tacilytics 2.0.1 → 2.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tacilytics",
-  "version": "2.0.1",
+  "version": "2.1.0",
   "description": "Privacy-first, cookieless analytics for websites and apps. Self-hosted: one Node process, one SQLite file.",
   "main": "server.js",
   "type": "commonjs",
@@ -12,8 +12,10 @@
   "author": "Nyx 🦞 & Fabian Budde",
   "license": "MIT",
   "dependencies": {
+    "@simplewebauthn/server": "^14.0.3",
     "better-sqlite3": "^12.10.0",
-    "express": "^4.21.2"
+    "express": "^4.21.2",
+    "qrcode": "^1.5.4"
   },
   "bin": {
     "tacilytics": "cli.js",
@@ -46,6 +48,7 @@
     "server.js",
     "cli.js",
     "day-salt.js",
+    "auth.js",
     "tz-country.js",
     "public/",
     "sdk/flutter/",

package/public/account.js

@@ -0,0 +1,335 @@
+/* Tacilytics — sign-in (passphrase / account / TOTP / passkey), invites, Settings (security + team).
+   Loaded before app.js; uses window.Taci (api, esc, ico, signedIn, sites) lazily. */
+(function () {
+  var $ = function (id) { return document.getElementById(id); };
+  var T = function () { return window.Taci; };
+  var esc = function (s) { return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) { return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]; }); };
+  var ico = function (id) { return '<svg class="ico ui" aria-hidden="true"><use href="/assets/icons.svg?v=2#' + id + '"></use></svg>'; };
+  var hasPasskeys = !!(window.PublicKeyCredential && navigator.credentials && navigator.credentials.create);
+
+  function post(path, body, token) {
+    var h = { 'Content-Type': 'application/json' };
+    if (token) h['x-session-token'] = token;
+    return fetch(path, { method: 'POST', headers: h, body: JSON.stringify(body || {}) })
+      .then(function (r) { return r.json().catch(function () { return {}; }).then(function (j) { return { ok: r.ok, status: r.status, j: j }; }); });
+  }
+  // authenticated calls that also report errors (Taci.api only throws on 401)
+  function call(method, path, body) {
+    return fetch(path, { method: method, headers: { 'Content-Type': 'application/json', 'x-session-token': localStorage.getItem('nyx_token') || '' }, body: body ? JSON.stringify(body) : undefined })
+      .then(function (r) { return r.json().catch(function () { return {}; }).then(function (j) { if (!r.ok) throw new Error(j.error || ('HTTP ' + r.status)); return j; }); });
+  }
+
+  // ── WebAuthn: JSON options (base64url) ⇄ browser ArrayBuffers ──
+  function b64uToBuf(s) { s = s.replace(/-/g, '+').replace(/_/g, '/'); while (s.length % 4) s += '='; var b = atob(s), u = new Uint8Array(b.length); for (var i = 0; i < b.length; i++) u[i] = b.charCodeAt(i); return u.buffer; }
+  function bufToB64u(buf) { var u = new Uint8Array(buf), s = ''; for (var i = 0; i < u.length; i++) s += String.fromCharCode(u[i]); return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, ''); }
+  function pkCreate(o) {
+    var pub = Object.assign({}, o, {
+      challenge: b64uToBuf(o.challenge),
+      user: Object.assign({}, o.user, { id: b64uToBuf(o.user.id) }),
+      excludeCredentials: (o.excludeCredentials || []).map(function (c) { return Object.assign({}, c, { id: b64uToBuf(c.id) }); }),
+    });
+    return navigator.credentials.create({ publicKey: pub }).then(function (c) {
+      return {
+        id: c.id, rawId: bufToB64u(c.rawId), type: c.type, clientExtensionResults: c.getClientExtensionResults ? c.getClientExtensionResults() : {},
+        authenticatorAttachment: c.authenticatorAttachment || undefined,
+        response: {
+          clientDataJSON: bufToB64u(c.response.clientDataJSON), attestationObject: bufToB64u(c.response.attestationObject),
+          transports: c.response.getTransports ? c.response.getTransports() : undefined,
+        },
+      };
+    });
+  }
+  function pkGet(o) {
+    var pub = Object.assign({}, o, { challenge: b64uToBuf(o.challenge), allowCredentials: (o.allowCredentials || []).map(function (c) { return Object.assign({}, c, { id: b64uToBuf(c.id) }); }) });
