slotlock 0.6.3 → 0.7.0

package/billing.d.ts

@@ -0,0 +1,114 @@
+import { type SlotlockPlan, type SlotlockPlanStatus } from './plans.js';
+import type { SlotlockSql } from './store.js';
+export type SlotlockBillingInterval = 'month' | 'year';
+/**
+ * Stripe answered with an error, or did not answer, or (`subscription_exists`) the customer already
+ * pays for a subscription. The message never holds the key.
+ */
+export declare class SlotlockBillingError extends Error {
+    readonly status?: number | undefined;
+    readonly code?: 'subscription_exists' | undefined;
+    constructor(message: string, status?: number | undefined, code?: 'subscription_exists' | undefined);
+}
+/**
+ * The Stripe-Version every request sends unless `apiVersion` says otherwise: Managed Payments needs
+ * 2025-03-31.basil or later and became generally available in this one (docs.stripe.com changelog,
+ * read 2026-11-09). Pinned, so the account's default version never changes what is sent or read.
+ */
+export declare const SLOTLOCK_STRIPE_API_VERSION = "2026-04-22.dahlia";
+export interface SlotlockStripeOptions {
+    /** A restricted key: write on Checkout Sessions and portal sessions, read on Subscriptions. */
+    secretKey: string;
+    /** The Developer plan's price ids, monthly and yearly. */
+    prices: Readonly<Record<SlotlockBillingInterval, string>>;
+    /** The Team plan's price ids, monthly and yearly (Teams on Cloud): an organization's checkout. */
+    teamPrices?: Readonly<Record<SlotlockBillingInterval, string>>;
+    /**
+     * Metered overage (overage.ts, SLOTLOCK_OVERAGE): a metered price on a Billing Meter, added to a
+     * Developer checkout so operations above the quota can be billed. Off without it.
+     */
+    overagePrice?: string;
+    /** Sent as Stripe-Version; SLOTLOCK_STRIPE_API_VERSION when unset. */
+    apiVersion?: string;
+    apiBase?: string;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}
+/** The parts of a Stripe subscription the plan is read from. */
+export interface SlotlockStripeSubscription {
+    id: string;
+    status: string;
+    customer: string | {
+        id: string;
+    };
+    metadata?: Record<string, string>;
+    current_period_end?: number | null;
+    items?: {
+        data?: Array<{
+            current_period_end?: number | null;
+            price?: {
+                id?: string;
+            } | string | null;
+        }>;
+    };
+}
+export interface SlotlockStripe {
+    /** A Checkout URL for a Developer (or, with team prices, Team) subscription, tagged with the tenant. */
+    checkout(input: {
+        tenantRef: string;
+        interval: SlotlockBillingInterval;
+        /** Developer unless `team`, which needs the Team prices. */
+        plan?: 'developer' | 'team';
+        customer: string | null;
+        successUrl: string;
+        cancelUrl: string;
+    }): Promise<string>;
+    /** A customer portal URL, to change or cancel the subscription and see invoices. */
+    portal(input: {
+        customer: string;
+        returnUrl: string;
+    }): Promise<string>;
+    subscription(id: string): Promise<SlotlockStripeSubscription>;
+    /** The customer's subscriptions that give a plan (`active`, `trialing`, `past_due`). */
+    liveSubscriptionsOfCustomer(customer: string): Promise<SlotlockStripeSubscription[]>;
+    /**
+     * The tenant's subscriptions that give a plan, found by their `tenant_ref` metadata under any
+     * customer (Stripe's search, which can lag a minute behind a subscription just created).
+     */
+    liveSubscriptionsOfTenant(tenantRef: string): Promise<SlotlockStripeSubscription[]>;
+    /** The plan a subscription gives, by its price: Team for a Team price, else Developer. */
+    planOf?(subscription: SlotlockStripeSubscription): {
+        plan: SlotlockPlan;
+        status: SlotlockPlanStatus;
+    };
+}
+/** Whether the subscription gives its tenant a plan. */
+export declare function slotlockSubscriptionIsLive(subscription: SlotlockStripeSubscription): boolean;
+export declare function createSlotlockStripe(options: SlotlockStripeOptions): SlotlockStripe;
+/**
+ * Whether a webhook's body was signed by Stripe with this endpoint's secret
+ * (docs.stripe.com/webhooks#verify-manually): `t=<unix seconds>,v1=<hex HMAC-SHA256 of "t.body">`,
+ * any v1 matching, within `toleranceSeconds` of now.
