Hub stage 0: own users with roles, login limit, audit log, permission table

Users in HUB_DATA/users.json with scrypt hashes and roles (viewer, operator,
apps-admin, admin), managed by hub/users-cli.ts; HUB_USER/HUB_PASSWORD remain a
bootstrap admin while the file does not exist. Five failed logins in 15 minutes lock
the address or the name for 15 minutes. Logins, logouts and every refused request go
to a JSON Lines audit log that admins read through hub/audit/list. Endpoints are
listed in routes.ts with their kind and capability; writes stay refused for now.
Optional <ID>_ADMIN_TOKEN is read for the coming write stages. The management plan
is in docs/hub-management-plan.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

hub/config.ts

@@ -9,12 +9,24 @@ export interface HubServer {
   id: string
   url: string
   token: string
+  /** Optional write-capable token (`<ID>_ADMIN_TOKEN`). Not used yet; never logged. */
+  adminToken?: string
+}
+
+/** The single admin from HUB_USER and HUB_PASSWORD, used only while there is no users file. */
+export interface Bootstrap {
+  user: string
+  password: string
 }
 
 export interface HubConfig {
   servers: HubServer[]
-  user: string
-  password: string
+  /** From HUB_USER and HUB_PASSWORD; null when they are not set. Whether it is used depends on the users file. */
+  bootstrap: Bootstrap | null
+  /** Where users.json and audit.log live (HUB_DATA). */
+  dataDir: string
+  /** Believe the first X-Forwarded-For entry as the client address (HUB_TRUST_PROXY=1). */
+  trustProxy: boolean
   port: number
   cacheSeconds: number
   timeoutMs: number
@@ -31,6 +43,11 @@ export function tokenVariable(id: string): string {
   return `${id.toUpperCase().replace(/[^A-Z0-9]/g, '_')}_TOKEN`
 }
 
+/* `ndns` -> `NDNS_ADMIN_TOKEN`. */
+export function adminTokenVariable(id: string): string {
+  return `${id.toUpperCase().replace(/[^A-Z0-9]/g, '_')}_ADMIN_TOKEN`
+}
+
 function number(env: Env, name: string, fallback: number, min: number): number {
   const raw = env[name]
   if (raw === undefined || raw.trim() === '') return fallback
@@ -40,9 +57,10 @@ function number(env: Env, name: string, fallback: number, min: number): number {
 }
 
 export function parseConfig(env: Env): HubConfig {
+  // The users file decides whether these are needed; the config does not read the file.
   const user = env.HUB_USER ?? ''
   const password = env.HUB_PASSWORD ?? ''
-  if (user === '' || password === '') throw new Error('HUB_USER and HUB_PASSWORD are required.')
+  if ((user === '') !== (password === '')) throw new Error('HUB_USER and HUB_PASSWORD must be set together.')
 
   const servers: HubServer[] = []
   for (const part of (env.HUB_SERVERS ?? '').split(',')) {
@@ -58,7 +76,8 @@ export function parseConfig(env: Env): HubConfig {
     const variable = tokenVariable(id)
     const token = env[variable] ?? ''
     if (token === '') throw new Error(`${variable} is required for the server "${id}".`)
-    servers.push({ id, url, token })
+    const adminToken = env[adminTokenVariable(id)] ?? ''
+    servers.push(adminToken === '' ? { id, url, token } : { id, url, token, adminToken })
   }
   if (servers.length === 0) {
     throw new Error('HUB_SERVERS is required, e.g. dns=https://dns.example.net,ndns=https://ndns.example.net.')
@@ -66,8 +85,9 @@ export function parseConfig(env: Env): HubConfig {
 
   return {
     servers,
-    user,
-    password,
+    bootstrap: user === '' ? null : { user, password },
+    dataDir: env.HUB_DATA?.trim() || '/data',
+    trustProxy: ['1', 'true'].includes((env.HUB_TRUST_PROXY ?? '').trim().toLowerCase()),
     port: number(env, 'HUB_PORT', 8080, 0),
     cacheSeconds: number(env, 'HUB_CACHE_SECONDS', 15, 0),
     timeoutMs: number(env, 'HUB_TIMEOUT_MS', 8000, 1),