+    return navigator.credentials.get({ publicKey: pub }).then(function (c) {
+      return {
+        id: c.id, rawId: bufToB64u(c.rawId), type: c.type, clientExtensionResults: c.getClientExtensionResults ? c.getClientExtensionResults() : {},
+        authenticatorAttachment: c.authenticatorAttachment || undefined,
+        response: {
+          clientDataJSON: bufToB64u(c.response.clientDataJSON), authenticatorData: bufToB64u(c.response.authenticatorData),
+          signature: bufToB64u(c.response.signature), userHandle: c.response.userHandle ? bufToB64u(c.response.userHandle) : undefined,
+        },
+      };
+    });
+  }
+  var pkCancelled = function (e) { return e && (e.name === 'NotAllowedError' || e.name === 'AbortError'); };
+
+  // ── sign in ──
+  var accounts = false, ticket = '';
+  function loginErr(t) { $('loginErr').textContent = t || ''; }
+  function step(n) { $('loginStep1').classList.toggle('hide', n !== 1); $('loginStep2').classList.toggle('hide', n !== 2); }
+  function prepareLogin() {
+    step(1); loginErr('');
+    fetch('/auth/status').then(function (r) { return r.json(); }).then(function (s) {
+      accounts = !!s.accounts;
+      $('user').classList.toggle('hide', !accounts);
+      $('pw').placeholder = accounts ? 'Password' : 'Passphrase';
+      $('loginHint').textContent = accounts ? 'Cookieless analytics. Sign in to your account.' : 'Cookieless analytics. Sign in with your passphrase.';
+      $('passkeyBtn').classList.toggle('hide', !(accounts && hasPasskeys));
+      (accounts ? $('user') : $('pw')).focus();
+    }).catch(function () {});
+  }
+  function login() {
+    loginErr('');
+    var body = { password: $('pw').value };
+    if (accounts) body.username = $('user').value.trim();
+    post('/auth/login', body).then(function (r) {
+      if (!r.ok) return loginErr(r.j.error || 'Wrong password');
+      $('pw').value = '';
+      if (r.j.mfa === 'totp') { ticket = r.j.ticket; step(2); $('otp').value = ''; $('otp').focus(); return; }
+      T().signedIn(r.j.token);
+    }).catch(function () { loginErr('Connection error'); });
+  }
+  function verifyOtp() {
+    loginErr('');
+    post('/auth/login/totp', { ticket: ticket, code: $('otp').value.trim() }).then(function (r) {
+      if (r.ok) return T().signedIn(r.j.token);
+      if (r.j.ticket) { ticket = r.j.ticket; $('otp').value = ''; $('otp').focus(); return loginErr(r.j.error || 'Wrong code'); }
+      step(1); loginErr(r.j.error || 'Sign-in expired — enter your password again');
+    }).catch(function () { loginErr('Connection error'); });
+  }
+  function passkeyLogin() {
+    loginErr('');
+    post('/auth/passkey/options').then(function (r) {
+      if (!r.ok) throw new Error(r.j.error || 'Passkeys are not available');
+      return pkGet(r.j.options).then(function (resp) { return post('/auth/passkey/verify', { ticket: r.j.ticket, response: resp }); });
+    }).then(function (r) {
+      if (!r.ok) return loginErr(r.j.error || 'Passkey not accepted');
+      T().signedIn(r.j.token);
+    }).catch(function (e) { if (!pkCancelled(e)) loginErr(e.message || 'Passkey sign-in failed'); });
+  }
+  $('loginBtn').onclick = login;
+  $('pw').addEventListener('keydown', function (e) { if (e.key === 'Enter') login(); });
+  $('user').addEventListener('keydown', function (e) { if (e.key === 'Enter') $('pw').focus(); });
+  $('otpBtn').onclick = verifyOtp;
+  $('otp').addEventListener('keydown', function (e) { if (e.key === 'Enter') verifyOtp(); });
+  $('passkeyBtn').onclick = passkeyLogin;
+
+  // ── invite page ──
+  function showInvite(token) {
+    $('app').classList.add('hide'); $('invite').classList.remove('hide');
+    fetch('/api/invite/' + token).then(function (r) { return r.json(); }).then(function (inv) {
+      if (inv.error) { $('inviteHint').textContent = inv.error; $('inviteForm').classList.add('hide'); return; }
+      $('inviteHint').textContent = 'You were invited as ' + ROLE_LABEL[inv.role].toLowerCase() + '. Choose a username and a password.';
+      $('invUser').focus();
+    });
+    var go = function () {
