ident

8.5 KB

1. // project.hl — ident.worldapi.org: THE MAP. Config, routes and wiring; the logic lives in lib/. Concept: CONCEPT.md
2. // (the creator's).
3. //
4. // WHERE THINGS ARE (one line per feature; README.md "Files" has the full list):
5. // the login: email → code, limits per address / IP, the code page lib/login.hl (codes, IP buckets: lib/login-helpers.hl)
6. // the account, its sessions, sign out everywhere, time zone lib/accounts.hl
7. // identities, the short id, avatar lib/identities.hl (checks, label: lib/identities-helpers.hl)
8. // apps, connections, the login button + exchange, an invite's login lib/apps.hl (checks, return URL: lib/apps-helpers.hl)
9. // the identity selector (pick ids, the choice) lib/selector.hl (browser half: selector.js)
10. // invites (ident#22) lib/invites.hl (checks: lib/invites-helpers.hl)
11. // notifications: kinds, sending, inbox, per-app switches lib/notify.hl (checks, orders: lib/notify-helpers.hl)
12. // mail (codes, invitations; IDENT_MAIL_SINK) lib/mail.hl
13. // the function routes (/login, /api/*, /invite/:token, /code) lib/api.hl (plumbing: lib/api-helpers.hl, lib/jsoncheck.hl)
14. // shared small helpers (storage dir, env, lists, text checks) lib/util.hl
15. // pages: shell, sign-in + identities, start, apps, inbox, per-app components/*.hl; CSS components/styles.hl
16. //
17. // THE FLOWS (README "How apps use ident", "How apps send notifications", "Invites"):
18. // GET /login?key=<api key>&return=<url> → error page, or → /signin/<rid> (sign in, choose the identity,
19. // → <return url>?ident_code=<one-time code>)
20. // POST /api/exchange { key, secret, code } → { identity } (the identity's short id only)
21. // GET /selector.js, GET /api/selector/identities?key=, POST /api/selector/choose?key= {identity} → { code }
22. // POST /api/code { email } → { email } | 400/429 { error } (a function route: the per-IP limit needs the request)
23. // GET /code, /signin/<rid>/code the code form for this session's pending address, or → / resp. /signin/<rid>
24. // Deploy (Byrodin): HL_HOST=127.0.0.1 binds loopback only (hl:web reads HL_HOST, hybriel#24),
25. // IDENT_PORT the port.
26. import WebFramework from 'hl:web'
27. import { env } from 'hl:proc'
29. import Styles from './components/styles.hl'
30. import { dark, darker } from './shared/tokens.hl'
31. import { appLogin, apiExchange, apiMigrateIds, apiCode, apiSelectorIdentities, apiSelectorChoose, apiInvites, apiInvitesList, apiInvitesGet, apiInvitesRevoke, inviteLink, apiKinds, apiNotify, apiOnline, notFoundApi, codePage } from './lib/api.hl'
32. import Mail from './lib/mail.hl'
33. import { sessionHooks, dropUserSessions } from './lib/accounts.hl'
34. import { shortIdsBackfilled } from './lib/identities.hl'
36. // ident#23: statics run on first use — touching it here gives every older identity its short id at boot
37. console.log('ident: ' + shortIdsBackfilled + ' identities got their short id')
39. import Home from './components/home.hl'
40. import Start from './components/start.hl'
41. import Apps from './components/apps.hl'
42. import Inbox from './components/inbox.hl'
43. import AppSettings from './components/appsettings.hl'
45. static siteName = "ident"
47. appTitle = siteName
48. styles = Styles
50. // ---- THE INSTALLABLE APP (mission 046, as calendar#3): hl:web generates the web app manifest
51. // (/__hl/manifest.webmanifest, linked in every head with the apple-touch-icon and theme-color)
52. // from these, and the service worker (/__hl/sw.js) from `offline`. No JavaScript of ours.
53. // Icons: icons/ (icon.svg is the source, README "PWA"). Theme colour = the header's colour (token
54. // `darker`), background `dark` — the same in every app (mission 046); the icon carries the accent.
55. appThemeColor = darker.value
56. appBackgroundColor = dark.value
57. appFavicon = '/favicon.ico'
58. appTouchIcon = '/icons/apple-touch-icon.png'
59. appIcons = [
60. { src = '/icons/icon-192.png' sizes = '192x192' purpose = 'any' }
61. { src = '/icons/icon-512.png' sizes = '512x512' purpose = 'any' }
62. { src = '/icons/icon-192.png' sizes = '192x192' purpose = 'maskable' }
63. { src = '/icons/icon-512.png' sizes = '512x512' purpose = 'maskable' }
64. ]
65. // OFFLINE, WITHOUT PERSONAL DATA: the worker keeps only `/start` (components/start.hl, a page
66. // with no data — never `/`, whose copy would hold the signed-in address and identities) and the
67. // shell's assets. The installed app starts at `/start` (appManifest); online the shell's probe
68. // (main.hl) sends it on to `/`, offline the header says it is offline. Every other page offline
69. // is the worker's "Unavailable offline" (README "PWA").
