toiljs 0.0.87 → 0.0.89

package/test/pqauth-email.test.ts

@@ -0,0 +1,333 @@
+/**
+ * End-to-end email-verification + password-reset for the BUILT-IN auth controller
+ * (`server/auth/AuthController.ts`, mounted into `examples/basic` via
+ * `server: { auth: true }`). Drives the REAL browser client (`src/client/auth.ts`)
+ * against the toilscript-compiled example wasm through the same fetch-shim harness
+ * as `pqauth-e2e.test.ts`: a `fetch` shim routes the client's requests into
+ * `WasmServerModule.dispatch`, and the in-process dev ToilDB persists across
+ * dispatches so a register -> login -> confirm/reset flow spans "requests".
+ *
+ * The confirm/reset one-time tokens are only delivered by email, so this reads
+ * them out of the dev email-capture seam (`__sentEmails`) and regexes the token
+ * from the emitted link. Confirmation is toggled per case via the plain env var
+ * the controller reads (`AUTH_REQUIRE_EMAIL_CONFIRMATION`), set through
+ * `process.env` + a dev env-cache clear.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { describe, expect, it, beforeEach, afterEach } from 'vitest';
+
+import { WasmServerModule } from '../src/devserver/index.js';
+import { __resetDbForTests } from '../src/devserver/db/index.js';
+import { __resetRatelimitForTests } from '../src/devserver/config/ratelimit.js';
+import { clearEnvCache } from '../src/devserver/config/dotenv.js';
+import { __sentEmails, __clearSentEmails } from '../src/devserver/email/index.js';
+import { Auth, EmailNotConfirmedError } from '../src/client/auth.js';
+import { DataReader, DataWriter } from '../src/io/codec.js';
+
+const EXAMPLE_WASM = path.resolve(
+    path.dirname(fileURLToPath(import.meta.url)),
+    '../examples/basic/build/server/release.wasm',
+);
+
+const haveWasm = fs.existsSync(EXAMPLE_WASM);
+
+function loadModule(): WasmServerModule {
+    const m = new WasmServerModule(EXAMPLE_WASM);
+    m.refresh();
+    return m;
+}
+
+/** Route the client's `fetch(path, {body})` into the dev wasm dispatcher (with a cookie jar). */
+function installFetchShim(m: WasmServerModule): () => void {
+    const original = globalThis.fetch;
+    const jar = new Map<string, string>();
+    globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+        const url = typeof input === 'string' ? input : input.toString();
+        const pathname = new URL(url, 'http://localhost').pathname;
+        const bodyBytes =
+            init?.body == null ? new Uint8Array(0) : new Uint8Array(init.body as ArrayBuffer);
+        const headers: [string, string][] = [
+            ['host', 'localhost:3000'],
+            ['content-type', 'application/octet-stream'],
+        ];
+        if (jar.size > 0)
+            headers.push(['cookie', [...jar.entries()].map(([k, v]) => `${k}=${v}`).join('; ')]);
+        const r = m.dispatch({
+            method: (init?.method ?? 'GET') as 'GET' | 'POST',
+            path: pathname,
+            headers,
+            body: bodyBytes,
+        });
+        for (const [name, value] of r.headers) {
+            if (name.toLowerCase() !== 'set-cookie') continue;
+            const pair = value.split(';', 1)[0];
+            const eq = pair.indexOf('=');
+            if (eq > 0) jar.set(pair.slice(0, eq).trim(), pair.slice(eq + 1).trim());
+        }
+        const ab = r.body.buffer.slice(r.body.byteOffset, r.body.byteOffset + r.body.byteLength);
+        return {
+            ok: r.status >= 200 && r.status < 300,
+            status: r.status,
+            arrayBuffer: async () => ab,
+            text: async () => Buffer.from(r.body).toString('utf8'),
+        } as Response;
+    }) as typeof fetch;
+    return {
+        restore: () => {
+            globalThis.fetch = original;
+        },
+        jar,
+    };
+}
+
+const CONFIRM_ENV = 'AUTH_REQUIRE_EMAIL_CONFIRMATION';
+
+/** Toggle the domain's email-confirmation requirement the way the dev env store exposes plain vars:
+ *  set/unset the `process.env` var, then drop the cached env snapshot so the next `Environment.get`
+ *  (a per-dispatch host call) re-reads it. */
+function setConfirmation(on: boolean): void {
+    if (on) process.env[CONFIRM_ENV] = 'true';
+    else delete process.env[CONFIRM_ENV];
+    clearEnvCache();
+}
+
+function hexToBytes(hex: string): Uint8Array {
+    const out = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < out.length; i++) out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    return out;
+}
+
+/** Pull the one-time token out of the most-recent captured confirm/reset email to `to`. */
+function tokenFromEmail(kind: 'confirm' | 'reset', to: string): string {
+    // Tokens live in the URL FRAGMENT now (#token=), kept out of server/CDN logs.
