ident

27.6 KB

1. // store.hl — THE SERVER REALM of ident.worldapi.org. hl:mpackdb tables and the rules
2. // that read and write them; statics only (a component imports what it reads by brace).
3. // Concept: CONCEPT.md (the creator's; source of truth). This is piece 1 of 6 (ticket #24):
4. // the account, its identities and its time zone.
5. //
6. // CREATOR'S CONVENTIONS (2026-09-24, ticket ident #10 / old #39, mission 009): every
7. // primary key is the mpackdb UUID (`@id`, a 12-char string like '0mufbkwhlpjq'), never a
8. // `*id` counter; the files live in storage/mpackdb/<table>.*. The public ids ARE these
9. // UUIDs (accounts, identities, apps). Order never comes from key order: "oldest first"
10. // sorts by the stored `created` time (then the id, only to break a tie).
11. // Rows migrated from the old `*id` store (tools/migrate-009.hl) carry `oldId` = the old
12. // public id (old mpackdb id + 1) — only the migration reads it.
13. //
14. // accountsTable pk @id index !email { email (lowercased), timeZone, created }
15. // identitiesTable pk @id index @account, !shortId { account (account @id), shortId (5 chars, the PUBLIC id, ident#23), identityName, nickname,
16. // firstname, lastname, avatar (data URL of the uploaded picture, ticket #15), created, updated }
17. // every field but `account` optional
18. // otpTable pk @id index email a pending one-time login code:
19. // { email, hash = sha256(email:code), expires, tries } (one per email)
20. // sendsTable pk @id index email one row per code mailed: { email, at } (rate limit)
21. // ipSendsTable pk @id index ip one row per code mailed: { ip (the client's BUCKET), at }
22. // (the per-IP limit, mission 010)
23. //
24. // NO REGISTRATION: the first right code for an address creates the account AND its
25. // default identity. An account ALWAYS has at least one identity: the last one cannot
26. // be deleted. The DEFAULT identity is the account's oldest remaining one (by `created`).
27. // Codes are never stored in clear, only their sha256.
28. import { MPackDB } from 'hl:mpackdb'
29. import { env } from 'hl:proc'
30. import { now } from 'hl:time'
31. import { randomBytes, sha256 } from 'hl:crypto'
33. // IDENT_STORAGE names another table DIRECTORY (the gates run on their own). Relative
34. // paths resolve against the ENTRY SCRIPT's directory — tools must pass an absolute one.
35. static dir = env('IDENT_STORAGE') != null ? env('IDENT_STORAGE') : './storage/mpackdb'
36. static accountsTable = new MPackDB(file = dir + '/accounts.db', primaryKey = '@id', indexes = ['!email'])
37. static identitiesTable = new MPackDB(file = dir + '/identities.db', primaryKey = '@id', indexes = ['@account' '!shortId'])
38. static otpTable = new MPackDB(file = dir + '/otp.db', primaryKey = '@id', indexes = ['email'])
39. static sendsTable = new MPackDB(file = dir + '/sends.db', primaryKey = '@id', indexes = ['email'])
40. static ipSendsTable = new MPackDB(file = dir + '/ipsends.db', primaryKey = '@id', indexes = ['ip'])
42. static envNumber = (name, fallback) => {
43. let v = env(name)
44. if (v == null || v == '') { return fallback }
45. let n = toNumber(v)
46. return n == null ? fallback : n
47. }
49. // THE CLOCKS AND LIMITS (ms). The env names exist for the gate's short-clock server.
50. static otpTtl = envNumber('IDENT_OTP_TTL_MS', 600000) // a login code: 10 min
51. static maxTries = 5 // wrong codes before it dies
52. static sendWindow = envNumber('IDENT_SEND_WINDOW_MS', 600000) // rate limit window: 10 min
53. static sendLimit = envNumber('IDENT_SEND_LIMIT', 3) // codes per email per window
54. // THE PER-IP LIMIT (mission 010): codes mailed per client IP BUCKET (see ipBucket) —
55. // 10 per 10 min and 30 per 24 h, so one client cannot use ident to mail many addresses
56. static ipWindow = envNumber('IDENT_IP_WINDOW_MS', 600000) // short window: 10 min
57. static ipLimit = envNumber('IDENT_IP_LIMIT', 10) // codes per IP per short window
58. static ipDayWindow = envNumber('IDENT_IP_DAY_WINDOW_MS', 86400000) // long window: 24 h
59. static ipDayLimit = envNumber('IDENT_IP_DAY_LIMIT', 30) // codes per IP per long window
60. // A SIGNED-IN SESSION'S OWN EXPIRY (ticket #2, hardening): independent of the hl:web
61. // session file's rolling idle/maxAge, so a browser left open cannot stay signed in to
62. // ident forever — the account's OTP must be proven again after this many ms.
