DEAD_LETTER: STREAMS.DEAD_LETTER
 		};
 		const streamDepths = {};
-		for (const [key, realRedisKey] of Object.entries(streamMap)) try {
+		if (ctx.isAdmin !== false) for (const [key, realRedisKey] of Object.entries(streamMap)) try {
 			streamDepths[key] = await deps.redis.native.xlen(realRedisKey);
 		} catch {
 			streamDepths[key] = 0;
 		}
-		const totalTasksRes = await deps.db.select({ count: sql`count(distinct ${messageLogs.taskId})` }).from(messageLogs).where(eq(messageLogs.projectId, ctx.projectId));
-		const deliveredTasksRes = await deps.db.select({ count: sql`count(distinct ${messageLogs.taskId})` }).from(messageLogs).where(and(eq(messageLogs.projectId, ctx.projectId), eq(messageLogs.status, "delivered")));
-		const total = Number(totalTasksRes[0]?.count ?? 0);
-		const delivered = Number(deliveredTasksRes[0]?.count ?? 0);
+		let total = 0;
+		let delivered = 0;
+		if (ctx.projectId) {
+			const totalTasksRes = await deps.db.select({ count: sql`count(distinct ${messageLogs.taskId})` }).from(messageLogs).where(eq(messageLogs.projectId, ctx.projectId));
+			const deliveredTasksRes = await deps.db.select({ count: sql`count(distinct ${messageLogs.taskId})` }).from(messageLogs).where(and(eq(messageLogs.projectId, ctx.projectId), eq(messageLogs.status, "delivered")));
+			total = Number(totalTasksRes[0]?.count ?? 0);
+			delivered = Number(deliveredTasksRes[0]?.count ?? 0);
+		} else {
+			const totalTasksRes = await deps.db.select({ count: sql`count(distinct ${messageLogs.taskId})` }).from(messageLogs);
+			const deliveredTasksRes = await deps.db.select({ count: sql`count(distinct ${messageLogs.taskId})` }).from(messageLogs).where(eq(messageLogs.status, "delivered"));
+			total = Number(totalTasksRes[0]?.count ?? 0);
+			delivered = Number(deliveredTasksRes[0]?.count ?? 0);
+		}
+		const failed = ctx.projectId ? Math.max(0, total - delivered) : streamDepths.DEAD_LETTER || 0;
+		const successRate = total > 0 ? Number((delivered / total * 100).toFixed(2)) : 100;
 		sendJson(res, 200, {
 			streams: streamDepths,
 			deliveryStats: {
 				total,
 				delivered,
-				failed: streamDepths.DEAD_LETTER || 0,
-				successRate: total > 0 ? Number((delivered / total * 100).toFixed(2)) : 100
+				failed,
+				successRate
 			}
 		});
 	}
-	async function getDLQMessages(_req, res, _ctx) {
+	async function getDLQMessages(_req, res, ctx) {
 		try {
-			sendJson(res, 200, { messages: (await deps.redis.native.xrevrange(STREAMS.DEAD_LETTER, "+", "-", "COUNT", "50") || []).map(([id, fields]) => {
+			const allMessages = (await deps.redis.native.xrevrange(STREAMS.DEAD_LETTER, "+", "-", "COUNT", "100") || []).map(([id, fields]) => {
 				const fieldMap = {};
 				for (let i = 0; i < fields.length; i += 2) fieldMap[fields[i]] = fields[i + 1];
+				let payload = fieldMap;
+				if (fieldMap.payload) try {
+					payload = JSON.parse(fieldMap.payload);
+				} catch {
+					payload = fieldMap.payload;
+				}
 				return {
 					id,
 					eventType: fieldMap.eventType || fieldMap.event_type || "unknown",
-					payload: fieldMap.payload ? JSON.parse(fieldMap.payload) : fieldMap,
+					payload,
 					error: fieldMap.error || fieldMap.reason || "Dead letter payload",
 					timestamp: fieldMap.timestamp || (/* @__PURE__ */ new Date()).toISOString()
 				};
-			}) });
+			});
+			sendJson(res, 200, { messages: (ctx.projectId ? allMessages.filter((m) => {
+				return (m.payload?.projectId ?? m.payload?.project_id ?? m.projectId) === ctx.projectId;
+			}) : allMessages).slice(0, 50) });
 		} catch {
 			sendJson(res, 200, { messages: [] });
 		}
 	}
-	async function replayDLQMessage(req, res, _ctx) {
+	async function replayDLQMessage(req, res, ctx) {
 		const messageId = (await readJsonBody(req).catch(() => ({})))?.id;
