omegga 1.5.2 → 1.6.0

package/dist/webserver/backend/scopes.js

@@ -0,0 +1,303 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const ScopeDomain = {
+  Chat: "chat",
+  Player: "player",
+  Plugin: "plugin",
+  Server: "server",
+  User: "user",
+  World: "world",
+  Role: "role",
+  Session: "session"
+};
+const ScopeName = {
+  ChatSend: "chat.send",
+  ChatRecent: "chat.recent",
+  ChatHistory: "chat.history",
+  ChatCalendar: "chat.calendar",
+  PlayerList: "player.list",
+  PlayerGet: "player.get",
+  PlayerBan: "player.ban",
+  PlayerKick: "player.kick",
+  PlayerUnban: "player.unban",
+  PlayerClearBricks: "player.clearBricks",
+  PluginList: "plugin.list",
+  PluginGet: "plugin.get",
+  PluginConfig: "plugin.config",
+  PluginLoad: "plugin.load",
+  PluginUnload: "plugin.unload",
+  PluginToggle: "plugin.toggle",
+  PluginReloadAll: "plugin.reloadAll",
+  ServerStatus: "server.status",
+  ServerStart: "server.start",
+  ServerStop: "server.stop",
+  ServerRestart: "server.restart",
+  ServerUpdateCheck: "server.update.check",
+  ServerUpdateRun: "server.update.run",
+  ServerAutorestartGet: "server.autorestart.get",
+  ServerAutorestartSet: "server.autorestart.set",
+  ServerUtilization: "server.utilization",
+  UserList: "user.list",
+  UserCreate: "user.create",
+  UserPasswd: "user.passwd",
+  UserBan: "user.ban",
+  UserDelete: "user.delete",
+  UserPermissions: "user.permissions",
+  UserReadMfa: "user.readMfa",
+  UserResetMfa: "user.resetMfa",
+  WorldList: "world.list",
+  WorldActive: "world.active",
+  WorldNext: "world.next",
+  WorldRevisions: "world.revisions",
+  WorldMeta: "world.meta",
+  WorldLoad: "world.load",
+  WorldUse: "world.use",
+  WorldSave: "world.save",
+  WorldCreate: "world.create",
+  RoleList: "role.list",
+  SessionInfo: "session.info"
+};
+const S = ScopeName;
+const D = ScopeDomain;
+const SCOPES = {
+  // Chat
+  [S.ChatSend]: {
+    description: "Send chat messages",
+    readOnly: false,
+    domain: D.Chat
+  },
+  [S.ChatRecent]: {
+    description: "View recent chat messages",
+    readOnly: true,
+    domain: D.Chat
+  },
+  [S.ChatHistory]: {
+    description: "View chat history",
+    readOnly: true,
+    domain: D.Chat
+  },
+  [S.ChatCalendar]: {
+    description: "View chat calendar",
+    readOnly: true,
+    domain: D.Chat
+  },
+  // Player
+  [S.PlayerList]: {
+    description: "View player list",
+    readOnly: true,
+    domain: D.Player
+  },
+  [S.PlayerGet]: {
+    description: "View player details",
+    readOnly: true,
+    domain: D.Player
+  },
+  [S.PlayerBan]: {
+    description: "Ban players",
+    readOnly: false,
+    domain: D.Player
+  },
+  [S.PlayerKick]: {
+    description: "Kick players",
+    readOnly: false,
+    domain: D.Player
+  },
+  [S.PlayerUnban]: {
+    description: "Unban players",
+    readOnly: false,
+    domain: D.Player
+  },
+  [S.PlayerClearBricks]: {
+    description: "Clear player bricks",
+    readOnly: false,
+    domain: D.Player
+  },
+  // Plugin
+  [S.PluginList]: {
+    description: "View plugin list",
+    readOnly: true,
+    domain: D.Plugin
+  },
+  [S.PluginGet]: {
+    description: "View plugin details",
+    readOnly: true,
+    domain: D.Plugin
+  },
+  [S.PluginConfig]: {
+    description: "Change plugin configuration",
+    readOnly: false,
+    domain: D.Plugin
+  },
+  [S.PluginLoad]: {
+    description: "Load plugins",
+    readOnly: false,
+    domain: D.Plugin
+  },
+  [S.PluginUnload]: {
+    description: "Unload plugins",
+    readOnly: false,
+    domain: D.Plugin
+  },
+  [S.PluginToggle]: {
+    description: "Enable/disable plugins",
+    readOnly: false,
+    domain: D.Plugin
+  },
+  [S.PluginReloadAll]: {
+    description: "Reload all plugins",
+    readOnly: false,
+    domain: D.Plugin
+  },
+  // Server
+  [S.ServerStatus]: {
+    description: "View server status",
+    readOnly: true,
+    domain: D.Server
+  },
+  [S.ServerStart]: {
+    description: "Start the server",
+    readOnly: false,
+    domain: D.Server
+  },
+  [S.ServerStop]: {
+    description: "Stop the server",
+    readOnly: false,
+    domain: D.Server
+  },
+  [S.ServerRestart]: {
+    description: "Restart the server",
+    readOnly: false,
+    domain: D.Server
+  },
+  [S.ServerUpdateCheck]: {
+    description: "Check for server updates",
+    readOnly: false,
+    domain: D.Server
+  },
+  [S.ServerUpdateRun]: {
+    description: "Update the server",
+    readOnly: false,
+    domain: D.Server
+  },
+  [S.ServerAutorestartGet]: {
+    description: "View auto-restart config",
+    readOnly: true,
+    domain: D.Server
+  },
+  [S.ServerAutorestartSet]: {
+    description: "Change auto-restart config",
+    readOnly: false,
+    domain: D.Server
+  },
+  [S.ServerUtilization]: {
+    description: "View current system utilization",
+    readOnly: true,
+    domain: D.Server
+  },
+  // User
+  [S.UserList]: {
+    description: "View web UI users",
+    readOnly: true,
+    domain: D.User
+  },
+  [S.UserCreate]: {
+    description: "Create web UI users",
+    readOnly: false,
+    domain: D.User
+  },
+  [S.UserPasswd]: {
