ocean-brain 0.7.4 → 0.7.5

package/server/dist/modules/rate-limit.js

@@ -1,5 +1,6 @@
 import { rateLimit } from "express-rate-limit";
 const AUTH_RATE_LIMIT_MESSAGE = "Too many authentication attempts. Please try again later.";
+const SESSION_ACCESS_RATE_LIMIT_MESSAGE = "Too many authenticated requests. Please try again later.";
 const createAuthAttemptRateLimit = () => rateLimit({
   windowMs: 15 * 60 * 1e3,
   limit: 10,
@@ -12,7 +13,20 @@ const createAuthAttemptRateLimit = () => rateLimit({
     });
   }
 });
+const createSessionAccessRateLimit = () => rateLimit({
+  windowMs: 60 * 1e3,
+  limit: 300,
+  standardHeaders: true,
+  legacyHeaders: false,
+  handler: (_req, res) => {
+    res.status(429).json({
+      code: "SESSION_RATE_LIMITED",
+      message: SESSION_ACCESS_RATE_LIMIT_MESSAGE
+    });
+  }
+});
 export {
-  createAuthAttemptRateLimit
+  createAuthAttemptRateLimit,
+  createSessionAccessRateLimit
 };
 //# sourceMappingURL=rate-limit.js.map

package/server/dist/modules/rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/modules/rate-limit.ts"],"sourcesContent":["import { rateLimit } from 'express-rate-limit';\n\nconst AUTH_RATE_LIMIT_MESSAGE = 'Too many authentication attempts. Please try again later.';\n\nexport const createAuthAttemptRateLimit = () =>\n    rateLimit({\n        windowMs: 15 * 60 * 1000,\n        limit: 10,\n        standardHeaders: true,\n        legacyHeaders: false,\n        handler: (_req, res) => {\n            res.status(429).json({\n                code: 'AUTH_RATE_LIMITED',\n                message: AUTH_RATE_LIMIT_MESSAGE,\n            });\n        },\n    });\n"],"mappings":"AAAA,SAAS,iBAAiB;AAE1B,MAAM,0BAA0B;AAEzB,MAAM,6BAA6B,MACtC,UAAU;AAAA,EACN,UAAU,KAAK,KAAK;AAAA,EACpB,OAAO;AAAA,EACP,iBAAiB;AAAA,EACjB,eAAe;AAAA,EACf,SAAS,CAAC,MAAM,QAAQ;AACpB,QAAI,OAAO,GAAG,EAAE,KAAK;AAAA,MACjB,MAAM;AAAA,MACN,SAAS;AAAA,IACb,CAAC;AAAA,EACL;AACJ,CAAC;","names":[]}
+{"version":3,"sources":["../../src/modules/rate-limit.ts"],"sourcesContent":["import { rateLimit } from 'express-rate-limit';\n\nconst AUTH_RATE_LIMIT_MESSAGE = 'Too many authentication attempts. Please try again later.';\nconst SESSION_ACCESS_RATE_LIMIT_MESSAGE = 'Too many authenticated requests. Please try again later.';\n\nexport const createAuthAttemptRateLimit = () =>\n    rateLimit({\n        windowMs: 15 * 60 * 1000,\n        limit: 10,\n        standardHeaders: true,\n        legacyHeaders: false,\n        handler: (_req, res) => {\n            res.status(429).json({\n                code: 'AUTH_RATE_LIMITED',\n                message: AUTH_RATE_LIMIT_MESSAGE,\n            });\n        },\n    });\n\nexport const createSessionAccessRateLimit = () =>\n    rateLimit({\n        windowMs: 60 * 1000,\n        limit: 300,\n        standardHeaders: true,\n        legacyHeaders: false,\n        handler: (_req, res) => {\n            res.status(429).json({\n                code: 'SESSION_RATE_LIMITED',\n                message: SESSION_ACCESS_RATE_LIMIT_MESSAGE,\n            });\n        },\n    });\n"],"mappings":"AAAA,SAAS,iBAAiB;AAE1B,MAAM,0BAA0B;AAChC,MAAM,oCAAoC;AAEnC,MAAM,6BAA6B,MACtC,UAAU;AAAA,EACN,UAAU,KAAK,KAAK;AAAA,EACpB,OAAO;AAAA,EACP,iBAAiB;AAAA,EACjB,eAAe;AAAA,EACf,SAAS,CAAC,MAAM,QAAQ;AACpB,QAAI,OAAO,GAAG,EAAE,KAAK;AAAA,MACjB,MAAM;AAAA,MACN,SAAS;AAAA,IACb,CAAC;AAAA,EACL;AACJ,CAAC;AAEE,MAAM,+BAA+B,MACxC,UAAU;AAAA,EACN,UAAU,KAAK;AAAA,EACf,OAAO;AAAA,EACP,iBAAiB;AAAA,EACjB,eAAe;AAAA,EACf,SAAS,CAAC,MAAM,QAAQ;AACpB,QAAI,OAAO,GAAG,EAAE,KAAK;AAAA,MACjB,MAAM;AAAA,MACN,SAAS;AAAA,IACb,CAAC;AAAA,EACL;AACJ,CAAC;","names":[]}

package/server/dist/modules/server-events-handler.js

@@ -1,5 +1,16 @@
 import { serializeServerEvent, subscribeServerEvents } from "./server-events.js";
+import { AUTH_SESSION_IDLE_TIMEOUT_MS } from "./session-store.js";
 const KEEP_ALIVE_INTERVAL_MS = 3e4;
+const getEventStreamLifetimeMs = (expires) => {
+  if (!expires) {
+    return AUTH_SESSION_IDLE_TIMEOUT_MS;
+  }
+  const expiresAt = expires instanceof Date ? expires : new Date(expires);
+  if (Number.isNaN(expiresAt.getTime())) {
+    return AUTH_SESSION_IDLE_TIMEOUT_MS;
+  }
+  return Math.max(0, Math.min(expiresAt.getTime() - Date.now(), AUTH_SESSION_IDLE_TIMEOUT_MS));
+};
 const createServerEventsHandler = () => {
   return async (req, res) => {
     res.status(200);
@@ -15,6 +26,11 @@ const createServerEventsHandler = () => {
     const keepAliveTimer = setInterval(() => {
       res.write(": keepalive\n\n");
     }, KEEP_ALIVE_INTERVAL_MS);
+    keepAliveTimer.unref?.();
+    const sessionExpiryTimer = setTimeout(() => {
+      res.end();
+    }, getEventStreamLifetimeMs(req.session?.cookie.expires));
+    sessionExpiryTimer.unref?.();
     let cleanedUp = false;
     const cleanup = () => {
       if (cleanedUp) {
@@ -22,6 +38,7 @@ const createServerEventsHandler = () => {
       }
       cleanedUp = true;
       clearInterval(keepAliveTimer);
+      clearTimeout(sessionExpiryTimer);
       unsubscribe();
     };
     req.on("close", cleanup);