+    const re = kind === 'confirm' ? /\/confirm#token=([0-9a-f]+)/ : /\/reset#token=([0-9a-f]+)/;
+    for (let i = __sentEmails.length - 1; i >= 0; i--) {
+        const msg = __sentEmails[i];
+        if (msg.to !== to) continue;
+        const hit = re.exec(msg.text) ?? re.exec(msg.html);
+        if (hit) return hit[1];
+    }
+    throw new Error(
+        `no ${kind} token emailed to ${to}; captured=${JSON.stringify(
+            __sentEmails.map((e) => ({ to: e.to, purpose: e.purpose })),
+        )}`,
+    );
+}
+
+describe.skipIf(!haveWasm)('built-in auth: email verification + password reset (client <-> example wasm)', () => {
+    let restoreFetch: () => void;
+    let mod: WasmServerModule;
+    let jar: Map<string, string>;
+
+    beforeEach(() => {
+        __resetDbForTests();
+        // The controller decorates every route with `@ratelimit`; the dev limiter is a module
+        // singleton, so reset it per case to keep the many dispatches across this file isolated.
+        __resetRatelimitForTests();
+        __clearSentEmails();
+        setConfirmation(false); // default: confirmation off unless a case opts in
+        mod = loadModule();
+        const shim = installFetchShim(mod);
+        restoreFetch = shim.restore;
+        jar = shim.jar;
+    });
+    afterEach(() => {
+        restoreFetch();
+        setConfirmation(false);
+    });
+
+    it(
+        'confirmation OFF (default): register auto-confirms, login succeeds, /auth/me returns the user',
+        async () => {
+            await Auth.register('ada', 'correct horse battery staple', 'ada@example.com');
+            const session = await Auth.login('ada', 'correct horse battery staple');
+            expect(session.length).toBeGreaterThan(0);
+
+            // The controller's `@auth`-gated /auth/me returns bytes(toilUserId) str(username).
+            const meRes = await fetch('/auth/me');
+            expect(meRes.status).toBe(200);
+            const me = new DataReader(new Uint8Array(await meRes.arrayBuffer()));
+            expect(me.readBytes().length).toBeGreaterThan(0); // stable toilUserId
+            expect(me.readString()).toBe('ada');
+
+            // No confirmation required -> no email was sent.
+            expect(__sentEmails.length).toBe(0);
+        },
+        60_000,
+    );
+
+    // ---- security regressions ----
+
+    it(
+        'reset link is NOT poisonable via a crafted Host header (#6 host-header reset-poisoning)',
+        async () => {
+            await Auth.register('grace', 'pw-grace-correct', 'grace@x.com');
+            __clearSentEmails();
+            // Attacker triggers reset/request with a Host that routes to the victim
+            // (the edge strip_port -> "victim.com") but, dropped raw into a link,
+            // reparents the URL authority to attacker.com.
+            const body = new DataWriter().writeString('grace@x.com').toBytes();
+            const r = mod.dispatch({
+                method: 'POST',
+                path: '/auth/reset/request',
+                headers: [
+                    ['host', 'victim.com:@attacker.com'],
+                    ['content-type', 'application/octet-stream'],
+                ],
+                body,
+            });
+            expect(r.status).toBe(200); // always the generic non-enumerating ack
+            const msg = __sentEmails.find((e) => e.to === 'grace@x.com');
+            expect(msg).toBeTruthy();
+            // The poisoned Host is rejected (contains `@`) and the link falls back to
+            // a safe origin -> the attacker domain never appears in the emailed link.
