pinomad 0.11.0 → 0.13.0

package/dist/{chunk-9h5vawnm.js → chunk-aapsc9g0.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   serveWebClient
-} from "./chunk-wb10efyq.js";
+} from "./chunk-445cevpm.js";
 import {
   RELAY_CLOSE,
   decodeHostToRelay,
@@ -9,14 +9,14 @@ import {
   relayWsBase,
   verifyRelayChallenge,
   verifyRelayChallengeV2
-} from "./chunk-y127fe1a.js";
+} from "./chunk-g3ahp7b9.js";
 import {
   normalizeHostName
 } from "./chunk-pqe7q1s7.js";
 import {
   commandHint,
   webRoot
-} from "./chunk-sd5fkxjj.js";
+} from "./chunk-s0h7c7da.js";
 import"./chunk-df32avw6.js";
 
 // apps/server/src/main.ts
@@ -58,13 +58,14 @@ async function lockDataDir(dir, options) {
 
 // apps/server/src/accounts.ts
 var DB_FILE = "server.sqlite";
-var SCHEMA_VERSION = 6;
+var SCHEMA_VERSION = 8;
 var SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 var JOIN_TOKEN_TTL_MS = 10 * 60 * 1000;
 var USER_CODE_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ";
 var USER_CODE_LENGTH = 8;
 var HOST_LINK_TTL_MS = JOIN_TOKEN_TTL_MS;
 var HOST_LINK_INTERVAL_S = 5;
+var HOST_LINK_CODE_TTL_MS = 2 * 60000;
 var SLOW_DOWN_STEP_S = 5;
 var POLL_SLACK_MS = 1000;
 var HOST_OS_MAX_CODEPOINTS = 64;
@@ -114,6 +115,11 @@ var MAX_USERNAME_CODEPOINTS = 254;
 var scryptAsync = promisify(scrypt);
 var DUMMY_HASH = `scrypt$${SCRYPT.N}$${SCRYPT.r}$${SCRYPT.p}$${"A".repeat(22)}$${"A".repeat(43)}`;
 var sha256Hex = (input) => createHash("sha256").update(input, "utf8").digest("hex");
+var safeEqual = (a, b) => {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual(left, right);
+};
 async function hashPassword(password) {
   const salt = randomBytes(SALT_LEN);
   const hash = await scryptAsync(password, salt, KEY_LEN, SCRYPT);
@@ -239,6 +245,32 @@ function migrate(db) {
       COMMIT;
     `);
   }
+  if (version < 7) {
+    db.exec(`
+      BEGIN;
+      CREATE TABLE removed_hosts (
+        host_id TEXT PRIMARY KEY,
+        removed_at INTEGER NOT NULL
+      );
+      PRAGMA user_version = 7;
+      COMMIT;
+    `);
+  }
+  if (version < 8) {
+    db.exec(`
+      BEGIN;
+      ALTER TABLE host_link_requests ADD COLUMN request_id_hash TEXT;
+      ALTER TABLE host_link_requests ADD COLUMN redirect_uri TEXT;
+      ALTER TABLE host_link_requests ADD COLUMN code_challenge TEXT;
+      ALTER TABLE host_link_requests ADD COLUMN client_state TEXT;
+      ALTER TABLE host_link_requests ADD COLUMN auth_code_hash TEXT;
+      ALTER TABLE host_link_requests ADD COLUMN auth_code_expires_at INTEGER;
+      CREATE UNIQUE INDEX host_link_requests_request_id ON host_link_requests (request_id_hash);
+      CREATE UNIQUE INDEX host_link_requests_auth_code ON host_link_requests (auth_code_hash);
+      PRAGMA user_version = 8;
+      COMMIT;
+    `);
+  }
 }
 function migrateTo4(db) {
   db.exec("BEGIN");
@@ -329,6 +361,12 @@ function migrateTo1(db) {
     COMMIT;
   `);
 }
+var loopbackRedirect = (redirectUri, params) => {
+  const url = new URL(redirectUri);
+  for (const [key, value] of Object.entries(params))
+    url.searchParams.set(key, value);
+  return url.toString();
+};
 
 class WindowedCounter {
   map = new Map;
@@ -447,6 +485,8 @@ async function openAccounts(options) {
   const linkStarts = new WindowedCounter(linkLimits.counterMaxEntries, now);
   const linkUserFailures = new WindowedCounter(linkLimits.counterMaxEntries, now);
   const linkIpFailures = new WindowedCounter(linkLimits.counterMaxEntries, now);
+  const PENDING_SELECT = `SELECT host_id AS hostId, host_name AS name, host_os AS os, source_ip AS sourceIp, expires_at AS expiresAt,
