rlz-engine 1.0.53 → 1.0.55

package/README.md

@@ -0,0 +1,225 @@
+# rlz-engine
+
+`rlz-engine` is a TypeScript toolkit for small web applications. It provides Fastify server setup, MongoDB helpers, schema-validated RPC, browser RPC transport, authentication helpers, audit logging, synchronization utilities, and reusable CLI modules.
+
+The package is an opt-in library: applications choose which capabilities to compose. It does not provide an application executable or automatically register its routes and CLI commands.
+
+## Requirements and installation
+
+- Node.js 22.13 or newer
+- MongoDB for the MongoDB storage helpers
+- React and React DOM when using the React client components
+
+Install the package and its peer dependencies as needed:
+
+```sh
+npm install rlz-engine
+npm install react react-dom
+```
+
+The package exports compiled files through subpaths under `rlz-engine/back/*`, `rlz-engine/client/*`, and `rlz-engine/shared/*`. Import implementation modules directly; for example:
+
+```ts
+import { rpc } from 'rlz-engine/back/rpc/rpc.js'
+import { HTTP_MODULE } from 'rlz-engine/back/http/module.js'
+import { syncItems } from 'rlz-engine/client/sync.js'
+```
+
+## Feature modules
+
+Each backend feature lives in a cohesive directory and exposes an uppercase `<FEATURE>_MODULE` object from `module.ts`. The object contains only the integration factories that feature supports. Applications invoke the factories for the integrations they want, then pass the returned facet values to `composeModules()`.
+
+| Module          | Facets                                    | Purpose                                                             |
+| --------------- | ----------------------------------------- | ------------------------------------------------------------------- |
+| `AUTH_MODULE`   | `makeRpc(storage, options?)`, `makeCli()` | Signup/signin/session/logout RPC endpoints and admin secret command |
+| `HTTP_MODULE`   | `makeCli(params, init)`                   | `http start` server command                                         |
+| `LOGGER_MODULE` | `makeCli()`, `makeAdmRpc()`               | Audit-log reader command and protected audit query endpoint         |
+| `RPC_MODULE`    | `makeDevCli(options)`                     | Generate user and administrative RPC clients during development     |
+
+The composer groups selected operational CLI, development CLI, user RPC, and administrative RPC facets. It rejects duplicate names within each facet kind before startup. It deliberately leaves factory arguments with the application: server settings, route handlers, working directories, and generated-client paths are application-specific. The React administration UI and certificate-status module remain planned; the administrative RPC transport and audit-log endpoint are available now.
+
+### CLI composition
+
+`CliEngine` provides operational commands. `DevCliEngine` is a separate entry point for development commands, such as generated-client updates.
+
+```ts
+import { CliEngine, DevCliEngine } from 'rlz-engine/back/cli/cli-engine.js'
+import { composeModules } from 'rlz-engine/back/module/composer.js'
+import { AUTH_MODULE } from 'rlz-engine/back/auth/module.js'
+import { HTTP_MODULE } from 'rlz-engine/back/http/module.js'
+import { LOGGER_MODULE } from 'rlz-engine/back/logger/module.js'
+import { RPC_MODULE } from 'rlz-engine/back/rpc/module.js'
+
+const applicationModules = composeModules({
+    cli: [AUTH_MODULE.makeCli(), HTTP_MODULE.makeCli(serverParams, initializeRoutes), LOGGER_MODULE.makeCli()],
+    rpc: userRpcPlugins,
+    admRpc: [LOGGER_MODULE.makeAdmRpc()]
+})
+
+const cli = applicationModules.registerCli(new CliEngine('app.js'))
+await cli.run()
+
+async function initializeRoutes(server) {
+    await applicationModules.registerRpc(server)
+    await applicationModules.registerAdmRpc(server)
+    // Register application-owned routes and plugins here.
+}
+
+const devModules = composeModules({
+    devCli: [
+        RPC_MODULE.makeDevCli({
+            rpcBuilders: userRpcPlugins,
+            admRpcBuilders: adminRpcPlugins,
+            rpcOutput: './src/client/generated/rpc-client.ts',
+            admRpcOutput: './src/client/generated/admin-rpc-client.ts'
+        })
+    ]
+})
+const devCli = devModules.registerDevCli(new DevCliEngine('dev.js'))
+await devCli.run()
+```
+
+`composeModules()` accepts any combination of `cli`, `devCli`, `rpc`, and `admRpc` arrays; omit facets the application does not use. For RPC builders that need Fastify plugin options, provide `rpcOptions` or `admRpcOptions`, keyed by each builder's `name` (for example, `{ audit: { workingDirectory: appDirectory } }`). The returned object has `registerCli()`, `registerDevCli()`, `registerRpc()`, and `registerAdmRpc()` methods. RPC registration methods are asynchronous and register plugins in array order. Duplicate module or plugin names within the same category throw during composition. Operational and development commands remain separate so client generation does not need to be included in production command setup. Each engine generates nested help from module and command descriptions. For example, `app.js --help`, `app.js http --help`, and `app.js http start --help` show progressively narrower command help.
+
+`AUTH_MODULE.makeRpc(storage, options?)` requires an initialized `AuthStorage` and returns the authentication RPC builder. `AUTH_MODULE.makeCli(workingDirectory?)` accepts a directory or a callback returning one; it defaults to the current working directory. `HTTP_MODULE.makeCli(params, init)` accepts `RunServerParams` without `init`, or a callback that returns those settings, and the route initialization callback. `LOGGER_MODULE.makeCli(workingDirectory?)` accepts the directory containing `logs.sqlite` and defaults to the current working directory. `RPC_MODULE.makeDevCli(options)` requires at least one user or administrative RPC builder and an output path for each configured builder kind.