+ */
+export declare function verifySlotlockStripeSignature(body: string, header: string | null, secret: string, nowMs: number, toleranceSeconds?: number): boolean;
+/** The plan a subscription gives its tenant. */
+export declare function slotlockPlanOfSubscription(subscription: SlotlockStripeSubscription, teamPrices?: Readonly<Record<SlotlockBillingInterval, string>>): {
+    plan: SlotlockPlan;
+    status: SlotlockPlanStatus;
+};
+/**
+ * Handles one Stripe webhook delivery: checks its signature, then, for any event about a
+ * subscription, reads that subscription from Stripe (not the event, which may be stale or arrive out
+ * of order) and sets its tenant's plan. A tenant that bought twice (two tabs, before either webhook
+ * arrived) keeps Developer until its last live subscription ends, and the second purchase is
+ * reported through `onDuplicate`, by subscription ids only, for a refund. Answers 400 to an unsigned
+ * or unreadable body, 500 when Stripe or the database fails (Stripe retries), and 200 otherwise.
+ */
+export declare function handleSlotlockStripeWebhook(request: Request, deps: {
+    secret: string;
+    stripe: SlotlockStripe;
+    sql: SlotlockSql;
+    now?: () => number;
+    onError?: (error: unknown) => void;
+    onDuplicate?: (subscriptionIds: readonly string[]) => void;
+}): Promise<Response>;

package/billing.js

@@ -0,0 +1,258 @@
+// Hosted Slotlock's billing through Stripe: Checkout (with Managed Payments, Stripe as merchant of
+// record) to start a Developer subscription, the customer portal to manage one, and the webhook that
+// keeps a tenant's plan (plans.ts) in step with its subscription. Plain fetch, so it runs on a
+// Worker. Self-hosted Slotlock never uses it.
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { readSlotlockTenantPlan, setSlotlockTenantPlan, } from './plans.js';
+/**
+ * Stripe answered with an error, or did not answer, or (`subscription_exists`) the customer already
+ * pays for a subscription. The message never holds the key.
+ */
+export class SlotlockBillingError extends Error {
+    status;
+    code;
+    constructor(message, status, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'SlotlockBillingError';
+    }
+}
+/**
+ * The Stripe-Version every request sends unless `apiVersion` says otherwise: Managed Payments needs
+ * 2025-03-31.basil or later and became generally available in this one (docs.stripe.com changelog,
+ * read 2026-11-09). Pinned, so the account's default version never changes what is sent or read.
+ */
+export const SLOTLOCK_STRIPE_API_VERSION = '2026-04-22.dahlia';
+/** Statuses in which a subscription gives its tenant the Developer plan (slotlockPlanOfSubscription). */
+const LIVE = new Set(['active', 'trialing', 'past_due']);
+/** Whether the subscription gives its tenant a plan. */
+export function slotlockSubscriptionIsLive(subscription) {
+    return LIVE.has(subscription.status);
+}
+const STRIPE_ID = /^[A-Za-z0-9_]{1,255}$/;
+/** A tenant reference as Stripe's search may quote it: no quote, backslash or control character. */
+const SEARCHABLE = /^[^'"\\\p{Cc}]{1,500}$/u;
+export function createSlotlockStripe(options) {
+    const base = options.apiBase ?? 'https://api.stripe.com';
+    const send = options.fetch ?? fetch;
+    const timeoutMs = options.timeoutMs ?? 10_000;
+    async function call(method, path, body) {
+        const headers = {
+            authorization: `Bearer ${options.secretKey}`,
+            'stripe-version': options.apiVersion ?? SLOTLOCK_STRIPE_API_VERSION,
+        };
+        if (body)
+            headers['content-type'] = 'application/x-www-form-urlencoded';
+        let response;
+        try {
+            response = await send(`${base}${path}`, {
+                method,
+                headers,
+                ...(body ? { body: body.toString() } : {}),
+                signal: AbortSignal.timeout(timeoutMs),
+            });
+        }
+        catch {
+            throw new SlotlockBillingError('Stripe did not answer');
+        }
+        const parsed = (await response.json().catch(() => null));
+        if (!response.ok || !parsed) {
+            const reason = [parsed?.error?.type, parsed?.error?.code].filter(Boolean).join(': ');
+            throw new SlotlockBillingError(`Stripe refused ${method} ${path.split('?')[0]} (${String(response.status)}${reason ? `, ${reason}` : ''})`, response.status);
+        }
+        return parsed;
+    }
+    async function liveSubscriptionsOfCustomer(customer) {
+        if (!STRIPE_ID.test(customer))
+            throw new SlotlockBillingError('Not a customer id');
+        // Without a status, Stripe lists every subscription that is not canceled.
