tacilytics 2.0.2 → 2.1.0

package/public/index.html

@@ -17,10 +17,34 @@
   <div class="modal">
     <img class="logo" src="/assets/tacilytics-mark.svg" alt="">
     <h2>Tacilytics</h2>
-    <p>Cookieless analytics. Sign in with your passphrase.</p>
-    <div id="loginErr" class="err"></div>
-    <input id="pw" type="password" placeholder="Passphrase" autocomplete="current-password">
-    <button class="btn" id="loginBtn">Sign in</button>
+    <p id="loginHint">Cookieless analytics. Sign in with your passphrase.</p>
+    <div id="loginErr" class="err" role="alert"></div>
+    <div id="loginStep1">
+      <input id="user" class="hide" type="text" placeholder="Username" autocomplete="username webauthn" autocapitalize="off" spellcheck="false">
+      <input id="pw" type="password" placeholder="Passphrase" autocomplete="current-password">
+      <button class="btn" id="loginBtn">Sign in</button>
+      <button class="btn ghost hide" id="passkeyBtn" style="margin-top:10px"><svg class="ico ui" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-key"></use></svg>Sign in with a passkey</button>
+    </div>
+    <div id="loginStep2" class="hide">
+      <input id="otp" type="text" inputmode="numeric" placeholder="6-digit code" autocomplete="one-time-code" maxlength="20">
+      <button class="btn" id="otpBtn">Verify</button>
+      <p class="muted small" style="margin:12px 0 0">Lost your phone? Enter one of your recovery codes instead.</p>
+    </div>
+  </div>
+</div>
+
+<!-- Invite: create an account from an invite link -->
+<div id="invite" class="modal-overlay hide">
+  <div class="modal">
+    <img class="logo" src="/assets/tacilytics-mark.svg" alt="">
+    <h2>Join Tacilytics</h2>
+    <p id="inviteHint">Choose a username and a password.</p>
+    <div id="inviteErr" class="err" role="alert"></div>
+    <div id="inviteForm">
+      <input id="invUser" type="text" placeholder="Username" autocomplete="username" autocapitalize="off" spellcheck="false">
+      <input id="invPw" type="password" placeholder="Password (at least 10 characters)" autocomplete="new-password">
+      <button class="btn" id="invBtn">Create account</button>
+    </div>
   </div>
 </div>
 
@@ -37,7 +61,8 @@
     <div class="header-right">
       <div class="realtime" id="realtimeBtn" title="View live visitors" style="cursor:pointer"><span class="dot"></span><span id="realtime">0</span> online now</div>
       <select id="siteSelect"></select>
-      <button class="btn ghost" id="addSiteBtn"><svg class="ico ui" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-plus"></use></svg>Add site</button>
+      <button class="btn ghost" id="addSiteBtn"><svg class="ico ui" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-plus"></use></svg>Add site</button>
+      <button class="btn ghost" id="settingsBtn" title="Account, security and team"><svg class="ico ui" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-settings"></use></svg><span id="meName">Settings</span></button>
       <button class="btn ghost danger" id="logoutBtn">Sign out</button>
     </div>
   </header>
@@ -52,12 +77,12 @@
     </div>
     <div class="toolbar-right">
       <div class="range" id="range">
-        <input type="date" id="fromDate" title="From"><span class="arrow"><svg class="ico ui" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-arrow"></use></svg></span><input type="date" id="toDate" title="To">
+        <input type="date" id="fromDate" title="From"><span class="arrow"><svg class="ico ui" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-arrow"></use></svg></span><input type="date" id="toDate" title="To">
         <button class="btn ghost" id="applyRange">Apply</button>
       </div>
-      <button class="btn ghost" id="exportBtn"><svg class="ico ui" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-download"></use></svg>CSV</button>
-      <button class="btn ghost" id="shareBtn" title="Create a public read-only link"><svg class="ico ui" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-share"></use></svg>Share</button>
-      <button class="btn ghost" id="snippetBtn"><svg class="ico ui" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-code"></use></svg>Embed code</button>
+      <button class="btn ghost" id="exportBtn"><svg class="ico ui" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-download"></use></svg>CSV</button>
+      <button class="btn ghost" id="shareBtn" title="Create a public read-only link"><svg class="ico ui" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-share"></use></svg>Share</button>
+      <button class="btn ghost" id="snippetBtn"><svg class="ico ui" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-code"></use></svg>Embed code</button>
     </div>
   </div>
 
