ident

5.1 KB

1. // selector.hl — THE IDENTITY SELECTOR's server side (piece 3 of 6, ticket #26; CONCEPT.md
2. // "Flow 2: identity selector" and "Decided 2026-09-24"). Statics only; the routes are in
3. // project.hl, the browser half is selector.js (served at /selector.js).
4. //
5. // GET /api/selector/identities?key=<api key> → { signedIn, identities: [{ id, name }] }
6. // POST /api/selector/choose?key=<api key> { identity: <id from the list> } → { code }
7. // OPTIONS /api/selector/choose?key=… the CORS preflight of the POST
8. //
9. // CORS: ident answers ONLY a request whose Origin header is one of the app's registered
10. // origins AND whose key is that app's API key. Then (and only then) the answer carries
11. // `Access-Control-Allow-Origin: <that exact origin>` and `…-Allow-Credentials: true`
12. // (never `*`). Anything else is a 403 without those headers: the browser hands the page
13. // nothing, and nothing is written.
14. // The ident user is the one of the `identsid` cookie the browser sends along (credentials;
15. // SameSite=Lax, so it only travels from the SAME SITE — our apps; other ports of the same
16. // host count). Function routes get no session: it is resolved from the cookie (hybriel #18).
17. //
18. // THE LIST'S ids are not ident's identity ids: each is sha256(app's secret hash : identity)
19. // cut to 32 hex — stable for one app, different for every app, not guessable, and it
20. // means nothing outside this selector. The CODE of a choice follows the login button's
21. // rules exactly (apps.hl issueCode: single use, 60 s, this app only); the host's server
22. // trades it with POST /api/exchange (key + secret) for the app-specific identity id.
23. import { Response } from 'hl:http1'
24. import { sha256 } from 'hl:crypto'
25. import { appByKey, originsOf, issueCode } from './apps.hl'
26. import { identityRecords, labelOf, accountOfSession } from './store.hl'
27. import { strictBody } from './api.hl'
29. static jsonType = 'application/json; charset=utf-8'
31. // the refusal: no CORS headers → the browser gives the page nothing
32. static refuse = (status, message) => {
33. return new Response(JSON.stringify({ error = message }), { status = status headers = { 'Content-Type' = jsonType 'Cache-Control' = 'no-store' 'Vary' = 'Origin' } })
34. }
35. static corsHeaders = (origin) => {
36. return { 'Content-Type' = jsonType 'Cache-Control' = 'no-store' 'Vary' = 'Origin' 'Access-Control-Allow-Origin' = origin 'Access-Control-Allow-Credentials' = 'true' }
37. }
38. static answer = (origin, status, value) => {
39. return new Response(JSON.stringify(value), { status = status headers = corsHeaders(origin) })
40. }
42. // WHO ASKS: answers { app (record), origin } or { status, error }
43. static caller = (req) => {
44. let origin = req.headers['origin']
45. if (origin == null || origin == '') { return { status = 403 error = 'the selector answers browsers only (no Origin header)' } }
46. let q = req.query != null ? req.query : {}
47. let a = appByKey(q.key)
48. if (a == null) { return { status = 403 error = 'no app has this API key' } }
49. if (!originsOf(a).includes(origin)) { return { status = 403 error = 'this origin is not registered for the app' } }
50. return { app = a origin = origin }
51. }
53. // (since mission 009 the identity's id is its UUID, so every pick id changed once then)
54. static pickOf = (appRec, identityRec) => { return sha256(appRec.secretHash + ':' + identityRec.id).slice(0, 32) }
56. // the account's identities for the app's page: the id to pick it by and the identity
57. // name (CONCEPT.md: "that one is shown in the selector"; blank → the list's fallback)
58. static selectorList = (appRec, accountId) => {
59. let out = []
60. let n = 1
61. for (r of identityRecords(accountId)) {
62. out.push({ id = pickOf(appRec, r) name = labelOf(r, n) })
63. n = n + 1
64. }
65. return out
66. }
68. // GET /api/selector/identities?key=
69. static selectorIdentities = (req, &session) => {
70. let c = caller(req)
71. if (c.error != null) { return refuse(c.status, c.error) }
72. if (req.method != 'GET') { return answer(c.origin, 405, { error = 'GET only' }) }
73. let me = accountOfSession(session)
74. if (me == null) { return answer(c.origin, 200, { signedIn = false identities = [] }) }
75. return answer(c.origin, 200, { signedIn = true identities = selectorList(c.app, me.id) })
76. }
78. // POST /api/selector/choose?key= { identity } (+ its OPTIONS preflight)
79. static selectorChoose = (req, &session) => {
80. let c = caller(req)
81. if (c.error != null) { return refuse(c.status, c.error) }
82. if (req.method == 'OPTIONS') {
83. let h = corsHeaders(c.origin)
84. h['Access-Control-Allow-Methods'] = 'POST'
85. h['Access-Control-Allow-Headers'] = 'Content-Type'
86. h['Access-Control-Max-Age'] = '600'
87. return new Response('', { status = 204 headers = h })
88. }
89. if (req.method != 'POST') { return answer(c.origin, 405, { error = 'POST only' }) }
90. let b = strictBody(req, { identity = { type = 'String' required = true } })
91. if (b.error != null) { return answer(c.origin, 400, { error = b.error }) }
92. let me = accountOfSession(session)
93. if (me == null) { return answer(c.origin, 401, { error = 'you are not signed in to ident' }) }
94. for (r of identityRecords(me.id)) {
95. if (pickOf(c.app, r) == b.body.identity) {
96. return answer(c.origin, 200, { code = issueCode(c.app.id, r.id) })
97. }
98. }
99. return answer(c.origin, 400, { error = 'no such identity' })
100. }