+    description: "Change user passwords",
+    readOnly: false,
+    domain: D.User
+  },
+  [S.UserBan]: {
+    description: "Disable/enable web UI users",
+    readOnly: false,
+    domain: D.User
+  },
+  [S.UserDelete]: {
+    description: "Delete web UI users",
+    readOnly: false,
+    domain: D.User
+  },
+  [S.UserPermissions]: {
+    description: "Manage user permissions",
+    readOnly: false,
+    domain: D.User
+  },
+  [S.UserReadMfa]: {
+    description: "View MFA status of other users",
+    readOnly: true,
+    domain: D.User
+  },
+  [S.UserResetMfa]: {
+    description: "Reset MFA for other users",
+    readOnly: false,
+    domain: D.User
+  },
+  // World
+  [S.WorldList]: {
+    description: "View world list",
+    readOnly: true,
+    domain: D.World
+  },
+  [S.WorldActive]: {
+    description: "View active world",
+    readOnly: true,
+    domain: D.World
+  },
+  [S.WorldNext]: {
+    description: "View next world",
+    readOnly: true,
+    domain: D.World
+  },
+  [S.WorldRevisions]: {
+    description: "View world revisions",
+    readOnly: true,
+    domain: D.World
+  },
+  [S.WorldMeta]: {
+    description: "View world metadata",
+    readOnly: true,
+    domain: D.World
+  },
+  [S.WorldLoad]: {
+    description: "Load worlds",
+    readOnly: false,
+    domain: D.World
+  },
+  [S.WorldUse]: {
+    description: "Set default world",
+    readOnly: false,
+    domain: D.World
+  },
+  [S.WorldSave]: {
+    description: "Save worlds",
+    readOnly: false,
+    domain: D.World
+  },
+  [S.WorldCreate]: {
+    description: "Create worlds",
+    readOnly: false,
+    domain: D.World
+  },
+  // Role
+  [S.RoleList]: {
+    description: "View server roles",
+    readOnly: true,
+    domain: D.Role
+  },
+  // Session
+  [S.SessionInfo]: {
+    description: "View session info",
+    readOnly: true,
+    domain: D.Session
+  }
+};
+[
+  ...new Set(Object.values(SCOPES).map((s) => s.domain))
+];
+exports.SCOPES = SCOPES;
+exports.ScopeDomain = ScopeDomain;
+exports.ScopeName = ScopeName;
+//# sourceMappingURL=scopes.js.map

package/dist/webserver/backend/scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.js","sources":["../../../src/webserver/backend/scopes.ts"],"sourcesContent":["export const ScopeDomain = {\n  Chat: 'chat',\n  Player: 'player',\n  Plugin: 'plugin',\n  Server: 'server',\n  User: 'user',\n  World: 'world',\n  Role: 'role',\n  Session: 'session',\n} as const;\n\nexport const ScopeName = {\n  ChatSend: 'chat.send',\n  ChatRecent: 'chat.recent',\n  ChatHistory: 'chat.history',\n  ChatCalendar: 'chat.calendar',\n\n  PlayerList: 'player.list',\n  PlayerGet: 'player.get',\n  PlayerBan: 'player.ban',\n  PlayerKick: 'player.kick',\n  PlayerUnban: 'player.unban',\n  PlayerClearBricks: 'player.clearBricks',\n\n  PluginList: 'plugin.list',\n  PluginGet: 'plugin.get',\n  PluginConfig: 'plugin.config',\n  PluginLoad: 'plugin.load',\n  PluginUnload: 'plugin.unload',\n  PluginToggle: 'plugin.toggle',\n  PluginReloadAll: 'plugin.reloadAll',\n\n  ServerStatus: 'server.status',\n  ServerStart: 'server.start',\n  ServerStop: 'server.stop',\n  ServerRestart: 'server.restart',\n  ServerUpdateCheck: 'server.update.check',\n  ServerUpdateRun: 'server.update.run',\n  ServerAutorestartGet: 'server.autorestart.get',\n  ServerAutorestartSet: 'server.autorestart.set',\n  ServerUtilization: 'server.utilization',\n\n  UserList: 'user.list',\n  UserCreate: 'user.create',\n  UserPasswd: 'user.passwd',\n  UserBan: 'user.ban',\n  UserDelete: 'user.delete',\n  UserPermissions: 'user.permissions',\n  UserReadMfa: 'user.readMfa',\n  UserResetMfa: 'user.resetMfa',\n\n  WorldList: 'world.list',\n  WorldActive: 'world.active',\n  WorldNext: 'world.next',\n  WorldRevisions: 'world.revisions',\n  WorldMeta: 'world.meta',\n  WorldLoad: 'world.load',\n  WorldUse: 'world.use',\n  WorldSave: 'world.save',\n  WorldCreate: 'world.create',\n\n  RoleList: 'role.list',\n\n  SessionInfo: 'session.info',\n} as const;\n\nconst S = ScopeName;\nconst D = ScopeDomain;\n\nexport const SCOPES = {\n  // Chat\n  [S.ChatSend]: {\n    description: 'Send chat messages',\n    readOnly: false,\n    domain: D.Chat,\n  },\n  [S.ChatRecent]: {\n    description: 'View recent chat messages',\n    readOnly: true,\n    domain: D.Chat,\n  },\n  [S.ChatHistory]: {\n    description: 'View chat history',\n    readOnly: true,\n    domain: D.Chat,\n  },\n  [S.ChatCalendar]: {\n    description: 'View chat calendar',\n    readOnly: true,\n    domain: D.Chat,\n  },\n\n  // Player\n  [S.PlayerList]: {\n    description: 'View player list',\n    readOnly: true,\n    domain: D.Player,\n  },\n  [S.PlayerGet]: {\n    description: 'View player details',\n    readOnly: true,\n    domain: D.Player,\n  },\n  [S.PlayerBan]: {\n    description: 'Ban players',\n    readOnly: false,\n    domain: D.Player,\n  },\n  [S.PlayerKick]: {\n    description: 'Kick players',\n    readOnly: false,\n    domain: D.Player,\n  },\n  [S.PlayerUnban]: {\n    description: 'Unban players',\n    readOnly: false,\n    domain: D.Player,\n  },\n  [S.PlayerClearBricks]: {\n    description: 'Clear