+      $('inviteErr').textContent = '';
+      post('/api/invite/' + token, { username: $('invUser').value.trim(), password: $('invPw').value }).then(function (r) {
+        if (!r.ok) { $('inviteErr').textContent = r.j.error || 'Could not create the account'; return; }
+        history.replaceState(null, '', '/');
+        $('invite').classList.add('hide');
+        T().signedIn(r.j.token);
+      });
+    };
+    $('invBtn').onclick = go;
+    $('invPw').addEventListener('keydown', function (e) { if (e.key === 'Enter') go(); });
+  }
+
+  // ── settings ──
+  var ROLE_LABEL = { owner: 'Owner', admin: 'Admin', viewer: 'Viewer' };
+  var ROLE_HELP = { owner: 'everything, including the team', admin: 'sites, share links and funnels', viewer: 'read only' };
+  var me = null;
+  function setErr(t) { $('setErr').textContent = t || ''; }
+  function afterBoot() {
+    call('GET', '/api/me').then(function (m) {
+      me = m;
+      $('meName').textContent = m.username || 'Settings';
+      document.body.classList.toggle('role-viewer', m.role === 'viewer');
+    }).catch(function () {});
+  }
+  function openSettings(tab) {
+    setErr(''); $('settingsModal').classList.remove('hide');
+    call('GET', '/api/me').then(function (m) {
+      me = m;
+      $('setTabs').querySelector('[data-t="team"]').classList.toggle('hide', m.role !== 'owner');
+      showTab(tab || 'security');
+    }).catch(function (e) { setErr(e.message); });
+  }
+  function showTab(t) {
+    Array.prototype.forEach.call($('setTabs').children, function (b) { b.classList.toggle('active', b.dataset.t === t); });
+    $('setSecurity').classList.toggle('hide', t !== 'security');
+    $('setTeam').classList.toggle('hide', t !== 'team');
+    setErr('');
+    if (t === 'security') renderSecurity(); else renderTeam();
+  }
+  $('settingsBtn').onclick = function () { openSettings(); };
+  $('closeSettings').onclick = function () { $('settingsModal').classList.add('hide'); };
+  $('setTabs').onclick = function (e) { var b = e.target.closest('button'); if (b) showTab(b.dataset.t); };
+  function date(ms) { return ms ? new Date(ms).toLocaleDateString(undefined, { day: 'numeric', month: 'short', year: 'numeric' }) : '—'; }
+
+  // security tab
+  function renderSecurity() {
+    var el = $('setSecurity');
+    if (me.kind !== 'user') {
+      // legacy passphrase (or API key): offer the first account
+      el.innerHTML =
+        '<div class="set-card"><h3>' + ico('i-user-plus') + 'Create your account</h3>' +
+        '<p class="muted">You are signed in with the shared passphrase. Create an owner account to unlock two-factor sign-in, passkeys and the team. ' +
+        '<strong>After that the passphrase (WEB_PASSWORD) stops working</strong>, so 2FA cannot be bypassed.</p>' +
+        '<input id="bsUser" type="text" placeholder="Username" autocomplete="username" autocapitalize="off" spellcheck="false">' +
+        '<input id="bsPw" type="password" placeholder="Password (at least 10 characters)" autocomplete="new-password">' +
+        '<button class="btn" id="bsBtn">Create owner account</button></div>';
+      $('bsBtn').onclick = function () {
+        setErr('');
+        post('/api/team/bootstrap', { username: $('bsUser').value.trim(), password: $('bsPw').value }, localStorage.getItem('nyx_token')).then(function (r) {
+          if (!r.ok) return setErr(r.j.error || 'Could not create the account');
+          localStorage.setItem('nyx_token', r.j.token);
+          openSettings('security'); afterBoot();
+        });
+      };
+      return;
+    }
+    var pk = (me.passkeyList || []).map(function (k) {
+      return '<div class="set-row"><span>' + ico('i-key') + esc(k.name) + '</span><span class="muted small">added ' + date(k.created) + (k.last_used ? ' · used ' + date(k.last_used) : '') + '</span>' +
+        '<button class="btn ghost danger mini" data-delpk="' + esc(k.id) + '">Remove</button></div>';
+    }).join('');
+    el.innerHTML =
+      '<div class="set-card"><h3>' + ico('i-key') + 'Passkeys <span class="pill">optional</span></h3>' +
