One container, and real authentication

[ralyodio]

Two changes, both requested.

One container

Deletes the three-service split. apps/server is now the only entrypoint — a single Bun process that:

• serves the Hono API in-process on /api/v1 and /health/*
• supervises the Next PWA as a loopback child and proxies everything else to it
• runs the background loop (signal expiry, deletion jobs, session pruning)

One Dockerfile, one railway.json, one deploy, one log stream, one set of environment variables.

Next ships its own server with no supported way to mount it inside another Bun server, hence the child process. Only the supervisor binds a public port; the child is loopback-only.

The worker loop is single-instance by design — two copies would both claim the same pending deletion job — so railway.json pins numReplicas: 1 and records why. Scaling horizontally later means splitting the loop back out behind a lock.

Removed: docker/{api,web,worker}.Dockerfile, apps/{web,worker}/railway.json, apps/api/src/index.ts, apps/worker/src/index.ts.

Real authentication

The API previously accepted one shared bearer token. That is now the machine path only; humans get sessions.

• argon2id hashing via Bun.password — no hand-rolled crypto
• sessions stored as a SHA-256 hash of the cookie value, never the value, so a database leak yields no usable sessions
• httpOnly, SameSite=Lax, Secure in production
• identical response for unknown user and wrong password, so the endpoint cannot enumerate accounts
• account lockout after repeated failures
• workspace scoping derived from membership, not from client-supplied headers — previously any holder of the token could name any workspace
• registration provisions an organization and first workspace, since a user without one cannot do anything here

The service token now additionally requires explicit scope headers and is compared in constant time.

The approval buttons were decorative

Zero onClick handlers. Approve, edit, skip and do-not-contact now call the API. A policy denial surfaces the gate that blocked it instead of failing silently, and do-not-contact confirms first, because a suppression tombstone deliberately outlives the prospect record.

CI

The docker matrix is replaced by one image job that boots the container and asserts the API is healthy, the Next child answers through the proxy, unauthenticated calls are 401, and register/login/me works end to end. Docker is not installed on the authoring machine, so this job is the only thing that has ever run these images.

Verification

289 tests (24 new for auth), typecheck clean, next build clean, prettier clean.

🤖 Generated with Claude Code