ident

6.6 KB

1. // lib/accounts.hl — THE ACCOUNT and ITS SESSIONS (piece 1, ticket #24; hardening ticket #2; sign out everywhere
2. // #19): the accounts table and every write to it, signing a session in, reading the account a session carries,
3. // signing out everywhere, the time zone. Statics only, the server realm.
4. // Concept: CONCEPT.md (the creator's; source of truth).
5. //
6. // CREATOR'S CONVENTIONS (2026-09-24, ticket ident #10 / old #39, mission 009): every
7. // primary key is the mpackdb UUID (`@id`, a 12-char string like '0mufbkwhlpjq'), never a
8. // `*id` counter; the files live in storage/mpackdb/<table>.*. The public ids ARE these
9. // UUIDs (accounts, identities, apps). Order never comes from key order: "oldest first"
10. // sorts by the stored `created` time (then the id, only to break a tie).
11. // Rows migrated from the old `*id` store (tools/migrate-009.hl) carry `oldId` = the old
12. // public id (old mpackdb id + 1) — only the migration reads it.
13. //
14. // accountsTable pk @id index !email { email (lowercased), timeZone, created, sessionEpoch }
15. //
16. // NO REGISTRATION: the first right code for an address (lib/login.hl checkCode) creates the account AND its
17. // default identity (createAccount).
18. import { MPackDB } from 'hl:mpackdb'
19. import { now } from 'hl:time'
20. import { listDir, readFile, remove } from 'hl:fs'
21. import { dir, envNumber, first, merged, isId, normEmail, checkTimeZone } from './util.hl'
22. import { addDefaultIdentity } from './identities.hl'
24. static accountsTable = new MPackDB(file = dir + '/accounts.db', primaryKey = '@id', indexes = ['!email'])
26. // A SIGNED-IN SESSION'S OWN EXPIRY (ticket #2, hardening): independent of the hl:web
27. // session file's rolling idle/maxAge, so a browser left open cannot stay signed in to
28. // ident forever — the account's OTP must be proven again after this many ms.
29. static sessionUserTtl = envNumber('IDENT_SESSION_TTL_MS', 1209600000) // 14 days
31. // PUBLIC ACCOUNT / IDENTITY IDS are the records' UUIDs
32. static accountRowOf = (a) => { return a == null ? null : { id = a.id email = a.email timeZone = a.timeZone } }
33. static accountById = (id) => { return isId(id) ? accountRowOf(accountsTable.fetch(id)) : null }
34. static accountByEmail = (email) => { return accountRowOf(first(accountsTable.find('email', normEmail(email)))) }
36. // THE FIRST LOGIN of an address: the account (the browser's time zone; a missing or malformed one is
37. // stored as UTC, it can be changed in ident) and THE DEFAULT IDENTITY, from the beginning. Answers the account row.
38. static createAccount = (e, timeZone) => {
39. tz = checkTimeZone(timeZone)
40. id = accountsTable.put({ email = e timeZone = tz.error == null ? tz.timeZone : 'UTC' created = now() })
41. addDefaultIdentity(id)
42. return accountRowOf(accountsTable.fetch(id))
43. }
45. // the account a session carries, re-read from the table (null when signed out or gone).
46. // ONLY A REAL SESSION COUNTS: a face's trailing `session` argument is positional, so a
47. // hand-made emit with one argument too many would hand the face its own object in the
48. // session's place (see README "Lessons"); the framework's session is a class instance (hlTypeName 'Instance'), JSON never is.
50. // SIGNS A SESSION IN (ticket #2): stamps `since` (this session's own expiry, sessionUserTtl)
51. // and `epoch` (the account's current sessionEpoch — "sign out everywhere" bumps it, which
52. // makes every session that still carries the old epoch read as signed out, see below).
53. // `&session` on every lambda here that writes the session: since hybriel #48 a lambda parameter COPIES its
54. // argument (the framework Session instance included), so without `&` the write lands on a copy.
55. static accountEpoch = (a) => { return a.sessionEpoch == null ? 0 : a.sessionEpoch }
56. static beginSession = (&session, accountId) => {
57. if (session == null) { return false }
58. a = isId(accountId) ? accountsTable.fetch(accountId) : null
59. if (a == null) { return false }
60. session.user = { id = accountId since = now() epoch = accountEpoch(a) }
61. return true
62. }
64. static accountOfSession = (&session) => {
65. if (session == null || session.user == null) { return null }
66. a = accountsTable.fetch(session.user.id)
67. if (a == null) { session.user = null return null }
68. // AN OLDER SESSION (before ticket #2, incl. one carried across the mission-009
69. // migration): it has no `since`/`epoch` yet. Adopt them now instead of forcing
70. // everyone signed out the moment this ships — its own-expiry clock starts here.
71. if (session.user.since == null || session.user.epoch == null) {
72. session.user = { id = session.user.id since = now() epoch = accountEpoch(a) }
73. return accountRowOf(a)
74. }
75. if (now() - session.user.since > sessionUserTtl || session.user.epoch != accountEpoch(a)) {
76. session.user = null
77. return null
78. }
79. return accountRowOf(a)
80. }
82. // "SIGN OUT EVERYWHERE": bumps the account's sessionEpoch, so every session that carries
83. // this account (this one included — the caller's UI resets the same as a normal sign out)
84. // stops working at its next check, on every device, without touching any other session file.
85. // The session files themselves are DELETED too (project.hl hands in `dropUser` = dropUserSessions
86. // below on its server); the epoch stays as the second net for any session the sweep did not see.
87. static sessionHooks = { dropUser = null }
88. static signOutEverywhere = (accountId) => {
89. a = isId(accountId) ? accountsTable.fetch(accountId) : null
90. if (a == null) { return { error = 'no such account' } }
91. if (sessionHooks.dropUser != null) { sessionHooks.dropUser(accountId) }
92. accountsTable.update(a.id, merged(a, { sessionEpoch = accountEpoch(a) + 1 }))
93. return { ok = true }
94. }
96. // ---- DELETE EVERY SESSION OF AN ACCOUNT (ticket #19) — `srv` is project.hl's server -------
97. // Resident ones (dropped from memory, their user cleared so a still-open socket's session
98. // object cannot be written back signed in) and the files of the ones nobody has open.
99. static dropUserSessions = (&srv, userId) => {
100. sess = srv.sessions
101. gone = []
102. for (k of sess.map.keys()) {
103. let x = sess.map[k]
104. if (x != null && x.user != null && x.user.id == userId) { gone.push(k) }
105. }
106. for (k of gone) {
107. sess.map[k].user = null
108. sess.drop(k)
109. sess.map[k] = null
110. }
111. if (sess.dir != null) {
112. for (e of listDir(sess.dir)) {
113. let raw = readFile(e.path)
114. if (raw != null) {
115. let rec = JSON.parse(raw)
116. if (rec != null && rec.user != null && rec.user.id == userId) { remove(e.path) }
117. }
118. }
119. }
120. return null
121. }
123. static setTimeZone = (accountId, tz) => {
124. c = checkTimeZone(tz)
125. if (c.error != null) { return c }
126. a = isId(accountId) ? accountsTable.fetch(accountId) : null
127. if (a == null) { return { error = 'no such account' } }
128. accountsTable.update(a.id, merged(a, { timeZone = c.timeZone }))
129. return { account = accountRowOf(accountsTable.fetch(a.id)) }
130. }