 		if (!messageId) {
 			sendJson(res, 400, { error: "missing_message_id" });
@@ -855,6 +956,16 @@ function createHandlers(deps) {
 			const fields = rawEntries[0][1];
 			const fieldMap = {};
 			for (let i = 0; i < fields.length; i += 2) fieldMap[fields[i]] = fields[i + 1];
+			let payload = null;
+			if (fieldMap.payload) try {
+				payload = JSON.parse(fieldMap.payload);
+			} catch {}
+			if (ctx.projectId) {
+				if ((payload?.projectId ?? payload?.project_id ?? fieldMap.projectId) !== ctx.projectId) {
+					sendJson(res, 404, { error: "dlq_message_not_found" });
+					return;
+				}
+			}
 			const priority = fieldMap.priority || "normal";
 			const p = getPriorityBucket(priority);
 			const targetStream = STREAMS[`INBOUND_${p.toUpperCase()}`] || STREAMS.INBOUND_NORMAL;
@@ -877,6 +988,24 @@ function createHandlers(deps) {
 		const messageId = ctx.params.id;
 		if (!messageId) return sendJson(res, 400, { error: "missing_id" });
 		try {
+			if (ctx.projectId) {
+				const rawEntries = await deps.redis.native.xrange(STREAMS.DEAD_LETTER, messageId, messageId);
+				if (!rawEntries || rawEntries.length === 0 || !rawEntries[0]) {
+					sendJson(res, 404, { error: "dlq_message_not_found" });
+					return;
+				}
+				const fields = rawEntries[0][1];
+				const fieldMap = {};
+				for (let i = 0; i < fields.length; i += 2) fieldMap[fields[i]] = fields[i + 1];
+				let payload = null;
+				if (fieldMap.payload) try {
+					payload = JSON.parse(fieldMap.payload);
+				} catch {}
+				if ((payload?.projectId ?? payload?.project_id ?? fieldMap.projectId) !== ctx.projectId) {
+					sendJson(res, 404, { error: "dlq_message_not_found" });
+					return;
+				}
+			}
 			await deps.redis.native.xdel(STREAMS.DEAD_LETTER, messageId);
 			sendJson(res, 200, { success: true });
 		} catch (err) {
@@ -910,7 +1039,13 @@ function createHandlers(deps) {
 			id: userId
 		});
 		const contacts = await deps.contactRepo.findByUserId(ctx.projectId, userId);
-		const logs = await deps.db.select().from(messageLogs).where(eq(messageLogs.projectId, ctx.projectId)).orderBy(desc(messageLogs.timestamp)).limit(50);
+		const contactTargets = contacts.map((c) => c.target);
+		let logs = [];
+		if (contactTargets.length > 0) {
+			const outboxRows = await deps.db.select({ taskId: deliveryOutbox.taskId }).from(deliveryOutbox).where(inArray(deliveryOutbox.destination, contactTargets));
+			const taskIds = Array.from(new Set(outboxRows.map((r) => r.taskId)));
+			if (taskIds.length > 0) logs = await deps.db.select().from(messageLogs).where(and(eq(messageLogs.projectId, ctx.projectId), inArray(messageLogs.taskId, taskIds))).orderBy(desc(messageLogs.timestamp)).limit(50);
+		}
 		sendJson(res, 200, {
 			...user,
 			contacts,
@@ -1148,10 +1283,85 @@ code{background:#f4f4f5;padding:.1rem .35rem;border-radius:4px}</style>
 	async function deleteSuppression(_req, res, ctx) {
 		const { channel, target } = ctx.params;
 		if (!channel || !target) return sendJson(res, 400, { error: "missing_channel_or_target" });
-		await deps.db.delete(suppressions).where(and(eq(suppressions.projectId, ctx.projectId), eq(suppressions.channel, channel), eq(suppressions.target, normaliseTarget(decodeURIComponent(target)))));
+		await deps.db.delete(suppressions).where(and(eq(suppressions.projectId, ctx.projectId), eq(suppressions.channel, channel), eq(suppressions.target, normaliseTarget(target))));
 		sendNoContent(res);
 	}
+	async function login(req, res) {
+		if (!deps.adminUserRepo) {
+			sendJson(res, 500, {
+				error: "internal_error",
+				message: "Admin user repository not initialized"
+			});
+			return;
+		}
+		const body = await readJsonBody(req);
+		const parsed = z.object({
+			identifier: z.string().min(1, "Identifier (email or username) is required"),
