ident

27.3 KB

1. // store.hl — THE SERVER REALM of ident.worldapi.org. hl:mpackdb tables and the rules
2. // that read and write them; statics only (a component imports what it reads by brace).
3. // Concept: CONCEPT.md (the creator's; source of truth). This is piece 1 of 6 (ticket #24):
4. // the account, its identities and its time zone.
5. //
6. // CREATOR'S CONVENTIONS (2026-09-24, ticket ident #10 / old #39, mission 009): every
7. // primary key is the mpackdb UUID (`@id`, a 12-char string like '0mufbkwhlpjq'), never a
8. // `*id` counter; the files live in storage/mpackdb/<table>.*. The public ids ARE these
9. // UUIDs (accounts, identities, apps). Order never comes from key order: "oldest first"
10. // sorts by the stored `created` time (then the id, only to break a tie).
11. // Rows migrated from the old `*id` store (tools/migrate-009.hl) carry `oldId` = the old
12. // public id (old mpackdb id + 1) — only the migration reads it.
13. //
14. // accountsTable pk @id index !email { email (lowercased), timeZone, created }
15. // identitiesTable pk @id index @account, !shortId { account (account @id), shortId (5 chars, the PUBLIC id, ident#23), identityName, nickname,
16. // firstname, lastname, avatar (data URL of the uploaded picture, ticket #15), created, updated }
17. // every field but `account` optional
18. // otpTable pk @id index email a pending one-time login code:
19. // { email, hash = sha256(email:code), expires, tries } (one per email)
20. // sendsTable pk @id index email one row per code mailed: { email, at } (rate limit)
21. // ipSendsTable pk @id index ip one row per code mailed: { ip (the client's BUCKET), at }
22. // (the per-IP limit, mission 010)
23. //
24. // NO REGISTRATION: the first right code for an address creates the account AND its
25. // default identity. An account ALWAYS has at least one identity: the last one cannot
26. // be deleted. The DEFAULT identity is the account's oldest remaining one (by `created`).
27. // Codes are never stored in clear, only their sha256.
28. import { MPackDB } from 'hl:mpackdb'
29. import { env } from 'hl:proc'
30. import { now } from 'hl:time'
31. import { randomBytes, sha256 } from 'hl:crypto'
33. // IDENT_STORAGE names another table DIRECTORY (the gates run on their own). Relative
34. // paths resolve against the ENTRY SCRIPT's directory — tools must pass an absolute one.
35. static dir = env('IDENT_STORAGE') != null ? env('IDENT_STORAGE') : './storage/mpackdb'
36. static accountsTable = new MPackDB(file = dir + '/accounts.db', primaryKey = '@id', indexes = ['!email'])
37. static identitiesTable = new MPackDB(file = dir + '/identities.db', primaryKey = '@id', indexes = ['@account' '!shortId'])
38. static otpTable = new MPackDB(file = dir + '/otp.db', primaryKey = '@id', indexes = ['email'])
39. static sendsTable = new MPackDB(file = dir + '/sends.db', primaryKey = '@id', indexes = ['email'])
40. static ipSendsTable = new MPackDB(file = dir + '/ipsends.db', primaryKey = '@id', indexes = ['ip'])
42. static envNumber = (name, fallback) => {
43. let v = env(name)
44. if (v == null || v == '') { return fallback }
45. let n = toNumber(v)
46. return n == null ? fallback : n
47. }
49. // THE CLOCKS AND LIMITS (ms). The env names exist for the gate's short-clock server.
