ident

19.0 KB

1. // project.hl — ident.worldapi.org: THE APP. Concept: CONCEPT.md (the creator's).
2. // Piece 1 (#24): the login to ident itself, the account, its identities, its time zone —
3. // page `/` (components/home.hl). Piece 2 (#25): apps (page `/apps`, components/apps.hl),
4. // one identity id per app, and the LOGIN BUTTON flow (README "How apps use ident"):
5. // GET /login?key=<api key>&return=<url> → error page, or → /signin/<rid>
6. // /signin/<rid> sign in to ident, choose the identity,
7. // → <return url>?ident_code=<one-time code>
8. // POST /api/exchange { key, secret, code } → { identity } (the identity's short id only)
9. // Piece 3 (#26): THE IDENTITY SELECTOR (selector.hl, selector.js; README "How apps use ident"):
10. // GET /selector.js the script an app's page includes
11. // GET /api/selector/identities?key= the signed-in user's identities (CORS)
12. // POST /api/selector/choose?key= {identity} → { code } (the same one-time code)
13. // Mission 010: THE CODE REQUEST is a function route, not a face, because a face gets no
14. // request (no headers), and the per-IP limit needs the client's IP:
15. // POST /api/code { email } → { email } | 400/429 { error }
16. // ident#20 (mission 032): THE CODE PAGE — after "Send me a code" the browser goes to
17. // GET /code, /signin/<rid>/code the code form for this session's pending
18. // address, or → / resp. /signin/<rid>
19. // Deploy (Byrodin): HL_HOST=127.0.0.1 binds loopback only (hl:web reads HL_HOST, hybriel#24),
20. // IDENT_PORT the port.
21. import WebFramework from 'hl:web'
22. import { Response } from 'hl:http1'
23. import { env } from 'hl:proc'
25. import Styles from './styles.hl'
26. import { dark, darker } from './shared/tokens.hl'
27. import { reply, fail, redirect, strictBody, errorPage } from './api.hl'
28. import { openRequest, exchange, migrateIds } from './apps.hl'
29. import { selectorIdentities, selectorChoose } from './selector.hl'
30. import { createInvite, listInvites, revokeInvite, ownInvite, inviteRow, openInvite, publicUrl } from './invites.hl'
31. import { appOfSecret, registerKinds, sendNotification } from './notify.hl'
32. import Mail from './mail.hl'
33. import { startLogin, sessionHooks, pendingOf, accountOfSession, shortIdsBackfilled } from './store.hl'
34. import { listDir, readFile, remove } from 'hl:fs'
35. import { sendCode, sendInvite } from './mail.hl'
37. // ident#23: statics run on first use — touching it here gives every older identity its short id at boot
38. console.log('ident: ' + shortIdsBackfilled + ' identities got their short id')
40. import Home from './components/home.hl'
41. import Start from './components/start.hl'
42. import Apps from './components/apps.hl'
43. import Inbox from './components/inbox.hl'
44. import AppSettings from './components/appsettings.hl'
46. static siteName = "ident"
48. appTitle = siteName
49. styles = Styles
51. // ---- THE INSTALLABLE APP (mission 046, as calendar#3): hl:web generates the web app manifest
52. // (/__hl/manifest.webmanifest, linked in every head with the apple-touch-icon and theme-color)
53. // from these, and the service worker (/__hl/sw.js) from `offline`. No JavaScript of ours.
54. // Icons: icons/ (icon.svg is the source, README "PWA"). Theme colour = the header's colour (token
55. // `darker`), background `dark` — the same in every app (mission 046); the icon carries the accent.
56. appThemeColor = darker.value
57. appBackgroundColor = dark.value
58. appFavicon = '/favicon.ico'
59. appTouchIcon = '/icons/apple-touch-icon.png'
60. appIcons = [
61. { src = '/icons/icon-192.png' sizes = '192x192' purpose = 'any' }
62. { src = '/icons/icon-512.png' sizes = '512x512' purpose = 'any' }
63. { src = '/icons/icon-192.png' sizes = '192x192' purpose = 'maskable' }
64. { src = '/icons/icon-512.png' sizes = '512x512' purpose = 'maskable' }
65. ]
66. // OFFLINE, WITHOUT PERSONAL DATA: the worker keeps only `/start` (components/start.hl, a page
67. // with no data — never `/`, whose copy would hold the signed-in address and identities) and the
68. // shell's assets. The installed app starts at `/start` (appManifest); online the shell's probe
69. // (main.hl) sends it on to `/`, offline the header says it is offline. Every other page offline
70. // is the worker's "Unavailable offline" (README "PWA").