@@ -94,7 +119,7 @@
 
     <div class="panels">
       <div class="card panel">
-        <h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-pages"></use></svg> Pages
+        <h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-pages"></use></svg> Pages
           <span class="tabs" id="pageTabs">
             <button data-t="pages" class="active">Top</button>
             <button data-t="entryPages">Entry</button>
@@ -104,7 +129,7 @@
         <div class="bars" id="p-pages"></div>
       </div>
       <div class="card panel">
-        <h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-sources"></use></svg> Sources
+        <h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-sources"></use></svg> Sources
           <span class="tabs" id="srcTabs">
             <button data-t="sources" class="active">Source</button>
             <button data-t="mediums">Medium</button>
@@ -113,37 +138,37 @@
         </h3>
         <div class="bars" id="p-sources"></div>
       </div>
-      <div class="card panel"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-globe"></use></svg> Locations</h3><div class="bars" id="p-countries"></div></div>
-      <div class="card panel"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-browser"></use></svg> Browsers</h3><div class="bars" id="p-browsers"></div></div>
-      <div class="card panel"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-os"></use></svg> OS</h3><div class="bars" id="p-os"></div></div>
-      <div class="card panel"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-device"></use></svg> Devices</h3><div class="bars" id="p-devices"></div></div>
-      <div class="card panel hide" id="w-platforms"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-platform"></use></svg> Platforms
+      <div class="card panel"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-globe"></use></svg> Locations</h3><div class="bars" id="p-countries"></div></div>
+      <div class="card panel"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-browser"></use></svg> Browsers</h3><div class="bars" id="p-browsers"></div></div>
+      <div class="card panel"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-os"></use></svg> OS</h3><div class="bars" id="p-os"></div></div>
+      <div class="card panel"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-device"></use></svg> Devices</h3><div class="bars" id="p-devices"></div></div>
+      <div class="card panel hide" id="w-platforms"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-platform"></use></svg> Platforms
           <span class="tabs" id="pfTabs"><button data-t="platforms" class="active">Platform</button><button data-t="appVersions">App version</button></span>
         </h3><div class="bars" id="p-platforms"></div></div>
-      <div class="card panel"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-goal"></use></svg> Goals &amp; conversions</h3><div class="bars" id="p-goals"></div></div>
-      <div class="card panel"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-lang"></use></svg> Languages</h3><div class="bars" id="p-languages"></div></div>
+      <div class="card panel"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-goal"></use></svg> Goals &amp; conversions</h3><div class="bars" id="p-goals"></div></div>
+      <div class="card panel"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-lang"></use></svg> Languages</h3><div class="bars" id="p-languages"></div></div>
     </div>
 