50. static otpTtl = envNumber('IDENT_OTP_TTL_MS', 600000) // a login code: 10 min
51. static maxTries = 5 // wrong codes before it dies
52. static sendWindow = envNumber('IDENT_SEND_WINDOW_MS', 600000) // rate limit window: 10 min
53. static sendLimit = envNumber('IDENT_SEND_LIMIT', 3) // codes per email per window
54. // THE PER-IP LIMIT (mission 010): codes mailed per client IP BUCKET (see ipBucket) —
55. // 10 per 10 min and 30 per 24 h, so one client cannot use ident to mail many addresses
56. static ipWindow = envNumber('IDENT_IP_WINDOW_MS', 600000) // short window: 10 min
57. static ipLimit = envNumber('IDENT_IP_LIMIT', 10) // codes per IP per short window
58. static ipDayWindow = envNumber('IDENT_IP_DAY_WINDOW_MS', 86400000) // long window: 24 h
59. static ipDayLimit = envNumber('IDENT_IP_DAY_LIMIT', 30) // codes per IP per long window
60. // A SIGNED-IN SESSION'S OWN EXPIRY (ticket #2, hardening): independent of the hl:web
61. // session file's rolling idle/maxAge, so a browser left open cannot stay signed in to
62. // ident forever — the account's OTP must be proven again after this many ms.
63. static sessionUserTtl = envNumber('IDENT_SESSION_TTL_MS', 1209600000) // 14 days
64. static maxField = 60 // chars per identity field
65. static fieldNames = ['identityName' 'nickname' 'firstname' 'lastname']
66. // THE AVATAR (ticket #15): an uploaded picture, stored as a small data URL (the page scales it to
67. // 128×128) — not a text field, so it is checked and stored separately from fieldNames/maxField
68. static maxAvatarUrl = 60000
69. static avatarChars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/='
71. // an empty list written to hl:mpackdb comes back as an empty hybrid (`.length` null)
72. static countOf = (list) => {
73. if (list == null) { return 0 }
74. let n = list.length
75. return n == null ? 0 : n
76. }
77. static first = (list) => { return countOf(list) > 0 ? list[0] : null }
79. // A PUBLIC ID is an mpackdb UUID: a non-empty string (a number is never one — an old
80. // numeric id from before mission 009 finds nothing)
81. static isId = (v) => { return v != null && hlTypeName(v) == 'String' && v.length > 0 && v.length <= 64 }
83. // OLDEST FIRST: by the stored `created`, a tie by the id (never by key order)
84. static olderThan = (a, b) => {
85. let ca = a.created == null ? 0 : a.created
86. let cb = b.created == null ? 0 : b.created
87. if (ca != cb) { return ca < cb }
88. return a.id < b.id // strings order by code point (hybriel#2)
89. }
90. // a found list, oldest first (insertion sort by hand: no list sort(), hybriel #6)
91. static oldestFirst = (list) => {
92. let out = []
93. if (countOf(list) == 0) { return out }
94. for (x of list) { out.push(x) }
95. let i = 1
96. while (i < out.length) {
97. let cur = out[i]
98. let j = i - 1
99. while (j >= 0 && olderThan(cur, out[j])) {
100. out[j + 1] = out[j]
101. j = j - 1
102. }
103. out[j + 1] = cur
104. i = i + 1
105. }
106. return out
107. }
109. // every record is written as a whole (hl:mpackdb's update replaces it)
110. static merged = (rec, changes) => {
111. let out = {}
112. for (k of rec.keys()) { out[k] = rec[k] }
113. for (k of changes.keys()) { out[k] = changes[k] }
114. return out
115. }
117. // ---- validation -----------------------------------------------------------------------
118. static normEmail = (email) => { return email == null ? '' : ('' + email).trim().toLowerCase() }
120. static validEmail = (email) => {
121. if (email == null || email.length < 3 || email.length > 200) { return false }
122. let at = email.indexOf('@')
123. if (at < 1 || at != email.lastIndexOf('@') || at == email.length - 1) { return false }
124. if (!email.slice(at + 1, email.length).includes('.')) { return false }
125. // a whitelist: the language has no escapes to name a CR or a tab with
126. let ok = 'abcdefghijklmnopqrstuvwxyz0123456789.-_+@'
127. let i = 0
128. while (i < email.length) {
129. if (!ok.includes(email[i])) { return false }
130. i = i + 1
131. }
132. return true
133. }
135. // no control characters (a field is one line of text)
136. static hasControl = (s) => {
137. let i = 0
138. while (i < s.length) {
139. let c = s.charCodeAt(i)
140. if (c < 32 || c == 127) { return true }
141. i = i + 1
142. }
143. return false
144. }
146. // A TIME ZONE is an IANA name as the browser reports it (`Europe/Vienna`, `UTC`,
147. // `America/Argentina/Buenos_Aires`, `Etc/GMT+5`). hl:time knows no zones (hybriel #11),
148. // so the server checks the SHAPE only; the page checks the name against the browser's
149. // own list (Intl.supportedValuesOf) before it sends it.