+      '<p class="muted">Sign in with Face ID, Touch ID, Windows Hello or a security key. No password, no code — and it cannot be phished.</p>' +
+      (pk || '<p class="muted small">No passkey yet.</p>') +
+      (hasPasskeys ? '<div class="set-inline"><input id="pkName" type="text" placeholder="Name, e.g. MacBook" maxlength="60"><button class="btn" id="pkAdd">Add passkey</button></div>'
+        : '<p class="muted small">This browser does not support passkeys.</p>') +
+      '</div>' +
+      '<div class="set-card"><h3>' + ico('i-smartphone') + 'Two-factor code (OTP) <span class="pill">' + (me.totp ? 'on' : 'optional') + '</span></h3>' +
+      (me.totp
+        ? '<p class="muted">Signing in with your password also asks for a 6-digit code from your authenticator app. Recovery codes left: <strong>' + me.recoveryLeft + '</strong>.</p>' +
+          '<div class="set-inline"><input id="totpPw" type="password" placeholder="Your password" autocomplete="current-password"><button class="btn ghost" id="newRecovery">New recovery codes</button><button class="btn ghost danger" id="totpOff">Turn off</button></div>'
+        : '<p class="muted">Use any authenticator app (1Password, Google Authenticator, Authy, Bitwarden …).</p><div id="totpSetup"><button class="btn" id="totpStart">Set up</button></div>') +
+      '</div>' +
+      '<div class="set-card"><h3>' + ico('i-shield') + 'Password</h3>' +
+      '<div class="set-inline"><input id="pwOld" type="password" placeholder="Current password" autocomplete="current-password"><input id="pwNew" type="password" placeholder="New password (10+)" autocomplete="new-password"><button class="btn ghost" id="pwSave">Change</button></div>' +
+      '<p class="muted small">Changing it signs you out on all other devices.</p></div>' +
+      '<p class="muted small">Signed in as <strong>' + esc(me.username) + '</strong> · ' + ROLE_LABEL[me.role] + '</p>';
+
+    el.querySelectorAll('[data-delpk]').forEach(function (b) {
+      b.onclick = function () { if (confirm('Remove this passkey?')) call('DELETE', '/api/me/passkeys/' + encodeURIComponent(b.dataset.delpk)).then(function () { openSettings('security'); }).catch(function (e) { setErr(e.message); }); };
+    });
+    if ($('pkAdd')) $('pkAdd').onclick = function () {
+      setErr('');
+      call('POST', '/api/me/passkeys/options').then(function (r) {
+        return pkCreate(r.options).then(function (resp) { return call('POST', '/api/me/passkeys', { ticket: r.ticket, response: resp, name: $('pkName').value.trim() }); });
+      }).then(function () { openSettings('security'); }).catch(function (e) { if (!pkCancelled(e)) setErr(e.message || 'Could not add the passkey'); });
+    };
+    if ($('totpStart')) $('totpStart').onclick = function () {
+      call('POST', '/api/me/totp/setup').then(function (s) {
+        $('totpSetup').innerHTML =
+          '<div class="totp-qr"><img src="' + s.qr + '" alt="QR code for your authenticator app"></div>' +
+          '<p class="muted small">Scan the code, or enter this key by hand:</p><div class="snippet center">' + esc(s.secret.replace(/(.{4})/g, '$1 ').trim()) + '</div>' +
+          '<div class="set-inline"><input id="totpCode" type="text" inputmode="numeric" placeholder="6-digit code" autocomplete="one-time-code" maxlength="6"><button class="btn" id="totpOn">Turn on</button></div>';
+        $('totpCode').focus();
+        var on = function () {
+          setErr('');
+          call('POST', '/api/me/totp/enable', { code: $('totpCode').value.trim() }).then(function (r) { showRecovery(r.recoveryCodes); }).catch(function (e) { setErr(e.message); });
+        };
+        $('totpOn').onclick = on;
+        $('totpCode').addEventListener('keydown', function (e) { if (e.key === 'Enter') on(); });
+      }).catch(function (e) { setErr(e.message); });
+    };
+    if ($('totpOff')) $('totpOff').onclick = function () {
+      if (!confirm('Turn off two-factor codes?')) return;
+      call('POST', '/api/me/totp/disable', { password: $('totpPw').value }).then(function () { openSettings('security'); }).catch(function (e) { setErr(e.message); });