package/server/dist/modules/server-events-handler.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/modules/server-events-handler.ts"],"sourcesContent":["import type { Controller } from '~/types/index.js';\nimport { serializeServerEvent, subscribeServerEvents } from './server-events.js';\n\nconst KEEP_ALIVE_INTERVAL_MS = 30_000;\n\nexport const createServerEventsHandler = (): Controller => {\n    return async (req, res) => {\n        res.status(200);\n        res.setHeader('Content-Type', 'text/event-stream; charset=utf-8');\n        res.setHeader('Cache-Control', 'no-cache, no-transform');\n        res.setHeader('Connection', 'keep-alive');\n        res.setHeader('X-Accel-Buffering', 'no');\n        res.flushHeaders?.();\n        res.write(': connected\\n\\n');\n\n        const unsubscribe = subscribeServerEvents((event) => {\n            res.write(serializeServerEvent(event));\n        });\n\n        const keepAliveTimer = setInterval(() => {\n            res.write(': keepalive\\n\\n');\n        }, KEEP_ALIVE_INTERVAL_MS);\n\n        let cleanedUp = false;\n\n        const cleanup = () => {\n            if (cleanedUp) {\n                return;\n            }\n\n            cleanedUp = true;\n            clearInterval(keepAliveTimer);\n            unsubscribe();\n        };\n\n        req.on('close', cleanup);\n        res.on('close', cleanup);\n    };\n};\n"],"mappings":"AACA,SAAS,sBAAsB,6BAA6B;AAE5D,MAAM,yBAAyB;AAExB,MAAM,4BAA4B,MAAkB;AACvD,SAAO,OAAO,KAAK,QAAQ;AACvB,QAAI,OAAO,GAAG;AACd,QAAI,UAAU,gBAAgB,kCAAkC;AAChE,QAAI,UAAU,iBAAiB,wBAAwB;AACvD,QAAI,UAAU,cAAc,YAAY;AACxC,QAAI,UAAU,qBAAqB,IAAI;AACvC,QAAI,eAAe;AACnB,QAAI,MAAM,iBAAiB;AAE3B,UAAM,cAAc,sBAAsB,CAAC,UAAU;AACjD,UAAI,MAAM,qBAAqB,KAAK,CAAC;AAAA,IACzC,CAAC;AAED,UAAM,iBAAiB,YAAY,MAAM;AACrC,UAAI,MAAM,iBAAiB;AAAA,IAC/B,GAAG,sBAAsB;AAEzB,QAAI,YAAY;AAEhB,UAAM,UAAU,MAAM;AAClB,UAAI,WAAW;AACX;AAAA,MACJ;AAEA,kBAAY;AACZ,oBAAc,cAAc;AAC5B,kBAAY;AAAA,IAChB;AAEA,QAAI,GAAG,SAAS,OAAO;AACvB,QAAI,GAAG,SAAS,OAAO;AAAA,EAC3B;AACJ;","names":[]}
+{"version":3,"sources":["../../src/modules/server-events-handler.ts"],"sourcesContent":["import type { Controller } from '~/types/index.js';\nimport { serializeServerEvent, subscribeServerEvents } from './server-events.js';\nimport { AUTH_SESSION_IDLE_TIMEOUT_MS } from './session-store.js';\n\nconst KEEP_ALIVE_INTERVAL_MS = 30_000;\n\nconst getEventStreamLifetimeMs = (expires?: Date | string | null) => {\n    if (!expires) {\n        return AUTH_SESSION_IDLE_TIMEOUT_MS;\n    }\n\n    const expiresAt = expires instanceof Date ? expires : new Date(expires);\n\n    if (Number.isNaN(expiresAt.getTime())) {\n        return AUTH_SESSION_IDLE_TIMEOUT_MS;\n    }\n\n    return Math.max(0, Math.min(expiresAt.getTime() - Date.now(), AUTH_SESSION_IDLE_TIMEOUT_MS));\n};\n\nexport const createServerEventsHandler = (): Controller => {\n    return async (req, res) => {\n        res.status(200);\n        res.setHeader('Content-Type', 'text/event-stream; charset=utf-8');\n        res.setHeader('Cache-Control', 'no-cache, no-transform');\n        res.setHeader('Connection', 'keep-alive');\n        res.setHeader('X-Accel-Buffering', 'no');\n        res.flushHeaders?.();\n        res.write(': connected\\n\\n');\n\n        const unsubscribe = subscribeServerEvents((event) => {\n            res.write(serializeServerEvent(event));\n        });\n\n        const keepAliveTimer = setInterval(() => {\n            res.write(': keepalive\\n\\n');\n        }, KEEP_ALIVE_INTERVAL_MS);\n        keepAliveTimer.unref?.();\n\n        const sessionExpiryTimer = setTimeout(() => {\n            res.end();\n        }, getEventStreamLifetimeMs(req.session?.cookie.expires));\n        sessionExpiryTimer.unref?.();\n\n        let cleanedUp = false;\n\n        const cleanup = () => {\n            if (cleanedUp) {\n                return;\n            }\n\n            cleanedUp = true;\n            clearInterval(keepAliveTimer);\n            clearTimeout(sessionExpiryTimer);\n            unsubscribe();\n        };\n\n        req.on('close', cleanup);\n        res.on('close', cleanup);\n    };\n};\n"],"mappings":"AACA,SAAS,sBAAsB,6BAA6B;AAC5D,SAAS,oCAAoC;AAE7C,MAAM,yBAAyB;AAE/B,MAAM,2BAA2B,CAAC,YAAmC;AACjE,MAAI,CAAC,SAAS;AACV,WAAO;AAAA,EACX;AAEA,QAAM,YAAY,mBAAmB,OAAO,UAAU,IAAI,KAAK,OAAO;AAEtE,MAAI,OAAO,MAAM,UAAU,QAAQ,CAAC,GAAG;AACnC,WAAO;AAAA,EACX;AAEA,SAAO,KAAK,IAAI,GAAG,KAAK,IAAI,UAAU,QAAQ,IAAI,KAAK,IAAI,GAAG,4BAA4B,CAAC;AAC/F;AAEO,MAAM,4BAA4B,MAAkB;AACvD,SAAO,OAAO,KAAK,QAAQ;AACvB,QAAI,OAAO,GAAG;AACd,QAAI,UAAU,gBAAgB,kCAAkC;AAChE,QAAI,UAAU,iBAAiB,wBAAwB;AACvD,QAAI,UAAU,cAAc,YAAY;AACxC,QAAI,UAAU,qBAAqB,IAAI;AACvC,QAAI,eAAe;AACnB,QAAI,MAAM,iBAAiB;AAE3B,UAAM,cAAc,sBAAsB,CAAC,UAAU;AACjD,UAAI,MAAM,qBAAqB,KAAK,CAAC;AAAA,IACzC,CAAC;AAED,UAAM,iBAAiB,YAAY,MAAM;AACrC,UAAI,MAAM,iBAAiB;AAAA,IAC/B,GAAG,sBAAsB;AACzB,mBAAe,QAAQ;AAEvB,UAAM,qBAAqB,WAAW,MAAM;AACxC,UAAI,IAAI;AAAA,IACZ,GAAG,yBAAyB,IAAI,SAAS,OAAO,OAAO,CAAC;AACxD,uBAAmB,QAAQ;AAE3B,QAAI,YAAY;AAEhB,UAAM,UAAU,MAAM;AAClB,UAAI,WAAW;AACX;AAAA,MACJ;AAEA,kBAAY;AACZ,oBAAc,cAAc;AAC5B,mBAAa,kBAAkB;AAC/B,kBAAY;AAAA,IAChB;AAEA,QAAI,GAAG,SAAS,OAAO;AACvB,QAAI,GAAG,SAAS,OAAO;AAAA,EAC3B;AACJ;","names":[]}

package/server/dist/modules/session-store.js

@@ -0,0 +1,149 @@
+import session from "express-session";
+const AUTH_SESSION_IDLE_TIMEOUT_MS = 7 * 24 * 60 * 60 * 1e3;
+const ANONYMOUS_SESSION_IDLE_TIMEOUT_MS = 30 * 60 * 1e3;
+const AUTH_SESSION_PRUNE_INTERVAL_MS = 60 * 60 * 1e3;
+const DEFAULT_MAX_SESSIONS = 1e3;
+const serializeSession = (data) => JSON.stringify(data);
+const deserializeSession = (data) => {
+  const parsed = JSON.parse(data);
+  const expires = parsed.cookie?.expires;
+  if (typeof expires === "string") {
+    parsed.cookie.expires = new Date(expires);
+  }
+  return parsed;
+};
+const isAuthenticatedSession = (data) => Boolean(data.authenticated);
+const getSessionExpiry = (data, now = Date.now()) => {
+  const expires = data.cookie?.expires;
+  const ttlMs = isAuthenticatedSession(data) ? AUTH_SESSION_IDLE_TIMEOUT_MS : ANONYMOUS_SESSION_IDLE_TIMEOUT_MS;
+  const fallbackExpiresAt = now + ttlMs;
+  if (expires) {
+    const expiresAt = expires instanceof Date ? expires : new Date(expires);
+    if (!Number.isNaN(expiresAt.getTime())) {
+      return Math.min(expiresAt.getTime(), fallbackExpiresAt);
+    }
+  }
+  return fallbackExpiresAt;
+};
+class TtlMemorySessionStore extends session.Store {
+  constructor(options = {}) {
+    super();
+    this.options = options;
+    this.pruneTimer = setInterval(() => {
+      this.pruneExpiredSessions();
+    }, options.pruneIntervalMs ?? AUTH_SESSION_PRUNE_INTERVAL_MS);
+    this.pruneTimer.unref?.();
+  }
+  options;
+  sessions = /* @__PURE__ */ new Map();
+  pruneTimer;
+  get(sid, callback) {
+    try {
+      const entry = this.sessions.get(sid);
+      if (!entry) {
+        callback(null, null);
+        return;
+      }
+      if (entry.expiresAt <= Date.now()) {
+        this.sessions.delete(sid);
+        callback(null, null);
+        return;
+      }
+      callback(null, deserializeSession(entry.data));
+    } catch (error) {
+      callback(error);
+    }
+  }
+  set(sid, data, callback) {
+    try {
+      const now = Date.now();
+      this.sessions.set(sid, {
+        data: serializeSession(data),
+        expiresAt: getSessionExpiry(data, now),
+        authenticated: isAuthenticatedSession(data),
+        updatedAt: now
+      });
+      this.pruneExpiredSessions();
+      this.evictOldestSessions();
+      callback?.();
+    } catch (error) {
+      callback?.(error);
+    }
+  }
+  destroy(sid, callback) {
+    this.sessions.delete(sid);
+    callback?.();
+  }
+  touch(sid, data, callback) {
+    const entry = this.sessions.get(sid);
+    if (entry) {
+      const now = Date.now();
+      this.sessions.set(sid, {
+        data: serializeSession(data),
+        expiresAt: getSessionExpiry(data, now),
+        authenticated: isAuthenticatedSession(data),
+        updatedAt: now
+      });
+    }
+    callback?.();
+  }
+  all(callback) {
+    try {
+      this.pruneExpiredSessions();
+      const sessions = {};
+      for (const [sid, entry] of this.sessions) {
+        sessions[sid] = deserializeSession(entry.data);
+      }
+      callback(null, sessions);
+    } catch (error) {
+      callback(error);
+    }
+  }
+  length(callback) {
+    this.pruneExpiredSessions();
+    callback(null, this.sessions.size);
+  }
+  clear(callback) {
+    this.sessions.clear();
+    callback?.();
+  }
+  pruneExpiredSessions(now = Date.now()) {
+    for (const [sid, entry] of this.sessions) {
+      if (entry.expiresAt <= now) {
+        this.sessions.delete(sid);
+      }
+    }
+  }
+  stopPruning() {
+    clearInterval(this.pruneTimer);
+  }
+  evictOldestSessions() {
+    const maxSessions = this.options.maxSessions ?? DEFAULT_MAX_SESSIONS;
+    while (this.sessions.size > maxSessions) {
+      const oldestSid = this.findOldestSessionId((entry) => !entry.authenticated) ?? this.findOldestSessionId();
+      if (!oldestSid) {
+        return;
+      }
+      this.sessions.delete(oldestSid);
+    }
+  }
+  findOldestSessionId(filter = () => true) {
+    let oldestSid;
+    let oldestUpdatedAt = Number.POSITIVE_INFINITY;
+    for (const [sid, entry] of this.sessions) {
+      if (filter(entry) && entry.updatedAt < oldestUpdatedAt) {
+        oldestSid = sid;
+        oldestUpdatedAt = entry.updatedAt;
+      }
+    }
+    return oldestSid;
+  }
+}
+const createSessionStore = () => new TtlMemorySessionStore();
+export {
+  ANONYMOUS_SESSION_IDLE_TIMEOUT_MS,
+  AUTH_SESSION_IDLE_TIMEOUT_MS,
+  TtlMemorySessionStore,
+  createSessionStore
+};
+//# sourceMappingURL=session-store.js.map

