From: Justin Wind <justin.wind+git@gmail.com>
Date: Sat, 23 Oct 2021 21:12:57 +0000 (-0700)
Subject: Merge branch 'v1.3-dev' as v1.3.0
X-Git-Tag: v1.3.0
X-Git-Url: http://git.squeep.com/?p=websub-hub;a=commitdiff_plain;h=afc5da271215282fa723e79a12562d3b86734326;hp=a4c58b857482dc900fad9498fc0c510dd67cd380

Merge branch 'v1.3-dev' as v1.3.0
---

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1426111..561f23f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,13 @@ Releases and notable changes to this project are documented here.
 
 ## [Unreleased]
 
+## [v1.3.0] - 2021-10-23
+
+### Added
+
+- IndieAuth logins now supported, admin overview page will show topics related to the authenticated profile's host.
+- Due to the new session-based admin login system, the config value `encryptionSecret` will need to be populated when upgrading.
+
 ## [v1.2.2] - 2021-10-05
 
 ### Fixed
@@ -79,7 +86,8 @@ Releases and notable changes to this project are documented here.
 
 ---
 
-[Unreleased]: https://git.squeep.com/?p=websub-hub;a=commitdiff;h=HEAD;hp=v1.2.0
+[Unreleased]: https://git.squeep.com/?p=websub-hub;a=commitdiff;h=HEAD;hp=v1.3.0
+[v1.3.0]: https://git.squeep.com/?p=websub-hub;a=commitdiff;h=v1.3.0;hp=v1.2.2
 [v1.2.2]: https://git.squeep.com/?p=websub-hub;a=commitdiff;h=v1.2.2;hp=v1.2.1
 [v1.2.1]: https://git.squeep.com/?p=websub-hub;a=commitdiff;h=v1.2.1;hp=v1.2.0
 [v1.2.0]: https://git.squeep.com/?p=websub-hub;a=commitdiff;h=v1.2.0;hp=v1.1.5
diff --git a/README.md b/README.md
index c7e805a..20f61e0 100644
--- a/README.md
+++ b/README.md
@@ -18,6 +18,8 @@ Database table initialization and schema version migrations are automated.  Conf
 
 A user will need to be created in order to view the `/admin` pages; the `bin/authAddUser.js` script will do this.
 
+An IndieAuth profile may be used to view any topics associated with that profile.
+
 The bundled logger spews JSON to stdout.
 
 ### Quickstart Example
@@ -126,6 +128,7 @@ This implementation is built atop an in-house API framework, for Reasons.  It wo
   - *.js - environment specific values, edit these as needed
 - server.js - launches the application server
 - src/
+  - authenticator.js - interact with credentials and validation mechanisms
   - common.js - utility functions
   - communication.js - outgoing requests and associated logic
   - db/
@@ -146,6 +149,7 @@ This implementation is built atop an in-house API framework, for Reasons.  It wo
   - logger.js - a very simple logging class
   - manager.js - process incoming requests
   - service.js - defines incoming endpoints, linking the API server framework to the manager methods
+  - session-manager.js - process login/logout requests
   - template/ - HTML content
   - worker.js - maintains a pool of tasks in progress, for sending out updates, performing verifications, et cetera
 - test/ - unit and coverage tests
diff --git a/config/default.js b/config/default.js
index 64f45ec..3714253 100644
--- a/config/default.js
+++ b/config/default.js
@@ -9,6 +9,9 @@ const defaultOptions = {
   // Uniquely identify this instance, used to tag work-in-progress.
   nodeId: common.requestId(), // Default to ephemeral ID: easiest for clustered deployments.
 
+  // This should be set to a reasonably long passphrase or random buffer, to keep client session data secure.
+  encryptionSecret: undefined, // REQUIRED
+
   // Dingus API Server Framework options. Be sure to set the one REQUIRED option here.
   dingus: {
     // This needs to be the full externally accessible root URL, including any proxyPrefix component, which clients will connect to, and which topics will list as their hub link.
@@ -69,6 +72,8 @@ const defaultOptions = {
   authenticator: {
     basicRealm: packageName, // Realm prompt for login on administration pages
     secureAuthOnly: true, // Require secure transport for authentication.
+    authnEnabled: ['argon2', 'pam'],
+    forbiddenPAMIdentifiers: ['root'],
   },
 