71. offline = [ Start ]
72. appManifest = { start_url = '/start' }
74. // ---- THE LOGIN BUTTON: GET /login?key=<api key>&return=<url> ---------------------------
75. // An unknown key or a return URL outside the app's origins → an error page, NEVER a
76. // redirect. Otherwise the request is parked under a random id (a page component cannot
77. // read the query, hybriel #18) and the browser goes to /signin/<rid>.
78. appLogin = (route, req) => {
79. if (req.method != 'GET') { return errorPage(405, 'Method not allowed', 'Use a GET request.') }
80. let q = req.query != null ? req.query : {}
81. let r = openRequest(q.key, q['return'])
82. if (r.error != null) { return errorPage(400, 'Bad login request', r.error) }
83. return redirect('/signin/' + r.rid)
84. }
86. // ---- POST /api/migrate-ids { key, secret, finish? } → { ids: { <old per-app id>: <short id> } } (ident#23)
87. // the APP'S SERVER moves its stored users to the identities' short ids in one step; with
88. // `finish: true` the old per-app ids are dropped afterwards (they are gone for good).
89. apiMigrateIds = (route, req) => {
90. if (req.method != 'POST') { return fail(405, 'POST only') }
91. let b = strictBody(req, { key = { type = 'String' required = true } secret = { type = 'String' required = true } finish = { type = 'Boolean' required = false } })
92. if (b.error != null) { return fail(400, b.error) }
93. let a = appOfSecret(b.body.key.trim(), b.body.secret.trim())
94. if (a == null) { return fail(401, 'unknown API key or wrong secret') }
95. return reply(200, migrateIds(a, b.body.finish == true))
96. }
98. // ---- POST /api/exchange { key, secret, code } → { identity } ---------------------------
99. // the APP'S SERVER trades the ident_code from its return URL for the app-specific
100. // identity's short id. Nothing else is handed out (CONCEPT.md "More fields").
101. apiExchange = (route, req) => {
102. if (req.method != 'POST') { return fail(405, 'POST only') }
103. let b = strictBody(req, { key = { type = 'String' required = true } secret = { type = 'String' required = true } code = { type = 'String' required = true } })
104. if (b.error != null) { return fail(400, b.error) }
105. for (k of ['key' 'secret' 'code']) {
106. if (b.body[k].trim() == '') { return fail(400, 'missing field: ' + k) }
107. }
108. let r = exchange(b.body.key.trim(), b.body.secret.trim(), b.body.code.trim())
109. if (r.error != null) { return fail(r.status, r.error) }
110. return reply(200, { identity = r.identity })
111. }
113. // ---- THE SELECTOR's two calls (selector.hl): the ident user is the cookie's -------------
114. // (hl:web hands a function route the cookie's session as req.session, hybriel#11)
115. apiSelectorIdentities = (route, req) => { return selectorIdentities(req, req.session) }
116. apiSelectorChoose = (route, req) => { return selectorChoose(req, req.session) }
118. // ---- POST /api/code { email } → { email }: THE ONE WAY TO GET A LOGIN CODE MAILED --------
119. // (the sign-in form of `/` and `/signin/<rid>` fetches it). Limits: per address (3 / 10 min)
120. // and per client IP (store.hl ipBucket: 10 / 10 min, 30 / 24 h) → 429 with the reason.
121. // THE CLIENT IP is the X-Client-IP header and nothing else: nginx on Byrodin sets it and
122. // overwrites any the client sent (/CONTAINERS/web/nginx/conf.d/cloudflare-client-ip.conf).
123. // CF-Connecting-IP / X-Forwarded-For / X-Real-IP are NEVER read (a client could forge them).
124. // Without the header (dev, no nginx) every request shares ONE bucket ('direct'):
125. // (hl:web's req.remoteAddress, hybriel#25, would be nginx's address behind the proxy.)