package/server/dist/modules/session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/modules/session-store.ts"],"sourcesContent":["import session, { type SessionData } from 'express-session';\n\nexport const AUTH_SESSION_IDLE_TIMEOUT_MS = 7 * 24 * 60 * 60 * 1000;\nexport const ANONYMOUS_SESSION_IDLE_TIMEOUT_MS = 30 * 60 * 1000;\nconst AUTH_SESSION_PRUNE_INTERVAL_MS = 60 * 60 * 1000;\nconst DEFAULT_MAX_SESSIONS = 1000;\n\ntype StoredSession = {\n    data: string;\n    expiresAt: number;\n    authenticated: boolean;\n    updatedAt: number;\n};\n\ntype AuthSessionData = SessionData & {\n    authenticated?: boolean;\n};\n\nconst serializeSession = (data: SessionData) => JSON.stringify(data);\n\nconst deserializeSession = (data: string): SessionData => {\n    const parsed = JSON.parse(data) as SessionData;\n    const expires = parsed.cookie?.expires;\n\n    if (typeof expires === 'string') {\n        parsed.cookie.expires = new Date(expires);\n    }\n\n    return parsed;\n};\n\nconst isAuthenticatedSession = (data: SessionData) => Boolean((data as AuthSessionData).authenticated);\n\nconst getSessionExpiry = (data: SessionData, now = Date.now()) => {\n    const expires = data.cookie?.expires;\n    const ttlMs = isAuthenticatedSession(data) ? AUTH_SESSION_IDLE_TIMEOUT_MS : ANONYMOUS_SESSION_IDLE_TIMEOUT_MS;\n    const fallbackExpiresAt = now + ttlMs;\n\n    if (expires) {\n        const expiresAt = expires instanceof Date ? expires : new Date(expires);\n\n        if (!Number.isNaN(expiresAt.getTime())) {\n            return Math.min(expiresAt.getTime(), fallbackExpiresAt);\n        }\n    }\n\n    return fallbackExpiresAt;\n};\n\nexport class TtlMemorySessionStore extends session.Store {\n    private readonly sessions = new Map<string, StoredSession>();\n    private readonly pruneTimer: NodeJS.Timeout;\n\n    constructor(private readonly options: { maxSessions?: number; pruneIntervalMs?: number } = {}) {\n        super();\n\n        this.pruneTimer = setInterval(() => {\n            this.pruneExpiredSessions();\n        }, options.pruneIntervalMs ?? AUTH_SESSION_PRUNE_INTERVAL_MS);\n        this.pruneTimer.unref?.();\n    }\n\n    get(sid: string, callback: (error: unknown, session?: SessionData | null) => void) {\n        try {\n            const entry = this.sessions.get(sid);\n\n            if (!entry) {\n                callback(null, null);\n                return;\n            }\n\n            if (entry.expiresAt <= Date.now()) {\n                this.sessions.delete(sid);\n                callback(null, null);\n                return;\n            }\n\n            callback(null, deserializeSession(entry.data));\n        } catch (error) {\n            callback(error);\n        }\n    }\n\n    set(sid: string, data: SessionData, callback?: (error?: unknown) => void) {\n        try {\n            const now = Date.now();\n\n            this.sessions.set(sid, {\n                data: serializeSession(data),\n                expiresAt: getSessionExpiry(data, now),\n                authenticated: isAuthenticatedSession(data),\n                updatedAt: now,\n            });\n            this.pruneExpiredSessions();\n            this.evictOldestSessions();\n            callback?.();\n        } catch (error) {\n            callback?.(error);\n        }\n    }\n\n    destroy(sid: string, callback?: (error?: unknown) => void) {\n        this.sessions.delete(sid);\n        callback?.();\n    }\n\n    touch(sid: string, data: SessionData, callback?: () => void) {\n        const entry = this.sessions.get(sid);\n\n        if (entry) {\n            const now = Date.now();\n\n            this.sessions.set(sid, {\n                data: serializeSession(data),\n                expiresAt: getSessionExpiry(data, now),\n                authenticated: isAuthenticatedSession(data),\n                updatedAt: now,\n            });\n        }\n\n        callback?.();\n    }\n\n    all(callback: (error: unknown, sessions?: SessionData[] | { [sid: string]: SessionData } | null) => void) {\n        try {\n            this.pruneExpiredSessions();\n\n            const sessions: Record<string, SessionData> = {};\n            for (const [sid, entry] of this.sessions) {\n                sessions[sid] = deserializeSession(entry.data);\n            }\n\n            callback(null, sessions);\n        } catch (error) {\n            callback(error);\n        }\n    }\n\n    length(callback: (error: unknown, length?: number) => void) {\n        this.pruneExpiredSessions();\n        callback(null, this.sessions.size);\n    }\n\n    clear(callback?: (error?: unknown) => void) {\n        this.sessions.clear();\n        callback?.();\n    }\n\n    pruneExpiredSessions(now = Date.now()) {\n        for (const [sid, entry] of this.sessions) {\n            if (entry.expiresAt <= now) {\n                this.sessions.delete(sid);\n            }\n        }\n    }\n\n    stopPruning() {\n        clearInterval(this.pruneTimer);\n    }\n\n    private evictOldestSessions() {\n        const maxSessions = this.options.maxSessions ?? DEFAULT_MAX_SESSIONS;\n\n        while (this.sessions.size > maxSessions) {\n            const oldestSid = this.findOldestSessionId((entry) => !entry.authenticated) ?? this.findOldestSessionId();\n\n            if (!oldestSid) {\n                return;\n            }\n\n            this.sessions.delete(oldestSid);\n        }\n    }\n\n    private findOldestSessionId(filter: (entry: StoredSession) => boolean = () => true) {\n        let oldestSid: string | undefined;\n        let oldestUpdatedAt = Number.POSITIVE_INFINITY;\n\n        for (const [sid, entry] of this.sessions) {\n            if (filter(entry) && entry.updatedAt < oldestUpdatedAt) {\n                oldestSid = sid;\n                oldestUpdatedAt = entry.updatedAt;\n            }\n        }\n\n        return oldestSid;\n    }\n}\n\nexport const createSessionStore = (): session.Store => new TtlMemorySessionStore();\n"],"mappings":"AAAA,OAAO,aAAmC;AAEnC,MAAM,+BAA+B,IAAI,KAAK,KAAK,KAAK;AACxD,MAAM,oCAAoC,KAAK,KAAK;AAC3D,MAAM,iCAAiC,KAAK,KAAK;AACjD,MAAM,uBAAuB;AAa7B,MAAM,mBAAmB,CAAC,SAAsB,KAAK,UAAU,IAAI;AAEnE,MAAM,qBAAqB,CAAC,SAA8B;AACtD,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAM,UAAU,OAAO,QAAQ;AAE/B,MAAI,OAAO,YAAY,UAAU;AAC7B,WAAO,OAAO,UAAU,IAAI,KAAK,OAAO;AAAA,EAC5C;AAEA,SAAO;AACX;AAEA,MAAM,yBAAyB,CAAC,SAAsB,QAAS,KAAyB,aAAa;AAErG,MAAM,mBAAmB,CAAC,MAAmB,MAAM,KAAK,IAAI,MAAM;AAC9D,QAAM,UAAU,KAAK,QAAQ;AAC7B,QAAM,QAAQ,uBAAuB,IAAI,IAAI,+BAA+B;AAC5E,QAAM,oBAAoB,MAAM;AAEhC,MAAI,SAAS;AACT,UAAM,YAAY,mBAAmB,OAAO,UAAU,IAAI,KAAK,OAAO;AAEtE,QAAI,CAAC,OAAO,MAAM,UAAU,QAAQ,CAAC,GAAG;AACpC,aAAO,KAAK,IAAI,UAAU,QAAQ,GAAG,iBAAiB;AAAA,IAC1D;AAAA,EACJ;AAEA,SAAO;AACX;AAEO,MAAM,8BAA8B,QAAQ,MAAM;AAAA,EAIrD,YAA6B,UAA8D,CAAC,GAAG;AAC3F,UAAM;AADmB;AAGzB,SAAK,aAAa,YAAY,MAAM;AAChC,WAAK,qBAAqB;AAAA,IAC9B,GAAG,QAAQ,mBAAmB,8BAA8B;AAC5D,SAAK,WAAW,QAAQ;AAAA,EAC5B;AAAA,EAP6B;AAAA,EAHZ,WAAW,oBAAI,IAA2B;AAAA,EAC1C;AAAA,EAWjB,IAAI,KAAa,UAAkE;AAC/E,QAAI;AACA,YAAM,QAAQ,KAAK,SAAS,IAAI,GAAG;AAEnC,UAAI,CAAC,OAAO;AACR,iBAAS,MAAM,IAAI;AACnB;AAAA,MACJ;AAEA,UAAI,MAAM,aAAa,KAAK,IAAI,GAAG;AAC/B,aAAK,SAAS,OAAO,GAAG;AACxB,iBAAS,MAAM,IAAI;AACnB;AAAA,MACJ;AAEA,eAAS,MAAM,mBAAmB,MAAM,IAAI,CAAC;AAAA,IACjD,SAAS,OAAO;AACZ,eAAS,KAAK;AAAA,IAClB;AAAA,EACJ;AAAA,EAEA,IAAI,KAAa,MAAmB,UAAsC;AACtE,QAAI;AACA,YAAM,MAAM,KAAK,IAAI;AAErB,WAAK,SAAS,IAAI,KAAK;AAAA,QACnB,MAAM,iBAAiB,IAAI;AAAA,QAC3B,WAAW,iBAAiB,MAAM,GAAG;AAAA,QACrC,eAAe,uBAAuB,IAAI;AAAA,QAC1C,WAAW;AAAA,MACf,CAAC;AACD,WAAK,qBAAqB;AAC1B,WAAK,oBAAoB;AACzB,iBAAW;AAAA,IACf,SAAS,OAAO;AACZ,iBAAW,KAAK;AAAA,IACpB;AAAA,EACJ;AAAA,EAEA,QAAQ,KAAa,UAAsC;AACvD,SAAK,SAAS,OAAO,GAAG;AACxB,eAAW;AAAA,EACf;AAAA,EAEA,MAAM,KAAa,MAAmB,UAAuB;AACzD,UAAM,QAAQ,KAAK,SAAS,IAAI,GAAG;AAEnC,QAAI,OAAO;AACP,YAAM,MAAM,KAAK,IAAI;AAErB,WAAK,SAAS,IAAI,KAAK;AAAA,QACnB,MAAM,iBAAiB,IAAI;AAAA,QAC3B,WAAW,iBAAiB,MAAM,GAAG;AAAA,QACrC,eAAe,uBAAuB,IAAI;AAAA,QAC1C,WAAW;AAAA,MACf,CAAC;AAAA,IACL;AAEA,eAAW;AAAA,EACf;AAAA,EAEA,IAAI,UAAsG;AACtG,QAAI;AACA,WAAK,qBAAqB;AAE1B,YAAM,WAAwC,CAAC;AAC/C,iBAAW,CAAC,KAAK,KAAK,KAAK,KAAK,UAAU;AACtC,iBAAS,GAAG,IAAI,mBAAmB,MAAM,IAAI;AAAA,MACjD;AAEA,eAAS,MAAM,QAAQ;AAAA,IAC3B,SAAS,OAAO;AACZ,eAAS,KAAK;AAAA,IAClB;AAAA,EACJ;AAAA,EAEA,OAAO,UAAqD;AACxD,SAAK,qBAAqB;AAC1B,aAAS,MAAM,KAAK,SAAS,IAAI;AAAA,EACrC;AAAA,EAEA,MAAM,UAAsC;AACxC,SAAK,SAAS,MAAM;AACpB,eAAW;AAAA,EACf;AAAA,EAEA,qBAAqB,MAAM,KAAK,IAAI,GAAG;AACnC,eAAW,CAAC,KAAK,KAAK,KAAK,KAAK,UAAU;AACtC,UAAI,MAAM,aAAa,KAAK;AACxB,aAAK,SAAS,OAAO,GAAG;AAAA,MAC5B;AAAA,IACJ;AAAA,EACJ;AAAA,EAEA,cAAc;AACV,kBAAc,KAAK,UAAU;AAAA,EACjC;AAAA,EAEQ,sBAAsB;AAC1B,UAAM,cAAc,KAAK,QAAQ,eAAe;AAEhD,WAAO,KAAK,SAAS,OAAO,aAAa;AACrC,YAAM,YAAY,KAAK,oBAAoB,CAAC,UAAU,CAAC,MAAM,aAAa,KAAK,KAAK,oBAAoB;AAExG,UAAI,CAAC,WAAW;AACZ;AAAA,MACJ;AAEA,WAAK,SAAS,OAAO,SAAS;AAAA,IAClC;AAAA,EACJ;AAAA,EAEQ,oBAAoB,SAA4C,MAAM,MAAM;AAChF,QAAI;AACJ,QAAI,kBAAkB,OAAO;AAE7B,eAAW,CAAC,KAAK,KAAK,KAAK,KAAK,UAAU;AACtC,UAAI,OAAO,KAAK,KAAK,MAAM,YAAY,iBAAiB;AACpD,oBAAY;AACZ,0BAAkB,MAAM;AAAA,MAC5B;AAAA,IACJ;AAEA,WAAO;AAAA,EACX;AACJ;AAEO,MAAM,qBAAqB,MAAqB,IAAI,sBAAsB;","names":[]}