+
+## HTTP server
+
+The server implementation is in `back/http/server.js`. Its `runServer()` function accepts `RunServerParams`:
+
+```ts
+import { runServer } from 'rlz-engine/back/http/server.js'
+
+await runServer({
+    production: process.env.NODE_ENV === 'production',
+    domain: 'example.com',
+    certDir: './certs',
+    staticDir: './dist',
+    init: async (server) => {
+        // Register application routes and plugins here.
+    }
+})
+```
+
+`domain`, `certDir`, `staticDir`, and `init` are required. Optional settings include `debug`, `unsecurePort`, `securePort`, `auditRetentionMs`, `auditMaxRecords`, `auditSqlite`, and `acmeProvider`. Development serves HTTP with CORS and static files. Production runs an HTTP-01 challenge and redirect server alongside a TLS server with HTTP/2 and HTTP/1 support, and renews certificates periodically. CORS is available only in development and does not allow credentials; production serves static files and RPC from the same HTTPS origin. The returned shutdown function closes the servers and logging storage. The `http start` CLI command keeps the process active until a termination signal.
+
+By default, non-debug production writes audit logs to `logs.sqlite`. Development and debug mode use colored console output. Set `auditSqlite: true` (or pass `--audit-sqlite` to `http start`) to write SQLite records alongside console output. Retention defaults to 30 days and the maximum record count defaults to 100,000.
+
+## RPC endpoints and generated clients
+
+Define user RPC plugins with `rpc()` and administrative plugins with `admRpc()`. Every endpoint has a version, a name, Zod body and response schemas, and an action. User endpoints may be anonymous or use a `cookieAuth` policy with both `authenticate` and `verifyCsrf` callbacks. The cookie-auth callbacks receive request cookies/headers and safe reply cookie methods via `RpcRequestContext`.
+
+```ts
+import z from 'zod'
+import { rpc, admRpc } from 'rlz-engine/back/rpc/rpc.js'
+import { authenticateSession, SESSION_IDLE_TIMEOUT_MS, verifySessionCsrf } from 'rlz-engine/back/auth/session.js'
+
+// Assume storage is an initialized AuthStorage instance.
+
+export const userRpc = rpc('users').add({
+    name: 'get-profile',
+    v: 1,
+    bodySchema: z.object({}),
+    respSchema: z.object({ name: z.string() }),
+    cookieAuth: {
+        authenticate: (context) => authenticateSession(storage, context, SESSION_IDLE_TIMEOUT_MS),
+        verifyCsrf: (context, session) => verifySessionCsrf(storage, context, session)
+    },
+    action: (session) => ({ name: session.user.name })
+})
+
+export const adminRpc = admRpc('operations').add({
+    name: 'health',
+    v: 1,
+    bodySchema: z.object({}),
+    respSchema: z.object({ status: z.string() }),
+    action: async () => ({ status: 'ok' })
+})
+```
+
+Register the generated Fastify plugins from the application initialization callback:
+
+```ts
+await server.register(userRpc.makeFastifyPlugin())
+await server.register(adminRpc.makeFastifyPlugin())
+```
+
+User endpoints are served at `/rpc/<plugin>_<endpoint>_v<version>`. Authenticated user routes use cookie sessions and require both a session authenticator and a CSRF verifier.
+
+Cookie-auth endpoints use the same route and receive a generated client method with no credential parameter. Their `authenticate` callback reads the session cookie; `verifyCsrf` must validate the request before the action runs. `runServer()` registers `@fastify/cookie` before application routes. `back/auth/cookies.js` exports session-cookie helpers; they always use `HttpOnly`, `Secure`, `SameSite=Lax`, and `Path=/` without a `Domain`. The caller can set only the cookie lifetime. `back/auth/csrf.js` provides 32-byte CSRF token generation, constant-time token comparison, and same-origin validation.
+
+Administrative endpoints are served at `/.adm/rpc/<plugin>_<endpoint>_v<version>` and accept only `Authorization: Bearer <admin-secret>`. The secret is checked against the salted scrypt hash in `./auth/admin-secret` relative to the process working directory. Use the operational `adm reset-secret` command to create or replace it; the generated plaintext is printed once. The server caches the hash per process and path, so restart a running server after resetting the secret.
+
+`generateClient(fileName, ...rpcBuilders)` and `generateAdmClient(fileName, ...admRpcBuilders)` in `back/rpc/gen.js` generate typed clients from endpoint schemas. The `rpc generate-client` command exposed by `RPC_MODULE.makeDevCli()` invokes these generators and writes outputs to the configured paths. Generated user methods use `rpcCall()`; generated administrative methods require `AdmAuthParam` and use `admRpcCall()`.
+
+### RPC transport
+
+`client/rpc.js` exports `rpcCall()`, `admRpcCall()`, `AdmAuthParam`, and `HttpError`, `Unauthorized`, `Forbidden`, and `NotFound` errors. Requests and responses are JSON. Request bodies larger than 16 KiB are gzip-compressed. User RPC uses same-origin cookie credentials and attaches the CSRF token held in client memory. Admin RPC uses a separate secret-only Bearer contract. `initFrontConfig()` configures the RPC base URL, which defaults to `/` in production and `http://localhost:8080/` otherwise.
+
+## Authentication RPC
+
