Add HMAC auth, user permissions, snake_case rename

Each request is signed with HMAC-SHA256 over timestamp+body using a
per-user secret loaded from a --secrets file (never env vars or git).
Users have a canApprove list controlling who may approve queued actions.
Queue entries track submitted_by for permission checks on approve/deny.

Also renames all identifiers to snake_case throughout the codebase.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/index.mjs

@@ -1,16 +1,37 @@
 import express from "express";
 import { actions } from "./actions.mjs";
-import { enqueue, getEntry, listPending, resolve } from "./queue.mjs";
+import { enqueue, get_entry, list_pending, resolve } from "./queue.mjs";
+import { load_secrets } from "./secrets.mjs";
+import { create_auth_middleware, check_can_approve } from "./auth.mjs";
 
 const PORT = process.env.CONDUIT_PORT || 3015;
 
-const app = express();
-app.use(express.json());
+function get_arg(argv, flag) {
+	const i = argv.indexOf(flag);
+	return i !== -1 ? argv[i + 1] : null;
+}
 
-// Validate that all required params are present.
-function validateParams(actionDef, params) {
+const secrets_path = get_arg(process.argv, "--secrets");
+let secrets;
+try {
+	secrets = load_secrets(secrets_path);
+} catch (err) {
+	console.error(`Fatal: ${err.message}`);
+	process.exit(1);
+}
+const { users } = secrets;
+
+const app = express();
+app.use(express.json({
+	verify: (req, _res, buf) => {
+		req.raw_body = buf.toString("utf8");
+	},
+}));
+app.use(create_auth_middleware(users));
+
+function validate_params(action_def, params) {
 	const errors = [];
-	for (const p of actionDef.params) {
+	for (const p of action_def.params) {
 		if (p.required && (params[p.name] === undefined || params[p.name] === null)) {
 			errors.push(`Missing required param: ${p.name}`);
 		}
@@ -31,7 +52,7 @@ app.post("/action", async (req, res) => {
 		return res.status(404).json({ error: `Unknown action: ${action}` });
 	}
 
-	const errors = validateParams(def, params);
+	const errors = validate_params(def, params);
 	if (errors.length) {
 		return res.status(400).json({ error: "Invalid params", details: errors });
 	}
@@ -50,25 +71,28 @@ app.post("/action", async (req, res) => {
 	}
 
 	if (def.policy === "queue") {
-		const id = enqueue(action, params);
+		const id = enqueue(action, params, req.conduit_user);
 		return res.status(202).json({ status: "queued", id });
 	}
 });
 
 // GET /queue — list pending items
 app.get("/queue", (req, res) => {
-	res.json(listPending());
+	res.json(list_pending());
 });
 
 // POST /queue/:id/approve — user approves a queued action
 app.post("/queue/:id/approve", async (req, res) => {
-	const entry = getEntry(req.params.id);
+	const entry = get_entry(req.params.id);
 	if (!entry) {
 		return res.status(404).json({ error: "Not found" });
 	}
 	if (entry.status !== "pending") {
 		return res.status(409).json({ error: "Already resolved" });
 	}
+	if (!check_can_approve(users, req.conduit_user, entry.submitted_by)) {
+		return res.status(403).json({ error: "Not authorized to approve this entry" });
+	}
 
 	resolve(req.params.id, "approved");
 
@@ -83,13 +107,16 @@ app.post("/queue/:id/approve", async (req, res) => {
 
 // POST /queue/:id/deny — user denies a queued action
 app.post("/queue/:id/deny", (req, res) => {
-	const entry = getEntry(req.params.id);
+	const entry = get_entry(req.params.id);
 	if (!entry) {
 		return res.status(404).json({ error: "Not found" });
 	}
 	if (entry.status !== "pending") {
 		return res.status(409).json({ error: "Already resolved" });
 	}
+	if (!check_can_approve(users, req.conduit_user, entry.submitted_by)) {
+		return res.status(403).json({ error: "Not authorized to deny this entry" });
+	}
 
 	resolve(req.params.id, "denied");
 	res.json({ status: "denied" });