150. static zoneChars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789/_+-'
151. static checkTimeZone = (tz) => {
152. if (tz == null || hlTypeName(tz) != 'String') { return { error = 'the time zone must be a string' } }
153. let t = tz.trim()
154. if (t == '') { return { error = 'the time zone is empty' } }
155. if (t.length > 64) { return { error = 'the time zone name is too long' } }
156. let i = 0
157. while (i < t.length) {
158. if (!zoneChars.includes(t[i])) { return { error = 'that is not a time zone name (like Europe/Vienna)' } }
159. i = i + 1
160. }
161. if (t[0] == '/' || t[t.length - 1] == '/' || t.includes('//')) { return { error = 'that is not a time zone name (like Europe/Vienna)' } }
162. return { timeZone = t }
163. }
165. // AN AVATAR: empty (none) or the uploaded picture as a data URL — data:image/(png|jpeg|webp);base64,
166. // with the file's own magic bytes at the start of the base64 text (the page scales the upload to
167. // 128×128 first, avatar.js), ≤ maxAvatarUrl characters, base64 characters only
168. static checkAvatarUrl = (v) => {
169. if (v == null || hlTypeName(v) != 'String') { return { error = 'field avatar must be a string' } }
170. let t = v.trim()
171. if (t == '') { return { avatar = '' } }
172. if (t.length > maxAvatarUrl) { return { error = 'field avatar is longer than ' + maxAvatarUrl + ' characters' } }
173. let kind = ''
174. let start = 0
175. if (t.startsWith('data:image/png;base64,')) { kind = 'iVBORw0KGgo' start = 22 }
176. else if (t.startsWith('data:image/jpeg;base64,')) { kind = '/9j/' start = 23 }
177. else if (t.startsWith('data:image/webp;base64,')) { kind = 'UklGR' start = 23 }
178. if (kind == '') { return { error = 'field avatar must be an uploaded PNG, JPEG or WebP picture' } }
179. let data = t.slice(start, t.length)
180. if (!data.startsWith(kind)) { return { error = 'field avatar is not a valid picture' } }
181. let i = 0
182. while (i < data.length) {
183. if (!avatarChars.includes(data[i])) { return { error = 'field avatar is not valid base64' } }
184. i = i + 1
185. }
186. return { avatar = t }
187. }
189. // the avatar to show: only an uploaded picture (a data URL). Before the upload existed an avatar
190. // was an http(s) URL; those are no longer shown (never fetched from a third-party address).
191. static shownAvatar = (r) => { return str(r.avatar).startsWith('data:image/') ? str(r.avatar) : '' }
193. // THE IDENTITY FIELDS, STRICT: `fields` is an object whose keys are among fieldNames plus
194. // `avatar`. A name field is a string (trimmed, at most 60 chars, no control characters);
195. // `avatar` is checked by checkAvatarUrl. Absent keys are absent from the answer.
196. // Answers { error, field } or { fields }.
