Replace Node UI token bootstrap with dashboard sessions

.github/workflows/ci.yml

@@ -535,6 +535,30 @@ jobs:
         run: tar -xzf /tmp/build-outputs.tgz
       - name: "node-ui tests"
         run: pnpm --filter @origintrail-official/dkg-node-ui test
+      - name: "node-ui static bundle contract"
+        shell: bash
+        run: |
+          pnpm --filter @origintrail-official/dkg-node-ui build:ui
+          test -f packages/node-ui/dist-ui/index.html
+          if grep -R "__DKG_TOKEN__" packages/node-ui/dist-ui; then
+            echo "dist-ui must not contain legacy browser bearer-token bootstrap"
+            exit 1
+          fi
+          node - <<'NODE'
+          const { readFileSync, existsSync } = require('node:fs');
+          const { join, dirname } = require('node:path');
+          const indexPath = join('packages', 'node-ui', 'dist-ui', 'index.html');
+          const html = readFileSync(indexPath, 'utf8');
+          const refs = [...html.matchAll(/(?:src|href)="([^"]+\.(?:js|css))"/g)].map((m) => m[1]);
+          if (refs.length === 0) {
+            throw new Error('dist-ui/index.html did not reference any JS/CSS assets');
+          }
+          for (const ref of refs) {
+            const normalized = ref.startsWith('/ui/') ? ref.slice('/ui/'.length) : ref.replace(/^\.\//, '');
+            const assetPath = join(dirname(indexPath), normalized);
+            if (!existsSync(assetPath)) throw new Error(`Missing referenced UI asset: ${ref}`);
+          }
+          NODE
 
   # node-ui Playwright e2e — REAL NODE, NO MOCKS. The suite boots a live
   # 4-node devnet (Hardhat + four DKG daemons) via Playwright's `webServer`

packages/cli/src/auth.ts

@@ -13,6 +13,53 @@ import { existsSync } from 'node:fs';
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { dkgDir } from './config.js';
 
+export type RequestAuthPrincipal = {
+  kind: 'agent' | 'node-admin';
+  agentAddress: string;
+};
+
+export interface HttpAuthGuardOptions {
+  resolvePrincipal?: (token: string) => RequestAuthPrincipal;
+  authSources?: RequestAuthSource[];
+}
+
+interface RequestAuthBaseContext {
+  principal: RequestAuthPrincipal;
+  csrf: {
+    required: boolean;
+    validated: boolean;
+  };
+}
+
+export type RequestAuthContext =
+  | (RequestAuthBaseContext & {
+      source: 'authorization-header';
+      token: string;
+    })
+  | (RequestAuthBaseContext & {
+      source: 'events-query';
+      token: string;
+    })
+  | (RequestAuthBaseContext & {
+      source: 'dashboard-session';
+      internalCredentialToken: string;
+      dashboardSession: {
+        sessionId?: string;
+        source?: 'loopback' | 'exchange';
+        expiresAt?: number;
+      };
+    });
+
+const REQUEST_AUTH_CONTEXT = Symbol('dkg.requestAuthContext');
+
+export function setRequestAuthContext(req: IncomingMessage, context: RequestAuthContext): void {
+  (req as IncomingMessage & { [REQUEST_AUTH_CONTEXT]?: RequestAuthContext })[REQUEST_AUTH_CONTEXT] = context;
+}
+
+export function getRequestAuthContext(req: IncomingMessage): RequestAuthContext | undefined {
+  return (req as IncomingMessage & { [REQUEST_AUTH_CONTEXT]?: RequestAuthContext })[REQUEST_AUTH_CONTEXT];
+}
+
 // ---------------------------------------------------------------------------
 // Types
 // ---------------------------------------------------------------------------
@@ -275,9 +322,13 @@ function reconcileFileTokens(validTokens: Set<string>): void {
  * Performs an mtime-gated hot-reload of the on-disk `auth.token` file
  * on every call — see `reconcileFileTokens` above for the rationale.
  */
+export function reconcileValidTokens(validTokens: Set<string>): void {
+  reconcileFileTokens(validTokens);
+}
+
 export function verifyToken(token: string | undefined, validTokens: Set<string>): boolean {
   if (!token) return false;
-  reconcileFileTokens(validTokens);
+  reconcileValidTokens(validTokens);
   return validTokens.has(token);
 }
 
@@ -763,6 +814,77 @@ function isPublicPath(method: string, pathname: string): boolean {
   return false;
 }
 