+      redirect_uri AS redirectUri, client_state AS clientState FROM host_link_requests`;
   const sweepExpired = () => {
     const at = now();
     db.prepare("DELETE FROM join_tokens WHERE expires_at <= ?").run(at);
@@ -458,29 +498,47 @@ async function openAccounts(options) {
     db.prepare("INSERT INTO join_tokens (token_hash, user_id, created_at, expires_at, host_id) VALUES (?, ?, ?, ?, ?)").run(sha256Hex(token), userId, now(), expiresAt, hostId);
     return { token, expiresAt };
   };
-  const pendingByCode = (userId, userCode, ip) => {
+  const pendingByRef = (userId, ref, ip) => {
+    if ("requestId" in ref) {
+      const hash = sha256Hex(ref.requestId);
+      const row2 = db.prepare(`${PENDING_SELECT} WHERE request_id_hash = ? AND state = 'pending' AND expires_at > ?`).get(hash, now());
+      return row2 === undefined ? "not_found" : { column: "request_id_hash", hash, row: row2 };
+    }
+    const { userCode } = ref;
     const userKey = String(userId);
     if (linkUserFailures.isOver(userKey, linkLimits.userMaxFailures) || linkIpFailures.isOver(ip, linkLimits.ipMaxFailures)) {
       return "limited";
     }
     const code = normalizeUserCode(userCode);
     const codeHash = code === undefined ? undefined : sha256Hex(code);
-    const row = codeHash === undefined ? undefined : db.prepare(`SELECT host_id AS hostId, host_name AS name, host_os AS os, source_ip AS sourceIp, expires_at AS expiresAt
-               FROM host_link_requests WHERE user_code_hash = ? AND state = 'pending' AND expires_at > ?`).get(codeHash, now());
+    const row = codeHash === undefined ? undefined : db.prepare(`${PENDING_SELECT} WHERE user_code_hash = ? AND state = 'pending' AND expires_at > ?`).get(codeHash, now());
     if (codeHash === undefined || row === undefined) {
       linkUserFailures.bump(userKey, linkLimits.failureWindowMs);
       linkIpFailures.bump(ip, linkLimits.failureWindowMs);
       return "not_found";
     }
-    return { codeHash, row };
+    return { column: "user_code_hash", hash: codeHash, row };
   };
   const settleHostLink = (args, state) => {
-    const found = pendingByCode(args.userId, args.userCode, args.ip);
+    const found = pendingByRef(args.userId, args, args.ip);
     if (found === "limited" || found === "not_found")
       return { status: found };
-    const settled = db.prepare(`UPDATE host_link_requests SET state = ?, user_id = ?, host_name = NULL, host_os = NULL, source_ip = NULL
-         WHERE user_code_hash = ? AND state = 'pending' AND expires_at > ?`).run(state, state === "confirmed" ? args.userId : null, found.codeHash, now());
-    return Number(settled.changes) === 1 ? { status: "ok" } : { status: "not_found" };
+    const { column, hash, row } = found;
+    const at = now();
+    const loopback = row.redirectUri === null ? undefined : { redirectUri: row.redirectUri, state: row.clientState ?? "" };
+    if (loopback !== undefined && state === "denied") {
+      const dropped = db.prepare(`DELETE FROM host_link_requests WHERE ${column} = ? AND state = 'pending' AND expires_at > ?`).run(hash, at);
+      if (Number(dropped.changes) !== 1)
+        return { status: "not_found" };
+      return { status: "ok", redirect: loopbackRedirect(loopback.redirectUri, { error: "access_denied", state: loopback.state }) };
+    }
+    const code = loopback === undefined ? undefined : randomBytes(32).toString("base64url");
+    const settled = db.prepare(`UPDATE host_link_requests SET state = ?, user_id = ?, host_name = NULL, host_os = NULL, source_ip = NULL,
+           auth_code_hash = ?, auth_code_expires_at = ?
