feat(auth): guest-aware requireAuth + disable invalidates guest sessions

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/web/middleware/requireAuth.ts

@@ -1,7 +1,8 @@
 import type { Request, Response, NextFunction, RequestHandler } from "express";
 import type { SessionStore } from "../../data/sessions.js";
 import { SESSION_TTL_MS } from "../../data/sessions.js";
-import { resolvePermissionContext, type PermissionStore } from "../../data/permissions.js";
+import { resolvePermissionContext, type PermissionStore, type GuestPermissions } from "../../data/permissions.js";
+import type { GuestModeConfig } from "../../data/config.js";
 import {
   validateSessionFromHeaders,
   extractSessionToken,
@@ -13,14 +14,19 @@ declare module "express-serve-static-core" {
     user?: {
       id: string;
       username: string;
-      role: "admin" | "member";
+      role: "admin" | "member" | "guest";
       capabilities?: Set<string>;
       bots?: "all" | Set<string>;
+      guest?: GuestPermissions;
     };
   }
 }
 
-export function createRequireAuth(sessions: SessionStore, permissions: PermissionStore): RequestHandler {
+export function createRequireAuth(
+  sessions: SessionStore,
+  permissions: PermissionStore,
+  getGuestConfig: () => GuestModeConfig
+): RequestHandler {
   return function requireAuth(req: Request, res: Response, next: NextFunction) {
     const result = validateSessionFromHeaders(req.headers.cookie, sessions);
     if (!result) {
@@ -28,13 +34,27 @@ export function createRequireAuth(sessions: SessionStore, permissions: Permissio
       res.status(401).json({ error: "unauthenticated" });
       return;
     }
-    const ctx = resolvePermissionContext(result.role, result.userId, permissions);
+    // A guest session is only valid while guest mode is enabled. Disabling it
+    // immediately invalidates any in-flight guest sessions.
+    const guestCfg = getGuestConfig();
+    if (result.role === "guest" && !guestCfg.enabled) {
+      res.clearCookie(SESSION_COOKIE_NAME, { path: "/" });
+      res.status(401).json({ error: "unauthenticated" });
+      return;
+    }
+    const ctx = resolvePermissionContext(
+      result.role,
+      result.userId,
+      permissions,
+      result.role === "guest" ? { bots: guestCfg.bots, permissions: guestCfg.permissions } : undefined
+    );
     req.user = {
       id: result.userId,
       username: result.username,
       role: result.role,
       capabilities: ctx.capabilities,
       bots: ctx.bots,
+      guest: ctx.guest,
     };
     const token = extractSessionToken(req.headers.cookie);
     if (token) {