126. apiCode = (route, req) => {
127. if (req.method != 'POST') { return fail(405, 'POST only') }
128. let b = strictBody(req, { email = { type = 'String' required = true } })
129. if (b.error != null) { return fail(400, b.error) }
130. let r = startLogin(b.body.email, req.headers['x-client-ip'])
131. if (r.error != null) { return fail(r.limited == true ? 429 : 400, r.error) }
132. sendCode(r.email, r.code)
133. return reply(200, { email = r.email })
134. }
136. // ---- NOTIFICATIONS (piece 4, notify.hl; README "How apps send notifications") -----------
137. // The APP'S SERVER, with its key + secret. Strict JSON bodies; delivery is not built yet
138. // (pieces 5/6) — ident stores the notification and its channels, and the user reads it
139. // in the inbox (/inbox).
140. // POST /api/kinds { key, secret, kinds: [{ name, push, email }] } → { kinds }
141. // POST /api/notify { key, secret, identity, name, text, icon?, link?, urgent? } → { id }
142. apiKinds = (route, req) => {
143. if (req.method != 'POST') { return fail(405, 'POST only') }
144. let b = strictBody(req, { key = { type = 'String' required = true } secret = { type = 'String' required = true } kinds = { type = 'List' required = true } })
145. if (b.error != null) { return fail(400, b.error) }
146. let a = appOfSecret(b.body.key, b.body.secret)
147. if (a == null) { return fail(401, 'unknown API key or wrong secret') }
148. let r = registerKinds(a, b.body.kinds)
149. if (r.error != null) { return fail(r.status, r.error) }
150. return reply(200, { kinds = r.kinds })
151. }
152. apiNotify = (route, req) => {
153. if (req.method != 'POST') { return fail(405, 'POST only') }
154. let b = strictBody(req, { key = { type = 'String' required = true } secret = { type = 'String' required = true } identity = { type = 'String' required = true } name = { type = 'String' required = true } text = { type = 'String' required = true } icon = { type = 'String' required = false } link = { type = 'String' required = false } urgent = { type = 'Boolean' required = false } })
155. if (b.error != null) { return fail(400, b.error) }
156. let r = sendNotification(b.body)
157. if (r.error != null) { return fail(r.status, r.error) }
158. return reply(200, { id = r.id })
159. }
161. // ---- INVITES (ident#22, invites.hl; README "Invites") ----------------------------------------
162. // The APP'S SERVER, key + secret, strict JSON bodies:
163. // POST /api/invites { key, secret, project, role, return, uses?, days?, email? } → { id, url, state, … }
164. // POST /api/invites/list { key, secret, project? } → { invites: [...] }
165. // POST /api/invites/get { key, secret, id } → { invite }
166. // POST /api/invites/revoke { key, secret, id } → { invite }
167. // and the PERSON: GET /invite/<token> → the login flow (or an error page: used, expired, withdrawn).
168. static field = (n, t) => { return { type = t required = n } }
169. inviteCaller = (req, spec) => {
170. if (req.method != 'POST') { return { res = fail(405, 'POST only') } }
171. let b = strictBody(req, spec)
172. if (b.error != null) { return { res = fail(400, b.error) } }
173. let a = appOfSecret(b.body.key, b.body.secret)
174. if (a == null) { return { res = fail(401, 'unknown API key or wrong secret') } }
175. return { app = a body = b.body }
176. }
177. // where the link points: IDENT_PUBLIC_URL, else the request's own host
178. baseOf = (req) => {
179. if (publicUrl != null) { return publicUrl }
180. let proto = req.headers['x-forwarded-proto'] != null ? req.headers['x-forwarded-proto'] : 'http'
181. return proto + '://' + req.headers['host']
182. }
183. apiInvites = (route, req) => {
184. let c = inviteCaller(req, { key = field(true, 'String') secret = field(true, 'String') project = field(true, 'String') role = field(true, 'String') 'return' = field(true, 'String') uses = field(false, 'Number') days = field(false, 'Number') email = field(false, 'String') })
185. if (c.res != null) { return c.res }