     <!-- shop insights: revenue by source, site search, broken pages, scroll depth (13.10.2026) -->
     <div class="panels" id="insights" style="margin-top:16px">
-      <div class="card panel hide" id="w-revsrc"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-revenue"></use></svg> Revenue by source <span class="muted hint">first source of the buying visit</span></h3><div class="bars" id="p-revsrc"></div></div>
-      <div class="card panel hide" id="w-revpf"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-platform"></use></svg> Revenue by platform <span class="muted hint">web vs. apps</span></h3><div class="bars" id="p-revpf"></div></div>
-      <div class="card panel hide" id="w-search"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-search"></use></svg> Site search
+      <div class="card panel hide" id="w-revsrc"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-revenue"></use></svg> Revenue by source <span class="muted hint">first source of the buying visit</span></h3><div class="bars" id="p-revsrc"></div></div>
+      <div class="card panel hide" id="w-revpf"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-platform"></use></svg> Revenue by platform <span class="muted hint">web vs. apps</span></h3><div class="bars" id="p-revpf"></div></div>
+      <div class="card panel hide" id="w-search"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-search"></use></svg> Site search
           <span class="tabs" id="searchTabs"><button data-t="top" class="active">Top</button><button data-t="zeroResults">No results</button></span>
         </h3><p class="muted hint" id="searchMeta"></p><div class="bars" id="p-search"></div></div>
-      <div class="card panel hide" id="w-404"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-404"></use></svg> Broken pages (404)</h3><div class="bars" id="p-404"></div></div>
-      <div class="card panel hide" id="w-scroll"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-scroll"></use></svg> Scroll depth <span class="muted hint">avg · share reaching 75 %</span></h3><div class="bars" id="p-scroll"></div></div>
+      <div class="card panel hide" id="w-404"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-404"></use></svg> Broken pages (404)</h3><div class="bars" id="p-404"></div></div>
+      <div class="card panel hide" id="w-scroll"><h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-scroll"></use></svg> Scroll depth <span class="muted hint">avg · share reaching 75 %</span></h3><div class="bars" id="p-scroll"></div></div>
     </div>
 
     <!-- visitor journeys (sankey) -->
     <div class="card panel" style="margin-top:16px">
-      <h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-journey"></use></svg> Visitor journeys <span class="muted" id="journeyMeta" style="font-size:.75rem;font-weight:400"></span></h3>
+      <h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-journey"></use></svg> Visitor journeys <span class="muted" id="journeyMeta" style="font-size:.75rem;font-weight:400"></span></h3>
       <div id="journeyWrap" style="overflow-x:auto"><svg id="journey" width="100%" height="340"></svg></div>
     </div>
 
     <!-- funnels -->
     <div class="card panel" style="margin-top:16px">
-      <h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-funnel"></use></svg> Funnels
+      <h3><svg class="ico h" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-funnel"></use></svg> Funnels
         <span class="tabs"><button id="addFunnelBtn">+ New funnel</button></span>
       </h3>
       <div id="funnels" class="funnels"></div>
@@ -158,7 +183,7 @@
 <!-- Add site modal -->
 <div id="addModal" class="modal-overlay hide">
   <div class="modal">
-    <span class="logo em"><svg class="ico big" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-site"></use></svg></span>
+    <span class="logo em"><svg class="ico big" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-site"></use></svg></span>
     <h2>Add a site</h2>
     <p>Enter the domain you want to track.</p>
     <div id="addErr" class="err"></div>
@@ -171,13 +196,13 @@
 <!-- Snippet modal: website + apps (13.10.2026) -->
 <div id="snippetModal" class="modal-overlay hide">
   <div class="modal modal-wide">
-    <span class="logo em"><svg class="ico big" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-code"></use></svg></span>
+    <span class="logo em"><svg class="ico big" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-code"></use></svg></span>
     <h2>Add tracking</h2>
     <p style="margin-bottom:12px">for <strong id="snipDomain"></strong>. Same dashboard for website and apps.</p>
     <div class="tabs snip-tabs" id="snipTabs">
-      <button data-t="web" class="active"><svg class="ico ui" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-web"></use></svg>Website</button>
-      <button data-t="flutter"><svg class="ico brand" style="color:#02569B" aria-hidden="true"><use href="/assets/icons.svg?v=1#b-flutter"></use></svg>Flutter app</button>
-      <button data-t="other"><svg class="ico ui" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-mobile"></use></svg>Other apps</button>
+      <button data-t="web" class="active"><svg class="ico ui" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-web"></use></svg>Website</button>
+      <button data-t="flutter"><svg class="ico brand" style="color:#02569B" aria-hidden="true"><use href="/assets/icons.svg?v=2#b-flutter"></use></svg>Flutter app</button>
+      <button data-t="other"><svg class="ico ui" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-mobile"></use></svg>Other apps</button>
     </div>
     <p class="muted snip-step" id="snipStep1"></p>
     <div class="snippet" id="snippetCode"></div>
@@ -193,7 +218,7 @@
 <!-- Share modal -->
 <div id="shareModal" class="modal-overlay hide">
   <div class="modal">
-    <span class="logo em"><svg class="ico big" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-share"></use></svg></span>
+    <span class="logo em"><svg class="ico big" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-share"></use></svg></span>
     <h2>Share dashboard</h2>
     <p>Anyone with this link can view stats for <strong id="shareDomain"></strong> — read-only, no login.</p>
     <div class="snippet" id="shareUrl" style="word-break:break-all"></div>
@@ -206,7 +231,7 @@
 <!-- Funnel builder modal -->
 <div id="funnelModal" class="modal-overlay hide">
   <div class="modal">
-    <span class="logo em"><svg class="ico big" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-funnel"></use></svg></span>
+    <span class="logo em"><svg class="ico big" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-funnel"></use></svg></span>
     <h2>New funnel</h2>
     <p>2–8 ordered steps. A visitor advances only after completing the previous step.</p>
     <div id="funnelErr" class="err"></div>
@@ -233,7 +258,25 @@
   </div>
 </div>
 