+`back/auth` contains `AuthStorage`, signup/signin helpers, opaque server-side sessions, and the administrative-secret implementation. `AUTH_MODULE.makeRpc(storage, options?)` provides `signup`, `signin`, `session`, and CSRF-protected `logout` endpoints under `/rpc/auth_*_v1`. Set `options.sessionIdleTimeoutMs` to configure the idle timeout; it defaults to 30 minutes and must be a positive integer no greater than the fixed seven-day absolute timeout. Signup and signin set an HttpOnly session cookie and return the user profile plus a CSRF token. `session` restores the profile and token from the cookie. Session IDs are random, only their SHA-256 hashes are stored, and logout revokes the current session. Auth endpoints require a matching same-origin `Origin` header. Register the builder with `composeModules()` like other RPC feature modules.
+
+`SignupSigninScreen` accepts an `authClient` adapter. Pass callbacks backed by the application's generated `RPC_CLIENT.auth.signup()` and `RPC_CLIENT.auth.signin()` methods:
+
+```ts
+const authClient = {
+    signup: (name, email, password) => RPC_CLIENT.auth.signup({ name, email, password }),
+    signin: (name, password) => RPC_CLIENT.auth.signin({ name, password }),
+    session: () => RPC_CLIENT.auth.session({})
+}
+```
+
+Login profile state is available through `useAuthState` in `client/state/auth.js` and is persisted with Zustand. The CSRF token is kept only in memory; call the generated `auth.session()` endpoint on app startup to restore it from the server session before making protected RPC calls. `SignupSigninScreen` performs this restoration when mounted. Existing local profile data does not authenticate a user, and the old temporary-password field is discarded during state migration. Existing passwords remain valid: legacy scrypt hashes are verified with their original parameters and upgraded to hash version 1 on successful signin. New hashes use scrypt with `N=32768`, `r=8`, and `p=3`. The `/api/...` routes and `apiCall()` transport have been removed; RPC is the only supported application protocol.
+
+## Logging and audit records
+
+`LOGGER_MODULE.makeCli()` supplies `logger logs`, which reads an existing SQLite audit database in read-only mode. Supported filters are `--from`, `--to`, `--module`, `--level`, `--limit`, and `--offset`.
+
+`LOGGER_MODULE.makeAdmRpc()` creates the `audit_logs_v1` administrative endpoint, which can be registered like other administrative RPC plugins. It accepts optional time, module, level, limit, and offset filters. Pages are newest-first, ordered stably, and capped at 1,000 records; defaults are 100 records and offset 0.
+
+Applications can write typed audit events using `getAuditLogger<EventUnion>(module)`:
+
+```ts
+import { getAuditLogger, type AuditEvent } from 'rlz-engine/back/logger/audit-logger.js'
+
+type UserEvent = AuditEvent & { type: 'user-registered'; userId: string }
+const audit = getAuditLogger<UserEvent>('USERS')
+audit.info({ type: 'user-registered', userId: 'user-id' })
+```
+
+Each event has a `type` and structured fields. Audit records include time, level, module, type, data, and optional error details. `initAuditLogger()` selects console, SQLite, or combined console and SQLite sinks and returns a shutdown function. Loggers obtained before initialization are no-op until a sink is selected, and become no-op again after shutdown. `getSystemLogger(name)` creates a Fastify-compatible logger that forwards records as `SYSTEM` audit events and writes readable single-line output in production.
+
+Structured fields are persisted as provided; do not include passwords, admin secrets, or other sensitive values in log events. SQLite uses Node's built-in synchronous database API. Storage failures are reported to stderr and do not interrupt SystemLogger output.
+
+## MongoDB and synchronization
+
+`MongoStorage` in `back/storage/db.js` wraps MongoDB collections and reconciles indexes to the configured descriptions: non-system indexes not listed in the configuration are removed, and missing configured indexes are created. `back/storage/model.js` defines `MongoObject<T>` and the shared sync-object schema. `AuthStorage` is separate and stores authentication data.
+
+`back/storage/sync.js` provides `getAll()` for listing an owner's object IDs and modification times. The client-side `syncItems()` helper in `client/sync.js` compares these timestamps with local items, pushes newer local objects, and fetches newer or unknown remote objects. The sync helpers do not define application-specific merging, RPC endpoint names, or durable local storage; callers provide RPC-backed item access and update behavior.
+
+## React client components and state
+
+- `SignupSigninScreen` provides the signup/signin screen; applications supply its `appName` and generated-client-backed `authClient` props.
+- `NotFound` is the 404 screen.
+- `ItemsSelect` is a reusable item selector; its `ItemType` and `ItemsType` types are exported alongside it.
+- `useAuthState` holds persisted authentication state.
+- `cacheLastResult()` wraps a function to cache its last result.
+
+These are building blocks for an application UI. The package does not provide a complete application shell or the planned administration interface.
+
+## Shared utilities
+
+`shared/utils/datetime.js` exports `isValidDateTime()`, `assertValidDateTime()`, `toValidDateTime()`, and `utcToday()` for Luxon `DateTime` values. Authentication RPC schemas are owned by `back/auth/module.js`; applications generate their client types from that builder.
+
+## Development
+
+```sh
+npm install
+npm run build
+npm test
+```
+
+Auth storage integration tests can run against a local MongoDB by setting `MONGODB_TEST_URI`, for example `MONGODB_TEST_URI=mongodb://127.0.0.1:27017 npm test -- --run tests/auth-storage.integration.test.ts`. They create and drop a uniquely named test database.
+
+The package uses TypeScript, Vitest, ESLint, and Prettier. Read `spec/` before changing behavior, keep it current when a design or contract changes, and track accepted future work in `todo.md`.