197. static checkFields = (fields) => {
198. if (fields == null || hlTypeName(fields) != 'Hybrid' || fields.length != null) { return { error = 'the identity fields must be an object' field = '' } }
199. let out = {}
200. for (k of fields.keys()) {
201. if (k == 'avatar') {
202. let c = checkAvatarUrl(fields[k])
203. if (c.error != null) { return { error = c.error field = 'avatar' } }
204. out.avatar = c.avatar
205. } else if (!fieldNames.includes(k)) { return { error = 'unknown field: ' + k field = k } }
206. else {
207. let v = fields[k]
208. if (v == null || hlTypeName(v) != 'String') { return { error = 'field ' + k + ' must be a string' field = k } }
209. let t = v.trim()
210. if (t.length > maxField) { return { error = 'field ' + k + ' is longer than ' + maxField + ' characters' field = k } }
211. if (hasControl(t)) { return { error = 'field ' + k + ' contains a control character' field = k } }
212. out[k] = t
213. }
214. }
215. return { fields = out }
216. }
218. // ---- codes --------------------------------------------------------------------------
219. // six digits from the kernel CSPRNG (randomBytes answers hex)
220. static newOtp = () => {
221. let hex = randomBytes(8)
222. let n = 0
223. let i = 0
224. while (i < 12) {
225. n = (n * 16 + '0123456789abcdef'.indexOf(hex[i])) % 1000000
226. i = i + 1
227. }
228. let s = '' + n
229. while (s.length < 6) { s = '0' + s }
230. return s
231. }
232. static otpHash = (email, code) => { return sha256(email + ':' + code) }
234. // ---- accounts -------------------------------------------------------------------------
235. // PUBLIC ACCOUNT / IDENTITY IDS are the records' UUIDs
236. static accountRowOf = (a) => { return a == null ? null : { id = a.id email = a.email timeZone = a.timeZone } }
237. static accountById = (id) => { return isId(id) ? accountRowOf(accountsTable.fetch(id)) : null }
238. static accountByEmail = (email) => { return accountRowOf(first(accountsTable.find('email', normEmail(email)))) }
240. // the account a session carries, re-read from the table (null when signed out or gone).
241. // ONLY A REAL SESSION COUNTS: a face's trailing `session` argument is positional, so a
242. // hand-made emit with one argument too many would hand the face its own object in the
243. // session's place (see README "Lessons"); the framework's session is a class instance (hlTypeName 'Instance'), JSON never is.
245. // SIGNS A SESSION IN (ticket #2): stamps `since` (this session's own expiry, sessionUserTtl)
246. // and `epoch` (the account's current sessionEpoch — "sign out everywhere" bumps it, which
247. // makes every session that still carries the old epoch read as signed out, see below).
248. static accountEpoch = (a) => { return a.sessionEpoch == null ? 0 : a.sessionEpoch }
249. static beginSession = (session, accountId) => {
250. if (session == null) { return false }
251. let a = isId(accountId) ? accountsTable.fetch(accountId) : null
252. if (a == null) { return false }
253. session.user = { id = accountId since = now() epoch = accountEpoch(a) }
254. return true
255. }
257. static accountOfSession = (session) => {
258. if (session == null || session.user == null) { return null }
259. let a = accountsTable.fetch(session.user.id)
260. if (a == null) { session.user = null return null }
261. // AN OLDER SESSION (before ticket #2, incl. one carried across the mission-009
262. // migration): it has no `since`/`epoch` yet. Adopt them now instead of forcing
263. // everyone signed out the moment this ships — its own-expiry clock starts here.
264. if (session.user.since == null || session.user.epoch == null) {
265. session.user = { id = session.user.id since = now() epoch = accountEpoch(a) }
266. return accountRowOf(a)
267. }
268. if (now() - session.user.since > sessionUserTtl || session.user.epoch != accountEpoch(a)) {
269. session.user = null
270. return null
271. }
272. return accountRowOf(a)
273. }
275. // "SIGN OUT EVERYWHERE": bumps the account's sessionEpoch, so every session that carries
276. // this account (this one included — the caller's UI resets the same as a normal sign out)
277. // stops working at its next check, on every device, without touching any other session file.