+         WHERE ${column} = ? AND state = 'pending' AND expires_at > ?`).run(state, state === "confirmed" ? args.userId : null, code === undefined ? null : sha256Hex(code), code === undefined ? null : at + HOST_LINK_CODE_TTL_MS, hash, at);
+    if (Number(settled.changes) !== 1)
+      return { status: "not_found" };
+    return loopback === undefined || code === undefined ? { status: "ok" } : { status: "ok", redirect: loopbackRedirect(loopback.redirectUri, { code, state: loopback.state }) };
   };
   const deviceForSignIn = (userId, claim) => {
     const at = now();
@@ -777,7 +835,7 @@ async function openAccounts(options) {
       sweepExpired();
       return mintJoinToken(userId, null);
     },
-    startHostLink({ hostId, name, os, ip }) {
+    startHostLink({ hostId, name, os, ip, loopback }) {
       if (linkStarts.hit(ip, linkLimits.startMaxPerIp, linkLimits.startWindowMs))
         return { status: "limited" };
       sweepExpired();
@@ -787,14 +845,24 @@ async function openAccounts(options) {
       const deviceCode = randomBytes(32).toString("base64url");
       const at = now();
       const expiresAt = at + HOST_LINK_TTL_MS;
+      const hostName = normalizeHostName(name);
+      const hostOs = [...os.trim()].slice(0, HOST_OS_MAX_CODEPOINTS).join("");
+      if (loopback !== undefined) {
+        const requestId = randomBytes(32).toString("base64url");
+        db.prepare(`INSERT INTO host_link_requests
+             (device_code_hash, user_code_hash, request_id_hash, redirect_uri, code_challenge, client_state,
+              host_id, host_name, host_os, source_ip, interval_s, created_at, expires_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(sha256Hex(randomBytes(32).toString("base64url")), sha256Hex(randomBytes(32).toString("base64url")), sha256Hex(requestId), loopback.redirectUri, loopback.codeChallenge, loopback.state, hostId, hostName, hostOs, ip, HOST_LINK_INTERVAL_S, at, expiresAt);
+        return { status: "ok", mode: "loopback", requestId, expiresAt };
+      }
       const insert = db.prepare(`INSERT INTO host_link_requests
            (device_code_hash, user_code_hash, host_id, host_name, host_os, source_ip, interval_s, created_at, expires_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`);
       for (let attempt = 0;; attempt++) {
         const code = Array.from({ length: USER_CODE_LENGTH }, () => USER_CODE_ALPHABET[randomInt(USER_CODE_ALPHABET.length)]).join("");
         try {
-          insert.run(sha256Hex(deviceCode), sha256Hex(code), hostId, normalizeHostName(name), [...os.trim()].slice(0, HOST_OS_MAX_CODEPOINTS).join(""), ip, HOST_LINK_INTERVAL_S, at, expiresAt);
-          return { status: "ok", deviceCode, userCode: formatUserCode(code), expiresAt, interval: HOST_LINK_INTERVAL_S };
+          insert.run(sha256Hex(deviceCode), sha256Hex(code), hostId, hostName, hostOs, ip, HOST_LINK_INTERVAL_S, at, expiresAt);
+          return { status: "ok", mode: "code", deviceCode, userCode: formatUserCode(code), expiresAt, interval: HOST_LINK_INTERVAL_S };
         } catch (error) {
           if (attempt >= 4 || !String(error).includes("UNIQUE"))
             throw error;
@@ -830,8 +898,9 @@ async function openAccounts(options) {
         throw error;
       }
     },
-    lookupHostLink({ userId, userCode, ip }) {
-      const found = pendingByCode(userId, userCode, ip);
+    lookupHostLink(args) {
+      const { userId, ip } = args;
+      const found = pendingByRef(userId, args, ip);
       if (found === "limited" || found === "not_found")
         return { status: found };
       const { row } = found;
@@ -853,6 +922,24 @@ async function openAccounts(options) {
     denyHostLink(args) {
       return settleHostLink(args, "denied");
     },
+    exchangeHostLinkCode(code, codeVerifier) {
+      const codeHash = sha256Hex(code);
