feat: passport-local authentication, story ownership

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/app.ts

@@ -14,6 +14,13 @@ import { adminRouter } from "./routes/admin.js";
 import { healthRouter } from "./routes/health.js";
 import { logDemoRouter } from "./routes/log-demo.js";
 import { rootRouter } from "./routes/root.js";
+import { authRouter } from "./routes/auth.js";
+import { createAuth } from "./lib/auth.js";
+import {
+  memoryUserStore,
+  pgUserStore,
+  type UserStore,
+} from "./lib/user-store.js";
 import { storiesRouter } from "./routes/stories.js";
 import { memoryStore, pgStore, type StoryStore } from "./lib/story-store.js";
 
@@ -25,6 +32,7 @@ export interface Deps {
   flags?: Flags;
   runtimeConfig?: RuntimeConfig;
   store?: StoryStore;
+  users?: UserStore;
 }
 
 export function createApp({
@@ -35,6 +43,7 @@ export function createApp({
   flags,
   runtimeConfig = staticRuntimeConfig(),
   store = db ? pgStore(db) : memoryStore(),
+  users = db ? pgUserStore(db) : memoryUserStore(),
 }: Deps) {
   const app = express();
   app.disable("x-powered-by");
@@ -63,6 +72,15 @@ export function createApp({
 
   app.use(healthRouter({ db, cache }));
   app.use(rootRouter({ config, db, cache, flags, runtimeConfig }));
+  const auth = createAuth({ config, users, db });
+  app.use(auth.middleware);
+  app.use(
+    authRouter({
+      auth,
+      users,
+      registrationOpen: () => runtimeConfig.get().registrationOpen,
+    }),
+  );
   app.use(storiesRouter({ store }));
   app.use(adminRouter({ runtimeConfig }));
   app.use(logDemoRouter());