+    };
+    if ($('newRecovery')) $('newRecovery').onclick = function () {
+      call('POST', '/api/me/recovery', { password: $('totpPw').value }).then(function (r) { showRecovery(r.recoveryCodes); }).catch(function (e) { setErr(e.message); });
+    };
+    $('pwSave').onclick = function () {
+      setErr('');
+      call('POST', '/api/me/password', { password: $('pwOld').value, newPassword: $('pwNew').value }).then(function () {
+        $('pwOld').value = ''; $('pwNew').value = ''; setErr(''); $('pwSave').textContent = 'Changed ✓';
+      }).catch(function (e) { setErr(e.message); });
+    };
+  }
+  function showRecovery(codes) {
+    $('setSecurity').innerHTML =
+      '<div class="set-card"><h3>' + ico('i-shield') + 'Save your recovery codes</h3>' +
+      '<p class="muted">Each code works once, instead of a 6-digit code. Keep them somewhere safe — they are shown only now.</p>' +
+      '<div class="snippet recovery">' + codes.map(esc).join('<br>') + '</div>' +
+      '<div class="set-inline"><button class="btn ghost" id="copyRec">Copy</button><button class="btn" id="recDone">I saved them</button></div></div>';
+    $('copyRec').onclick = function () { navigator.clipboard.writeText(codes.join('\n')); $('copyRec').textContent = 'Copied ✓'; };
+    $('recDone').onclick = function () { openSettings('security'); };
+  }
+
+  // team tab (owner)
+  function siteNames(ids) {
+    if (!ids) return 'all sites';
+    var all = T().sites() || [];
+    return ids.map(function (id) { var s = all.filter(function (x) { return x.id === id; })[0]; return s ? s.domain : '#' + id; }).join(', ');
+  }
+  function sitePicker(idPrefix, selected) {
+    var all = T().sites() || [];
+    return '<div class="site-pick" id="' + idPrefix + '">' + all.map(function (s) {
+      var on = !selected || selected.indexOf(s.id) >= 0;
+      return '<label><input type="checkbox" value="' + s.id + '"' + (on ? ' checked' : '') + '> ' + esc(s.domain) + '</label>';
+    }).join('') + '</div>';
+  }
+  function pickedSites(idPrefix) {
+    var box = $(idPrefix); if (!box) return null;
+    var all = box.querySelectorAll('input'), ids = [];
+    all.forEach(function (c) { if (c.checked) ids.push(Number(c.value)); });
+    return ids.length === all.length ? null : ids; // everything ticked = all sites, also future ones
+  }
+  function renderTeam() {
+    var el = $('setTeam');
+    call('GET', '/api/team').then(function (t) {
+      var rows = t.users.map(function (u) {
+        var self = me && me.id === u.id;
+        return '<div class="set-row team-row" data-uid="' + u.id + '">' +
+          '<span><strong>' + esc(u.username) + '</strong>' + (self ? ' <span class="muted small">(you)</span>' : '') +
+          '<br><span class="muted small">' + (u.role === 'viewer' ? siteNames(u.sites) + ' · ' : '') + (u.totp ? '2FA on' : 'no 2FA') + (u.passkeys ? ' · ' + u.passkeys + ' passkey' + (u.passkeys > 1 ? 's' : '') : '') + ' · last sign-in ' + date(u.last_login) + '</span></span>' +
+          '<select data-role>' + ['owner', 'admin', 'viewer'].map(function (r) { return '<option value="' + r + '"' + (r === u.role ? ' selected' : '') + '>' + ROLE_LABEL[r] + '</option>'; }).join('') + '</select>' +
+          '<span class="row-actions">' + (u.role === 'viewer' ? '<button class="btn ghost mini" data-sites>Sites</button>' : '') +
+          (u.totp && !self ? '<button class="btn ghost mini" data-reset2fa>Reset 2FA</button>' : '') +
+          (!self ? '<button class="btn ghost danger mini" data-remove>Remove</button>' : '') + '</span></div>';
+      }).join('');
+      var invites = t.invites.map(function (i) {
+        return '<div class="set-row"><span>' + ico('i-user-plus') + ROLE_LABEL[i.role] + (i.role === 'viewer' ? ' · ' + esc(siteNames(i.sites)) : '') + '</span><span class="muted small">expires ' + date(i.expires) + '</span><button class="btn ghost danger mini" data-delinv="' + i.id + '">Revoke</button></div>';
+      }).join('');
+      el.innerHTML =
+        '<div class="set-card"><h3>' + ico('i-users') + 'Members</h3>' + rows + '</div>' +