package/server/dist/routes/api.js

@@ -7,28 +7,53 @@ import {
   createMcpAdminSetEnabledHandler,
   createMcpAdminStatusHandler
 } from "../features/mcp-admin/http/handlers.js";
-import { requireSessionForWrite } from "../modules/auth-guard.js";
-import { createAuthAttemptRateLimit } from "../modules/rate-limit.js";
+import { createCsrfProtection, requireSessionForWrite } from "../modules/auth-guard.js";
+import { createAuthAttemptRateLimit, createSessionAccessRateLimit } from "../modules/rate-limit.js";
 import { createServerEventsHandler } from "../modules/server-events-handler.js";
 import useAsync from "../modules/use-async.js";
 import { createMcpRouter } from "./mcp.js";
-const createApiRouter = (authConfig, mcpAdminService) => Router().use("/mcp", createMcpRouter(authConfig, mcpAdminService)).post("/auth/login", createAuthAttemptRateLimit(), useAsync(createLoginHandler(authConfig))).post("/auth/logout", useAsync(createLogoutHandler(authConfig))).get("/auth/session", useAsync(createSessionStatusHandler(authConfig))).get(
-  "/mcp-admin/status",
-  requireSessionForWrite(authConfig),
-  useAsync(createMcpAdminStatusHandler(mcpAdminService))
-).post(
-  "/mcp-admin/enabled",
-  requireSessionForWrite(authConfig),
-  useAsync(createMcpAdminSetEnabledHandler(mcpAdminService))
-).post(
-  "/mcp-admin/token/rotate",
-  requireSessionForWrite(authConfig),
-  useAsync(createMcpAdminRotateTokenHandler(mcpAdminService))
-).post(
-  "/mcp-admin/token/revoke",
-  requireSessionForWrite(authConfig),
-  useAsync(createMcpAdminRevokeTokenHandler(mcpAdminService))
-).post("/image", requireSessionForWrite(authConfig), useAsync(createUploadImageHandler())).post("/image-from-src", requireSessionForWrite(authConfig), useAsync(createUploadImageFromSrcHandler())).get("/events", requireSessionForWrite(authConfig), createServerEventsHandler());
+const createApiRouter = (authConfig, mcpAdminService) => {
+  const csrfProtection = createCsrfProtection(authConfig);
+  const requireSession = requireSessionForWrite(authConfig);
+  const sessionAccessRateLimit = createSessionAccessRateLimit();
+  return Router().use("/mcp", createMcpRouter(authConfig, mcpAdminService)).get("/auth/session", csrfProtection, useAsync(createSessionStatusHandler(authConfig))).post("/auth/login", csrfProtection, createAuthAttemptRateLimit(), useAsync(createLoginHandler(authConfig))).post(
+    "/auth/logout",
+    sessionAccessRateLimit,
+    requireSession,
+    csrfProtection,
+    useAsync(createLogoutHandler(authConfig))
+  ).get(
+    "/mcp-admin/status",
+    sessionAccessRateLimit,
+    requireSession,
+    csrfProtection,
+    useAsync(createMcpAdminStatusHandler(mcpAdminService))
+  ).post(
+    "/mcp-admin/enabled",
+    sessionAccessRateLimit,
+    requireSession,
+    csrfProtection,
+    useAsync(createMcpAdminSetEnabledHandler(mcpAdminService))
+  ).post(
+    "/mcp-admin/token/rotate",
+    sessionAccessRateLimit,
+    requireSession,
+    csrfProtection,
+    useAsync(createMcpAdminRotateTokenHandler(mcpAdminService))
+  ).post(
+    "/mcp-admin/token/revoke",
+    sessionAccessRateLimit,
+    requireSession,
+    csrfProtection,
+    useAsync(createMcpAdminRevokeTokenHandler(mcpAdminService))
+  ).post("/image", sessionAccessRateLimit, requireSession, csrfProtection, useAsync(createUploadImageHandler())).post(
+    "/image-from-src",
+    sessionAccessRateLimit,
+    requireSession,
+    csrfProtection,
+    useAsync(createUploadImageFromSrcHandler())
+  ).get("/events", sessionAccessRateLimit, requireSession, csrfProtection, createServerEventsHandler());
+};
 export {
   createApiRouter
 };

package/server/dist/routes/api.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/routes/api.ts"],"sourcesContent":["import { Router } from 'express';\nimport { createLoginHandler, createLogoutHandler, createSessionStatusHandler } from '../features/auth/http/api.js';\nimport { createUploadImageFromSrcHandler, createUploadImageHandler } from '../features/image/http/upload.js';\nimport {\n    createMcpAdminRevokeTokenHandler,\n    createMcpAdminRotateTokenHandler,\n    createMcpAdminSetEnabledHandler,\n    createMcpAdminStatusHandler,\n} from '../features/mcp-admin/http/handlers.js';\nimport type { McpAdminService } from '../features/mcp-admin/service.js';\nimport { requireSessionForWrite } from '../modules/auth-guard.js';\nimport type { AuthConfig } from '../modules/auth-mode.js';\nimport { createAuthAttemptRateLimit } from '../modules/rate-limit.js';\nimport { createServerEventsHandler } from '../modules/server-events-handler.js';\nimport useAsync from '../modules/use-async.js';\nimport { createMcpRouter } from './mcp.js';\n\ntype McpAdminApiService = Pick<\n    McpAdminService,\n    'getStatus' | 'setEnabled' | 'rotateToken' | 'revokeActiveToken' | 'validatePresentedToken'\n>;\n\nexport const createApiRouter = (authConfig: AuthConfig, mcpAdminService: McpAdminApiService) =>\n    Router()\n        .use('/mcp', createMcpRouter(authConfig, mcpAdminService))\n        .post('/auth/login', createAuthAttemptRateLimit(), useAsync(createLoginHandler(authConfig)))\n        .post('/auth/logout', useAsync(createLogoutHandler(authConfig)))\n        .get('/auth/session', useAsync(createSessionStatusHandler(authConfig)))\n        .get(\n            '/mcp-admin/status',\n            requireSessionForWrite(authConfig),\n            useAsync(createMcpAdminStatusHandler(mcpAdminService)),\n        )\n        .post(\n            '/mcp-admin/enabled',\n            requireSessionForWrite(authConfig),\n            useAsync(createMcpAdminSetEnabledHandler(mcpAdminService)),\n        )\n        .post(\n            '/mcp-admin/token/rotate',\n            requireSessionForWrite(authConfig),\n            useAsync(createMcpAdminRotateTokenHandler(mcpAdminService)),\n        )\n        .post(\n            '/mcp-admin/token/revoke',\n            requireSessionForWrite(authConfig),\n            