   worker: {
diff --git a/config/test.js b/config/test.js
index 3ff1259..081f32a 100644
--- a/config/test.js
+++ b/config/test.js
@@ -10,4 +10,5 @@ module.exports = {
     queryLogLevel: 'debug',
     cacheEnabled: false,
   },
+  encryptionSecret: 'not a very good secret',
 };
diff --git a/package-lock.json b/package-lock.json
index bcd5dba..36a1d58 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,18 +1,9 @@
 {
-  "name": "websub-hub",
-  "version": "1.2.2",
+  "name": "@squeep/websub-hub",
+  "version": "1.3.0",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
-    "@babel/code-frame": {
-      "version": "7.12.11",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.12.11.tgz",
-      "integrity": "sha512-Zt1yodBx1UcyiePMSkWnU4hPqhwq7hGi2nFL1LeA3EUl+q2LQx16MISgJ0+z7dnmgvP9QtIleuETGOiOH1RcIw==",
-      "dev": true,
-      "requires": {
-        "@babel/highlight": "^7.10.4"
-      }
-    },
     "@babel/compat-data": {
       "version": "7.14.7",
       "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.14.7.tgz",
@@ -228,12 +219,6 @@
         "@babel/types": "^7.14.5"
       }
     },
-    "@babel/helper-validator-identifier": {
-      "version": "7.14.8",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.14.8.tgz",
-      "integrity": "sha512-ZGy6/XQjllhYQrNw/3zfWRwZCTVSiBLZ9DHVZxn9n2gip/7ab8mv2TWlKPIBk26RwedCBoWdjLmn+t9na2Gcow==",
-      "dev": true
-    },
     "@babel/helper-validator-option": {
       "version": "7.14.5",
       "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.14.5.tgz",
@@ -251,30 +236,6 @@
         "@babel/types": "^7.14.5"
       }
     },
-    "@babel/highlight": {
-      "version": "7.14.5",
-      "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.14.5.tgz",
-      "integrity": "sha512-qf9u2WFWVV0MppaL877j2dBtQIDgmidgjGk5VIMw3OadXvYaXn66U1BFlH2t4+t3i+8PhedppRv+i40ABzd+gg==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-validator-identifier": "^7.14.5",
-        "chalk": "^2.0.0",
-        "js-tokens": "^4.0.0"
-      },
-      "dependencies": {
-        "chalk": {
-          "version": "2.4.2",
-          "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
-          "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
-          "dev": true,
-          "requires": {
-            "ansi-styles": "^3.2.1",
-            "escape-string-regexp": "^1.0.5",
-            "supports-color": "^5.3.0"
-          }
-        }
-      }
-    },
     "@babel/parser": {
       "version": "7.14.7",
       "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.14.7.tgz",
@@ -412,14 +373,14 @@
       }
     },
     "@eslint/eslintrc": {
-      "version": "0.4.3",
-      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-0.4.3.tgz",
-      "integrity": "sha512-J6KFFz5QCYUJq3pf0mjEcCJVERbzv71PUIDczuh9JkwGEzced6CO5ADLHB1rbf/+oPBtoPfMYNOpGDzCANlbXw==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-1.0.3.tgz",
+      "integrity": "sha512-DHI1wDPoKCBPoLZA3qDR91+3te/wDSc1YhKg3jR8NxKKRJq2hwHwcWv31cSwSYvIBrmbENoYMWcenW8uproQqg==",
       "dev": true,
       "requires": {
         "ajv": "^6.12.4",
-        "debug": "^4.1.1",
-        "espree": "^7.3.0",
+        "debug": "^4.3.2",
+        "espree": "^9.0.0",
         "globals": "^13.9.0",
         "ignore": "^4.0.6",
         "import-fresh": "^3.2.1",
@@ -429,9 +390,9 @@
       }
     },
     "@humanwhocodes/config-array": {
-      "version": "0.5.0",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.5.0.tgz",
-      "integrity": "sha512-FagtKFz74XrTl7y6HCzQpwDfXP0yhxe9lHLD1UZxjvZIcbyRz8zTFF/yYNfSfzU414eDwZ1SrO0Qvtyf+wFMQg==",
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.6.0.tgz",
+      "integrity": "sha512-JQlEKbcgEUjBFhLIF4iqM7u/9lwgHRBcpHrmUNCALK0Q3amXN6lxdoXLnF0sm11E9VqTmBALR87IlUg1bZ8A9A==",
       "dev": true,
       "requires": {
         "@humanwhocodes/object-schema": "^1.2.0",
@@ -519,6 +480,7 @@
       "version": "1.0.5",
       "resolved": "https://registry.npmjs.org/@mapbox/node-pre-gyp/-/node-pre-gyp-1.0.5.tgz",
       "integrity": "sha512-4srsKPXWlIxp5Vbqz5uLfBN+du2fJChBoYn/f2h991WLdk7jUvcSk/McVLSv/X+xQIPI8eGD5GjrnygdyHnhPA==",
+      "optional": true,
       "requires": {
         "detect-libc": "^1.0.3",
         "https-proxy-agent": "^5.0.0",
@@ -534,7 +496,8 @@
     "@phc/format": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/@phc/format/-/format-1.0.0.tgz",
-      "integrity": "sha512-m7X9U6BG2+J+R1lSOdCiITLLrxm+cWlNI3HUFA92oLO77ObGNzaKdh8pMLqdZcshtkKuV84olNNXDfMc4FezBQ=="
+      "integrity": "sha512-m7X9U6BG2+J+R1lSOdCiITLLrxm+cWlNI3HUFA92oLO77ObGNzaKdh8pMLqdZcshtkKuV84olNNXDfMc4FezBQ==",
+      "optional": true
     },
     "@sinonjs/commons": {
       "version": "1.8.3",
@@ -572,10 +535,10 @@
       "dev": true
     },
     "@squeep/api-dingus": {
-      "version": "git+https://git.squeep.com/squeep-api-dingus/#842a9b1e5b62aa642a53269a8466fd1e021e4ff2",
-      "from": "git+https://git.squeep.com/squeep-api-dingus/#v1.2.0",
+      "version": "git+https://git.squeep.com/squeep-api-dingus/#3cf325b9e87b66e16f05c9bcae769eea72b207ed",
+      "from": "git+https://git.squeep.com/squeep-api-dingus/#v1.2.1",
       "requires": {
-        "mime-db": "^1.49.0",
+        "mime-db": "^1.50.0",
         "uuid": "^8.3.2"
       },
       "dependencies": {
@@ -586,9 +549,37 @@
         }
       }
     },
+    "@squeep/indieauth-helper": {
+      "version": "git+https://git.squeep.com/squeep-indieauth-helper/#ea59a4bf7a596b502aacf06baee26518d86fd312",
+      "from": "git+https://git.squeep.com/squeep-indieauth-helper/#v1.0.0",
+      "requires": {
+        "@squeep/web-linking": "git+https://git.squeep.com/squeep-web-linking/#v1.0.0",
+        "axios": "^0.23.0",
+        "iconv": "^3.0.1",
+        "microformats-parser": "^1.4.0"
+      },
+      "dependencies": {
+        "@squeep/web-linking": {
+          "version": "git+https://git.squeep.com/squeep-web-linking/#3436c07c25324507228f3d538d345ea35751c623",
+          "from": "git+https://git.squeep.com/squeep-web-linking/#v1.0.0"
+        },
+        "axios": {
+          "version": "0.23.0",
+          "resolved": "https://registry.npmjs.org/axios/-/axios-0.23.0.tgz",
+          "integrity": "sha512-NmvAE4i0YAv5cKq8zlDoPd1VLKAqX5oLuZKs8xkJa4qi6RGn0uhCYFjWtHHC9EM/MwOwYWOs53W+V0aqEXq1sg==",
+          "requires": {
+            "follow-redirects": "^1.14.4"
+          }
+        }
+      }
+    },
+    "@squeep/mystery-box": {
+      "version": "git+https://git.squeep.com/squeep-mystery-box/#8df7723f7bbd9ad239bd5a3f66d6e9a8cd3c8100",
+      "from": "git+https://git.squeep.com/squeep-mystery-box/#v1.0.1"
+    },
     "@squeep/web-linking": {
-      "version": "git+https://git.squeep.com/squeep-web-linking/#6506e54d8183d383fa9c127b87783179a0662fc1",
-      "from": "git+https://git.squeep.com/squeep-web-linking/#v1.0.0"
+      "version": "git+https://git.squeep.com/squeep-web-linking/#0728e2b9347826ed0be7f9a7939bf5d61e181204",
+      "from": "git+https://git.squeep.com/squeep-web-linking/#v1.0.1"
     },
     "@ungap/promise-all-settled": {
       "version": "1.1.2",
@@ -599,12 +590,13 @@
     "abbrev": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-1.1.1.tgz",
-      "integrity": "sha512-nne9/IiQ/hzIhY6pdDnbBtz7DjPTKrY00P/zvPSm5pOFkl6xuGrGnXn/VtTNNfNtAfZ9/1RtehkszU9qcTii0Q=="
+      "integrity": "sha512-nne9/IiQ/hzIhY6pdDnbBtz7DjPTKrY00P/zvPSm5pOFkl6xuGrGnXn/VtTNNfNtAfZ9/1RtehkszU9qcTii0Q==",
+      "optional": true
     },
     "acorn": {
-      "version": "7.4.1",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.4.1.tgz",
-      "integrity": "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A==",
+      "version": "8.5.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.5.0.tgz",
+      "integrity": "sha512-yXbYeFy+jUuYd3/CDcg2NkIYE991XYX/bje7LmjJigUciaeO1JR4XxXgCIV1/Zc/dRuFEyw1L0pbA+qynJkW5Q==",
       "dev": true
     },
     "acorn-jsx": {
@@ -622,6 +614,7 @@
       "version": "6.0.2",
       "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
       "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
+      "optional": true,
       "requires": {
         "debug": "4"
       }
@@ -655,10 +648,9 @@
       "dev": true
     },
     "ansi-regex": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz",
-      "integrity": "sha512-bY6fj56OUQ0hU1KjFNDQuJFezqKdrAyFdIevADiqrWHwSlbmBNMHp5ak2f40Pm8JTFyM2mqxkG6ngkHO11f/lg==",
-      "dev": true
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="
     },
     "ansi-styles": {
       "version": "3.2.1",
@@ -691,7 +683,8 @@
     "aproba": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/aproba/-/aproba-1.2.0.tgz",
-      "integrity": "sha512-Y9J6ZjXtoYh8RnXVCMOU/ttDmk1aBjunq9vO0ta5x85WDQiQfUF9sIPBITdbiiIVcBo03Hi3jMxigBtsddlXRw=="
+      "integrity": "sha512-Y9J6ZjXtoYh8RnXVCMOU/ttDmk1aBjunq9vO0ta5x85WDQiQfUF9sIPBITdbiiIVcBo03Hi3jMxigBtsddlXRw==",
+      "optional": true
     },
     "archy": {
       "version": "1.0.0",
@@ -703,6 +696,7 @@
       "version": "1.1.5",
       "resolved": "https://registry.npmjs.org/are-we-there-yet/-/are-we-there-yet-1.1.5.tgz",
       "integrity": "sha512-5hYdAkZlcG8tOLujVDTgCT+uPX0VnpAH28gWsLfzpXYm7wP6mp5Q/gYyR7YQ0cKVJcXJnl3j2kpBan13PtQf6w==",
+      "optional": true,
       "requires": {
         "delegates": "^1.0.0",
         "readable-stream": "^2.0.6"
@@ -712,6 +706,7 @@
       "version": "0.28.2",
       "resolved": "https://registry.npmjs.org/argon2/-/argon2-0.28.2.tgz",
       "integrity": "sha512-8oRk3kPlL0lLletENzhpbF9zoZJqvIHwTkjBseMrg1uD4gBMqhqnjJz1z3lEtwT0oqQAEkEwsEpsjaQBBRHcWw==",
+      "optional": true,
       "requires": {
         "@mapbox/node-pre-gyp": "^1.0.1",
         "@phc/format": "^1.0.0",
@@ -736,18 +731,13 @@
     "assert-options": {
       "version": "0.7.0",
       "resolved": "https://registry.npmjs.org/assert-options/-/assert-options-0.7.0.tgz",
-      "integrity": "sha512-7q9uNH/Dh8gFgpIIb9ja8PJEWA5AQy3xnBC8jtKs8K/gNVCr1K6kIvlm59HUyYgvM7oEDoLzGgPcGd9FqhtXEQ=="
-    },
-    "astral-regex": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/astral-regex/-/astral-regex-2.0.0.tgz",
-      "integrity": "sha512-Z7tMw1ytTXt5jqMcOP+OQteU1VuNK9Y02uuJtKQ1Sv69jXQKKg5cibLwGJow8yzZP+eAc18EmLGPal0bp36rvQ==",
-      "dev": true
+      "integrity": "sha512-7q9uNH/Dh8gFgpIIb9ja8PJEWA5AQy3xnBC8jtKs8K/gNVCr1K6kIvlm59HUyYgvM7oEDoLzGgPcGd9FqhtXEQ==",
+      "optional": true
     },
     "axios": {
-      "version": "0.22.0",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-0.22.0.tgz",
-      "integrity": "sha512-Z0U3uhqQeg1oNcihswf4ZD57O3NrR1+ZXhxaROaWpDmsDTx7T2HNBV2ulBtie2hwJptu8UvgnJoK+BIqdzh/1w==",
+      "version": "0.23.0",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-0.23.0.tgz",
+      "integrity": "sha512-NmvAE4i0YAv5cKq8zlDoPd1VLKAqX5oLuZKs8xkJa4qi6RGn0uhCYFjWtHHC9EM/MwOwYWOs53W+V0aqEXq1sg==",
       "requires": {
         "follow-redirects": "^1.14.4"
       }
@@ -760,12 +750,14 @@
     "base64-js": {
       "version": "1.5.1",
       "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
-      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA=="
+      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
+      "optional": true
     },
     "better-sqlite3": {
       "version": "7.4.3",
       "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-7.4.3.tgz",
       "integrity": "sha512-07bKjClZg/f4KMVRkzWtoIvazVPcF1gsvVKVIXlxwleC2DxuIhnra3KCMlUT1rFeRYXXckot2a46UciF2d9KLw==",
+      "optional": true,
       "requires": {
         "bindings": "^1.5.0",
         "prebuild-install": "^6.0.1",
@@ -782,6 +774,7 @@
       "version": "1.5.0",
       "resolved": "https://registry.npmjs.org/bindings/-/bindings-1.5.0.tgz",
       "integrity": "sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==",
+      "optional": true,
       "requires": {
         "file-uri-to-path": "1.0.0"
       }
@@ -790,6 +783,7 @@
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
       "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
+      "optional": true,
       "requires": {
         "buffer": "^5.5.0",
         "inherits": "^2.0.4",
@@ -800,6 +794,7 @@
           "version": "3.6.0",
           "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.0.tgz",
           "integrity": "sha512-BViHy7LKeTz4oNnkcLJ+lVSL6vpiFeX6/d3oSH8zCW7UxP2onchk+vTGB143xuFjHS3deTgkKoXXymXqymiIdA==",
+          "optional": true,
           "requires": {
             "inherits": "^2.0.3",
             "string_decoder": "^1.1.1",
@@ -849,6 +844,7 @@
       "version": "5.7.1",
       "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
       "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
+      "optional": true,
       "requires": {
         "base64-js": "^1.3.1",
         "ieee754": "^1.1.13"
@@ -863,7 +859,8 @@
     "buffer-writer": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/buffer-writer/-/buffer-writer-2.0.0.tgz",
-      "integrity": "sha512-a7ZpuTZU1TRtnwyCNW3I5dc0wWNC3VR9S++Ewyk2HHZdrO3CQJqSpd+95Us590V6AL7JqUAH2IwZ/398PmNFgw=="
+      "integrity": "sha512-a7ZpuTZU1TRtnwyCNW3I5dc0wWNC3VR9S++Ewyk2HHZdrO3CQJqSpd+95Us590V6AL7JqUAH2IwZ/398PmNFgw==",
+      "optional": true
     },
     "caching-transform": {
       "version": "4.0.0",
@@ -896,9 +893,9 @@
       "dev": true
     },
     "chalk": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.1.tgz",
-      "integrity": "sha512-diHzdDKxcU+bAsUboHLPEDQiw0qEe0qd7SYUn3HgcFlWgbDcfLGswOHYeGrHKzG9z6UYf01d9VFMfZxPM1xZSg==",
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "requires": {
         "ansi-styles": "^4.1.0",
@@ -960,12 +957,24 @@
         "is-glob": "~4.0.1",
         "normalize-path": "~3.0.0",
         "readdirp": "~3.6.0"
+      },
+      "dependencies": {
+        "glob-parent": {
+          "version": "5.1.2",
+          "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+          "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+          "dev": true,
+          "requires": {
+            "is-glob": "^4.0.1"
+          }
+        }
       }
     },
     "chownr": {
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
-      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg=="
+      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
+      "optional": true
     },
     "clean-stack": {
       "version": "2.2.0",
@@ -987,7 +996,8 @@
     "code-point-at": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/code-point-at/-/code-point-at-1.1.0.tgz",
-      "integrity": "sha1-DQcLTQQ6W+ozovGkDi7bPZpMz3c="
+      "integrity": "sha1-DQcLTQQ6W+ozovGkDi7bPZpMz3c=",
+      "optional": true
     },
     "color-convert": {
       "version": "1.9.3",
@@ -1036,7 +1046,8 @@
     "console-control-strings": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/console-control-strings/-/console-control-strings-1.1.0.tgz",
-      "integrity": "sha1-PXz0Rk22RG6mRL9LOVB/mFEAjo4="
+      "integrity": "sha1-PXz0Rk22RG6mRL9LOVB/mFEAjo4=",
+      "optional": true
     },
     "convert-source-map": {
       "version": "1.8.0",
@@ -1089,6 +1100,7 @@
       "version": "4.2.1",
       "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-4.2.1.tgz",
       "integrity": "sha512-jOSne2qbyE+/r8G1VU+G/82LBs2Fs4LAsTiLSHOCOMZQl2OKZ6i8i4IyHemTe+/yIXOtTcRQMzPcgyhoFlqPkw==",
+      "optional": true,
       "requires": {
         "mimic-response": "^2.0.0"
       }
@@ -1096,12 +1108,13 @@
     "deep-extend": {
       "version": "0.6.0",
       "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
-      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA=="
+      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
+      "optional": true
     },
     "deep-is": {
-      "version": "0.1.3",
-      "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.3.tgz",
-      "integrity": "sha1-s2nW+128E+7PUk+RsHD+7cNXzzQ=",
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
+      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
       "dev": true
     },
     "default-require-extensions": {
@@ -1116,12 +1129,14 @@
     "delegates": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/delegates/-/delegates-1.0.0.tgz",
-      "integrity": "sha1-hMbhWbgZBP3KWaDvRM2HDTElD5o="
+      "integrity": "sha1-hMbhWbgZBP3KWaDvRM2HDTElD5o=",
+      "optional": true
     },
     "detect-libc": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-1.0.3.tgz",
-      "integrity": "sha1-+hN8S9aY7fVc1c0CrFWfkaTEups="
+      "integrity": "sha1-+hN8S9aY7fVc1c0CrFWfkaTEups=",
+      "optional": true
     },
     "diff": {
       "version": "5.0.0",
@@ -1187,13 +1202,13 @@
     "emoji-regex": {
       "version": "8.0.0",
       "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
-      "dev": true
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="
     },
     "end-of-stream": {
       "version": "1.4.4",
       "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.4.tgz",
       "integrity": "sha512-+uw1inIHVPQoaVuHzRyXd21icM+cnt4CzD5rW+NC1wjOUSTOs+Te7FOv7AhN7vS9x/oIyhLP5PR1H+phQAHu5Q==",
+      "optional": true,
       "requires": {
         "once": "^1.4.0"
       }
@@ -1231,37 +1246,36 @@
       "dev": true
     },
     "eslint": {
-      "version": "7.32.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-7.32.0.tgz",
-      "integrity": "sha512-VHZ8gX+EDfz+97jGcgyGCyRia/dPOd6Xh9yPv8Bl1+SoaIwD+a/vlrOmGRUyOYu7MwUhc7CxqeaDZU13S4+EpA==",
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.1.0.tgz",
+      "integrity": "sha512-JZvNneArGSUsluHWJ8g8MMs3CfIEzwaLx9KyH4tZ2i+R2/rPWzL8c0zg3rHdwYVpN/1sB9gqnjHwz9HoeJpGHw==",
       "dev": true,
       "requires": {
-        "@babel/code-frame": "7.12.11",
-        "@eslint/eslintrc": "^0.4.3",
-        "@humanwhocodes/config-array": "^0.5.0",
+        "@eslint/eslintrc": "^1.0.3",
+        "@humanwhocodes/config-array": "^0.6.0",
         "ajv": "^6.10.0",
         "chalk": "^4.0.0",
         "cross-spawn": "^7.0.2",
-        "debug": "^4.0.1",
+        "debug": "^4.3.2",
         "doctrine": "^3.0.0",
         "enquirer": "^2.3.5",
         "escape-string-regexp": "^4.0.0",
-        "eslint-scope": "^5.1.1",
-        "eslint-utils": "^2.1.0",
-        "eslint-visitor-keys": "^2.0.0",
-        "espree": "^7.3.1",
+        "eslint-scope": "^6.0.0",
+        "eslint-utils": "^3.0.0",
+        "eslint-visitor-keys": "^3.0.0",
+        "espree": "^9.0.0",
         "esquery": "^1.4.0",
         "esutils": "^2.0.2",
         "fast-deep-equal": "^3.1.3",
         "file-entry-cache": "^6.0.1",
         "functional-red-black-tree": "^1.0.1",
-        "glob-parent": "^5.1.2",
+        "glob-parent": "^6.0.1",
         "globals": "^13.6.0",
         "ignore": "^4.0.6",
         "import-fresh": "^3.0.0",
         "imurmurhash": "^0.1.4",
         "is-glob": "^4.0.0",
-        "js-yaml": "^3.13.1",
+        "js-yaml": "^4.1.0",
         "json-stable-stringify-without-jsonify": "^1.0.1",
         "levn": "^0.4.1",
         "lodash.merge": "^4.6.2",
@@ -1269,20 +1283,51 @@
         "natural-compare": "^1.4.0",
         "optionator": "^0.9.1",
         "progress": "^2.0.0",
-        "regexpp": "^3.1.0",
+        "regexpp": "^3.2.0",
         "semver": "^7.2.1",
         "strip-ansi": "^6.0.0",
         "strip-json-comments": "^3.1.0",
-        "table": "^6.0.9",
         "text-table": "^0.2.0",
         "v8-compile-cache": "^2.0.3"
       },
       "dependencies": {
+        "argparse": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+          "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+          "dev": true
+        },
         "escape-string-regexp": {
           "version": "4.0.0",
           "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
           "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
           "dev": true
+        },
+        "eslint-utils": {
+          "version": "3.0.0",
+          "resolved": "https://registry.npmjs.org/eslint-utils/-/eslint-utils-3.0.0.tgz",
+          "integrity": "sha512-uuQC43IGctw68pJA1RgbQS8/NP7rch6Cwd4j3ZBtgo4/8Flj4eGE7ZYSZRN3iq5pVUv6GPdW5Z1RFleo84uLDA==",
+          "dev": true,
+          "requires": {
+            "eslint-visitor-keys": "^2.0.0"
+          },
+          "dependencies": {
+            "eslint-visitor-keys": {
+              "version": "2.1.0",
+              "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-2.1.0.tgz",
+              "integrity": "sha512-0rSmRBzXgDzIsD6mGdJgevzgezI534Cer5L/vyMX0kHzT/jiB43jRhd9YUlMGYLQy2zprNmoT8qasCGtY+QaKw==",
+              "dev": true
+            }
+          }
+        },
+        "js-yaml": {
+          "version": "4.1.0",
+          "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
+          "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
+          "dev": true,
+          "requires": {
+            "argparse": "^2.0.1"
+          }
         }
       }
     },
@@ -1340,13 +1385,13 @@
       "dev": true
     },
     "eslint-scope": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-5.1.1.tgz",
-      "integrity": "sha512-2NxwbF/hZ0KpepYN0cNbo+FN6XoK7GaHlQhgx/hIZl6Va0bF45RQOOwhLIy8lQDbuCiadSLCBnH2CFYquit5bw==",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-6.0.0.tgz",
