feat(auth): persistent login system + C7 session introspection
Implements the complete persistent login stack for the hosted gateway and self-hosted hub, plus the C7 session introspection contract for Scooling.
## Persistent login (refresh token rotation) - hub/lib/refresh-token-core.mjs: storage-agnostic refresh token core — issue, rotate (with reuse/family-revocation detection), revoke, prune. - hub/gateway/refresh-token-store.mjs: Netlify Blob-backed store (eventual consistency; strong is unavailable in Lambda-compat mode — using strong caused BlobsConsistencyError that silently blocked every cookie write). - hub/refresh-tokens.mjs: file-backed store for self-hosted. - hub/auth-session.mjs: HttpOnly cookie policy + Express handler factories for POST /api/v1/auth/refresh and POST /api/v1/auth/logout. - hub/gateway/server.mjs + hub/server.mjs: wired into both runtimes. - netlify/functions/gateway.mjs: provisions gateway-auth blob per-invocation (eventual consistency) and tears it down in finally. - web/hub/config.js: API base URL → api.knowtation.store for first-party cookie behavior (same registrable domain as www.knowtation.store). - web/hub/hub.js: client-side silent refresh on 401, server-side logout.
## C7 session introspection - GET /api/v1/auth/session: Bearer JWT → {sub, provider, id, name, role, iat, exp, scopes[]}. No DB call. Cross-origin safe (Bearer, no cookie). - scopesForRole: role-derived today; C4 explicit grants replaces derivation without changing the response shape — Scooling's contract is stable. - X-Powered-By: Express disabled globally (information leak fix). - docs/openapi.yaml + hub/gateway/README.md: full C7 + refresh + logout docs.
## Security / dependency hardening - npm audit fix in hub/bridge and hub/gateway (patched high CVE in tmp). - test/hub-note-outline-self-hosted-route.test.mjs: scope fix for brittle test.
## Tests (all 7 tiers, 100% pass) - test/refresh-token-core.test.mjs: 50 tests for the storage-agnostic core. - test/gateway-refresh-token-store.test.mjs: blob + file backend tests. - test/auth-refresh-wiring.test.mjs + test/auth-session.test.mjs: self-hosted. - test/gateway-auth-refresh-wiring.test.mjs: hosted gateway wiring. - test/gateway-session-introspection.test.mjs: 32 tests across all 7 tiers for C7 (unit → structural, integration → HTTP, e2e, stress × 50 concurrent, data-integrity, performance p99 < 100ms, security: wrong secret / tampered payload / alg:none / empty sub / query-bypass / no stack-trace leak).
Files Changed
+707
707 in snapshot
0 comments
muse hub commit comment sha256:8d46372e39d2d5a54fd93a8b1c27922fe0d9b22a72197345f1d2c71701cc4ce2 --body "your comment"
No comments yet. Be the first to start the discussion.