+			password: z.string().min(1, "Password is required")
+		}).safeParse(body);
+		if (!parsed.success) {
+			sendValidationError(res, parsed.error);
+			return;
+		}
+		const { identifier, password } = parsed.data;
+		const user = await deps.adminUserRepo.findByEmailOrUsername(identifier);
+		const isValid = await verifyPassword(password, user ? user.passwordHash : DUMMY_PASSWORD_HASH);
+		if (!user || !isValid) {
+			sendJson(res, 401, {
+				error: "unauthorized",
+				message: "Invalid credentials"
+			});
+			return;
+		}
+		const session = await createAdminSession(deps.redis.native, user);
+		sendJson(res, 200, {
+			token: session.token,
+			user: {
+				id: user.id,
+				email: user.email,
+				username: user.username,
+				role: user.role
+			},
+			expiresAt: session.expiresAt
+		});
+	}
+	async function logout(req, res) {
+		const authHeader = req.headers["authorization"];
+		let token;
+		if (typeof authHeader === "string" && authHeader.toLowerCase().startsWith("bearer ")) token = authHeader.slice(7).trim();
+		if (token) await revokeAdminSession(deps.redis.native, token);
+		sendJson(res, 200, { message: "Logged out successfully" });
+	}
+	async function getMe(req, res) {
+		const authHeader = req.headers["authorization"];
+		let token;
+		if (typeof authHeader === "string" && authHeader.toLowerCase().startsWith("bearer ")) token = authHeader.slice(7).trim();
+		if (!token) {
+			sendJson(res, 401, {
+				error: "unauthorized",
+				message: "Missing token"
+			});
+			return;
+		}
+		const session = await getAdminSession(deps.redis.native, token);
+		if (!session) {
+			sendJson(res, 401, {
+				error: "unauthorized",
+				message: "Invalid or expired session"
+			});
+			return;
+		}
+		sendJson(res, 200, { user: {
+			id: session.adminId,
+			email: session.email,
+			username: session.username,
+			role: session.role
+		} });
+	}
 	return {
+		login,
+		logout,
+		getMe,
 		syncTemplates,
 		addUser,
 		updateUser,
@@ -1201,6 +1411,159 @@ code{background:#f4f4f5;padding:.1rem .35rem;border-radius:4px}</style>
 	};
 }
 //#endregion
+//#region src/services/api/admin-static.ts
+const MIME_TYPES = {
+	".html": "text/html; charset=utf-8",
+	".js": "application/javascript; charset=utf-8",
+	".mjs": "application/javascript; charset=utf-8",
+	".css": "text/css; charset=utf-8",
+	".json": "application/json; charset=utf-8",
+	".png": "image/png",
+	".jpg": "image/jpeg",
+	".jpeg": "image/jpeg",
+	".gif": "image/gif",
+	".svg": "image/svg+xml",
+	".ico": "image/x-icon",
+	".woff": "font/woff",
+	".woff2": "font/woff2",
+	".ttf": "font/ttf",
+	".webp": "image/webp",
+	".txt": "text/plain; charset=utf-8",
+	".map": "application/json; charset=utf-8"
+};
+const POSSIBLE_DASHBOARD_DIRS = [
+	resolve(process.cwd(), "dashboard", "dist"),
+	resolve(process.cwd(), "dashboard", "out"),
+	resolve(process.cwd(), "dist", "admin"),
+	resolve(process.cwd(), "dist", "dashboard")
+];
+function getDashboardDir() {
+	for (const dir of POSSIBLE_DASHBOARD_DIRS) if (existsSync(dir) && existsSync(join(dir, "index.html"))) return dir;
+	return null;
+}
+/**
+* Proxies request to frontend dev server if running.
+*/
+function proxyToDevServer(req, res, targetHost, targetPort) {
+	return new Promise((resolvePromise) => {
+		const proxyReq = request({
+			host: targetHost,
+			port: targetPort,
+			path: req.url,
+			method: req.method,
+			headers: req.headers
+		}, (proxyRes) => {
+			res.writeHead(proxyRes.statusCode || 200, proxyRes.headers);
+			proxyRes.pipe(res);
+			resolvePromise(true);
+		});
+		proxyReq.on("error", () => {
+			resolvePromise(false);
+		});
+		if (req.readable) req.pipe(proxyReq);
+		else proxyReq.end();
+	});
+}
+/**
+* Handles incoming HTTP requests for `/admin` and `/admin/*`.
