ident

16.4 KB

1. // project.hl — ident.worldapi.org: THE APP. Concept: CONCEPT.md (the creator's).
2. // Piece 1 (#24): the login to ident itself, the account, its identities, its time zone —
3. // page `/` (components/home.hl). Piece 2 (#25): apps (page `/apps`, components/apps.hl),
4. // one identity id per app, and the LOGIN BUTTON flow (README "How apps use ident"):
5. // GET /login?key=<api key>&return=<url> → error page, or → /signin/<rid>
6. // /signin/<rid> sign in to ident, choose the identity,
7. // → <return url>?ident_code=<one-time code>
8. // POST /api/exchange { key, secret, code } → { identity } (the identity's short id only)
9. // Piece 3 (#26): THE IDENTITY SELECTOR (selector.hl, selector.js; README "How apps use ident"):
10. // GET /selector.js the script an app's page includes
11. // GET /api/selector/identities?key= the signed-in user's identities (CORS)
12. // POST /api/selector/choose?key= {identity} → { code } (the same one-time code)
13. // Mission 010: THE CODE REQUEST is a function route, not a face, because a face gets no
14. // request (no headers), and the per-IP limit needs the client's IP:
15. // POST /api/code { email } → { email } | 400/429 { error }
16. // ident#20 (mission 032): THE CODE PAGE — after "Send me a code" the browser goes to
17. // GET /code, /signin/<rid>/code the code form for this session's pending
18. // address, or → / resp. /signin/<rid>
19. // Deploy (Byrodin): HL_HOST=127.0.0.1 binds loopback only (hl:web reads HL_HOST, hybriel#24),
20. // IDENT_PORT the port.
21. import WebFramework from 'hl:web'
22. import { env } from 'hl:proc'
24. import Styles from './styles.hl'
25. import { reply, fail, redirect, strictBody, errorPage } from './api.hl'
26. import { openRequest, exchange, migrateIds } from './apps.hl'
27. import { selectorIdentities, selectorChoose } from './selector.hl'
28. import { createInvite, listInvites, revokeInvite, ownInvite, inviteRow, openInvite, publicUrl } from './invites.hl'
29. import { appOfSecret, registerKinds, sendNotification } from './notify.hl'
30. import Mail from './mail.hl'
31. import { startLogin, sessionHooks, pendingOf, accountOfSession, shortIdsBackfilled } from './store.hl'
32. import { listDir, readFile, remove } from 'hl:fs'
33. import { sendCode, sendInvite } from './mail.hl'
35. // ident#23: statics run on first use — touching it here gives every older identity its short id at boot
36. console.log('ident: ' + shortIdsBackfilled + ' identities got their short id')
38. import Home from './components/home.hl'
39. import Apps from './components/apps.hl'
40. import Inbox from './components/inbox.hl'
41. import AppSettings from './components/appsettings.hl'
43. static siteName = "ident"
45. appTitle = siteName
46. styles = Styles
48. // ---- THE LOGIN BUTTON: GET /login?key=<api key>&return=<url> ---------------------------
49. // An unknown key or a return URL outside the app's origins → an error page, NEVER a
50. // redirect. Otherwise the request is parked under a random id (a page component cannot
51. // read the query, hybriel #18) and the browser goes to /signin/<rid>.
52. appLogin = (route, req) => {
53. if (req.method != 'GET') { return errorPage(405, 'Method not allowed', 'Use a GET request.') }
54. let q = req.query != null ? req.query : {}
55. let r = openRequest(q.key, q['return'])
56. if (r.error != null) { return errorPage(400, 'Bad login request', r.error) }
57. return redirect('/signin/' + r.rid)
58. }
60. // ---- POST /api/migrate-ids { key, secret, finish? } → { ids: { <old per-app id>: <short id> } } (ident#23)
61. // the APP'S SERVER moves its stored users to the identities' short ids in one step; with
62. // `finish: true` the old per-app ids are dropped afterwards (they are gone for good).
63. apiMigrateIds = (route, req) => {
64. if (req.method != 'POST') { return fail(405, 'POST only') }
65. let b = strictBody(req, { key = { type = 'String' required = true } secret = { type = 'String' required = true } finish = { type = 'Boolean' required = false } })
66. if (b.error != null) { return fail(400, b.error) }
67. let a = appOfSecret(b.body.key.trim(), b.body.secret.trim())
68. if (a == null) { return fail(401, 'unknown API key or wrong secret') }
69. return reply(200, migrateIds(a, b.body.finish == true))
70. }
72. // ---- POST /api/exchange { key, secret, code } → { identity } ---------------------------
73. // the APP'S SERVER trades the ident_code from its return URL for the app-specific
74. // identity's short id. Nothing else is handed out (CONCEPT.md "More fields").
