https://stoptheslanderfromposting.lovable.app/assets/portal.security-DG0IWqP6.js

1import{u as x,r as f,j as e}from"./index-Dw04bfMU.js";import{F as _,P as O,L as P}from"./portal-shell-De40gV7l.js";import{u as I}from"./use-auth-ready-7k9jzdM2.js";import{l as T,a as D,r as C,p as L,b as K}from"./session-sentinel.functions-BlAldlpa.js";import{W as d,i as U,b as G,t as M,a as k,c as H,d as w,e as B,j as V,k as q,m as F,r as $}from"./passkey.functions-RzTsGBvG.js";import{computeFingerprint as W}from"./silicon-lag-fingerprint-BQTAOsmm.js";import{T as E}from"./trash-2-DcRRN1Y4.js";import{S as Y}from"./shield-check-BlLeWGjS.js";import{Z as J}from"./zap-BlvafvfD.js";import{S as z}from"./shield-alert-DTMiXs7l.js";import{E as Z}from"./external-link-BqZRxg2n.js";import"./use-idle-timeout-DmyRAEso.js";import"./key-round-DUfWcil5.js";import"./bot-BmxjwvwU.js";import"./search-BHpCVSuv.js";import"./trending-up-C3vQsirm.js";import"./activity-CbJ1y1-y.js";import"./file-text-DGbBydz5.js";function Q({error:t,options:a}){const{publicKey:i}=a;if(!i)throw Error("options was missing required publicKey property");if(t.name==="AbortError"){if(a.signal instanceof AbortSignal)return new d({message:"Registration ceremony was sent an abort signal",code:"ERROR_CEREMONY_ABORTED",cause:t})}else if(t.name==="ConstraintError"){if(i.authenticatorSelection?.requireResidentKey===!0)return new d({message:"Discoverable credentials were required but no available authenticator supported it",code:"ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT",cause:t});if(a.mediation==="conditional"&&i.authenticatorSelection?.userVerification==="required")return new d({message:"User verification was required during automatic registration but it could not be performed",code:"ERROR_AUTO_REGISTER_USER_VERIFICATION_FAILURE",cause:t});if(i.authenticatorSelection?.userVerification==="required")return new d({message:"User verification was required but no available authenticator supported it",code:"ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT",cause:t})}else{if(t.name==="InvalidStateError")return new d({message:"The authenticator was previously registered",code:"ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED",cause:t});if(t.name==="NotAllowedError")return new d({message:t.message,code:"ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",cause:t});if(t.name==="NotSupportedError")return i.pubKeyCredParams.filter(c=>c.type==="public-key").length===0?new d({message:'No entry in pubKeyCredParams was of type "public-key"',code:"ERROR_MALFORMED_PUBKEYCREDPARAMS",cause:t}):new d({message:"No available authenticator supported any of the specified pubKeyCredParams algorithms",code:"ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEYCREDPARAMS_ALG",cause:t});if(t.name==="SecurityError"){const u=globalThis.location.hostname;if(U(u)){if(i.rp.id!==u)return new d({message:`The RP ID "${i.rp.id}" is invalid for this domain`,code:"ERROR_INVALID_RP_ID",cause:t})}else return new d({message:`${globalThis.location.hostname} is an invalid domain`,code:"ERROR_INVALID_DOMAIN",cause:t})}else if(t.name==="TypeError"){if(i.user.id.byteLength<1||i.user.id.byteLength>64)return new d({message:"User ID was not between 1 and 64 characters",code:"ERROR_INVALID_USER_ID_LENGTH",cause:t})}else if(t.name==="UnknownError")return new d({message:"The authenticator was unable to process the specified options, or could not create a new credential",code:"ERROR_AUTHENTICATOR_GENERAL_ERROR",cause:t})}return t}async function X(t){!t.optionsJSON&&t.challenge&&(console.warn("startRegistration() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information."),t={optionsJSON:t});const{optionsJSON:a,useAutoRegister:i=!1}=t;if(!G())throw new Error("WebAuthn is not supported in this browser");const u={...a,challenge:k(a.challenge),user:{...a.user,id:k(a.user.id)},excludeCredentials:a.excludeCredentials?.map(M)},c={};i&&(c.mediation="conditional"),c.publicKey=u,c.signal=H.createNewAbortSignal();let m;try{m=await navigator.credentials.create(c)}catch(n){throw Q({error:n,options:c})}if(!m)throw new Error("Registration was not completed");const{id:p,rawId:b,response:o,type:v}=m;let g;typeof o.getTransports=="function"&&(g=o.getTransports());let l;if(typeof o.getPublicKeyAlgorithm=="function")try{l=o.getPublicKeyAlgorithm()}catch(n){N("getPublicKeyAlgorithm()",n)}let h;

1if(typeof o.getPublicKey=="function")try{const n=o.getPublicKey();n!==null&&(h=w(n))}catch(n){N("getPublicKey()",n)}let y;if(typeof o.getAuthenticatorData=="function")try{y=w(o.getAuthenticatorData())}catch(n){N("getAuthenticatorData()",n)}return{id:p,rawId:w(b),response:{attestationObject:w(o.attestationObject),clientDataJSON:w(o.clientDataJSON),transports:g,publicKeyAlgorithm:l,publicKey:h,authenticatorData:y},type:v,clientExtensionResults:m.getClientExtensionResults(),authenticatorAttachment:B(m.authenticatorAttachment)}}function N(t,a){console.warn(`The browser extension that intercepted this WebAuthn API call incorrectly implemented ${t}. You should report this error to them.