+* Serves static exported assets from Vite SPA build with index.html fallback,
+* or proxies to Vite dev server if running in development mode.
+*/
+async function handleAdminRequest(req, res, url) {
+	if (url.pathname !== "/admin" && !url.pathname.startsWith("/admin/")) return false;
+	if (url.pathname === "/admin") {
+		res.writeHead(301, { Location: "/admin/" + (url.search || "") });
+		res.end();
+		return true;
+	}
+	if (process.env.NODE_ENV !== "production") {
+		const devProxyUrl = process.env.VITE_DEV_URL || process.env.ADMIN_DEV_URL || process.env.NEXT_DEV_URL;
+		const targetPort = devProxyUrl ? parseInt(new URL(devProxyUrl).port, 10) : 5173;
+		if (await proxyToDevServer(req, res, devProxyUrl ? new URL(devProxyUrl).hostname : "127.0.0.1", targetPort)) return true;
+	}
+	const dashboardDir = getDashboardDir();
+	if (!dashboardDir) {
+		res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+		res.end(`
+      <!DOCTYPE html>
+      <html lang="en">
+      <head>
+        <meta charset="utf-8">
+        <title>Notifkit Admin Dashboard</title>
+        <style>
+          body { font-family: system-ui, -apple-system, sans-serif; background: #09090b; color: #f4f4f5; display: flex; align-items: center; justify-content: center; height: 100vh; margin: 0; }
+          .card { background: #18181b; border: 1px solid #27272a; padding: 2rem; border-radius: 0.75rem; max-width: 500px; text-align: center; }
+          h1 { margin-top: 0; color: #fafafa; }
+          code { background: #27272a; padding: 0.2rem 0.4rem; border-radius: 0.25rem; font-family: monospace; font-size: 0.9em; }
+        </style>
+      </head>
+      <body>
+        <div class="card">
+          <h1>Notifkit Admin Dashboard</h1>
+          <p>The dashboard static bundle has not been built yet.</p>
+          <p>Please build it by running:</p>
+          <p><code>npm run build:dashboard</code></p>
+          <p>or run the dev server with <code>npm --prefix dashboard run dev</code>.</p>
+        </div>
+      </body>
+      </html>
+    `);
+		return true;
+	}
+	let subPath = url.pathname.slice(6);
+	if (subPath.startsWith("/")) subPath = subPath.slice(1);
+	if (!subPath) subPath = "index.html";
+	const normalizedSubPath = subPath.replace(/\/$/, "");
+	let filePath = resolve(dashboardDir, subPath);
+	const rel = relative(dashboardDir, filePath);
+	if (rel.startsWith("..") || isAbsolute(rel)) {
+		res.writeHead(403, { "Content-Type": "text/plain" });
+		res.end("Forbidden");
+		return true;
+	}
+	let stat = null;
+	if (existsSync(filePath)) {
+		stat = statSync(filePath);
+		if (stat.isDirectory()) {
+			filePath = join(filePath, "index.html");
+			stat = existsSync(filePath) ? statSync(filePath) : null;
+		}
+	}
+	if (!stat) {
+		const htmlPath = resolve(dashboardDir, `${normalizedSubPath}.html`);
+		if (existsSync(htmlPath)) {
+			filePath = htmlPath;
+			stat = statSync(filePath);
+		}
+	}
+	if (!stat) {
+		const dirIndexPath = resolve(dashboardDir, normalizedSubPath, "index.html");
+		if (existsSync(dirIndexPath)) {
+			filePath = dirIndexPath;
+			stat = statSync(filePath);
+		}
+	}
+	if (!stat) {
+		filePath = resolve(dashboardDir, "index.html");
+		if (existsSync(filePath)) stat = statSync(filePath);
+	}
+	if (!stat) {
+		res.writeHead(404, { "Content-Type": "text/plain" });
+		res.end("Not Found");
+		return true;
+	}
+	const ext = extname(filePath).toLowerCase();
+	const contentType = MIME_TYPES[ext] || "application/octet-stream";
+	const cacheControl = filePath.includes("_next") || ext === ".js" || ext === ".css" ? "public, max-age=31536000, immutable" : "public, max-age=0, must-revalidate";
+	res.writeHead(200, {
+		"Content-Type": contentType,
+		"Content-Length": stat.size,
+		"Cache-Control": cacheControl
+	});
+	createReadStream(filePath).pipe(res);
+	return true;
+}
+//#endregion
 //#region src/services/api/main.ts
 /** Pub/sub channel used to drop a cached API key across every API process. */
 const API_KEY_INVALIDATION_CHANNEL = "apikey.invalidated";
@@ -1223,6 +1586,19 @@ function extractAuthToken(req) {
 	const apiKeyHeader = req.headers["x-api-key"];
 	if (typeof apiKeyHeader === "string") return apiKeyHeader.trim();
 }
+/**
+* Resolves client IP address, respecting reverse proxy headers only when TRUST_PROXY is enabled.