278. // The session files themselves are DELETED too (project.hl hands in `dropUser`, it owns the
279. // session store); the epoch stays as the second net for any session the sweep did not see.
280. static sessionHooks = { dropUser = null }
281. static signOutEverywhere = (accountId) => {
282. let a = isId(accountId) ? accountsTable.fetch(accountId) : null
283. if (a == null) { return { error = 'no such account' } }
284. if (sessionHooks.dropUser != null) { sessionHooks.dropUser(accountId) }
285. accountsTable.update(a.id, merged(a, { sessionEpoch = accountEpoch(a) + 1 }))
286. return { ok = true }
287. }
289. static setTimeZone = (accountId, tz) => {
290. let c = checkTimeZone(tz)
291. if (c.error != null) { return c }
292. let a = isId(accountId) ? accountsTable.fetch(accountId) : null
293. if (a == null) { return { error = 'no such account' } }
294. accountsTable.update(a.id, merged(a, { timeZone = c.timeZone }))
295. return { account = accountRowOf(accountsTable.fetch(a.id)) }
296. }
298. // ---- THE SHORT ID (ident#23) ------------------------------------------------------------
299. // ONE PUBLIC ID per identity, kept forever, the same in every app: 5 characters (e.g. a68sz)
300. // from an alphabet without look-alikes — digits 2-9 and the letters minus i, l, o (no 0/O,
301. // 1/l/I): 31 characters, 28.6 million ids. Case does not matter (stored lowercase, looked up
302. // lowercased). Unique: checked against the `!shortId` index when it is made. Random (not
303. // counted), so it says nothing about how many identities exist.
304. static shortAlphabet = '23456789abcdefghjkmnpqrstuvwxyz'
305. static shortLength = 5
306. static newShortId = () => {
307. let out = ''
308. while (out.length < shortLength) {
309. let hex = randomBytes(16)
310. let i = 0
311. while (i < 32 && out.length < shortLength) {
312. let b = '0123456789abcdef'.indexOf(hex[i]) * 16 + '0123456789abcdef'.indexOf(hex[i + 1])
313. // 248 = 8 * 31: bytes above it are dropped so every character is equally likely
314. if (b < 248) { out = out + shortAlphabet[b % 31] }
315. i = i + 2
316. }
317. }
318. return out
319. }
320. // a fresh short id nobody has
321. static freshShortId = () => {
322. let id = newShortId()
323. while (countOf(identitiesTable.find('shortId', id)) > 0) { id = newShortId() }
324. return id
325. }
326. // what a person typed → the lowercase form, or null when it cannot be a short id
327. static normShortId = (v) => {
328. if (v == null || hlTypeName(v) != 'String') { return null }
329. let t = v.trim().toLowerCase()
330. if (t.length != shortLength) { return null }
331. let i = 0
332. while (i < t.length) {
333. if (shortAlphabet.indexOf(t[i]) < 0) { return null }
334. i = i + 1
335. }
336. return t
337. }
338. static identityByShortId = (v) => {
339. let t = normShortId(v)
340. return t == null ? null : first(identitiesTable.find('shortId', t))
341. }
342. // every identity made before ident#23 gets its short id now, once (at load)
343. static backfillShortIds = () => {
344. let n = 0
345. let rows = identitiesTable.find(null, null)
346. if (countOf(rows) > 0) {
347. for (r of rows) {
348. if (r.shortId == null || r.shortId == '') {
349. identitiesTable.update(r.id, merged(r, { shortId = freshShortId() }))
350. n = n + 1
351. }
352. }
353. }
354. return n
355. }
356. static shortIdsBackfilled = backfillShortIds()
358. // ---- identities -----------------------------------------------------------------------
359. static str = (v) => { return v == null ? '' : v }
361. // the account's identities, oldest first (stored `created`); the first is the DEFAULT one
362. static identityRecords = (accountId) => {
363. if (!isId(accountId)) { return [] }
364. return oldestFirst(identitiesTable.find('account', accountId))
365. }
