[tylinux]

Summary

Servers started with NEX_SERVER_AUTH_TOKEN now show a sign-in page instead of a half-working app when the browser has no valid session. Spec: docs/specs/web-token-login.md.

• Login page (/login): one field, the access token. No/invalid session sends the browser to /login?next=<original page>; after login it returns there. next only accepts same-origin relative paths.
• Sessions: the browser holds a random nex_session cookie (HttpOnly, SameSite=Lax, Secure behind https, 30 days). Session ids are stored as SHA-256 hashes in <configDir>/web-sessions.json (0600, atomic write). Changing the token invalidates all stored sessions. A corrupt file fails closed.
• Compatibility: ?token= still works for programmatic /ws//api clients, and /?token=… still signs in a browser (then the token is removed from the address bar).
• Hardening: constant-time token compare; 5 failed logins per address lock sign-in for 60s (429 + Retry-After).
• Mid-session loss: if the socket closes and the server reports the session is gone (expiry, token rotation), the app returns to /login. Plain disconnects are not treated as logout; checks retry with backoff while the server restarts.

Behaviour change

The old nex_lite_token cookie (which held the raw token) is no longer accepted. Existing browsers see the login page once. Provisioning (install.sh, plist, docker-compose) is unchanged.

Testing

• pnpm typecheck: pass; pnpm lint: 0 errors (80 existing warnings); pnpm architecture:check --changed: 0 new violations
• New unit tests: server 19, web 11 (also added to both CI workflows); ui 79 pass
• Real browser run (headless Chromium against an isolated server on :3131): redirect to login, wrong token error, login, reload, /login while signed in, open-redirect next ignored, deep link preserved, ?token= first visit and address-bar cleanup, logout, restart with same token keeps the user in, token rotation while open returns to login, 6th bad attempt rate-limited
• Not verified: behind an https reverse proxy (Secure cookie covered by a unit test only), mobile browsers, the production :3030 service (not redeployed)