useAsync(createMcpAdminRevokeTokenHandler(mcpAdminService)),\n        )\n        .post('/image', requireSessionForWrite(authConfig), useAsync(createUploadImageHandler()))\n        .post('/image-from-src', requireSessionForWrite(authConfig), useAsync(createUploadImageFromSrcHandler()))\n        .get('/events', requireSessionForWrite(authConfig), createServerEventsHandler());\n"],"mappings":"AAAA,SAAS,cAAc;AACvB,SAAS,oBAAoB,qBAAqB,kCAAkC;AACpF,SAAS,iCAAiC,gCAAgC;AAC1E;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACG;AAEP,SAAS,8BAA8B;AAEvC,SAAS,kCAAkC;AAC3C,SAAS,iCAAiC;AAC1C,OAAO,cAAc;AACrB,SAAS,uBAAuB;AAOzB,MAAM,kBAAkB,CAAC,YAAwB,oBACpD,OAAO,EACF,IAAI,QAAQ,gBAAgB,YAAY,eAAe,CAAC,EACxD,KAAK,eAAe,2BAA2B,GAAG,SAAS,mBAAmB,UAAU,CAAC,CAAC,EAC1F,KAAK,gBAAgB,SAAS,oBAAoB,UAAU,CAAC,CAAC,EAC9D,IAAI,iBAAiB,SAAS,2BAA2B,UAAU,CAAC,CAAC,EACrE;AAAA,EACG;AAAA,EACA,uBAAuB,UAAU;AAAA,EACjC,SAAS,4BAA4B,eAAe,CAAC;AACzD,EACC;AAAA,EACG;AAAA,EACA,uBAAuB,UAAU;AAAA,EACjC,SAAS,gCAAgC,eAAe,CAAC;AAC7D,EACC;AAAA,EACG;AAAA,EACA,uBAAuB,UAAU;AAAA,EACjC,SAAS,iCAAiC,eAAe,CAAC;AAC9D,EACC;AAAA,EACG;AAAA,EACA,uBAAuB,UAAU;AAAA,EACjC,SAAS,iCAAiC,eAAe,CAAC;AAC9D,EACC,KAAK,UAAU,uBAAuB,UAAU,GAAG,SAAS,yBAAyB,CAAC,CAAC,EACvF,KAAK,mBAAmB,uBAAuB,UAAU,GAAG,SAAS,gCAAgC,CAAC,CAAC,EACvG,IAAI,WAAW,uBAAuB,UAAU,GAAG,0BAA0B,CAAC;","names":[]}
+{"version":3,"sources":["../../src/routes/api.ts"],"sourcesContent":["import { Router } from 'express';\nimport { createLoginHandler, createLogoutHandler, createSessionStatusHandler } from '../features/auth/http/api.js';\nimport { createUploadImageFromSrcHandler, createUploadImageHandler } from '../features/image/http/upload.js';\nimport {\n    createMcpAdminRevokeTokenHandler,\n    createMcpAdminRotateTokenHandler,\n    createMcpAdminSetEnabledHandler,\n    createMcpAdminStatusHandler,\n} from '../features/mcp-admin/http/handlers.js';\nimport type { McpAdminService } from '../features/mcp-admin/service.js';\nimport { createCsrfProtection, requireSessionForWrite } from '../modules/auth-guard.js';\nimport type { AuthConfig } from '../modules/auth-mode.js';\nimport { createAuthAttemptRateLimit, createSessionAccessRateLimit } from '../modules/rate-limit.js';\nimport { createServerEventsHandler } from '../modules/server-events-handler.js';\nimport useAsync from '../modules/use-async.js';\nimport { createMcpRouter } from './mcp.js';\n\ntype McpAdminApiService = Pick<\n    McpAdminService,\n    'getStatus' | 'setEnabled' | 'rotateToken' | 'revokeActiveToken' | 'validatePresentedToken'\n>;\n\nexport const createApiRouter = (authConfig: AuthConfig, mcpAdminService: McpAdminApiService) => {\n    const csrfProtection = createCsrfProtection(authConfig);\n    const requireSession = requireSessionForWrite(authConfig);\n    const sessionAccessRateLimit = createSessionAccessRateLimit();\n\n    return Router()\n        .use('/mcp', createMcpRouter(authConfig, mcpAdminService))\n        .get('/auth/session', csrfProtection, useAsync(createSessionStatusHandler(authConfig)))\n        .post('/auth/login', csrfProtection, createAuthAttemptRateLimit(), useAsync(createLoginHandler(authConfig)))\n        .post(\n            '/auth/logout',\n            sessionAccessRateLimit,\n            requireSession,\n            csrfProtection,\n            useAsync(createLogoutHandler(authConfig)),\n        )\n        .get(\n            '/mcp-admin/status',\n            sessionAccessRateLimit,\n            requireSession,\n            csrfProtection,\n            useAsync(createMcpAdminStatusHandler(mcpAdminService)),\n        )\n        .post(\n            '/mcp-admin/enabled',\n            sessionAccessRateLimit,\n            requireSession,\n            csrfProtection,\n            useAsync(createMcpAdminSetEnabledHandler(mcpAdminService)),\n        )\n        .post(\n            '/mcp-admin/token/rotate',\n            sessionAccessRateLimit,\n            requireSession,\n            csrfProtection,\n            useAsync(createMcpAdminRotateTokenHandler(mcpAdminService)),\n        )\n        .post(\n            '/mcp-admin/token/revoke',\n            sessionAccessRateLimit,\n            requireSession,\n            csrfProtection,\n            useAsync(createMcpAdminRevokeTokenHandler(mcpAdminService)),\n        )\n        .post('/image', sessionAccessRateLimit, requireSession, csrfProtection, useAsync(createUploadImageHandler()))\n        .post(\n            '/image-from-src',\n            sessionAccessRateLimit,\n            requireSession,\n            csrfProtection,\n            useAsync(createUploadImageFromSrcHandler()),\n        )\n        .get('/events', sessionAccessRateLimit, requireSession, csrfProtection, createServerEventsHandler());\n};\n"],"mappings":"AAAA,SAAS,cAAc;AACvB,SAAS,oBAAoB,qBAAqB,kCAAkC;AACpF,SAAS,iCAAiC,gCAAgC;AAC1E;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACG;AAEP,SAAS,sBAAsB,8BAA8B;AAE7D,SAAS,4BAA4B,oCAAoC;AACzE,SAAS,iCAAiC;AAC1C,OAAO,cAAc;AACrB,SAAS,uBAAuB;AAOzB,MAAM,kBAAkB,CAAC,YAAwB,oBAAwC;AAC5F,QAAM,iBAAiB,qBAAqB,UAAU;AACtD,QAAM,iBAAiB,uBAAuB,UAAU;AACxD,QAAM,yBAAyB,6BAA6B;AAE5D,SAAO,OAAO,EACT,IAAI,QAAQ,gBAAgB,YAAY,eAAe,CAAC,EACxD,IAAI,iBAAiB,gBAAgB,SAAS,2BAA2B,UAAU,CAAC,CAAC,EACrF,KAAK,eAAe,gBAAgB,2BAA2B,GAAG,SAAS,mBAAmB,UAAU,CAAC,CAAC,EAC1G;AAAA,IACG;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS,oBAAoB,UAAU,CAAC;AAAA,EAC5C,EACC;AAAA,IACG;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS,4BAA4B,eAAe,CAAC;AAAA,EACzD,EACC;AAAA,IACG;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS,gCAAgC,eAAe,CAAC;AAAA,EAC7D,EACC;AAAA,IACG;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS,iCAAiC,eAAe,CAAC;AAAA,EAC9D,EACC;AAAA,IACG;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS,iCAAiC,eAAe,CAAC;AAAA,EAC9D,EACC,KAAK,UAAU,wBAAwB,gBAAgB,gBAAgB,SAAS,yBAAyB,CAAC,CAAC,EAC3G;AAAA,IACG;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS,gCAAgC,CAAC;AAAA,EAC9C,EACC,IAAI,WAAW,wBAAwB,gBAAgB,gBAAgB,0BAA0B,CAAC;AAC3G;","names":[]}