player bricks',\n    readOnly: false,\n    domain: D.Player,\n  },\n\n  // Plugin\n  [S.PluginList]: {\n    description: 'View plugin list',\n    readOnly: true,\n    domain: D.Plugin,\n  },\n  [S.PluginGet]: {\n    description: 'View plugin details',\n    readOnly: true,\n    domain: D.Plugin,\n  },\n  [S.PluginConfig]: {\n    description: 'Change plugin configuration',\n    readOnly: false,\n    domain: D.Plugin,\n  },\n  [S.PluginLoad]: {\n    description: 'Load plugins',\n    readOnly: false,\n    domain: D.Plugin,\n  },\n  [S.PluginUnload]: {\n    description: 'Unload plugins',\n    readOnly: false,\n    domain: D.Plugin,\n  },\n  [S.PluginToggle]: {\n    description: 'Enable/disable plugins',\n    readOnly: false,\n    domain: D.Plugin,\n  },\n  [S.PluginReloadAll]: {\n    description: 'Reload all plugins',\n    readOnly: false,\n    domain: D.Plugin,\n  },\n\n  // Server\n  [S.ServerStatus]: {\n    description: 'View server status',\n    readOnly: true,\n    domain: D.Server,\n  },\n  [S.ServerStart]: {\n    description: 'Start the server',\n    readOnly: false,\n    domain: D.Server,\n  },\n  [S.ServerStop]: {\n    description: 'Stop the server',\n    readOnly: false,\n    domain: D.Server,\n  },\n  [S.ServerRestart]: {\n    description: 'Restart the server',\n    readOnly: false,\n    domain: D.Server,\n  },\n  [S.ServerUpdateCheck]: {\n    description: 'Check for server updates',\n    readOnly: false,\n    domain: D.Server,\n  },\n  [S.ServerUpdateRun]: {\n    description: 'Update the server',\n    readOnly: false,\n    domain: D.Server,\n  },\n  [S.ServerAutorestartGet]: {\n    description: 'View auto-restart config',\n    readOnly: true,\n    domain: D.Server,\n  },\n  [S.ServerAutorestartSet]: {\n    description: 'Change auto-restart config',\n    readOnly: false,\n    domain: D.Server,\n  },\n  [S.ServerUtilization]: {\n    description: 'View current system utilization',\n    readOnly: true,\n    domain: D.Server,\n  },\n\n  // User\n  [S.UserList]: {\n    description: 'View web UI users',\n    readOnly: true,\n    domain: D.User,\n  },\n  [S.UserCreate]: {\n    description: 'Create web UI users',\n    readOnly: false,\n    domain: D.User,\n  },\n  [S.UserPasswd]: {\n    description: 'Change user passwords',\n    readOnly: false,\n    domain: D.User,\n  },\n  [S.UserBan]: {\n    description: 'Disable/enable web UI users',\n    readOnly: false,\n    domain: D.User,\n  },\n  [S.UserDelete]: {\n    description: 'Delete web UI users',\n    readOnly: false,\n    domain: D.User,\n  },\n  [S.UserPermissions]: {\n    description: 'Manage user permissions',\n    readOnly: false,\n    domain: D.User,\n  },\n  [S.UserReadMfa]: {\n    description: 'View MFA status of other users',\n    readOnly: true,\n    domain: D.User,\n  },\n  [S.UserResetMfa]: {\n    description: 'Reset MFA for other users',\n    readOnly: false,\n    domain: D.User,\n  },\n\n  // World\n  [S.WorldList]: {\n    description: 'View world list',\n    readOnly: true,\n    domain: D.World,\n  },\n  [S.WorldActive]: {\n    description: 'View active world',\n    readOnly: true,\n    domain: D.World,\n  },\n  [S.WorldNext]: {\n    description: 'View next world',\n    readOnly: true,\n    domain: D.World,\n  },\n  [S.WorldRevisions]: {\n    description: 'View world revisions',\n    readOnly: true,\n    domain: D.World,\n  },\n  [S.WorldMeta]: {\n    description: 'View world metadata',\n    readOnly: true,\n    domain: D.World,\n  },\n  [S.WorldLoad]: {\n    description: 'Load worlds',\n    readOnly: false,\n    domain: D.World,\n  },\n  [S.WorldUse]: {\n    description: 'Set default world',\n    readOnly: false,\n    domain: D.World,\n  },\n  [S.WorldSave]: {\n    description: 'Save worlds',\n    readOnly: false,\n    domain: D.World,\n  },\n  [S.WorldCreate]: {\n    description: 'Create worlds',\n    readOnly: false,\n    domain: D.World,\n  },\n\n  // Role\n  [S.RoleList]: {\n    description: 'View server roles',\n    readOnly: true,\n    domain: D.Role,\n  },\n\n  // Session\n  [S.SessionInfo]: {\n    description: 'View session info',\n    readOnly: true,\n    domain: D.Session,\n  },\n} as const;\n\nexport type Scope = keyof typeof SCOPES;\n\nexport const DOMAINS = [\n  ...new Set(Object.values(SCOPES).map(s => s.domain)),\n] as const;\n\nexport type Domain = (typeof DOMAINS)[number];\n"],"names":[],"mappings":";;AAAO,MAAM,cAAc;AAAA,EACzB,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,OAAO;AAAA,EACP,MAAM;AAAA,EACN,SAAS;AACX;AAEO,MAAM,YAAY;AAAA,EACvB,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,cAAc;AAAA,EAEd,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,mBAAmB;AAAA,EAEnB,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EACd,iBAAiB;AAAA,EAEjB,cAAc;AAAA,EACd,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,sBAAsB;AAAA,EACtB,sBAAsB;AAAA,EACtB,mBAAmB;AAAA,EAEnB,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,aAAa;AAAA,EACb,cAAc;AAAA,EAEd,WAAW;AAAA,EACX,aAAa;AAAA,EACb,WAAW;AAAA,EACX,gBAAgB;AAAA,EAChB,WAAW;AAAA,EACX,WAAW;AAAA,EACX,UAAU;AAAA,EACV,WAAW;AAAA,EACX,aAAa;AAAA,EAEb,UAAU;AAAA,EAEV,aAAa;AACf;AAEA,MAAM,IAAI;AACV,MAAM,IAAI;AAEH,MAAM,SAAS;AAAA;AAAA,EAEpB,CAAC,EAAE,QAAQ,GAAG;AAAA,IACZ,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,UAAU,GAAG;AAAA,IACd,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,WAAW,GAAG;AAAA,IACf,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,YAAY,GAAG;AAAA,IAChB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA;AAAA,EAIZ,CAAC,EAAE,UAAU,GAAG;AAAA,IACd,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,SAAS,GAAG;AAAA,IACb,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,SAAS,GAAG;AAAA,IACb,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,UAAU,GAAG;AAAA,IACd,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,WAAW,GAAG;AAAA,IACf,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,iBAAiB,GAAG;AAAA,IACrB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA;AAAA,EAIZ,CAAC,EAAE,UAAU,GAAG;AAAA,IACd,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,SAAS,GAAG;AAAA,IACb,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,YAAY,GAAG;AAAA,IAChB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,UAAU,GAAG;AAAA,IACd,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,YAAY,GAAG;AAAA,IAChB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,YAAY,GAAG;AAAA,IAChB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,eAAe,GAAG;AAAA,IACnB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA;AAAA,EAIZ,CAAC,EAAE,YAAY,GAAG;AAAA,IAChB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,WAAW,GAAG;AAAA,IACf,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,UAAU,GAAG;AAAA,IACd,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,aAAa,GAAG;AAAA,IACjB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,iBAAiB,GAAG;AAAA,IACrB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,eAAe,GAAG;AAAA,IACnB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,oBAAoB,GAAG;AAAA,IACxB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,oBAAoB,GAAG;AAAA,IACxB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,iBAAiB,GAAG;AAAA,IACrB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA;AAAA,EAIZ,CAAC,EAAE,QAAQ,GAAG;AAAA,IACZ,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,UAAU,GAAG;AAAA,IACd,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,UAAU,GAAG;AAAA,IACd,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,OAAO,GAAG;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,UAAU,GAAG;AAAA,IACd,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,eAAe,GAAG;AAAA,IACnB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,WAAW,GAAG;AAAA,IACf,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,YAAY,GAAG;AAAA,IAChB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA;AAAA,EAIZ,CAAC,EAAE,SAAS,GAAG;AAAA,IACb,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,WAAW,GAAG;AAAA,IACf,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,SAAS,GAAG;AAAA,IACb,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,cAAc,GAAG;AAAA,IAClB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,SAAS,GAAG;AAAA,IACb,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,SAAS,GAAG;AAAA,IACb,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,QAAQ,GAAG;AAAA,IACZ,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,SAAS,GAAG;AAAA,IACb,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,WAAW,GAAG;AAAA,IACf,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA;AAAA,EAIZ,CAAC,EAAE,QAAQ,GAAG;AAAA,IACZ,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA;AAAA,EAIZ,CAAC,EAAE,WAAW,GAAG;AAAA,IACf,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAEd;AAIuB;AAAA,EACrB,GAAG,IAAI,IAAI,OAAO,OAAO,MAAM,EAAE,IAAI,CAAA,MAAK,EAAE,MAAM,CAAC;AACrD;;;;"}

package/dist/webserver/backend/totp.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const otpauth = require("otpauth");
+const ISSUER = "Omegga";
+const DIGITS = 6;
+const PERIOD = 30;
+const ALGORITHM = "SHA1";
+function makeTOTP(secret, label = "") {
+  return new otpauth.TOTP({
+    issuer: ISSUER,
+    label,
+    algorithm: ALGORITHM,
+    digits: DIGITS,
+    period: PERIOD,
+    secret: otpauth.Secret.fromBase32(secret)
+  });
+}
+function generateSecret() {
+  return new otpauth.Secret().base32;
+}
+function verifyToken(token, secret, window = 1) {
+  if (!/^\d{6}$/.test(token)) return false;
+  const delta = makeTOTP(secret).validate({ token, window });
+  return delta !== null;
+}
+function generateURI(secret, username) {
+  return makeTOTP(secret, username).toString();
+}
+exports.generateSecret = generateSecret;
+exports.generateURI = generateURI;
+exports.verifyToken = verifyToken;
+//# sourceMappingURL=totp.js.map