70. offline = [ Start ]
71. appManifest = { start_url = '/start' }
73. // ---- THE ROUTES: files, the function routes (lib/api.hl), the pages (components/) ----------------
74. routes = [
75. { pattern = "/favicon.ico" file = "./icons/favicon.ico" headers = { 'Cache-Control' = 'no-cache' } }
76. { pattern = "/icons/icon-192.png" file = "./icons/icon-192.png" headers = { 'Cache-Control' = 'no-cache' } }
77. { pattern = "/icons/icon-512.png" file = "./icons/icon-512.png" headers = { 'Cache-Control' = 'no-cache' } }
78. { pattern = "/icons/apple-touch-icon.png" file = "./icons/apple-touch-icon.png" headers = { 'Cache-Control' = 'no-cache' } }
79. { pattern = "/icons/icon.svg" file = "./icons/icon.svg" headers = { 'Cache-Control' = 'no-cache' } }
80. { pattern = "/login" function = appLogin }
81. { pattern = "/api/exchange" function = apiExchange }
82. { pattern = "/api/migrate-ids" function = apiMigrateIds }
83. { pattern = "/api/code" function = apiCode }
84. { pattern = "/api/selector/identities" function = apiSelectorIdentities }
85. { pattern = "/api/selector/choose" function = apiSelectorChoose }
86. { pattern = "/api/invites" function = apiInvites }
87. { pattern = "/api/invites/list" function = apiInvitesList }
88. { pattern = "/api/invites/get" function = apiInvitesGet }
89. { pattern = "/api/invites/revoke" function = apiInvitesRevoke }
90. { pattern = "/invite/:token" function = inviteLink }
91. { pattern = "/api/kinds" function = apiKinds }
92. { pattern = "/api/notify" function = apiNotify }
93. { pattern = "/selector.js" file = "./selector.js" headers = { 'Cache-Control' = 'no-cache' } }
94. { pattern = "/avatar.js" file = "./avatar.js" headers = { 'Cache-Control' = 'no-cache' } }
95. // the offline probe of the shell (components/main.hl): 204
96. { pattern = "/api/online" function = apiOnline }
97. { pattern = "/api/*" function = notFoundApi }
98. // THE CODE PAGE (ident#20): renders Home through the framework's page render — it needs the server, BY REFERENCE
99. { pattern = "/code" function = (route, req) => { return codePage(route, req, &server, Home) } }
100. { pattern = "/signin/:rid/code" function = (route, req) => { return codePage(route, req, &server, Home) } }
101. { pattern = "/" component = Home }
102. { pattern = "/start" component = Start }
103. { pattern = "/signin/:rid" component = Home }
104. { pattern = "/apps" component = Apps }
105. { pattern = "/inbox" component = Inbox }
106. { pattern = "/inbox/:cid" component = AppSettings }
107. ]
109. // the mailer's result handlers live on an INSTANCE of lib/mail.hl
110. mail = new Mail()
112. sessionDir = env('IDENT_SESSIONS') != null ? env('IDENT_SESSIONS') : null
113. port = env('IDENT_PORT') != null ? toNumber(env('IDENT_PORT')) : 8351
114. // THE LISTENER's interface: hl:web reads HL_HOST (or HOST) itself (hybriel#24): 127.0.0.1 on
115. // Byrodin behind nginx; unset = 0.0.0.0 (dev on Loreana).
116. // IDENT_WATCH=0 turns the dev watcher off (the container: a deploy is an rsync + restart,
117. // half-copied .hl files must not be re-analysed); unset = on, as before.
118. watching = env('IDENT_WATCH') != '0'
119. // WHO A PUSHED EVENT IS FOR: "signed out everywhere" reaches every open connection whose
120. // session is the account's (checked before dropUserSessions clears the sessions).
121. audience = {
122. signedOutAll = (accountId, session) => { return session != null && session.user != null && session.user.id == accountId }
123. }
124. // ident's OWN COOKIE NAME. Cookies are per host, not per port: with the default `hlsid` an app
125. // on the same host (tickets on :8350) and ident would overwrite each other's session cookie
126. // → hl:web's `sessionCookie` setting (hybriel#10/#17).
127. sessionCookie = 'identsid'
128. server = new WebFramework(routes = routes, styles = styles, audience = audience, minify = true, port = port, watchMode = watching, sessionCookie = sessionCookie)
130. // SIGN OUT EVERYWHERE deletes every session of the account (ticket #19, lib/accounts.hl dropUserSessions): the
131. // session store is this server's
132. sessionHooks.dropUser = (userId) => { return dropUserSessions(&server, userId) }