+<!-- Settings: account, security, team -->
+<div id="settingsModal" class="modal-overlay hide">
+  <div class="modal modal-wide settings">
+    <div class="settings-head">
+      <h2>Settings</h2>
+      <div class="tabs set-tabs" id="setTabs">
+        <button data-t="security" class="active"><svg class="ico ui" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-shield"></use></svg>Security</button>
+        <button data-t="team"><svg class="ico ui" aria-hidden="true"><use href="/assets/icons.svg?v=2#i-users"></use></svg>Team</button>
+      </div>
+    </div>
+    <div id="setErr" class="err" role="alert"></div>
+    <div id="setSecurity"></div>
+    <div id="setTeam" class="hide"></div>
+    <button class="btn ghost" id="closeSettings" style="margin-top:18px">Close</button>
+  </div>
+</div>
+
 <div class="tip" id="tip"></div>
-<script src="/app.js?v=2.2.0"></script>
+<script src="/account.js?v=2.1.0"></script>
+<script src="/app.js?v=2.3.1"></script>
 </body>
 </html>

package/public/style.css

@@ -413,3 +413,42 @@ header::after { content: ""; position: absolute; left: 18px; right: 18px; bottom
 /* native dropdown lists follow the dark theme (otherwise light text on a white popup) */
 select { color-scheme: dark; }
 select option { background: #0c1a1d; color: var(--text); }
+
+/* ── settings: security + team (2.1) ───────────────────────────────────────── */
+.modal.settings { text-align: left; max-width: 680px; }
+.settings-head { display: flex; align-items: center; gap: 14px; margin-bottom: 12px; flex-wrap: wrap; }
+.settings-head h2 { margin: 0; }
+.set-tabs { margin-left: auto; display: inline-flex; gap: 2px; background: rgba(255,255,255,.03); border: 1px solid var(--line); border-radius: 9px; padding: 2px; }
+.set-tabs button { background: transparent; border: none; color: var(--text-dim); padding: 6px 12px; border-radius: 7px; cursor: pointer; font: 550 0.8rem inherit; font-family: inherit; display: inline-flex; align-items: center; gap: 6px; }
+.set-tabs button.active { background: var(--surface-2); color: var(--text); box-shadow: inset 0 0 0 1px var(--line-strong); }
+.set-card { border: 1px solid var(--line); border-radius: 14px; padding: 16px 18px; margin-bottom: 12px; background: rgba(255,255,255,.02); }
+.set-card h3 { font-size: 0.95rem; font-weight: 650; margin: 0 0 6px; display: flex; align-items: center; gap: 8px; }
+.set-card p { margin-bottom: 12px; font-size: 0.84rem; }
+.modal .set-card input, .modal .set-card select { text-align: left; margin-bottom: 0; }
+.modal .set-card .btn { width: auto; padding: 9px 14px; }
+.set-card > input { margin-bottom: 10px !important; display: block; }
+.set-card > .btn { width: 100%; }
+.set-inline { display: flex; gap: 8px; flex-wrap: wrap; align-items: center; margin-top: 8px; }