package/dist/webserver/backend/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sources":["../../../src/webserver/backend/totp.ts"],"sourcesContent":["import { TOTP, Secret } from 'otpauth';\n\nconst ISSUER = 'Omegga';\nconst DIGITS = 6;\nconst PERIOD = 30;\nconst ALGORITHM = 'SHA1';\n\nfunction makeTOTP(secret: string, label = ''): TOTP {\n  return new TOTP({\n    issuer: ISSUER,\n    label,\n    algorithm: ALGORITHM,\n    digits: DIGITS,\n    period: PERIOD,\n    secret: Secret.fromBase32(secret),\n  });\n}\n\nexport function generateSecret(): string {\n  return new Secret().base32;\n}\n\nexport function generateToken(secret: string): string {\n  return makeTOTP(secret).generate();\n}\n\nexport function verifyToken(\n  token: string,\n  secret: string,\n  window = 1,\n): boolean {\n  if (!/^\\d{6}$/.test(token)) return false;\n  const delta = makeTOTP(secret).validate({ token, window });\n  return delta !== null;\n}\n\nexport function generateURI(secret: string, username: string): string {\n  return makeTOTP(secret, username).toString();\n}\n"],"names":["TOTP","Secret"],"mappings":";;;AAEA,MAAM,SAAS;AACf,MAAM,SAAS;AACf,MAAM,SAAS;AACf,MAAM,YAAY;AAElB,SAAS,SAAS,QAAgB,QAAQ,IAAU;AAClD,SAAO,IAAIA,QAAAA,KAAK;AAAA,IACd,QAAQ;AAAA,IACR;AAAA,IACA,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQC,QAAAA,OAAO,WAAW,MAAM;AAAA,EAAA,CACjC;AACH;AAEO,SAAS,iBAAyB;AACvC,SAAO,IAAIA,QAAAA,SAAS;AACtB;AAMO,SAAS,YACd,OACA,QACA,SAAS,GACA;AACT,MAAI,CAAC,UAAU,KAAK,KAAK,EAAG,QAAO;AACnC,QAAM,QAAQ,SAAS,MAAM,EAAE,SAAS,EAAE,OAAO,QAAQ;AACzD,SAAO,UAAU;AACnB;AAEO,SAAS,YAAY,QAAgB,UAA0B;AACpE,SAAO,SAAS,QAAQ,QAAQ,EAAE,SAAA;AACpC;;;;"}

package/dist/webserver/backend/trpc.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const logger = require("../../logger.js");
 const server = require("@trpc/server");
+const events = require("./events.js");
+const permissions = require("./permissions.js");
 let _deps = null;
 function setContextDeps(deps) {
   _deps = deps;
@@ -13,7 +15,11 @@ function getContextDeps() {
 async function createContext(opts) {
   const { database } = getContextDeps();
   const req = opts.req;
-  const userId = req.session?.userId;
+  const session = req.session;
+  if (session?.mfaPending) {
+    throw new server.TRPCError({ code: "UNAUTHORIZED" });
+  }
+  const userId = session?.userId;
   const user = await database.findUserById(userId);
   if (!user || user.isBanned) {
     throw new server.TRPCError({ code: "UNAUTHORIZED" });
@@ -23,21 +29,58 @@ async function createContext(opts) {
     { $set: { lastOnline: Date.now() } }
   );
   const usernameText = `[${(user.username || "Admin").brightMagenta}]`;
+  let _userAbort = null;
+  const getUserAbort = () => {
+    if (!_userAbort) {
+      _userAbort = new AbortController();
+      const ac = _userAbort;
+      const onInvalidated = (name) => {
+        if (name === user.username) ac.abort();
+      };
+      events.serverEvents.on("userInvalidated", onInvalidated);
+      ac.signal.addEventListener("abort", () => {
+        events.serverEvents.off("userInvalidated", onInvalidated);
+      });
+    }
+    return _userAbort;
+  };
   return {
     user,
+    req,
+    get userAbort() {
+      return getUserAbort();
+    },
     log: (...args) => logger.default.logp(usernameText, ...args),
     error: (...args) => logger.default.errorp(usernameText, ...args)
   };
 }
-const t = server.initTRPC.context().create();
+const t = server.initTRPC.context().create({
+  errorFormatter({ shape, error, path, ctx }) {
+    const user = ctx?.user?.username || "?";
+    logger.default.errorp(
+      `[${user.brightMagenta}]`,
+      `${error.code} ${path ?? "?"}: ${error.message}`
+    );
+    return shape;
+  }
+});
 const router = t.router;
 t.procedure;
 const mergeRouters = t.mergeRouters;
-const requireScope = (scope) => t.middleware(({ ctx, next }) => {
+const requireScope = (scope) => t.middleware(async ({ ctx, next }) => {
   if (!ctx.user) throw new server.TRPCError({ code: "UNAUTHORIZED" });
+  if (ctx.user.isOwner) return next({ ctx });
+  const { database } = getContextDeps();
+  const defaults = await database.getDefaultPermissions();
+  if (!permissions.userHasScope(ctx.user, scope, defaults)) {
+    throw new server.TRPCError({
+      code: "FORBIDDEN",
+      message: `missing scope: ${scope}`
+    });
+  }
   return next({ ctx });
 });
-const protectedProcedure = (scope) => t.procedure.use(requireScope());
+const protectedProcedure = (scope) => t.procedure.use(requireScope(scope));
 exports.createContext = createContext;
 exports.getContextDeps = getContextDeps;
 exports.mergeRouters = mergeRouters;

package/dist/webserver/backend/trpc.js.map

@@ -1 +1 @@
-{"version":3,"file":"trpc.js","sources":["../../../src/webserver/backend/trpc.ts"],"sourcesContent":["import Logger from '@/logger';\nimport type Omegga from '@omegga/server';\nimport { initTRPC, TRPCError } from '@trpc/server';\nimport type { CreateExpressContextOptions } from '@trpc/server/adapters/express';\nimport type Database from './database';\nimport type { Scope } from './scopes';\nimport type { IStoreUser } from './types';\n\nexport type ContextDeps = {\n  database: Database;\n  omegga: Omegga;\n};\n\nlet _deps: ContextDeps | null = null;\n\nexport function setContextDeps(deps: ContextDeps) {\n  _deps = deps;\n}\n\nexport function getContextDeps(): ContextDeps {\n  if (!