+*/
+function getClientIp(req, trustProxy) {
+	if (trustProxy) {
+		const forwarded = req.headers["x-forwarded-for"];
+		if (typeof forwarded === "string") {
+			const first = forwarded.split(",")[0]?.trim();
+			if (first) return first;
+		}
+	}
+	return req.socket.remoteAddress || "unknown";
+}
 async function handleCreateProject(req, res) {
 	const parsed = z.object({ name: z.string().min(1) }).safeParse(await readJsonBody(req));
 	if (!parsed.success) {
@@ -1300,7 +1676,28 @@ async function handleHealth(_req, res) {
 	};
 	sendJson(res, statusCode, response);
 }
-async function handleMetrics(_req, res) {
+async function handleMetrics(req, res) {
+	const remoteIp = req.socket.remoteAddress ?? "";
+	let authorized = remoteIp === "127.0.0.1" || remoteIp === "::1" || remoteIp === "::ffff:127.0.0.1" || remoteIp === "localhost";
+	if (!authorized) {
+		const token = extractAuthToken(req);
+		if (token) {
+			if (token.startsWith("nk_sess_") && redis?.native) {
+				if (await getAdminSession(redis.native, token)) authorized = true;
+			} else if (config.ADMIN_API_KEY) {
+				const expectedBuffer = Buffer.from(config.ADMIN_API_KEY);
+				const providedBuffer = Buffer.from(token);
+				if (expectedBuffer.length === providedBuffer.length && timingSafeEqual(expectedBuffer, providedBuffer)) authorized = true;
+			}
+		}
+	}
+	if (!authorized) {
+		sendJson(res, 401, {
+			error: "unauthorized",
+			message: "Metrics endpoint requires admin credentials"
+		});
+		return;
+	}
 	const registry = getMetricsRegistry();
 	res.writeHead(200, { "Content-Type": registry.contentType });
 	res.end(await registry.metrics());
@@ -1331,6 +1728,10 @@ async function startApiServer() {
 		name: "api",
 		level: config.LOG_LEVEL
 	});
+	if (config.NODE_ENV === "production" && !config.UNSUBSCRIBE_SECRET) {
+		logger.fatal("UNSUBSCRIBE_SECRET is required in production. Without it, all unsubscribe links return 400 and opt-outs are silently dropped. Set a random string of 32+ characters and restart.");
+		process.exit(1);
+	}
 	redis = new RedisClient({
 		url: config.REDIS_URL,
 		name: "api",
@@ -1370,6 +1771,21 @@ async function startApiServer() {
 			logger
 		})
 	};
+	const adminUserRepo = new AdminUserRepository(db);
+	if (config.ADMIN_EMAIL && config.ADMIN_PASSWORD) try {
+		if (!await adminUserRepo.findByEmailOrUsername(config.ADMIN_EMAIL)) {
+			const passwordHash = await hashPassword(config.ADMIN_PASSWORD);
+			await adminUserRepo.create({
+				email: config.ADMIN_EMAIL,
+				username: config.ADMIN_USERNAME,
+				passwordHash,
+				role: "superadmin"
+			});
+			logger.info({ email: config.ADMIN_EMAIL }, "Bootstrapped initial admin user");
+		}
+	} catch (err) {
+		logger.error({ err }, "Failed to bootstrap default admin user");
+	}
 	deps = {
 		logger,
 		redis,
@@ -1380,11 +1796,12 @@ async function startApiServer() {
 		projectRepo: new ProjectRepository(db),
 		workflowRepo: new WorkflowRepository(db),
 		segmentRepo: new SegmentRepository(db),
+		adminUserRepo,
 		db
 	};
 	h = createHandlers(deps);
 	router = new Router();
-	router.put("/v1/templates", h.syncTemplates).get("/v1/templates", h.listTemplates).get("/v1/templates/:id", h.getTemplate).delete("/v1/templates/:id", h.deleteTemplate).post("/v1/users", h.addUser).get("/v1/users", h.listUsers).get("/v1/users/:id", h.getUser).get("/v1/users/:id/details", h.getUserDetails).patch("/v1/users/:id", h.updateUser).delete("/v1/users/:id", h.deleteUser).post("/v1/users/:id/contacts", h.addContact).get("/v1/users/:id/contacts", h.getUserContacts).delete("/v1/users/:id/contacts/:channel/:target", h.deleteContact).get("/v1/users/:id/preferences", h.getUserPreferences