+.set-inline input, .set-inline select { flex: 1 1 160px; min-width: 0; }
+.set-row { display: flex; align-items: center; gap: 10px; padding: 9px 0; border-top: 1px solid var(--line); font-size: 0.86rem; }
+.set-row:first-of-type { border-top: none; }
+.set-row > span:first-child { flex: 1; min-width: 0; display: inline-flex; align-items: center; gap: 7px; flex-wrap: wrap; }
+.team-row > span:first-child { display: block; }
+.team-row select { width: auto; padding: 6px 8px; font-size: 0.8rem; }
+.row-actions { display: inline-flex; gap: 6px; }
+.btn.mini, .modal .btn.mini { padding: 5px 10px; font-size: 0.76rem; width: auto; }
+.small { font-size: 0.76rem; }
+.pill { font-size: 0.66rem; font-weight: 600; text-transform: uppercase; letter-spacing: .04em; padding: 2px 7px; border-radius: 99px; border: 1px solid var(--line-strong); color: var(--text-dim); }
+.totp-qr { display: grid; place-items: center; margin: 6px 0 10px; }
+.totp-qr img { width: 180px; height: 180px; background: #fff; border-radius: 12px; padding: 8px; }
+.snippet.center { text-align: center; letter-spacing: .08em; }
+.snippet.recovery { columns: 2; text-align: center; font-size: 0.86rem; line-height: 1.9; }
+.site-pick { display: flex; flex-wrap: wrap; gap: 6px 14px; margin: 10px 0 4px; font-size: 0.82rem; }
+.site-pick label { display: inline-flex; align-items: center; gap: 6px; cursor: pointer; }
+.modal .site-pick input { width: auto; margin: 0; accent-color: var(--accent-strong, var(--accent)); }
+.site-edit { padding: 4px 0 10px; }
+#user, #pw { margin-bottom: 10px; }
+#login .btn.ghost .ico, #settingsBtn .ico { margin-right: 6px; }
+/* viewers: hide everything that would only answer with 403 */
+body.role-viewer #addSiteBtn, body.role-viewer #shareBtn, body.role-viewer #addFunnelBtn { display: none !important; }
+@media (max-width: 560px) { #meName { display: none; } .team-row { flex-wrap: wrap; } }

package/server.js

@@ -216,14 +216,16 @@ function visitorHash(siteId, ip, ua, day) {
   if (!salt) return crypto.randomBytes(12).toString('hex'); // unlinkable one-off visitor
   return crypto.createHash('sha256').update(`${INGEST_SALT}|${salt}|${day}|${siteId}|${ip}|${ua}`).digest('hex').slice(0, 24);
 }
+// The client writes the FIRST X-Forwarded-For entry itself, so it must never be used for rate limits.
+// req.ip honours 'trust proxy': with TRUST_PROXY=1 (default, one reverse proxy in front) it is the
+// entry that proxy appended. Set TRUST_PROXY=0 when the server is reachable without a proxy.
 function clientIp(req) {
-  const xff = (req.headers['x-forwarded-for'] || '').split(',')[0].trim();
-  return xff || req.socket.remoteAddress || '0.0.0.0';
+  return req.ip || req.socket.remoteAddress || '0.0.0.0';
 }
 