367. // WHAT A LIST SHOWS: the identity name; without one, nickname, then first + last name,
368. // then "Identity <n>" (n = its place in the list)
369. static labelOf = (r, n) => {
370. if (str(r.identityName) != '') { return r.identityName }
371. if (str(r.nickname) != '') { return r.nickname }
372. let full = (str(r.firstname) + ' ' + str(r.lastname)).trim()
373. if (full != '') { return full }
374. return 'Identity ' + n
375. }
377. static identityRows = (accountId) => {
378. let recs = identityRecords(accountId)
379. let out = []
380. let n = 1
381. for (r of recs) {
382. let full = (str(r.firstname) + ' ' + str(r.lastname)).trim()
383. let parts = []
384. if (str(r.nickname) != '') { parts.push('“' + r.nickname + '”') }
385. if (full != '') { parts.push(full) }
386. out.push({
387. id = r.id
388. shortId = str(r.shortId)
389. label = labelOf(r, n)
390. identityName = str(r.identityName)
391. nickname = str(r.nickname)
392. firstname = str(r.firstname)
393. lastname = str(r.lastname)
394. avatar = shownAvatar(r)
395. hasAvatar = shownAvatar(r) != ''
396. details = parts.length > 0 ? parts.join(' · ') : 'no names'
397. isDefault = n == 1
398. canDelete = recs.length > 1
399. })
400. n = n + 1
401. }
402. return out
403. }
405. // the identity `id` if it belongs to the account, else null
406. static ownIdentity = (accountId, id) => {
407. if (!isId(id)) { return null }
408. let r = identitiesTable.fetch(id)
409. if (r == null || r.account != accountId) { return null }
410. return r
411. }
413. // answers { error, field } or { identity (public id) }
414. static createIdentity = (accountId, fields) => {
415. let c = checkFields(fields)
416. if (c.error != null) { return c }
417. let rec = { account = accountId shortId = freshShortId() identityName = '' nickname = '' firstname = '' lastname = '' avatar = '' created = now() updated = now() }
418. for (k of c.fields.keys()) { rec[k] = c.fields[k] }
419. let id = identitiesTable.put(rec)
420. return { identity = id }
421. }
423. // only the fields named change; answers { error, field } or { identity }
424. static updateIdentity = (accountId, id, fields) => {
425. let r = ownIdentity(accountId, id)
426. if (r == null) { return { error = 'no such identity' field = 'id' } }
427. let c = checkFields(fields)
428. if (c.error != null) { return c }
429. let changes = { updated = now() }
430. for (k of c.fields.keys()) { changes[k] = c.fields[k] }
431. identitiesTable.update(r.id, merged(r, changes))
432. return { identity = id }
433. }
435. // THE LAST IDENTITY STAYS: answers { error } or { deleted }
436. static deleteIdentity = (accountId, id) => {
437. let r = ownIdentity(accountId, id)
438. if (r == null) { return { error = 'no such identity' } }
439. if (identityRecords(accountId).length <= 1) { return { error = 'this is your only identity — an account always keeps one' } }
440. identitiesTable.delete(r.id)
441. return { deleted = id }
442. }
444. // ---- the client's IP bucket (mission 010) -------------------------------------------
445. // `ip` is the X-Client-IP header nginx sets on Byrodin (CF-Connecting-IP when the request
446. // really came through Cloudflare, else the TCP peer; nginx OVERWRITES what a client sent),
447. // or null when there is none (dev without nginx: hl:web's req.remoteAddress would be nginx's; hl:http1 did not expose the
448. // connection's peer address). The bucket:
449. // no header / empty → 'direct' ONE SHARED BUCKET for every header-less request
450. // IPv4 (also ::ffff:a.b.c.d) → the address
451. // IPv6 → its /64 prefix ('2a01:4f9:3080:1126::/64'): one client
452. // usually owns a whole /64, so per-address would not limit it
453. // anything else → the text itself (lowercased, cut to 64 chars)
454. static hexDigits = '0123456789abcdef'
455. static stripZeros = (g) => {
456. let t = g