+      "integrity": "sha512-uRDL9MWmQCkaFus8RF5K9/L/2fn+80yoW3jkD53l4shjCh26fCtvJGasxjUqP5OT87SYTxCVA3BwTUzuELx9kA==",
       "dev": true,
       "requires": {
         "esrecurse": "^4.3.0",
-        "estraverse": "^4.1.1"
+        "estraverse": "^5.2.0"
       }
     },
     "eslint-utils": {
@@ -1367,28 +1412,20 @@
       }
     },
     "eslint-visitor-keys": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-2.1.0.tgz",
-      "integrity": "sha512-0rSmRBzXgDzIsD6mGdJgevzgezI534Cer5L/vyMX0kHzT/jiB43jRhd9YUlMGYLQy2zprNmoT8qasCGtY+QaKw==",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.0.0.tgz",
+      "integrity": "sha512-mJOZa35trBTb3IyRmo8xmKBZlxf+N7OnUl4+ZhJHs/r+0770Wh/LEACE2pqMGMe27G/4y8P2bYGk4J70IC5k1Q==",
       "dev": true
     },
     "espree": {
-      "version": "7.3.1",
-      "resolved": "https://registry.npmjs.org/espree/-/espree-7.3.1.tgz",
-      "integrity": "sha512-v3JCNCE64umkFpmkFGqzVKsOT0tN1Zr+ueqLZfpV1Ob8e+CEgPWa+OxCoGH3tnhimMKIaBm4m/vaRpJ/krRz2g==",
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/espree/-/espree-9.0.0.tgz",
+      "integrity": "sha512-r5EQJcYZ2oaGbeR0jR0fFVijGOcwai07/690YRXLINuhmVeRY4UKSAsQPe/0BNuDgwP7Ophoc1PRsr2E3tkbdQ==",
       "dev": true,
       "requires": {
-        "acorn": "^7.4.0",
+        "acorn": "^8.5.0",
         "acorn-jsx": "^5.3.1",
-        "eslint-visitor-keys": "^1.3.0"
-      },
-      "dependencies": {
-        "eslint-visitor-keys": {
-          "version": "1.3.0",
-          "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-1.3.0.tgz",
-          "integrity": "sha512-6J72N8UNa462wa/KFODt/PJ3IU60SDpC3QXC1Hjc1BXXpfL2C9R5+AU7jhe0F6GREqVMh4Juu+NY7xn+6dipUQ==",
-          "dev": true
-        }
+        "eslint-visitor-keys": "^3.0.0"
       }
     },
     "esprima": {
@@ -1404,14 +1441,6 @@
       "dev": true,
       "requires": {
         "estraverse": "^5.1.0"
-      },
-      "dependencies": {
-        "estraverse": {
-          "version": "5.2.0",
-          "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.2.0.tgz",
-          "integrity": "sha512-BxbNGGNm0RyRYvUdHpIwv9IWzeM9XClbOxwoATuFdOE7ZE6wHL+HQ5T8hoPM+zHvmKzzsEqhgy0GrQ5X13afiQ==",
-          "dev": true
-        }
       }
     },
     "esrecurse": {
@@ -1421,20 +1450,12 @@
       "dev": true,
       "requires": {
         "estraverse": "^5.2.0"
-      },
-      "dependencies": {
-        "estraverse": {
-          "version": "5.2.0",
-          "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.2.0.tgz",
-          "integrity": "sha512-BxbNGGNm0RyRYvUdHpIwv9IWzeM9XClbOxwoATuFdOE7ZE6wHL+HQ5T8hoPM+zHvmKzzsEqhgy0GrQ5X13afiQ==",
-          "dev": true
-        }
       }
     },
     "estraverse": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-4.3.0.tgz",
-      "integrity": "sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw==",
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.2.0.tgz",
+      "integrity": "sha512-BxbNGGNm0RyRYvUdHpIwv9IWzeM9XClbOxwoATuFdOE7ZE6wHL+HQ5T8hoPM+zHvmKzzsEqhgy0GrQ5X13afiQ==",
       "dev": true
     },
     "esutils": {
@@ -1446,7 +1467,8 @@
     "expand-template": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
-      "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg=="
+      "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==",
+      "optional": true
     },
     "fast-deep-equal": {
       "version": "3.1.3",
@@ -1494,7 +1516,8 @@
     "file-uri-to-path": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
-      "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw=="
+      "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==",
+      "optional": true
     },
     "fill-range": {
       "version": "7.0.1",
@@ -1572,12 +1595,14 @@
     "fs-constants": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
-      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow=="
+      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==",
+      "optional": true
     },
     "fs-minipass": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-2.1.0.tgz",
       "integrity": "sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==",
+      "optional": true,
       "requires": {
         "minipass": "^3.0.0"
       }
@@ -1610,6 +1635,7 @@
       "version": "2.7.4",
       "resolved": "https://registry.npmjs.org/gauge/-/gauge-2.7.4.tgz",
       "integrity": "sha1-LANAXHU4w51+s3sxcCLjJfsBi/c=",
+      "optional": true,
       "requires": {
         "aproba": "^1.0.3",
         "console-control-strings": "^1.0.0",
@@ -1624,12 +1650,14 @@
         "ansi-regex": {
           "version": "2.1.1",
           "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-2.1.1.tgz",
-          "integrity": "sha1-w7M6te42DYbg5ijwRorn7yfWVN8="
+          "integrity": "sha1-w7M6te42DYbg5ijwRorn7yfWVN8=",
+          "optional": true
         },
         "is-fullwidth-code-point": {
           "version": "1.0.0",
           "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-1.0.0.tgz",
           "integrity": "sha1-754xOG8DGn8NZDr4L95QxFfvAMs=",
+          "optional": true,
           "requires": {
             "number-is-nan": "^1.0.0"
           }
@@ -1638,6 +1666,7 @@
           "version": "1.0.2",
           "resolved": "https://registry.npmjs.org/string-width/-/string-width-1.0.2.tgz",
           "integrity": "sha1-EYvfW4zcUaKn5w0hHgfisLmxB9M=",
+          "optional": true,
           "requires": {
             "code-point-at": "^1.0.0",
             "is-fullwidth-code-point": "^1.0.0",
@@ -1648,6 +1677,7 @@
           "version": "3.0.1",
           "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-3.0.1.tgz",
           "integrity": "sha1-ajhfuIU9lS1f8F0Oiq+UJ43GPc8=",
+          "optional": true,
           "requires": {
             "ansi-regex": "^2.0.0"
           }
@@ -1663,8 +1693,7 @@
     "get-caller-file": {
       "version": "2.0.5",
       "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz",
-      "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==",
-      "dev": true
+      "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg=="
     },
     "get-package-type": {
       "version": "0.1.0",
@@ -1675,7 +1704,8 @@
     "github-from-package": {
       "version": "0.0.0",
       "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
-      "integrity": "sha1-l/tdlr/eiXMxPyDoKI75oWf6ZM4="
+      "integrity": "sha1-l/tdlr/eiXMxPyDoKI75oWf6ZM4=",
+      "optional": true
     },
     "glob": {
       "version": "7.1.7",
@@ -1691,18 +1721,18 @@
       }
     },
     "glob-parent": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
-      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
+      "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==",
       "dev": true,
       "requires": {
-        "is-glob": "^4.0.1"
+        "is-glob": "^4.0.3"
       }
     },
     "globals": {
-      "version": "13.10.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-13.10.0.tgz",
-      "integrity": "sha512-piHC3blgLGFjvOuMmWZX60f+na1lXFDhQXBf1UYp2fXPXqvEUbOhNwi6BsQ0bQishwedgnjkwv1d9zKf+MWw3g==",
+      "version": "13.11.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-13.11.0.tgz",
+      "integrity": "sha512-08/xrJ7wQjK9kkkRoI3OFUBbLx4f+6x3SGwcPvQ0QH6goFDrOU2oyAWrmh3dJezu65buo+HBMzAMQy6rovVC3g==",
       "dev": true,
       "requires": {
         "type-fest": "^0.20.2"
@@ -1746,7 +1776,8 @@
     "has-unicode": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/has-unicode/-/has-unicode-2.0.1.tgz",
-      "integrity": "sha1-4Ob+aijPUROIVeCG0Wkedx3iqLk="
+      "integrity": "sha1-4Ob+aijPUROIVeCG0Wkedx3iqLk=",
+      "optional": true
     },
     "hasha": {
       "version": "5.2.2",
@@ -1785,6 +1816,7 @@
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.0.tgz",
       "integrity": "sha512-EkYm5BcKUGiduxzSt3Eppko+PiNWNEpa4ySk9vTC6wDsQJW9rHSa+UhGNJoRYp7bz6Ht1eaRIa6QaJqO5rCFbA==",
+      "optional": true,
       "requires": {
         "agent-base": "6",
         "debug": "4"
@@ -1798,7 +1830,8 @@
     "ieee754": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
-      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA=="
+      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
+      "optional": true
     },
     "ignore": {
       "version": "4.0.6",
@@ -1845,7 +1878,8 @@
     "ini": {
       "version": "1.3.8",
       "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
-      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew=="
+      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
+      "optional": true
     },
     "is-binary-path": {
       "version": "2.1.0",
@@ -1874,13 +1908,12 @@
     "is-fullwidth-code-point": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
-      "dev": true
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="
     },
     "is-glob": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.1.tgz",
-      "integrity": "sha512-5G0tKtBTFImOqDnLB2hG6Bp2qcKEFduo4tZu9MT/H6NQv/ghhy30o55ufafxJ/LdH79LLs2Kfrn85TLKyA7BUg==",
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
+      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
       "dev": true,
       "requires": {
         "is-extglob": "^2.1.1"
@@ -2113,12 +2146,6 @@
       "resolved": "https://registry.npmjs.org/lodash.assign/-/lodash.assign-4.2.0.tgz",
       "integrity": "sha1-DZnzzNem0mHRm9rrkkUAXShYCOc="
     },
-    "lodash.clonedeep": {
-      "version": "4.5.0",
-      "resolved": "https://registry.npmjs.org/lodash.clonedeep/-/lodash.clonedeep-4.5.0.tgz",
-      "integrity": "sha1-4j8/nE+Pvd6HJSnBBxhXoIblzO8=",
-      "dev": true
-    },
     "lodash.flattendeep": {
       "version": "4.4.0",
       "resolved": "https://registry.npmjs.org/lodash.flattendeep/-/lodash.flattendeep-4.4.0.tgz",
@@ -2141,12 +2168,6 @@
       "integrity": "sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==",
       "dev": true
     },
-    "lodash.truncate": {
-      "version": "4.4.2",
-      "resolved": "https://registry.npmjs.org/lodash.truncate/-/lodash.truncate-4.4.2.tgz",
-      "integrity": "sha1-WjUNoLERO4N+z//VgSy+WNbq4ZM=",
-      "dev": true
-    },
     "lodash.uniq": {
       "version": "4.5.0",
       "resolved": "https://registry.npmjs.org/lodash.uniq/-/lodash.uniq-4.5.0.tgz",
@@ -2185,15 +2206,24 @@
         }
       }
     },
+    "microformats-parser": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/microformats-parser/-/microformats-parser-1.4.0.tgz",
+      "integrity": "sha512-8WBt/LzCxswJw9G5K43LtCN4eNwpNaXLddrjW2DjIf8jLkDcy56gQvxavqlEMcR6tAyPdSrj8fyt+gNTTgFdAg==",
+      "requires": {
+        "parse5": "^6.0.0"
+      }
+    },
     "mime-db": {
-      "version": "1.49.0",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.49.0.tgz",
-      "integrity": "sha512-CIc8j9URtOVApSFCQIF+VBkX1RwXp/oMMOrqdyXSBXq5RWNEsRfyj1kiRnQgmNXmHxPoFIxOroKA3zcU9P+nAA=="
+      "version": "1.50.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.50.0.tgz",
+      "integrity": "sha512-9tMZCDlYHqeERXEHO9f/hKfNXhre5dK2eE/krIvUjZbS2KPcqGDfNShIWS1uW9XOTKQKqK6qbeOci18rbfW77A=="
     },
     "mimic-response": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-2.1.0.tgz",
-      "integrity": "sha512-wXqjST+SLt7R009ySCglWBCFpjUygmCIfD790/kVbiGmUgfYGuB14PiTd5DwVxSV4NcYHjzMkoj5LjQZwTQLEA=="
+      "integrity": "sha512-wXqjST+SLt7R009ySCglWBCFpjUygmCIfD790/kVbiGmUgfYGuB14PiTd5DwVxSV4NcYHjzMkoj5LjQZwTQLEA==",
+      "optional": true
     },
     "minimatch": {
       "version": "3.0.4",
@@ -2212,6 +2242,7 @@
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.1.3.tgz",
       "integrity": "sha512-Mgd2GdMVzY+x3IJ+oHnVM+KG3lA5c8tnabyJKmHSaG2kAGpudxuOf8ToDkhumF7UzME7DecbQE9uOZhNm7PuJg==",
+      "optional": true,
       "requires": {
         "yallist": "^4.0.0"
       }
@@ -2220,6 +2251,7 @@
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-2.1.2.tgz",
       "integrity": "sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg==",
+      "optional": true,
       "requires": {
         "minipass": "^3.0.0",
         "yallist": "^4.0.0"
@@ -2228,17 +2260,19 @@
     "mkdirp": {
       "version": "1.0.4",
       "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz",
-      "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw=="
+      "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==",
+      "optional": true
     },
     "mkdirp-classic": {
       "version": "0.5.3",
       "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
-      "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A=="
+      "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==",
+      "optional": true
     },
     "mocha": {
-      "version": "9.1.2",
-      "resolved": "https://registry.npmjs.org/mocha/-/mocha-9.1.2.tgz",
-      "integrity": "sha512-ta3LtJ+63RIBP03VBjMGtSqbe6cWXRejF9SyM9Zyli1CKZJZ+vfCTj3oW24V7wAphMJdpOFLoMI3hjJ1LWbs0w==",
+      "version": "9.1.3",
+      "resolved": "https://registry.npmjs.org/mocha/-/mocha-9.1.3.tgz",
+      "integrity": "sha512-Xcpl9FqXOAYqI3j79pEtHBBnQgVXIhpULjGQa7DVb0Po+VzmSIK9kanAiWLHoRR/dbZ2qpdPshuXr8l1VaHCzw==",
       "dev": true,
       "requires": {
         "@ungap/promise-all-settled": "1.1.2",
@@ -2336,7 +2370,8 @@
     "napi-build-utils": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-1.0.2.tgz",
-      "integrity": "sha512-ONmRUqK7zj7DWX0D9ADe03wbwOBZxNAfF20PlGfCWQcD3+/MakShIHrMqx9YwPTfxDdF1zLeL+RGZiR9kGMLdg=="
+      "integrity": "sha512-ONmRUqK7zj7DWX0D9ADe03wbwOBZxNAfF20PlGfCWQcD3+/MakShIHrMqx9YwPTfxDdF1zLeL+RGZiR9kGMLdg==",
+      "optional": true
     },
     "natural-compare": {
       "version": "1.4.0",
@@ -2361,6 +2396,7 @@
       "version": "2.30.0",
       "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-2.30.0.tgz",
       "integrity": "sha512-g6bZh3YCKQRdwuO/tSZZYJAw622SjsRfJ2X0Iy4sSOHZ34/sPPdVBn8fev2tj7njzLwuqPw9uMtGsGkO5kIQvg==",
+      "optional": true,
       "requires": {
         "semver": "^5.4.1"
       },
@@ -2368,19 +2404,173 @@
         "semver": {
           "version": "5.7.1",
           "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz",
-          "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ=="
+          "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==",
+          "optional": true
         }
       }
     },
     "node-addon-api": {
       "version": "3.2.1",
       "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-3.2.1.tgz",
-      "integrity": "sha512-mmcei9JghVNDYydghQmeDX8KoAm0FAiYyIcUt/N4nhyAipB17pllZQDOJD2fotxABnt4Mdz+dKTO7eftLg4d0A=="
+      "integrity": "sha512-mmcei9JghVNDYydghQmeDX8KoAm0FAiYyIcUt/N4nhyAipB17pllZQDOJD2fotxABnt4Mdz+dKTO7eftLg4d0A==",
+      "optional": true
     },
     "node-fetch": {
       "version": "2.6.1",
       "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.1.tgz",
-      "integrity": "sha512-V4aYg89jEoVRxRb2fJdAg8FHvI7cEyYdVAh94HH0UIK8oJxUfkjlDQN9RbMx+bEjP7+ggMiFRprSti032Oipxw=="
+      "integrity": "sha512-V4aYg89jEoVRxRb2fJdAg8FHvI7cEyYdVAh94HH0UIK8oJxUfkjlDQN9RbMx+bEjP7+ggMiFRprSti032Oipxw==",
+      "optional": true
+    },
+    "node-linux-pam": {
+      "version": "0.2.1",
+      "resolved": "https://registry.npmjs.org/node-linux-pam/-/node-linux-pam-0.2.1.tgz",
+      "integrity": "sha512-OeMZW0Bs1bffsvXI/bJQbU0rkiWTOo0ceT6+mrbU84TJ33vAKykIZrLI+ApfRqkBQW5jzW5rJ7x+NSyToafqig==",
+      "optional": true,
+      "requires": {
+        "@mapbox/node-pre-gyp": "1.0.5",
+        "bindings": "1.5.0",
+        "node-addon-api": "3.1.0",
+        "string-template": "1.0.0",
+        "yargs": "15.4.1"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "optional": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "camelcase": {
+          "version": "5.3.1",
+          "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz",
+          "integrity": "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==",
+          "optional": true
+        },
+        "cliui": {
+          "version": "6.0.0",
+          "resolved": "https://registry.npmjs.org/cliui/-/cliui-6.0.0.tgz",
+          "integrity": "sha512-t6wbgtoCXvAzst7QgXxJYqPt0usEfbgQdftEPbLL/cvv6HPE5VgvqCuAIDR0NgU52ds6rFwqrgakNLrHEjCbrQ==",
+          "optional": true,
+          "requires": {
+            "string-width": "^4.2.0",
+            "strip-ansi": "^6.0.0",
+            "wrap-ansi": "^6.2.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "optional": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "optional": true
+        },
+        "decamelize": {
+          "version": "1.2.0",
+          "resolved": "https://registry.npmjs.org/decamelize/-/decamelize-1.2.0.tgz",
+          "integrity": "sha1-9lNNFRSCabIDUue+4m9QH5oZEpA=",
+          "optional": true
+        },
+        "find-up": {
+          "version": "4.1.0",
+          "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz",
+          "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
+          "optional": true,
+          "requires": {
+            "locate-path": "^5.0.0",
+            "path-exists": "^4.0.0"
+          }
+        },
+        "locate-path": {
+          "version": "5.0.0",
+          "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz",
+          "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
+          "optional": true,
+          "requires": {
+            "p-locate": "^4.1.0"
+          }
+        },
+        "node-addon-api": {
+          "version": "3.1.0",
+          "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-3.1.0.tgz",
+          "integrity": "sha512-flmrDNB06LIl5lywUz7YlNGZH/5p0M7W28k8hzd9Lshtdh1wshD2Y+U4h9LD6KObOy1f+fEVdgprPrEymjM5uw==",
+          "optional": true
+        },
+        "p-limit": {
+          "version": "2.3.0",
+          "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz",
+          "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
+          "optional": true,
+          "requires": {
+            "p-try": "^2.0.0"
+          }
+        },
+        "p-locate": {
+          "version": "4.1.0",
+          "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz",
+          "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
+          "optional": true,
+          "requires": {
+            "p-limit": "^2.2.0"
+          }
+        },
+        "wrap-ansi": {
+          "version": "6.2.0",
+          "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-6.2.0.tgz",
+          "integrity": "sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==",
+          "optional": true,
+          "requires": {
+            "ansi-styles": "^4.0.0",
+            "string-width": "^4.1.0",
+            "strip-ansi": "^6.0.0"
+          }
+        },
+        "y18n": {
+          "version": "4.0.3",
+          "resolved": "https://registry.npmjs.org/y18n/-/y18n-4.0.3.tgz",
+          "integrity": "sha512-JKhqTOwSrqNA1NY5lSztJ1GrBiUodLMmIZuLiDaMRJ+itFd+ABVE8XBjOvIWL+rSqNDC74LCSFmlb/U4UZ4hJQ==",
+          "optional": true
+        },
+        "yargs": {
+          "version": "15.4.1",
+          "resolved": "https://registry.npmjs.org/yargs/-/yargs-15.4.1.tgz",
+          "integrity": "sha512-aePbxDmcYW++PaqBsJ+HYUFwCdv4LVvdnhBy78E57PIor8/OVvhMrADFFEDh8DHDFRv/O9i3lPhsENjO7QX0+A==",
+          "optional": true,
+          "requires": {
+            "cliui": "^6.0.0",
+            "decamelize": "^1.2.0",
+            "find-up": "^4.1.0",
+            "get-caller-file": "^2.0.1",
+            "require-directory": "^2.1.1",
+            "require-main-filename": "^2.0.0",
+            "set-blocking": "^2.0.0",
+            "string-width": "^4.2.0",
+            "which-module": "^2.0.0",
+            "y18n": "^4.0.0",
+            "yargs-parser": "^18.1.2"
+          }
+        },
+        "yargs-parser": {
+          "version": "18.1.3",
+          "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-18.1.3.tgz",
+          "integrity": "sha512-o50j0JeToy/4K6OZcaQmW6lyXXKhq7csREXcDwk2omFPJEwUNOVtJKvmDr9EI1fAJZUyZcRF7kxGBWmRXudrCQ==",
+          "optional": true,
+          "requires": {
+            "camelcase": "^5.0.0",
+            "decamelize": "^1.2.0"
+          }
+        }
+      }
     },
     "node-preload": {
       "version": "0.2.1",
@@ -2401,6 +2591,7 @@
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/nopt/-/nopt-5.0.0.tgz",
       "integrity": "sha512-Tbj67rffqceeLpcRXrT7vKAN8CwfPeIBgM7E6iBkmKLV7bEMwpGgYLGv0jACUsECaa/vuxP0IjEont6umdMgtQ==",
+      "optional": true,
       "requires": {
         "abbrev": "1"
       }
@@ -2415,6 +2606,7 @@
       "version": "4.1.2",
       "resolved": "https://registry.npmjs.org/npmlog/-/npmlog-4.1.2.tgz",
       "integrity": "sha512-2uUqazuKlTaSI/dC8AzicUck7+IrEaOnN/e0jd3Xtt1KcGpwx30v50mL7oPyr/h9bL3E4aZccVwpwP+5W9Vjkg==",
+      "optional": true,
       "requires": {
         "are-we-there-yet": "~1.1.2",
         "console-control-strings": "~1.1.0",
@@ -2425,7 +2617,8 @@
     "number-is-nan": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/number-is-nan/-/number-is-nan-1.0.1.tgz",
-      "integrity": "sha1-CXtgK1NCKlIsGvuHkDGDNpQaAR0="