package/dist/back/auth/admin-secret.d.ts

@@ -0,0 +1,4 @@
+export declare function generateAdminSecret(): Promise<string>;
+export declare function resetAdminSecret(workingDirectory?: string): Promise<string>;
+export declare function verifyAdminSecret(secret: string, workingDirectory?: string): Promise<boolean>;
+export declare function writeAdminSecretHash(path: string, secret: string): Promise<void>;

package/dist/back/auth/admin-secret.js

@@ -0,0 +1,86 @@
+import { randomBytes, randomInt, scrypt as scryptCallback, timingSafeEqual } from 'node:crypto';
+import { mkdir, open, readFile, rename, rm } from 'node:fs/promises';
+import { dirname, join, resolve } from 'node:path';
+const SECRET_ALPHABET = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789';
+const HASH_LENGTH = 64;
+const SCRYPT_N = 16384;
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+const adminSecretRecords = new Map();
+export async function generateAdminSecret() {
+    return Array.from({ length: 32 }, () => SECRET_ALPHABET[randomInt(SECRET_ALPHABET.length)]).join('');
+}
+export async function resetAdminSecret(workingDirectory = process.cwd()) {
+    const secret = await generateAdminSecret();
+    await writeAdminSecretHash(join(workingDirectory, 'auth', 'admin-secret'), secret);
+    return secret;
+}
+export async function verifyAdminSecret(secret, workingDirectory = process.cwd()) {
+    const path = resolve(workingDirectory, 'auth', 'admin-secret');
+    let recordPromise = adminSecretRecords.get(path);
+    if (recordPromise === undefined) {
+        recordPromise = readAdminSecretRecord(path);
+        adminSecretRecords.set(path, recordPromise);
+    }
+    const record = await recordPromise;
+    if (record === null) {
+        return false;
+    }
+    const actualHash = await deriveSecretHash(secret, record.salt);
+    return timingSafeEqual(actualHash, record.hash);
+}
+async function readAdminSecretRecord(path) {
+    let contents;
+    try {
+        contents = await readFile(path, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    const match = /^scrypt\$(\d+)\$(\d+)\$(\d+)\$([A-Za-z0-9+/]+={0,2})\$([A-Za-z0-9+/]+={0,2})\n?$/.exec(contents);
+    if (match === null || match[1] !== String(SCRYPT_N) || match[2] !== String(SCRYPT_R) || match[3] !== String(SCRYPT_P)) {
+        return null;
+    }
+    const salt = Buffer.from(match[4], 'base64');
+    const hash = Buffer.from(match[5], 'base64');
+    if (salt.length !== 16 || hash.length !== HASH_LENGTH) {
+        return null;
+    }
+    return { salt, hash };
+}
+function deriveSecretHash(secret, salt) {
+    return new Promise((resolve, reject) => {
+        scryptCallback(secret, salt, HASH_LENGTH, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P }, (error, derivedKey) => {
+            if (error !== null) {
+                reject(error);
+            }
+            else {
+                resolve(derivedKey);
+            }
+        });
+    });
+}
+export async function writeAdminSecretHash(path, secret) {
+    const salt = randomBytes(16);
+    const hash = await deriveSecretHash(secret, salt);
+    const record = `scrypt$${SCRYPT_N}$${SCRYPT_R}$${SCRYPT_P}$${salt.toString('base64')}$${hash.toString('base64')}\n`;
+    const directory = dirname(path);
+    const temporaryPath = join(directory, `.admin-secret-${process.pid}-${randomBytes(8).toString('hex')}.tmp`);
+    await mkdir(directory, { recursive: true });
+    try {
+        const file = await open(temporaryPath, 'wx', 0o600);
+        try {
+            await file.writeFile(record, 'utf8');
+            await file.sync();
+        }
+        finally {
+            await file.close();
+        }
+        await rename(temporaryPath, path);
+    }
+    catch (error) {
+        await rm(temporaryPath, { force: true });
+        throw error;
+    }
+}
+//# sourceMappingURL=admin-secret.js.map