2`,a)}function ee(){const t=x(V),a=x(q),i=x(F),u=x($),[c,m]=f.useState([]),[p,b]=f.useState(""),[o,v]=f.useState(!1),[g,l]=f.useState(null),h=async()=>{const r=await t();m(r.passkeys??[])};f.useEffect(()=>{h()},[]);const n=c.filter(r=>!r.revoked_at).length,s=async()=>{if(!p.trim()){l("Give this device a label (e.g. iPhone 15, MacBook Pro).");return}v(!0),l(null);try{const{options:r}=await a({data:{label:p.trim()}}),j=await X({optionsJSON:r}),A=await W(),S=await i({data:{response:j,label:p.trim(),deviceHash:A.deviceHash}});l(`Enrolled as ${S.role}. ${n+1} device(s) total.`),b(""),await h()}catch(r){l(r?.message??"Enrollment failed")}finally{v(!1)}},R=async r=>{confirm("Revoke this passkey? You will need to re-enroll this device.")&&(await u({data:{id:r}}),await h())};return e.jsxs("div",{className:"rounded-xl border border-gold/30 p-5",style:{background:"var(--card)"},children:[e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx(_,{className:"h-5 w-5 text-gold"}),e.jsx("h2",{className:"text-sm font-black uppercase tracking-widest text-gold",children:"Silicon Lag Passkey — Dual Device"})]}),e.jsxs("p",{className:"mt-2 text-xs text-muted-foreground",children:["Biometric, phishing-proof login. Enroll at least"," ",e.jsx("span",{className:"font-bold text-foreground",children:"two devices"})," (e.g. laptop + phone). Sign-in on any device requires the second device to approve. Cookie theft cannot bypass this — the private keys never leave your hardware."]}),e.jsxs("div",{className:"mt-4 rounded-lg border border-gold/20 bg-background/40 p-3",children:[e.jsxs("div",{className:"flex flex-col gap-2 sm:flex-row",children:[e.jsx("input",{value:p,onChange:r=>b(r.target.value),placeholder:"This device's label",className:"flex-1 rounded-md border border-gold/30 bg-transparent px-3 py-2 text-sm text-foreground placeholder:text-muted-foreground focus:outline-none focus:ring-1 focus:ring-gold"}),e.jsx("button",{onClick:s,disabled:o,className:"rounded-md border border-gold/40 bg-gold/10 px-4 py-2 text-xs font-bold uppercase tracking-widest text-gold hover:bg-gold/20 disabled:opacity-50",children:o?"Working…":"Enroll this device"})]}),g&&e.jsx("div",{className:"mt-2 text-xs text-foreground/80",children:g})]}),e.jsxs("div",{className:"mt-4 space-y-2",children:[c.length===0&&e.jsx("div",{className:"text-xs text-muted-foreground",children:"No passkeys enrolled yet."}),c.map(r=>e.jsxs("div",{className:"flex items-center justify-between rounded-md border border-gold/20 bg-background/30 px-3 py-2 text-xs",children:[e.jsxs("div",{children:[e.jsxs("div",{className:"font-bold text-foreground",children:[r.device_label," ",e.jsx("span",{className:`ml-2 rounded px-1.5 py-0.5 text-[10px] uppercase ${r.role==="primary"?"bg-gold/20 text-gold":"bg-foreground

2/10 text-foreground/70"}`,children:r.role}),r.revoked_at&&e.jsx("span",{className:"ml-2 rounded bg-destructive/20 px-1.5 py-0.5 text-[10px] uppercase text-destructive",children:"revoked"})]}),e.jsxs("div",{className:"text-muted-foreground",children:["Added ",new Date(r.created_at).toLocaleString(),r.last_used_at?` · Last used ${new Date(r.last_used_at).toLocaleString()}`:""]})]}),!r.revoked_at&&e.jsx("button",{onClick:()=>R(r.id),className:"rounded-md p-1.5 text-destructive hover:bg-destructive/10",title:"Revoke",children:e.jsx(E,{className:"h-4 w-4"})})]},r.id))]}),n<2&&e.jsxs("div",{className:"mt-3 rounded-md border border-gold/30 bg-gold/5 p-3 text-xs text-foreground/80",children:["You have ",e.jsx("span",{className:"font-bold",children:n})," enrolled device(s). Passkey sign-in unlocks at 2 devices. Google sign-in remains available until you flip enforcement."]