thevoidforge 21.0.8 → 21.0.10

package/dist/wizard/api/auth.js

@@ -4,13 +4,13 @@
  */
 import { addRoute } from '../router.js';
 import { parseJsonBody } from '../lib/body-parser.js';
-import { hasUsers, createUser, login, logout, validateSession, parseSessionCookie, buildSessionCookie, clearSessionCookie, isRemoteMode, checkRateLimit, getClientIp, getUserRole, isValidUsername, } from '../lib/tower-auth.js';
+import { hasUsers, createUser, login, logout, validateSession, parseSessionCookie, buildSessionCookie, clearSessionCookie, isRemoteMode, isLanMode, checkRateLimit, getClientIp, getUserRole, isValidUsername, } from '../lib/tower-auth.js';
 import { audit } from '../lib/audit-log.js';
 import { sendJson } from '../lib/http-helpers.js';
 // POST /api/auth/setup — Create initial admin user (only when no users exist)
 addRoute('POST', '/api/auth/setup', async (req, res) => {
-    if (!isRemoteMode()) {
-        sendJson(res, 400, { success: false, error: 'Auth setup is only available in remote mode' });
+    if (!isRemoteMode() && !isLanMode()) {
+        sendJson(res, 400, { success: false, error: 'Auth setup is only available in remote or LAN mode' });
         return;
     }
     // Rate-limit the setup endpoint (prevents race-to-setup attacks)
@@ -58,8 +58,8 @@ addRoute('POST', '/api/auth/setup', async (req, res) => {
 });
 // POST /api/auth/login — Authenticate with username + password + TOTP
 addRoute('POST', '/api/auth/login', async (req, res) => {
-    if (!isRemoteMode()) {
-        sendJson(res, 400, { success: false, error: 'Auth is only required in remote mode' });
+    if (!isRemoteMode() && !isLanMode()) {
+        sendJson(res, 400, { success: false, error: 'Auth is only required in remote or LAN mode' });
         return;
     }
     const body = await parseJsonBody(req);
@@ -68,19 +68,25 @@ addRoute('POST', '/api/auth/login', async (req, res) => {
         return;
     }
     const { username, password, totpCode } = body;
-    if (typeof username !== 'string' || typeof password !== 'string' || typeof totpCode !== 'string') {
-        sendJson(res, 400, { success: false, error: 'username, password, and totpCode are required strings' });
+    if (typeof username !== 'string' || typeof password !== 'string') {
+        sendJson(res, 400, { success: false, error: 'username and password are required strings' });
+        return;
+    }
+    // LAN mode: TOTP is optional (password-only auth)
+    const requireTotp = isRemoteMode();
+    const totp = typeof totpCode === 'string' ? totpCode : '';
+    if (requireTotp && (totp.length !== 6 || !/^\d{6}$/.test(totp))) {
+        sendJson(res, 400, { success: false, error: 'totpCode must be exactly 6 digits' });
         return;
     }
     // Cap field lengths to prevent DoS via oversized PBKDF2 input
-    // QA-R3-018 + CROSS-R4-010: TOTP must be exactly 6 digits per RFC 6238
-    if (username.length > 64 || password.length > 256 || totpCode.length !== 6 || !/^\d{6}$/.test(totpCode)) {
+    if (username.length > 64 || password.length > 256) {
         sendJson(res, 400, { success: false, error: 'Field length exceeded' });
         return;
     }
     const ip = getClientIp(req);
-    await audit('login_attempt', ip, username.slice(0, 64), { method: 'password+totp' });
-    const result = await login(username, password, totpCode, ip);
+    await audit('login_attempt', ip, username.slice(0, 64), { method: requireTotp ? 'password+totp' : 'password' });
+    const result = await login(username, password, totp, ip);
     if ('error' in result) {
         await audit('login_failure', ip, username.slice(0, 64), { reason: result.error });
         const status = result.retryAfterMs ? 429 : 401;
@@ -114,8 +120,8 @@ addRoute('POST', '/api/auth/logout', async (req, res) => {
 });
 // GET /api/auth/session — Check if current session is valid
 addRoute('GET', '/api/auth/session', async (req, res) => {
-    if (!isRemoteMode()) {
-        sendJson(res, 200, { success: true, data: { authenticated: true, username: 'local', role: 'admin', remoteMode: false } });
+    if (!isRemoteMode() && !isLanMode()) {
+        sendJson(res, 200, { success: true, data: { authenticated: true, username: 'local', role: 'admin', remoteMode: false, lanMode: false } });
         return;
     }
     const token = parseSessionCookie(req.headers.cookie);
@@ -129,5 +135,5 @@ addRoute('GET', '/api/auth/session', async (req, res) => {
         sendJson(res, 200, { success: true, data: { authenticated: false, needsSetup: false } });
         return;
     }
-    sendJson(res, 200, { success: true, data: { authenticated: true, username: session.username, role: session.role, remoteMode: true } });
+    sendJson(res, 200, { success: true, data: { authenticated: true, username: session.username, role: session.role, remoteMode: isRemoteMode(), lanMode: isLanMode() } });
 });