package/dist/back/auth/admin-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-secret.js","sourceRoot":"","sources":["../../../src/back/auth/admin-secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,IAAI,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC/F,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AACpE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAElD,MAAM,eAAe,GAAG,2DAA2D,CAAA;AACnF,MAAM,WAAW,GAAG,EAAE,CAAA;AACtB,MAAM,QAAQ,GAAG,KAAK,CAAA;AACtB,MAAM,QAAQ,GAAG,CAAC,CAAA;AAClB,MAAM,QAAQ,GAAG,CAAC,CAAA;AAClB,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA0D,CAAA;AAE5F,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACrC,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACxG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,gBAAgB,GAAG,OAAO,CAAC,GAAG,EAAE;IACnE,MAAM,MAAM,GAAG,MAAM,mBAAmB,EAAE,CAAA;IAC1C,MAAM,oBAAoB,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAA;IAClF,OAAO,MAAM,CAAA;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,EAAE;IACpF,MAAM,IAAI,GAAG,OAAO,CAAC,gBAAgB,EAAE,MAAM,EAAE,cAAc,CAAC,CAAA;IAC9D,IAAI,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAChD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAC9B,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAA;QAC3C,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;IAC/C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAA;IAClC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,KAAK,CAAA;IAChB,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;IAC9D,OAAO,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;AACnD,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,IAAY;IAC7C,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QACD,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAA;IACf,CAAC;IAED,MAAM,KAAK,GAAG,kFAAkF,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/G,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpH,OAAO,IAAI,CAAA;IACf,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACpD,OAAO,IAAI,CAAA;IACf,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AACzB,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,IAAY;IAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;YACvG,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,CAAC,KAAK,CAAC,CAAA;YACjB,CAAC;iBAAM,CAAC;gBACJ,OAAO,CAAC,UAAU,CAAC,CAAA;YACvB,CAAC;QACL,CAAC,CAAC,CAAA;IACN,CAAC,CAAC,CAAA;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,MAAc;IACnE,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;IAC5B,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,UAAU,QAAQ,IAAI,QAAQ,IAAI,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAA;IACnH,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,iBAAiB,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAE3G,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3C,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;QACnD,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YACpC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACrB,CAAC;gBAAS,CAAC;YACP,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;QACtB,CAAC;QACD,MAAM,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACxC,MAAM,KAAK,CAAA;IACf,CAAC;AACL,CAAC"}

package/dist/back/auth/cookies.d.ts

@@ -0,0 +1,12 @@
+import type { CookieSerializeOptions } from '@fastify/cookie';
+export declare const SESSION_COOKIE_NAME = "__Host-session";
+export declare const SESSION_COOKIE_MAX_AGE_SECONDS: number;
+/** Set the HttpOnly session cookie without a Domain attribute. */
+export declare function setSessionCookie(reply: SessionCookieReply, value: string): void;
+/** Clear the session cookie using the same path and security attributes used when setting it. */
+export declare function clearSessionCookie(reply: SessionCookieReply): void;
+interface SessionCookieReply {
+    setCookie(name: string, value: string, options: CookieSerializeOptions): unknown;
+    clearCookie(name: string, options: CookieSerializeOptions): unknown;
+}
+export {};

package/dist/back/auth/cookies.js

@@ -0,0 +1,20 @@
+export const SESSION_COOKIE_NAME = '__Host-session';
+export const SESSION_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 7;
+/** Set the HttpOnly session cookie without a Domain attribute. */
+export function setSessionCookie(reply, value) {
+    reply.setCookie(SESSION_COOKIE_NAME, value, makeOptions());
+}
+/** Clear the session cookie using the same path and security attributes used when setting it. */
+export function clearSessionCookie(reply) {
+    reply.clearCookie(SESSION_COOKIE_NAME, makeOptions());
+}
+function makeOptions() {
+    return {
+        httpOnly: true,
+        secure: true,
+        sameSite: 'lax',
+        path: '/',
+        maxAge: SESSION_COOKIE_MAX_AGE_SECONDS
+    };
+}
+//# sourceMappingURL=cookies.js.map

package/dist/back/auth/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../../src/back/auth/cookies.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAA;AACnD,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;AAE9D,kEAAkE;AAClE,MAAM,UAAU,gBAAgB,CAAC,KAAyB,EAAE,KAAa;IACrE,KAAK,CAAC,SAAS,CAAC,mBAAmB,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;AAC9D,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IACxD,KAAK,CAAC,WAAW,CAAC,mBAAmB,EAAE,WAAW,EAAE,CAAC,CAAA;AACzD,CAAC;AAOD,SAAS,WAAW;IAChB,OAAO;QACH,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,8BAA8B;KACzC,CAAA;AACL,CAAC"}

package/dist/back/auth/csrf.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyRequest } from 'fastify';
+export declare const CSRF_TOKEN_HEADER = "x-csrf-token";
+/** Create a secret token suitable for storing with one server-side session. */
+export declare function makeCsrfToken(): string;
+/** Compare a session's expected CSRF token with the token submitted in a request header. */
+export declare function verifyCsrfToken(expected: string, provided: string | string[] | undefined): boolean;
+/** Reject requests whose browser Origin does not match the request's own origin. */
+export declare function assertSameOrigin(request: Pick<FastifyRequest, 'headers' | 'protocol'>): void;

package/dist/back/auth/csrf.js

@@ -0,0 +1,47 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { httpErrors } from '@fastify/sensible';
+export const CSRF_TOKEN_HEADER = 'x-csrf-token';
+/** Create a secret token suitable for storing with one server-side session. */
+export function makeCsrfToken() {
+    return randomBytes(32).toString('base64url');
+}
+/** Compare a session's expected CSRF token with the token submitted in a request header. */
+export function verifyCsrfToken(expected, provided) {
+    if (!/^[A-Za-z0-9_-]{43}$/.test(expected) || typeof provided !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(provided)) {
+        return false;
+    }
+    const expectedBytes = Buffer.from(expected);
+    const providedBytes = Buffer.from(provided);
+    const expectedHash = createHash('sha256').update(expectedBytes).digest();
+    const providedHash = createHash('sha256').update(providedBytes).digest();
+    return timingSafeEqual(expectedHash, providedHash);
+}
+/** Reject requests whose browser Origin does not match the request's own origin. */
+export function assertSameOrigin(request) {
+    const originHeader = request.headers.origin;
+    const hostHeader = request.headers.host;
+    const origin = Array.isArray(originHeader) ? undefined : originHeader;
+    const host = Array.isArray(hostHeader) ? undefined : hostHeader;
+    if (origin === undefined || origin === 'null' || host === undefined || !isCanonicalOrigin(origin)) {
+        throw httpErrors.forbidden();
+    }
+    try {
+        if (new URL(origin).origin !== new URL(`${request.protocol}://${host}`).origin)
+            throw httpErrors.forbidden();
+    }
+    catch (error) {
+        if (error instanceof Error && 'statusCode' in error)
+            throw error;
+        throw httpErrors.forbidden();
+    }
+}
+function isCanonicalOrigin(value) {
+    try {
+        const parsed = new URL(value);
+        return (parsed.protocol === 'http:' || parsed.protocol === 'https:') && parsed.origin === value;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=csrf.js.map

package/dist/back/auth/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../../src/back/auth/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEtE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAG9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAA;AAE/C,+EAA+E;AAC/E,MAAM,UAAU,aAAa;IACzB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAChD,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,QAAuC;IACrF,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjH,OAAO,KAAK,CAAA;IAChB,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC3C,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC3C,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,CAAA;IACxE,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,CAAA;IACxE,OAAO,eAAe,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;AACtD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,OAAqD;IAClF,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAA;IAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IACvC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAA;IACrE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAA;IAE/D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChG,MAAM,UAAU,CAAC,SAAS,EAAE,CAAA;IAChC,CAAC;IAED,IAAI,CAAC;QACD,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,QAAQ,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM;YAAE,MAAM,UAAU,CAAC,SAAS,EAAE,CAAA;IAChH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,KAAK,IAAI,YAAY,IAAI,KAAK;YAAE,MAAM,KAAK,CAAA;QAChE,MAAM,UAAU,CAAC,SAAS,EAAE,CAAA;IAChC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACpC,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC7B,OAAO,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAA;IACnG,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAA;IAChB,CAAC;AACL,CAAC"}

package/dist/back/auth/model.d.ts

@@ -5,10 +5,14 @@ export interface StorageUser {
     email: string;
     passwordSalt: Binary;
     passwordHash: Binary;
+    passwordHashVersion?: number;
     lastActivityDate: Date;
 }
-export interface StorageTempPassword {
+export interface StorageSession {
     userId: string;
-    passwordHash: Binary;
-    validUntil: Date;
+    sessionHash: Binary;
+    csrfToken: string;
+    createdAt: Date;
+    lastActivityAt: Date;
+    expiresAt: Date;
 }

package/dist/back/auth/module.d.ts

@@ -0,0 +1,14 @@
+import { CliModule } from '../cli/cli-engine.js';
+import { RpcPluginBuilder } from '../rpc/rpc.js';
+import { AuthStorage } from './storage.js';
+export interface AuthRpcOptions {
+    /** Maximum time without an authenticated request before a session expires. Defaults to 30 minutes. */
+    sessionIdleTimeoutMs?: number;
+}
+/** Authentication RPC and administrative maintenance integrations. */
+export declare const AUTH_MODULE: {
+    /** Create signup/signin, session restoration, and cookie-authenticated logout RPC endpoints. */
+    makeRpc(storage: AuthStorage, options?: AuthRpcOptions): RpcPluginBuilder;
+    /** Create the `adm reset-secret` command for the supplied application directory. */
+    makeCli(workingDirectory?: string | (() => string)): CliModule;
+};

