refactor(auth): add timeout and libc fixes

- Add AbortSignal.timeout(5000) to PAM
  authentication request in
  apps/api/src/api/auth/index.ts
- Fetch projects only when authenticated and not
  on /login in apps/web/src/components/Layout.tsx
- Update useProjects to accept options and pass
  through to useQuery in
  apps/web/src/hooks/useProjects.ts
- Harden PAM Python scripts by loading libc via
  find_library and setting malloc/strdup restype
  in scripts/auth/pam-server.py
- Symmetrically update pam-verify.py to use
  find_library for libc and set malloc/strdup
  restype
- Remove premature success return from
  pam-verify.py to fix flow

Author: Lftobs

apps/api/src/api/auth/index.ts

@@ -10,6 +10,7 @@ const callPam = async (username: string, password: string): Promise<{ ok: boolea
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ username, password }),
+      signal: AbortSignal.timeout(5000),
     });
     const data = await res.json();
     return data;

apps/web/src/components/Layout.tsx

@@ -31,7 +31,7 @@ export function Layout({ children }: { children: React.ReactNode }) {
 		}
 	}, [me, authLoading, location.pathname, navigate]);
 
-	const { data: projects = [] } = useProjects();
+	const { data: projects = [] } = useProjects({ enabled: !!me?.authenticated && location.pathname !== "/login" });
 	const [projectSelectorOpen, setProjectSelectorOpen] = useState(false);
 
 	const { data: metricsText } = useQuery({

apps/web/src/hooks/useProjects.ts

@@ -2,8 +2,8 @@ import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
 import { listProjects, createProject, deleteProject } from '../api/client';
 import type { Project } from '../types';
 
-export function useProjects() {
-  return useQuery({ queryKey: ['projects'], queryFn: listProjects, refetchInterval: 10_000 });
+export function useProjects(options?: { enabled?: boolean }) {
+  return useQuery({ queryKey: ['projects'], queryFn: listProjects, refetchInterval: 10_000, ...options });
 }
 
 export function useProject(id: string) {

scripts/auth/pam-server.py

@@ -41,13 +41,15 @@ def verify(username: str, password: str) -> dict:
     if not lib_path:
         return {"ok": False, "error": "PAM library not found on system"}
     libpam = ctypes.cdll.LoadLibrary(lib_path)
-    libc = ctypes.cdll.LoadLibrary("libc.so.6")
+    libc = ctypes.cdll.LoadLibrary(ctypes.util.find_library("c") or "libc.so.6")
     libpam.pam_start.restype = ctypes.c_int
     libpam.pam_authenticate.restype = ctypes.c_int
     libpam.pam_acct_mgmt.restype = ctypes.c_int
     libpam.pam_end.restype = ctypes.c_int
     libpam.pam_strerror.restype = ctypes.c_char_p
     libpam.pam_strerror.argtypes = [ctypes.c_void_p, ctypes.c_int]
+    libc.malloc.restype = ctypes.c_void_p
+    libc.strdup.restype = ctypes.c_void_p
 
     password_cpy = [password]
 

scripts/auth/pam-verify.py

@@ -45,13 +45,15 @@ def verify(username: str, password: str) -> dict:
     if not lib_path:
         return {"ok": False, "error": "PAM library not found on system"}
     libpam = ctypes.cdll.LoadLibrary(lib_path)
-    libc = ctypes.cdll.LoadLibrary("libc.so.6")
+    libc = ctypes.cdll.LoadLibrary(ctypes.util.find_library("c") or "libc.so.6")
     libpam.pam_start.restype = ctypes.c_int
     libpam.pam_authenticate.restype = ctypes.c_int
     libpam.pam_acct_mgmt.restype = ctypes.c_int
     libpam.pam_end.restype = ctypes.c_int
     libpam.pam_strerror.restype = ctypes.c_char_p
     libpam.pam_strerror.argtypes = [ctypes.c_void_p, ctypes.c_int]
+    libc.malloc.restype = ctypes.c_void_p
+    libc.strdup.restype = ctypes.c_void_p
 
     password_cpy = [password]
 
@@ -119,8 +121,6 @@ def conv(nmsg, msg, out_resp, appdata):
 
     return {"ok": False, "error": f"User '{username}' is not in the '{GRP_NAME}' group"}
 
-    return {"ok": True, "username": username}
-
 
 def main():
     try: