ident

13.5 KB

1. // lib/apps.hl — APPS AND THE LOGIN BUTTON (piece 2 of 6, ticket #25; CONCEPT.md "Apps",
2. // "One id per app", "Flow 1: login button"; the invite's login flow, ident#22). Statics only, the server realm.
3. // Every write to the apps, connections, requests and grants tables is here. The checks (app form, origins,
4. // return URL), keys and the row a page shows: lib/apps-helpers.hl.
5. //
6. // appsTable pk @id index @owner, !apiKey
7. // { owner (account @id), name, origins ('a b c': the origins it runs
8. // on, space separated), apiKey, secretHash = sha256(secret), created, updated }
9. // connectionsTable pk @id index !pair, @app
10. // { pair = '<app @id>:<identity @id>', app, identity, created } — `created` is
11. // when the identity registered in that app (the per-app page).
12. // What an app holds is the identity's ONE SHORT ID (ident#23, lib/identities.hl
13. // `shortId`), the same in every app. Rows made before ident#23 still carry
14. // `appIdentity` (the old per-app id, 32 hex) until the app has migrated:
15. // POST /api/migrate-ids answers old → short and, with finish, drops them.
16. // requestsTable pk @id index !rid a login button press waiting for the choice:
17. // { rid, app (app @id), returnUrl, expires, invite (invite @id, ident#22; absent for a plain login) }
18. // grantsTable pk @id index !hash a one-time code on its way back to the app:
19. // { hash = sha256(code), app, identity, expires }
20. //
21. // Any signed-in account registers apps. An app has a PUBLIC API key (`pk_…`, it may sit
22. // in a page) and a SECRET (`sk_…`, the app's server only). The secret is shown ONCE, when
23. // it is made (register / new secret); only its sha256 is stored.
24. // Public app ids are the records' mpackdb UUIDs (`@id`), as for accounts and identities;
25. // the files live in storage/mpackdb/ (lib/util.hl `dir`).
26. import { MPackDB } from 'hl:mpackdb'
27. import { now } from 'hl:time'
28. import { randomBytes, sha256 } from 'hl:crypto'
29. import { dir, envNumber, countOf, first, merged, isId, oldestFirst } from './util.hl'
30. import { checkAppInput, newKey, newSecret, appRowOf, checkReturn } from './apps-helpers.hl'
31. import { ownIdentity, identitiesTable, identityByShortId } from './identities.hl'
32. import { dropInvitesOf, openableInvite, inviteById, acceptInvite } from './invites.hl'
34. static appsTable = new MPackDB(file = dir + '/apps.db', primaryKey = '@id', indexes = ['@owner' '!apiKey'])
35. static connectionsTable = new MPackDB(file = dir + '/connections.db', primaryKey = '@id', indexes = ['!pair' '@app'])
36. static requestsTable = new MPackDB(file = dir + '/requests.db', primaryKey = '@id', indexes = ['!rid'])
37. static grantsTable = new MPackDB(file = dir + '/grants.db', primaryKey = '@id', indexes = ['!hash'])
39. static grantTtl = envNumber('IDENT_GRANT_TTL_MS', 60000) // a one-time code: 60 s
40. static requestTtl = 1800000 // a login button press: 30 min
42. // ---- apps -----------------------------------------------------------------------------
43. // the account's apps, oldest first (stored `created`, never key order)
44. static appRows = (accountId) => {
45. out = []
46. if (!isId(accountId)) { return out }
47. for (r of oldestFirst(appsTable.find('owner', accountId))) { out.push(appRowOf(r)) }
48. return out
49. }
51. // the app record `id` (public) if the account owns it, else null
52. static ownApp = (accountId, id) => {
53. if (!isId(id)) { return null }
54. r = appsTable.fetch(id)
55. if (r == null || r.owner != accountId) { return null }
56. return r
57. }
59. static appByKey = (key) => {
60. if (key == null || hlTypeName(key) != 'String' || key == '') { return null }
61. return first(appsTable.find('apiKey', key))
62. }
64. // THE APP'S SERVER, key + secret: answers the app record or null (unknown key or wrong secret: one answer, 401)
65. static appOfSecret = (key, secret) => {
66. a = appByKey(key)
67. if (a == null || hlTypeName(secret) != 'String' || sha256(secret) != a.secretHash) { return null }
68. return a
69. }
71. // answers { error, field } or { app (row), secret } — the secret leaves ident only here
72. static createApp = (accountId, input) => {
73. c = checkAppInput(input)
74. if (c.error != null) { return c }
75. let secret = newSecret()
76. id = appsTable.put({ owner = accountId name = c.name origins = c.origins.join(' ') apiKey = newKey() secretHash = sha256(secret) created = now() updated = now() })
77. return { app = appRowOf(appsTable.fetch(id)) secret = secret }
78. }
80. static updateApp = (accountId, id, input) => {
81. r = ownApp(accountId, id)
82. if (r == null) { return { error = 'no such app' field = 'id' } }
83. c = checkAppInput(input)
84. if (c.error != null) { return c }