+        '<div class="set-card"><h3>' + ico('i-user-plus') + 'Invite someone</h3>' +
+        '<p class="muted">Creates a link that works once, for 7 days. Send it yourself — Tacilytics sends no e-mail.</p>' +
+        '<div class="set-inline"><select id="invRole">' + ['viewer', 'admin', 'owner'].map(function (r) { return '<option value="' + r + '">' + ROLE_LABEL[r] + ' — ' + ROLE_HELP[r] + '</option>'; }).join('') + '</select><button class="btn" id="invCreate">Create link</button></div>' +
+        '<div id="invSites">' + sitePicker('invPick', null) + '</div>' +
+        '<div id="invOut"></div>' + (invites ? '<h4 class="muted small" style="margin-top:12px">Open invites</h4>' + invites : '') + '</div>';
+
+      $('invRole').onchange = function () { $('invSites').classList.toggle('hide', this.value !== 'viewer'); };
+      $('invCreate').onclick = function () {
+        setErr('');
+        var role = $('invRole').value;
+        call('POST', '/api/team/invites', { role: role, sites: role === 'viewer' ? pickedSites('invPick') : null }).then(function (r) {
+          var url = location.origin + r.url;
+          $('invOut').innerHTML = '<div class="snippet" id="invUrl">' + esc(url) + '</div><button class="btn ghost" id="invCopy">Copy link</button>';
+          $('invCopy').onclick = function () { navigator.clipboard.writeText(url); $('invCopy').textContent = 'Copied ✓'; };
+        }).catch(function (e) { setErr(e.message); });
+      };
+      el.querySelectorAll('[data-delinv]').forEach(function (b) {
+        b.onclick = function () { call('DELETE', '/api/team/invites/' + b.dataset.delinv).then(renderTeam).catch(function (e) { setErr(e.message); }); };
+      });
+      el.querySelectorAll('.team-row').forEach(function (row) {
+        var uid = row.dataset.uid;
+        row.querySelector('[data-role]').onchange = function () {
+          setErr('');
+          call('PATCH', '/api/team/users/' + uid, { role: this.value }).then(renderTeam).catch(function (e) { setErr(e.message); renderTeam(); });
+        };
+        var rm = row.querySelector('[data-remove]');
+        if (rm) rm.onclick = function () { if (confirm('Remove this member? They are signed out immediately.')) call('DELETE', '/api/team/users/' + uid).then(renderTeam).catch(function (e) { setErr(e.message); }); };
+        var r2 = row.querySelector('[data-reset2fa]');
+        if (r2) r2.onclick = function () { if (confirm('Turn off 2FA for this member? Use this when they lost their phone.')) call('POST', '/api/team/users/' + uid + '/reset-2fa').then(renderTeam).catch(function (e) { setErr(e.message); }); };
+        var st = row.querySelector('[data-sites]');
+        if (st) st.onclick = function () {
+          var u = t.users.filter(function (x) { return String(x.id) === uid; })[0];
+          if (row.nextElementSibling && row.nextElementSibling.classList.contains('site-edit')) { row.nextElementSibling.remove(); return; }
+          var box = document.createElement('div'); box.className = 'site-edit';
+          box.innerHTML = sitePicker('pick' + uid, u.sites) + '<button class="btn mini" data-savesites>Save</button>';
+          row.after(box);
+          box.querySelector('[data-savesites]').onclick = function () {
+            call('PATCH', '/api/team/users/' + uid, { sites: pickedSites('pick' + uid) }).then(renderTeam).catch(function (e) { setErr(e.message); });
+          };
+        };
+      });
+    }).catch(function (e) { setErr(e.message); });
+  }
+
+  window.TaciAccount = { prepareLogin: prepareLogin, showInvite: showInvite, afterBoot: afterBoot };
+})();

package/public/app.js

@@ -87,23 +87,16 @@
   function flag(cc) { return flagIcon(cc); } // returns HTML now (img), never a text emoji
