ident

6.4 KB

1. // lib/api-helpers.hl — the plumbing of the function routes (lib/api.hl): JSON answers, redirects, the HTML error
2. // page, the STRICT JSON body, the app's key + secret check of a call, the selector's CORS answers. Statics only.
3. //
4. // STRICT: a body must be a JSON object; an unknown field, a missing field and a field of
5. // the wrong type are each a 400 whose `error` names the field. hl:json's JSON.parse
6. // aborts the request (500) on invalid input and the language has no catch (hybriel #12),
7. // so the body's syntax is checked first by jsoncheck.hl (copied from tickets).
8. import { Response } from 'hl:http1'
9. import { jsonErrorAt } from './jsoncheck.hl'
10. import { appByKey, appOfSecret } from './apps.hl'
11. import { originsOf } from './apps-helpers.hl'
12. import { publicUrl } from './invites.hl'
14. static jsonHeaders = { 'Content-Type' = 'application/json; charset=utf-8' 'Cache-Control' = 'no-store' }
15. static htmlHeaders = { 'Content-Type' = 'text/html; charset=utf-8' 'Cache-Control' = 'no-store' }
17. static reply = (status, value) => { return new Response(JSON.stringify(value), { status = status headers = jsonHeaders }) }
18. static fail = (status, message) => { return reply(status, { error = message }) }
20. static redirect = (url) => { return new Response('', { status = 302 headers = { 'Location' = url 'Cache-Control' = 'no-store' } }) }
22. // THE STRICT BODY: `spec` maps each allowed field to { type ('String' | 'Number' |
23. // 'Boolean' | 'List'), required }. Answers { error } or { body }.
24. static strictBody = (req, spec) => {
25. raw = req.body
26. if (raw == null || raw.trim() == '') { return { error = 'a JSON object body is required' } }
27. at = jsonErrorAt(raw)
28. if (at >= 0) { return { error = 'the body is not valid JSON (at character ' + at + ')' } }
29. t = raw.trim()
30. if (t[0] != '{') { return { error = 'the body must be a JSON object' } }
31. b = JSON.parse(raw)
32. for (k of b.keys()) {
33. if (spec[k] == null) { return { error = 'unknown field: ' + k } }
34. }
35. for (k of spec.keys()) {
36. let f = spec[k]
37. let v = b[k]
38. if (v == null) {
39. if (f.required) { return { error = 'missing field: ' + k } }
40. } else if (f.type == 'List') {
41. if (hlTypeName(v) != 'Hybrid' || v.length == null) { return { error = 'field ' + k + ' must be a list' } }
42. } else if (hlTypeName(v) != f.type) {
43. return { error = 'field ' + k + ' must be a ' + f.type.toLowerCase() }
44. }
45. }
46. return { body = b }
47. }
49. // ---- the HTML error page of the login button (never a redirect) ------------------------
50. static escapeHtml = (s) => { return ('' + s).replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;') }
51. static errorPage = (status, title, message) => {
52. html = '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>ident | ' + escapeHtml(title) + '</title><style>:root{--dark:rgb(25, 30, 35);--darker:rgb(15, 20, 25);--light:rgb(195, 200, 205);--lighter:rgb(245, 250, 255);--red:#f44747;--color-background:var(--dark);--color-surface:rgb(35, 40, 45);--color-border:rgb(70, 75, 80);--color-text:var(--light);--color-danger:var(--red);--color-accent:#ce9178}html{color-scheme:dark}body{margin:0;font:16px/1.5 system-ui,sans-serif;color:var(--color-text);background:var(--color-background)}application-header{display:block;padding:.6rem 1rem;background:var(--darker);border-bottom:1px solid var(--color-border)}application-header a{font-weight:800;font-size:1.15rem;color:var(--color-accent);text-decoration:none}main{padding:2rem 1rem}ident-error{display:block;max-width:34rem;margin:0 auto;padding:1rem;background:var(--color-surface);border:1px solid var(--color-border);border-radius:.5rem}h1{margin:0 0 .5rem;font-size:1.2rem;color:var(--color-danger)}p{margin:0;overflow-wrap:anywhere}</style></head><body><application-header><a href="/">ident</a></application-header><main><ident-error id="identerror"><h1>' + escapeHtml(title) + '</h1><p id="errormessage">' + escapeHtml(message) + '</p></ident-error></main></body></html>'
53. return new Response(html, { status = status headers = htmlHeaders })
54. }
56. // ---- THE APP'S CALLS (key + secret, strict JSON body) ------------------------------------------
57. static field = (n, t) => { return { type = t required = n } }
58. // POST only, the strict body `spec`, then the app of its key + secret: answers { res } (the refusal) or { app, body }
59. static inviteCaller = (req, spec) => {
60. if (req.method != 'POST') { return { res = fail(405, 'POST only') } }
61. b = strictBody(req, spec)
62. if (b.error != null) { return { res = fail(400, b.error) } }
63. a = appOfSecret(b.body.key, b.body.secret)
64. if (a == null) { return { res = fail(401, 'unknown API key or wrong secret') } }
65. return { app = a body = b.body }
66. }
67. // where an invite link points: IDENT_PUBLIC_URL, else the request's own host
68. static baseOf = (req) => {
69. if (publicUrl != null) { return publicUrl }
70. proto = req.headers['x-forwarded-proto'] != null ? req.headers['x-forwarded-proto'] : 'http'
71. return proto + '://' + req.headers['host']
72. }
74. // a login request id is 32 hex (lib/apps.hl openRequest)
75. static hexId = (v) => {
76. if (v.length != 32) { return false }
77. let i = 0
78. while (i < v.length) {
79. if (!'0123456789abcdef'.includes(v[i])) { return false }
80. i = i + 1
81. }
82. return true
83. }
85. // ---- THE SELECTOR's CORS answers (lib/selector.hl) ----------------------------------------------
86. static jsonType = 'application/json; charset=utf-8'
88. // the refusal: no CORS headers → the browser gives the page nothing
89. static refuse = (status, message) => {
90. return new Response(JSON.stringify({ error = message }), { status = status headers = { 'Content-Type' = jsonType 'Cache-Control' = 'no-store' 'Vary' = 'Origin' } })
91. }
92. static corsHeaders = (origin) => {
93. return { 'Content-Type' = jsonType 'Cache-Control' = 'no-store' 'Vary' = 'Origin' 'Access-Control-Allow-Origin' = origin 'Access-Control-Allow-Credentials' = 'true' }
94. }
95. static answer = (origin, status, value) => {
96. return new Response(JSON.stringify(value), { status = status headers = corsHeaders(origin) })
97. }
99. // WHO ASKS: answers { app (record), origin } or { status, error }
100. static caller = (req) => {
101. let origin = req.headers['origin']
102. if (origin == null || origin == '') { return { status = 403 error = 'the selector answers browsers only (no Origin header)' } }
103. q = req.query != null ? req.query : {}
104. a = appByKey(q.key)
105. if (a == null) { return { status = 403 error = 'no app has this API key' } }
106. if (!originsOf(a).includes(origin)) { return { status = 403 error = 'this origin is not registered for the app' } }
107. return { app = a origin = origin }
108. }