From cf2962fd67375bfa67a08db9dd34173d1b2dd935 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Padez?= <andre.padez@gmail.com>
Date: Thu, 23 Jul 2026 00:06:42 +0000
Subject: [PATCH] auth: distress-password lockdown + explicit token-revoke
 endpoint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a duress password (DISTRESS_PASSWORD env): entering it at login trips an
in-memory full lockdown — all new logins (password + passkey) and every existing
session are refused until the server is restarted, and the login itself returns a
normal "invalid credentials" so it gives nothing away. Also add
POST /api/auth/blacklist-token as a clearly-named alias for revoking the current
JWT (same effect as signout).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/servers/_middlewares/user-middleware.ts |  4 ++++
 src/servers/api/auth/auth.ts                |  2 ++
 src/servers/api/auth/distress.ts            | 10 ++++++++++
 src/servers/api/auth/passkey-router.ts      |  2 ++
 src/servers/api/auth/signin.ts              | 11 +++++++++++
 5 files changed, 29 insertions(+)
 create mode 100644 src/servers/api/auth/distress.ts

diff --git a/src/servers/_middlewares/user-middleware.ts b/src/servers/_middlewares/user-middleware.ts
index fb05acc0..ff2bc0c9 100644
--- a/src/servers/_middlewares/user-middleware.ts
+++ b/src/servers/_middlewares/user-middleware.ts
@@ -2,6 +2,7 @@ import type { MiddlewareHandler } from 'hono';
 import { verify } from '@@/jwt';
 import * as errors from '@@/custom-errors';
 import { isOriginAllowed } from './origin-validation';
+import { isLockdown } from '../api/auth/distress';
 import { getUserById, isTokenBlacklisted } from 'officerdb';
 
 // Role permissions: which HTTP methods each role can use
@@ -21,6 +22,9 @@ function isMethodAllowed(role: string | null, method: string): boolean {
 }
 
 export const userMiddleware: MiddlewareHandler = async function (ctx, next) {
+  // Duress lockdown: reject every authenticated request, cutting off all existing sessions.
+  if (isLockdown()) throw errors.UNAUTHORIZED();
+
   const { authorization } = ctx.req.header();
 
   // Support token in query param for media elements (<audio>, <video>, <img>)
diff --git a/src/servers/api/auth/auth.ts b/src/servers/api/auth/auth.ts
index 1a0d3300..a70cefd3 100644
--- a/src/servers/api/auth/auth.ts
+++ b/src/servers/api/auth/auth.ts
@@ -32,6 +32,8 @@ authRouter.use('/', async (ctx) => ctx.json({ officerAuthServer: 'ok' }));
 authRouter.get('/me', userMiddleware, usersMe);
 authRouter.post('/signin', signinRateLimiter, signinHandler);
 authRouter.post('/signout', userMiddleware, signoutHandler);
+// Explicit "revoke the current token" alias (same effect as signout: blacklists this JWT).
+authRouter.post('/blacklist-token', userMiddleware, signoutHandler);
 authRouter.post('/signup', signupRateLimiter, signupHandler);
 authRouter.post('/bootstrap', signupRateLimiter, bootstrapHandler);
 authRouter.post('/verify', verifyHandler);
diff --git a/src/servers/api/auth/distress.ts b/src/servers/api/auth/distress.ts
new file mode 100644
index 00000000..562223a8
--- /dev/null
+++ b/src/servers/api/auth/distress.ts
@@ -0,0 +1,10 @@
+// Duress lockdown. The distress password (entered at login) trips this in-memory flag; while it is
+// set, ALL new logins and ALL existing sessions are refused. It is intentionally in-memory only, so
+// the only way to clear it is a manual server restart.
+let locked = false;
+
+export const isLockdown = (): boolean => locked;
+
+export const triggerLockdown = (): void => {
+  locked = true;
+};
diff --git a/src/servers/api/auth/passkey-router.ts b/src/servers/api/auth/passkey-router.ts
index 44d161bf..d5bfd719 100644
--- a/src/servers/api/auth/passkey-router.ts
+++ b/src/servers/api/auth/passkey-router.ts
@@ -4,6 +4,7 @@ import { createRouter } from '../../create-router';
 import { userMiddleware, passkeyRateLimiter } from '../../_middlewares';
 import { sign } from '../../jwt';
 import * as errors from '../../custom-errors';
+import { isLockdown } from './distress';
 import {
   getUserByEmail,
   getPasskeysByUserIdAndOrigin,
@@ -128,6 +129,7 @@ passkeyRouter.get('/signin/:email', passkeyRateLimiter, passkeyRouterGet);
 
 // Verify passkey authentication and issue token
 const passkeyRouterPostVerify: Handler = async (ctx) => {
+  if (isLockdown()) throw errors.UNAUTHORIZED(); // duress lockdown blocks passkey logins too
   const { email } = ctx.req.param();
   const origin = ctx.get('origin') as string;
   const rpId = getRpId(origin);
diff --git a/src/servers/api/auth/signin.ts b/src/servers/api/auth/signin.ts
index 639affb3..9d93a964 100755
--- a/src/servers/api/auth/signin.ts
+++ b/src/servers/api/auth/signin.ts
@@ -6,11 +6,22 @@ import { sign } from '@@/jwt';
 import { getClaudeDir } from '@@/data-path';
 import argon2 from 'argon2';
 import * as errors from '@@/custom-errors';
+import { isLockdown, triggerLockdown } from './distress';
 
 const TEST_USERS: number[] = [];
+const { DISTRESS_PASSWORD } = process.env;
 
 export const signinHandler: Handler = async function (ctx) {
   const { email, password } = ctx.get('body');
+
+  // Duress: if lockdown is active, refuse everyone (looks like a normal failed login). If the distress
+  // password was entered, trip the lockdown now and then fail the same way, giving nothing away.
+  if (isLockdown()) throw errors.UNAUTHORIZED();
+  if (DISTRESS_PASSWORD && typeof password === 'string' && password === DISTRESS_PASSWORD) {
+    triggerLockdown();
+    throw errors.UNAUTHORIZED();
+  }
+
   const origin = ctx.get('origin');
   const dbUser = await getUserByEmail(email);
   if (!dbUser) throw errors.UNAUTHORIZED();