75. apiExchange = (route, req) => {
76. if (req.method != 'POST') { return fail(405, 'POST only') }
77. let b = strictBody(req, { key = { type = 'String' required = true } secret = { type = 'String' required = true } code = { type = 'String' required = true } })
78. if (b.error != null) { return fail(400, b.error) }
79. for (k of ['key' 'secret' 'code']) {
80. if (b.body[k].trim() == '') { return fail(400, 'missing field: ' + k) }
81. }
82. let r = exchange(b.body.key.trim(), b.body.secret.trim(), b.body.code.trim())
83. if (r.error != null) { return fail(r.status, r.error) }
84. return reply(200, { identity = r.identity })
85. }
87. // ---- THE SELECTOR's two calls (selector.hl): the ident user is the cookie's -------------
88. // (hl:web hands a function route the cookie's session as req.session, hybriel#11)
89. apiSelectorIdentities = (route, req) => { return selectorIdentities(req, req.session) }
90. apiSelectorChoose = (route, req) => { return selectorChoose(req, req.session) }
92. // ---- POST /api/code { email } → { email }: THE ONE WAY TO GET A LOGIN CODE MAILED --------
93. // (the sign-in form of `/` and `/signin/<rid>` fetches it). Limits: per address (3 / 10 min)
94. // and per client IP (store.hl ipBucket: 10 / 10 min, 30 / 24 h) → 429 with the reason.
95. // THE CLIENT IP is the X-Client-IP header and nothing else: nginx on Byrodin sets it and
96. // overwrites any the client sent (/CONTAINERS/web/nginx/conf.d/cloudflare-client-ip.conf).
97. // CF-Connecting-IP / X-Forwarded-For / X-Real-IP are NEVER read (a client could forge them).
98. // Without the header (dev, no nginx) every request shares ONE bucket ('direct'):
99. // (hl:web's req.remoteAddress, hybriel#25, would be nginx's address behind the proxy.)
100. apiCode = (route, req) => {
101. if (req.method != 'POST') { return fail(405, 'POST only') }
102. let b = strictBody(req, { email = { type = 'String' required = true } })
103. if (b.error != null) { return fail(400, b.error) }
104. let r = startLogin(b.body.email, req.headers['x-client-ip'])
105. if (r.error != null) { return fail(r.limited == true ? 429 : 400, r.error) }
106. sendCode(r.email, r.code)
107. return reply(200, { email = r.email })
108. }
110. // ---- NOTIFICATIONS (piece 4, notify.hl; README "How apps send notifications") -----------
111. // The APP'S SERVER, with its key + secret. Strict JSON bodies; delivery is not built yet
112. // (pieces 5/6) — ident stores the notification and its channels, and the user reads it
113. // in the inbox (/inbox).
114. // POST /api/kinds { key, secret, kinds: [{ name, push, email }] } → { kinds }
115. // POST /api/notify { key, secret, identity, name, text, icon?, link?, urgent? } → { id }
116. apiKinds = (route, req) => {
117. if (req.method != 'POST') { return fail(405, 'POST only') }
118. let b = strictBody(req, { key = { type = 'String' required = true } secret = { type = 'String' required = true } kinds = { type = 'List' required = true } })
119. if (b.error != null) { return fail(400, b.error) }
120. let a = appOfSecret(b.body.key, b.body.secret)
121. if (a == null) { return fail(401, 'unknown API key or wrong secret') }
122. let r = registerKinds(a, b.body.kinds)
123. if (r.error != null) { return fail(r.status, r.error) }
124. return reply(200, { kinds = r.kinds })
125. }
126. apiNotify = (route, req) => {
127. if (req.method != 'POST') { return fail(405, 'POST only') }
128. let b = strictBody(req, { key = { type = 'String' required = true } secret = { type = 'String' required = true } identity = { type = 'String' required = true } name = { type = 'String' required = true } text = { type = 'String' required = true } icon = { type = 'String' required = false } link = { type = 'String' required = false } urgent = { type = 'Boolean' required = false } })
129. if (b.error != null) { return fail(400, b.error) }
130. let r = sendNotification(b.body)
131. if (r.error != null) { return fail(r.status, r.error) }
132. return reply(200, { id = r.id })
133. }
135. // ---- INVITES (ident#22, invites.hl; README "Invites") ----------------------------------------
136. // The APP'S SERVER, key + secret, strict JSON bodies:
137. // POST /api/invites { key, secret, project, role, return, uses?, days?, email? } → { id, url, state, … }
138. // POST /api/invites/list { key, secret, project? } → { invites: [...] }
139. // POST /api/invites/get { key, secret, id } → { invite }
140. // POST /api/invites/revoke { key, secret, id } → { invite }
141. // and the PERSON: GET /invite/<token> → the login flow (or an error page: used, expired, withdrawn).
