rootandClaude Opus 5.5
ff230e5da7
- Admin login gate (docs/design/auth-reference.md): admin_user/admin_session/login_attempt
(migration 0015), one-time setup token logged once + conditional UPDATE, argon2id via
hash-wasm (WASM; compiled binary has no --allow-ffi), sha256-stored sessions in HttpOnly
SameSite=Lax cookie umt_session (fixed 12h TTL, soft revoke), HMAC-derived double-submit
CSRF, IP (5) + account (15) failure limits per 15 min, password change revokes other
sessions, optional TOTP with replay counter, AuditAction enum.
- Unified auth middleware: cookie session or Bearer API key -> c.var.actor
{type: admin|api_key, id, name, scopes}; requireScope works for both; requireAdminSession.
- ctx.secrets: AES-256-GCM, per-secret HKDF-SHA256 key from SECRET_MASTER_KEY, AAD bound
to (id, purpose); ctx.settings: 30s cache invalidated by settings.changed events.
- Endpoints: /auth/*, /settings, /api-keys, /secrets, /audit-events, library-roots,
downloader/media-server instances (+test), path-mappings (+verify),
PUT /sites/{id}/credentials, /engine/runs|stats|cancel (read-only openworkflow schema).
- SSE: PgEventBus (sse_event table, migration 0016, LISTEN/NOTIFY umt_events, catch-up by
seq, pruning, resync); EventBusPort is now async.
- Tests: login/rate limit/revocation/CSRF/TOTP, secrets round trip and no log leakage,
admin APIs against mock qB/Emby, SSE across two Deno subprocesses.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
80 lines
3.5 KiB
JSON
80 lines
3.5 KiB
JSON
{
|
|
"workspace": [
|
|
"./packages/adapters",
|
|
"./packages/agent",
|
|
"./packages/contracts",
|
|
"./packages/db",
|
|
"./packages/domain",
|
|
"./packages/mapping",
|
|
"./packages/tasks",
|
|
"./packages/testkit",
|
|
"./apps/server",
|
|
"./apps/web"
|
|
],
|
|
"nodeModulesDir": "auto",
|
|
"imports": {
|
|
"@biomejs/biome": "npm:@biomejs/[email protected]",
|
|
"@earendil-works/pi-agent-core": "npm:@earendil-works/[email protected]",
|
|
"@earendil-works/pi-agent-core/": "npm:/@earendil-works/[email protected]/",
|
|
"@earendil-works/pi-ai": "npm:@earendil-works/[email protected]",
|
|
"@earendil-works/pi-ai/": "npm:/@earendil-works/[email protected]/",
|
|
"@hono/swagger-ui": "npm:@hono/[email protected]",
|
|
"@hono/zod-openapi": "npm:@hono/[email protected]",
|
|
"@types/node": "npm:@types/[email protected]",
|
|
"@types/nunjucks": "npm:@types/[email protected]",
|
|
"@types/pg": "npm:@types/[email protected]",
|
|
"@xmldom/xmldom": "npm:@xmldom/[email protected]",
|
|
"cheerio": "npm:[email protected]",
|
|
"fast-xml-parser": "npm:[email protected]",
|
|
"hash-wasm": "npm:[email protected]",
|
|
"hono": "npm:[email protected]",
|
|
"hono/": "npm:/[email protected]/",
|
|
"kysely": "npm:[email protected]",
|
|
"kysely/": "npm:/[email protected]/",
|
|
"nunjucks": "npm:[email protected]",
|
|
"openworkflow": "npm:[email protected]",
|
|
"openworkflow/": "npm:/[email protected]/",
|
|
"pg": "npm:[email protected]",
|
|
"pino": "npm:[email protected]",
|
|
"pino-pretty": "npm:[email protected]",
|
|
"postgres": "npm:[email protected]",
|
|
"typebox": "npm:[email protected]",
|
|
"typescript": "npm:[email protected]",
|
|
"vitest": "npm:[email protected]",
|
|
"vitest/": "npm:/[email protected]/",
|
|
"xpath": "npm:[email protected]",
|
|
"yaml": "npm:[email protected]",
|
|
"zod": "npm:[email protected]"
|
|
},
|
|
"compilerOptions": {
|
|
"strict": true,
|
|
"noUncheckedIndexedAccess": true,
|
|
"noImplicitOverride": true,
|
|
"noFallthroughCasesInSwitch": true,
|
|
"verbatimModuleSyntax": true
|
|
},
|
|
"tasks": {
|
|
"dev": {
|
|
"description": "同时起 server(4380)与 web(5180)",
|
|
"dependencies": ["dev:server", "dev:web"]
|
|
},
|
|
"dev:server": "cd apps/server && deno task dev",
|
|
"dev:web": "cd apps/web && deno task dev",
|
|
"db:up": "docker compose -f docker-compose.dev.yml up -d --wait",
|
|
"db:migrate": "deno run -A --env-file=.env packages/db/scripts/migrate.ts latest",
|
|
"db:reset": "deno run -A --env-file=.env packages/db/scripts/migrate.ts reset",
|
|
"gen:types": "deno run -A --env-file=.env packages/db/scripts/gen-types.ts",
|
|
"types": "mkdir -p types && deno types > types/deno.d.ts",
|
|
"typecheck": "deno task types && deno task typecheck:tsc && deno task typecheck:deno",
|
|
"typecheck:tsc": "deno task --members -j 1 typecheck",
|
|
"typecheck:deno": "deno check apps/server/src/main.ts packages/contracts/src/index.ts packages/db/src/index.ts packages/db/scripts/migrate.ts packages/db/scripts/gen-types.ts packages/db/migrations/*.ts packages/domain/src/index.ts packages/mapping/src/index.ts packages/tasks/src/index.ts packages/agent/src/index.ts packages/adapters/src/index.ts packages/testkit/src/index.ts",
|
|
"lint": "deno run -A npm:@biomejs/biome check .",
|
|
"fmt": "deno run -A npm:@biomejs/biome check --write .",
|
|
"test": "deno task --members -j 1 test",
|
|
"check:tokens": "cd apps/web && deno task check:tokens",
|
|
"build": "cd apps/web && deno task build && cd ../server && deno task compile",
|
|
"ci": "deno task typecheck && deno task lint && deno task test && deno task check:tokens && deno task build",
|
|
"gen:tokens": "cd apps/web && deno task gen:tokens"
|
|
}
|
|
}
|