+      const at = now();
+      db.exec("BEGIN IMMEDIATE");
+      try {
+        const row = db.prepare(`SELECT host_id AS hostId, user_id AS userId, code_challenge AS challenge, auth_code_expires_at AS codeExpiresAt
+             FROM host_link_requests WHERE auth_code_hash = ? AND state = 'confirmed'`).get(codeHash);
+        if (row !== undefined)
+          db.prepare("DELETE FROM host_link_requests WHERE auth_code_hash = ?").run(codeHash);
+        const valid = row !== undefined && row.userId !== null && row.challenge !== null && row.codeExpiresAt !== null && row.codeExpiresAt > at && safeEqual(createHash("sha256").update(codeVerifier).digest("base64url"), row.challenge);
+        const result = valid ? { status: "ok", ...mintJoinToken(row.userId, row.hostId) } : { status: "invalid" };
+        db.exec("COMMIT");
+        return result;
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
+    },
     sweepExpired,
     joinHost({ token, hostId, noisePublicKey, name }) {
       const tokenHash = sha256Hex(token);
@@ -888,6 +975,7 @@ async function openAccounts(options) {
              name = excluded.name,
              joined_at = excluded.joined_at,
              last_seen_at = excluded.last_seen_at`).run(hostId, row.userId, noisePublicKey, hostName, at, at);
+        db.prepare("DELETE FROM removed_hosts WHERE host_id = ?").run(hostId);
         const user = db.prepare("SELECT username FROM users WHERE id = ?").get(row.userId);
         db.exec("COMMIT");
         return { status: "joined", username: user?.username ?? "unknown" };
@@ -899,6 +987,37 @@ async function openAccounts(options) {
     leaveHost(hostId) {
       return Number(db.prepare("DELETE FROM hosts WHERE host_id = ?").run(hostId).changes) > 0;
     },
+    async removeHost({ userId, username, password, hostId }) {
+      const owned = () => db.prepare("SELECT 1 AS x FROM hosts WHERE host_id = ? AND user_id = ?").get(hostId, userId) !== undefined;
+      if (!owned())
+        return { status: "refused", reason: "not_found" };
+      const checked = await checkPassword(userId, username, password);
+      if (checked === "limited")
+        return { status: "limited" };
+      if (checked === "wrong_password")
+        return { status: "refused", reason: "wrong_password" };
+      db.exec("BEGIN IMMEDIATE");
+      try {
+        if (currentHash(userId) !== checked.verifiedHash) {
+          db.exec("ROLLBACK");
+          return { status: "refused", reason: "wrong_password" };
+        }
+        if (!owned()) {
+          db.exec("ROLLBACK");
+          return { status: "refused", reason: "not_found" };
+        }
+        db.prepare("DELETE FROM hosts WHERE host_id = ?").run(hostId);
+        db.prepare("INSERT INTO removed_hosts (host_id, removed_at) VALUES (?, ?) ON CONFLICT(host_id) DO UPDATE SET removed_at = excluded.removed_at").run(hostId, now());
+        db.exec("COMMIT");
+        return { status: "ok" };
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
+    },
+    wasRemoved(hostId) {
+      return db.prepare("SELECT 1 AS x FROM removed_hosts WHERE host_id = ?").get(hostId) !== undefined;
+    },
     listHosts(userId) {
       return db.prepare(`SELECT host_id AS hostId, user_id AS userId, noise_public_key AS noisePublicKey,
                     name, joined_at AS joinedAt, last_seen_at AS lastSeenAt, device_reports AS deviceReports
@@ -1422,6 +1541,27 @@ function createRelayLimiter(limits, now = Date.now) {
 // apps/server/src/api.ts
 var SESSION_COOKIE = "__Host-pinomad-session";
 var HOST_ID_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+var PKCE_CHALLENGE = /^[A-Za-z0-9_-]{43}$/;
+var PKCE_VERIFIER = /^[A-Za-z0-9._~-]{43,128}$/;
+var LOOPBACK_STATE = /^[A-Za-z0-9_-]{1,128}$/;
+var MAX_REDIRECT_URI = 256;
+function parseLoopback(value) {