+      "integrity": "sha1-CXtgK1NCKlIsGvuHkDGDNpQaAR0=",
+      "optional": true
     },
     "nyc": {
       "version": "15.1.0",
@@ -2603,7 +2796,8 @@
     "object-assign": {
       "version": "4.1.1",
       "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
-      "integrity": "sha1-IQmtx5ZYh8/AXLvUQsrIv7s2CGM="
+      "integrity": "sha1-IQmtx5ZYh8/AXLvUQsrIv7s2CGM=",
+      "optional": true
     },
     "once": {
       "version": "1.4.0",
@@ -2616,7 +2810,8 @@
     "opencollective-postinstall": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/opencollective-postinstall/-/opencollective-postinstall-2.0.3.tgz",
-      "integrity": "sha512-8AV/sCtuzUeTo8gQK5qDZzARrulB3egtLzFgteqB2tcT4Mw7B8Kt7JcDHmltjz6FOAHsvTevk70gZEbhM4ZS9Q=="
+      "integrity": "sha512-8AV/sCtuzUeTo8gQK5qDZzARrulB3egtLzFgteqB2tcT4Mw7B8Kt7JcDHmltjz6FOAHsvTevk70gZEbhM4ZS9Q==",
+      "optional": true
     },
     "optionator": {
       "version": "0.9.1",
@@ -2668,8 +2863,7 @@
     "p-try": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz",
-      "integrity": "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==",
-      "dev": true
+      "integrity": "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ=="
     },
     "package-hash": {
       "version": "4.0.0",
@@ -2686,7 +2880,8 @@
     "packet-reader": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/packet-reader/-/packet-reader-1.0.0.tgz",
-      "integrity": "sha512-HAKu/fG3HpHFO0AA8WE8q2g+gBJaZ9MG7fcKk+IJPLTGAD6Psw4443l+9DGRbOIh3/aXr7Phy0TjilYivJo5XQ=="
+      "integrity": "sha512-HAKu/fG3HpHFO0AA8WE8q2g+gBJaZ9MG7fcKk+IJPLTGAD6Psw4443l+9DGRbOIh3/aXr7Phy0TjilYivJo5XQ==",
+      "optional": true
     },
     "parent-module": {
       "version": "1.0.1",
@@ -2697,11 +2892,15 @@
         "callsites": "^3.0.0"
       }
     },
+    "parse5": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/parse5/-/parse5-6.0.1.tgz",
+      "integrity": "sha512-Ofn/CTFzRGTTxwpNEs9PP93gXShHcTq255nzRYSKe8AkVpZY7e1fpmTfOyoIvjP5HG7Z2ZM7VS9PPhQGW2pOpw=="
+    },
     "path-exists": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
-      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
-      "dev": true
+      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w=="
     },
     "path-is-absolute": {
       "version": "1.0.1",
@@ -2741,6 +2940,7 @@
       "version": "8.7.1",
       "resolved": "https://registry.npmjs.org/pg/-/pg-8.7.1.tgz",
       "integrity": "sha512-7bdYcv7V6U3KAtWjpQJJBww0UEsWuh4yQ/EjNf2HeO/NnvKjpvhEIe/A/TleP6wtmSKnUnghs5A9jUoK6iDdkA==",
+      "optional": true,
       "requires": {
         "buffer-writer": "2.0.0",
         "packet-reader": "1.0.0",
@@ -2754,27 +2954,32 @@
     "pg-connection-string": {
       "version": "2.5.0",
       "resolved": "https://registry.npmjs.org/pg-connection-string/-/pg-connection-string-2.5.0.tgz",
-      "integrity": "sha512-r5o/V/ORTA6TmUnyWZR9nCj1klXCO2CEKNRlVuJptZe85QuhFayC7WeMic7ndayT5IRIR0S0xFxFi2ousartlQ=="
+      "integrity": "sha512-r5o/V/ORTA6TmUnyWZR9nCj1klXCO2CEKNRlVuJptZe85QuhFayC7WeMic7ndayT5IRIR0S0xFxFi2ousartlQ==",
+      "optional": true
     },
     "pg-int8": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/pg-int8/-/pg-int8-1.0.1.tgz",
-      "integrity": "sha512-WCtabS6t3c8SkpDBUlb1kjOs7l66xsGdKpIPZsg4wR+B3+u9UAum2odSsF9tnvxg80h4ZxLWMy4pRjOsFIqQpw=="
+      "integrity": "sha512-WCtabS6t3c8SkpDBUlb1kjOs7l66xsGdKpIPZsg4wR+B3+u9UAum2odSsF9tnvxg80h4ZxLWMy4pRjOsFIqQpw==",
+      "optional": true
     },
     "pg-minify": {
       "version": "1.6.2",
       "resolved": "https://registry.npmjs.org/pg-minify/-/pg-minify-1.6.2.tgz",
-      "integrity": "sha512-1KdmFGGTP6jplJoI8MfvRlfvMiyBivMRP7/ffh4a11RUFJ7kC2J0ZHlipoKiH/1hz+DVgceon9U2qbaHpPeyPg=="
+      "integrity": "sha512-1KdmFGGTP6jplJoI8MfvRlfvMiyBivMRP7/ffh4a11RUFJ7kC2J0ZHlipoKiH/1hz+DVgceon9U2qbaHpPeyPg==",
+      "optional": true
     },
     "pg-pool": {
       "version": "3.4.1",
       "resolved": "https://registry.npmjs.org/pg-pool/-/pg-pool-3.4.1.tgz",
-      "integrity": "sha512-TVHxR/gf3MeJRvchgNHxsYsTCHQ+4wm3VIHSS19z8NC0+gioEhq1okDY1sm/TYbfoP6JLFx01s0ShvZ3puP/iQ=="
+      "integrity": "sha512-TVHxR/gf3MeJRvchgNHxsYsTCHQ+4wm3VIHSS19z8NC0+gioEhq1okDY1sm/TYbfoP6JLFx01s0ShvZ3puP/iQ==",
+      "optional": true
     },
     "pg-promise": {
-      "version": "10.11.0",
-      "resolved": "https://registry.npmjs.org/pg-promise/-/pg-promise-10.11.0.tgz",
-      "integrity": "sha512-UntgHZNv+gpGJKhh+tzGSGHLkniKWV+ZQ8/SNdtvElsg9Aa7ZJ4Fgyl6pl2x0ZtJ7uFNy+OIq3Z+Ei6iplqTDQ==",
+      "version": "10.11.1",
+      "resolved": "https://registry.npmjs.org/pg-promise/-/pg-promise-10.11.1.tgz",
+      "integrity": "sha512-HAv32WSKf2m2RqHerW5RmANn/mcXIwWXbg/gOfGQcoS0SE+8iBi3Jj4JmoR4PNzSEozo/y/npy4e6F16psOItw==",
+      "optional": true,
       "requires": {
         "assert-options": "0.7.0",
         "pg": "8.7.1",
@@ -2785,12 +2990,14 @@
     "pg-protocol": {
       "version": "1.5.0",
       "resolved": "https://registry.npmjs.org/pg-protocol/-/pg-protocol-1.5.0.tgz",
-      "integrity": "sha512-muRttij7H8TqRNu/DxrAJQITO4Ac7RmX3Klyr/9mJEOBeIpgnF8f9jAfRz5d3XwQZl5qBjF9gLsUtMPJE0vezQ=="
+      "integrity": "sha512-muRttij7H8TqRNu/DxrAJQITO4Ac7RmX3Klyr/9mJEOBeIpgnF8f9jAfRz5d3XwQZl5qBjF9gLsUtMPJE0vezQ==",
+      "optional": true
     },
     "pg-types": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/pg-types/-/pg-types-2.2.0.tgz",
       "integrity": "sha512-qTAAlrEsl8s4OiEQY69wDvcMIdQN6wdz5ojQiOy6YRMuynxenON0O5oCpJI6lshc6scgAY8qvJ2On/p+CXY0GA==",
+      "optional": true,
       "requires": {
         "pg-int8": "1.0.1",
         "postgres-array": "~2.0.0",
@@ -2803,6 +3010,7 @@
       "version": "1.0.4",
       "resolved": "https://registry.npmjs.org/pgpass/-/pgpass-1.0.4.tgz",
       "integrity": "sha512-YmuA56alyBq7M59vxVBfPJrGSozru8QAdoNlWuW3cz8l+UX3cWge0vTvjKhsSHSJpo3Bom8/Mm6hf0TR5GY0+w==",
+      "optional": true,
       "requires": {
         "split2": "^3.1.1"
       }
@@ -2864,22 +3072,26 @@
     "postgres-array": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/postgres-array/-/postgres-array-2.0.0.tgz",
-      "integrity": "sha512-VpZrUqU5A69eQyW2c5CA1jtLecCsN2U/bD6VilrFDWq5+5UIEVO7nazS3TEcHf1zuPYO/sqGvUvW62g86RXZuA=="
+      "integrity": "sha512-VpZrUqU5A69eQyW2c5CA1jtLecCsN2U/bD6VilrFDWq5+5UIEVO7nazS3TEcHf1zuPYO/sqGvUvW62g86RXZuA==",
+      "optional": true
     },
     "postgres-bytea": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/postgres-bytea/-/postgres-bytea-1.0.0.tgz",
-      "integrity": "sha1-AntTPAqokOJtFy1Hz5zOzFIazTU="
+      "integrity": "sha1-AntTPAqokOJtFy1Hz5zOzFIazTU=",
+      "optional": true
     },
     "postgres-date": {
       "version": "1.0.7",
       "resolved": "https://registry.npmjs.org/postgres-date/-/postgres-date-1.0.7.tgz",
-      "integrity": "sha512-suDmjLVQg78nMK2UZ454hAG+OAW+HQPZ6n++TNDUX+L0+uUlLywnoxJKDou51Zm+zTCjrCl0Nq6J9C5hP9vK/Q=="
+      "integrity": "sha512-suDmjLVQg78nMK2UZ454hAG+OAW+HQPZ6n++TNDUX+L0+uUlLywnoxJKDou51Zm+zTCjrCl0Nq6J9C5hP9vK/Q==",
+      "optional": true
     },
     "postgres-interval": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/postgres-interval/-/postgres-interval-1.2.0.tgz",
       "integrity": "sha512-9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ==",
+      "optional": true,
       "requires": {
         "xtend": "^4.0.0"
       }
@@ -2952,6 +3164,7 @@
       "version": "6.1.3",
       "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-6.1.3.tgz",
       "integrity": "sha512-iqqSR84tNYQUQHRXalSKdIaM8Ov1QxOVuBNWI7+BzZWv6Ih9k75wOnH1rGQ9WWTaaLkTpxWKIciOF0KyfM74+Q==",
+      "optional": true,
       "requires": {
         "detect-libc": "^1.0.3",
         "expand-template": "^2.0.3",
@@ -3004,6 +3217,7 @@
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.0.tgz",
       "integrity": "sha512-LwZy+p3SFs1Pytd/jYct4wpv49HiYCqd9Rlc5ZVdk0V+8Yzv6jR5Blk3TRmPL1ft69TxP0IMZGJ+WPFU2BFhww==",
+      "optional": true,
       "requires": {
         "end-of-stream": "^1.1.0",
         "once": "^1.3.1"
@@ -3028,6 +3242,7 @@
       "version": "1.2.8",
       "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
       "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
+      "optional": true,
       "requires": {
         "deep-extend": "^0.6.0",
         "ini": "~1.3.0",
@@ -3038,7 +3253,8 @@
         "strip-json-comments": {
           "version": "2.0.1",
           "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
-          "integrity": "sha1-PFMZQukIwml8DsNEhYwobHygpgo="
+          "integrity": "sha1-PFMZQukIwml8DsNEhYwobHygpgo=",
+          "optional": true
         }
       }
     },
@@ -3098,20 +3314,12 @@
     "require-directory": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz",
-      "integrity": "sha1-jGStX9MNqxyXbiNE/+f3kqam30I=",
-      "dev": true
-    },
-    "require-from-string": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
-      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
-      "dev": true
+      "integrity": "sha1-jGStX9MNqxyXbiNE/+f3kqam30I="
     },
     "require-main-filename": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/require-main-filename/-/require-main-filename-2.0.0.tgz",
-      "integrity": "sha512-NKN5kMDylKuldxYLSUfrbo5Tuzh4hd+2E8NPPX02mZtn1VuREQToYe/ZdlJy+J3uCpfaiGF05e7B8W0iXbQHmg==",
-      "dev": true
+      "integrity": "sha512-NKN5kMDylKuldxYLSUfrbo5Tuzh4hd+2E8NPPX02mZtn1VuREQToYe/ZdlJy+J3uCpfaiGF05e7B8W0iXbQHmg=="
     },
     "resolve": {
       "version": "1.20.0",
@@ -3207,12 +3415,14 @@
     "simple-concat": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz",
-      "integrity": "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q=="
+      "integrity": "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==",
+      "optional": true
     },
     "simple-get": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-3.1.0.tgz",
       "integrity": "sha512-bCR6cP+aTdScaQCnQKbPKtJOKDp/hj9EDLJo3Nw4y1QksqaovlW/bnptB6/c1e+qmNIDHRK+oXFDdEqBT8WzUA==",
+      "optional": true,
       "requires": {
         "decompress-response": "^4.2.0",
         "once": "^1.3.1",
@@ -3250,43 +3460,6 @@
         }
       }
     },
-    "slice-ansi": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-4.0.0.tgz",
-      "integrity": "sha512-qMCMfhY040cVHT43K9BFygqYbUPFZKHOg7K73mtTWJRb8pyP3fzf4Ixd5SzdEJQ6MRUg/WBnOLxghZtKKurENQ==",
-      "dev": true,
-      "requires": {
-        "ansi-styles": "^4.0.0",
-        "astral-regex": "^2.0.0",
-        "is-fullwidth-code-point": "^3.0.0"
-      },
-      "dependencies": {
-        "ansi-styles": {
-          "version": "4.3.0",
-          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
-          "dev": true,
-          "requires": {
-            "color-convert": "^2.0.1"
-          }
-        },
-        "color-convert": {
-          "version": "2.0.1",
-          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
-          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
-          "dev": true,
-          "requires": {
-            "color-name": "~1.1.4"
-          }
-        },
-        "color-name": {
-          "version": "1.1.4",
-          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
-          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
-          "dev": true
-        }
-      }
-    },
     "source-map": {
       "version": "0.5.7",
       "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.5.7.tgz",
@@ -3320,12 +3493,14 @@
     "spex": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/spex/-/spex-3.2.0.tgz",
-      "integrity": "sha512-9srjJM7NaymrpwMHvSmpDeIK5GoRMX/Tq0E8aOlDPS54dDnDUIp30DrP9SphMPEETDLzEM9+4qo+KipmbtPecg=="
+      "integrity": "sha512-9srjJM7NaymrpwMHvSmpDeIK5GoRMX/Tq0E8aOlDPS54dDnDUIp30DrP9SphMPEETDLzEM9+4qo+KipmbtPecg==",
+      "optional": true
     },
     "split2": {
       "version": "3.2.2",
       "resolved": "https://registry.npmjs.org/split2/-/split2-3.2.2.tgz",
       "integrity": "sha512-9NThjpgZnifTkJpzTZ7Eue85S49QwpNhZTq6GRJwObb6jnLFNGB7Qm73V5HewTROPyxD0C29xqmaI68bQtV+hg==",
+      "optional": true,
       "requires": {
         "readable-stream": "^3.0.0"
       },
@@ -3334,6 +3509,7 @@
           "version": "3.6.0",
           "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.0.tgz",
           "integrity": "sha512-BViHy7LKeTz4oNnkcLJ+lVSL6vpiFeX6/d3oSH8zCW7UxP2onchk+vTGB143xuFjHS3deTgkKoXXymXqymiIdA==",
+          "optional": true,
           "requires": {
             "inherits": "^2.0.3",
             "string_decoder": "^1.1.1",
@@ -3348,11 +3524,16 @@
       "integrity": "sha1-BOaSb2YolTVPPdAVIDYzuFcpfiw=",
       "dev": true
     },
+    "string-template": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/string-template/-/string-template-1.0.0.tgz",
+      "integrity": "sha1-np8iM9wA8hhxjsN5oopWc+zKi5Y=",
+      "optional": true
+    },
     "string-width": {
       "version": "4.2.2",
       "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.2.tgz",
       "integrity": "sha512-XBJbT3N4JhVumXE0eoLU9DCjcaF92KLNqTmFCnG1pf8duUxFGwtP6AD6nkjw9a3IdiRtL3E2w3JDiE/xi3vOeA==",
-      "dev": true,
       "requires": {
         "emoji-regex": "^8.0.0",
         "is-fullwidth-code-point": "^3.0.0",
@@ -3363,6 +3544,7 @@
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
       "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "optional": true,
       "requires": {
         "safe-buffer": "~5.2.0"
       }
@@ -3371,7 +3553,6 @@
       "version": "6.0.0",
       "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.0.tgz",
       "integrity": "sha512-AuvKTrTfQNYNIctbR1K/YGTR1756GycPsg7b9bdV9Duqur4gv6aKqHXah67Z8ImS7WEz5QVcOtlfW2rZEugt6w==",
-      "dev": true,
       "requires": {
         "ansi-regex": "^5.0.0"
       }
@@ -3397,44 +3578,11 @@
         "has-flag": "^3.0.0"
       }
     },
-    "table": {
-      "version": "6.7.1",
-      "resolved": "https://registry.npmjs.org/table/-/table-6.7.1.tgz",
-      "integrity": "sha512-ZGum47Yi6KOOFDE8m223td53ath2enHcYLgOCjGr5ngu8bdIARQk6mN/wRMv4yMRcHnCSnHbCEha4sobQx5yWg==",
-      "dev": true,
-      "requires": {
-        "ajv": "^8.0.1",
-        "lodash.clonedeep": "^4.5.0",
-        "lodash.truncate": "^4.4.2",
-        "slice-ansi": "^4.0.0",
-        "string-width": "^4.2.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "dependencies": {
-        "ajv": {
-          "version": "8.6.2",
-          "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.6.2.tgz",
-          "integrity": "sha512-9807RlWAgT564wT+DjeyU5OFMPjmzxVobvDFmNAhY+5zD6A2ly3jDp6sgnfyDtlIQ+7H97oc/DGCzzfu9rjw9w==",
-          "dev": true,
-          "requires": {
-            "fast-deep-equal": "^3.1.1",
-            "json-schema-traverse": "^1.0.0",
-            "require-from-string": "^2.0.2",
-            "uri-js": "^4.2.2"
-          }
-        },
-        "json-schema-traverse": {
-          "version": "1.0.0",
-          "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
-          "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
-          "dev": true
-        }
-      }
-    },
     "tar": {
       "version": "6.1.11",
       "resolved": "https://registry.npmjs.org/tar/-/tar-6.1.11.tgz",
       "integrity": "sha512-an/KZQzQUkZCkuoAA64hM92X0Urb6VpRhAFllDzz44U2mcD5scmT3zBc4VgVpkugF580+DQn8eAFSyoQt0tznA==",
+      "optional": true,
       "requires": {
         "chownr": "^2.0.0",
         "fs-minipass": "^2.0.0",
@@ -3447,7 +3595,8 @@
         "chownr": {
           "version": "2.0.0",
           "resolved": "https://registry.npmjs.org/chownr/-/chownr-2.0.0.tgz",
-          "integrity": "sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ=="
+          "integrity": "sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==",
+          "optional": true
         }
       }
     },
@@ -3455,6 +3604,7 @@
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.1.tgz",
       "integrity": "sha512-V0r2Y9scmbDRLCNex/+hYzvp/zyYjvFbHPNgVTKfQvVrb6guiE/fxP+XblDNR011utopbkex2nM4dHNV6GDsng==",
+      "optional": true,
       "requires": {
         "chownr": "^1.1.1",
         "mkdirp-classic": "^0.5.2",
@@ -3466,6 +3616,7 @@
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
       "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
+      "optional": true,
       "requires": {
         "bl": "^4.0.3",
         "end-of-stream": "^1.4.1",
@@ -3478,6 +3629,7 @@
           "version": "3.6.0",
           "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.0.tgz",
           "integrity": "sha512-BViHy7LKeTz4oNnkcLJ+lVSL6vpiFeX6/d3oSH8zCW7UxP2onchk+vTGB143xuFjHS3deTgkKoXXymXqymiIdA==",
+          "optional": true,
           "requires": {
             "inherits": "^2.0.3",
             "string_decoder": "^1.1.1",
@@ -3522,6 +3674,7 @@
       "version": "0.6.0",
       "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
       "integrity": "sha1-J6XeoGs2sEoKmWZ3SykIaPD8QP0=",
+      "optional": true,
       "requires": {
         "safe-buffer": "^5.0.1"
       }
@@ -3600,13 +3753,13 @@
     "which-module": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/which-module/-/which-module-2.0.0.tgz",
-      "integrity": "sha1-2e8H3Od7mQK4o6j6SzHD4/fm6Ho=",
-      "dev": true
+      "integrity": "sha1-2e8H3Od7mQK4o6j6SzHD4/fm6Ho="
     },
     "wide-align": {
       "version": "1.1.3",
       "resolved": "https://registry.npmjs.org/wide-align/-/wide-align-1.1.3.tgz",
       "integrity": "sha512-QGkOQc8XL6Bt5PwnsExKBPuMKBxnGxWWW3fU55Xt4feHozMUhdUMaBCk290qpm/wG5u/RSKzwdAC4i51YigihA==",
+      "optional": true,
       "requires": {
         "string-width": "^1.0.2 || 2"
       },
@@ -3614,17 +3767,20 @@
         "ansi-regex": {
           "version": "3.0.0",
           "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz",
-          "integrity": "sha1-7QMXwyIGT3lGbAKWa922Bas32Zg="
+          "integrity": "sha1-7QMXwyIGT3lGbAKWa922Bas32Zg=",
+          "optional": true
         },
         "is-fullwidth-code-point": {
           "version": "2.0.0",
           "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-2.0.0.tgz",
-          "integrity": "sha1-o7MKXE8ZkYMWeqq5O+764937ZU8="
+          "integrity": "sha1-o7MKXE8ZkYMWeqq5O+764937ZU8=",
+          "optional": true
         },
         "string-width": {
           "version": "2.1.1",
           "resolved": "https://registry.npmjs.org/string-width/-/string-width-2.1.1.tgz",
           "integrity": "sha512-nOqH59deCq9SRHlxq1Aw85Jnt4w6KvLKqWVik6oA9ZklXLNIOlqg4F2yrT1MVaTjAqvVwdfeZ7w7aCvJD7ugkw==",
+          "optional": true,
           "requires": {
             "is-fullwidth-code-point": "^2.0.0",
             "strip-ansi": "^4.0.0"
@@ -3634,6 +3790,7 @@
           "version": "4.0.0",
           "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-4.0.0.tgz",
           "integrity": "sha1-qEeQIusaw2iocTibY1JixQXuNo8=",
+          "optional": true,
           "requires": {
             "ansi-regex": "^3.0.0"
           }
@@ -3709,7 +3866,8 @@
     "xtend": {
       "version": "4.0.2",
       "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz",
-      "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ=="
+      "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==",
+      "optional": true
     },
     "y18n": {
       "version": "5.0.8",
diff --git a/package.json b/package.json
index 893bb20..8f38d85 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
-  "name": "websub-hub",
-  "version": "1.2.2",
+  "name": "@squeep/websub-hub",
+  "version": "1.3.0",
   "description": "A WebSub Hub server implementation.",
   "main": "server.js",
   "scripts": {
@@ -32,22 +32,27 @@
     "coverage-check"
   ],
   "dependencies": {
-    "@squeep/api-dingus": "git+https://git.squeep.com/squeep-api-dingus/#v1.2.0",
-    "@squeep/web-linking": "git+https://git.squeep.com/squeep-web-linking/#v1.0.0",
-    "argon2": "^0.28.2",
-    "axios": "^0.22.0",
-    "better-sqlite3": "^7.4.3",
+    "@squeep/api-dingus": "git+https://git.squeep.com/squeep-api-dingus/#v1.2.1",
+    "@squeep/indieauth-helper": "git+https://git.squeep.com/squeep-indieauth-helper/#v1.0.0",
+    "@squeep/mystery-box": "git+https://git.squeep.com/squeep-mystery-box/#v1.0.1",
+    "@squeep/web-linking": "git+https://git.squeep.com/squeep-web-linking/#v1.0.1",
+    "axios": "^0.23.0",
     "feedparser": "^2.2.10",
     "htmlparser2": "^7.1.2",
-    "iconv": "^3.0.1",
-    "pg-promise": "^10.11.0"
+    "iconv": "^3.0.1"
+  },
+  "optionalDependencies": {
+    "argon2": "^0.28.2",
+    "better-sqlite3": "^7.4.3",
+    "node-linux-pam": "^0.2.1",
+    "pg-promise": "^10.11.1"
   },
   "devDependencies": {
-    "eslint": "^7.32.0",
+    "eslint": "^8.1.0",
     "eslint-plugin-node": "^11.1.0",
     "eslint-plugin-security": "^1.4.0",
     "eslint-plugin-sonarjs": "^0.10.0",
-    "mocha": "^9.1.2",
+    "mocha": "^9.1.3",
     "mocha-steps": "^1.3.0",
     "nyc": "^15.1.0",
     "pre-commit": "^1.2.2",
diff --git a/src/authenticator.js b/src/authenticator.js
index 7053b56..3a196fc 100644
--- a/src/authenticator.js
+++ b/src/authenticator.js
@@ -1,18 +1,48 @@
 'use strict';
 