+            expect((msg!.html + msg!.text).includes('attacker.com')).toBe(false);
+        },
+        60_000,
+    );
+
+    it(
+        'a session minted for one tenant does NOT verify for another (#2 cross-tenant session)',
+        async () => {
+            await Auth.register('heidi', 'pw-heidi-correct', 'heidi@x.com');
+            await Auth.login('heidi', 'pw-heidi-correct'); // minted under the shim Host localhost:3000
+            const sess = jar.get('toil_sess'); // dev is plain HTTP -> unprefixed cookie
+            expect(sess).toBeTruthy();
+            const meHeaders = (host: string): [string, string][] => [
+                ['host', host],
+                ['cookie', 'toil_sess=' + String(sess)],
+            ];
+            // Same tenant (localhost) -> the @auth-gated /auth/me accepts it.
+            const same = mod.dispatch({
+                method: 'GET',
+                path: '/auth/me',
+                headers: meHeaders('localhost:3000'),
+                body: new Uint8Array(0),
+            });
+            expect(same.status).toBe(200);
+            // A DIFFERENT tenant Host derives a different session key -> the same
+            // cookie fails to open -> 401. A B-minted session cannot bypass A.
+            const cross = mod.dispatch({
+                method: 'GET',
+                path: '/auth/me',
+                headers: meHeaders('evil-tenant.com'),
+                body: new Uint8Array(0),
+            });
+            expect(cross.status).toBe(401);
+        },
+        60_000,
+    );
+
+    it(
+        'token bound: a new reset request invalidates the previous token (#5c growth bound)',
+        async () => {
+            await Auth.register('ivan', 'pw-ivan-correct', 'ivan@x.com');
+            await Auth.requestPasswordReset('ivan@x.com');
+            const token1 = tokenFromEmail('reset', 'ivan@x.com');
+            __clearSentEmails();
+            await Auth.requestPasswordReset('ivan@x.com'); // mints token2, invalidates token1
+            const token2 = tokenFromEmail('reset', 'ivan@x.com');
+            expect(token2).not.toBe(token1);
+            // The superseded token no longer works...
+            await expect(Auth.resetPassword(token1, 'new-pw-unused')).rejects.toThrow();
+            // ...only the latest does.
+            await Auth.resetPassword(token2, 'new-pw-ivan');
+            const session = await Auth.login('ivan', 'new-pw-ivan');
+            expect(session.length).toBeGreaterThan(0);
+        },
+        60_000,
+    );
+
+    it(
+        'confirmation ON: login is refused until the emailed token confirms the account',
+        async () => {
+            setConfirmation(true);
+            await Auth.register('bob', 'hunter2-correct', 'bob@example.com');
+
+            // A valid credential is not enough: the domain requires a confirmed email.
+            await expect(Auth.login('bob', 'hunter2-correct')).rejects.toThrow(EmailNotConfirmedError);
+
+            // Read the confirm link out of the captured email and confirm.
+            const token = tokenFromEmail('confirm', 'bob@example.com');
+            await Auth.confirmEmail(token);
+
+            // Now login succeeds.
+            const session = await Auth.login('bob', 'hunter2-correct');
+            expect(session.length).toBeGreaterThan(0);
+        },
+        60_000,
+    );
+
+    it(
+        'duplicate email is rejected at registration (distinct "email already in use")',
+        async () => {
+            await Auth.register('carol', 'carol-pw-strong', 'dupe@x.com');
+            await expect(Auth.register('dave', 'dave-pw-strong', 'dupe@x.com')).rejects.toThrow(
+                /email already in use/,
+            );
+        },
+        60_000,
+    );
+
+    it(
+        'password reset round trip: old password stops working, the new one logs in',
+        async () => {
+            await Auth.register('erin', 'oldpw-erin-strong', 'erin@x.com');
+            // Sanity: confirmation is off, so she can log in before the reset.
+            expect((await Auth.login('erin', 'oldpw-erin-strong')).length).toBeGreaterThan(0);
+
+            await Auth.requestPasswordReset('erin@x.com');
+            const token = tokenFromEmail('reset', 'erin@x.com');
+            await Auth.resetPassword(token, 'newpw-erin-strong');
+
+            await expect(Auth.login('erin', 'oldpw-erin-strong')).rejects.toThrow(
+                /login failed|request failed/,
+            );
+            expect((await Auth.login('erin', 'newpw-erin-strong')).length).toBeGreaterThan(0);
+        },
+        60_000,
+    );
+
+    it(
+        'non-enumeration: reset/resend for an unknown email resolve and send NOTHING',
+        async () => {
+            __clearSentEmails();
+            await expect(Auth.requestPasswordReset('nobody@x.com')).resolves.toBeUndefined();
+            await expect(Auth.resendConfirmation('nobody@x.com')).resolves.toBeUndefined();
+            expect(__sentEmails.length).toBe(0);
+        },
+        60_000,
+    );
+
+    it(
+        'a reset token is one-time: replaying /auth/reset/finish with the consumed token fails',
+        async () => {
+            await Auth.register('frank', 'oldpw-frank-strong', 'frank@x.com');
+            await Auth.requestPasswordReset('frank@x.com');
+            const tokenHex = tokenFromEmail('reset', 'frank@x.com');
+            await Auth.resetPassword(tokenHex, 'newpw-frank-strong'); // consumes the token
+
+            // Replay reset/finish with a valid-length pk/proof so the controller reaches the
+            // token-consume step, which now finds the token already deleted -> generic fail.