package/dist/back/auth/module.js

@@ -0,0 +1,121 @@
+import { httpErrors } from '@fastify/sensible';
+import { resolve } from 'node:path';
+import { resetAdminSecret } from './admin-secret.js';
+import { clearSessionCookie, setSessionCookie } from './cookies.js';
+import { assertSameOrigin } from './csrf.js';
+import { AuthRateLimiter } from './rate-limit.js';
+import { authenticateSession, createSession, revokeCurrentSession, SESSION_ABSOLUTE_TIMEOUT_MS, SESSION_IDLE_TIMEOUT_MS, verifySessionCsrf } from './session.js';
+import { rpc } from '../rpc/rpc.js';
+import { signin, signup } from './utils.js';
+import { z } from 'zod';
+const AUTH_RESPONSE_SCHEMA = z.object({ id: z.uuid(), name: z.string(), email: z.email(), csrfToken: z.string() });
+const SIGNUP_REQUEST_SCHEMA = z.object({
+    name: z.string().min(1).max(64),
+    email: z.email().max(254),
+    password: z.string().min(12).max(1024)
+});
+const SIGNIN_REQUEST_SCHEMA = z.object({ name: z.string().min(1).max(64), password: z.string().max(1024) });
+const EMPTY_REQUEST_SCHEMA = z.object({});
+const EMPTY_RESPONSE_SCHEMA = z.object({});
+/** Authentication RPC and administrative maintenance integrations. */
+export const AUTH_MODULE = {
+    /** Create signup/signin, session restoration, and cookie-authenticated logout RPC endpoints. */
+    makeRpc(storage, options = {}) {
+        const sessionIdleTimeoutMs = options.sessionIdleTimeoutMs ?? SESSION_IDLE_TIMEOUT_MS;
+        if (!Number.isSafeInteger(sessionIdleTimeoutMs) ||
+            sessionIdleTimeoutMs <= 0 ||
+            sessionIdleTimeoutMs > SESSION_ABSOLUTE_TIMEOUT_MS) {
+            throw new RangeError(`sessionIdleTimeoutMs must be a positive integer no greater than ${SESSION_ABSOLUTE_TIMEOUT_MS}`);
+        }
+        const rateLimiter = new AuthRateLimiter();
+        return rpc('auth')
+            .add({
+            v: 1,
+            name: 'signup',
+            anonimous: true,
+            bodySchema: SIGNUP_REQUEST_SCHEMA,
+            respSchema: EMPTY_RESPONSE_SCHEMA,
+            action: async (body, _opts, context) => {
+                assertSameOrigin(context.request);
+                await rateLimiter.run('signup', context.request.ip, async () => {
+                    try {
+                        await signup(storage, body.name, body.email, body.password);
+                    }
+                    catch (error) {
+                        // Keep a duplicate name indistinguishable from a successful registration.
+                        if (!isConflictError(error))
+                            throw error;
+                    }
+                });
+                return {};
+            }
+        })
+            .add({
+            v: 1,
+            name: 'signin',
+            anonimous: true,
+            bodySchema: SIGNIN_REQUEST_SCHEMA,
+            respSchema: AUTH_RESPONSE_SCHEMA,
+            action: async (body, _opts, context) => {
+                assertSameOrigin(context.request);
+                const response = await rateLimiter.run('signin', context.request.ip, () => signin(storage, body.name, body.password));
+                if (response === null)
+                    throw httpErrors.unauthorized();
+                await revokeCurrentSession(storage, context);
+                const session = await createSession(storage, response.id);
+                setSessionCookie(context.reply, session.sessionId);
+                return { ...response, csrfToken: session.csrfToken };
+            }
+        })
+            .add({
+            v: 1,
+            name: 'session',
+            bodySchema: EMPTY_REQUEST_SCHEMA,
+            respSchema: AUTH_RESPONSE_SCHEMA,
+            cookieAuth: {
+                authenticate: (context) => authenticateSession(storage, context, sessionIdleTimeoutMs),
+                verifyCsrf: async (context, session) => {
+                    assertSameOrigin(context.request);
+                    await storage.touchSession(session.sessionHash, new Date());
+                }
+            },
+            action: (session) => ({ ...session.user, csrfToken: session.csrfToken })
+        })
+            .add({
+            v: 1,
+            name: 'logout',
+            bodySchema: EMPTY_REQUEST_SCHEMA,
+            respSchema: EMPTY_RESPONSE_SCHEMA,
+            cookieAuth: {
+                authenticate: (context) => authenticateSession(storage, context, sessionIdleTimeoutMs),
+                verifyCsrf: (context, session) => verifySessionCsrf(storage, context, session)
+            },
+            action: async (session, _body, _opts, context) => {
+                await storage.deleteSession(session.sessionHash);
+                clearSessionCookie(context.reply);
+                return {};
+            }
+        });
+    },
+    /** Create the `adm reset-secret` command for the supplied application directory. */
+    makeCli(workingDirectory = () => process.cwd()) {
+        return {
+            name: 'adm',
+            description: 'Administrative maintenance commands.',
+            commands: {
+                'reset-secret': {
+                    description: 'Generate a keyboard-friendly administrative secret and atomically replace the stored password hash. The plaintext is printed once after the hash is safely written.',
+                    handler: async () => {
+                        const directory = typeof workingDirectory === 'function' ? workingDirectory() : workingDirectory;
+                        const secret = await resetAdminSecret(resolve(directory));
+                        process.stdout.write(`${secret}\n`);
+                    }
+                }
+            }
+        };
+    }
+};
+function isConflictError(error) {
+    return error instanceof Error && 'statusCode' in error && error.statusCode === 409;
+}
+//# sourceMappingURL=module.js.map