457. while (t.length > 1 && t[0] == '0') { t = t.slice(1, t.length) }
458. return t
459. }
460. static ipBucket = (ip) => {
461. if (ip == null || hlTypeName(ip) != 'String') { return 'direct' }
462. let t = ip.trim().toLowerCase()
463. if (t == '') { return 'direct' }
464. if (t.length > 64) { t = t.slice(0, 64) }
465. if (!t.includes(':')) { return t }
466. // an IPv4-mapped IPv6 address counts as its IPv4 address
467. if (t.includes('.')) { return t.slice(t.lastIndexOf(':') + 1, t.length) }
468. let head = t
469. let tail = ''
470. let gap = t.indexOf('::')
471. if (gap >= 0) {
472. head = t.slice(0, gap)
473. tail = t.slice(gap + 2, t.length)
474. }
475. let groups = head == '' ? [] : head.split(':')
476. let rest = tail == '' ? [] : tail.split(':')
477. if (gap >= 0) {
478. let fill = 8 - groups.length - rest.length
479. while (fill > 0) {
480. groups.push('0')
481. fill = fill - 1
482. }
483. }
484. for (g of rest) { groups.push(g) }
485. if (groups.length != 8) { return t }
486. let out = []
487. let i = 0
488. while (i < 4) {
489. let g = groups[i]
490. if (g == '' || g.length > 4) { return t }
491. let j = 0
492. while (j < g.length) {
493. if (!hexDigits.includes(g[j])) { return t }
494. j = j + 1
495. }
496. out.push(stripZeros(g))
497. i = i + 1
498. }
499. return out.join(':') + '::/64'
500. }
502. // how many codes went to this bucket in the short and in the long window (and the rows
503. // older than the long window are removed on the way)
504. static ipCounts = (bucket, t0) => {
505. let inWindow = 0
506. let inDay = 0
507. let rows = ipSendsTable.find('ip', bucket)
508. if (countOf(rows) > 0) {
509. for (s of rows) {
510. if (s.at > t0 - ipDayWindow) {
511. inDay = inDay + 1
512. if (s.at > t0 - ipWindow) { inWindow = inWindow + 1 }
513. } else {
514. ipSendsTable.delete(s.id)
515. }
516. }
517. }
518. return { inWindow = inWindow inDay = inDay }
519. }
521. // ---- step 1: ask for a code ---------------------------------------------------------
522. // answers { error, limited } or { email, code } — the caller mails the code. The answer
523. // does not say whether the address has an account (the first login creates it).
524. // `ip` is the client's IP (the X-Client-IP header, or null — see ipBucket). `limited` is
525. // true when a limit refused it (the route answers 429 then).
526. static startLogin = (email, ip) => {
527. let e = normEmail(email)
528. if (!validEmail(e)) { return { error = 'that is not an email address' } }
529. let t0 = now()
530. // THE PER-IP LIMIT first: one client, many addresses
531. let bucket = ipBucket(ip)
532. let ipc = ipCounts(bucket, t0)
533. if (ipc.inWindow >= ipLimit || ipc.inDay >= ipDayLimit) {
534. return { error = 'too many codes were requested from your network — wait a while and try again' limited = true }
535. }
536. let recent = 0
537. let sends = sendsTable.find('email', e)
538. if (countOf(sends) > 0) {
539. for (s of sends) {
540. if (s.at > t0 - sendWindow) { recent = recent + 1 } else { sendsTable.delete(s.id) }
541. }
542. }
543. if (recent >= sendLimit) {
544. return { error = 'too many codes were sent to this address — wait a few minutes and try again' limited = true }
545. }
546. let olds = otpTable.find('email', e)
547. if (countOf(olds) > 0) { for (old of olds) { otpTable.delete(old.id) } }
548. let code = newOtp()
549. otpTable.put({ email = e hash = otpHash(e, code) expires = t0 + otpTtl tries = 0 })
550. sendsTable.put({ email = e at = t0 })
551. ipSendsTable.put({ ip = bucket at = t0 })
552. return { email = e code = code }
553. }
555. // ---- step 2: check it — and on the FIRST login create the account -------------------
556. // answers { error } or { account, created }. `timeZone` is the browser's (first use);
557. // a missing or malformed one is stored as UTC, it can be changed in ident.