+  const { redirectUri, codeChallenge, state } = value;
+  if (typeof redirectUri !== "string" || redirectUri.length > MAX_REDIRECT_URI)
+    return null;
+  if (typeof codeChallenge !== "string" || !PKCE_CHALLENGE.test(codeChallenge))
+    return null;
+  if (typeof state !== "string" || !LOOPBACK_STATE.test(state))
+    return null;
+  let url;
+  try {
+    url = new URL(redirectUri);
+  } catch {
+    return null;
+  }
+  const loopbackOnly = url.protocol === "http:" && url.hostname === "127.0.0.1" && url.port !== "" && url.username === "" && url.password === "" && url.search === "" && url.hash === "" && url.href === redirectUri;
+  return loopbackOnly ? { redirectUri, codeChallenge, state } : null;
+}
 var MAX_BODY = 8 * 1024;
 var MUTATING = new Set(["POST", "PUT", "PATCH", "DELETE"]);
 var DESKTOP_ORIGIN = "app://pinomad";
@@ -1469,6 +1609,15 @@ async function readJson(request, optional = false) {
     return { ok: false, tooLarge: false };
   }
 }
+async function authedJson(accounts, request, token, optional = false) {
+  const body = await readJson(request, optional);
+  if (!body.ok)
+    return { ok: false, status: body.tooLarge ? 413 : 400, error: body.tooLarge ? "payload_too_large" : "invalid_json" };
+  const session = accounts.authenticate(token);
+  if (session === undefined)
+    return { ok: false, status: 401, error: "unauthenticated" };
+  return { ok: true, value: body.value, session };
+}
 function sessionToken(request) {
   const authorization = request.headers.authorization;
   if (authorization !== undefined && authorization.startsWith("Bearer "))
@@ -1512,7 +1661,7 @@ async function handleApiRequest(request, response, ctx) {
   }
   const bearer = (request.headers.authorization ?? "").startsWith("Bearer ");
   const loginTokenMode = (pathname === "/api/login" || pathname === "/api/register") && (origin === undefined || origin === DESKTOP_ORIGIN);
-  const hostLinkHostMode = (pathname === "/api/host-link/start" || pathname === "/api/host-link/poll") && origin === undefined;
+  const hostLinkHostMode = (pathname === "/api/host-link/start" || pathname === "/api/host-link/poll" || pathname === "/api/host-link/token") && origin === undefined;
   if (MUTATING.has(method) && !bearer && !loginTokenMode && !hostLinkHostMode && origin !== ctx.publicOrigin) {
     deny(403, "origin_mismatch");
     return;
@@ -1593,7 +1742,7 @@ async function handleApiRequest(request, response, ctx) {
     send(200, { user: { username }, expiresAt: result.expiresAt, ...cookieMode ? {} : { token: result.token } }, cookieMode ? { "set-cookie": setSessionCookie(result.token) } : undefined);
     return;
   }
-  if (pathname === "/api/host-link/start" || pathname === "/api/host-link/poll") {
+  if (pathname === "/api/host-link/start" || pathname === "/api/host-link/poll" || pathname === "/api/host-link/token") {
     if (method !== "POST") {
       deny(405, "method_not_allowed", { allow: "POST" });
       return;
@@ -1605,7 +1754,8 @@ async function handleApiRequest(request, response, ctx) {
     }
     if (pathname === "/api/host-link/start") {
       const value = body.value;
-      if (typeof value?.hostId !== "string" || !HOST_ID_PATTERN.test(value.hostId) || typeof value.name !== "string" || typeof value.os !== "string") {
+      const loopback = value?.redirectUri === undefined ? undefined : parseLoopback(value);
+      if (typeof value?.hostId !== "string" || !HOST_ID_PATTERN.test(value.hostId) || typeof value.name !== "string" || typeof value.os !== "string" || loopback === null) {
         deny(400, "invalid_request");
         return;
       }
@@ -1613,7 +1763,8 @@ async function handleApiRequest(request, response, ctx) {
         hostId: value.hostId,
         name: value.name,
         os: value.os,
-        ip: clientIp(request, ctx.trustProxy)
