Add SSH-provisioned TOTP login with JWT sessions

scripts/deploy.sh

@@ -17,7 +17,7 @@ test "$(git -c safe.directory="$PWD" rev-parse HEAD)" = "$RELEASE_SHA"
 LATEST_MAIN=$(git -c safe.directory="$PWD" ls-remote origin refs/heads/main | cut -f1)
 if [ "$LATEST_MAIN" != "$RELEASE_SHA" ]; then
   git -c safe.directory="$PWD" fetch origin main
-  if ! git -c safe.directory="$PWD" diff --quiet "$RELEASE_SHA" origin/main -- apps/wiki Dockerfile compose.yml scripts/deploy.sh scripts/infra.sh scripts/integration.sh .gitea/workflows/wiki.yml pnpm-workspace.yaml; then
+  if ! git -c safe.directory="$PWD" diff --quiet "$RELEASE_SHA" origin/main -- apps/wiki Dockerfile compose.yml scripts/deploy.sh scripts/infra.sh scripts/integration.sh scripts/auth-admin.sh .gitea/workflows/wiki.yml pnpm-workspace.yaml; then
     echo 'Skipping deployment: Wiki has a newer commit'; exit 0
   fi
 fi
@@ -26,8 +26,8 @@ if [ -L "$APP_ROOT/current" ] && [ -d "$APP_ROOT/current" ]; then PREVIOUS=$(rea
 bash scripts/infra.sh "$IMAGE"
 mkdir -p "$RELEASE_DIR"
 install -m 0644 compose.yml "$RELEASE_DIR/compose.yml"
-printf 'PROMPT_IMAGE=%s\nRELEASE_SHA=%s\nWEB_PORT=%s\n' "$IMAGE" "$RELEASE_SHA" "$PORT" > "$RELEASE_DIR/release.env"
-compose_at(){ local release="$1"; shift; env -u PROMPT_IMAGE -u PROMPT_TEST_IMAGE -u RELEASE_SHA -u WEB_PORT -u WEB_BIND_ADDRESS docker compose -p prompt --env-file /etc/prompt.env --env-file "$release/release.env" -f "$release/compose.yml" "$@"; }
+printf 'PROMPT_IMAGE=%s\nRELEASE_SHA=%s\nWEB_PORT=%s\nAUTH_CONFIG_FILE=/auth/config.json\n' "$IMAGE" "$RELEASE_SHA" "$PORT" > "$RELEASE_DIR/release.env"
+compose_at(){ local release="$1"; shift; env -u AUTH_CONFIG_FILE -u AUTH_COOKIE_SECURE -u PROMPT_IMAGE -u PROMPT_TEST_IMAGE -u RELEASE_SHA -u WEB_PORT -u WEB_BIND_ADDRESS docker compose -p prompt --env-file /etc/prompt.env --env-file "$release/release.env" -f "$release/compose.yml" "$@"; }
 compose(){ compose_at "$RELEASE_DIR" "$@"; }
 LEGACY_WEB=0
 LEGACY_WORKER=0
@@ -85,6 +85,7 @@ BACKUP_FILE="/var/lib/prompt/backups/$(date -u +%Y%m%dT%H%M%S)-$RELEASE_SHA.dump
 compose exec -T postgres pg_dump -U prompt -d prompt -Fc > "$BACKUP_FILE"
 find /var/lib/prompt/backups -name '*.dump' -printf '%T@ %p\n' | sort -rn | tail -n +11 | cut -d' ' -f2- | xargs -r rm --
 MIGRATION_STARTED=1
+compose run --rm --no-deps auth-admin
 compose run --rm --no-deps migrate
 compose run --rm --no-deps publish
 CUTOVER=1
@@ -93,11 +94,11 @@ if [ "$LEGACY_WORKER" -eq 1 ] || [ "$LEGACY_WORKER_ENABLED" -eq 1 ]; then system
 if [ "$LEGACY_WEB" -eq 1 ] || [ "$LEGACY_WEB_ENABLED" -eq 1 ]; then systemctl disable --now prompt.service; fi
 compose up -d --no-build --wait --wait-timeout 180 web worker
 compose exec -T web node container-health.mjs
-compose exec -T web node -e "fetch('http://127.0.0.1:3000/').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"
-compose exec -T web node scripts/import-character-packs.mjs
+compose exec -T web node auth-cli.cjs verify
+compose exec -T web node auth-cli.cjs run scripts/import-character-packs.mjs
 compose exec -T worker sh -c 'test "$(id -u)" -ne 0 && ffmpeg -version >/dev/null'
 # Editorial posts may be older than the first 24 entries. Verify the complete paged feed.
-compose exec -T web node - <<'NODE'
+compose exec -T web sh -c 'cat > /tmp/prompt-release-check.mjs && node auth-cli.cjs run /tmp/prompt-release-check.mjs' <<'NODE'
 (async()=>{
  const slugs=['learning-skills-notes','learning-skills-teaching','learning-skills-english'];
  const missing=new Set(slugs),seen=new Set();let cursor='';
@@ -118,6 +119,7 @@ NODE
 
 ln -sfn "$RELEASE_DIR" "$APP_ROOT/.current.next"
 mv -Tf "$APP_ROOT/.current.next" "$APP_ROOT/current"
+install -m 0755 scripts/auth-admin.sh "$APP_ROOT/auth"
 compose ps
 for service in web worker postgres objects; do
   id=$(compose ps -q "$service")