-const argon2 = require('argon2');
 const common = require('./common');
 const Enum = require('./enum');
 const Errors = require('./errors');
+const { MysteryBox } = require('@squeep/mystery-box');
 
 const _fileScope = common.fileScope(__filename);
 
 class Authenticator {
+  /**
+   * @param {Console} logger
+   * @param {*} db
+   * @param {Object} options
+   * @param {Object} options.authenticator
+   * @param {String} options.authenticator.basicRealm
+   * @param {Boolean} options.authenticator.secureAuthOnly
+   * @param {String[]} options.authenticator.forbiddenPAMIdentifiers
+   * @param {String[]} options.authenticator.authnEnabled
+   */
   constructor(logger, db, options) {
     this.logger = logger;
     this.db = db;
     this.basicRealm = options.authenticator.basicRealm;
     this.secureAuthOnly = options.authenticator.secureAuthOnly;
+
+    this.authn = {
+      DEBUG_ANY: {},
+    };
+    try {
+      this.authn.argon2 = require('argon2');
+    } catch (e) { /**/ }
+    try {
+      this.authn.pam = require('node-linux-pam');
+      this.forbiddenPAMIdentifiers = options.authenticator.forbiddenPAMIdentifiers;
+    } catch (e) { /**/ }
+
+    this.authnEnabled = Object.keys(this.authn).filter((auth) => options.authenticator.authnEnabled.includes(auth));
+    this.logger.debug(_fileScope('constructor'), 'available mechanisms', { authn: this.authnEnabled });
+
+    if (this.authnEnabled.length === 0) {
+      throw new Error('no authentication mechanisms available');
+    }
+
+    this.mysteryBox = new MysteryBox(logger, options);
   }
 
 
@@ -28,26 +58,74 @@ class Authenticator {
 
     const [identifier, credential] = common.splitFirst(credentials, ':', '');
 
-    let valid = false;
+    return this.isValidIdentifierCredential(identifier, credential, ctx);
+  }
+
+
+  /**
+   * Check local auth entries.
+   * @param {String} identifier
+   * @param {String} credential
+   * @param {Object} ctx
+   */
+  async isValidIdentifierCredential(identifier, credential, ctx) {
+    const _scope = _fileScope('isValidIdentifierCredential');
+    this.logger.debug(_scope, 'called', { identifier, credential: '*'.repeat(credential.length), ctx });
+
+    let isValid = false;
+
     await this.db.context(async (dbCtx) => {
       const authData = await this.db.authenticationGet(dbCtx, identifier);
       if (!authData) {
-        this.logger.debug(_scope, 'failed, invalid authentication id', { ctx });
-        return false;
+        this.logger.debug(_scope, 'failed, invalid identifier', { ctx, identifier });
+      } else {
+        if (authData.credential.startsWith('$argon2')
+        &&  this.authnEnabled.includes('argon2')) {
+          isValid = await this.authn.argon2.verify(authData.credential, credential);
+        } else if (authData.credential.startsWith('$PAM$')
+        &&         this.authnEnabled.includes('pam')) {
+          isValid = this._isValidPAMIdentifier(identifier, credential);
+        } else {
+          this.logger.error(_scope, 'failed, unknown type of stored credential', { identifier, ctx });
+        }
       }
 
-      if (authData.credential.startsWith('$argon2')) {
-        valid = await argon2.verify(authData.credential, credential);
-      } else {
-        this.logger.error(_scope, 'failed, unknown type of stored password hash', { ctx });
+      if (this.authnEnabled.includes('DEBUG_ANY')) {
+        isValid = true;
       }
-      if (valid) {
+
+      if (isValid) {
         ctx.authenticationId = identifier;
         await this.db.authenticationSuccess(dbCtx, identifier);
       }
-    });
+    }); // dbCtx
+
+    return isValid;
+  }
 
-    return valid;
+
+  /**
+   * Check system PAM.
+   * @param {String} identifier
+   * @param {String} credential
+   * @returns {Boolean}
+   */
+  async _isValidPAMIdentifier(identifier, credential) {
+    const _scope = _fileScope('_isValidPAMIdentifier');
+    let isValid = false;
+    if (this.forbiddenPAMIdentifiers.includes(identifier)) {
+      return false;
+    }
+    try {
+      await this.authn.pam.pamAuthenticatePromise({ username: identifier, password: credential });
+      isValid = true;
+    } catch (e) {
+      this.logger.debug(_scope, 'failed', { error: e });
+      if (!(e instanceof this.authn.pam.PamError)) {
+        throw e;
+      }
+    }
+    return isValid;
   }
 
 
@@ -65,7 +143,7 @@ class Authenticator {
     switch (authMethod.toLowerCase()) {
       case 'basic': {
         const credentials = Buffer.from(authString, 'base64').toString('utf-8');
-        return await this.isValidBasic(credentials, ctx);
+        return this.isValidBasic(credentials, ctx);
       }
 
       default:
@@ -85,13 +163,41 @@ class Authenticator {
   }
 
 
+  /**
+   * Attempt to parse a session cookie, and determine if it
+   * contains authenticated user.
+   * Restores ctx.session from cookie data.
+   * @param {Object} ctx
+   * @param {String} cookieHeader
+   * @returns {Boolean}
+   */
+  async isValidCookieAuth(ctx, cookieHeader) {
+    const _scope = _fileScope('isValidCookieAuth');
+    this.logger.debug(_scope, 'called', { ctx, cookieHeader });
+
+    const [ cookieName, cookieValue ] = common.splitFirst(cookieHeader, '=', '');
+    if (cookieName !== 'WSHas') {
+      return false;
+    }
+    try {
+      ctx.session = await this.mysteryBox.unpack(cookieValue);
+      this.logger.debug(_scope, 'unpacked cookie', { ctx });
+      return !!ctx.session.authenticatedProfile || !! ctx.session.authenticatedIdentifier;
+    } catch (e) {
+      this.logger.debug(_scope, 'could not unpack cookie', { error:e, ctx });
+      return false;
+    }
+  }
+
+
   /**
    * Require that a request has valid auth over secure channel, requests if missing.
    * @param {http.ClientRequest} req
    * @param {http.ServerResponse} res
    * @param {Object} ctx
+   * @param {String} loginPath
    */
-  async required(req, res, ctx) {
+  async required(req, res, ctx, loginPath) {
     const _scope = _fileScope('required');
     this.logger.debug(_scope, 'called', { ctx });
 
@@ -100,12 +206,69 @@ class Authenticator {
       throw new Errors.ResponseError(Enum.ErrorResponse.Forbidden, 'authentication required, but connection is insecure; cannot continue');
     }
 
+    const sessionCookie = req.getHeader(Enum.Header.Cookie);
+    if (sessionCookie && await this.isValidCookieAuth(ctx, sessionCookie)) {
+      return true;
+    }
+
     const authData = req.getHeader(Enum.Header.Authorization);
-    if (authData
-    &&  await this.isValidAuthorization(authData, ctx)) {
+    if (authData) {
+      if (await this.isValidAuthorization(authData, ctx)) {
+        return true;
+      }
+      // If they came in trying header auth, let them try again.
+      return this.requestBasic(res);
+    }
+
+    // Otherwise redirect to login.
+    res.statusCode = 302;
+    res.setHeader(Enum.Header.Location, loginPath);
+    res.end();
+
+    return false;
+  }
+
+
+  /**
+   * Require that a request has valid local auth over secure channel, requests if missing.
+   * @param {http.ClientRequest} req
+   * @param {http.ServerResponse} res
+   * @param {Object} ctx
+   * @param {String} loginPath
+   */
+  async requiredLocal(req, res, ctx, loginPath) {
+    const _scope = _fileScope('requiredLocal');
+    this.logger.debug(_scope, 'called', { ctx });
+
+    if (this.secureAuthOnly && ctx.clientProtocol.toLowerCase() !== 'https') {
+      this.logger.debug(_scope, 'rejecting insecure auth', ctx);
+      throw new Errors.ResponseError(Enum.ErrorResponse.Forbidden, 'authentication required, but connection is insecure; cannot continue');
+    }
+
+    // Only accept identifier sessions.
+    const sessionCookie = req.getHeader(Enum.Header.Cookie);
+    if (sessionCookie
+    &&  await this.isValidCookieAuth(ctx, sessionCookie)
+    &&  ctx.session.authenticatedIdentifier) {
       return true;
     }
-    return this.requestBasic(res);
+
+    // Allow header auth
+    const authData = req.getHeader(Enum.Header.Authorization);
+    if (authData) {
+      if (await this.isValidAuthorization(authData, ctx)) {
+        return true;
+      }
+      // If they came in trying header auth, let them try again.
+      return this.requestBasic(res);
+    }
+
+    // Otherwise redirect to login.
+    res.statusCode = 302;
+    res.setHeader(Enum.Header.Location, loginPath);
+    res.end();
+
+    return false;
   }
 
 }
diff --git a/src/communication.js b/src/communication.js
index b112377..03cc670 100644
--- a/src/communication.js
+++ b/src/communication.js
@@ -57,7 +57,7 @@ class Communication {
   static userAgentString(userAgentConfig) {
     // eslint-disable-next-line security/detect-object-injection
     const _conf = (field, def) => (userAgentConfig && field in userAgentConfig) ? userAgentConfig[field] : def;
-    const product = _conf('product', packageName);
+    const product = _conf('product', packageName).split('/').pop();
     const version = _conf('version', packageVersion);
     let implementation = _conf('implementation', Enum.Specification);
     if (implementation) {
diff --git a/src/enum.js b/src/enum.js
index 96f0940..b8eaf3e 100644
--- a/src/enum.js
+++ b/src/enum.js
@@ -15,10 +15,12 @@ const Enum = common.mergeDeep(DingusEnum, {
   
   Header: {
     Authorization: 'Authorization',
+    Cookie: 'Cookie',
     From: 'From',
     LastSeen: 'Last-Seen',
     Link: 'Link',
     Location: 'Location',
+    SetCookie: 'Set-Cookie',
     Signature: 'Signature',
     UserAgent: 'User-Agent',
     WWWAuthenticate: 'WWW-Authenticate',
diff --git a/src/manager.js b/src/manager.js
index 2aa9abc..667fb30 100644
--- a/src/manager.js
+++ b/src/manager.js
@@ -577,6 +577,15 @@ class Manager {
     });
     this.logger.debug(_scope, 'got topics', { topics: ctx.topics });
 
+    // Profile users can only see related topics.
+    if (ctx.session && ctx.session.authenticatedProfile) {
+      const profileUrlObj = new URL(ctx.session.authenticatedProfile);
+      ctx.topics = ctx.topics.filter((topic) => {
+        const topicUrlObj = new URL(topic.url);
+        return (topicUrlObj.hostname === profileUrlObj.hostname);
+      });
+    }
+
     res.end(Template.adminOverviewHTML(ctx, this.options));
     this.logger.info(_scope, 'finished', { ...ctx, topics: ctx.topics.length })
   }
@@ -598,8 +607,18 @@ class Manager {
     });
     this.logger.debug(_scope, 'got topic details', { topic: ctx.topic, subscriptions: ctx.subscriptions });
 
+    // Profile users can only see related topics.
+    if (ctx.session && ctx.session.authenticatedProfile) {
+      const profileUrlObj = new URL(ctx.session.authenticatedProfile);
+      const topicUrlObj = new URL(ctx.topic.url);
+      if (topicUrlObj.hostname !== profileUrlObj.hostname) {
+        ctx.topic = null;
+        ctx.subscriptions = [];
+      }
+    }
+
     res.end(Template.adminTopicDetailsHTML(ctx, this.options));
-    this.logger.info(_scope, 'finished', { ...ctx, subscriptions: ctx.subscriptions.length, topic: ctx.topic.id });
+    this.logger.info(_scope, 'finished', { ...ctx, subscriptions: ctx.subscriptions.length, topic: ctx.topic && ctx.topic.id || ctx.topic });
   }
 
 
diff --git a/src/service.js b/src/service.js
index df56ba0..1d9b8a0 100644
--- a/src/service.js
+++ b/src/service.js
@@ -9,6 +9,7 @@ const { Dingus } = require('@squeep/api-dingus');
 const common = require('./common');
 const Enum = require('./enum');
 const Manager = require('./manager');
+const SessionManager = require('./session-manager');
 const Authenticator = require('./authenticator');
 const path = require('path');
 
@@ -23,7 +24,9 @@ class Service extends Dingus {
 
     this.manager = new Manager(logger, db, options);
     this.authenticator = new Authenticator(logger, db, options);
+    this.sessionManager = new SessionManager(logger, this.authenticator, options);
     this.staticPath = path.join(__dirname, '..', 'static');
+    this.loginPath = `${options.dingus.proxyPrefix}/admin/login`;
 
     // Primary API endpoint
     this.on('POST', '/', this.handlerPostRoot.bind(this));
@@ -57,13 +60,20 @@ class Service extends Dingus {
 
     // Private server-action endpoints
     this.on('POST', '/admin/process', this.handlerPostAdminProcess.bind(this));
+
+    // Admin login
+    this.on(['GET', 'HEAD'], '/admin/login', this.handlerGetAdminLogin.bind(this));
+    this.on(['POST'], '/admin/login', this.handlerPostAdminLogin.bind(this));
+    this.on(['GET'], '/admin/logout', this.handlerGetAdminLogout.bind(this));
+    this.on(['GET'], '/admin/_ia', this.handlerGetAdminIA.bind(this));
+
   }
 
 
   /**
-   * @param {http.ClientRequest} req 
-   * @param {http.ServerResponse} res 
-   * @param {object} ctx 
+   * @param {http.ClientRequest} req
+   * @param {http.ServerResponse} res
+   * @param {Object} ctx
    */
   async handlerPostRoot(req, res, ctx) {
     const _scope = _fileScope('handlerPostRoot');
@@ -77,9 +87,9 @@ class Service extends Dingus {
 
 
   /**
-   * @param {http.ClientRequest} req 
-   * @param {http.ServerResponse} res 
-   * @param {object} ctx 
+   * @param {http.ClientRequest} req
+   * @param {http.ServerResponse} res
+   * @param {Object} ctx
    */
   async handlerGetRoot(req, res, ctx) {
     const _scope = _fileScope('handlerGetRoot');
@@ -97,9 +107,9 @@ class Service extends Dingus {
 
 
   /**
-   * @param {http.ClientRequest} req 
-   * @param {http.ServerResponse} res 
-   * @param {object} ctx 
+   * @param {http.ClientRequest} req
+   * @param {http.ServerResponse} res
+   * @param {Object} ctx
    */
   async handlerGetHealthcheck(req, res, ctx) {
     const _scope = _fileScope('handlerGetHealthcheck');
@@ -116,7 +126,7 @@ class Service extends Dingus {
   /**
    * @param {http.ClientRequest} req
    * @param {http.ServerResponse} res
-   * @param {object} ctx
+   * @param {Object} ctx
    */
   async handlerGetInfo(req, res, ctx) {
     const _scope = _fileScope('handlerGetInfo');
@@ -135,7 +145,7 @@ class Service extends Dingus {
   /**
    * @param {http.ClientRequest} req
    * @param {http.ServerResponse} res
-   * @param {object} ctx
+   * @param {Object} ctx
    */
   async handlerGetAdminOverview(req, res, ctx) {
     const _scope = _fileScope('handlerGetAdminOverview');
@@ -145,7 +155,7 @@ class Service extends Dingus {
 
     this.setResponseType(this.responseTypes, req, res, ctx);
 
-    await this.authenticator.required(req, res, ctx);
+    await this.authenticator.required(req, res, ctx, this.loginPath);
 
     await this.manager.getAdminOverview(res, ctx);
   }
@@ -154,7 +164,7 @@ class Service extends Dingus {
   /**
    * @param {http.ClientRequest} req
    * @param {http.ServerResponse} res
-   * @param {object} ctx
+   * @param {Object} ctx
    */
   async handlerGetAdminTopicDetails(req, res, ctx) {
     const _scope = _fileScope('handlerGetAdminTopicDetails');
@@ -164,7 +174,7 @@ class Service extends Dingus {
 
     this.setResponseType(this.responseTypes, req, res, ctx);
 
-    await this.authenticator.required(req, res, ctx);
+    await this.authenticator.required(req, res, ctx, this.loginPath);
 
     await this.manager.getTopicDetails(res, ctx);
   }
@@ -197,7 +207,7 @@ class Service extends Dingus {
 
     this.setResponseType(this.responseTypes, req, res, ctx);
 
-    await this.authenticator.required(req, res, ctx);
+    await this.authenticator.requiredLocal(req, res, ctx, this.loginPath);
 
     await this.maybeIngestBody(req, res, ctx);
     ctx.method = req.method;
@@ -216,7 +226,7 @@ class Service extends Dingus {
 
     this.setResponseType(this.responseTypes, req, res, ctx);
 
-    await this.authenticator.required(req, res, ctx);
+    await this.authenticator.requiredLocal(req, res, ctx, this.loginPath);
 
     await this.maybeIngestBody(req, res, ctx);
     ctx.method = req.method;
@@ -227,7 +237,7 @@ class Service extends Dingus {
   /**
    * @param {http.ClientRequest} req
    * @param {http.ServerResponse} res
-   * @param {object} ctx
+   * @param {Object} ctx
    */
   async handlerPostAdminProcess(req, res, ctx) {
     const _scope = _fileScope('handlerPostAdminProcess');
@@ -235,10 +245,78 @@ class Service extends Dingus {
 
     this.setResponseType(this.responseTypes, req, res, ctx);
 
