feat(ui): implement App Launchpad and secure logout redirect
This PR implements the requested App Launchpad feature and secures the logout process against open-redirect attacks.
Key changes:
1. **Logout Return-Path Validation**: Added `isSafeRedirectUrl` and updated the `GET /logout` handler. Unsafe redirects are logged as `open_redirect_intercepted`, while successful logouts generate `logout_success` events on the Merkle ledger. All host and parent wildcard cookies (`getCookieDomain()`) are cleared to prevent state collisions.
2. **SSO Application Launchpad**: Introduced `ui/components/AppLaunchpadPage.tsx` using pure Hono SSR JSX. Updates `GET /dashboard` to render this page as the main authenticated landing view. Query logic uses strict Zero-Knowledge filtering—regular users only see explicitly granted apps, and Global Admins see all apps tagged with an `[Admin]` badge.
3. **Hybrid Ingress Playbook**: Authored `docs/HYBRID_INGRESS_PLAYBOOK.md` detailing the architectural split between Traefik ForwardAuth and client application SSR routing.
4. **Testing & QA**: Written comprehensive hermetic unit tests in `server/main.test.ts` for the redirect interceptor, standard logout logic, and Zero-Knowledge role queries. All tests pass with full quality gate compliance (`deno fmt`, `deno task lint`, `deno task check`).
- Add isSafeRedirectUrl utility to prevent open-redirect vulnerabilities.
- Update GET /logout to handle ?redirect=, clear cookies safely, and log audit events.
- Create AppLaunchpadPage.tsx using pure Hono SSR JSX for application visibility and SSO launching.
- Update GET /dashboard and AuthenticatedLayout.tsx to mount the Launchpad as the default authenticated view with Zero-Knowledge querying.
- Add HYBRID_INGRESS_PLAYBOOK.md documentation for Traefik ForwardAuth routing.
- Implement exhaustive unit tests in server/main.test.ts for redirect preservation, anomaly logging, and Zero-Knowledge role filtering.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Scaffolds a new Rust crate `wasm/sss_recovery` for constant-time Shamir's Secret Sharing over GF(256) with strict Wasm `zeroize`
- Implements purely typed BIP-39 fallback mapped via Deno WebCrypto in `ui/utils/bip39.ts`
- Migrates `server/recovery.ts` logic mapping Device/Voucher + Server shares with Valkey rate-limiting
- Applies mandatory in-memory JS zeroization on all reconstructed buffers
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
* Added `prf_enabled` and `prf_salt` columns to the `passkeys` table.
* Updated registration API endpoints to request and store the PRF extension capability and generate a secure salt.
* Updated the login API endpoints to map stored PRF salts into the `evalByCredential` array for the WebAuthn challenge.
* Enhanced the client-side WebAuthn SDK (`auth-client.js`) to extract the PRF Base64URL string output, decode it into a `Uint8Array`, and securely derive a 256-bit AES-GCM Key Encryption Key (KEK) via `crypto.subtle.deriveKey` using the `auth-yes:prf:device-share:v1` info string.
* Implemented graceful fallbacks throughout the stack to ensure registration and standard logins proceed if PRF is unsupported.
* Added corresponding unit tests to verify PRF flow and rejection logic.
* Verified visual and functional changes for the optional username input on the login page via Playwright scripts.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Expanded database schema to include `leaf_hash` in `audit_records` and added `audit_sths` table.
- Implemented `server/audit_merkle.ts` for native WebCrypto RFC 6962 tree computations and inclusion proofs.
- Created asynchronous micro-batcher in `server/audit.ts` to compute STH, sign with SPIFFE key, save to DB, and broadcast via Valkey.
- Refactored `auditLog` to compute leaf hashes synchronously before database inserts.
- Added hermetic unit tests with mock fallback patterns for SPIFFE/FFI in `server/audit_merkle.test.ts`.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Added a new task markdown file `2026-0824.01.jul.feat.webauthn.prf-extension-1200.md` detailing the plan for integrating the WebAuthn PRF extension. It outlines the schema updates, client and server flow implementations, and progressive fallback logic as per Kanban guidelines.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Adds a detailed markdown task file in `tasks/new/` following the Kanban guidelines to outline the architectural implementation plan for RFC 9421 HTTP Message Signatures verification at edge nodes using native Deno WebCrypto.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Created the task file for formalizing the Ghost Cockpit Protocol and its corresponding WebSocket guard helper in the SDK, adhering strictly to the required guidelines.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Add `domain` column to `apps` table.
- Create Valkey caching layers for app resolution by host (`auth:app_by_host:<host>`) and user grants (`auth:grants:<userId>:<appId>`) with PostgreSQL fallback in `server/auth-session.ts`.
- Update `/api/forward-auth` endpoint to resolve `X-Forwarded-Host`, enforce Default-Deny, check RBAC grants, and inject `X-Forwarded-*` scopes.
- Update relevant unit tests to cover missing and invalid scenarios with correct Mock stubs.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
