ident

2.8 KB

1. // lib/selector.hl — THE IDENTITY SELECTOR (piece 3 of 6, ticket #26; CONCEPT.md "Flow 2: identity selector"
2. // and "Decided 2026-09-24"). Statics only, the server realm. Its two CORS endpoints are lib/api.hl
3. // (apiSelectorIdentities, apiSelectorChoose; the CORS answers and the caller check: lib/api-helpers.hl);
4. // the browser half is selector.js (served at /selector.js).
5. //
6. // GET /api/selector/identities?key=<api key> → { signedIn, identities: [{ id, name }] }
7. // POST /api/selector/choose?key=<api key> { identity: <id from the list> } → { code }
8. // OPTIONS /api/selector/choose?key=… the CORS preflight of the POST
9. //
10. // CORS: ident answers ONLY a request whose Origin header is one of the app's registered
11. // origins AND whose key is that app's API key. Then (and only then) the answer carries
12. // `Access-Control-Allow-Origin: <that exact origin>` and `…-Allow-Credentials: true`
13. // (never `*`). Anything else is a 403 without those headers: the browser hands the page
14. // nothing, and nothing is written.
15. // The ident user is the one of the `identsid` cookie the browser sends along (credentials;
16. // SameSite=Lax, so it only travels from the SAME SITE — our apps; other ports of the same
17. // host count). Function routes get no session: it is resolved from the cookie (hybriel #18).
18. //
19. // THE LIST'S ids are not ident's identity ids: each is sha256(app's secret hash : identity)
20. // cut to 32 hex — stable for one app, different for every app, not guessable, and it
21. // means nothing outside this selector. The CODE of a choice follows the login button's
22. // rules exactly (lib/apps.hl issueCode: single use, 60 s, this app only); the host's server
23. // trades it with POST /api/exchange (key + secret) for the app-specific identity id.
24. import { sha256 } from 'hl:crypto'
25. import { issueCode } from './apps.hl'
26. import { identityRecords } from './identities.hl'
27. import { labelOf } from './identities-helpers.hl'
29. // (since mission 009 the identity's id is its UUID, so every pick id changed once then)
30. static pickOf = (appRec, identityRec) => { return sha256(appRec.secretHash + ':' + identityRec.id).slice(0, 32) }
32. // the account's identities for the app's page: the id to pick it by and the identity
33. // name (CONCEPT.md: "that one is shown in the selector"; blank → the list's fallback)
34. static selectorList = (appRec, accountId) => {
35. out = []
36. let n = 1
37. for (r of identityRecords(accountId)) {
38. out.push({ id = pickOf(appRec, r) name = labelOf(r, n) })
39. n = n + 1
40. }
41. return out
42. }
44. // THE CHOICE: the account's identity whose pick id is `pick` gets a one-time code for the app. Answers the
45. // code, or null (no such identity).
46. static codeOfPick = (appRec, accountId, pick) => {
47. for (r of identityRecords(accountId)) {
48. if (pickOf(appRec, r) == pick) {
49. return issueCode(appRec.id, r.id)
50. }
51. }
52. return null
53. }