Serve the customer-facing menus

Landing page, Section pages and archived sets rendered per request from the
store, with the approved design: hand-written CSS, self-hosted Archivo, a
copper pour line in the Section rail, an admin-only Thumbnail and a text page
index. Media is keyed by Page id so URLs survive publishing, and a Draft's
media needs a session. Includes the scrypt admin auth and the login throttle
the media rule needs.

test/auth.test.ts

@@ -0,0 +1,91 @@
+import { strict as assert } from 'node:assert';
+import { describe, it } from 'node:test';
+import {
+  LoginThrottle,
+  createSessionToken,
+  hashPassword,
+  verifyPassword,
+  verifySessionToken,
+} from '../src/auth.ts';
+
+const NOW = new Date('2026-05-01T06:00:00.000Z');
+
+describe('the admin password', () => {
+  it('verifies a correct password and rejects a wrong one', async () => {
+    const stored = await hashPassword('correct horse battery staple');
+    assert.match(stored, /^scrypt\$32768\$8\$1\$/);
+    assert.equal(await verifyPassword('correct horse battery staple', stored), true);
+    assert.equal(await verifyPassword('Correct horse battery staple', stored), false);
+    assert.equal(await verifyPassword('', stored), false);
+  });
+
+  it('salts every hash, so the same password never produces the same string', async () => {
+    const first = await hashPassword('same password');
+    const second = await hashPassword('same password');
+    assert.notEqual(first, second);
+    assert.equal(await verifyPassword('same password', first), true);
+    assert.equal(await verifyPassword('same password', second), true);
+  });
+
+  it('rejects malformed stored values instead of throwing', async () => {
+    for (const stored of ['', 'plaintext', 'scrypt$1$2$3', 'bcrypt$1$2$3$4$5', 'scrypt$x$8$1$aa$bb']) {
+      assert.equal(await verifyPassword('anything', stored), false);
+    }
+  });
+});
+
+describe('the session token', () => {
+  const secret = 'a-long-random-secret';
+
+  it('accepts a fresh token', () => {
+    const token = createSessionToken(secret, 60_000, NOW);
+    assert.equal(verifySessionToken(token, secret, NOW), true);
+    assert.equal(verifySessionToken(token, secret, new Date(NOW.getTime() + 59_000)), true);
+  });
+
+  it('rejects an expired token', () => {
+    const token = createSessionToken(secret, 60_000, NOW);
+    assert.equal(verifySessionToken(token, secret, new Date(NOW.getTime() + 61_000)), false);
+  });
+
+  it('rejects a token signed with another secret, a tampered expiry, and rubbish', () => {
+    const token = createSessionToken(secret, 60_000, NOW);
+    assert.equal(verifySessionToken(token, 'another-secret', NOW), false);
+    const [, signature] = token.split('.');
+    assert.equal(verifySessionToken(`${NOW.getTime() + 999_999}.${signature}`, secret, NOW), false);
+    assert.equal(verifySessionToken(undefined, secret, NOW), false);
+    assert.equal(verifySessionToken('', secret, NOW), false);
+    assert.equal(verifySessionToken('no-dot', secret, NOW), false);
+    assert.equal(verifySessionToken(`.${signature}`, secret, NOW), false);
+  });
+});
+
+describe('the login throttle', () => {
+  it('blocks the sixth failure inside the window and reports how long to wait', () => {
+    let time = NOW.getTime();
+    const throttle = new LoginThrottle({ maxFailures: 5, windowMs: 60_000, now: () => new Date(time) });
+
+    for (let attempt = 0; attempt < 5; attempt += 1) {
+      assert.equal(throttle.check('1.2.3.4').allowed, true);
+      throttle.recordFailure('1.2.3.4');
+    }
+
+    const blocked = throttle.check('1.2.3.4');
+    assert.equal(blocked.allowed, false);
+    assert.ok(blocked.retryAfterSeconds > 0);
+
+    assert.equal(throttle.check('5.6.7.8').allowed, true);
+
+    time += 61_000;
+    assert.equal(throttle.check('1.2.3.4').allowed, true);
+  });
+
+  it('clears failures on a successful login', () => {
+    const throttle = new LoginThrottle({ maxFailures: 2, windowMs: 60_000, now: () => NOW });
+    throttle.recordFailure('ip');
+    throttle.recordFailure('ip');
+    assert.equal(throttle.check('ip').allowed, false);
+    throttle.reset('ip');
+    assert.equal(throttle.check('ip').allowed, true);
+  });
+});