-    await this.authenticator.required(req, res, ctx);
+    await this.authenticator.requiredLocal(req, res, ctx, this.loginPath);
 
     await this.manager.processTasks(res, ctx);
   }
+
+
+  /**
+   * @param {http.ClientRequest} req
+   * @param {http.ServerResponse} res
+   * @param {Object} ctx
+   */
+  async handlerGetAdminLogin(req, res, ctx) {
+    const _scope = _fileScope('handlerGetAdminLogin');
+    this.logger.debug(_scope, 'called', { req: common.requestLogData(req), ctx });
+
+    Dingus.setHeadHandler(req, res, ctx);
+
+    this.setResponseType(this.responseTypes, req, res, ctx);
+
+    await this.sessionManager.getAdminLogin(res, ctx);
+  }
+
+
+  /**
+   * @param {http.ClientRequest} req
+   * @param {http.ServerResponse} res
+   * @param {Object} ctx
+   */
+  async handlerPostAdminLogin(req, res, ctx) {
+    const _scope = _fileScope('handlerPostAdminLogin');
+    this.logger.debug(_scope, 'called', { req: common.requestLogData(req), ctx });
+
+    this.setResponseType(this.responseTypes, req, res, ctx);
+
+    await this.maybeIngestBody(req, res, ctx);
+
+    await this.sessionManager.postAdminLogin(res, ctx);
+  }
+
+
+  /**
+   * @param {http.ClientRequest} req
+   * @param {http.ServerResponse} res
+   * @param {Object} ctx
+   */
+  async handlerGetAdminLogout(req, res, ctx) {
+    const _scope = _fileScope('handlerGetAdminLogout');
+    this.logger.debug(_scope, 'called', { req: common.requestLogData(req), ctx });
+
+    this.setResponseType(this.responseTypes, req, res, ctx);
+
+    await this.sessionManager.getAdminLogout(res, ctx);
+  }
+
+
+  /**
+   * @param {http.ClientRequest} req
+   * @param {http.ServerResponse} res
+   * @param {Object} ctx
+   */
+  async handlerGetAdminIA(req, res, ctx) {
+    const _scope = _fileScope('handlerGetAdminIA');
+    this.logger.debug(_scope, 'called', { req: common.requestLogData(req), ctx });
+
+    this.setResponseType(this.responseTypes, req, res, ctx);
+
+    // Special case here, to see cookie before session established
+    ctx.cookie = req.getHeader(Enum.Header.Cookie);
+
+    await this.sessionManager.getAdminIA(res, ctx);
+  }
+
 }
 
 module.exports = Service;
diff --git a/src/session-manager.js b/src/session-manager.js
new file mode 100644
index 0000000..5caff34
--- /dev/null
+++ b/src/session-manager.js
@@ -0,0 +1,279 @@
+'use strict';
+
+/**
+ * Here we process activities which support login sessions.
+ */
+
+const { Communication: IndieAuthCommunication } = require('@squeep/indieauth-helper');
+const { MysteryBox } = require('@squeep/mystery-box');
+const common = require('./common');
+const Enum = require('./enum');
+const Template = require('./template');
+
+const _fileScope = common.fileScope(__filename);
+
+class SessionManager {
+  constructor(logger, authenticator, options) {
+    this.logger = logger;
+    this.authenticator = authenticator;
+    this.options = options;
+    this.indieAuthCommunication = new IndieAuthCommunication(logger, options);
+    this.mysteryBox = new MysteryBox(logger, options);
+
+    this.secureCookie = options.authenticator.secureAuthOnly ? ' Secure;' : '';
+    this.cookieLifespan = 60 * 60 * 24 * 32;
+  }
+
+
+  /**
+   * Set or update our session cookie.
+   * @param {http.ServerResponse} res
+   * @param {Object} session
+   * @param {Number} maxAge
+   */
+  async _sessionCookieSet(res, session, maxAge) {
+    const cookieName = 'WSHas';
+    const secureSession = session && await this.mysteryBox.pack(session) || '';
+    const cookie = [
+      `${cookieName}=${secureSession}`,
+      'HttpOnly',
+      this.secureCookie,
+      `Max-Age: ${maxAge}`,
+    ].join('; ');
+    res.setHeader(Enum.Header.SetCookie, cookie);
+  }
+
+
+  /**
+   * GET request for establishing admin session.
+   * @param {http.ServerResponse} res
+   * @param {Object} ctx
+   */
+  async getAdminLogin(res, ctx) {
+    const _scope = _fileScope('getAdminLogin');
+    this.logger.debug(_scope, 'called', { ctx });
+
+    res.end(Template.adminLoginHTML(ctx, this.options));
+    this.logger.info(_scope, 'finished', { ctx })
+  }
+
+
+  /**
+   * POST request for taking form data to establish admin session.
+   * @param {http.ServerResponse} res
+   * @param {Object} ctx
+   */
+  async postAdminLogin(res, ctx) {
+    const _scope = _fileScope('postAdminLogin');
+    this.logger.debug(_scope, 'called', { ctx });
+
+    ctx.errors = [];
+
+    // Only attempt user login if no IndieAuth profile is set
+    if (!ctx.parsedBody['me']) {
+      this.logger.debug(_scope, 'no indieauth profile, trying identifier', { ctx });
+
+      const identifier = ctx.parsedBody['identifier'];
+      const credential = ctx.parsedBody['credential'];
+
+      const isValidLocalIdentifier = await this.authenticator.isValidIdentifierCredential(identifier, credential, ctx);
+      if (!isValidLocalIdentifier) {
+        ctx.errors.push('Invalid username or password');
+      }
+
+      if (ctx.errors.length) {
+        res.end(Template.adminLoginHTML(ctx, this.options));
+        return;
+      }
+
+      // Valid auth, persist the authenticated session
+      ctx.session = {
+        authenticatedIdentifier: ctx.authenticationId,
+      };
+      await this._sessionCookieSet(res, ctx.session, this.cookieLifespan);
+      res.statusCode = 302;
+      res.setHeader(Enum.Header.Location, './');
+      res.end();
+      this.logger.info(_scope, 'finished local', { ctx });
+      return;
+    }
+
+    let me, session, authorizationEndpoint;
+    try {
+      me = new URL(ctx.parsedBody['me']);
+    } catch (e) {
+      this.logger.debug(_scope, 'failed to parse supplied profile url', { ctx });
+      ctx.errors.push(`Unable to understand '${ctx.parsedBody['me']}' as a profile URL.`);
+    }
+
+    if (me) {
+      const profile = await this.indieAuthCommunication.fetchProfile(me);
+      if (!profile || !profile.authorizationEndpoint) {
+        this.logger.debug(_scope, 'failed to find any profile information at url', { ctx });
+        ctx.errors.push(`No profile information was found at '${me}'.`);
+      } else {
+        // fetch and parse me for 'authorization_endpoint' relation links
+        try {
+          authorizationEndpoint = new URL(profile.authorizationEndpoint);
+        } catch (e) {
+          ctx.errors.push(`Unable to understand the authorization endpoint ('${profile.authorizationEndpoint}') indicated by that profile ('${me}') as a URL.`);
+        }
+      }
+
+      if (authorizationEndpoint) {
+        const pkce = await IndieAuthCommunication.generatePKCE();
+        session = {
+          authorizationEndpoint: authorizationEndpoint.href,
+          state: ctx.requestId,
+          codeVerifier: pkce.codeVerifier,
+          me,
+        };
+
+        Object.entries({
+          'response_type': 'code',
+          'client_id': this.options.dingus.selfBaseUrl,
+          'redirect_uri': `${this.options.dingus.selfBaseUrl}admin/_ia`,
+          'state': session.state,
+          'code_challenge': pkce.codeChallenge,
+          'code_challenge_method': pkce.codeChallengeMethod,
+          'me': me,
+        }).forEach(([name, value]) => authorizationEndpoint.searchParams.set(name, value));
+      }
+    }
+
+    if (ctx.errors.length) {
+      res.end(Template.adminLoginHTML(ctx, this.options));
+      return;
+    }
+
+    await this._sessionCookieSet(res, session, this.cookieLifespan);
+    res.setHeader(Enum.Header.Location, authorizationEndpoint.href);
+    res.statusCode = 302; // Found
+    res.end();
+
+    this.logger.info(_scope, 'finished indieauth', { ctx })
+  }
+
+
+  /**
+   * GET request to remove current credentials.
+   * @param {http.ServerResponse} res
+   * @param {Object} ctx
+   */
+  async getAdminLogout(res, ctx) {
+    const _scope = _fileScope('getAdminLogout');
+    this.logger.debug(_scope, 'called', { ctx });
+
+    this._sessionCookieSet(res, '', 0);
+    res.statusCode = 302;
+    res.setHeader(Enum.Header.Location, './');
+    res.end();
+
+    this.logger.info(_scope, 'finished', { ctx });
+  }
+
+
+  /**
+   * GET request for returning IndieAuth redirect.
+   * @param {http.ServerResponse} res
+   * @param {Object} ctx
+   */
+  async getAdminIA(res, ctx) {
+    const _scope = _fileScope('getAdminIA');
+    this.logger.debug(_scope, 'called', { ctx });
+
+    ctx.errors = [];
+    ctx.session = {};
+
+    // Unpack cookie to restore session data
+
+    const [ cookieName, cookieValue ] = common.splitFirst((ctx.cookie || ''), '=', '');
+    if (cookieName !== 'WSHas') {
+      this.logger.debug(_scope, 'no cookie', { ctx });
+      ctx.errors.push('missing required cookie');
+    } else {
+      try {
+        ctx.session = await this.mysteryBox.unpack(cookieValue);
+        this.logger.debug(_scope, 'restored session from cookie', { ctx });
+      } catch (e) {
+        this.logger.debug(_scope, 'could not unpack cookie');
+        ctx.errors.push('invalid cookie');
+      }
+    }
+
+    // Validate unpacked session values
+
+    // Add any auth errors
+    if (ctx.queryParams['error']) {
+      ctx.errors.push(ctx.queryParams['error']);
+      if (ctx.queryParams['error_description']) {
+        ctx.errors.push(ctx.queryParams['error_description']);
+      }
+    }
+
+    // check stuff
+    if (ctx.queryParams['state'] !== ctx.session.state) {
+      this.logger.debug(_scope, 'state mismatch', { ctx });
+      ctx.errors.push('invalid state');
+    }
+
+    const code = ctx.queryParams['code'];
+    if (!code) {
+      this.logger.debug(_scope, 'missing code', { ctx });
+      ctx.errors.push('invalid code');
+    }
+
+    let redeemProfileUrl;
+    try {
+      redeemProfileUrl = new URL(ctx.session.authorizationEndpoint);
+    } catch (e) {
+      this.logger.debug(_scope, 'failed to parse restored session authorization endpoint as url', { ctx });
+      ctx.errors.push('invalid cookie');
+    }
+    let profile;
+    if (redeemProfileUrl) {
+      profile = await this.indieAuthCommunication.redeemProfileCode(redeemProfileUrl, code, ctx.session.codeVerifier, this.options.dingus.selfBaseUrl, `${this.options.dingus.selfBaseUrl}admin/_ia`);
+      if (!profile) {
+        this.logger.debug(_scope, 'no profile from code redemption', { ctx });
+        ctx.errors.push('did not get a profile response from authorization endpoint code redemption');
+      } else if (!profile.me) {
+        this.logger.debug(_scope, 'no profile me identifier from code redemption', { ctx });
+        ctx.errors.push('did not get \'me\' value from authorization endpoint code redemption');
+      } else if (profile.me !== ctx.session.me) {
+        this.logger.debug(_scope, 'mis-matched canonical me from redeemed profile', { ctx, profile });
+        const newProfileUrl = new URL(profile.me);
+        // Rediscover auth endpoint for the new returned profile.
+        const newProfile = await this.indieAuthCommunication.fetchProfile(newProfileUrl);
+        if (newProfile.authorizationEndpoint !== ctx.session.authorizationEndpoint) {
+          this.logger.debug(_scope, 'mis-matched auth endpoints between provided me and canonical me', { ctx, profile, newProfile });
+          ctx.errors.push('canonical profile url provided by authorization endpoint is not handled by that endpoint, cannot continue');
+        } else {
+          // The endpoints match, all is okay, update our records.
+          ctx.session.me = profile.me;
+        }
+      }
+    }
+
+    if (ctx.errors.length) {
+      await this._sessionCookieSet(res, '', 0);
+      res.end(Template.adminIAHTML(ctx, this.options));
+      return;
+    }
+
+    // set cookie as auth valid, redirect to admin
+    ctx.session = {
+      authenticatedProfile: ctx.session.me,
+    };
+
+    await this._sessionCookieSet(res, ctx.session, this.cookieLifespan);
+    res.statusCode = 302;
+    res.setHeader(Enum.Header.Location, './');
+    res.end();
+
+    this.logger.info(_scope, 'finished', { ctx })
+  }
+
+
+}
+
+module.exports = SessionManager;
\ No newline at end of file
diff --git a/src/template/admin-ia-html.js b/src/template/admin-ia-html.js
new file mode 100644
index 0000000..103582d
--- /dev/null
+++ b/src/template/admin-ia-html.js
@@ -0,0 +1,39 @@
+'use strict';
+
+const th = require('./template-helper');
+
+function errorsSection(ctx) {
+  return (ctx.errors && ctx.errors.length) ? `        <section class="errors">
+          <h2>Troubles</h2>
+          <p>Problems were encountered while trying to authenticate your profile URL.</p>
+          <ul>` +
+          ctx.errors.map((error) => `<li>${error}</li>`).join('\n') + `
+          </ul>
+        </section>
+        <div>
+          <a href="./login">Try Again?</a>
+        </div>`
+    : '';
+}
+
+/**
+ * Render any errors from attempting IndieAuth.
+ * @param {Object} ctx
+ * @param {String[]} ctx.errors
+ * @param {Object} options
+ * @param {Object} options.manager
+ * @param {String} options.manager.pageTitle
+ * @param {Object} options.dingus
+ * @param {String} options.dingus.selfBaseUrl
+ * @returns {String}
+ */
+module.exports = (ctx, options) => {
+  const pageTitle = options.manager.pageTitle;
+  const footerEntries = options.manager.footerEntries;
+  const headElements = [];
+  const navLinks = [];
+  const mainContent = [
+    errorsSection(ctx),
+  ];
+  return th.htmlTemplate(ctx, 2, pageTitle, headElements, navLinks, mainContent, footerEntries);
+};
\ No newline at end of file
diff --git a/src/template/admin-login-html.js b/src/template/admin-login-html.js
new file mode 100644
index 0000000..a87f930
--- /dev/null
+++ b/src/template/admin-login-html.js
@@ -0,0 +1,83 @@
+'use strict';
+
+const th = require('./template-helper');
+
+
+/**
+ * Login form.
+ */
+function indieAuthSection() {
+  return `      <section class="indieauth">
+        <h2>Login</h2>
+        <form action="" method="POST">
+          <fieldset>
+            <legend>IndieAuth</legend>
+            <label for="me">Profile URL:</label>
+            <input id="me" name="me" type="url" size="40" placeholder="https://example.com/my_profile_url" value="" autofocus>
+            <button>Login</button>
+            <br>
+            <div>
+              Logging in with an <a class="external" href="https://indieweb.org/IndieAuth">IndieAuth</a> profile will allow you to view details of any topics on this hub which are related to that profile's domain.
+            </div>
+          </fieldset>
+        </form>
+      </section>`;
+}
+
+
+function userSection(ctx, options) {
+  const secure = (ctx.clientProtocol || '').toLowerCase() === 'https';
+  const showUserForm = secure || !options.authenticator.secureAuthOnly;
+  return showUserForm ? `      <section class="user">
+        <form action="" method="POST">
+          <fieldset>
+            <legend>User Account</legend>
+            <label for="identifier">Username:</label>
+            <input id="identifier" name="identifier" value="">
+            <br>
+            <label for="credential">Password:</label>
+            <input id="credential" name="credential" type="password" value="">
+            <br>
+            <button>Login</button>
+            <br>
+          </fieldset>
+        </form>
+      </section>`
+    : '';
+}
+
+
+function errorsSection(ctx) {
+  return (ctx.errors && ctx.errors.length) ? `        <section class="errors">
+          <h2>Troubles</h2>
+          <p>Problems were encountered while trying to authenticate you.</p>
+          <ul>` +
+          ctx.errors.map((error) => `<li>${error}</li>`).join('\n') + `
+          </ul>
+        </section>`
+    : '';
+}
+
+
+/**
+ * Render login form for both local and profile authentication.
+ * @param {Object} ctx
+ * @param {Object} options
+ * @param {Object} options.manager
+ * @param {String} options.manager.pageTitle
+ * @param {Object} options.dingus
+ * @param {String} options.dingus.selfBaseUrl
+ * @returns {String}
+ */
+module.exports = (ctx, options) => {
+  const pageTitle = options.manager.pageTitle;
+  const footerEntries = options.manager.footerEntries;
+  const headElements = [];
+  const navLinks = [];
+  const mainContent = [
+    errorsSection(ctx),
+    indieAuthSection(),
+    userSection(ctx, options),
+  ];
+  return th.htmlTemplate(ctx, 2, pageTitle, headElements, navLinks, mainContent, footerEntries);
+};
\ No newline at end of file
diff --git a/src/template/admin-overview-html.js b/src/template/admin-overview-html.js
index 3d4f62c..a8efef3 100644
--- a/src/template/admin-overview-html.js
+++ b/src/template/admin-overview-html.js
@@ -19,7 +19,7 @@ module.exports = (ctx, options) => {
   if (!ctx.topics) {
     ctx.topics = [];
   }
-  return th.htmlTemplate(1, pageTitle, headElements, navLinks, [
+  return th.htmlTemplate(ctx, 1, pageTitle, headElements, navLinks, [
     `      <section class="topics">
         <p>${ctx.topics.length ? ctx.topics.length : 'no'} topic${(ctx.topics.length === 1) ? '' : 's'}</p>
         <table>
diff --git a/src/template/admin-topic-details-html.js b/src/template/admin-topic-details-html.js
index df13f21..e039189 100644
--- a/src/template/admin-topic-details-html.js
+++ b/src/template/admin-topic-details-html.js
@@ -25,14 +25,14 @@ module.exports = (ctx, options) => {
   if (!ctx.subscriptions) {
     ctx.subscriptions = [];
   }
-  return th.htmlTemplate(2, pageTitle, headElements, navLinks, [
+  return th.htmlTemplate(ctx, 2, pageTitle, headElements, navLinks, [
     `      <section class="topics">
         <table>
           <thead>`,
     th.renderTopicRowHeader(),
     `          </thead>
         <tbody>`,
-    ...(ctx.topic && [ th.renderTopicRow(ctx.topic, ctx.subscriptions, false) ]),
+    ...(ctx.topic && [ th.renderTopicRow(ctx.topic, ctx.subscriptions, false) ] || []),
     `        </tbody>
         </table>
       </section>`,
diff --git a/src/template/index.js b/src/template/index.js
index e177788..ced94bf 100644
--- a/src/template/index.js
+++ b/src/template/index.js
@@ -1,6 +1,8 @@
 'use strict';
 
 module.exports = {
+  adminLoginHTML: require('./admin-login-html'),
+  adminIAHTML: require('./admin-ia-html'),
   adminOverviewHTML: require('./admin-overview-html'),
   adminTopicDetailsHTML: require('./admin-topic-details-html'),
   badgeSVG: require('./badge-svg'),
diff --git a/src/template/root-html.js b/src/template/root-html.js
index 8797564..fc655c0 100644
--- a/src/template/root-html.js
+++ b/src/template/root-html.js
@@ -2,6 +2,18 @@
 
 const th = require('./template-helper');
 