+        const page = await call('GET', `/v1/subscriptions?${new URLSearchParams({ customer, limit: '100' }).toString()}`);
+        return (page.data ?? []).filter(slotlockSubscriptionIsLive);
+    }
+    return {
+        async checkout({ tenantRef, interval, plan = 'developer', customer, successUrl, cancelUrl }) {
+            if (plan === 'team' && !options.teamPrices)
+                throw new SlotlockBillingError('There is no Team price');
+            const price = plan === 'team' ? options.teamPrices[interval] : options.prices[interval];
+            // A customer who already pays changes the plan in the portal: a second Checkout would charge
+            // twice for one tenant. (A first purchase has no customer yet; the webhook catches that case.)
+            if (customer && (await liveSubscriptionsOfCustomer(customer)).length > 0) {
+                throw new SlotlockBillingError('The customer has a live subscription already', 409, 'subscription_exists');
+            }
+            const form = new URLSearchParams({
+                mode: 'subscription',
+                'line_items[0][price]': price,
+                'line_items[0][quantity]': '1',
+                // A metered price takes no quantity: what the meter reports is billed.
+                ...(plan === 'developer' && options.overagePrice ? { 'line_items[1][price]': options.overagePrice } : {}),
+                'managed_payments[enabled]': 'true',
+                success_url: successUrl,
+                cancel_url: cancelUrl,
+                client_reference_id: tenantRef.replace(/[^A-Za-z0-9_-]/g, '_').slice(0, 200),
+                'metadata[tenant_ref]': tenantRef,
+                'subscription_data[metadata][tenant_ref]': tenantRef,
+            });
+            if (customer)
+                form.set('customer', customer);
+            const session = await call('POST', '/v1/checkout/sessions', form);
+            if (!session.url)
+                throw new SlotlockBillingError('Stripe gave no Checkout URL');
+            return session.url;
+        },
+        async portal({ customer, returnUrl }) {
+            const session = await call('POST', '/v1/billing_portal/sessions', new URLSearchParams({ customer, return_url: returnUrl }));
+            if (!session.url)
+                throw new SlotlockBillingError('Stripe gave no portal URL');
+            return session.url;
+        },
+        async subscription(id) {
+            if (!STRIPE_ID.test(id))
+                throw new SlotlockBillingError('Not a subscription id');
+            return call('GET', `/v1/subscriptions/${id}`);
+        },
+        liveSubscriptionsOfCustomer,
+        planOf: (subscription) => slotlockPlanOfSubscription(subscription, options.teamPrices),
+        async liveSubscriptionsOfTenant(tenantRef) {
+            if (!SEARCHABLE.test(tenantRef))
+                throw new SlotlockBillingError('Not a searchable tenant');
+            const page = await call('GET', `/v1/subscriptions/search?${new URLSearchParams({
+                query: `metadata['tenant_ref']:'${tenantRef}'`,
+                limit: '100',
+            }).toString()}`);
+            return (page.data ?? []).filter((found) => slotlockSubscriptionIsLive(found) && found.metadata?.tenant_ref === tenantRef);
+        },
+    };
+}
+/**
+ * Whether a webhook's body was signed by Stripe with this endpoint's secret
+ * (docs.stripe.com/webhooks#verify-manually): `t=<unix seconds>,v1=<hex HMAC-SHA256 of "t.body">`,
+ * any v1 matching, within `toleranceSeconds` of now.
+ */
+export function verifySlotlockStripeSignature(body, header, secret, nowMs, toleranceSeconds = 300) {
+    if (!header || !secret)
+        return false;
+    let timestamp;
+    const signatures = [];
+    for (const part of header.split(',')) {
+        const at = part.indexOf('=');
+        const key = part.slice(0, at).trim();
+        const value = part.slice(at + 1).trim();
+        if (key === 't' && /^\d{1,12}$/.test(value))
+            timestamp = Number(value);
+        if (key === 'v1' && /^[0-9a-f]{64}$/.test(value))
+            signatures.push(value);
+    }
+    if (timestamp === undefined || signatures.length === 0)
+        return false;
+    if (Math.abs(nowMs / 1000 - timestamp) > toleranceSeconds)
+        return false;
+    const expected = createHmac('sha256', secret).update(`${String(timestamp)}.${body}`).digest();
+    return signatures.some((signature) => timingSafeEqual(Buffer.from(signature, 'hex'), expected));
+}
+/** The plan a subscription gives its tenant. */
+export function slotlockPlanOfSubscription(subscription, teamPrices) {
+    // Team when any item is at a Team price: changed to it in the portal, or bought as it.
+    const team = teamPrices !== undefined &&
+        (subscription.items?.data ?? []).some((item) => {
+            const id = typeof item.price === 'string' ? item.price : item.price?.id;
+            return id === teamPrices.month || id === teamPrices.year;
+        });
+    const paid = team ? 'team' : 'developer';
+    switch (subscription.status) {
+        case 'active':
+        case 'trialing':
+            return { plan: paid, status: 'active' };
+        case 'past_due':
+            // Stripe is retrying the payment: keep the plan while it does.
+            return { plan: paid, status: 'past_due' };
+        default:
+            // canceled, unpaid, incomplete, incomplete_expired, paused: the Free limits.
+            return { plan: 'free', status: 'canceled' };
+    }
+}
+/** The subscription a webhook event is about, if any. */
+function subscriptionOf(event) {
+    const object = event?.data?.object;
+    if (!object)
+        return null;
+    if (object.object === 'subscription' && typeof object.id === 'string')
+        return object.id;
+    const field = object.subscription;
+    if (typeof field === 'string')
+        return field;
+    if (field && typeof field.id === 'string')
+        return field.id;
+    return null;
+}
+/**
+ * Handles one Stripe webhook delivery: checks its signature, then, for any event about a
+ * subscription, reads that subscription from Stripe (not the event, which may be stale or arrive out
+ * of order) and sets its tenant's plan. A tenant that bought twice (two tabs, before either webhook
+ * arrived) keeps Developer until its last live subscription ends, and the second purchase is
+ * reported through `onDuplicate`, by subscription ids only, for a refund. Answers 400 to an unsigned
+ * or unreadable body, 500 when Stripe or the database fails (Stripe retries), and 200 otherwise.
+ */
+export async function handleSlotlockStripeWebhook(request, deps) {
+    const text = (status, body) => new Response(body, { status, headers: { 'content-type': 'text/plain; charset=utf-8' } });
+    if (request.method !== 'POST')
+        return text(405, 'Use POST.');
+    if (Number(request.headers.get('content-length') ?? 0) > 1_000_000)
+        return text(413, 'Too large.');
+    const body = await request.text();
+    if (body.length > 1_000_000)
+        return text(413, 'Too large.');
+    const signed = verifySlotlockStripeSignature(body, request.headers.get('stripe-signature'), deps.secret, (deps.now ?? Date.now)());
+    if (!signed)
+        return text(400, 'Bad signature.');
+    let event;
+    try {
+        event = JSON.parse(body);
+    }
+    catch {
+        return text(400, 'Not JSON.');
+    }
+    const id = subscriptionOf(event);
+    if (!id)
+        return text(200, 'Ignored.');
+    try {
+        const subscription = await deps.stripe.subscription(id);
+        const tenantRef = subscription.metadata?.tenant_ref;
+        // Not one of the dashboard's: nothing to set.
