- Add idempotent migrations for `is_public`, `bypass_paths`, and `allowed_cidrs` in `server/db.ts`.
- Update `AppRecord` and `getAppByHost` in `server/auth-session.ts` to cache bypass rules in Valkey.
- Implement native Deno, fast-path prefix (`isPathBypassed`) and CIDR matchers (`isIpAllowed`).
- Update `GET /api/forward-auth` to evaluate dynamic rules and properly return 302/403 for unregistered domains.
- Create `ui/components/UnregisteredAppPage.tsx` SSR view for browser fallbacks.
- Update `AdminAppsPage.tsx` to handle the new ingress settings visually and post to `/api/admin/apps`.
- Add `POST /api/guests/sandbox` to generate ephemeral Valkey guest sessions.
- Update `POST /api/register/verify` to detect `upgrade_session` and promote guests to full users in-flight.
- Add `docs/TIER1_INGRESS_SPEC.md`.
- Ensure tests run cleanly and add comprehensive unit test cases for the bypass matrix.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Add isSafeRedirectUrl utility to prevent open-redirect vulnerabilities.
- Update GET /logout to handle ?redirect=, clear cookies safely, and log audit events.
- Create AppLaunchpadPage.tsx using pure Hono SSR JSX for application visibility and SSO launching.
- Update GET /dashboard and AuthenticatedLayout.tsx to mount the Launchpad as the default authenticated view with Zero-Knowledge querying.
- Add HYBRID_INGRESS_PLAYBOOK.md documentation for Traefik ForwardAuth routing.
- Implement exhaustive unit tests in server/main.test.ts for redirect preservation, anomaly logging, and Zero-Knowledge role filtering.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Scaffolds a new Rust crate `wasm/sss_recovery` for constant-time Shamir's Secret Sharing over GF(256) with strict Wasm `zeroize`
- Implements purely typed BIP-39 fallback mapped via Deno WebCrypto in `ui/utils/bip39.ts`
- Migrates `server/recovery.ts` logic mapping Device/Voucher + Server shares with Valkey rate-limiting
- Applies mandatory in-memory JS zeroization on all reconstructed buffers
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
* Added `prf_enabled` and `prf_salt` columns to the `passkeys` table.
* Updated registration API endpoints to request and store the PRF extension capability and generate a secure salt.
* Updated the login API endpoints to map stored PRF salts into the `evalByCredential` array for the WebAuthn challenge.
* Enhanced the client-side WebAuthn SDK (`auth-client.js`) to extract the PRF Base64URL string output, decode it into a `Uint8Array`, and securely derive a 256-bit AES-GCM Key Encryption Key (KEK) via `crypto.subtle.deriveKey` using the `auth-yes:prf:device-share:v1` info string.
* Implemented graceful fallbacks throughout the stack to ensure registration and standard logins proceed if PRF is unsupported.
* Added corresponding unit tests to verify PRF flow and rejection logic.
* Verified visual and functional changes for the optional username input on the login page via Playwright scripts.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Expanded database schema to include `leaf_hash` in `audit_records` and added `audit_sths` table.
- Implemented `server/audit_merkle.ts` for native WebCrypto RFC 6962 tree computations and inclusion proofs.
- Created asynchronous micro-batcher in `server/audit.ts` to compute STH, sign with SPIFFE key, save to DB, and broadcast via Valkey.
- Refactored `auditLog` to compute leaf hashes synchronously before database inserts.
- Added hermetic unit tests with mock fallback patterns for SPIFFE/FFI in `server/audit_merkle.test.ts`.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Add `domain` column to `apps` table.
- Create Valkey caching layers for app resolution by host (`auth:app_by_host:<host>`) and user grants (`auth:grants:<userId>:<appId>`) with PostgreSQL fallback in `server/auth-session.ts`.
- Update `/api/forward-auth` endpoint to resolve `X-Forwarded-Host`, enforce Default-Deny, check RBAC grants, and inject `X-Forwarded-*` scopes.
- Update relevant unit tests to cover missing and invalid scenarios with correct Mock stubs.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Added `argon2` v0.5 dependency to `spire_ffi/Cargo.toml`
- Implemented `argon2id_derive` FFI function in `spire_ffi/src/lib.rs` with C-ABI.
- Added Deno FFI binding `deriveArgon2idKey` in `server/spire_ffi.ts` with `nonblocking: true` to prevent stalling the event loop.
- Pre-allocates output buffer on the Deno side as the standard FFI pattern.
- Included fallback mock behavior when `libspire_ffi.so` is not loaded, returning a 32-byte 0xaa filled array.
- Updated unit tests in `server/spire_ffi.test.ts` to test mock usage and successful generation.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
