fix(uds-auth): emergency login workspaces, Desktop key prompts, persistent sessions

Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw "sign-in failed / add API key" on DSH Desktop because the remote.mux opens anonymously at boot and every early call was rejected terminally. - gateway: anonymous workspace/follow reaches dsh-acl's empty baseline; anonymous streams are parked until the carrier aborts instead of failing; anonymous workspace/initializeDefault answers "nothing created" - request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket or bridge (sync + async variants used by all callers) - dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup instead of 403, so the Desktop welcome read no longer fails - desktop-bootstrap: key/account projection is best-effort per reference - client: emit connection/reset after login so boot-time caches (settings describe mirror -> Settings > Models) re-read under the real principal - sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min); bridge expiry slides with its session; MemoryStore persisted to sessions.json (bearer hash only, userData AES-256-GCM sealed) - README: session lifetime/persistence and DSH compatibility notes Also includes previously uncommitted uds-auth 0.3.x work in this tree. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-13 07:13:20 +08:00 · 2026-10-12 02:11:09 +08:00 · 2026-10-12 02:11:09 +08:00 · df97c5e042
commit df97c5e042
parent fa4d5d6d97
72 changed files with 8436 additions and 1192 deletions
--- a/uds-auth/docs/sbom.cdx.json
+++ b/uds-auth/docs/sbom.cdx.json
@ -0,0 +1,109 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5",
+  "version": 1,
+  "metadata": {
+    "component": {
+      "type": "application",
+      "name": "uds-auth",
+      "version": "0.3.11",
+      "bom-ref": "pkg:npm/uds-auth@0.3.11",
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ]
+    },
+    "properties": [
+      {
+        "name": "uds-auth:bundle-sha256",
+        "value": "1ca76135efb5f93975793da04024409ef215d8b595d5b5194707e3acc693a15f"
+      },
+      {
+        "name": "uds-auth:external-peer",
+        "value": "React supplied by DSH; audit its exact version in the Host SBOM"
+      },
+      {
+        "name": "uds-auth:scope",
+        "value": "Actual vendored runtime bundle; development dependency audit is a separate npm audit --include=dev gate"
+      }
+    ]
+  },
+  "components": [
+    {
+      "type": "library",
+      "name": "dijkstrajs",
+      "version": "1.0.3",
+      "purl": "pkg:npm/dijkstrajs@1.0.3",
+      "bom-ref": "pkg:npm/dijkstrajs@1.0.3",
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "properties": [
+        {
+          "name": "uds-auth:delivery",
+          "value": "bundled in lib/qrcode-bundled.cjs"
+        },
+        {
+          "name": "npm:integrity",
+          "value": "sha512-qiSlmBq9+BCdCA/L46dw8Uy93mloxsPSbwnm5yrKn2vMPiy8KyAskTF6zuV/j5BMsmOGZDPs7KjU+mjb670kfA=="
+        },
+        {
+          "name": "uds-auth:source-files",
+          "value": "[{\"file\":\"dijkstrajs/dijkstra.js\",\"sha256\":\"7f5721e77332370a71314f1536b8c552f4f9dbd99bbc6c5aa10df3253eacfd5c\"}]"
+        }
+      ]
+    },
+    {
+      "type": "library",
+      "name": "qrcode",
+      "version": "1.5.4",
+      "purl": "pkg:npm/qrcode@1.5.4",
+      "bom-ref": "pkg:npm/qrcode@1.5.4",
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "properties": [
+        {
+          "name": "uds-auth:delivery",
+          "value": "bundled in lib/qrcode-bundled.cjs"
+        },
+        {
+          "name": "npm:integrity",
+          "value": "sha512-1ca71Zgiu6ORjHqFBDpnSMTR2ReToX4l1Au1VFLyVeBTFavzQnv5JxMFr3ukHVKpSrSA2MCk0lNJSykjUfz7Zg=="
+        },
+        {
+          "name": "uds-auth:source-files",