+function hAppSection(pageTitle) {
+  return `      <section class="h-app hidden">
+        <h2>h-app Information for IndieAuth Logins</h2>
+        <img src="static/favicon.ico" class="u-logo">
+        <a href="" class="u-url p-name">${pageTitle}</a>
+        <p class="p-summary">
+          This is a WebSub Hub service, facilitating content distribution.
+          Authenticated users may view details of any syndications related to their profile.
+        </p>
+      </section>`;
+}
+
 function aboutSection() {
   return `      <section class="about">
         <h2>What</h2>
@@ -82,7 +94,7 @@ function usageSection(isPublicHub, hubURL) {
       </div>
       <div>
         <h3>Publishing Updates</h3>
-        To notify the Hub that a topic&apos;s content has been updated and should be distributed to subscribers, send a <code>POST</code> request with Form Data (<code>application/x-www-form-urlencoded</code>):
+        To notify the Hub either of a new topic to syndicate, or that a topic&apos;s content has been updated and should be distributed to subscribers, send a <code>POST</code> request with Form Data (<code>application/x-www-form-urlencoded</code>):
         <ul>
           <li>
             <code>hub.mode</code> set to <code>publish</code>
@@ -138,12 +150,16 @@ module.exports = (ctx, options) => {
   const footerEntries = options.manager.footerEntries;
   const hubURL = options.dingus.selfBaseUrl || '<s>https://hub.example.com/</s>';
   const headElements = [];
-  const navLinks = [];
+  const navLinks = [{
+    href: 'admin/',
+    text: 'Admin',
+  }];
   const mainContent = [
     aboutSection(),
     usageSection(isPublicHub, hubURL),
     contactSection(contactHTML),
+    hAppSection(pageTitle),
   ];
-  return th.htmlTemplate(1, pageTitle, headElements, navLinks, mainContent, footerEntries,
+  return th.htmlTemplate(ctx, 0, pageTitle, headElements, navLinks, mainContent, footerEntries,
   );
 };
\ No newline at end of file
diff --git a/src/template/template-helper.js b/src/template/template-helper.js
index f36829d..c633e41 100644
--- a/src/template/template-helper.js
+++ b/src/template/template-helper.js
@@ -61,6 +61,11 @@ const secondsToPeriod = (seconds) => {
  * @returns {String}
  */
 function renderTopicRow(topic, subscribers, detailsLink = true) {
+  if (!topic) {
+    return `<tr>
+    <th colspan="15">(topic not found)</th>
+</tr>`;
+  }
   return `<tr>
   <th scope="row">${detailsLink ? '<a href="topic/' + topic.id + '">' : ''}${topic.url}${detailsLink ? '</a>' : ''}</th>
   <td>${subscribers.length}</td>
@@ -112,6 +117,11 @@ function renderTopicRowHeader() {
  * @returns {String}
  */
 function renderSubscriptionRow(subscription) {
+  if (!subscription) {
+    return `<tr>
+    <th colspan="12">(topic not found)</th>
+</tr>`;
+  }
   return `<tr>
   <td scope="row">${subscription.callback}</td>
   <td>${dateOrNot(subscription.created, 'Unknown')}</td>
@@ -236,7 +246,8 @@ function htmlFooter(footerEntries = []) {
 
 
 /**
- * Render all parts of an HTML page.
+ * Render all parts of an HTML page. Adds user logout nav link automatically.
+ * @param {Object} ctx
  * @param {Number} pagePathLevel
  * @param {String} pageTitle
  * @param {String[]} headElements
@@ -245,7 +256,20 @@ function htmlFooter(footerEntries = []) {
  * @param {String[]} footerEntries
  * @returns {String}
  */
-function htmlTemplate(pagePathLevel, pageTitle, headElements = [], navLinks = [], main = [], footerEntries = []) {
+function htmlTemplate(ctx, pagePathLevel, pageTitle, headElements = [], navLinks = [], main = [], footerEntries = []) {
+  const user = (ctx && ctx.session && ctx.session.authenticatedProfile) || (ctx && ctx.session && ctx.session.authenticatedIdentifier);
+  if (user) {
+    let logoutPath;
+    if (pagePathLevel > 0) {
+      logoutPath = `${'../'.repeat(pagePathLevel - 1)}`;
+    } else {
+      logoutPath = 'admin/';
+    }
+    navLinks.push({
+      text: `Logout (${user})`,
+      href: `${logoutPath}logout`,
+    });
+  }
   return [
     htmlHead(pagePathLevel, pageTitle, headElements),
     htmlHeader(pageTitle, navLinks),
diff --git a/static/theme.css b/static/theme.css
index 3e4c4f4..4987191 100644
--- a/static/theme.css
+++ b/static/theme.css
@@ -11,16 +11,36 @@ body {
 	flex-direction: column;
 }
 header {}
+header nav {
+	margin-bottom: 1em;
+}
 header nav ol {
 	list-style-type: none;
 	margin: 0;
 	padding: 0;
-	border: 1px solid #000;
 }
-header nav ol li a {
-	display: block;
-	width: 10em;
+header nav ol li {
+	display: inline;
 	text-align: center;
+	border-top: 2px solid #666;
+	border-bottom: 2px solid #666;
+	border-left: 1px solid #666;
+	border-right: 1px solid #666;
+	padding: .3em .5em .2em .5em;
+}
+header nav ol > li:first-child {
+	border-left: 2px solid #666;
+}
+header nav ol > li:last-child {
+	border-right: 2px solid #666;
+}
+header nav ol li:hover {
+	background-color: #ddd;
+}
+header nav ol a {
+	font-variant-caps: small-caps;
+	text-decoration: none;
+	font-weight: bold;
 }
 h1 {
 	margin-top: 1em;
@@ -35,6 +55,9 @@ main {
 	flex-grow: 1;
 }
 section {}
+section + section {
+	margin-top: 2em;
+}
 .about {}
 .usage {}
 .topics {}
@@ -45,6 +68,15 @@ section {}
 	background-repeat: no-repeat;
 	padding-right: 13px;
 }
+.hidden {
+	display: none;
+}
+.h-app img {
+	vertical-align: middle;
+}
+.errors ul {
+	border: 1px solid red;
+}
 table {
 	border: 0;
 	width: 100%;
diff --git a/test/src/authenticator.js b/test/src/authenticator.js
index 8c17436..47313d8 100644
--- a/test/src/authenticator.js
+++ b/test/src/authenticator.js
@@ -2,37 +2,51 @@
 'use strict';
 
 const assert = require('assert');
-const sinon = require('sinon');
+const sinon = require('sinon'); // eslint-disable-line node/no-unpublished-require
 const Authenticator = require('../../src/authenticator');
 const stubLogger = require('../stub-logger');
 const stubDb = require('../stub-db');
 const Errors = require('../../src/errors');
 const Enum = require('../../src/enum');
+const Config = require('../../config');
 
 const noExpectedException = 'did not receive expected exception';
 
 describe('Authenticator', function () {
   let authenticator, credential, ctx, identifier, password, options;
+  function _authMechanismRequired(a, m) {
+    if (!a.authn[m]) { // eslint-disable-line security/detect-object-injection
+      this.skip();
+    }
+  };
+
   beforeEach(function () {
-    options = {
-      authenticator: {
-        basicRealm: 'realm',
-        secureAuthOnly: true,
-      },
-    };
+    options = Config('test');
     authenticator = new Authenticator(stubLogger, stubDb, options);
     identifier = 'username';
     credential = '$argon2id$v=19$m=4096,t=3,p=1$1a6zRlX4BI4$sZGcQ72BTpDOlxUI/j3DmE1PMcu+Cs5liZ/D6kk79Ew';
     ctx = {};
     password = 'badPassword';
+    stubDb._reset();
   });
   afterEach(function () {
     sinon.restore();
   });
 
+  it('covers no auth mechanisms', function () {
+    options.authenticator.authnEnabled = [];
+    try {
+      authenticator = new Authenticator(stubLogger, stubDb, options);
+      assert.fail(noExpectedException);
+    } catch (e) {
+      assert.strictEqual(e.message, 'no authentication mechanisms available');
+    }
+  });
+
   describe('isValidBasic', function () {
     it('succeeds', async function () {
-      sinon.stub(authenticator.db, 'authenticationGet').resolves({
+      _authMechanismRequired(authenticator, 'argon2');
+      authenticator.db.authenticationGet.resolves({
         identifier,
         credential,
       });
@@ -42,7 +56,8 @@ describe('Authenticator', function () {
       assert.strictEqual(ctx.authenticationId, identifier);
     });
     it('fails', async function () {
-      sinon.stub(authenticator.db, 'authenticationGet').resolves({
+      _authMechanismRequired(authenticator, 'argon2');
+      authenticator.db.authenticationGet.resolves({
         identifier,
         credential,
       });
@@ -52,14 +67,14 @@ describe('Authenticator', function () {
       assert.strictEqual(ctx.authenticationId, undefined);
     });
     it('covers no entry', async function() {
-      sinon.stub(authenticator.db, 'authenticationGet').resolves();
+      authenticator.db.authenticationGet.resolves();
       const authString = `${identifier}:wrongPassword}`;
       const result = await authenticator.isValidBasic(authString, ctx);
       assert.strictEqual(result, false);
       assert.strictEqual(ctx.authenticationId, undefined);
     });
     it('covers unknown password hash', async function () {
-      sinon.stub(authenticator.db, 'authenticationGet').resolves({
+      authenticator.db.authenticationGet.resolves({
         identifier,
         credential: '$other$kind_of_credential',
       });
@@ -70,6 +85,95 @@ describe('Authenticator', function () {
     });
   }); // isValidBasic
 
+  describe('isValidIdentifierCredential', function () {
+    it('succeeds', async function () {
+      _authMechanismRequired(authenticator, 'argon2');
+      authenticator.db.authenticationGet.resolves({
+        identifier,
+        credential,
+      });
+      const result = await authenticator.isValidIdentifierCredential(identifier, password, ctx);
+      assert.strictEqual(result, true);
+      assert.strictEqual(ctx.authenticationId, identifier);
+    });
+    it('fails', async function () {
+      _authMechanismRequired(authenticator, 'argon2');
+      authenticator.db.authenticationGet.resolves({
+        identifier,
+        credential,
+      });
+      const result = await authenticator.isValidIdentifierCredential(identifier, 'wrongPassword', ctx);
+      assert.strictEqual(result, false);
+      assert.strictEqual(ctx.authenticationId, undefined);
+    });
+    it('covers no entry', async function() {
+      authenticator.db.authenticationGet.resolves();
+      const result = await authenticator.isValidIdentifierCredential(identifier, 'wrongPassword', ctx);
+      assert.strictEqual(result, false);
+      assert.strictEqual(ctx.authenticationId, undefined);
+    });
+    it('covers unknown password hash', async function () {
+      authenticator.db.authenticationGet.resolves({
+        identifier,
+        credential: '$other$kind_of_credential',
+      });
+      const result = await authenticator.isValidIdentifierCredential(identifier, 'wrongPassword', ctx);
+      assert.strictEqual(result, false);
+      assert.strictEqual(ctx.authenticationId, undefined);
+    });
+    it('covers PAM', async function () {
+      _authMechanismRequired(authenticator, 'pam');
+      sinon.stub(authenticator, '_isValidPAMIdentifier').resolves(true);
+      authenticator.db.authenticationGet.resolves({
+        identifier,
+        credential: '$PAM$',
+      });
+      const result = await authenticator.isValidIdentifierCredential(identifier, password, ctx);
+      assert.strictEqual(result, true);
+      assert.strictEqual(ctx.authenticationId, identifier);
+    });
+    it('covers debug', async function () {
+      authenticator.authnEnabled = ['DEBUG_ANY'];
+      const result = await authenticator.isValidIdentifierCredential(identifier, password, ctx);
+      assert.strictEqual(result, true);
+      assert.strictEqual(ctx.authenticationId, identifier);
+    });
+  }); // isValidIdentifierCredential
+
+  describe('_isValidPAMIdentifier', function () {
+    beforeEach(function () {
+      _authMechanismRequired(authenticator, 'pam');
+      sinon.stub(authenticator.authn.pam, 'pamAuthenticatePromise');
+    });
+    it('covers success', async function () {
+      authenticator.authn.pam.pamAuthenticatePromise.resolves(true);
+      const result = await authenticator._isValidPAMIdentifier(identifier, credential);
+      assert.strictEqual(result, true);
+    });
+    it('covers failure', async function () {
+      _authMechanismRequired(authenticator, 'pam');
+      authenticator.authn.pam.pamAuthenticatePromise.rejects(new authenticator.authn.pam.PamError());
+      const result = await authenticator._isValidPAMIdentifier(identifier, credential);
+      assert.strictEqual(result, false);
+    });
+    it('covers error', async function () {
+      _authMechanismRequired(authenticator, 'pam');
+      const expected = new Error('blah');
+      authenticator.authn.pam.pamAuthenticatePromise.rejects(expected);
+      try {
+        await authenticator._isValidPAMIdentifier(identifier, credential);
+        assert.fail(noExpectedException);
+      } catch (e) {
+        assert.deepStrictEqual(e, expected);
+      }
+    });
+    it('covers forbidden', async function () {
+      identifier = 'root';
+      const result = await authenticator._isValidPAMIdentifier(identifier, credential);
+      assert.strictEqual(result, false);
+    });
+  }); // _isValidPAMIdentifier
+
   describe('isValidAuthorization', function () {
     it('handles basic', async function () {
       const expected = true;
@@ -101,6 +205,35 @@ describe('Authenticator', function () {
     });
   }); // requestBasic
 
+  describe('isValidCookieAuth', function () {
+    beforeEach(function () {
+      sinon.stub(authenticator.mysteryBox, 'unpack');
+    });
+    it('covers identifier success', async function () {
+      authenticator.mysteryBox.unpack.resolves({
+        authenticatedIdentifier: 'identifier',
+      });
+      const result = await authenticator.isValidCookieAuth(ctx, 'WSHas=dummy');
+      assert.strictEqual(result, true);
+    });
+    it('covers profile success', async function () {
+      authenticator.mysteryBox.unpack.resolves({
+        authenticatedProfile: 'profile',
+      });
+      const result = await authenticator.isValidCookieAuth(ctx, 'WSHas=dummy');
+      assert.strictEqual(result, true);
+    });
+    it('covers missing cookie', async function () {
+      const result = await authenticator.isValidCookieAuth(ctx, 'wrongCookie');
+      assert.strictEqual(result, false);
+    });
+    it('covers bad cookie', async function () {
+      authenticator.mysteryBox.unpack.rejects();
+      const result = await authenticator.isValidCookieAuth(ctx, 'WSHas=dummy');
+      assert.strictEqual(result, false);
+    });
+  }); // isValidCookieAuth
+
   describe('required', function () {
     let req, res;
     beforeEach(function () {
@@ -109,6 +242,7 @@ describe('Authenticator', function () {
         getHeader: sinon.stub(),
       };
       res = {
+        end: sinon.stub(),
         setHeader: sinon.stub(),
       }
     });
@@ -118,6 +252,12 @@ describe('Authenticator', function () {
       const result = await authenticator.required(req, res, ctx);
       assert.strictEqual(result, true);
     });
+    it('covers valid cookie session', async function () {
+      req.getHeader.returns('WSHas=sessionCookie');
+      sinon.stub(authenticator, 'isValidCookieAuth').resolves(true);
+      const result = await authenticator.required(req, res, ctx);
+      assert.strictEqual(result, true);
+    });
     it('rejects insecure connection', async function () {
       ctx.clientProtocol = 'http';
       try {
@@ -139,5 +279,66 @@ describe('Authenticator', function () {
         assert.strictEqual(e.statusCode, Enum.ErrorResponse.Unauthorized.statusCode);
       }
     });
+    it('redirects without any auth', async function () {
+      await authenticator.required(req, res, ctx);
+      assert(res.end.called);
+      assert(res.setHeader.called);
+    });
   }); // required
+
+  describe('requiredLocal', function () {
+    let req, res;
+    beforeEach(function () {
+      ctx.clientProtocol = 'https';
+      req = {
+        getHeader: sinon.stub(),
+      };
+      res = {
+        end: sinon.stub(),
+        setHeader: sinon.stub(),
+      }
+    });
+    it('succeeds', async function() {
+      req.getHeader.returns('auth header');
+      sinon.stub(authenticator, 'isValidAuthorization').resolves(true);
+      const result = await authenticator.requiredLocal(req, res, ctx);
+      assert.strictEqual(result, true);
+    });
+    it('covers valid cookie session', async function () {
+      req.getHeader.returns('WSHas=sessionCookie');
+      sinon.stub(authenticator, 'isValidCookieAuth').resolves(true);
+      ctx.session = {
+        authenticatedIdentifier: identifier,
+      };
+      const result = await authenticator.requiredLocal(req, res, ctx);
+      assert.strictEqual(result, true);
+    });
+    it('rejects insecure connection', async function () {
+      ctx.clientProtocol = 'http';
+      try {
+        await authenticator.requiredLocal(req, res, ctx);
+        assert.fail(noExpectedException);
+      } catch (e) {
+        assert(e instanceof Errors.ResponseError);
+        assert.strictEqual(e.statusCode, Enum.ErrorResponse.Forbidden.statusCode);
+      }
+    });
+    it('rejects invalid auth', async function () {
+      try {
+        req.getHeader.returns('auth header');
+        sinon.stub(authenticator, 'isValidAuthorization').resolves(false);
+        await authenticator.requiredLocal(req, res, ctx);
+        assert.fail(noExpectedException);
+      } catch (e) {
+        assert(e instanceof Errors.ResponseError);
+        assert.strictEqual(e.statusCode, Enum.ErrorResponse.Unauthorized.statusCode);
+      }
+    });
+    it('redirects without any auth', async function () {
+      await authenticator.requiredLocal(req, res, ctx);
+      assert(res.end.called);
+      assert(res.setHeader.called);
+    });
+  }); // requiredLocal
+
 }); // Authenticator
diff --git a/test/src/manager.js b/test/src/manager.js
index 89e3d65..7db6b84 100644
--- a/test/src/manager.js
+++ b/test/src/manager.js
@@ -150,7 +150,7 @@ describe('Manager', function () {
   }); // getInfo
 