 // ── app ─────────────────────────────────────────────────────────────────────
 const app = express();
-app.set('trust proxy', 1);
+app.set('trust proxy', Number.isFinite(+process.env.TRUST_PROXY) && process.env.TRUST_PROXY !== '' && process.env.TRUST_PROXY != null ? +process.env.TRUST_PROXY : 1);
 // Accept both application/json (dashboard) and text/plain (cross-origin beacons).
 app.use(express.json({ limit: '32kb', type: ['application/json', 'text/plain'] }));
 app.disable('x-powered-by');
@@ -326,35 +328,16 @@ app.options('/api/collect', (_req, res) => { res.set('Access-Control-Allow-Origi
 app.post('/api/collect', collect);
 app.get('/api/collect', collect);
 
-// ── auth (password → in-memory session token) ──────────────
-const sessions = new Map();
-function newToken() { return crypto.randomBytes(24).toString('hex'); }
-app.post('/auth/login', (req, res) => {
-  if (rateLimited('login:' + clientIp(req), 10, 15 * 60000)) return res.status(429).json({ error: 'Too many attempts — wait 15 minutes' });
-  const pw = String((req.body && req.body.password) || '');
-  const ok = pw.length === WEB_PASSWORD.length && crypto.timingSafeEqual(Buffer.from(pw), Buffer.from(WEB_PASSWORD));
-  if (!ok) return res.status(401).json({ error: 'Wrong password' });
-  const token = newToken();
-  sessions.set(token, { expires: Date.now() + 7 * 864e5 });
-  res.json({ token });
+// ── auth: accounts, team, optional 2FA + passkeys (auth.js) ───────────────────
+const { setupAuth } = require('./auth');
+const { auth, requireRole, siteAllowed } = setupAuth({
+  app, db, WEB_PASSWORD, API_KEY, rateLimited, clientIp,
+  allSiteIds: () => db.prepare('SELECT id FROM sites').all().map((r) => r.id),
 });
-function checkApiKey(req) {
-  if (!API_KEY) return false;
-  const hdr = String(req.headers['authorization'] || '');
-  const key = hdr.startsWith('Bearer ') ? hdr.slice(7) : String(req.headers['x-api-key'] || '');
-  return key.length === API_KEY.length && crypto.timingSafeEqual(Buffer.from(key), Buffer.from(API_KEY));
-}
-function auth(req, res, next) {
-  if (checkApiKey(req)) return next(); // agents / CLI
-  const t = req.headers['x-session-token'];
-  const s = t && sessions.get(t);
-  if (s && s.expires > Date.now()) return next();
-  if (s) sessions.delete(t);
-  res.status(401).json({ error: 'Not authenticated' });
-}
+const adminOnly = requireRole('admin');
 
 // share-token auth: read-only stats access scoped to exactly one site.
-// Accepted as ?share=<token>; the handler must verify req.shareSite matches the queried site.
+// Accepted as ?share=<token>; the handler must check siteOk(req, site).
 const getShare = db.prepare('SELECT * FROM shares WHERE token = ?');
 function authOrShare(req, res, next) {
   const tok = String(req.query.share || '');
@@ -364,10 +347,13 @@ function authOrShare(req, res, next) {
   }
   return auth(req, res, next);
 }
-function shareScopeOk(req, site) { return req.shareSiteId == null || req.shareSiteId === site.id; }
+// share links see exactly their site; viewers only the sites they were given
+const siteOk = (req, site) => siteAllowed(req, site.id);
+const NO_SITE = { error: 'You have no access to this site' };
+function newToken() { return crypto.randomBytes(24).toString('hex'); }
 