).patch("/v1/users/:id/preferences", h.updateUserPreferences).post("/v1/notify", h.notify).get("/v1/notifications/scheduled", h.getScheduledMessages).get("/v1/notifications/logs", h.getNotificationLogs).get("/v1/notifications/:taskId", h.getNotificationStatus).delete("/v1/notifications/:taskId", h.cancelNotification).get("/v1/unsubscribe", h.unsubscribePage).post("/v1/unsubscribe", h.unsubscribe).get("/v1/campaigns", h.listCampaigns).get("/v1/campaigns/:campaign/stats", h.getCampaignStats).get("/v1/suppressions", h.listSuppressions).post("/v1/suppressions", h.createSuppression).delete("/v1/suppressions/:channel/:target", h.deleteSuppression).get("/v1/system/health", h.getSystemHealth).get("/v1/system/metrics", h.getSystemMetrics).get("/v1/dlq", h.getDLQMessages).post("/v1/dlq/replay", h.replayDLQMessage).delete("/v1/dlq/:id", h.deleteDLQMessage).post("/v1/workflows", h.createWorkflow).get("/v1/workflows", h.listWorkflows).get("/v1/workflows/instances/:id", h.getWorkflow).delete("/v1/workflows/instances/:id", h.cancelWorkflow).post("/v1/workflows/trigger", h.triggerWorkflow).get("/v1/segments", h.listSegments).post("/v1/events", h.ingestEvent).get("/v1/events/stream", h.getEventsStream).get("/v1/projects", h.listProjects).post("/v1/projects", handleCreateProject).delete("/v1/projects/:id", h.deleteProject).patch("/v1/projects/:id", h.updateProject).post("/v1/projects/:id/keys", h.createProjectKey).get("/v1/projects/:id/keys", h.listProjectKeys).delete("/v1/projects/:id/keys/:keyId", h.deleteProjectKey).get("/health", handleHealth).get("/metrics", handleMetrics).get("/live", handleLive).get("/ready", handleReady);
+	router.post("/v1/auth/login", h.login).post("/v1/auth/logout", h.logout).get("/v1/auth/me", h.getMe).put("/v1/templates", h.syncTemplates).get("/v1/templates", h.listTemplates).get("/v1/templates/:id", h.getTemplate).delete("/v1/templates/:id", h.deleteTemplate).post("/v1/users", h.addUser).get("/v1/users", h.listUsers).get("/v1/users/:id", h.getUser).get("/v1/users/:id/details", h.getUserDetails).patch("/v1/users/:id", h.updateUser).delete("/v1/users/:id", h.deleteUser).post("/v1/users/:id/contacts", h.addContact).get("/v1/users/:id/contacts", h.getUserContacts).delete("/v1/users/:id/contacts/:channel/:target", h.deleteContact).get("/v1/users/:id/preferences", h.getUserPreferences).patch("/v1/users/:id/preferences", h.updateUserPreferences).post("/v1/notify", h.notify).get("/v1/notifications/scheduled", h.getScheduledMessages).get("/v1/notifications/logs", h.getNotificationLogs).get("/v1/notifications/:taskId", h.getNotificationStatus).delete("/v1/notifications/:taskId", h.cancelNotification).get("/v1/unsubscribe", h.unsubscribePage).post("/v1/unsubscribe", h.unsubscribe).get("/v1/campaigns", h.listCampaigns).get("/v1/campaigns/:campaign/stats", h.getCampaignStats).get("/v1/suppressions", h.listSuppressions).post("/v1/suppressions", h.createSuppression).delete("/v1/suppressions/:channel/:target", h.deleteSuppression).get("/v1/system/health", h.getSystemHealth).get("/v1/system/metrics", h.getSystemMetrics).get("/v1/dlq", h.getDLQMessages).post("/v1/dlq/replay", h.replayDLQMessage).delete("/v1/dlq/:id", h.deleteDLQMessage).post("/v1/workflows", h.createWorkflow).get("/v1/workflows", h.listWorkflows).get("/v1/workflows/instances/:id", h.getWorkflow).delete("/v1/workflows/instances/:id", h.cancelWorkflow).post("/v1/workflows/trigger", h.triggerWorkflow).get("/v1/segments", h.listSegments).post("/v1/events", h.ingestEvent).get("/v1/events/stream", h.getEventsStream).get("/v1/projects", h.listProjects).post("/v1/projects", handleCreateProject).delete("/v1/projects/:id", h.deleteProject).patch("/v1/projects/:id", h.updateProject).post("/v1/projects/:id/keys", h.createProjectKey).get("/v1/projects/:id/keys", h.listProjectKeys).delete("/v1/projects/:id/keys/:keyId", h.deleteProjectKey).get("/health", handleHealth).get("/metrics", handleMetrics).get("/live", handleLive).get("/ready", handleReady);