   describe('getAdminOverview', function () {
-    it('covers', async function () {
+    beforeEach(function () {
       manager.db.topicGetAll.resolves([
         {
           id: '56c557ce-e667-11eb-bd80-0025905f714a',
@@ -172,13 +172,23 @@ describe('Manager', function () {
           subscribers: 12,
         },
       ]);
+    });
+    it('covers', async function () {
+      await manager.getAdminOverview(res, ctx);
+      assert(res.end.called);
+    });
+    it('covers non-matching profile', async function () {
+      ctx.session = {
+        authenticatedProfile: 'https://different.example.com/profile',
+      };
       await manager.getAdminOverview(res, ctx);
+      assert.deepStrictEqual(ctx.topics, []);
       assert(res.end.called);
     });
   }); // getAdminOverview
 
   describe('getTopicDetails', function () {
-    it('covers', async function() {
+    beforeEach(function () {
       ctx.params.topicId = '56c557ce-e667-11eb-bd80-0025905f714a';
       manager.db.topicGetById.resolves({
         id: '56c557ce-e667-11eb-bd80-0025905f714a',
@@ -214,7 +224,25 @@ describe('Manager', function () {
         deliveryAttemptsSinceSuccess: 0,
         deliveryNextAttempt: new Date(-Infinity),
       }]);
+    });
+    it('covers', async function() {
+      await manager.getTopicDetails(res, ctx);
+      assert(res.end.called);
+    });
+    it('covers non-matching profile', async function () {
+      ctx.session = {
+        authenticatedProfile: 'https://different.example.com/profile',
+      };
+      await manager.getTopicDetails(res, ctx);
+      assert.strictEqual(ctx.topic, null);
+      assert(res.end.called);
+    });
+    it('covers matching profile', async function () {
+      ctx.session = {
+        authenticatedProfile: 'https://example.com/profile',
+      };
       await manager.getTopicDetails(res, ctx);
+      assert(ctx.topic);
       assert(res.end.called);
     });
   }); // getTopicDetails
diff --git a/test/src/service.js b/test/src/service.js
index 7a97cf5..bb93d2e 100644
--- a/test/src/service.js
+++ b/test/src/service.js
@@ -20,6 +20,7 @@ describe('Service', function () {
     options = new Config('test');
     service = new Service(stubLogger, stubDb, options);
     sinon.stub(service.manager);
+    sinon.stub(service.sessionManager);
     sinon.stub(service.authenticator);
     sinon.stub(service, 'setResponseType');
     sinon.stub(service, 'serveFile');
@@ -119,7 +120,7 @@ describe('Service', function () {
     it('covers', async function () {
       service.serveFile.resolves();
       await service.handlerPostAdminProcess(req, res, ctx);
-      assert(service.authenticator.required.called);
+      assert(service.authenticator.requiredLocal.called);
       assert(service.manager.processTasks.called);
     });
   }); // handlerPostAdminProcess
@@ -128,7 +129,7 @@ describe('Service', function () {
     it('covers', async function () {
       sinon.stub(service, 'bodyData').resolves();
       await service.handlerUpdateTopic(req, res, ctx);
-      assert(service.authenticator.required.called);
+      assert(service.authenticator.requiredLocal.called);
       assert(service.manager.updateTopic.called);
     });
   }); // handlerUpdateTopic
@@ -137,9 +138,38 @@ describe('Service', function () {
     it('covers', async function () {
       sinon.stub(service, 'bodyData').resolves();
       await service.handlerUpdateSubscription(req, res, ctx);
-      assert(service.authenticator.required.called);
+      assert(service.authenticator.requiredLocal.called);
       assert(service.manager.updateSubscription.called);
     });
   }); // handlerUpdateSubscription
 
+  describe('handlerGetAdminLogin', function () {
+    it('covers', async function () {
+      await service.handlerGetAdminLogin(req, res, ctx);
+      assert(service.sessionManager.getAdminLogin.called);
+    });
+  }); // handlerGetAdminLogin
+
+  describe('handlerPostAdminLogin', function () {
+    it('covers', async function () {
+      sinon.stub(service, 'bodyData').resolves();
+      await service.handlerPostAdminLogin(req, res, ctx);
+      assert(service.sessionManager.postAdminLogin.called);
+    });
+  }); // handlerPostAdminLogin
+
+  describe('handlerGetAdminLogout', function () {
+    it('covers', async function () {
+      await service.handlerGetAdminLogout(req, res, ctx);
+      assert(service.sessionManager.getAdminLogout.called);
+    });
+}); // handlerGetAdminLogout
+
+  describe('handlerGetAdminIA', function () {
+    it('covers', async function () {
+      await service.handlerGetAdminIA(req, res, ctx);
+      assert(service.sessionManager.getAdminIA.called);
+    });
+  }); // handlerGetAdminIA
+
 });
\ No newline at end of file
diff --git a/test/src/session-manager.js b/test/src/session-manager.js
new file mode 100644
index 0000000..0d77ba0
--- /dev/null
+++ b/test/src/session-manager.js
@@ -0,0 +1,240 @@
+/* eslint-env mocha */
+/* eslint-disable capitalized-comments, sonarjs/no-duplicate-string, sonarjs/no-identical-functions */
+
+'use strict';
+
+const assert = require('assert');
+const sinon = require('sinon'); // eslint-disable-line node/no-unpublished-require
+
+const SessionManager = require('../../src/session-manager');
+const Config = require('../../config');
+const stubLogger = require('../stub-logger');
+
+describe('SessionManager', function () {
+  let manager, options, stubAuthenticator;
+  let res, ctx;
+
+  beforeEach(function () {
+    options = new Config('test');
+    res = {
+      end: sinon.stub(),
+      setHeader: sinon.stub(),
+    };
+    ctx = {
+      cookie: '',
+      params: {},
+      queryParams: {},
+      parsedBody: {},
+    };
+    stubAuthenticator = {
+      isValidIdentifierCredential: sinon.stub(),
+    };
+    manager = new SessionManager(stubLogger, stubAuthenticator, options);
+    sinon.stub(manager.indieAuthCommunication);
+    stubLogger._reset();
+  });
+  afterEach(function () {
+    sinon.restore();
+  });
+
+  describe('_sessionCookieSet', function () {
+    let session, maxAge;
+    beforeEach(function () {
+      session = {};
+      maxAge = 86400;
+    });
+    it('covers', async function () {
+      await manager._sessionCookieSet(res, session, maxAge);
+      assert(res.setHeader.called);
+    });
+    it('covers reset', async function () {
+      session = undefined;
+      maxAge = 0;
+      await manager._sessionCookieSet(res, session, maxAge);
+      assert(res.setHeader.called);
+    });
+  }); // _sessionCookieSet
+
+  describe('getAdminLogin', function () {
+    it('covers', async function () {
+      await manager.getAdminLogin(res, ctx);
+    });
+  }); // getAdminLogin
+
+  describe('postAdminLogin', function () {
+    it('covers valid local', async function () {
+      ctx.parsedBody.identifier = 'user';
+      ctx.parsedBody.credential = 'password';
+      manager.authenticator.isValidIdentifierCredential.resolves(true);
+      await manager.postAdminLogin(res, ctx);
+      assert.strictEqual(res.statusCode, 302);
+    });
+    it('covers invalid local', async function () {
+      ctx.parsedBody.identifier = 'user';
+      ctx.parsedBody.credential = 'password';
+      manager.authenticator.isValidIdentifierCredential.resolves(false);
+      await manager.postAdminLogin(res, ctx);
+      assert(!res.setHeader.called);
+    });
+    it('covers valid profile', async function () {
+      ctx.parsedBody.me = 'https://example.com/profile';
+      manager.indieAuthCommunication.fetchProfile.resolves({
+        authorizationEndpoint: 'https://example.com/auth',
+      });
+      await manager.postAdminLogin(res, ctx);
+      assert.strictEqual(res.statusCode, 302);
+    });
+    it('covers invalid profile', async function () {
+      ctx.parsedBody.me = 'not a profile';
+      manager.indieAuthCommunication.fetchProfile.resolves();
+      await manager.postAdminLogin(res, ctx);
+      assert(!res.setHeader.called);
+    });
+    it('covers invalid profile response', async function () {
+      ctx.parsedBody.me = 'https://example.com/profile';
+      manager.indieAuthCommunication.fetchProfile.resolves();
+      await manager.postAdminLogin(res, ctx);
+      assert(!res.setHeader.called);
+    });
+    it('covers invalid profile response endpoint', async function () {
+      ctx.parsedBody.me = 'https://example.com/profile';
+      manager.indieAuthCommunication.fetchProfile.resolves({
+        authorizationEndpoint: 'not an auth endpoint',
+      });
+      await manager.postAdminLogin(res, ctx);
+      assert(!res.setHeader.called);
+    });
+  }); // postAdminLogin
+
+  describe('getAdminLogout', function () {
+    it('covers', async function () {
+      await manager.getAdminLogout(res, ctx);
+    });
+  }); // getAdminLogout
+
+  describe('getAdminIA', function () {
+    let state, me, authorizationEndpoint;
+    beforeEach(function () {
+      state = '4ea7e936-3427-11ec-9f4b-0025905f714a';
+      me = 'https://example.com/profile';
+      authorizationEndpoint = 'https://example.com/auth'
+      ctx.cookie = 'WSHas=sessionCookie';
+      manager.indieAuthCommunication.redeemProfileCode.resolves({
+        me,
+      });
+      manager.indieAuthCommunication.fetchProfile.resolves({
+        authorizationEndpoint,
+      });
+      sinon.stub(manager.mysteryBox, 'unpack').resolves({
+        authorizationEndpoint,
+        state,
+        me,
+      });
+    });
+    it('covers valid', async function () {
+      ctx.queryParams['state'] = state;
+      ctx.queryParams['code'] = 'codeCodeCode';
+
+      await manager.getAdminIA(res, ctx);
+
+      assert.strictEqual(res.statusCode, 302);
+    });
+    it('covers missing cookie', async function () {
+      delete ctx.cookie;
+
+      await manager.getAdminIA(res, ctx);
+
+      assert(ctx.errors.length);
+    });
+    it('covers invalid cookie', async function () {
+      manager.mysteryBox.unpack.restore();
+      sinon.stub(manager.mysteryBox, 'unpack').rejects();
+
+      await manager.getAdminIA(res, ctx);
+
+      assert(ctx.errors.length);
+    });
+    it('covers mis-matched state', async function () {
+      ctx.queryParams['state'] = 'incorrect-state';
+      ctx.queryParams['code'] = 'codeCodeCode';
+
+      await manager.getAdminIA(res, ctx);
+
+      assert(ctx.errors.length);
+    });
+    it('relays auth endpoint errors', async function () {
+      ctx.queryParams['state'] = state;
+      ctx.queryParams['code'] = 'codeCodeCode';
+      ctx.queryParams['error'] = 'error_code';
+      ctx.queryParams['error_description'] = 'something went wrong';
+
+      await manager.getAdminIA(res, ctx);
+
+      assert(ctx.errors.length);
+    });
+    it('covers invalid restored session', async function () {
+      manager.mysteryBox.unpack.restore();
+      sinon.stub(manager.mysteryBox, 'unpack').resolves({
+        authorizationEndpoint: 'not a url',
+        state,
+        me,
+      });
+      ctx.queryParams['state'] = state;
+      ctx.queryParams['code'] = 'codeCodeCode';
+
+      await manager.getAdminIA(res, ctx);
+
+      assert(ctx.errors.length);
+    });
+    it('covers empty profile redemption response', async function () {
+      ctx.queryParams['state'] = state;
+      ctx.queryParams['code'] = 'codeCodeCode';
+      manager.indieAuthCommunication.redeemProfileCode.restore();
+      sinon.stub(manager.indieAuthCommunication, 'redeemProfileCode').resolves();
+
+      await manager.getAdminIA(res, ctx);
+
+      assert(ctx.errors.length);
+    });
+    it('covers missing profile in redemption response', async function () {
+      ctx.queryParams['state'] = state;
+      ctx.queryParams['code'] = 'codeCodeCode';
+      manager.indieAuthCommunication.redeemProfileCode.restore();
+      sinon.stub(manager.indieAuthCommunication, 'redeemProfileCode').resolves({
+      });
+
+      await manager.getAdminIA(res, ctx);
+
+      assert(ctx.errors.length);
+    });
+    it('covers different canonical profile response', async function () {
+      ctx.queryParams['state'] = state;
+      ctx.queryParams['code'] = 'codeCodeCode';
+      manager.indieAuthCommunication.redeemProfileCode.restore();
+      sinon.stub(manager.indieAuthCommunication, 'redeemProfileCode').resolves({
+        me: 'https://different.example.com/profile',
+      });
+
+      await manager.getAdminIA(res, ctx);
+
+      assert.strictEqual(res.statusCode, 302);
+    });
+    it('covers different canonical profile response mis-matched endpoint', async function () {
+      ctx.queryParams['state'] = state;
+      ctx.queryParams['code'] = 'codeCodeCode';
+      manager.indieAuthCommunication.redeemProfileCode.restore();
+      sinon.stub(manager.indieAuthCommunication, 'redeemProfileCode').resolves({
+        me: 'https://different.example.com/profile',
+      });
+      manager.indieAuthCommunication.fetchProfile.restore();
+      sinon.stub(manager.indieAuthCommunication, 'fetchProfile').resolves({
+        authorizationEndpoint: 'https://elsewhere.example.com/auth',
+      });
+
+      await manager.getAdminIA(res, ctx);
+
+      assert(ctx.errors.length);
+    });
+  }); // getAdminIA
+
+}); // SessionManager
\ No newline at end of file
diff --git a/test/src/template/admin-ia-html.js b/test/src/template/admin-ia-html.js
new file mode 100644
index 0000000..d909389
--- /dev/null
+++ b/test/src/template/admin-ia-html.js
@@ -0,0 +1,25 @@
+/* eslint-env mocha */
+'use strict';
+
+const assert = require('assert');
+const template = require('../../../src/template/admin-ia-html');
+const Config = require('../../../config');
+const config = new Config('test');
+
+describe('Admin Login HTML Template', function () {
+  let ctx;
+
+  beforeEach(function () {
+    ctx = {};
+  });
+
+  it('covers', function () {
+    ctx.errors = ['bad'];
+    const result = template(ctx, config);
+    assert(result);
+  });
+  it('covers empty', function () {
+    const result = template(ctx, config);
+    assert(result);
+  });
+});
diff --git a/test/src/template/admin-login-html.js b/test/src/template/admin-login-html.js
new file mode 100644
index 0000000..661efd9
--- /dev/null
+++ b/test/src/template/admin-login-html.js
@@ -0,0 +1,26 @@
+/* eslint-env mocha */
+'use strict';
+
+const assert = require('assert');
+const template = require('../../../src/template/admin-login-html');
+const Config = require('../../../config');
+const config = new Config('test');
+
+describe('Admin Login HTML Template', function () {
+  let ctx;
+
+  beforeEach(function () {
+    ctx = {};
+  });
+
+  it('covers', function () {
+    ctx.errors = ['bad'];
+    ctx.clientProtocol = 'https';
+    const result = template(ctx, config);
+    assert(result);
+  });
+  it('covers empty', function () {
+    const result = template(ctx, config);
+    assert(result);
+  });
+});
diff --git a/test/src/template/admin-topic-details-html.js b/test/src/template/admin-topic-details-html.js
index 52a8ed8..4b8c0dd 100644
--- a/test/src/template/admin-topic-details-html.js
+++ b/test/src/template/admin-topic-details-html.js
@@ -22,6 +22,12 @@ describe('Admin Topic Details HTML Template', function () {
     const result = template(ctx, config);
     assert(result);
   });
+  it('covers null topic', function () {
+    ctx.topic = null;
+    ctx.subscriptions = null;
+    const result = template(ctx, config);
+    assert(result);
+  });
   it('covers missing subscriptions', function () {
     delete ctx.subscriptions;
     const result = template(ctx, config);
@@ -32,5 +38,4 @@ describe('Admin Topic Details HTML Template', function () {
     const result = template(ctx, config);
     assert(result);
   });
-
 });
diff --git a/test/src/template/template-helper.js b/test/src/template/template-helper.js
index 4ddf360..3ad7f83 100644
--- a/test/src/template/template-helper.js
+++ b/test/src/template/template-helper.js
@@ -75,6 +75,12 @@ describe('Template Helper', function () {
       const result = th.renderTopicRow(topic, subscribers);
       assert(result);
     });
+    it('covers empty', function () {
+      topic = null;
+      subscribers = null;
+      const result = th.renderTopicRow(topic, subscribers);
+      assert(result);
+    });
     it('covers no link', function () {
       subscribers = [{}, {}];
       const result = th.renderTopicRow(topic, subscribers, false);
@@ -103,6 +109,10 @@ describe('Template Helper', function () {
       const result = th.renderSubscriptionRow(subscription);
       assert(result);
     });
+    it('covers empty', function () {
+      const result = th.renderSubscriptionRow();
+      assert(result);
+    });
   }); // renderSubscriptionRow
 
   describe('renderSubscriptionRowHeader', function () {
@@ -179,6 +189,10 @@ describe('Template Helper', function () {
 
   describe('htmlFooter', function () {
     it('covers', function () {
+      const result = th.htmlFooter(['foo', 'bar']);
+      assert(result);
+    });
+    it('covers default', function () {
       const result = th.htmlFooter();
       assert(result);
     });
@@ -187,6 +201,7 @@ describe('Template Helper', function () {
   describe('htmlTemplate', function () {
     let pagePathLevel, pageTitle, headElements, navLinks, main;
     beforeEach(function () {
+      ctx = {};
       pagePathLevel = 1;
       pageTitle = 'title';
       headElements = [];
@@ -194,11 +209,26 @@ describe('Template Helper', function () {
       main = [];
     });
     it('covers', function () {
-      const result = th.htmlTemplate(pagePathLevel, pageTitle, headElements, navLinks, main);
+      const result = th.htmlTemplate(ctx, pagePathLevel, pageTitle, headElements, navLinks, main);
       assert(result);
     });
     it('covers defaults', function () {
-      const result = th.htmlTemplate(pagePathLevel, pageTitle);
+      const result = th.htmlTemplate(ctx, pagePathLevel, pageTitle);
+      assert(result);
+    });
+    it('covers user', function () {
+      ctx.session = {
+        authenticatedProfile: 'user',
+      };
+      const result = th.htmlTemplate(ctx, pagePathLevel, pageTitle);
+      assert(result);
+    });
+    it('covers user at root path', function () {
+      ctx.session = {
+        authenticatedIdentifier: 'user',
+      };
+      pagePathLevel = 0;
+      const result = th.htmlTemplate(ctx, pagePathLevel, pageTitle);
       assert(result);
     });
   }); // htmlTemplate