_deps) throw new Error('tRPC context deps not initialized');\n  return _deps;\n}\n\nexport type Context = {\n  user: IStoreUser & { _id: string };\n  log: (...args: any[]) => void;\n  error: (...args: any[]) => void;\n};\n\nexport async function createContext(\n  opts: CreateExpressContextOptions,\n): Promise<Context> {\n  const { database } = getContextDeps();\n  const req = opts.req;\n\n  const userId = (req as any).session?.userId;\n  const user = await database.findUserById(userId);\n  if (!user || user.isBanned) {\n    throw new TRPCError({ code: 'UNAUTHORIZED' });\n  }\n\n  // Update lastOnline (migrated from Socket.IO connect handler)\n  await database.stores.users.update<IStoreUser>(\n    { _id: user._id },\n    { $set: { lastOnline: Date.now() } },\n  );\n\n  const usernameText = `[${(user.username || 'Admin').brightMagenta}]`;\n\n  return {\n    user,\n    log: (...args: any[]) => Logger.logp(usernameText, ...args),\n    error: (...args: any[]) => Logger.errorp(usernameText, ...args),\n  };\n}\n\nconst t = initTRPC.context<Context>().create();\n\nexport const router = t.router;\nexport const publicProcedure = t.procedure;\nexport const mergeRouters = t.mergeRouters;\n\nexport const requireScope = (scope: Scope) =>\n  t.middleware(({ ctx, next }) => {\n    if (!ctx.user) throw new TRPCError({ code: 'UNAUTHORIZED' });\n    // TODO: check ctx.user.roles against scope\n    // For now, all authenticated users pass\n    return next({ ctx });\n  });\n\nexport const protectedProcedure = (scope: Scope) =>\n  t.procedure.use(requireScope(scope));\n"],"names":["TRPCError","Logger","initTRPC"],"mappings":";;;;AAaA,IAAI,QAA4B;AAEzB,SAAS,eAAe,MAAmB;AAChD,UAAQ;AACV;AAEO,SAAS,iBAA8B;AAC5C,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,mCAAmC;AAC/D,SAAO;AACT;AAQA,eAAsB,cACpB,MACkB;AAClB,QAAM,EAAE,SAAA,IAAa,eAAA;AACrB,QAAM,MAAM,KAAK;AAEjB,QAAM,SAAU,IAAY,SAAS;AACrC,QAAM,OAAO,MAAM,SAAS,aAAa,MAAM;AAC/C,MAAI,CAAC,QAAQ,KAAK,UAAU;AAC1B,UAAM,IAAIA,OAAAA,UAAU,EAAE,MAAM,gBAAgB;AAAA,EAC9C;AAGA,QAAM,SAAS,OAAO,MAAM;AAAA,IAC1B,EAAE,KAAK,KAAK,IAAA;AAAA,IACZ,EAAE,MAAM,EAAE,YAAY,KAAK,IAAA,IAAM;AAAA,EAAE;AAGrC,QAAM,eAAe,KAAK,KAAK,YAAY,SAAS,aAAa;AAEjE,SAAO;AAAA,IACL;AAAA,IACA,KAAK,IAAI,SAAgBC,OAAAA,QAAO,KAAK,cAAc,GAAG,IAAI;AAAA,IAC1D,OAAO,IAAI,SAAgBA,OAAAA,QAAO,OAAO,cAAc,GAAG,IAAI;AAAA,EAAA;AAElE;AAEA,MAAM,IAAIC,OAAAA,SAAS,QAAA,EAAmB,OAAA;AAE/B,MAAM,SAAS,EAAE;AACO,EAAE;AAC1B,MAAM,eAAe,EAAE;AAEvB,MAAM,eAAe,CAAC,UAC3B,EAAE,WAAW,CAAC,EAAE,KAAK,WAAW;AAC9B,MAAI,CAAC,IAAI,KAAM,OAAM,IAAIF,OAAAA,UAAU,EAAE,MAAM,gBAAgB;AAG3D,SAAO,KAAK,EAAE,KAAK;AACrB,CAAC;AAEI,MAAM,qBAAqB,CAAC,UACjC,EAAE,UAAU,IAAI,aAAkB,CAAC;;;;;;;;"}
+{"version":3,"file":"trpc.js","sources":["../../../src/webserver/backend/trpc.ts"],"sourcesContent":["import Logger from '@/logger';\nimport type Omegga from '@omegga/server';\nimport { initTRPC, TRPCError } from '@trpc/server';\nimport type { CreateExpressContextOptions } from '@trpc/server/adapters/express';\nimport type Database from './database';\nimport { serverEvents } from './events';\nimport { userHasScope } from './permissions';\nimport type { Scope } from './scopes';\nimport type { IStoreUser } from './types';\n\nexport type ContextDeps = {\n  database: Database;\n  omegga: Omegga;\n};\n\nlet _deps: ContextDeps | null = null;\n\nexport function setContextDeps(deps: ContextDeps) {\n  _deps = deps;\n}\n\nexport function getContextDeps(): ContextDeps {\n  if (!_deps) throw new Error('tRPC context deps not initialized');\n  return _deps;\n}\n\nexport type Context = {\n  user: IStoreUser & { _id: string };\n  req: import('express').Request;\n  userAbort: AbortController;\n  log: (...args: any[]) => void;\n  error: (...args: any[]) => void;\n};\n\nexport async function createContext(\n  opts: CreateExpressContextOptions,\n): Promise<Context> {\n  const { database } = getContextDeps();\n  const req = opts.req;\n\n  const session = (req as any).session;\n  if (session?.mfaPending) {\n    throw new TRPCError({ code: 'UNAUTHORIZED' });\n  }\n  const userId = session?.userId;\n  const user = await database.findUserById(userId);\n  if (!user || user.isBanned) {\n    throw new TRPCError({ code: 'UNAUTHORIZED' });\n  }\n\n  // Update lastOnline (migrated from Socket.IO connect handler)\n  await database.stores.users.update<IStoreUser>(\n    { _id: user._id },\n    { $set: { lastOnline: Date.now() } },\n  );\n\n  const usernameText = `[${(user.username || 'Admin').brightMagenta}]`;\n\n  let _userAbort: AbortController | null = null;\n  const getUserAbort = () => {\n    if (!_userAbort) {\n      _userAbort = new AbortController();\n      const ac = _userAbort;\n      const onInvalidated = (name: string) => {\n        if (name === user.username) ac.abort();\n      };\n      serverEvents.on('userInvalidated', onInvalidated);\n      ac.signal.addEventListener('abort', () => {\n        serverEvents.off('userInvalidated', onInvalidated);\n      });\n    }\n    return _userAbort;\n  };\n\n  return {\n    user,\n    req,\n    get userAbort() {\n      return getUserAbort();\n    },\n    log: (...args: any[]) => Logger.logp(usernameText, ...args),\n    error: (...args: any[]) => Logger.errorp(usernameText, ...args),\n  };\n}\n\nconst t = initTRPC.context<Context>().create({\n  errorFormatter({ shape, error, path, ctx }) {\n    const user = (ctx as Context | undefined)?.user?.username || '?';\n    Logger.errorp(\n      `[${user.brightMagenta}]`,\n      `${error.code} ${path ?? '?'