fix(auth): bind current local registry and CORS

backend/src/auth/local-registry.ts

@@ -8,11 +8,11 @@ import {
   realpathSync,
 } from "node:fs";
 import type { Stats } from "node:fs";
-import { dirname, isAbsolute, normalize } from "node:path";
+import { dirname, isAbsolute, join, normalize } from "node:path";
 import { parseDocument } from "yaml";
 import { z } from "zod";
 import { isValidPasswordHash, verifyPassword, verifyWithDummy } from "./password.js";
-import type { Role } from "./types.js";
+import type { LoadedAuthConfig, Role } from "./types.js";
 
 const MAX_USERS_YAML_BYTES = 1 << 20;
 const USERNAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._@-]{2,63}$/;
@@ -37,6 +37,11 @@ export interface LocalUserRegistry {
   verify(user: LocalUserRecord | undefined, password: string): Promise<boolean>;
 }
 
+/** Keeps only the registry named by the current coherent authentication-config snapshot. */
+export interface CurrentLocalUserRegistryResolver {
+  resolve(loaded: LoadedAuthConfig): LocalUserRegistry | undefined;
+}
+
 interface FileIdentity {
   dev: number;
   ino: number;
@@ -253,3 +258,17 @@ export function createLocalUserRegistry(usersPath: string): LocalUserRegistry {
     },
   };
 }
+
+export function createCurrentLocalUserRegistryResolver(): CurrentLocalUserRegistryResolver {
+  let current: { usersPath: string; registry: LocalUserRegistry } | undefined;
+  return {
+    resolve(loaded: LoadedAuthConfig): LocalUserRegistry | undefined {
+      if (loaded.value.mode !== "local") return undefined;
+      const usersPath = join(dirname(loaded.sourcePath), loaded.value.local.usersFile);
+      if (current?.usersPath === usersPath) return current.registry;
+      const registry = createLocalUserRegistry(usersPath);
+      current = { usersPath, registry };
+      return registry;
+    },
+  };
+}