 	server = createServer((req, res) => {
 		handleRequest(req, res);
 	});
@@ -1392,7 +1809,15 @@ async function startApiServer() {
 	server.headersTimeout = 1e4;
 	server.keepAliveTimeout = 5e3;
 	async function handleRequest(req, res) {
-		res.setHeader("Access-Control-Allow-Origin", "*");
+		const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+		const origin = req.headers["origin"];
+		const allowedOrigins = (config.CORS_ORIGIN ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+		if (url.pathname.startsWith("/v1/auth/") || url.pathname === "/v1/projects" || url.pathname.startsWith("/v1/projects/") || url.pathname.startsWith("/v1/system/") || url.pathname.startsWith("/v1/dlq")) {
+			if (origin && allowedOrigins.includes(origin)) {
+				res.setHeader("Access-Control-Allow-Origin", origin);
+				res.setHeader("Vary", "Origin");
+			}
+		} else res.setHeader("Access-Control-Allow-Origin", "*");
 		res.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS");
 		res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, x-api-key, x-project-id");
 		if (req.method === "OPTIONS") {
@@ -1400,13 +1825,17 @@ async function startApiServer() {
 			res.end();
 			return;
 		}
-		const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+		if (url.pathname === "/admin" || url.pathname.startsWith("/admin/")) {
+			if (await handleAdminRequest(req, res, url)) return;
+		}
 		let projectId = void 0;
 		let projectRateLimitRpm = 600;
 		let keyRole = "admin";
+		let isAdminToken = false;
 		const isProjectManagement = url.pathname === "/v1/projects" || url.pathname.startsWith("/v1/projects/");
 		const isPublicUnsubscribe = url.pathname === "/v1/unsubscribe";
-		if (url.pathname.startsWith("/v1/") && !isProjectManagement && !isPublicUnsubscribe) {
+		const isPublicAuth = url.pathname === "/v1/auth/login";
+		if (url.pathname.startsWith("/v1/") && !isProjectManagement && !isPublicUnsubscribe && !isPublicAuth) {
 			let token = extractAuthToken(req);
 			if (!token && url.searchParams.has("token")) token = url.searchParams.get("token") || void 0;
 			if (!token) {
@@ -1416,15 +1845,21 @@ async function startApiServer() {
 				});
 				return;
 			}
-			let isAdminToken = false;
-			if (config.ADMIN_API_KEY) {
+			if (token.startsWith("nk_sess_")) {
+				const session = await getAdminSession(redis.native, token);
+				if (session) {
+					isAdminToken = true;
+					keyRole = session.role === "superadmin" ? "admin" : session.role;
+				}
+			} else if (config.ADMIN_API_KEY) {
 				const expectedBuffer = Buffer.from(config.ADMIN_API_KEY);
 				const providedBuffer = Buffer.from(token);
 				if (expectedBuffer.length === providedBuffer.length && timingSafeEqual(expectedBuffer, providedBuffer)) isAdminToken = true;
 			}
 			if (isAdminToken) {
 				const headerProjectId = req.headers["x-project-id"] || url.searchParams.get("projectId") || void 0;
-				if (!headerProjectId) {
+				const isProjectAgnostic = url.pathname.startsWith("/v1/auth/") || url.pathname.startsWith("/v1/system/") || url.pathname.startsWith("/v1/dlq");
+				if (!headerProjectId && !isProjectAgnostic) {
 					sendJson(res, 400, {
 						error: "bad_request",
 						message: "x-project-id header or projectId query param required when using admin token"
@@ -1433,7 +1868,7 @@ async function startApiServer() {
 				}
 				projectId = headerProjectId;