   var NAMES = { DE: 'Germany', AT: 'Austria', CH: 'Switzerland', GB: 'United Kingdom', US: 'United States', FR: 'France', NL: 'Netherlands', ES: 'Spain', IT: 'Italy', SE: 'Sweden', NO: 'Norway', DK: 'Denmark', FI: 'Finland', PL: 'Poland', CZ: 'Czechia', BE: 'Belgium', IE: 'Ireland', PT: 'Portugal', CA: 'Canada', AU: 'Australia', BR: 'Brazil', IN: 'India', JP: 'Japan', CN: 'China', RU: 'Russia', TR: 'Turkey', MX: 'Mexico', HU: 'Hungary', RO: 'Romania', GR: 'Greece', UA: 'Ukraine', HR: 'Croatia', NZ: 'New Zealand', SG: 'Singapore', KR: 'South Korea', IL: 'Israel', AE: 'UAE', ZA: 'South Africa' };
 
-  // ── login ──
-  function showLogin() { $('login').classList.remove('hide'); $('app').classList.add('hide'); }
+  // ── login (the form itself lives in account.js: passphrase, accounts, TOTP, passkeys) ──
+  function showLogin() { clearInterval(window.__rt); $('login').classList.remove('hide'); $('app').classList.add('hide'); if (window.TaciAccount) window.TaciAccount.prepareLogin(); }
   function hideLogin() { $('login').classList.add('hide'); $('app').classList.remove('hide'); }
-  function login() {
-    var pw = $('pw').value;
-    fetch('/auth/login', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ password: pw }) })
-      .then(function (r) { return r.json().then(function (j) { return { ok: r.ok, j: j }; }); })
-      .then(function (res) {
-        if (!res.ok) { $('loginErr').textContent = res.j.error || 'Wrong password'; return; }
-        TOKEN = res.j.token; localStorage.setItem('nyx_token', TOKEN); $('loginErr').textContent = '';
-        boot();
-      })
-      .catch(function () { $('loginErr').textContent = 'Connection error'; });
-  }
-  $('loginBtn').onclick = login;
-  $('pw').addEventListener('keydown', function (e) { if (e.key === 'Enter') login(); });
-  $('logoutBtn').onclick = function () { localStorage.removeItem('nyx_token'); TOKEN = ''; showLogin(); };
+  function signedIn(token) { TOKEN = token; localStorage.setItem('nyx_token', TOKEN); $('loginErr').textContent = ''; boot(); }
+  $('logoutBtn').onclick = function () {
+    fetch('/auth/logout', { method: 'POST', headers: { 'x-session-token': TOKEN } }).catch(function () {});
+    localStorage.removeItem('nyx_token'); TOKEN = ''; showLogin();
+  };
+  // hooks for account.js
+  window.Taci = { api: api, esc: esc, ico: ico, signedIn: signedIn, sites: function () { return state.sites; }, reloadSites: function () { return loadSites().then(load); } };
 
   // ── sites ──
   function loadSites() {
@@ -758,6 +751,7 @@
 
   function boot() {
     hideLogin();
+    if (window.TaciAccount) window.TaciAccount.afterBoot();
     syncLegend();
     loadSites().then(function () { load(); loadFunnels(); });
     // live dashboard: refresh every 15s while the tab is visible
@@ -776,7 +770,7 @@
       state.site = info.domain;
       var sel = $('siteSelect');
       sel.innerHTML = '<option>' + esc(info.domain) + '</option>'; sel.disabled = true;
-      ['addSiteBtn', 'logoutBtn', 'shareBtn', 'snippetBtn', 'addFunnelBtn'].forEach(function (id) { var el = $(id); if (el) el.classList.add('hide'); });
+      ['addSiteBtn', 'logoutBtn', 'settingsBtn', 'shareBtn', 'snippetBtn', 'addFunnelBtn'].forEach(function (id) { var el = $(id); if (el) el.classList.add('hide'); });
       syncLegend();
       load();
       clearInterval(window.__rt);
@@ -784,5 +778,8 @@
     });
   }
 
-  if (SHARE) bootShare(); else if (TOKEN) boot(); else showLogin();
+  var INVITE = (location.pathname.match(/^\/invite\/([a-f0-9]{32,64})$/) || [])[1] || '';
+  if (SHARE) bootShare();
+  else if (INVITE) { $('login').classList.add('hide'); window.TaciAccount.showInvite(INVITE); }
+  else if (TOKEN) boot(); else showLogin();
 })();

package/public/assets/icons.svg

@@ -197,4 +197,9 @@
 <symbol id="b-bluesky" viewBox="0 0 24 24"><path fill="currentColor" d="M5.202 2.857C7.954 4.922 10.913 9.11 12 11.358c1.087-2.247 4.046-6.436 6.798-8.501C20.783 1.366 24 .213 24 3.883c0 .732-.42 6.156-.667 7.037-.856 3.061-3.978 3.842-6.755 3.37 4.854.826 6.089 3.562 3.422 6.299-5.065 5.196-7.28-1.304-7.847-2.97-.104-.305-.152-.448-.153-.327 0-.121-.05.022-.153.327-.568 1.666-2.782 8.166-7.847 2.97-2.667-2.737-1.432-5.473 3.422-6.3-2.777.473-5.899-.308-6.755-3.369C.42 10.04 0 4.615 0 3.883c0-3.67 3.217-2.517 5.202-1.026"/></symbol>