}: ${error.message}`,\n    );\n    return shape;\n  },\n});\n\nexport const router = t.router;\nexport const publicProcedure = t.procedure;\nexport const mergeRouters = t.mergeRouters;\n\nexport const requireScope = (scope: Scope) =>\n  t.middleware(async ({ ctx, next }) => {\n    if (!ctx.user) throw new TRPCError({ code: 'UNAUTHORIZED' });\n    if (ctx.user.isOwner) return next({ ctx });\n    const { database } = getContextDeps();\n    const defaults = await database.getDefaultPermissions();\n    if (!userHasScope(ctx.user, scope, defaults)) {\n      throw new TRPCError({\n        code: 'FORBIDDEN',\n        message: `missing scope: ${scope}`,\n      });\n    }\n    return next({ ctx });\n  });\n\nexport const protectedProcedure = (scope: Scope) =>\n  t.procedure.use(requireScope(scope));\n"],"names":["TRPCError","serverEvents","Logger","initTRPC","userHasScope"],"mappings":";;;;;;AAeA,IAAI,QAA4B;AAEzB,SAAS,eAAe,MAAmB;AAChD,UAAQ;AACV;AAEO,SAAS,iBAA8B;AAC5C,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,mCAAmC;AAC/D,SAAO;AACT;AAUA,eAAsB,cACpB,MACkB;AAClB,QAAM,EAAE,SAAA,IAAa,eAAA;AACrB,QAAM,MAAM,KAAK;AAEjB,QAAM,UAAW,IAAY;AAC7B,MAAI,SAAS,YAAY;AACvB,UAAM,IAAIA,OAAAA,UAAU,EAAE,MAAM,gBAAgB;AAAA,EAC9C;AACA,QAAM,SAAS,SAAS;AACxB,QAAM,OAAO,MAAM,SAAS,aAAa,MAAM;AAC/C,MAAI,CAAC,QAAQ,KAAK,UAAU;AAC1B,UAAM,IAAIA,OAAAA,UAAU,EAAE,MAAM,gBAAgB;AAAA,EAC9C;AAGA,QAAM,SAAS,OAAO,MAAM;AAAA,IAC1B,EAAE,KAAK,KAAK,IAAA;AAAA,IACZ,EAAE,MAAM,EAAE,YAAY,KAAK,IAAA,IAAM;AAAA,EAAE;AAGrC,QAAM,eAAe,KAAK,KAAK,YAAY,SAAS,aAAa;AAEjE,MAAI,aAAqC;AACzC,QAAM,eAAe,MAAM;AACzB,QAAI,CAAC,YAAY;AACf,mBAAa,IAAI,gBAAA;AACjB,YAAM,KAAK;AACX,YAAM,gBAAgB,CAAC,SAAiB;AACtC,YAAI,SAAS,KAAK,SAAU,IAAG,MAAA;AAAA,MACjC;AACAC,0BAAa,GAAG,mBAAmB,aAAa;AAChD,SAAG,OAAO,iBAAiB,SAAS,MAAM;AACxCA,4BAAa,IAAI,mBAAmB,aAAa;AAAA,MACnD,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,IAAI,YAAY;AACd,aAAO,aAAA;AAAA,IACT;AAAA,IACA,KAAK,IAAI,SAAgBC,OAAAA,QAAO,KAAK,cAAc,GAAG,IAAI;AAAA,IAC1D,OAAO,IAAI,SAAgBA,OAAAA,QAAO,OAAO,cAAc,GAAG,IAAI;AAAA,EAAA;AAElE;AAEA,MAAM,IAAIC,OAAAA,SAAS,QAAA,EAAmB,OAAO;AAAA,EAC3C,eAAe,EAAE,OAAO,OAAO,MAAM,OAAO;AAC1C,UAAM,OAAQ,KAA6B,MAAM,YAAY;AAC7DD,WAAAA,QAAO;AAAA,MACL,IAAI,KAAK,aAAa;AAAA,MACtB,GAAG,MAAM,IAAI,IAAI,QAAQ,GAAG,KAAK,MAAM,OAAO;AAAA,IAAA;AAEhD,WAAO;AAAA,EACT;AACF,CAAC;AAEM,MAAM,SAAS,EAAE;AACO,EAAE;AAC1B,MAAM,eAAe,EAAE;AAEvB,MAAM,eAAe,CAAC,UAC3B,EAAE,WAAW,OAAO,EAAE,KAAK,WAAW;AACpC,MAAI,CAAC,IAAI,KAAM,OAAM,IAAIF,OAAAA,UAAU,EAAE,MAAM,gBAAgB;AAC3D,MAAI,IAAI,KAAK,gBAAgB,KAAK,EAAE,KAAK;AACzC,QAAM,EAAE,SAAA,IAAa,eAAA;AACrB,QAAM,WAAW,MAAM,SAAS,sBAAA;AAChC,MAAI,CAACI,YAAAA,aAAa,IAAI,MAAM,OAAO,QAAQ,GAAG;AAC5C,UAAM,IAAIJ,OAAAA,UAAU;AAAA,MAClB,MAAM;AAAA,MACN,SAAS,kBAAkB,KAAK;AAAA,IAAA,CACjC;AAAA,EACH;AACA,SAAO,KAAK,EAAE,KAAK;AACrB,CAAC;AAEI,MAAM,qBAAqB,CAAC,UACjC,EAAE,UAAU,IAAI,aAAa,KAAK,CAAC;;;;;;;;"}

package/doc/permissions.md

@@ -0,0 +1,193 @@
+# Web UI Permission System
+
+The web UI uses a hierarchical, purely additive permission model. Permissions can only grant access, never deny it.
+
+## Data Model
+
+Each user has a `PermissionSet`:
+
+```ts
+interface PermissionSet {
+  root: 'all' | 'read' | 'off';
+  domains: Partial<Record<Domain, 'all' | 'read'>>;
+  scopes: Partial<Record<Scope, boolean>>;
+}
+```
+
+A server-wide **default** `PermissionSet` serves as a fallback for all users.
+
+## Resolution
+
+When checking whether a user has a specific scope, the resolver walks four levels in order. The first level that produces a definite answer wins.
+
+```
+1. Owner bypass    - isOwner grants everything
+2. Root level      - 'all' grants everything; 'read' grants read-only scopes; 'off' falls through
+3. Domain level    - 'all' grants all scopes in that domain; 'read' grants read-only scopes; absent falls through
+4. Scope level     - true grants; absent falls through to defaults
+5. Default perms   - same root/domain/scope resolution, but with no further fallback
+6. Not granted     - false
+```
+
+The `readOnly` flag on each scope definition determines whether "Read Only" mode at root or domain level grants that scope.
+
+## Levels
+
+### Root
+
+| Value | UI Label | Behavior |
+|-------|----------|----------|
+| `all` | All | Grants every scope |
+| `read` | Read Only | Grants only scopes marked `readOnly: true` |
+| `off` | Manual | Falls through to domain and scope checks |
+
+### Domain
+
+| Value | UI Label | Behavior |
+|-------|----------|----------|
+| `all` | All | Grants every scope in this domain |
+| `read` | Read Only | Grants only `readOnly` scopes in this domain |
+| *(absent)* | Manual | Falls through to individual scope toggles |
+
+Domains are purely additive. Setting a domain to "Manual" removes it from the `domains` map rather than storing a deny value.
+
+### Scope
+
+Permissions are purely additive. `true` grants the scope, absent (or toggled off) falls through to defaults. There is no way to explicitly deny a scope -- toggling a scope off simply removes the user-level override so the default applies.
+
+## Domains and Scopes
+
+Each scope belongs to exactly one domain and is either read-only (R) or read-write (W).