package/dist/wizard/server.js

@@ -159,11 +159,10 @@ async function handleRequest(req, res) {
         sendJson(res, 403, { success: false, error: 'Missing X-VoidForge-Request header' });
         return;
     }
-    // LAN mode — full access. LAN is a private network (ZeroTier, local subnet),
-    // inherently more secure than remote. No endpoint restrictions.
-    // Auth: optional password (no TOTP). All features available.
-    // Auth middleware — in remote mode, require valid session for non-exempt paths
-    if (isRemoteMode()) {
+    // Auth middleware — in remote and LAN modes, require valid session for non-exempt paths.
+    // LAN mode has full access (same as remote) but simpler auth (password only, no TOTP).
+    // Local mode (127.0.0.1) has no auth — it's your own machine.
+    if (isRemoteMode() || isLanMode()) {
         const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
         if (!isAuthExempt(url.pathname)) {
             const token = parseSessionCookie(req.headers.cookie);

package/dist/wizard/ui/lobby.js

@@ -710,14 +710,14 @@
       const res = await fetch('/api/auth/session');
       const body = await res.json();
       const data = body.data || {};
-      if (data.remoteMode && data.authenticated) {
+      if ((data.remoteMode || data.lanMode) && data.authenticated) {
         currentUser = { username: data.username || '', role: data.role || 'viewer' };
         const roleLabel = { admin: 'Admin', deployer: 'Deployer', viewer: 'Viewer' }[data.role] || '';
         authUser.textContent = data.username + (roleLabel ? ' (' + roleLabel + ')' : '');
         authUser.style.display = '';
         btnLogout.style.display = '';
       }
-      if (data.remoteMode && !data.authenticated) {
+      if ((data.remoteMode || data.lanMode) && !data.authenticated) {
         window.location.href = '/login.html';
       }
     } catch { /* local mode — no auth needed */ }

package/dist/wizard/ui/login.js

@@ -92,12 +92,19 @@
 
     try {
       const data = await setupAccount(username, password);
-      // Show TOTP setup
-      setupStatus.textContent = '';
-      setupStatus.className = 'status-row';
-      totpSecret.textContent = data.totpSecret;
-      totpSetup.style.display = 'block';
-      setupSubmit.style.display = 'none';
+      if (requireTotp && data.totpSecret) {
+        // Show TOTP setup (remote mode)
+        setupStatus.textContent = '';
+        setupStatus.className = 'status-row';
+        totpSecret.textContent = data.totpSecret;
+        totpSetup.style.display = 'block';
+        setupSubmit.style.display = 'none';
+      } else {
+        // LAN mode — skip TOTP, go straight to login
+        setupStatus.textContent = 'Account created. Please log in.';
+        setupStatus.className = 'status-row success';
+        setTimeout(function () { showLogin(); }, 1000);
+      }
     } catch (err) {
       setupStatus.textContent = err.message;
       setupStatus.className = 'status-row error';
@@ -111,7 +118,15 @@
 
   // ── Login flow ─────────────────────────────────────
 
-  // TOTP field is always visible (removed conditional show — accessibility fix)
+  // Detect if TOTP is required (remote mode) or optional (LAN mode)
+  var requireTotp = true;
+  fetch('/api/auth/session').then(function (r) { return r.json(); }).then(function (d) {
+    var data = d.data || {};
+    if (data.lanMode && !data.remoteMode) {
+      requireTotp = false;
+      if (totpField) totpField.style.display = 'none';
+    }
+  }).catch(function () {});
 
   loginSubmit.addEventListener('click', async () => {
     const username = loginUsername.value.trim();
@@ -123,7 +138,7 @@
       loginStatus.className = 'status-row error';
       return;
     }
-    if (!totp || totp.length !== 6) {
+    if (requireTotp && (!totp || totp.length !== 6)) {
       loginStatus.textContent = 'Enter your 6-digit authenticator code';
       loginStatus.className = 'status-row error';
       loginTotp.focus();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thevoidforge",
-  "version": "21.0.8",
+  "version": "21.0.10",
   "description": "From nothing, everything. A methodology framework for building with Claude Code.",
   "type": "module",
   "engines": {