186. let r = createInvite(c.app, c.body, baseOf(req))
187. if (r.error != null) { return fail(r.status, r.error) }
188. let mailed = false
189. if (r.mail != null) {
190. sendInvite(r.mail.to, r.url, c.app.name, r.invite.project, r.invite.role, r.mail.days)
191. mailed = true
192. }
193. return reply(200, { id = r.invite.id url = r.url state = r.invite.state project = r.invite.project role = r.invite.role uses = r.invite.uses expires = r.invite.expires mailed = mailed })
194. }
195. apiInvitesList = (route, req) => {
196. let c = inviteCaller(req, { key = field(true, 'String') secret = field(true, 'String') project = field(false, 'String') })
197. if (c.res != null) { return c.res }
198. return reply(200, { invites = listInvites(c.app, c.body.project) })
199. }
200. apiInvitesGet = (route, req) => {
201. let c = inviteCaller(req, { key = field(true, 'String') secret = field(true, 'String') id = field(true, 'String') })
202. if (c.res != null) { return c.res }
203. let r = ownInvite(c.app, c.body.id)
204. if (r == null) { return fail(404, 'no such invite') }
205. return reply(200, { invite = inviteRow(r) })
206. }
207. apiInvitesRevoke = (route, req) => {
208. let c = inviteCaller(req, { key = field(true, 'String') secret = field(true, 'String') id = field(true, 'String') })
209. if (c.res != null) { return c.res }
210. let r = revokeInvite(c.app, c.body.id)
211. if (r.error != null) { return fail(r.status, r.error) }
212. return reply(200, { invite = r.invite })
213. }
214. inviteLink = (route, req) => {
215. if (req.method != 'GET') { return errorPage(405, 'Method not allowed', 'Use a GET request.') }
216. let r = openInvite(route.params.token)
217. if (r.error != null) { return errorPage(r.status, r.title, r.error) }
218. return redirect('/signin/' + r.rid)
219. }
221. // ---- THE CODE PAGE: GET /code and /signin/<rid>/code (ident#20, mission 032) ------------
222. // Creator: "just make a /code where it checks a pending code". The page asks the SESSION
223. // (store.hl pendingOf) whether a code it asked for is still waiting — unused, unexpired,
224. // not killed by wrong tries. Yes → Home renders its code step with that address (a reload
225. // shows it again). No, or already signed in → 302 back to the email form (`/` or
226. // `/signin/<rid>`), so a stale /code is never a dead end.
227. // A FUNCTION route because a component route cannot answer a redirect: it takes the
228. // cookie's session (req.session, hybriel#11) and renders Home through the framework's own page
229. // render (`server.page`, the same call a component route makes) with `step = 'code'`.
230. // Its signature since hybriel #105 (mission 048): page(match, session, host, headers) — the
231. // old page(match, req, session) still compiles but renders with req as the session (empty page).
232. codePage = (route, req) => {
233. let rid = route.params.rid
234. // a rid is 32 hex (apps.hl); anything else goes to `/` (it lands in a Location header)
235. if (rid != null && !hexId(rid)) { return redirect('/') }
236. let home = rid != null ? '/signin/' + rid : '/'
237. if (req.method != 'GET') { return redirect(home) }
238. let s = req.session
239. if (s == null || accountOfSession(s) != null || pendingOf(s) == null) { return redirect(home) }
240. let m = { route = { pattern = route.route.pattern component = Home } kind = 'component' params = { rid = rid step = 'code' pending = pendingOf(s) } path = route.path }
241. return server.page(m, s, server.hostOf(req.headers['host']), server.requestHeaders(req.headers))
242. }
243. hexId = (v) => {
244. if (v.length != 32) { return false }
245. let i = 0
246. while (i < v.length) {
247. if (!'0123456789abcdef'.includes(v[i])) { return false }
248. i = i + 1
249. }
250. return true
251. }
253. notFoundApi = (route, req) => { return fail(404, 'no such endpoint') }
255. // GET /api/online → 204: the shell's network probe (main.hl). Never cached, carries nothing.