+        ip: clientIp(request, ctx.trustProxy),
+        ...loopback === undefined ? {} : { loopback }
       });
       if (result2.status === "limited") {
         deny(429, "rate_limited");
@@ -1623,6 +1774,14 @@ async function handleApiRequest(request, response, ctx) {
         deny(503, "busy");
         return;
       }
+      if (result2.mode === "loopback") {
+        send(200, {
+          requestId: result2.requestId,
+          verifyUrl: `${ctx.publicOrigin}/host-link?request=${result2.requestId}`,
+          expiresAt: result2.expiresAt
+        });
+        return;
+      }
       send(200, {
         deviceCode: result2.deviceCode,
         userCode: result2.userCode,
@@ -1632,6 +1791,19 @@ async function handleApiRequest(request, response, ctx) {
       });
       return;
     }
+    if (pathname === "/api/host-link/token") {
+      const value = body.value;
+      if (typeof value?.code !== "string" || value.code.length > 256 || typeof value.codeVerifier !== "string" || !PKCE_VERIFIER.test(value.codeVerifier)) {
+        deny(400, "invalid_request");
+        return;
+      }
+      const result2 = accounts.exchangeHostLinkCode(value.code, value.codeVerifier);
+      if (result2.status === "invalid")
+        deny(400, "invalid_grant");
+      else
+        send(200, { token: result2.token, expiresAt: result2.expiresAt });
+      return;
+    }
     const deviceCode = body.value?.deviceCode;
     if (typeof deviceCode !== "string" || deviceCode.length > 256) {
       deny(400, "invalid_request");
@@ -1666,22 +1838,18 @@ async function handleApiRequest(request, response, ctx) {
       deny(401, "unauthenticated");
       return;
     }
-    const body = await readJson(request);
+    const body = await authedJson(accounts, request, token);
     if (!body.ok) {
-      deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+      deny(body.status, body.error);
       return;
     }
-    const userCode = body.value?.userCode;
-    if (typeof userCode !== "string" || userCode.length > 64) {
+    const named = body.value;
+    const ref = typeof named?.userCode === "string" && named.userCode.length <= 64 && named.requestId === undefined ? { userCode: named.userCode } : typeof named?.requestId === "string" && named.requestId.length <= 64 && named.userCode === undefined ? { requestId: named.requestId } : undefined;
+    if (ref === undefined) {
       deny(400, "invalid_request");
       return;
     }
-    const session = accounts.authenticate(token);
-    if (session === undefined) {
-      deny(401, "unauthenticated");
-      return;
-    }
-    const args = { userId: session.userId, userCode, ip: clientIp(request, ctx.trustProxy) };
+    const args = { userId: body.session.userId, ip: clientIp(request, ctx.trustProxy), ...ref };
     const result = pathname === "/api/host-link/lookup" ? accounts.lookupHostLink(args) : pathname === "/api/host-link/confirm" ? accounts.confirmHostLink(args) : accounts.denyHostLink(args);
     if (result.status === "limited") {
       deny(429, "rate_limited");
@@ -1693,6 +1861,8 @@ async function handleApiRequest(request, response, ctx) {
     }
     if ("request" in result)
       send(200, result.request);
+    else if (result.redirect !== undefined)
+      send(200, { redirect: result.redirect });
     else
       send(204);
     return;
@@ -1720,9 +1890,13 @@ async function handleApiRequest(request, response, ctx) {
         send(200, accounts.createInvite(session.userId));
       return;
     }
-    const body = await readJson(request);
+    const body = await authedJson(accounts, request, token);
     if (!body.ok) {
-      deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+      deny(body.status, body.error);
+      return;
+    }
+    if (!body.session.admin) {