+
+### Chat
+| Scope | R/W | Description |
+|-------|-----|-------------|
+| `chat.send` | W | Send messages in the dashboard chat widget |
+| `chat.recent` | R | View recent chat on the dashboard |
+| `chat.history` | R | Browse past chat logs in the history view |
+| `chat.calendar` | R | Navigate chat by date in the history view |
+
+### Player
+| Scope | R/W | Description |
+|-------|-----|-------------|
+| `player.list` | R | View the player list in the players view |
+| `player.get` | R | Inspect player details and history |
+| `player.ban` | W | Ban players from the player inspector |
+| `player.kick` | W | Kick players from the player inspector |
+| `player.unban` | W | Unban players from the player inspector |
+| `player.clearBricks` | W | Clear a player's bricks from the player inspector |
+
+### Plugin
+| Scope | R/W | Description |
+|-------|-----|-------------|
+| `plugin.list` | R | View installed plugins in the plugins view |
+| `plugin.get` | R | Inspect plugin details and configuration |
+| `plugin.config` | W | Edit plugin settings in the plugin inspector |
+| `plugin.load` | W | Load plugins from the plugin inspector |
+| `plugin.unload` | W | Unload plugins from the plugin inspector |
+| `plugin.toggle` | W | Enable or disable plugins in the plugins view |
+| `plugin.reloadAll` | W | Reload all plugins from the plugins view |
+
+### Server
+| Scope | R/W | Description |
+|-------|-----|-------------|
+| `server.status` | R | View server status on the dashboard and server view |
+| `server.start` | W | Start the server from the server view |
+| `server.stop` | W | Stop the server from the server view |
+| `server.restart` | W | Restart the server from the server view |
+| `server.update.check` | W | Check for server updates in the server view (runs SteamCMD) |
+| `server.update.run` | W | Run server updates from the server view |
+| `server.autorestart.get` | R | View auto-restart settings in the server view |
+| `server.autorestart.set` | W | Change auto-restart settings in the server view |
+| `server.utilization` | R | View CPU, memory, and disk usage on the dashboard |
+
+### User
+| Scope | R/W | Description |
+|-------|-----|-------------|
+| `user.list` | R | View web UI user accounts in the users view |
+| `user.create` | W | Create new user accounts in the users view |
+| `user.passwd` | W | Change other users' passwords in the user inspector |
+| `user.ban` | W | Disable or re-enable users in the user inspector |
+| `user.delete` | W | Permanently delete user accounts |
+| `user.permissions` | W | Edit user and default permissions in the users view |
+| `user.readMfa` | R | View MFA status of other users in the user inspector |
+| `user.resetMfa` | W | Reset MFA for other users in the user inspector |
+
+### World
+| Scope | R/W | Description |
+|-------|-----|-------------|
+| `world.list` | R | View available worlds in the worlds view |
+| `world.active` | R | See which world is currently loaded |
+| `world.next` | R | See which world will load next |
+| `world.revisions` | R | View world save revisions in the world inspector |
+| `world.meta` | R | View world metadata in the world inspector |
+| `world.load` | W | Load worlds from the world inspector |
+| `world.use` | W | Set the default world in the worlds view |
+| `world.save` | W | Save the current world from the worlds or server view |
+| `world.create` | W | Create new worlds in the worlds view |
+
+## Self-Service
+
+All authenticated users can access the `/account` page regardless of permissions. This page shows the user's own account info, MFA management (TOTP, passkeys, recovery codes), and password change.
+
+The `user.self` endpoint (scoped to `session.info`) returns the current user's data without requiring `user.list`. The `user.passwd` endpoint allows any user to change their own password (requires current password); changing another user's password requires the `user.passwd` scope. MFA management endpoints (`mfa.*`) are scoped to `session.info` and require password verification for sensitive operations (TOTP setup/disable, passkey removal, recovery code generation).
+
+## Enforcement
+
+### Backend
+
+Every tRPC endpoint is wrapped with `protectedProcedure(scope)`, which runs `requireScope` middleware. The middleware:
+
+1. Rejects unauthenticated requests (`UNAUTHORIZED`)
+2. Allows owners unconditionally
+3. Resolves the scope against the user's permissions + server defaults
+4. Rejects with `FORBIDDEN` if not granted
+
+Subscription endpoints (like `server.onStatus`, `chat.onMessage`) share the scope of their corresponding query endpoint rather than having separate scopes.
+
+### Frontend
+
+On login, the session response includes `resolvedScopes` -- a flat `Record<string, boolean>` with every scope pre-resolved. The frontend stores this in a nanostore (`$resolvedScopes`).
+
+- `useHasScope(...scopes)` -- returns true if the user has all specified scopes
+- `useHasAnyScope(...scopes)` -- returns true if the user has any of the specified scopes
+- `useRequireScope(scope)` -- redirects to `/` if the user lacks the scope
+
+#### Sidenav Visibility
+
+Each sidenav link is gated by a specific scope:
+
+| Link | Required Scope | Always Visible |
+|------|---------------|----------------|
+| Dashboard | -- | Yes |
+| Worlds | `world.list` | No |
+| History | `chat.history` | No |
+| Plugins | `plugin.list` | No |
+| Players | `player.list` | No |
+| Server | `server.status` | No |
+| Users | `user.list` | No |
+| Account | -- | Yes |
+
+#### View Access
+
+Each view redirects to the dashboard if the user lacks its required scope:
+- Worlds requires `world.list`
+- History requires `chat.history`
+- Plugins requires `plugin.list`
+- Players requires `player.list`
+- Server requires `server.status`
+- Users requires `user.list`
+
+Within a view, individual buttons and controls are conditionally rendered based on their specific scopes. Admin actions in the user inspector (change password, disable, delete, reset MFA) are shown in an actions widget gated by their respective scopes.
+
+The backend remains the source of truth -- frontend checks are for UX only.
+
+## Privilege Escalation Prevention
+
+When a non-owner user edits another user's permissions, the backend checks that the editor is not granting scopes they don't have themselves. The mutation resolves all scopes in the proposed `PermissionSet` against defaults and rejects any scope the editor lacks.
+
+## Storage
+
+User permissions are stored in the `users` NeDB store as part of each user document. Default permissions are stored in the `server` NeDB store as a `{ type: 'defaultPermissions' }` document.
+
+New users are created with `EMPTY_PERMISSIONS` (`root: 'off', domains: {}, scopes: {}`), which means all access is determined by server defaults until explicitly configured.