256. apiOnline = (route, req) => { return new Response('', { status = 204 headers = { 'Cache-Control' = 'no-store' } }) }
258. routes = [
259. { pattern = "/favicon.ico" file = "./icons/favicon.ico" headers = { 'Cache-Control' = 'no-cache' } }
260. { pattern = "/icons/icon-192.png" file = "./icons/icon-192.png" headers = { 'Cache-Control' = 'no-cache' } }
261. { pattern = "/icons/icon-512.png" file = "./icons/icon-512.png" headers = { 'Cache-Control' = 'no-cache' } }
262. { pattern = "/icons/apple-touch-icon.png" file = "./icons/apple-touch-icon.png" headers = { 'Cache-Control' = 'no-cache' } }
263. { pattern = "/icons/icon.svg" file = "./icons/icon.svg" headers = { 'Cache-Control' = 'no-cache' } }
264. { pattern = "/login" function = appLogin }
265. { pattern = "/api/exchange" function = apiExchange }
266. { pattern = "/api/migrate-ids" function = apiMigrateIds }
267. { pattern = "/api/code" function = apiCode }
268. { pattern = "/api/selector/identities" function = apiSelectorIdentities }
269. { pattern = "/api/selector/choose" function = apiSelectorChoose }
270. { pattern = "/api/invites" function = apiInvites }
271. { pattern = "/api/invites/list" function = apiInvitesList }
272. { pattern = "/api/invites/get" function = apiInvitesGet }
273. { pattern = "/api/invites/revoke" function = apiInvitesRevoke }
274. { pattern = "/invite/:token" function = inviteLink }
275. { pattern = "/api/kinds" function = apiKinds }
276. { pattern = "/api/notify" function = apiNotify }
277. { pattern = "/selector.js" file = "./selector.js" headers = { 'Cache-Control' = 'no-cache' } }
278. { pattern = "/avatar.js" file = "./avatar.js" headers = { 'Cache-Control' = 'no-cache' } }
279. { pattern = "/api/online" function = apiOnline }
280. { pattern = "/api/*" function = notFoundApi }
281. { pattern = "/code" function = codePage }
282. { pattern = "/signin/:rid/code" function = codePage }
283. { pattern = "/" component = Home }
284. { pattern = "/start" component = Start }
285. { pattern = "/signin/:rid" component = Home }
286. { pattern = "/apps" component = Apps }
287. { pattern = "/inbox" component = Inbox }
288. { pattern = "/inbox/:cid" component = AppSettings }
289. ]
291. // the mailer's result handlers live on an INSTANCE of mail.hl
292. mail = new Mail()
294. sessionDir = env('IDENT_SESSIONS') != null ? env('IDENT_SESSIONS') : null
295. port = env('IDENT_PORT') != null ? toNumber(env('IDENT_PORT')) : 8351
296. // THE LISTENER's interface: hl:web reads HL_HOST (or HOST) itself (hybriel#24): 127.0.0.1 on
297. // Byrodin behind nginx; unset = 0.0.0.0 (dev on Loreana).
298. // IDENT_WATCH=0 turns the dev watcher off (the container: a deploy is an rsync + restart,
299. // half-copied .hl files must not be re-analysed); unset = on, as before.
300. watching = env('IDENT_WATCH') != '0'
301. // WHO A PUSHED EVENT IS FOR: "signed out everywhere" reaches every open connection whose
302. // session is the account's (checked before dropUserSessions clears the sessions).
303. audience = {
304. signedOutAll = (accountId, session) => { return session != null && session.user != null && session.user.id == accountId }
305. }
306. // ident's OWN COOKIE NAME. Cookies are per host, not per port: with the default `hlsid` an app
307. // on the same host (tickets on :8350) and ident would overwrite each other's session cookie
308. // → hl:web's `sessionCookie` setting (hybriel#10/#17).
309. sessionCookie = 'identsid'
310. server = new WebFramework(routes = routes, styles = styles, audience = audience, minify = true, port = port, watchMode = watching, sessionCookie = sessionCookie)
312. // ---- SIGN OUT EVERYWHERE: DELETE EVERY SESSION OF AN ACCOUNT (ticket #19) ----------------
313. // Resident ones (dropped from memory, their user cleared so a still-open socket's session
314. // object cannot be written back signed in) and the files of the ones nobody has open.
315. dropUserSessions = (userId) => {
316. let sess = server.sessions
317. let gone = []
318. for (k of sess.map.keys()) {
319. let x = sess.map[k]
320. if (x != null && x.user != null && x.user.id == userId) { gone.push(k) }
321. }
322. for (k of gone) {
323. sess.map[k].user = null
324. sess.drop(k)
325. sess.map[k] = null
326. }
327. if (sess.dir != null) {
328. for (e of listDir(sess.dir)) {
329. let raw = readFile(e.path)
330. if (raw != null) {
331. let rec = JSON.parse(raw)
332. if (rec != null && rec.user != null && rec.user.id == userId) { remove(e.path) }
333. }
334. }
335. }
336. return null
337. }
338. sessionHooks.dropUser = dropUserSessions