+            const body = new DataWriter()
+                .writeBytes(hexToBytes(tokenHex))
+                .writeBytes(new Uint8Array(1312)) // AuthService.PUBLIC_KEY_LEN (ML-DSA-44)
+                .writeBytes(new Uint8Array(2420)) // AuthService.SIGNATURE_LEN
+                .toBytes();
+            const r = mod.dispatch({
+                method: 'POST',
+                path: '/auth/reset/finish',
+                headers: [
+                    ['host', 'localhost:3000'],
+                    ['content-type', 'application/octet-stream'],
+                ],
+                body,
+            });
+            expect(r.status).not.toBe(200);
+        },
+        60_000,
+    );
+});

package/examples/basic/server/routes/Auth.ts

@@ -1,268 +0,0 @@
-import { Response, RouteContext } from 'toiljs/server/runtime';
-import { DataReader, DataWriter } from 'data';
-
-import { encodeSessionUser } from './Session';
-
-/**
- * Toil PQ-Auth: post-quantum password login, end-to-end and runnable under `toiljs dev`.
- *
- * The password never leaves the browser. The client blinds it through the
- * server-keyed OPRF (precomputation-resistant keyed salt), stretches the OPRF
- * output with Argon2id into an ML-DSA-44 keypair, and registers only the public
- * key (+ a proof-of-possession). Login is a challenge-response that also runs an
- * ML-KEM-768 key encapsulation: the server proves its identity by returning a
- * confirmation tag only derivable from the decapsulated shared secret (mutual
- * auth). See `server/globals/auth.ts` (the `AuthService` global) and the client
- * half in `toiljs/client` (`Auth.register` / `Auth.login`).
- *
- * STORAGE: backed by ToilDB (`@database AuthDb`). Accounts are a `record`
- * collection keyed by username; login challenges are a `record` consumed exactly
- * once with `getDelete` (atomic fetch-and-delete). The dev server emulates these
- * `env.data.*` host imports in process (so register -> login spans requests under
- * `toiljs dev`); the production edge backs the SAME API with ScyllaDB.
- *
- * Wire: every body/response is binary (`DataWriter`/`DataReader`), never JSON.
- */
-
-const AUD = 'toil-demo'; // this service's audience id (server config; never client-echoed)
-
-// Demo-light Argon2id params (responsive in a browser tab). A real deployment
-// uses >= 256 MiB / >= 3 iterations. The client derives against whatever it is
-// handed, so this is the single source of truth.
-const DEMO_MEM_KIB: u32 = 32768; // 32 MiB
-const DEMO_ITERS: u32 = 2;
-const DEMO_PAR: u32 = 1;
-
-const CHALLENGE_TTL_SECS: u64 = 120;
-const SESSION_TTL_SECS: u64 = 3600;
-
-function randomBytes(n: i32): Uint8Array {
-    const b = new Uint8Array(n);
-    crypto.getRandomValues(b);
-    return b;
-}
-
-function nowSecs(): u64 {
-    return <u64>(Date.now() / 1000);
-}
-
-/** One generic error on every failure path (anti-enumeration, anti-oracle). */
-function fail(): Response {
-    return Response.text('auth: request failed\n', 401);
-}
-
-/**
- * Deterministic per-user Argon2id salt (16 bytes). With the OPRF providing
- * precomputation resistance, a public/deterministic salt is fine: it only needs
- * to be unique per user (the OPRF output already differs per user). Making it
- * deterministic means register and login agree with NO stored salt, and an
- * unknown user yields the SAME stable salt as a known one would -- no
- * enumeration oracle.