package/server/dist/routes/auth-pages.js

@@ -4,8 +4,19 @@ import {
   createLoginPageSubmitHandler,
   createLogoutPageHandler
 } from "../features/auth/http/pages.js";
-import { createAuthAttemptRateLimit } from "../modules/rate-limit.js";
-const createAuthPagesRouter = (authConfig) => Router().get("/login", createLoginPageHandler(authConfig)).post("/login", createAuthAttemptRateLimit(), createLoginPageSubmitHandler(authConfig)).post("/logout", createLogoutPageHandler(authConfig));
+import { createCsrfProtection, createLoginCsrfFailureHandler, requireSessionForWrite } from "../modules/auth-guard.js";
+import { createAuthAttemptRateLimit, createSessionAccessRateLimit } from "../modules/rate-limit.js";
+const createAuthPagesRouter = (authConfig) => {
+  const csrfProtection = createCsrfProtection(authConfig);
+  const sessionAccessRateLimit = createSessionAccessRateLimit();
+  return Router().get("/login", csrfProtection, createLoginPageHandler(authConfig)).post("/login", csrfProtection, createAuthAttemptRateLimit(), createLoginPageSubmitHandler(authConfig)).post(
+    "/logout",
+    sessionAccessRateLimit,
+    requireSessionForWrite(authConfig),
+    csrfProtection,
+    createLogoutPageHandler(authConfig)
+  ).use(createLoginCsrfFailureHandler(authConfig));
+};
 export {
   createAuthPagesRouter
 };

package/server/dist/routes/auth-pages.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/routes/auth-pages.ts"],"sourcesContent":["import { Router } from 'express';\nimport {\n    createLoginPageHandler,\n    createLoginPageSubmitHandler,\n    createLogoutPageHandler,\n} from '../features/auth/http/pages.js';\nimport type { AuthConfig } from '../modules/auth-mode.js';\nimport { createAuthAttemptRateLimit } from '../modules/rate-limit.js';\n\nexport const createAuthPagesRouter = (authConfig: AuthConfig) =>\n    Router()\n        .get('/login', createLoginPageHandler(authConfig))\n        .post('/login', createAuthAttemptRateLimit(), createLoginPageSubmitHandler(authConfig))\n        .post('/logout', createLogoutPageHandler(authConfig));\n"],"mappings":"AAAA,SAAS,cAAc;AACvB;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,OACG;AAEP,SAAS,kCAAkC;AAEpC,MAAM,wBAAwB,CAAC,eAClC,OAAO,EACF,IAAI,UAAU,uBAAuB,UAAU,CAAC,EAChD,KAAK,UAAU,2BAA2B,GAAG,6BAA6B,UAAU,CAAC,EACrF,KAAK,WAAW,wBAAwB,UAAU,CAAC;","names":[]}
+{"version":3,"sources":["../../src/routes/auth-pages.ts"],"sourcesContent":["import { Router } from 'express';\nimport {\n    createLoginPageHandler,\n    createLoginPageSubmitHandler,\n    createLogoutPageHandler,\n} from '../features/auth/http/pages.js';\nimport { createCsrfProtection, createLoginCsrfFailureHandler, requireSessionForWrite } from '../modules/auth-guard.js';\nimport type { AuthConfig } from '../modules/auth-mode.js';\nimport { createAuthAttemptRateLimit, createSessionAccessRateLimit } from '../modules/rate-limit.js';\n\nexport const createAuthPagesRouter = (authConfig: AuthConfig) => {\n    const csrfProtection = createCsrfProtection(authConfig);\n    const sessionAccessRateLimit = createSessionAccessRateLimit();\n\n    return Router()\n        .get('/login', csrfProtection, createLoginPageHandler(authConfig))\n        .post('/login', csrfProtection, createAuthAttemptRateLimit(), createLoginPageSubmitHandler(authConfig))\n        .post(\n            '/logout',\n            sessionAccessRateLimit,\n            requireSessionForWrite(authConfig),\n            csrfProtection,\n            createLogoutPageHandler(authConfig),\n        )\n        .use(createLoginCsrfFailureHandler(authConfig));\n};\n"],"mappings":"AAAA,SAAS,cAAc;AACvB;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,OACG;AACP,SAAS,sBAAsB,+BAA+B,8BAA8B;AAE5F,SAAS,4BAA4B,oCAAoC;AAElE,MAAM,wBAAwB,CAAC,eAA2B;AAC7D,QAAM,iBAAiB,qBAAqB,UAAU;AACtD,QAAM,yBAAyB,6BAA6B;AAE5D,SAAO,OAAO,EACT,IAAI,UAAU,gBAAgB,uBAAuB,UAAU,CAAC,EAChE,KAAK,UAAU,gBAAgB,2BAA2B,GAAG,6BAA6B,UAAU,CAAC,EACrG;AAAA,IACG;AAAA,IACA;AAAA,IACA,uBAAuB,UAAU;AAAA,IACjC;AAAA,IACA,wBAAwB,UAAU;AAAA,EACtC,EACC,IAAI,8BAA8B,UAAU,CAAC;AACtD;","names":[]}

