security(relay): harden internet-facing relay server

Closes the account-takeover chain and related issues found in audit:

- WS auth brute-force protection: per-session lockout (authThrottle) + per-
  socket failure cap that closes the socket (1008); applied to both web-client
  and desktop auth. Failed auth no longer leaves the socket open for unlimited
  guesses.
- WS upgrades now pass an IP-based rate limiter and Origin allowlist before
  handleUpgrade (previously bypassed all HTTP middleware); trust proxy set so
  limiting keys on the real client IP.
- /health no longer leaks live session IDs (counts only).
- .env.example rate-limit fixed (900000ms / 300) from the accidental ~11k rps.
- Credentials moved out of URLs into the X-MacroPad-Password header; images
  fetched via header + blob URLs; login stores creds in sessionStorage.
- Session creation bounded (max sessions, min password length) and TTL-pruned;
  session store writes are now atomic (temp+rename) and debounced.
- Session IDs lengthened to 12 chars with rejection sampling (no modulo bias).
- Enable helmet CSP; restrict CORS to configured origins.
- Request IDs use crypto.randomUUID; drop postinstall build hook and uuid dep.
- Uniform response for unknown session IDs (removes enumeration oracle).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

macropad-relay/src/handlers/webClientHandler.ts

@@ -4,6 +4,11 @@ import WebSocket from 'ws';
 import { ConnectionManager, WebClientConnection } from '../services/ConnectionManager';
 import { SessionManager } from '../services/SessionManager';
 import { logger } from '../utils/logger';
+import { config } from '../config';
+import { getLockoutRemaining, recordFailure, recordSuccess } from '../utils/authThrottle';
+
+// Close code 1008 = policy violation (used for auth abuse).
+const WS_POLICY_VIOLATION = 1008;
 
 interface AuthMessage {
   type: 'auth';
@@ -36,6 +41,9 @@ export function handleWebClientConnection(
   // Add client (not authenticated yet)
   const client = connectionManager.addWebClient(sessionId, socket, false);
 
+  // Track failed auth attempts on this individual socket.
+  let socketAuthFailures = 0;
+
   // Check if desktop is connected
   const desktop = connectionManager.getDesktopBySessionId(sessionId);
   socket.send(JSON.stringify({
@@ -53,9 +61,19 @@ export function handleWebClientConnection(
       const message: WebClientMessage = JSON.parse(data.toString());
 
       switch (message.type) {
-        case 'auth':
-          await handleAuth(socket, client, message, sessionId, sessionManager);
+        case 'auth': {
+          const failed = await handleAuth(socket, client, message, sessionId, sessionManager);
+          if (failed) {
+            socketAuthFailures++;
+            if (socketAuthFailures >= config.authMaxSocketFailures) {
+              logger.warn(`Web client exceeded auth attempts for session ${sessionId}, closing socket`);
+              socket.close(WS_POLICY_VIOLATION, 'Too many failed attempts');
+            }
+          } else {
+            socketAuthFailures = 0;
+          }
           break;
+        }
 
         case 'ping':
           socket.send(JSON.stringify({ type: 'pong' }));
@@ -82,28 +100,45 @@ export function handleWebClientConnection(
   });
 }
 
+// Returns true if the auth attempt failed (so the caller can count it).
 async function handleAuth(
   socket: WebSocket,
   client: WebClientConnection,
   message: AuthMessage,
   sessionId: string,
   sessionManager: SessionManager
-): Promise<void> {
+): Promise<boolean> {
+  // Reject early if this session id is currently locked out.
+  const lockRemaining = getLockoutRemaining(sessionId);
+  if (lockRemaining > 0) {
+    socket.send(JSON.stringify({
+      type: 'auth_response',
+      success: false,
+      error: 'Too many failed attempts, try again later',
+      retryAfterMs: lockRemaining
+    }));
+    return true;
+  }
+
   const valid = await sessionManager.validatePassword(sessionId, message.password);
 
   if (valid) {
+    recordSuccess(sessionId);
     client.authenticated = true;
     socket.send(JSON.stringify({
       type: 'auth_response',
       success: true
     }));
     logger.debug(`Web client authenticated for session: ${sessionId}`);
+    return false;
   } else {
+    recordFailure(sessionId);
     socket.send(JSON.stringify({
       type: 'auth_response',
       success: false,
       error: 'Invalid password'
     }));
+    return true;
   }
 }