- */
-function deriveSalt(username: string): Uint8Array {
-    return crypto.sha256Text('toil-demo-salt-v1:' + username).slice(0, 16);
-}
-
-@data
-class Username {
-    name: string = '';
-    constructor(name: string = '') {
-        this.name = name;
-    }
-}
-
-@data
-class ChallengeId {
-    cid: Uint8Array = new Uint8Array(0);
-    constructor(cid: Uint8Array = new Uint8Array(0)) {
-        this.cid = cid;
-    }
-}
-
-@data
-class AuthAccount {
-    username: string = '';
-    salt: Uint8Array = new Uint8Array(0);
-    publicKey: Uint8Array = new Uint8Array(0);
-    memKiB: u32 = 0;
-    iterations: u32 = 0;
-    parallelism: u32 = 0;
-}
-
-@data
-class Challenge {
-    cid: Uint8Array = new Uint8Array(0);
-    username: string = '';
-    nonce: Uint8Array = new Uint8Array(0);
-    iat: u64 = 0;
-    exp: u64 = 0;
-}
-
-@database
-class AuthDb {
-    @collection static accounts: Documents<Username, AuthAccount>;
-    @collection static challenges: Documents<ChallengeId, Challenge>;
-}
-
-@rest('auth')
-class Auth {
-    /** POST /auth/register/start  body: str(username) bytes(blinded)
-     *  resp: u8(status=0) u32(mem) u32(iters) u32(par) bytes(salt) bytes(evaluated)
-     *  No taken-oracle: always succeeds; register/finish rejects a duplicate. */
-    @post('/register/start')
-    public registerStart(ctx: RouteContext): Response {
-        const r = new DataReader(ctx.request.body);
-        const username = r.readString();
-        const blinded = r.readBytes();
-        if (!r.ok) return fail();
-        const evaluated = AuthService.oprfEvaluate(username, blinded);
-        if (evaluated.length != AuthService.OPRF_ELEMENT_LEN) return fail();
-
-        const w = new DataWriter();
-        w.writeU8(0);
-        w.writeU32(DEMO_MEM_KIB);
-        w.writeU32(DEMO_ITERS);
-        w.writeU32(DEMO_PAR);
-        w.writeBytes(deriveSalt(username));
-        w.writeBytes(evaluated);
-        return Response.bytes(w.toBytes());
-    }
-
-    /** POST /auth/register/finish  body: str(username) bytes(pk) bytes(regProof)
-     *  resp: u8(status) -- 0 = ok, 1 = username already registered. Verifies
-     *  proof-of-possession before storing the key. */
-    @post('/register/finish')
-    public registerFinish(ctx: RouteContext): Response {
-        const r = new DataReader(ctx.request.body);
-        const username = r.readString();
-        const pk = r.readBytes();
-        const proof = r.readBytes();
-        if (!r.ok) return fail();
-        if (pk.length != AuthService.PUBLIC_KEY_LEN) return fail();
-        // Already registered: a distinguishable status (not the generic 401) so the
-        // client can say "username taken, log in instead" rather than a blank error.
-        if (AuthDb.accounts.exists(new Username(username))) {
-            return Response.bytes(new DataWriter().writeU8(1).toBytes());
-        }
-
-        // Proof-of-possession: the client signed buildRegisterMessage with the
-        // matching secret key, so we confirm it actually holds it.
-        const regMsg = AuthService.buildRegisterMessage(username, pk);
-        if (!AuthService.verifyRegister(pk, regMsg, proof)) return fail();
-
-        const a = new AuthAccount();
-        a.username = username;
-        a.salt = deriveSalt(username);
-        a.publicKey = pk;
-        a.memKiB = DEMO_MEM_KIB;
-        a.iterations = DEMO_ITERS;
-        a.parallelism = DEMO_PAR;
-        // create-if-absent: a racing duplicate registration loses here, not above.
