Team server

Threat and trust model

Team mode is for a trusted team sharing one local Git work tree. It authenticates users, records edits, and protects browser mutations; it is not a replacement for network segmentation or a managed identity service.

Creating accounts

Use bluep team user add --users <file> <username> --display-name <name> --email <email> --role <role> --password-stdin. Passwords are read only from standard input.

Password hashing and file protection

Accounts use salted PBKDF2-HMAC-SHA-256 hashes and the account file should be readable only by the service operator. Plaintext passwords are never stored.

Roles

Viewers read models, editors may save and manage their own locks, and administrators manage accounts, locks, and audit records.

Sessions and CSRF

Sessions are opaque, HttpOnly cookies with absolute expiry. Browser writes require a CSRF token returned after login.

Locks and expiry

Locks are advisory for display and enforced for writes. They expire automatically, so abandoned browser sessions cannot block work indefinitely.

Save conflicts

Every save carries the model fingerprint it started from. A stale save is rejected and must be reloaded rather than silently overwriting someone else’s change.

Git authors/commits

Each successful browser save produces one Git commit authored by the authenticated user. Only changed model files are staged.

Audit log

The append-only JSONL audit log records authentication, lock, account, and save activity without credentials or tokens.

Live updates/SSE

Authenticated browsers use server-sent events for model and lock changes, and reconnect using event identifiers.

HTTP on loopback

By default the server only accepts loopback HTTP. This keeps local traffic on the host while still allowing a browser to use the team UI.

TLS proxy deployment

Bluep does not terminate TLS. For any non-loopback use, place it behind a TLS proxy and expose only the proxy publicly.

Remote override risks

--allow-remote-http deliberately permits clear-text remote HTTP and exposes credentials and model contents to network interception. Use it only for controlled testing.

Backups and recovery

Back up the Git repository, .bluep-team/users, and audit log together. Git history and the audit log provide complementary recovery evidence.

Operational limits

This server is one process for one work tree. It has no SSO, password recovery, multi-process coordination, or remote Git push.