})]})}function ye(){const t=I(),a=x(T),i=x(D),u=x(C),c=x(L),m=x(K),[p,b]=f.useState([]),[o,v]=f.useState([]),[g,l]=f.useState(!1),h=async()=>{const[s,R]=await Promise.all([a(),i()]);b(s.devices),v(R.incidents)};f.useEffect(()=>{t&&h()},[t]);const y=async s=>{if(confirm("Revoke this device? It will be forced to re-verify with your Master Hashkey.")){l(!0);try{await u({data:{sentinelId:s,reason:"user_revoked"}}),await h()}finally{l(!1)}}},n=async()=>{if(confirm("PANIC: Revoke ALL devices (including this one) and sign every session out globally?")){l(!0);try{await c(),window.location.href="/portal/login"}finally{l(!1)}}};return e.jsx(O,{title:"Silicon Lag Security",children:e.jsxs("div",{className:"space-y-6",children:[e.jsx(ee,{}),e.jsxs("section",{className:"rounded-xl border border-gold/30 p-5",style:{background:"var(--card)"},children:[e.jsxs("div",{className:"flex items-start gap-3",children:[e.jsx(Y,{className:"mt-1 h-6 w-6 text-gold"}),e.jsxs("div",{children:[e.jsx("h2",{className:"text-lg font-black uppercase tracking-tight text-foreground",children:"How Silicon Lag stops cookie theft & OAuth phishing"}),e.jsxs("p",{className:"mt-2 text-sm text-muted-foreground",children:["Every time you sign in, we bind your session to a device fingerprint that mixes stable signals (browser, screen, timezone) with a ",e.jsx("strong",{children:"persistent random ID stored in this browser only"}),". An attacker who steals just your cookie — or holds a phished Google OAuth refresh token — cannot replicate that ID from their machine, so they land as a"," ",e.jsx("strong",{children:"new, unapproved device"})," and are blocked at the door. Approving a new device always requires your ",e.jsx("strong",{children:"Master Hashkey"}),"."]})]})]}),e.jsxs("div",{className:"mt-4 flex flex-wrap gap-2",children:[e.jsxs("button",{onClick:async()=>{if(confirm("Revoke every OTHER active session for this account (keeps this browser signed in)?")){l(!0);try{await m(),alert("All other sessions have been signed out.")}finally{l(!1)}}},disabled:g,className:"inline-flex items-center gap-2 rounded-md border border-gold/40 bg-gold/10 px-4 py-2 text-xs font-black uppercase tracking-widest text-gold hover:bg-gold/20 disabled:opacity-50",children:[e.jsx(P,{className:"h-4 w-4"})," Sign out every other session"]}),e.jsxs("button",{onClick:n,disabled:g,className:"inline-flex items-center gap-2 rounded-md border border-destructive/50 bg-destructive/10 px-4 py-2 text-xs font-black uppercase tracking-widest text-destructive hover:bg-destructive/20 disabled:opacity-50",children:[e.jsx(J,{className:"h-4 w-4"})," Panic: revoke all devices & sign out everywhere"]})]}),e.jsx("div",{className:"mt-3 rounded-md border border-gold/30 bg-background/30 p-3 text-[11px] text-muted-foreground",children:"Two-factor apps are no longer used anywhere in this portal. Every sign-in — client and admin — is issued a one-time hash key by email that self-destructs after use, and idle sessions are terminated after 15 minutes."})]}),e.jsxs("section",{className:"rounded-xl border border-gold/30 p-5",style:{background:"var(--card)"},children:[e.jsx("h3",{className:"text-sm font-black uppercase tracking-widest text-gold",children:"Approved devices"}),e.jsxs("ul",{className:"mt-3 space-y-2",children:[p.length===0&&e.jsx("li",{className:"text-xs text-muted-foreground",children:"No devices recorded yet."}),p.map(s=>e.jsx("li",{className:"rounded-md border border-gold/20 bg-background/30 p-3",children:e.jsxs("div",{className:"flex items-start justify-between gap-3",children:[e.jsxs("div",{className:"min-w-0",children:[e.jsxs("div",{className:"flex items-center gap-2 text-xs font-bold uppercase tracking-widest",children:[e.jsx(te,{status:s.status}),e.jsx("span",{className:"text-muted-foreground",children:s.timezone??"unknown tz"}),e.jsxs("span",{className:"text-muted-foreground",children:["• ",s.screen]})]}),e.jsx("div",{className:"mt-1 truncate text-[11px] text-foreground

2/70",children:s.user_agent}),e.jsxs("div",{className:"mt-1 text-[10px] uppercase tracking-widest text-muted-foreground",children:["First seen ",new Date(s.first_seen).toLocaleString()," · Last seen"," ",new Date(s.last_seen).toLocaleString(),s.approved_via?` · Approved via ${s.approved_via}`:""]})]}),s.status!=="revoked"&&e.jsxs("button",{onClick:()=>y(s.id),disabled:g,className:"shrink-0 rounded-md border border-destructive/40 px-3 py-1.5 text-[10px] font-bold uppercase tracking-widest text-destructive hover:bg-destructive/10 disabled:opacity-50",children:[e.jsx(E,{className:"mr-1 inline h-3 w-3"})," Revoke"]})]})},s.id))]})]}),e.jsxs("section",{className:"rounded-xl border border-gold/30 p-5",style:{background:"var(--card)"},children:[e.jsx("h3",{className:"text-sm font-black uppercase tracking-widest text-gold",children:"Recent security incidents"}),e.jsxs("ul",{className:"mt-3 space-y-1.5 text-xs",children:[o.length===0&&e.jsx("li",{className:"text-muted-foreground",children:"No incidents recorded."}),o.map(s=>e.jsxs("li",{className:"flex items-start gap-2 rounded-md bg-background/30 px-2 py-1.5",children:[e.jsx(z,{className:"mt-0.5 h-3.5 w-3.5 text-gold"}),e.jsxs("div",{className:"min-w-0 flex-1",children:[e.jsx("div",{className:"font-bold uppercase tracking-widest text-foreground",children:s.kind}),e.jsxs("div",{className:"text-[10px] text-muted-foreground",children:[new Date(s.created_at).toLocaleString()," · ip ",s.ip_hash?.slice(0,8)??"n/a"]})]})]},s.id))]})]}),e.jsxs("section",{className:"rounded-xl border border-gold/30 p-5",style:{background:"var(--card)"},children:[e.jsx("h3",{className:"text-sm font-black uppercase tracking-widest text-gold",children:"OAuth Grant Watchdog (Google)"}),e.jsx("p",{className:"mt-2 text-sm text-muted-foreground",children:`The Mercor-style attack often holds a Google OAuth refresh token from a shady "Sign in with Google" app you approved once. Silicon Lag blocks their session on our side, but you should also revoke the token at the source. Review your Google-authorized apps and remove anything you don't recognize:`}),e.jsxs("a",{href:"https://myaccount.google.com/permissions",target:"_blank",rel:"noreferrer noopener",className:"mt-3 inline-flex items-center gap-2 rounded-md border border-gold/40 px-4 py-2 text-xs font-bold uppercase tracking-widest text-gold hover:bg-gold/10",children:["Open Google third-party access ",e.jsx(Z,{className:"h-3 w-3"})]}),e.jsx("p",{className:"mt-3 text-[11px] text-muted-foreground",children:"Recommended cadence: monthly. Any app you don't remember approving → remove immediately and hit the Panic button above."})]})]})})}function te({status:t}){const a=t==="approved"?"bg-gold/20 text-gold":t==="pending"?"bg-yellow-500/20 text-yellow-400":"bg-destructive/20 text-destructive";return e.jsx("span",{className:`rounded px-1.5 py-0.5 text-[9px] ${a}`,children:t})}export{ye as component};