85. appsTable.update(r.id, merged(r, { name = c.name origins = c.origins.join(' ') updated = now() }))
86. return { app = appRowOf(appsTable.fetch(r.id)) }
87. }
89. // a NEW SECRET: the old one stops working at once; the API key stays
90. static regenerateSecret = (accountId, id) => {
91. r = ownApp(accountId, id)
92. if (r == null) { return { error = 'no such app' } }
93. let secret = newSecret()
94. appsTable.update(r.id, merged(r, { secretHash = sha256(secret) updated = now() }))
95. return { app = appRowOf(appsTable.fetch(r.id)) secret = secret }
96. }
98. // DELETING AN APP removes its connections (the per-app ids) and its invites with it; a pending login
99. // request or code for it dies because its app is gone
100. static deleteApp = (accountId, id) => {
101. r = ownApp(accountId, id)
102. if (r == null) { return { error = 'no such app' } }
103. conns = connectionsTable.find('app', id)
104. if (countOf(conns) > 0) { for (c of conns) { connectionsTable.delete(c.id) } }
105. dropInvitesOf(id)
106. appsTable.delete(r.id)
107. return { deleted = id }
108. }
110. // ---- the login button ---------------------------------------------------------------
111. // the login button's GET /login?key=&return= : answers { error } or { rid }
112. static openRequest = (key, returnUrl) => {
113. a = appByKey(key)
114. if (a == null) { return { error = key == null || key == '' ? 'the key parameter (the app’s API key) is missing' : 'no app has this API key' } }
115. r = checkReturn(returnUrl, a)
116. if (r.error != null) { return r }
117. let rid = randomBytes(16)
118. requestsTable.put({ rid = rid app = a.id returnUrl = returnUrl expires = now() + requestTtl })
119. return { rid = rid }
120. }
122. // { rid, app (row), origin, returnUrl } or null (unknown, expired, or its app is gone)
123. static requestOf = (rid) => {
124. if (rid == null || hlTypeName(rid) != 'String' || rid == '') { return null }
125. r = first(requestsTable.find('rid', rid))
126. if (r == null) { return null }
127. if (r.expires < now()) {
128. requestsTable.delete(r.id)
129. return null
130. }
131. a = isId(r.app) ? appsTable.fetch(r.app) : null
132. if (a == null) { return null }
133. c = checkReturn(r.returnUrl, a)
134. if (c.error != null) { return null } // the origin was removed from the app since
135. return { rid = r.rid app = appRowOf(a) origin = c.origin returnUrl = r.returnUrl invite = r.invite == null ? '' : r.invite }
136. }
138. // The identity's connection to the app, made on the first login
139. static connectionOf = (appId, identityId) => {
140. let pair = appId + ':' + identityId
141. c = first(connectionsTable.find('pair', pair))
142. if (c != null) { return c }
143. id = connectionsTable.put({ pair = pair app = appId identity = identityId created = now() })
144. return connectionsTable.fetch(id)
145. }
147. // "SIGN OUT" OF AN APP (ticket #2): forgets this identity's connection to it (its
148. // notification settings for the app). The identity's short id does not change: a later
149. // login makes a fresh connection and the app gets the same id. Notifications already sent
150. // through the old connection stay (as for a deleted app).
151. static disconnectConnection = (accountId, id) => {
152. if (!isId(id)) { return { error = 'no such app connection' } }
153. c = connectionsTable.fetch(id)
154. if (c == null) { return { error = 'no such app connection' } }
155. ident = ownIdentity(accountId, c.identity)
156. if (ident == null) { return { error = 'no such app connection' } }
157. connectionsTable.delete(c.id)
158. return { disconnected = id }
159. }
161. // A ONE-TIME CODE for app `appId` and identity `identityId` (public ids): 48 hex, single
162. // use, grantTtl (60 s), this app only. The login button AND the selector (lib/selector.hl)
163. // hand out these codes; the app's server trades one with `exchange` below.
164. static issueCode = (appId, identityId) => {
165. connectionOf(appId, identityId)
166. code = randomBytes(24)
167. grantsTable.put({ hash = sha256(code) app = appId identity = identityId expires = now() + grantTtl })
168. return code
169. }
171. // THE CHOICE: the account picks one of its identities for the request. Answers { error }
172. // or { url } — the app's return URL with a fresh one-time `ident_code`.
173. static grantLogin = (accountId, rid, identityId) => {
174. rq = requestOf(rid)
175. if (rq == null) { return { error = 'this login request is unknown or expired — go back to the app and start again' } }
176. ident = ownIdentity(accountId, identityId)
177. if (ident == null) { return { error = 'no such identity' } }
178. code = issueCode(rq.app.id, identityId)
179. r = first(requestsTable.find('rid', rid))
180. if (r != null) { requestsTable.delete(r.id) }
181. sep = rq.returnUrl.includes('?') ? '&' : '?'