+      deny(401, "unauthenticated");
       return;
     }
     const id = body.value?.id;
@@ -1730,16 +1904,52 @@ async function handleApiRequest(request, response, ctx) {
       deny(400, "invalid_request");
       return;
     }
-    if (accounts.authenticate(token)?.admin !== true) {
-      deny(401, "unauthenticated");
-      return;
-    }
     if (accounts.revokeInvite(id))
       send(204);
     else
       deny(404, "not_found");
     return;
   }
+  const hostRemove = /^\/api\/hosts\/([A-Za-z0-9_-]{43})\/remove$/.exec(pathname);
+  if (hostRemove !== null) {
+    if (method !== "POST") {
+      deny(405, "method_not_allowed", { allow: "POST" });
+      return;
+    }
+    const token = sessionToken(request);
+    if (token === undefined || accounts.authenticate(token) === undefined) {
+      deny(401, "unauthenticated");
+      return;
+    }
+    const body = await authedJson(accounts, request, token);
+    if (!body.ok) {
+      deny(body.status, body.error);
+      return;
+    }
+    const value = body.value;
+    if (typeof value?.password !== "string" || [...value.password].length > MAX_PASSWORD_CODEPOINTS) {
+      deny(400, "invalid_request");
+      return;
+    }
+    const current = body.session;
+    const result = await accounts.removeHost({
+      userId: current.userId,
+      username: current.username,
+      password: value.password,
+      hostId: hostRemove[1]
+    });
+    if (result.status === "limited") {
+      deny(429, "rate_limited");
+      return;
+    }
+    if (result.status === "refused") {
+      deny(result.reason === "not_found" ? 404 : 403, result.reason);
+      return;
+    }
+    ctx.disconnectHost(hostRemove[1], true);
+    send(204);
+    return;
+  }
   const hostPairing = /^\/api\/hosts\/([A-Za-z0-9_-]{43})\/pairing$/.exec(pathname);
   if (pathname === "/api/hosts" || hostPairing !== null) {
     const expected = pathname === "/api/hosts" ? "GET" : "POST";
@@ -1834,9 +2044,9 @@ async function handleApiRequest(request, response, ctx) {
       send(200, accounts.listDevices(session.userId).map((device) => ({ ...device, current: device.id === session.deviceId })));
       return;
     }
-    const body = await readJson(request);
+    const body = await authedJson(accounts, request, token);
     if (!body.ok) {
-      deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+      deny(body.status, body.error);
       return;
     }
     const value = body.value;
@@ -1844,11 +2054,7 @@ async function handleApiRequest(request, response, ctx) {
       deny(400, "invalid_request");
       return;
     }
-    const current = accounts.authenticate(token);
-    if (current === undefined) {
-      deny(401, "unauthenticated");
-      return;
-    }
+    const current = body.session;
     const result = await accounts.kickDevice({
       userId: current.userId,
       username: current.username,
@@ -1886,9 +2092,9 @@ async function handleApiRequest(request, response, ctx) {
       return;
     }
     if (pathname === "/api/push-tokens" || pathname === "/api/push-tokens/remove") {
-      const body = await readJson(request);
+      const body = await authedJson(accounts, request, token);
       if (!body.ok) {
-        deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+        deny(body.status, body.error);
         return;
       }
       const value = body.value;
@@ -1898,30 +2104,27 @@ async function handleApiRequest(request, response, ctx) {
         deny(400, "invalid_request");
         return;
       }
-      const current = accounts.authenticate(token);
-      if (current === undefined) {
-        deny(401, "unauthenticated");
-        return;
-      }
+      const current = body.session;
       if (pathname === "/api/push-tokens")
-        accounts.registerPushToken(session.userId, apns, environment, current.deviceId);