-        if (!AuthDb.accounts.create(new Username(username), a)) {
-            return Response.bytes(new DataWriter().writeU8(1).toBytes());
-        }
-        return Response.bytes(new DataWriter().writeU8(0).toBytes());
-    }
-
-    /** POST /auth/login/start  body: str(username) bytes(blinded)
-     *  resp: bytes(cid) str(aud) u32(mem) u32(iters) u32(par) bytes(salt)
-     *        bytes(nonce) u64(iat) u64(exp) bytes(evaluated)
-     *  Anti-enumeration: ALWAYS OPRF-evaluates (real or decoy key from the same
-     *  seed+username), returns a deterministic per-user salt + constant params,
-     *  and a fresh challenge -- a known and an unknown user are indistinguishable. */
-    @post('/login/start')
-    public loginStart(ctx: RouteContext): Response {
-        const r = new DataReader(ctx.request.body);
-        const username = r.readString();
-        const blinded = r.readBytes();
-        if (!r.ok) return fail();
-        const evaluated = AuthService.oprfEvaluate(username, blinded);
-        if (evaluated.length != AuthService.OPRF_ELEMENT_LEN) return fail();
-
-        const known = AuthDb.accounts.exists(new Username(username));
-        const cid = randomBytes(16);
-        const nonce = randomBytes(32);
-        const iat = nowSecs();
-        const exp = iat + CHALLENGE_TTL_SECS;
-
-        // Persist only for a real account; the response is identical either way,
-        // and login/finish for an unknown user fails generically at consume.
-        if (known) {
-            const c = new Challenge();
-            c.cid = cid;
-            c.username = username;
-            c.nonce = nonce;
-            c.iat = iat;
-            c.exp = exp;
-            AuthDb.challenges.create(new ChallengeId(cid), c);
-        }
-
-        const w = new DataWriter();
-        w.writeBytes(cid);
-        w.writeString(AUD);
-        w.writeU32(DEMO_MEM_KIB);
-        w.writeU32(DEMO_ITERS);
-        w.writeU32(DEMO_PAR);
-        w.writeBytes(deriveSalt(username));
-        w.writeBytes(nonce);
-        w.writeU64(iat);
-        w.writeU64(exp);
-        w.writeBytes(evaluated);
-        return Response.bytes(w.toBytes());
-    }
-
-    /** POST /auth/login/finish  body: bytes(cid) bytes(ct) bytes(sig)
-     *  resp: u8(status) [+ bytes(sessionToken) bytes(serverConfirm)] + Set-Cookie */
-    @post('/login/finish')
-    public loginFinish(ctx: RouteContext): Response {
-        const r = new DataReader(ctx.request.body);
-        const cid = r.readBytes();
-        const ct = r.readBytes();
-        const sig = r.readBytes();
-        if (!r.ok) return fail();
-
-        // 1. CONSUME FIRST: atomic fetch-and-delete. Unknown/used/expired => fail.
-        const ch = AuthDb.challenges.getDelete(new ChallengeId(cid));
-        if (ch == null) return fail();
-        if (nowSecs() >= ch.exp) return fail();
-
-        // 2. Rebuild the message from OUR stored values + the client's ct (and
-        //    the bound params + server key id), load the account key, verify.
-        const acct = AuthDb.accounts.get(new Username(ch.username));
-        if (acct == null) return fail();
-        const message = AuthService.buildLoginMessage(
-            ch.username,
-            AUD,
-            cid,
-            ch.nonce,
-            ch.iat,
-            ch.exp,
-            ct,
-            DEMO_MEM_KIB,
-            DEMO_ITERS,
-            DEMO_PAR,
-            AuthService.serverKemKeyId()
-        );
-        if (!AuthService.verifyLogin(acct.publicKey, message, sig)) return fail();
-
-        // 3. Decapsulate (proves WE hold the KEM key), derive the session key K
-        //    bound to the transcript, and build the confirmation tag the client
-        //    verifies for mutual auth.
-        const sharedSecret = AuthService.mlkemDecapsulate(ct);
-        if (sharedSecret.length != AuthService.SHARED_SECRET_LEN) return fail();
-        const transcriptHash = AuthService.sha256(message);
-        const sessionKey = AuthService.deriveSessionKey(sharedSecret, transcriptHash);
-        const confirm = AuthService.serverConfirmTag(sessionKey, transcriptHash);
-
-        // 4. Success: mint the session and return {0, sessionToken, confirm}.
-        const userData = encodeSessionUser(ch.username);
-        const w = new DataWriter();
-        w.writeU8(0);
-        w.writeBytes(userData); // opaque session token (the readable user payload)
-        w.writeBytes(confirm);
-        const resp = Response.bytes(w.toBytes());
-        resp.setCookie(AuthService.mintSession(userData, SESSION_TTL_SECS));
-        resp.setCookie(AuthService.userCookie(userData, SESSION_TTL_SECS));
-        return resp;
-    }
-}