558. static checkCode = (email, code, timeZone) => {
559. let e = normEmail(email)
560. let c = code == null ? '' : ('' + code).trim()
561. let p = first(otpTable.find('email', e))
562. if (p == null) { return { error = 'no code is waiting for this address — ask for a new one' } }
563. if (p.expires < now()) {
564. otpTable.delete(p.id)
565. return { error = 'the code expired — ask for a new one' }
566. }
567. if (otpHash(e, c) != p.hash) {
568. if (p.tries + 1 >= maxTries) {
569. otpTable.delete(p.id)
570. return { error = 'too many wrong codes — ask for a new one' }
571. }
572. otpTable.update(p.id, merged(p, { tries = p.tries + 1 }))
573. return { error = 'wrong code (' + (maxTries - p.tries - 1) + ' tries left)' }
574. }
575. otpTable.delete(p.id)
576. let known = accountByEmail(e)
577. if (known != null) { return { account = known created = false } }
578. let tz = checkTimeZone(timeZone)
579. let id = accountsTable.put({ email = e timeZone = tz.error == null ? tz.timeZone : 'UTC' created = now() })
580. // THE DEFAULT IDENTITY, from the beginning; its names are optional (asked next)
581. identitiesTable.put({ account = id shortId = freshShortId() identityName = 'Default' nickname = '' firstname = '' lastname = '' avatar = '' created = now() updated = now() })
582. return { account = accountRowOf(accountsTable.fetch(id)) created = true }
583. }
585. // ---- THE PENDING SIGN-IN (ticket ident#20, mission 032) ------------------------------
586. // After "Send me a code" the browser's SESSION remembers the address, so a reload (a phone
587. // reloading the tab while the user reads the mail, a second tab, a socket re-seed) still
588. // shows the code step. It lives in `session.data.pendingEmail` (the app's hybrid on the
589. // Session — an undeclared member of the instance would not read back, see session.hl).
590. // It is ONLY honoured while a code for that address is really waiting: in otpTable, not
591. // expired, not used, not killed by too many wrong tries — so it never shows a code step
592. // for an address no code was sent to. It holds no secret (the code is only in the mail).
593. // Cleared on: a successful sign-in (verifyCode), "Other address" (dropPending), and
594. // expiry / a dead code (pendingOf drops it the next time it reads it).
595. static codeWaiting = (email) => {
596. let e = normEmail(email)
597. if (e == '') { return false }
598. let p = first(otpTable.find('email', e))
599. return p != null && p.expires >= now() && p.tries < maxTries
600. }
602. // the face rememberPending (home.hl): { email } or { error }
603. static recordPending = (session, email) => {
604. if (session == null) { return { error = 'no session — reload the page' } }
605. if (email == null || hlTypeName(email) != 'String') { return { error = 'field email must be a string' } }
606. let e = normEmail(email)
607. if (!codeWaiting(e)) { return { error = 'no code is waiting for this address' } }
608. session.data.pendingEmail = e
609. return { email = e }
610. }
612. // the address whose code step this session shows, or null (and a stale one is dropped)
613. static pendingOf = (session) => {
614. if (session == null || session.data == null) { return null }
615. let e = session.data.pendingEmail
616. if (e == null || e == '') { return null }
617. if (!codeWaiting(e)) {
618. session.data.pendingEmail = null
619. return null
620. }
621. return e
622. }
624. static dropPending = (session) => {
625. if (session != null && session.data != null) { session.data.pendingEmail = null }
626. return true
627. }