142. static field = (n, t) => { return { type = t required = n } }
143. inviteCaller = (req, spec) => {
144. if (req.method != 'POST') { return { res = fail(405, 'POST only') } }
145. let b = strictBody(req, spec)
146. if (b.error != null) { return { res = fail(400, b.error) } }
147. let a = appOfSecret(b.body.key, b.body.secret)
148. if (a == null) { return { res = fail(401, 'unknown API key or wrong secret') } }
149. return { app = a body = b.body }
150. }
151. // where the link points: IDENT_PUBLIC_URL, else the request's own host
152. baseOf = (req) => {
153. if (publicUrl != null) { return publicUrl }
154. let proto = req.headers['x-forwarded-proto'] != null ? req.headers['x-forwarded-proto'] : 'http'
155. return proto + '://' + req.headers['host']
156. }
157. apiInvites = (route, req) => {
158. let c = inviteCaller(req, { key = field(true, 'String') secret = field(true, 'String') project = field(true, 'String') role = field(true, 'String') 'return' = field(true, 'String') uses = field(false, 'Number') days = field(false, 'Number') email = field(false, 'String') })
159. if (c.res != null) { return c.res }
160. let r = createInvite(c.app, c.body, baseOf(req))
161. if (r.error != null) { return fail(r.status, r.error) }
162. let mailed = false
163. if (r.mail != null) {
164. sendInvite(r.mail.to, r.url, c.app.name, r.invite.project, r.invite.role, r.mail.days)
165. mailed = true
166. }
167. return reply(200, { id = r.invite.id url = r.url state = r.invite.state project = r.invite.project role = r.invite.role uses = r.invite.uses expires = r.invite.expires mailed = mailed })
168. }
169. apiInvitesList = (route, req) => {
170. let c = inviteCaller(req, { key = field(true, 'String') secret = field(true, 'String') project = field(false, 'String') })
171. if (c.res != null) { return c.res }
172. return reply(200, { invites = listInvites(c.app, c.body.project) })
173. }
174. apiInvitesGet = (route, req) => {
175. let c = inviteCaller(req, { key = field(true, 'String') secret = field(true, 'String') id = field(true, 'String') })
176. if (c.res != null) { return c.res }
177. let r = ownInvite(c.app, c.body.id)
178. if (r == null) { return fail(404, 'no such invite') }
179. return reply(200, { invite = inviteRow(r) })
180. }
181. apiInvitesRevoke = (route, req) => {
182. let c = inviteCaller(req, { key = field(true, 'String') secret = field(true, 'String') id = field(true, 'String') })
183. if (c.res != null) { return c.res }
184. let r = revokeInvite(c.app, c.body.id)
185. if (r.error != null) { return fail(r.status, r.error) }
186. return reply(200, { invite = r.invite })
187. }
188. inviteLink = (route, req) => {
189. if (req.method != 'GET') { return errorPage(405, 'Method not allowed', 'Use a GET request.') }
190. let r = openInvite(route.params.token)
191. if (r.error != null) { return errorPage(r.status, r.title, r.error) }
192. return redirect('/signin/' + r.rid)
193. }
195. // ---- THE CODE PAGE: GET /code and /signin/<rid>/code (ident#20, mission 032) ------------
196. // Creator: "just make a /code where it checks a pending code". The page asks the SESSION
197. // (store.hl pendingOf) whether a code it asked for is still waiting — unused, unexpired,
198. // not killed by wrong tries. Yes → Home renders its code step with that address (a reload
199. // shows it again). No, or already signed in → 302 back to the email form (`/` or
200. // `/signin/<rid>`), so a stale /code is never a dead end.
201. // A FUNCTION route because a component route cannot answer a redirect: it takes the
202. // cookie's session (req.session, hybriel#11) and renders Home through the framework's own page
203. // render (`server.page`, the same call a component route makes) with `step = 'code'`.