package/dist/back/auth/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../src/back/auth/module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EACH,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,2BAA2B,EAC3B,uBAAuB,EACvB,iBAAiB,EACpB,MAAM,cAAc,CAAA;AAErB,OAAO,EAAoB,GAAG,EAAE,MAAM,eAAe,CAAA;AAErD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAClH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;CACzC,CAAC,CAAA;AACF,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC3G,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AACzC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAO1C,sEAAsE;AACtE,MAAM,CAAC,MAAM,WAAW,GAAG;IACvB,gGAAgG;IAChG,OAAO,CAAC,OAAoB,EAAE,OAAO,GAAmB,EAAE;QACtD,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,uBAAuB,CAAA;QACpF,IACI,CAAC,MAAM,CAAC,aAAa,CAAC,oBAAoB,CAAC;YAC3C,oBAAoB,IAAI,CAAC;YACzB,oBAAoB,GAAG,2BAA2B,EACpD,CAAC;YACC,MAAM,IAAI,UAAU,CAAC,mEAAmE,2BAA2B,EAAE,CAAC,CAAA;QAC1H,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,eAAe,EAAE,CAAA;QAEzC,OAAO,GAAG,CAAC,MAAM,CAAC;aACb,GAAG,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,qBAAqB;YACjC,UAAU,EAAE,qBAAqB;YACjC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACnC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;gBACjC,MAAM,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;oBAC3D,IAAI,CAAC;wBACD,MAAM,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;oBAC/D,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACb,0EAA0E;wBAC1E,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;4BAAE,MAAM,KAAK,CAAA;oBAC5C,CAAC;gBACL,CAAC,CAAC,CAAA;gBACF,OAAO,EAAE,CAAA;YACb,CAAC;SACJ,CAAC;aACD,GAAG,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,qBAAqB;YACjC,UAAU,EAAE,oBAAoB;YAChC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACnC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;gBACjC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;gBACrH,IAAI,QAAQ,KAAK,IAAI;oBAAE,MAAM,UAAU,CAAC,YAAY,EAAE,CAAA;gBACtD,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBAC5C,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAA;gBACzD,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;gBAClD,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAA;YACxD,CAAC;SACJ,CAAC;aACD,GAAG,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,oBAAoB;YAChC,UAAU,EAAE,oBAAoB;YAChC,UAAU,EAAE;gBACR,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,oBAAoB,CAAC;gBACtF,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;oBACnC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;oBACjC,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;gBAC/D,CAAC;aACJ;YACD,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;SAC3E,CAAC;aACD,GAAG,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,oBAAoB;YAChC,UAAU,EAAE,qBAAqB;YACjC,UAAU,EAAE;gBACR,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,oBAAoB,CAAC;gBACtF,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;aACjF;YACD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7C,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;gBAChD,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;gBACjC,OAAO,EAAE,CAAA;YACb,CAAC;SACJ,CAAC,CAAA;IACV,CAAC;IACD,oFAAoF;IACpF,OAAO,CAAC,gBAAgB,GAA4B,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;QACnE,OAAO;YACH,IAAI,EAAE,KAAK;YACX,WAAW,EAAE,sCAAsC;YACnD,QAAQ,EAAE;gBACN,cAAc,EAAE;oBACZ,WAAW,EACP,qKAAqK;oBACzK,OAAO,EAAE,KAAK,IAAI,EAAE;wBAChB,MAAM,SAAS,GAAG,OAAO,gBAAgB,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAA;wBAChG,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAA;wBACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,CAAA;oBACvC,CAAC;iBACJ;aACJ;SACJ,CAAA;IACL,CAAC;CACJ,CAAA;AAED,SAAS,eAAe,CAAC,KAAc;IACnC,OAAO,KAAK,YAAY,KAAK,IAAI,YAAY,IAAI,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,CAAA;AACtF,CAAC"}

package/dist/back/auth/rate-limit.d.ts

@@ -0,0 +1,11 @@
+type AuthOperation = 'signin' | 'signup';
+/** Bounds anonymous password-hash work per peer and across this server process. */
+export declare class AuthRateLimiter {
+    private readonly buckets;
+    private activeOperations;
+    private bucketInsertionsSinceCleanup;
+    run<T>(operation: AuthOperation, ip: string, action: () => Promise<T>): Promise<T>;
+    private checkRate;
+    private removeExpiredBuckets;
+}
+export {};