 // ── sites management ─────────────────────────────────────────────────────────
-const sitesListHandler = (_req, res) => res.json(allSites.all());
+const sitesListHandler = (req, res) => res.json(allSites.all().filter((st) => siteAllowed(req, st.id)));
 const sitesCreateHandler = (req, res) => {
   const rawDomain = norm(req.body && req.body.domain);
   let domain = rawDomain;
@@ -382,8 +368,8 @@ const sitesCreateHandler = (req, res) => {
   res.json(getSiteByDomain.get(domain));
 };
 app.get('/api/sites', auth, sitesListHandler);
-app.post('/api/sites', auth, sitesCreateHandler);
-app.delete('/api/sites/:id', auth, (req, res) => {
+app.post('/api/sites', adminOnly, sitesCreateHandler);
+app.delete('/api/sites/:id', adminOnly, (req, res) => {
   const id = Number(req.params.id);
   db.prepare('DELETE FROM events WHERE site_id = ?').run(id);
   db.prepare('DELETE FROM sites WHERE id = ?').run(id);
@@ -403,7 +389,7 @@ app.get('/api/v1', (_req, res) => res.json({
   filters: 'add any of country,source,page,browser,os,device,lang,medium,campaign,goal to /stats to segment',
 }));
 app.get('/api/v1/sites', auth, sitesListHandler);
-app.post('/api/v1/sites', auth, sitesCreateHandler);
+app.post('/api/v1/sites', adminOnly, sitesCreateHandler);
 
 // ── stats ────────────────────────────────────────────────────────────────────
 const PERIODS = { today: 1, '7d': 7, '30d': 30, '90d': 90, '12mo': 365 };
@@ -452,7 +438,7 @@ function eventPlatformFilter(query) {
 function statsHandler(req, res) {
   const site = getSiteByDomain.get(norm(req.query.site));
   if (!site) return res.status(404).json({ error: 'Unknown site' });
-  if (!shareScopeOk(req, site)) return res.status(403).json({ error: 'Share link is limited to another site' });
+  if (!siteOk(req, site)) return res.status(403).json(NO_SITE);
   const sid = site.id;
   const { start, end, days, period, hourly } = rangeFor(req.query);
   const { clauses, params, goal } = buildFilters(req.query);
@@ -669,7 +655,7 @@ app.get('/api/v1/stats', authOrShare, statsHandler);
 function realtimeHandler(req, res) {
   const site = getSiteByDomain.get(norm(req.query.site));
   if (!site) return res.status(404).json({ error: 'Unknown site' });
-  if (!shareScopeOk(req, site)) return res.status(403).json({ error: 'Share link is limited to another site' });
+  if (!siteOk(req, site)) return res.status(403).json(NO_SITE);
   const sid = site.id, now = Date.now(), since = now - 30 * 60000;
   const online = db.prepare('SELECT COUNT(DISTINCT vh) v FROM events WHERE site_id = ? AND name IS NULL AND ts >= ?').get(sid, now - 5 * 60000).v;
   const rows = db.prepare('SELECT CAST((ts/60000) AS INT) b, COUNT(*) pv, COUNT(DISTINCT vh) v FROM events WHERE site_id = ? AND name IS NULL AND ts >= ? GROUP BY b').all(sid, since);
@@ -683,18 +669,20 @@ app.get('/api/realtime', authOrShare, realtimeHandler);
 app.get('/api/v1/realtime', authOrShare, realtimeHandler);
 