package/server/dist/routes/client.js

@@ -1,6 +1,6 @@
 import express, { Router } from "express";
 import path from "path";
-import { isAuthenticatedRequest } from "../modules/auth-guard.js";
+import { createCsrfProtection, isAuthenticatedRequest } from "../modules/auth-guard.js";
 import { paths } from "../paths.js";
 const shouldBlockClientRoute = (authConfig, requestPath, authenticated) => {
   if (authConfig.mode !== "password" || authenticated) {
@@ -11,6 +11,16 @@ const shouldBlockClientRoute = (authConfig, requestPath, authenticated) => {
   }
   return path.extname(requestPath) === "";
 };
+const createClientRouteCsrfTokenMiddleware = (authConfig) => {
+  const csrfProtection = createCsrfProtection(authConfig);
+  return (req, res, next) => {
+    if (path.extname(req.path) !== "") {
+      next();
+      return;
+    }
+    csrfProtection(req, res, next);
+  };
+};
 const createClientRouter = (authConfig) => Router().use("/assets/images", express.static(paths.imageDir)).use((req, res, next) => {
   if (shouldBlockClientRoute(authConfig, req.path, isAuthenticatedRequest(req))) {
     const redirectPath = encodeURIComponent(req.originalUrl || "/");
@@ -18,7 +28,7 @@ const createClientRouter = (authConfig) => Router().use("/assets/images", expres
     return;
   }
   next();
-}).use(express.static(paths.clientDist, { extensions: ["html"] })).get(/.*/, (_req, res) => {
+}).use(createClientRouteCsrfTokenMiddleware(authConfig)).use(express.static(paths.clientDist, { extensions: ["html"] })).get(/.*/, (_req, res) => {
   res.sendFile(paths.clientIndex);
 });
 export {

package/server/dist/routes/client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/routes/client.ts"],"sourcesContent":["import express, { Router } from 'express';\nimport path from 'path';\nimport { isAuthenticatedRequest } from '../modules/auth-guard.js';\nimport type { AuthConfig } from '../modules/auth-mode.js';\nimport { paths } from '../paths.js';\n\nconst shouldBlockClientRoute = (authConfig: AuthConfig, requestPath: string, authenticated: boolean) => {\n    if (authConfig.mode !== 'password' || authenticated) {\n        return false;\n    }\n\n    if (\n        requestPath.startsWith('/api') ||\n        requestPath.startsWith('/graphql') ||\n        requestPath === '/login' ||\n        requestPath === '/logout'\n    ) {\n        return false;\n    }\n\n    return path.extname(requestPath) === '';\n};\n\nexport const createClientRouter = (authConfig: AuthConfig) =>\n    Router()\n        .use('/assets/images', express.static(paths.imageDir))\n        .use((req, res, next) => {\n            if (shouldBlockClientRoute(authConfig, req.path, isAuthenticatedRequest(req))) {\n                const redirectPath = encodeURIComponent(req.originalUrl || '/');\n                res.redirect(303, `/login?next=${redirectPath}`);\n                return;\n            }\n\n            next();\n        })\n        .use(express.static(paths.clientDist, { extensions: ['html'] }))\n        .get(/.*/, (_req, res) => {\n            res.sendFile(paths.clientIndex);\n        });\n"],"mappings":"AAAA,OAAO,WAAW,cAAc;AAChC,OAAO,UAAU;AACjB,SAAS,8BAA8B;AAEvC,SAAS,aAAa;AAEtB,MAAM,yBAAyB,CAAC,YAAwB,aAAqB,kBAA2B;AACpG,MAAI,WAAW,SAAS,cAAc,eAAe;AACjD,WAAO;AAAA,EACX;AAEA,MACI,YAAY,WAAW,MAAM,KAC7B,YAAY,WAAW,UAAU,KACjC,gBAAgB,YAChB,gBAAgB,WAClB;AACE,WAAO;AAAA,EACX;AAEA,SAAO,KAAK,QAAQ,WAAW,MAAM;AACzC;AAEO,MAAM,qBAAqB,CAAC,eAC/B,OAAO,EACF,IAAI,kBAAkB,QAAQ,OAAO,MAAM,QAAQ,CAAC,EACpD,IAAI,CAAC,KAAK,KAAK,SAAS;AACrB,MAAI,uBAAuB,YAAY,IAAI,MAAM,uBAAuB,GAAG,CAAC,GAAG;AAC3E,UAAM,eAAe,mBAAmB,IAAI,eAAe,GAAG;AAC9D,QAAI,SAAS,KAAK,eAAe,YAAY,EAAE;AAC/C;AAAA,EACJ;AAEA,OAAK;AACT,CAAC,EACA,IAAI,QAAQ,OAAO,MAAM,YAAY,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,EAC9D,IAAI,MAAM,CAAC,MAAM,QAAQ;AACtB,MAAI,SAAS,MAAM,WAAW;AAClC,CAAC;","names":[]}
+{"version":3,"sources":["../../src/routes/client.ts"],"sourcesContent":["import express, { Router } from 'express';\nimport path from 'path';\nimport { createCsrfProtection, isAuthenticatedRequest } from '../modules/auth-guard.js';\nimport type { AuthConfig } from '../modules/auth-mode.js';\nimport { paths } from '../paths.js';\n\nconst shouldBlockClientRoute = (authConfig: AuthConfig, requestPath: string, authenticated: boolean) => {\n    if (authConfig.mode !== 'password' || authenticated) {\n        return false;\n    }\n\n    if (\n        requestPath.startsWith('/api') ||\n        requestPath.startsWith('/graphql') ||\n        requestPath === '/login' ||\n        requestPath === '/logout'\n    ) {\n        return false;\n    }\n\n    return path.extname(requestPath) === '';\n};\n\nconst createClientRouteCsrfTokenMiddleware = (authConfig: AuthConfig) => {\n    const csrfProtection = createCsrfProtection(authConfig);\n\n    return (req: express.Request, res: express.Response, next: express.NextFunction) => {\n        if (path.extname(req.path) !== '') {\n            next();\n            return;\n        }\n\n        csrfProtection(req, res, next);\n    };\n};\n\nexport const createClientRouter = (authConfig: AuthConfig) =>\n    Router()\n        .use('/assets/images', express.static(paths.imageDir))\n        .use((req, res, next) => {\n            if (shouldBlockClientRoute(authConfig, req.path, isAuthenticatedRequest(req))) {\n                const redirectPath = encodeURIComponent(req.originalUrl || '/');\n                res.redirect(303, `/login?next=${redirectPath}`);\n                return;\n            }\n\n            next();\n        })\n        .use(createClientRouteCsrfTokenMiddleware(authConfig))\n        .use(express.static(paths.clientDist, { extensions: ['html'] }))\n        .get(/.*/, (_req, res) => {\n            res.sendFile(paths.clientIndex);\n        });\n"],"mappings":"AAAA,OAAO,WAAW,cAAc;AAChC,OAAO,UAAU;AACjB,SAAS,sBAAsB,8BAA8B;AAE7D,SAAS,aAAa;AAEtB,MAAM,yBAAyB,CAAC,YAAwB,aAAqB,kBAA2B;AACpG,MAAI,WAAW,SAAS,cAAc,eAAe;AACjD,WAAO;AAAA,EACX;AAEA,MACI,YAAY,WAAW,MAAM,KAC7B,YAAY,WAAW,UAAU,KACjC,gBAAgB,YAChB,gBAAgB,WAClB;AACE,WAAO;AAAA,EACX;AAEA,SAAO,KAAK,QAAQ,WAAW,MAAM;AACzC;AAEA,MAAM,uCAAuC,CAAC,eAA2B;AACrE,QAAM,iBAAiB,qBAAqB,UAAU;AAEtD,SAAO,CAAC,KAAsB,KAAuB,SAA+B;AAChF,QAAI,KAAK,QAAQ,IAAI,IAAI,MAAM,IAAI;AAC/B,WAAK;AACL;AAAA,IACJ;AAEA,mBAAe,KAAK,KAAK,IAAI;AAAA,EACjC;AACJ;AAEO,MAAM,qBAAqB,CAAC,eAC/B,OAAO,EACF,IAAI,kBAAkB,QAAQ,OAAO,MAAM,QAAQ,CAAC,EACpD,IAAI,CAAC,KAAK,KAAK,SAAS;AACrB,MAAI,uBAAuB,YAAY,IAAI,MAAM,uBAAuB,GAAG,CAAC,GAAG;AAC3E,UAAM,eAAe,mBAAmB,IAAI,eAAe,GAAG;AAC9D,QAAI,SAAS,KAAK,eAAe,YAAY,EAAE;AAC/C;AAAA,EACJ;AAEA,OAAK;AACT,CAAC,EACA,IAAI,qCAAqC,UAAU,CAAC,EACpD,IAAI,QAAQ,OAAO,MAAM,YAAY,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,EAC9D,IAAI,MAAM,CAAC,MAAM,QAAQ;AACtB,MAAI,SAAS,MAAM,WAAW;AAClC,CAAC;","names":[]}