+        if (!tenantRef)
+            return text(200, 'Ignored.');
+        const current = await readSlotlockTenantPlan(deps.sql, tenantRef);
+        const named = current?.stripeSubscription ?? null;
+        let chosen = subscription;
+        if (!slotlockSubscriptionIsLive(subscription)) {
+            // An ended subscription only ends the plan it gave: not one the tenant has started since.
+            if (named && named !== subscription.id)
+                return text(200, 'Ignored.');
+            // Nor one the tenant still pays for under another subscription.
+            const other = (await deps.stripe.liveSubscriptionsOfTenant(tenantRef)).find((found) => found.id !== subscription.id);
+            if (other)
+                chosen = other;
+        }
+        else if (named && named !== subscription.id) {
+            const previous = await deps.stripe.subscription(named).catch(() => null);
+            if (previous && slotlockSubscriptionIsLive(previous))
+                deps.onDuplicate?.([previous.id, subscription.id]);
+        }
+        const { plan, status } = deps.stripe.planOf?.(chosen) ?? slotlockPlanOfSubscription(chosen);
+        const customer = typeof chosen.customer === 'string' ? chosen.customer : chosen.customer.id;
+        const end = chosen.items?.data?.[0]?.current_period_end ?? chosen.current_period_end ?? null;
+        await setSlotlockTenantPlan(deps.sql, {
+            tenantRef,
+            plan,
+            status,
+            stripeCustomer: customer,
+            stripeSubscription: plan === 'free' ? null : chosen.id,
+            currentPeriodEnd: plan === 'free' || !end ? null : new Date(end * 1000),
+        });
+        return text(200, 'Updated.');
+    }
+    catch (error) {
+        deps.onError?.(error);
+        return text(500, 'Try again.');
+    }
+}

package/config.d.ts

@@ -30,17 +30,38 @@ export interface SlotlockServeDashboardConfig {
     githubClientId: string;
     githubClientSecret: string;
     sessionSecret: string;
-    /** GitHub user ids that may sign in, or `'*'` for every GitHub account. */
+    /** GitHub user ids and Google accounts (`google:<subject>`) that may sign in, or `'*'` for everyone. */
     allowedUsers: '*' | string[];
-    /** GitHub organization ids whose members share a tenant each (SLOTLOCK_DASHBOARD_ORGS). */
-    organizations?: string[];
+    /** Sign-in with Google too (SLOTLOCK_GOOGLE_CLIENT_ID and SLOTLOCK_GOOGLE_CLIENT_SECRET). */
+    google?: {
+        clientId: string;
+        clientSecret: string;
+    };
+    /**
+     * GitHub organization ids whose members share a tenant each (SLOTLOCK_DASHBOARD_ORGS), or
+     * `'enabled'`: those an owner turned on from the dashboard (Teams on Cloud, teams.ts).
+     */
+    organizations?: string[] | 'enabled';
     /** What the deployment is called in the dashboard (SLOTLOCK_DASHBOARD_NAME). */
     name?: string;
+    /**
+     * The terms people accept by signing in (SLOTLOCK_DASHBOARD_TERMS_URL): the sign-in page links
+     * them beside the button. Without it, the page names no terms.
+     */
+    termsUrl?: string;
+    /** What the sign-in page links as the privacy notice (SLOTLOCK_DASHBOARD_PRIVACY_URL). */
+    privacyUrl?: string;
     /**
      * Seals each tenant's model API key for the dashboard assistant (SLOTLOCK_ASSISTANT_SECRET).
      * Without it the assistant is off.
      */
     assistantSecret?: string;
+    /**
+     * Secrets model keys may still be sealed under, newest first (SLOTLOCK_ASSISTANT_PREVIOUS_SECRETS,
+     * comma-separated): each key one opens is sealed again under SLOTLOCK_ASSISTANT_SECRET when next
+     * used.
+     */
+    assistantPreviousSecrets?: string[];
     /**
      * Let the assistant reach a model at a local or private network address
      * (SLOTLOCK_ASSISTANT_PRIVATE_URLS=on): a self-hosted model on the same machine or network.
@@ -63,7 +84,7 @@ export declare function readDashboardConfig(env: SlotlockEnv): SlotlockServeDash
  * well: a server whose dashboard runs elsewhere (on Cloudflare Workers) still takes those
  * organizations' keys, and only theirs.
  */
-export declare function readDashboardOrganizations(env: SlotlockEnv): string[] | undefined;
+export declare function readDashboardOrganizations(env: SlotlockEnv): string[] | 'enabled' | undefined;
 /** A token bucket: `perSecond` tokens come back each second, and it holds at most `burst`. */
 export interface SlotlockRate {
     perSecond: number;

package/config.js

@@ -114,8 +114,9 @@ export function readDashboardUsers(env) {
     const users = optional(env, 'SLOTLOCK_DASHBOARD_USERS')?.replaceAll(' ', '');
     if (users === undefined)
         return undefined;
-    if (users !== '*' && !/^[1-9]\d{0,19}(,[1-9]\d{0,19})*$/.test(users)) {
-        throw new SlotlockConfigError('SLOTLOCK_DASHBOARD_USERS must be * for every GitHub account, or a comma-separated list of GitHub user ids (gh api users/<login> --jq .id)');
+    const person = '(?:[1-9]\\d{0,19}|google:[A-Za-z0-9._-]{1,255})';
+    if (users !== '*' && !new RegExp(`^${person}(,${person})*$`).test(users)) {
+        throw new SlotlockConfigError('SLOTLOCK_DASHBOARD_USERS must be * for every account, or a comma-separated list of GitHub user ids (gh api users/<login> --jq .id) and Google accounts as google:<subject>');
     }
     return users === '*' ? '*' : [...new Set(users.split(','))];
 }
@@ -135,6 +136,14 @@ export function readDashboardConfig(env) {
     if (githubClientSecret === undefined) {
         throw new SlotlockConfigError('SLOTLOCK_GITHUB_CLIENT_SECRET is required to serve the dashboard: a client secret of that GitHub OAuth app');
     }
+    const googleClientId = optional(env, 'SLOTLOCK_GOOGLE_CLIENT_ID');
+    const googleClientSecret = readSecret(env, 'SLOTLOCK_GOOGLE_CLIENT_SECRET');
+    if ((googleClientId === undefined) !== (googleClientSecret === undefined)) {
+        throw new SlotlockConfigError('SLOTLOCK_GOOGLE_CLIENT_ID and SLOTLOCK_GOOGLE_CLIENT_SECRET go together: an OAuth client of a Google Cloud project whose redirect URI is <SLOTLOCK_PUBLIC_URL>/dashboard/callback');
+    }
+    if (googleClientId !== undefined && !/^[A-Za-z0-9._-]{1,200}$/.test(googleClientId)) {
+        throw new SlotlockConfigError('SLOTLOCK_GOOGLE_CLIENT_ID must be a Google OAuth client id');
+    }
     const sessionSecret = readSecret(env, 'SLOTLOCK_SESSION_SECRET');
     if (sessionSecret === undefined) {
         throw new SlotlockConfigError(`SLOTLOCK_SESSION_SECRET is required to serve the dashboard: it signs sign-in sessions; ${SECRET_HINT}`);
@@ -143,6 +152,7 @@ export function readDashboardConfig(env) {
         env.SLOTLOCK_GITHUB_CLIENT_SECRET,
         env.SLOTLOCK_AUTH_TOKEN,
         env.SLOTLOCK_CONFIRMATION_SECRET,
+        ...(googleClientSecret !== undefined ? [googleClientSecret] : []),
     ];
     if (others.includes(sessionSecret)) {
         throw new SlotlockConfigError('SLOTLOCK_SESSION_SECRET must differ from every other secret');
@@ -162,26 +172,83 @@ export function readDashboardConfig(env) {
         [sessionSecret, ...others].includes(assistantSecret)) {
         throw new SlotlockConfigError('SLOTLOCK_ASSISTANT_SECRET must differ from every other secret');
     }
+    const previousSecrets = readAssistantPreviousSecrets(env, assistantSecret, [sessionSecret, ...others]);
     const privateUrls = optional(env, 'SLOTLOCK_ASSISTANT_PRIVATE_URLS') ?? 'off';
     if (privateUrls !== 'on' && privateUrls !== 'off') {
