ident

4.9 KB

1. // lib/identities-helpers.hl — what lib/identities.hl looks up: the strict identity fields, the avatar check, the
2. // short id's alphabet, the label a list shows. No table access. Statics only.
3. import { randomBytes } from 'hl:crypto'
4. import { str, hasControl } from './util.hl'
6. static maxField = 60 // chars per identity field
7. static fieldNames = ['identityName' 'nickname' 'firstname' 'lastname']
8. // THE AVATAR (ticket #15): an uploaded picture, stored as a small data URL (the page scales it to
9. // 128×128) — not a text field, so it is checked and stored separately from fieldNames/maxField
10. static maxAvatarUrl = 60000
11. static avatarChars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/='
13. // AN AVATAR: empty (none) or the uploaded picture as a data URL — data:image/(png|jpeg|webp);base64,
14. // with the file's own magic bytes at the start of the base64 text (the page scales the upload to
15. // 128×128 first, avatar.js), ≤ maxAvatarUrl characters, base64 characters only
16. static checkAvatarUrl = (v) => {
17. if (v == null || hlTypeName(v) != 'String') { return { error = 'field avatar must be a string' } }
18. t = v.trim()
19. if (t == '') { return { avatar = '' } }
20. if (t.length > maxAvatarUrl) { return { error = 'field avatar is longer than ' + maxAvatarUrl + ' characters' } }
21. let kind = ''
22. let start = 0
23. if (t.startsWith('data:image/png;base64,')) { kind = 'iVBORw0KGgo' start = 22 }
24. else if (t.startsWith('data:image/jpeg;base64,')) { kind = '/9j/' start = 23 }
25. else if (t.startsWith('data:image/webp;base64,')) { kind = 'UklGR' start = 23 }
26. if (kind == '') { return { error = 'field avatar must be an uploaded PNG, JPEG or WebP picture' } }
27. data = t.slice(start, t.length)
28. if (!data.startsWith(kind)) { return { error = 'field avatar is not a valid picture' } }
29. let i = 0
30. while (i < data.length) {
31. if (!avatarChars.includes(data[i])) { return { error = 'field avatar is not valid base64' } }
32. i = i + 1
33. }
34. return { avatar = t }
35. }
37. // the avatar to show: only an uploaded picture (a data URL). Before the upload existed an avatar
38. // was an http(s) URL; those are no longer shown (never fetched from a third-party address).
39. static shownAvatar = (r) => { return str(r.avatar).startsWith('data:image/') ? str(r.avatar) : '' }
41. // THE IDENTITY FIELDS, STRICT: `fields` is an object whose keys are among fieldNames plus
42. // `avatar`. A name field is a string (trimmed, at most 60 chars, no control characters);
43. // `avatar` is checked by checkAvatarUrl. Absent keys are absent from the answer.
44. // Answers { error, field } or { fields }.
45. static checkFields = (fields) => {
46. if (fields == null || hlTypeName(fields) != 'Hybrid' || fields.length != null) { return { error = 'the identity fields must be an object' field = '' } }
47. out = {}
48. for (k of fields.keys()) {
49. if (k == 'avatar') {
50. let c = checkAvatarUrl(fields[k])
51. if (c.error != null) { return { error = c.error field = 'avatar' } }
52. out.avatar = c.avatar
53. } else if (!fieldNames.includes(k)) { return { error = 'unknown field: ' + k field = k } }
54. else {
55. let v = fields[k]
56. if (v == null || hlTypeName(v) != 'String') { return { error = 'field ' + k + ' must be a string' field = k } }
57. let t = v.trim()
58. if (t.length > maxField) { return { error = 'field ' + k + ' is longer than ' + maxField + ' characters' field = k } }
59. if (hasControl(t)) { return { error = 'field ' + k + ' contains a control character' field = k } }
60. out[k] = t
61. }
62. }
63. return { fields = out }
64. }
66. // WHAT A LIST SHOWS: the identity name; without one, nickname, then first + last name,
67. // then "Identity <n>" (n = its place in the list)
68. static labelOf = (r, n) => {
69. if (str(r.identityName) != '') { return r.identityName }
70. if (str(r.nickname) != '') { return r.nickname }
71. full = (str(r.firstname) + ' ' + str(r.lastname)).trim()
72. if (full != '') { return full }
73. return 'Identity ' + n
74. }
76. // ---- THE SHORT ID's shape (ident#23; lib/identities.hl makes and finds them) -------------------
77. // 5 characters from an alphabet without look-alikes — digits 2-9 and the letters minus i, l, o
78. // (no 0/O, 1/l/I): 31 characters, 28.6 million ids
79. static shortAlphabet = '23456789abcdefghjkmnpqrstuvwxyz'
80. static shortLength = 5
81. static newShortId = () => {
82. let out = ''
83. while (out.length < shortLength) {
84. let hex = randomBytes(16)
85. let i = 0
86. while (i < 32 && out.length < shortLength) {
87. let b = '0123456789abcdef'.indexOf(hex[i]) * 16 + '0123456789abcdef'.indexOf(hex[i + 1])
88. // 248 = 8 * 31: bytes above it are dropped so every character is equally likely
89. if (b < 248) { out = out + shortAlphabet[b % 31] }
90. i = i + 2
91. }
92. }
93. return out
94. }
95. // what a person typed → the lowercase form, or null when it cannot be a short id
96. static normShortId = (v) => {
97. if (v == null || hlTypeName(v) != 'String') { return null }
98. t = v.trim().toLowerCase()
99. if (t.length != shortLength) { return null }
100. let i = 0
101. while (i < t.length) {
102. if (shortAlphabet.indexOf(t[i]) < 0) { return null }
103. i = i + 1
104. }
105. return t
106. }