204. codePage = (route, req) => {
205. let rid = route.params.rid
206. // a rid is 32 hex (apps.hl); anything else goes to `/` (it lands in a Location header)
207. if (rid != null && !hexId(rid)) { return redirect('/') }
208. let home = rid != null ? '/signin/' + rid : '/'
209. if (req.method != 'GET') { return redirect(home) }
210. let s = req.session
211. if (s == null || accountOfSession(s) != null || pendingOf(s) == null) { return redirect(home) }
212. let m = { route = { pattern = route.route.pattern component = Home } kind = 'component' params = { rid = rid step = 'code' } path = route.path }
213. return server.page(m, req, s)
214. }
215. hexId = (v) => {
216. if (v.length != 32) { return false }
217. let i = 0
218. while (i < v.length) {
219. if (!'0123456789abcdef'.includes(v[i])) { return false }
220. i = i + 1
221. }
222. return true
223. }
225. notFoundApi = (route, req) => { return fail(404, 'no such endpoint') }
227. routes = [
228. { pattern = "/favicon.ico" direct = "" }
229. { pattern = "/login" function = appLogin }
230. { pattern = "/api/exchange" function = apiExchange }
231. { pattern = "/api/migrate-ids" function = apiMigrateIds }
232. { pattern = "/api/code" function = apiCode }
233. { pattern = "/api/selector/identities" function = apiSelectorIdentities }
234. { pattern = "/api/selector/choose" function = apiSelectorChoose }
235. { pattern = "/api/invites" function = apiInvites }
236. { pattern = "/api/invites/list" function = apiInvitesList }
237. { pattern = "/api/invites/get" function = apiInvitesGet }
238. { pattern = "/api/invites/revoke" function = apiInvitesRevoke }
239. { pattern = "/invite/:token" function = inviteLink }
240. { pattern = "/api/kinds" function = apiKinds }
241. { pattern = "/api/notify" function = apiNotify }
242. { pattern = "/selector.js" file = "./selector.js" headers = { 'Cache-Control' = 'no-cache' } }
243. { pattern = "/avatar.js" file = "./avatar.js" headers = { 'Cache-Control' = 'no-cache' } }
244. { pattern = "/api/*" function = notFoundApi }
245. { pattern = "/code" function = codePage }
246. { pattern = "/signin/:rid/code" function = codePage }
247. { pattern = "/" component = Home }
248. { pattern = "/signin/:rid" component = Home }
249. { pattern = "/apps" component = Apps }
250. { pattern = "/inbox" component = Inbox }
251. { pattern = "/inbox/:cid" component = AppSettings }
252. ]
254. // the mailer's result handlers live on an INSTANCE of mail.hl
255. mail = new Mail()
257. sessionDir = env('IDENT_SESSIONS') != null ? env('IDENT_SESSIONS') : null
258. port = env('IDENT_PORT') != null ? toNumber(env('IDENT_PORT')) : 8351
259. // THE LISTENER's interface: hl:web reads HL_HOST (or HOST) itself (hybriel#24): 127.0.0.1 on
260. // Byrodin behind nginx; unset = 0.0.0.0 (dev on Loreana).
261. // IDENT_WATCH=0 turns the dev watcher off (the container: a deploy is an rsync + restart,
262. // half-copied .hl files must not be re-analysed); unset = on, as before.
263. watching = env('IDENT_WATCH') != '0'
264. // WHO A PUSHED EVENT IS FOR: "signed out everywhere" reaches every open connection whose
265. // session is the account's (checked before dropUserSessions clears the sessions).
266. audience = {
267. signedOutAll = (accountId, session) => { return session != null && session.user != null && session.user.id == accountId }
268. }
269. // ident's OWN COOKIE NAME. Cookies are per host, not per port: with the default `hlsid` an app
270. // on the same host (tickets on :8350) and ident would overwrite each other's session cookie
271. // → hl:web's `sessionCookie` setting (hybriel#10/#17).
272. sessionCookie = 'identsid'
273. server = new WebFramework(routes = routes, styles = styles, audience = audience, minify = true, port = port, watchMode = watching, sessionCookie = sessionCookie)
275. // ---- SIGN OUT EVERYWHERE: DELETE EVERY SESSION OF AN ACCOUNT (ticket #19) ----------------
276. // Resident ones (dropped from memory, their user cleared so a still-open socket's session
277. // object cannot be written back signed in) and the files of the ones nobody has open.
278. dropUserSessions = (userId) => {
279. let sess = server.sessions
280. let gone = []
281. for (k of sess.map.keys()) {
282. let x = sess.map[k]
283. if (x != null && x.user != null && x.user.id == userId) { gone.push(k) }
284. }
285. for (k of gone) {
286. sess.map[k].user = null
287. sess.drop(k)
288. sess.map[k] = null
289. }
290. if (sess.dir != null) {
291. for (e of listDir(sess.dir)) {
292. let raw = readFile(e.path)
293. if (raw != null) {
294. let rec = JSON.parse(raw)
295. if (rec != null && rec.user != null && rec.user.id == userId) { remove(e.path) }
296. }
297. }
298. }
299. return null
300. }
301. sessionHooks.dropUser = dropUserSessions