         throw new SlotlockConfigError('SLOTLOCK_ASSISTANT_PRIVATE_URLS must be on or off');
     }
     const orgs = readDashboardOrganizations(env);
+    if (Array.isArray(orgs) && googleClientId !== undefined) {
+        throw new SlotlockConfigError('SLOTLOCK_GOOGLE_CLIENT_ID does not go with a list of SLOTLOCK_DASHBOARD_ORGS: those organizations are GitHub\'s; use SLOTLOCK_DASHBOARD_ORGS=enabled to have both');
+    }
     const name = optional(env, 'SLOTLOCK_DASHBOARD_NAME')?.trim();
     if (name !== undefined && name !== '' && !SLOTLOCK_DASHBOARD_NAME_PATTERN.test(name)) {
         throw new SlotlockConfigError('SLOTLOCK_DASHBOARD_NAME must be 1-60 characters, without <, > or control or invisible characters');
     }
+    const termsUrl = readPolicyUrl(env, 'SLOTLOCK_DASHBOARD_TERMS_URL');
+    const privacyUrl = readPolicyUrl(env, 'SLOTLOCK_DASHBOARD_PRIVACY_URL');
     return {
         githubClientId,
         githubClientSecret,
         sessionSecret,
         allowedUsers: users,
+        ...(googleClientId !== undefined && googleClientSecret !== undefined
+            ? { google: { clientId: googleClientId, clientSecret: googleClientSecret } }
+            : {}),
         ...(orgs !== undefined ? { organizations: orgs } : {}),
         ...(name !== undefined && name !== '' ? { name } : {}),
+        ...(termsUrl !== undefined ? { termsUrl } : {}),
+        ...(privacyUrl !== undefined ? { privacyUrl } : {}),
         ...(assistantSecret !== undefined ? { assistantSecret } : {}),
+        ...(previousSecrets.length > 0 ? { assistantPreviousSecrets: previousSecrets } : {}),
         ...(assistantSecret !== undefined && privateUrls === 'on' ? { assistantPrivateUrls: true } : {}),
     };
 }
+/** Previous assistant secrets a deployment may keep (assistant.ts SLOTLOCK_ASSISTANT_MAX_PREVIOUS_SECRETS). */
+const MAX_ASSISTANT_PREVIOUS_SECRETS = 3;
+/**
+ * SLOTLOCK_ASSISTANT_PREVIOUS_SECRETS: up to three earlier values of SLOTLOCK_ASSISTANT_SECRET,
+ * comma-separated, newest first, each as strong as a secret must be and unlike every other secret.
+ * Only with SLOTLOCK_ASSISTANT_SECRET: without a current secret nothing would seal the keys again.
+ */
+function readAssistantPreviousSecrets(env, current, others) {
+    const name = 'SLOTLOCK_ASSISTANT_PREVIOUS_SECRETS';
+    const value = env[name];
+    if (value === undefined || value.trim() === '')
+        return [];
+    if (current === undefined) {
+        throw new SlotlockConfigError(`${name} needs SLOTLOCK_ASSISTANT_SECRET: the secret keys are sealed again under`);
+    }
+    const secrets = value.split(',').map((part) => readSecret({ [name]: part }, name));
+    if (secrets.some((secret) => secret === undefined)) {
+        throw new SlotlockConfigError(`${name} must be comma-separated secrets, with no empty one`);
+    }
+    const listed = secrets;
+    if (listed.length > MAX_ASSISTANT_PREVIOUS_SECRETS) {
+        throw new SlotlockConfigError(`${name} takes at most ${String(MAX_ASSISTANT_PREVIOUS_SECRETS)} secrets`);
+    }
+    if (new Set(listed).size !== listed.length || listed.some((secret) => secret === current || others.includes(secret))) {
+        throw new SlotlockConfigError(`${name} must differ from each other, from SLOTLOCK_ASSISTANT_SECRET and from every other secret`);
+    }
+    return listed;
+}
+/** A policy page the sign-in page links: an https URL, or undefined when the setting is empty. */