+export type RequestAuthDecision =
+  | { ok: true; context: RequestAuthContext; credentialToken: string }
+  | { ok: false; status: 403; error: string };
+
+export interface RequestAuthSource {
+  resolve: (
+    req: IncomingMessage,
+    validTokens: Set<string>,
+    corsOrigin?: string | null,
+  ) => RequestAuthDecision | null;
+}
+
+function defaultRequestPrincipal(): RequestAuthPrincipal {
+  return { kind: 'node-admin', agentAddress: 'unknown' };
+}
+
+function resolveRequestPrincipal(token: string, options?: HttpAuthGuardOptions): RequestAuthPrincipal {
+  return options?.resolvePrincipal?.(token) ?? defaultRequestPrincipal();
+}
+
+export function resolveRequestAuthDecision(
+  req: IncomingMessage,
+  validTokens: Set<string>,
+  options?: HttpAuthGuardOptions,
+  corsOrigin?: string | null,
+): RequestAuthDecision | null {
+  const url = new URL(req.url ?? '/', `http://${req.headers.host}`);
+  const pathname = url.pathname;
+  const token = extractBearerToken(req.headers.authorization);
+
+  if (token && verifyToken(token, validTokens)) {
+    return {
+      ok: true,
+      credentialToken: token,
+      context: {
+        source: 'authorization-header',
+        token,
+        principal: resolveRequestPrincipal(token, options),
+        csrf: { required: false, validated: false },
+      },
+    };
+  }
+
+  const hasEventsQueryToken = pathname === '/api/events' && url.searchParams.has('token');
+  if (hasEventsQueryToken) {
+    const queryToken = url.searchParams.get('token') ?? undefined;
+    if (queryToken && verifyToken(queryToken, validTokens)) {
+      return {
+        ok: true,
+        credentialToken: queryToken,
+        context: {
+          source: 'events-query',
+          token: queryToken,
+          principal: resolveRequestPrincipal(queryToken, options),
+          csrf: { required: false, validated: false },
+        },
+      };
+    }
+  }
+
+  const explicitAuthAttempt = Boolean(token) || hasEventsQueryToken;
+  if (explicitAuthAttempt) return null;
+
+  for (const source of options?.authSources ?? []) {
+    const decision = source.resolve(req, validTokens, corsOrigin);
+    if (decision) return decision;
+  }
+
+  return null;
+}
+
 /**
  * CLI-10 /.
  *
@@ -827,28 +949,28 @@ export function httpAuthGuard(
   authEnabled: boolean,
   validTokens: Set<string>,
   corsOrigin?: string | null,
+  options?: HttpAuthGuardOptions,
 ): boolean | Promise<boolean> {
   if (!authEnabled) return true;
   if (req.method === 'OPTIONS') return true;
 
   const pathname = new URL(req.url ?? '/', `http://${req.headers.host}`).pathname;
   if (isPublicPath(req.method ?? '', pathname)) return true;
 
-  const token = extractBearerToken(req.headers.authorization);
-  let acceptedToken: string | undefined;
-  if (verifyToken(token, validTokens)) {
-    acceptedToken = token;
-  } else if (pathname === '/api/events') {
-    // EventSource can't set headers — accept token as query param, but ONLY
-    // for the SSE endpoint to avoid leaking credentials in URLs/logs/referrers.
-    const url = new URL(req.url ?? '/', `http://${req.headers.host}`);
-    const qsToken = url.searchParams.get('token');
-    if (qsToken && verifyToken(qsToken, validTokens)) {
-      acceptedToken = qsToken;
-    }
+  const authDecision = resolveRequestAuthDecision(req, validTokens, options, corsOrigin);
+  if (authDecision?.ok === false) {
+    res.writeHead(authDecision.status, {
+      'Content-Type': 'application/json',
+      'Access-Control-Allow-Origin': corsOrigin ?? '*',
+    });
+    res.end(JSON.stringify({ error: authDecision.error }));
+    return false;
   }
 
-  if (acceptedToken) {
+  if (authDecision?.ok === true) {
+    setRequestAuthContext(req, authDecision.context);
+    const acceptedCredentialToken = authDecision.credentialToken;
+
     const now = Date.now();
 
     // CLI-10: stale-timestamp gate. If the client opted into the
@@ -925,7 +1047,7 @@ export function httpAuthGuard(
       // pre-check and the full verifier enforce identical replay
       // semantics.
       pruneNonces(now);
-      const preBodyNonceScope = createHash('sha256').update(acceptedToken).digest('hex');
+      const preBodyNonceScope = createHash('sha256').update(acceptedCredentialToken).digest('hex');
       const preBodyNonceKey = `${preBodyNonceScope}:${nonceHeader}`;
       if (seenNonces.has(preBodyNonceKey)) {
         res.writeHead(401, {
@@ -941,7 +1063,7 @@ export function httpAuthGuard(
       // buffering the body. The actual HMAC check happens there
       // (or synchronously below for body-less requests).
       (req as unknown as { __dkgSignedAuth?: SignedAuthPending }).__dkgSignedAuth = {
-        token: acceptedToken,
+        token: acceptedCredentialToken,
         timestamp: tsHeader,
         nonce: nonceHeader,
         signature: sigHeader,