package/server/dist/routes/graphql.js

@@ -1,6 +1,6 @@
 import { Router } from "express";
 import { createHandler } from "graphql-http/lib/use/express";
-import { isAuthenticatedRequest, requireSessionForGraphql } from "../modules/auth-guard.js";
+import { createCsrfProtection, isAuthenticatedRequest, requireSessionForGraphql } from "../modules/auth-guard.js";
 import { createMcpAuthMiddleware, createReadOnlyMcpValidationRule } from "../modules/mcp-auth.js";
 import schema from "../schema/index.js";
 const createGraphqlContext = (authConfig) => (req) => ({
@@ -9,24 +9,28 @@ const createGraphqlContext = (authConfig) => (req) => ({
   req: req.raw,
   res: req.context.res
 });
-const createGraphqlRouter = (authConfig, mcpAdminService) => Router().use(
-  "/mcp",
-  createMcpAuthMiddleware(authConfig, mcpAdminService),
-  createHandler({
-    schema,
-    context: createGraphqlContext(authConfig),
-    validationRules: (_req, _args, specifiedRules) => {
-      return [...specifiedRules, createReadOnlyMcpValidationRule()];
-    }
-  })
-).use(
-  "/",
-  requireSessionForGraphql(authConfig),
-  createHandler({
-    schema,
-    context: createGraphqlContext(authConfig)
-  })
-);
+const createGraphqlRouter = (authConfig, mcpAdminService) => {
+  const csrfProtection = createCsrfProtection(authConfig);
+  return Router().use(
+    "/mcp",
+    createMcpAuthMiddleware(authConfig, mcpAdminService),
+    createHandler({
+      schema,
+      context: createGraphqlContext(authConfig),
+      validationRules: (_req, _args, specifiedRules) => {
+        return [...specifiedRules, createReadOnlyMcpValidationRule()];
+      }
+    })
+  ).use(
+    "/",
+    requireSessionForGraphql(authConfig),
+    csrfProtection,
+    createHandler({
+      schema,
+      context: createGraphqlContext(authConfig)
+    })
+  );
+};
 export {
   createGraphqlRouter
 };

package/server/dist/routes/graphql.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/routes/graphql.ts"],"sourcesContent":["import { type Request, type Response, Router } from 'express';\nimport { createHandler } from 'graphql-http/lib/use/express';\nimport type { McpAdminService } from '../features/mcp-admin/service.js';\nimport { isAuthenticatedRequest, requireSessionForGraphql } from '../modules/auth-guard.js';\nimport type { AuthConfig } from '../modules/auth-mode.js';\nimport { createMcpAuthMiddleware, createReadOnlyMcpValidationRule } from '../modules/mcp-auth.js';\nimport schema from '../schema/index.js';\n\ntype McpGraphqlService = Pick<McpAdminService, 'getStatus' | 'validatePresentedToken'>;\ntype GraphqlRequestContext = { raw: Request; context: { res: Response } };\n\nconst createGraphqlContext = (authConfig: AuthConfig) => (req: GraphqlRequestContext) => ({\n    authMode: authConfig.mode,\n    isAuthenticated: isAuthenticatedRequest(req.raw),\n    req: req.raw,\n    res: req.context.res,\n});\n\nexport const createGraphqlRouter = (authConfig: AuthConfig, mcpAdminService: McpGraphqlService) =>\n    Router()\n        .use(\n            '/mcp',\n            createMcpAuthMiddleware(authConfig, mcpAdminService),\n            createHandler({\n                schema,\n                context: createGraphqlContext(authConfig),\n                validationRules: (_req, _args, specifiedRules) => {\n                    return [...specifiedRules, createReadOnlyMcpValidationRule()];\n                },\n            }),\n        )\n        .use(\n            '/',\n            requireSessionForGraphql(authConfig),\n            createHandler({\n                schema,\n                context: createGraphqlContext(authConfig),\n            }),\n        );\n"],"mappings":"AAAA,SAAsC,cAAc;AACpD,SAAS,qBAAqB;AAE9B,SAAS,wBAAwB,gCAAgC;AAEjE,SAAS,yBAAyB,uCAAuC;AACzE,OAAO,YAAY;AAKnB,MAAM,uBAAuB,CAAC,eAA2B,CAAC,SAAgC;AAAA,EACtF,UAAU,WAAW;AAAA,EACrB,iBAAiB,uBAAuB,IAAI,GAAG;AAAA,EAC/C,KAAK,IAAI;AAAA,EACT,KAAK,IAAI,QAAQ;AACrB;AAEO,MAAM,sBAAsB,CAAC,YAAwB,oBACxD,OAAO,EACF;AAAA,EACG;AAAA,EACA,wBAAwB,YAAY,eAAe;AAAA,EACnD,cAAc;AAAA,IACV;AAAA,IACA,SAAS,qBAAqB,UAAU;AAAA,IACxC,iBAAiB,CAAC,MAAM,OAAO,mBAAmB;AAC9C,aAAO,CAAC,GAAG,gBAAgB,gCAAgC,CAAC;AAAA,IAChE;AAAA,EACJ,CAAC;AACL,EACC;AAAA,EACG;AAAA,EACA,yBAAyB,UAAU;AAAA,EACnC,cAAc;AAAA,IACV;AAAA,IACA,SAAS,qBAAqB,UAAU;AAAA,EAC5C,CAAC;AACL;","names":[]}
+{"version":3,"sources":["../../src/routes/graphql.ts"],"sourcesContent":["import { type Request, type Response, Router } from 'express';\nimport { createHandler } from 'graphql-http/lib/use/express';\nimport type { McpAdminService } from '../features/mcp-admin/service.js';\nimport { createCsrfProtection, isAuthenticatedRequest, requireSessionForGraphql } from '../modules/auth-guard.js';\nimport type { AuthConfig } from '../modules/auth-mode.js';\nimport { createMcpAuthMiddleware, createReadOnlyMcpValidationRule } from '../modules/mcp-auth.js';\nimport schema from '../schema/index.js';\n\ntype McpGraphqlService = Pick<McpAdminService, 'getStatus' | 'validatePresentedToken'>;\ntype GraphqlRequestContext = { raw: Request; context: { res: Response } };\n\nconst createGraphqlContext = (authConfig: AuthConfig) => (req: GraphqlRequestContext) => ({\n    authMode: authConfig.mode,\n    isAuthenticated: isAuthenticatedRequest(req.raw),\n    req: req.raw,\n    res: req.context.res,\n});\n\nexport const createGraphqlRouter = (authConfig: AuthConfig, mcpAdminService: McpGraphqlService) => {\n    const csrfProtection = createCsrfProtection(authConfig);\n\n    return Router()\n        .use(\n            '/mcp',\n            createMcpAuthMiddleware(authConfig, mcpAdminService),\n            createHandler({\n                schema,\n                context: createGraphqlContext(authConfig),\n                validationRules: (_req, _args, specifiedRules) => {\n                    return [...specifiedRules, createReadOnlyMcpValidationRule()];\n                },\n            }),\n        )\n        .use(\n            '/',\n            requireSessionForGraphql(authConfig),\n            csrfProtection,\n            createHandler({\n                schema,\n                context: createGraphqlContext(authConfig),\n            }),\n        );\n};\n"],"mappings":"AAAA,SAAsC,cAAc;AACpD,SAAS,qBAAqB;AAE9B,SAAS,sBAAsB,wBAAwB,gCAAgC;AAEvF,SAAS,yBAAyB,uCAAuC;AACzE,OAAO,YAAY;AAKnB,MAAM,uBAAuB,CAAC,eAA2B,CAAC,SAAgC;AAAA,EACtF,UAAU,WAAW;AAAA,EACrB,iBAAiB,uBAAuB,IAAI,GAAG;AAAA,EAC/C,KAAK,IAAI;AAAA,EACT,KAAK,IAAI,QAAQ;AACrB;AAEO,MAAM,sBAAsB,CAAC,YAAwB,oBAAuC;AAC/F,QAAM,iBAAiB,qBAAqB,UAAU;AAEtD,SAAO,OAAO,EACT;AAAA,IACG;AAAA,IACA,wBAAwB,YAAY,eAAe;AAAA,IACnD,cAAc;AAAA,MACV;AAAA,MACA,SAAS,qBAAqB,UAAU;AAAA,MACxC,iBAAiB,CAAC,MAAM,OAAO,mBAAmB;AAC9C,eAAO,CAAC,GAAG,gBAAgB,gCAAgC,CAAC;AAAA,MAChE;AAAA,IACJ,CAAC;AAAA,EACL,EACC;AAAA,IACG;AAAA,IACA,yBAAyB,UAAU;AAAA,IACnC;AAAA,IACA,cAAc;AAAA,MACV;AAAA,MACA,SAAS,qBAAqB,UAAU;AAAA,IAC5C,CAAC;AAAA,EACL;AACR;","names":[]}