 // ── share links: create / list / revoke (owner only) + resolve (public) ──────────
-app.get('/api/shares', auth, (req, res) => {
-  const rows = db.prepare('SELECT s.token, s.created, st.domain FROM shares s JOIN sites st ON st.id = s.site_id ORDER BY s.created DESC').all();
+app.get('/api/shares', adminOnly, (req, res) => {
+  const rows = db.prepare('SELECT s.token, s.created, s.site_id, st.domain FROM shares s JOIN sites st ON st.id = s.site_id ORDER BY s.created DESC').all()
+    .filter((r) => siteAllowed(req, r.site_id)).map(({ site_id, ...r }) => r);
   res.json(rows);
 });
-app.post('/api/shares', auth, (req, res) => {
+app.post('/api/shares', adminOnly, (req, res) => {
   const site = getSiteByDomain.get(norm(req.body && req.body.site));
   if (!site) return res.status(404).json({ error: 'Unknown site' });
+  if (!siteOk(req, site)) return res.status(403).json(NO_SITE);
   const token = newToken();
   db.prepare('INSERT INTO shares (token, site_id, created) VALUES (?, ?, ?)').run(token, site.id, Date.now());
   res.json({ token, domain: site.domain, url: '/share/' + token });
 });
-app.delete('/api/shares/:token', auth, (req, res) => {
+app.delete('/api/shares/:token', adminOnly, (req, res) => {
   db.prepare('DELETE FROM shares WHERE token = ?').run(String(req.params.token));
   res.json({ ok: true });
 });
@@ -710,11 +698,13 @@ app.get('/api/share-info/:token', (req, res) => {
 app.get('/api/funnels', auth, (req, res) => {
   const site = getSiteByDomain.get(norm(req.query.site));
   if (!site) return res.status(404).json({ error: 'Unknown site' });
+  if (!siteOk(req, site)) return res.status(403).json(NO_SITE);
   res.json(db.prepare('SELECT id, name, steps, created FROM funnels WHERE site_id = ? ORDER BY id').all(site.id).map((f) => ({ ...f, steps: JSON.parse(f.steps) })));
 });
-app.post('/api/funnels', auth, (req, res) => {
+app.post('/api/funnels', adminOnly, (req, res) => {
   const site = getSiteByDomain.get(norm(req.body && req.body.site));
   if (!site) return res.status(404).json({ error: 'Unknown site' });
+  if (!siteOk(req, site)) return res.status(403).json(NO_SITE);
   const name = String((req.body && req.body.name) || '').slice(0, 80).trim();
   const raw = (req.body && req.body.steps) || [];
   if (!name) return res.status(400).json({ error: 'Funnel needs a name' });
@@ -728,7 +718,7 @@ app.post('/api/funnels', auth, (req, res) => {
   const info = db.prepare('INSERT INTO funnels (site_id, name, steps, created) VALUES (?, ?, ?, ?)').run(site.id, name, JSON.stringify(steps), Date.now());
   res.json({ id: info.lastInsertRowid, name, steps });
 });
-app.delete('/api/funnels/:id', auth, (req, res) => {
+app.delete('/api/funnels/:id', adminOnly, (req, res) => {
   db.prepare('DELETE FROM funnels WHERE id = ?').run(Number(req.params.id));
   res.json({ ok: true });
 });
@@ -737,7 +727,7 @@ app.get('/api/funnels/:id/stats', authOrShare, (req, res) => {
   const f = db.prepare('SELECT * FROM funnels WHERE id = ?').get(Number(req.params.id));
   if (!f) return res.status(404).json({ error: 'Unknown funnel' });
   const site = db.prepare('SELECT * FROM sites WHERE id = ?').get(f.site_id);
-  if (!shareScopeOk(req, site)) return res.status(403).json({ error: 'Share link is limited to another site' });
+  if (!siteOk(req, site)) return res.status(403).json(NO_SITE);
   const { start, end } = rangeFor(req.query);
   const steps = JSON.parse(f.steps);
   // one pass per visitor: fetch matching events sorted by time, walk the step ladder.
@@ -771,7 +761,7 @@ app.use(express.static(path.join(__dirname, 'public')));
 app.get('/api/journeys', authOrShare, (req, res) => {
   const site = getSiteByDomain.get(norm(req.query.site));
   if (!site) return res.status(404).json({ error: 'Unknown site' });
-  if (!shareScopeOk(req, site)) return res.status(403).json({ error: 'Share link is limited to another site' });
+  if (!siteOk(req, site)) return res.status(403).json(NO_SITE);
   const { start, end } = rangeFor(req.query);
   const maxDepth = Math.min(5, Math.max(2, parseInt(req.query.depth, 10) || 4));
   const GAP = 30 * 60000;