+function readPolicyUrl(env, name) {
+    const value = optional(env, name)?.trim();
+    if (value === undefined || value === '')
+        return undefined;
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new SlotlockConfigError(`${name} must be an https URL`);
+    }
+    if (url.protocol !== 'https:' || url.username !== '' || url.password !== '') {
+        throw new SlotlockConfigError(`${name} must be an https URL`);
+    }
+    return url.href;
+}
 /**
  * The GitHub organization ids of SLOTLOCK_DASHBOARD_ORGS, or undefined when unset. Read on its own as
  * well: a server whose dashboard runs elsewhere (on Cloudflare Workers) still takes those
@@ -191,8 +258,10 @@ export function readDashboardOrganizations(env) {
     const orgs = optional(env, 'SLOTLOCK_DASHBOARD_ORGS')?.replaceAll(' ', '');
     if (orgs === undefined)
         return undefined;
+    if (orgs === 'enabled')
+        return 'enabled';
     if (!/^[1-9]\d{0,19}(,[1-9]\d{0,19})*$/.test(orgs)) {
-        throw new SlotlockConfigError('SLOTLOCK_DASHBOARD_ORGS must be a comma-separated list of GitHub organization ids (gh api orgs/<login> --jq .id)');
+        throw new SlotlockConfigError('SLOTLOCK_DASHBOARD_ORGS must be a comma-separated list of GitHub organization ids (gh api orgs/<login> --jq .id), or enabled');
     }
     return [...new Set(orgs.split(','))];
 }

package/dashboard-icon.d.ts

@@ -0,0 +1 @@
+export declare const SLOTLOCK_DASHBOARD_ICON_SVG = "<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 64 64\"><rect width=\"64\" height=\"64\" rx=\"14\" fill=\"#111110\"/><g transform=\"translate(12.2 14.1) scale(0.465)\"><path fill=\"#F6F4EE\" d=\"M13.13 34.46L72.2 34.46C79.45 34.46 85.32 40.33 85.32 47.58L85.32 63.99C85.32 71.24 79.45 77.12 72.2 77.12L13.13 77.12C5.88 77.12 0 71.24 0 63.99L0 47.58C0 40.33 5.88 34.46 13.13 34.46ZM22.97 39.38L22.97 19.69C22.97 8.82 31.79 0 42.66 0C53.54 0 62.35 8.82 62.35 19.69L62.35 39.38L56.61 39.38L56.61 19.69C56.61 11.99 50.36 5.74 42.66 5.74C34.96 5.74 28.71 11.99 28.71 19.69L28.71 39.38Z\"/><path fill=\"#FF5B2E\" d=\"M19.69 52.51L65.63 52.51C67.45 52.51 68.91 53.98 68.91 55.79C68.91 57.6 67.45 59.07 65.63 59.07L19.69 59.07C17.88 59.07 16.41 57.6 16.41 55.79C16.41 53.98 17.88 52.51 19.69 52.51Z\"/></g></svg>\n";

package/dashboard-icon.js

@@ -0,0 +1,5 @@
+// The Slotlock mark the dashboard serves as its favicon. A copy of site/public/favicon.svg, which a
+// test keeps identical; the dashboard's Content-Security-Policy allows images from its own origin
+// only, so the mark is served, not inlined.
+export const SLOTLOCK_DASHBOARD_ICON_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><rect width="64" height="64" rx="14" fill="#111110"/><g transform="translate(12.2 14.1) scale(0.465)"><path fill="#F6F4EE" d="M13.13 34.46L72.2 34.46C79.45 34.46 85.32 40.33 85.32 47.58L85.32 63.99C85.32 71.24 79.45 77.12 72.2 77.12L13.13 77.12C5.88 77.12 0 71.24 0 63.99L0 47.58C0 40.33 5.88 34.46 13.13 34.46ZM22.97 39.38L22.97 19.69C22.97 8.82 31.79 0 42.66 0C53.54 0 62.35 8.82 62.35 19.69L62.35 39.38L56.61 39.38L56.61 19.69C56.61 11.99 50.36 5.74 42.66 5.74C34.96 5.74 28.71 11.99 28.71 19.69L28.71 39.38Z"/><path fill="#FF5B2E" d="M19.69 52.51L65.63 52.51C67.45 52.51 68.91 53.98 68.91 55.79C68.91 57.6 67.45 59.07 65.63 59.07L19.69 59.07C17.88 59.07 16.41 57.6 16.41 55.79C16.41 53.98 17.88 52.51 19.69 52.51Z"/></g></svg>
+`;