 				projectRateLimitRpm = 6e3;
-				keyRole = "admin";
+				if (!token.startsWith("nk_sess_")) keyRole = "admin";
 			} else {
 				const tokenHash = createHash("sha256").update(token).digest("hex");
 				const cached = authCache.get(tokenHash);
@@ -1485,7 +1920,7 @@ async function startApiServer() {
         end
         return -1
       `;
-			const rlKey = `rate-limit:api:req:${projectId}`;
+			const rlKey = `rate-limit:api:req:${projectId || "global"}`;
 			const nowMs = Date.now();
 			if (await redis.native.eval(LUA_LIMIT, 1, rlKey, nowMs, 6e4, projectRateLimitRpm, randomBytes(4).toString("hex")) === -1) {
 				if (!res.headersSent) {
@@ -1499,13 +1934,6 @@ async function startApiServer() {
 			}
 		} else if (isProjectManagement) {
 			const token = extractAuthToken(req);
-			if (!config.ADMIN_API_KEY) {
-				sendJson(res, 403, {
-					error: "forbidden",
-					message: "Project management disabled (no ADMIN_API_KEY set)"
-				});
-				return;
-			}
 			if (!token) {
 				sendJson(res, 401, {
 					error: "unauthorized",
@@ -1513,18 +1941,25 @@ async function startApiServer() {
 				});
 				return;
 			}
-			const expectedBuffer = Buffer.from(config.ADMIN_API_KEY);
-			const providedBuffer = Buffer.from(token);
-			if (expectedBuffer.length !== providedBuffer.length || !timingSafeEqual(expectedBuffer, providedBuffer)) {
+			let authorized = false;
+			if (token.startsWith("nk_sess_")) {
+				if (await getAdminSession(redis.native, token)) authorized = true;
+			} else if (config.ADMIN_API_KEY) {
+				const expectedBuffer = Buffer.from(config.ADMIN_API_KEY);
+				const providedBuffer = Buffer.from(token);
+				if (expectedBuffer.length === providedBuffer.length && timingSafeEqual(expectedBuffer, providedBuffer)) authorized = true;
+			}
+			if (!authorized) {
 				sendJson(res, 401, {
 					error: "unauthorized",
 					message: "Invalid admin token"
 				});
 				return;
 			}
+			isAdminToken = true;
 		}
 		if (isPublicUnsubscribe) {
-			const clientIp = req.headers["x-forwarded-for"]?.split(",")[0]?.trim() || req.socket.remoteAddress || "unknown";
+			const clientIp = getClientIp(req, Boolean(config.TRUST_PROXY));
 			try {
 				const key = `rate-limit:api:unsub:${clientIp}`;
 				const count = await redis.native.incr(key);
@@ -1538,6 +1973,24 @@ async function startApiServer() {
 				logger.warn({ err }, "unsubscribe rate limit unavailable — allowing request");
 			}
 		}
+		if (isPublicAuth) {
+			const clientIp = getClientIp(req, Boolean(config.TRUST_PROXY));
+			try {
+				const key = `rate-limit:api:auth:${clientIp}`;
+				const count = await redis.native.incr(key);
+				if (count === 1) await redis.native.expire(key, 60);
+				if (count > 10) {
+					res.setHeader("Retry-After", "60");
+					sendJson(res, 429, {
+						error: "too_many_requests",
+						message: "Too many login attempts. Please try again later."
+					});
+					return;
+				}
+			} catch (err) {
+				logger.warn({ err }, "auth rate limit unavailable — allowing request");
+			}
+		}
 		const route = router.match(req.method ?? "GET", url.pathname);
 		if (!route) {
 			sendJson(res, 404, { error: "not_found" });
@@ -1547,7 +2000,8 @@ async function startApiServer() {
 			params: route.params,
 			query: url.searchParams,
 			projectId,
-			role: keyRole
+			role: keyRole,
+			isAdmin: isAdminToken
 		};
 		Promise.resolve(route.handler(req, res, ctx)).catch((err) => {
 			if (err instanceof HttpError) {
@@ -1729,4 +2183,4 @@ async function stopApiServer() {
 //#endregion
 export { startApiServer, stopApiServer };
 
-//# sourceMappingURL=main-CFSukWm8.mjs.map
+//# sourceMappingURL=main-JdOvJ70b.mjs.map