+          "value": "[{\"file\":\"qrcode/lib/can-promise.js\",\"sha256\":\"fd18906803bd4cfe4f23801a7032c5a1e10be31274ba25dc34541932cdd8f253\"},{\"file\":\"qrcode/lib/core/utils.js\",\"sha256\":\"1b66145cb9afddadf46ea7314b168e0b8369b2ab4938256fe64bd1c465a473bd\"},{\"file\":\"qrcode/lib/core/error-correction-level.js\",\"sha256\":\"7f31b2250223cb7549bf3c305cce948ad9b0ee67cb9ee93b6c08352b7fa2b7f6\"},{\"file\":\"qrcode/lib/core/bit-buffer.js\",\"sha256\":\"c6f982814aa373da6e44183a61f75762c8559909087fff76603885b180bac0ad\"},{\"file\":\"qrcode/lib/core/bit-matrix.js\",\"sha256\":\"77e051929fbc9d3b3ba91bd9b190f9a1ab3ccea162d627696ad2c01bf41e51bd\"},{\"file\":\"qrcode/lib/core/alignment-pattern.js\",\"sha256\":\"7e642a801c5c3d114bcceeeb08a3930369ec16fe874bdb617f02efb43aaea9ba\"},{\"file\":\"qrcode/lib/core/finder-pattern.js\",\"sha256\":\"e5808e9b8ed06fd7c3ed201a03f7e7341a5c80f6a8b4cc78c9a94c3ee0ddd6e2\"},{\"file\":\"qrcode/lib/core/mask-pattern.js\",\"sha256\":\"c8cfdab7b8d8276f9c1128ab8e5d930759df7594f03211f72b80c3002af91aa9\"},{\"file\":\"qrcode/lib/core/error-correction-code.js\",\"sha256\":\"03683cae6cc410b83f8ad0e87fa394df5102b52ca4ce843e507aa9f6acce13e5\"},{\"file\":\"qrcode/lib/core/galois-field.js\",\"sha256\":\"d487207ce5040b49f95441bedafb6dbc9c010b245a0f0f47b9e3f10f8d9530a6\"},{\"file\":\"qrcode/lib/core/polynomial.js\",\"sha256\":\"34cb4e4216fc51fe75ac1c4bb00c4f4fc118a51da50c8250aec951062ff3a3c4\"},{\"file\":\"qrcode/lib/core/reed-solomon-encoder.js\",\"sha256\":\"080273fcf5a73c2348330f3edb55f3968c78853e298dc55a074becd7cee3faa2\"},{\"file\":\"qrcode/lib/core/version-check.js\",\"sha256\":\"9cffe3a6f9cbb978022c0d0b1652fb2f3d381b9e48b7e01dfc744ded28736da2\"},{\"file\":\"qrcode/lib/core/regex.js\",\"sha256\":\"974d9358148d11c8e48713ef2da8fc12e597b76f4e6fc6bde00cfe7c8094efa1\"},{\"file\":\"qrcode/lib/core/mode.js\",\"sha256\":\"25d3574cf4b0cdbd62363ff2c57eb46da41d21124e6d37eb0e84f979799bd530\"},{\"file\":\"qrcode/lib/core/version.js\",\"sha256\":\"1221665a29e6927d3823912bde8bd711c114c61188d7ce862997a33d47fcfba9\"},{\"file\":\"qrcode/lib/core/format-info.js\",\"sha256\":\"889b133cd6a86f4079a3a5d1dfd94c495ca71d4fde4ec88ce9e9a5de358629d0\"},{\"file\":\"qrcode/lib/core/numeric-data.js\",\"sha256\":\"3e506376e4c84b88162024c1d840b5bc3721da3b0d02f18784161adea5e3b2e8\"},{\"file\":\"qrcode/lib/core/alphanumeric-data.js\",\"sha256\":\"cf8f81197e02c0db069155a2e82c098d26329019cfd06cc0e4479124636fa1ea\"},{\"file\":\"qrcode/lib/core/byte-data.js\",\"sha256\":\"24614cb942165dcc5378117a951cc1d68fbfc2e60043830111ae99283cd9aa94\"},{\"file\":\"qrcode/lib/core/kanji-data.js\",\"sha256\":\"2dcd7d5aee492392e0c47976ae718e9783c5b13234487804ed21558fbd4a62de\"},{\"file\":\"qrcode/lib/core/segments.js\",\"sha256\":\"abd08a6ddd778c92e36e2a303d2b4a3b4ad1d9089d2a7605bee8b9d06da7846a\"},{\"file\":\"qrcode/lib/core/qrcode.js\",\"sha256\":\"216e490908ed95df74992a05d44efa35ea7bc8dcab27b49b446725964704e833\"},{\"file\":\"qrcode/lib/renderer/utils.js\",\"sha256\":\"03ffb1b5f7e629bef61a83835107b391efc0b7a71ab9329a950708b20f361b87\"},{\"file\":\"qrcode/lib/renderer/canvas.js\",\"sha256\":\"0ce857661e234786295c9b4042cad6dc1f4d7a496c4990f52870d2bc4ab1e6a9\"},{\"file\":\"qrcode/lib/renderer/svg-tag.js\",\"sha256\":\"2f733e88d0b0155fae4aa4827de0fb9ae73cbbfdfc0cae52dc9d5ed17ae0447d\"},{\"file\":\"qrcode/lib/browser.js\",\"sha256\":\"868da79917b05db1f3d4402f4875148fb06ce843cbd74c65429cd6ef960b1638\"}]"
+        }
+      ]
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "pkg:npm/uds-auth@0.3.11",
+      "dependsOn": [
+        "pkg:npm/dijkstrajs@1.0.3",
+        "pkg:npm/qrcode@1.5.4"
+      ]
+    },
+    {
+      "ref": "pkg:npm/dijkstrajs@1.0.3",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:npm/qrcode@1.5.4",
+      "dependsOn": []
+    }
+  ]
+}