182. return { url = rq.returnUrl + sep + 'ident_code=' + code }
183. }
185. // THE EXCHANGE (the app's server): answers { status, error } or { identity }. The app
186. // authenticates with key + secret (401); a code works once, for its own app, for 60 s (400).
187. // A code shown to the wrong app is spent: it has leaked.
188. static exchange = (key, secret, code) => {
189. a = appByKey(key)
190. if (a == null || sha256(secret) != a.secretHash) { return { status = 401 error = 'unknown API key or wrong secret' } }
191. g = first(grantsTable.find('hash', sha256(code)))
192. if (g == null) { return { status = 400 error = 'unknown or already used code' } }
193. grantsTable.delete(g.id)
194. if (g.app != a.id) { return { status = 400 error = 'this code was not issued to this app' } }
195. if (g.expires < now()) { return { status = 400 error = 'the code expired' } }
196. c = first(connectionsTable.find('pair', a.id + ':' + g.identity))
197. ident = isId(g.identity) ? identitiesTable.fetch(g.identity) : null
198. if (c == null || ident == null) { return { status = 400 error = 'the identity is no longer connected to this app' } }
199. return { identity = ident.shortId }
200. }
202. // ---- AN INVITE'S LOGIN (ident#22; the invite records: lib/invites.hl) -------------------------------
203. // GET /invite/<token>: answers { status, title, error } (an error page) or { rid } — a login
204. // request of the app that carries the invite, so the login flow does the rest.
205. static openInvite = (token) => {
206. o = openableInvite(token)
207. if (o.error != null) { return o }
208. rec = o.invite
209. let rid = randomBytes(16)
210. requestsTable.put({ rid = rid app = rec.app returnUrl = rec.returnUrl invite = rec.id expires = now() + requestTtl })
211. return { rid = rid }
212. }
214. // THE CHOICE for an invite's request: the identity accepts it. Answers { error } or { url }
215. // (the app's return URL with ident_code and invite). An identity that already accepted this
216. // invite may pass again without taking another use.
217. static grantInvite = (accountId, rid, identityId) => {
218. rq = requestOf(rid)
219. if (rq == null) { return { error = 'this login request is unknown or expired — open the invitation link again' } }
220. rec = inviteById(rq.invite)
221. if (rec == null || rec.app != rq.app.id) { return { error = 'this invitation no longer exists' } }
222. if (ownIdentity(accountId, identityId) == null) { return { error = 'no such identity' } }
223. conn = connectionOf(rq.app.id, identityId)
224. a = acceptInvite(rec, identityId, conn)
225. if (a.error != null) { return a }
226. code = issueCode(rq.app.id, identityId)
227. r = first(requestsTable.find('rid', rid))
228. if (r != null) { requestsTable.delete(r.id) }
229. sep = rq.returnUrl.includes('?') ? '&' : '?'
230. return { url = rq.returnUrl + sep + 'ident_code=' + code + '&invite=' + rec.id }
231. }
233. // the face chooseIdentity (components/home.hl): a request that carries an invite accepts the invite, any
234. // other is a plain login. Answers { error } or { url }.
235. static grantRequest = (accountId, rid, identityId) => {
236. rq = requestOf(rid)
237. if (rq != null && rq.invite != '') { return grantInvite(accountId, rid, identityId) }
238. return grantLogin(accountId, rid, identityId)
239. }
241. // ---- THE SHORT IDS (ident#23) ---------------------------------------------------------------------
242. // WHAT THE APP MEANT BY AN ID: a notification or a lookup may name an identity by
243. // its short id, or — until the app has migrated — by its old per-app id. Answers the
244. // connection (of app `appId`) or null.
245. static connectionByAnyId = (appId, given) => {
246. ident = identityByShortId(given)
247. if (ident != null) { return first(connectionsTable.find('pair', appId + ':' + ident.id)) }
248. if (given == null || hlTypeName(given) != 'String') { return null }
249. rows = connectionsTable.find('app', appId)
250. if (countOf(rows) > 0) {
251. for (c of rows) { if (c.appIdentity != null && c.appIdentity == given) { return c } }
252. }
253. return null
254. }
256. // THE MIGRATION, for the app's server: answers { ids } — every old per-app id
257. // → the identity's short id (an identity that was deleted has none and is left out).
258. // With `finish` the old ids are dropped afterwards: the app has stored the short ids.
259. static migrateIds = (a, finish) => {
260. let ids = {}
261. let n = 0
262. rows = connectionsTable.find('app', a.id)
263. if (countOf(rows) > 0) {
264. for (c of rows) {
265. if (c.appIdentity == null) { continue }
266. let ident = isId(c.identity) ? identitiesTable.fetch(c.identity) : null
267. if (ident != null) { ids[c.appIdentity] = ident.shortId n = n + 1 }
268. if (finish) {
269. let rec = {}
270. for (k of c.keys()) { if (k != 'appIdentity') { rec[k] = c[k] } }
271. connectionsTable.update(c.id, rec)
272. }
273. }
274. }
275. return { ids = ids count = n finished = finish }
276. }