+        accounts.registerPushToken(current.userId, apns, environment, current.deviceId);
       else
-        accounts.removePushToken(session.userId, apns, environment);
+        accounts.removePushToken(current.userId, apns, environment);
       send(204);
       return;
     }
     if (pathname === "/api/me/delete") {
-      const body = await readJson(request);
+      const body = await authedJson(accounts, request, token);
       if (!body.ok) {
-        deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+        deny(body.status, body.error);
         return;
       }
+      const current = body.session;
       const value = body.value;
       if (typeof value?.password !== "string" || [...value.password].length > MAX_PASSWORD_CODEPOINTS) {
         deny(400, "invalid_request");
         return;
       }
-      const result = await accounts.deleteAccount({ userId: session.userId, username: session.username, password: value.password });
+      const result = await accounts.deleteAccount({ userId: current.userId, username: current.username, password: value.password });
       if (result.status === "limited") {
         deny(429, "rate_limited");
         return;
@@ -1932,24 +2135,25 @@ async function handleApiRequest(request, response, ctx) {
       }
       for (const hostId of result.hostIds)
         ctx.disconnectHost(hostId);
-      ctx.forgetAccount(session.userId);
+      ctx.forgetAccount(current.userId);
       send(204, undefined, { "set-cookie": clearSessionCookie });
       return;
     }
     if (pathname === "/api/password") {
-      const body = await readJson(request);
+      const body = await authedJson(accounts, request, token);
       if (!body.ok) {
-        deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+        deny(body.status, body.error);
         return;
       }
+      const current = body.session;
       const value = body.value;
       if (typeof value?.currentPassword !== "string" || typeof value.newPassword !== "string" || [...value.currentPassword].length > MAX_PASSWORD_CODEPOINTS) {
         deny(400, "invalid_request");
         return;
       }
       const result = await accounts.changePassword({
-        userId: session.userId,
-        username: session.username,
+        userId: current.userId,
+        username: current.username,
         keepToken: token,
         currentPassword: value.currentPassword,
         newPassword: value.newPassword
@@ -1975,9 +2179,9 @@ async function handleApiRequest(request, response, ctx) {
       return;
     }
     if (pathname === "/api/logout") {
-      const body = await readJson(request, true);
+      const body = await authedJson(accounts, request, token, true);
       if (!body.ok) {
-        deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+        deny(body.status, body.error);
         return;
       }
       const value = body.value;
@@ -2118,8 +2322,8 @@ async function startRelay(options) {
     });
   }
   const pairing = { status: pairingStatus, request: requestPairing };
-  function disconnectHost(hostId) {
-    controls.get(hostId)?.socket.close(RELAY_CLOSE.hostNotAllowed);
+  function disconnectHost(hostId, removed = false) {
+    controls.get(hostId)?.socket.close(removed ? RELAY_CLOSE.hostRemoved : RELAY_CLOSE.hostNotAllowed);
     closeHostDevices(hostId, RELAY_CLOSE.hostNotAllowed, "host left its account");
   }
   function closeHostDevices(hostId, code, reason) {
@@ -2306,7 +2510,7 @@ async function startRelay(options) {
         return;
       }
       if (accounts?.hasHost(frame.hostId) !== true) {
-        socket.close(RELAY_CLOSE.hostNotAllowed);
+        socket.close(accounts?.wasRemoved(frame.hostId) === true ? RELAY_CLOSE.hostRemoved : RELAY_CLOSE.hostNotAllowed);
         return;
       }
       hostId = frame.hostId;