 <symbol id="b-mastodon" viewBox="0 0 24 24"><path fill="currentColor" d="M23.268 5.313c-.35-2.578-2.617-4.61-5.304-5.004C17.51.242 15.792 0 11.813 0h-.03c-3.98 0-4.835.242-5.288.309C3.882.692 1.496 2.518.917 5.127.64 6.412.61 7.837.661 9.143c.074 1.874.088 3.745.26 5.611.118 1.24.325 2.47.62 3.68.55 2.237 2.777 4.098 4.96 4.857 2.336.792 4.849.923 7.256.38.265-.061.527-.132.786-.213.585-.184 1.27-.39 1.774-.753a.057.057 0 0 0 .023-.043v-1.809a.052.052 0 0 0-.02-.041.053.053 0 0 0-.046-.01 20.282 20.282 0 0 1-4.709.545c-2.73 0-3.463-1.284-3.674-1.818a5.593 5.593 0 0 1-.319-1.433.053.053 0 0 1 .066-.054c1.517.363 3.072.546 4.632.546.376 0 .75 0 1.125-.01 1.57-.044 3.224-.124 4.768-.422.038-.008.077-.015.11-.024 2.435-.464 4.753-1.92 4.989-5.604.008-.145.03-1.52.03-1.67.002-.512.167-3.63-.024-5.545zm-3.748 9.195h-2.561V8.29c0-1.309-.55-1.976-1.67-1.976-1.23 0-1.846.79-1.846 2.35v3.403h-2.546V8.663c0-1.56-.617-2.35-1.848-2.35-1.112 0-1.668.668-1.67 1.977v6.218H4.822V8.102c0-1.31.337-2.35 1.011-3.12.696-.77 1.608-1.164 2.74-1.164 1.311 0 2.302.5 2.962 1.498l.638 1.06.638-1.06c.66-.999 1.65-1.498 2.96-1.498 1.13 0 2.043.395 2.74 1.164.675.77 1.012 1.81 1.012 3.12z"/></symbol>
 <symbol id="b-signal" viewBox="0 0 24 24"><path fill="currentColor" d="M12 0q-.934 0-1.83.139l.17 1.111a11 11 0 0 1 3.32 0l.172-1.111A12 12 0 0 0 12 0M9.152.34A12 12 0 0 0 5.77 1.742l.584.961a10.8 10.8 0 0 1 3.066-1.27zm5.696 0-.268 1.094a10.8 10.8 0 0 1 3.066 1.27l.584-.962A12 12 0 0 0 14.848.34M12 2.25a9.75 9.75 0 0 0-8.539 14.459c.074.134.1.292.064.441l-1.013 4.338 4.338-1.013a.62.62 0 0 1 .441.064A9.7 9.7 0 0 0 12 21.75c5.385 0 9.75-4.365 9.75-9.75S17.385 2.25 12 2.25m-7.092.068a12 12 0 0 0-2.59 2.59l.909.664a11 11 0 0 1 2.345-2.345zm14.184 0-.664.909a11 11 0 0 1 2.345 2.345l.909-.664a12 12 0 0 0-2.59-2.59M1.742 5.77A12 12 0 0 0 .34 9.152l1.094.268a10.8 10.8 0 0 1 1.269-3.066zm20.516 0-.961.584a10.8 10.8 0 0 1 1.27 3.066l1.093-.268a12 12 0 0 0-1.402-3.383M.138 10.168A12 12 0 0 0 0 12q0 .934.139 1.83l1.111-.17A11 11 0 0 1 1.125 12q0-.848.125-1.66zm23.723.002-1.111.17q.125.812.125 1.66c0 .848-.042 1.12-.125 1.66l1.111.172a12.1 12.1 0 0 0 0-3.662M1.434 14.58l-1.094.268a12 12 0 0 0 .96 2.591l-.265 1.14 1.096.255.36-1.539-.188-.365a10.8 10.8 0 0 1-.87-2.35m21.133 0a10.8 10.8 0 0 1-1.27 3.067l.962.584a12 12 0 0 0 1.402-3.383zm-1.793 3.848a11 11 0 0 1-2.345 2.345l.664.909a12 12 0 0 0 2.59-2.59zm-19.959 1.1L.357 21.48a1.8 1.8 0 0 0 2.162 2.161l1.954-.455-.256-1.095-1.953.455a.675.675 0 0 1-.81-.81l.454-1.954zm16.832 1.769a10.8 10.8 0 0 1-3.066 1.27l.268 1.093a12 12 0 0 0 3.382-1.402zm-10.94.213-1.54.36.256 1.095 1.139-.266c.814.415 1.683.74 2.591.961l.268-1.094a10.8 10.8 0 0 1-2.35-.869zm3.634 1.24-.172 1.111a12.1 12.1 0 0 0 3.662 0l-.17-1.111q-.812.125-1.66.125a11 11 0 0 1-1.66-.125"/></symbol>
+<symbol id="i-key" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d="M2.586 17.414A2 2 0 0 0 2 18.828V21a1 1 0 0 0 1 1h3a1 1 0 0 0 1-1v-1a1 1 0 0 1 1-1h1a1 1 0 0 0 1-1v-1a1 1 0 0 1 1-1h.172a2 2 0 0 0 1.414-.586l.814-.814a6.5 6.5 0 1 0-4-4z" /><circle cx="16.5" cy="7.5" r=".5" fill="currentColor" /></symbol>
+<symbol id="i-settings" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d="M9.671 4.136a2.34 2.34 0 0 1 4.659 0 2.34 2.34 0 0 0 3.319 1.915 2.34 2.34 0 0 1 2.33 4.033 2.34 2.34 0 0 0 0 3.831 2.34 2.34 0 0 1-2.33 4.033 2.34 2.34 0 0 0-3.319 1.915 2.34 2.34 0 0 1-4.659 0 2.34 2.34 0 0 0-3.32-1.915 2.34 2.34 0 0 1-2.33-4.033 2.34 2.34 0 0 0 0-3.831A2.34 2.34 0 0 1 6.35 6.051a2.34 2.34 0 0 0 3.319-1.915" /><circle cx="12" cy="12" r="3" /></symbol>
+<symbol id="i-shield" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d="M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z" /><path d="m9 12 2 2 4-4" /></symbol>
+<symbol id="i-user-plus" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2" /><circle cx="9" cy="7" r="4" /><line x1="19" x2="19" y1="8" y2="14" /><line x1="22" x2="16" y1="11" y2="11" /></symbol>
+<symbol id="i-smartphone" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><rect width="14" height="20" x="5" y="2" rx="2" ry="2" /><path d="M12 18h.01" /></symbol>
 </svg>