63. static sessionUserTtl = envNumber('IDENT_SESSION_TTL_MS', 1209600000) // 14 days
64. static maxField = 60 // chars per identity field
65. static fieldNames = ['identityName' 'nickname' 'firstname' 'lastname']
66. // THE AVATAR (ticket #15): an uploaded picture, stored as a small data URL (the page scales it to
67. // 128×128) — not a text field, so it is checked and stored separately from fieldNames/maxField
68. static maxAvatarUrl = 60000
69. static avatarChars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/='
71. // an empty list written to hl:mpackdb comes back as an empty hybrid (`.length` null)
72. static countOf = (list) => {
73. if (list == null) { return 0 }
74. let n = list.length
75. return n == null ? 0 : n
76. }
77. static first = (list) => { return countOf(list) > 0 ? list[0] : null }
79. // A PUBLIC ID is an mpackdb UUID: a non-empty string (a number is never one — an old
80. // numeric id from before mission 009 finds nothing)
81. static isId = (v) => { return v != null && hlTypeName(v) == 'String' && v.length > 0 && v.length <= 64 }
83. // OLDEST FIRST: by the stored `created`, a tie by the id (never by key order)
84. static olderThan = (a, b) => {
85. let ca = a.created == null ? 0 : a.created
86. let cb = b.created == null ? 0 : b.created
87. if (ca != cb) { return ca < cb }
88. return a.id < b.id // strings order by code point (hybriel#2)
89. }
90. // a found list, oldest first (insertion sort by hand: no list sort(), hybriel #6)
91. static oldestFirst = (list) => {
92. let out = []
93. if (countOf(list) == 0) { return out }
94. for (x of list) { out.push(x) }
95. let i = 1
96. while (i < out.length) {
97. let cur = out[i]
98. let j = i - 1
99. while (j >= 0 && olderThan(cur, out[j])) {
100. out[j + 1] = out[j]
101. j = j - 1
102. }
103. out[j + 1] = cur
104. i = i + 1
105. }
106. return out
107. }
109. // every record is written as a whole (hl:mpackdb's update replaces it)
110. static merged = (rec, changes) => {
111. let out = {}
112. for (k of rec.keys()) { out[k] = rec[k] }
113. for (k of changes.keys()) { out[k] = changes[k] }
114. return out
115. }
117. // ---- validation -----------------------------------------------------------------------
118. static normEmail = (email) => { return email == null ? '' : ('' + email).trim().toLowerCase() }
120. static validEmail = (email) => {
121. if (email == null || email.length < 3 || email.length > 200) { return false }
122. let at = email.indexOf('@')
123. if (at < 1 || at != email.lastIndexOf('@') || at == email.length - 1) { return false }
124. if (!email.slice(at + 1, email.length).includes('.')) { return false }
125. // a whitelist: the language has no escapes to name a CR or a tab with
126. let ok = 'abcdefghijklmnopqrstuvwxyz0123456789.-_+@'
127. let i = 0
128. while (i < email.length) {
129. if (!ok.includes(email[i])) { return false }
130. i = i + 1
131. }
132. return true
133. }
135. // no control characters (a field is one line of text)
136. static hasControl = (s) => {
137. let i = 0
138. while (i < s.length) {
139. let c = s.charCodeAt(i)
140. if (c < 32 || c == 127) { return true }
141. i = i + 1
142. }
143. return false
144. }
146. // A TIME ZONE is an IANA name as the browser reports it (`Europe/Vienna`, `UTC`,
147. // `America/Argentina/Buenos_Aires`, `Etc/GMT+5`). hl:time knows no zones (hybriel #11),
148. // so the server checks the SHAPE only; the page checks the name against the browser's
149. // own list (Intl.supportedValuesOf) before it sends it.
150. static zoneChars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789/_+-'
151. static checkTimeZone = (tz) => {
152. if (tz == null || hlTypeName(tz) != 'String') { return { error = 'the time zone must be a string' } }
153. let t = tz.trim()
154. if (t == '') { return { error = 'the time zone is empty' } }
155. if (t.length > 64) { return { error = 'the time zone name is too long' } }
156. let i = 0
157. while (i < t.length) {
158. if (!zoneChars.includes(t[i])) { return { error = 'that is not a time zone name (like Europe/Vienna)' } }
159. i = i + 1
160. }
161. if (t[0] == '/' || t[t.length - 1] == '/' || t.includes('//')) { return { error = 'that is not a time zone name (like Europe/Vienna)' } }
162. return { timeZone = t }
163. }
165. // AN AVATAR: empty (none) or the uploaded picture as a data URL — data:image/(png|jpeg|webp);base64,
166. // with the file's own magic bytes at the start of the base64 text (the page scales the upload to
167. // 128×128 first, avatar.js), ≤ maxAvatarUrl characters, base64 characters only
168. static checkAvatarUrl = (v) => {
169. if (v == null || hlTypeName(v) != 'String') { return { error = 'field avatar must be a string' } }
170. let t = v.trim()
171. if (t == '') { return { avatar = '' } }
172. if (t.length > maxAvatarUrl) { return { error = 'field avatar is longer than ' + maxAvatarUrl + ' characters' } }
173. let kind = ''
174. let start = 0
175. if (t.startsWith('data:image/png;base64,')) { kind = 'iVBORw0KGgo' start = 22 }
176. else if (t.startsWith('data:image/jpeg;base64,')) { kind = '/9j/' start = 23 }
177. else if (t.startsWith('data:image/webp;base64,')) { kind = 'UklGR' start = 23 }
178. if (kind == '') { return { error = 'field avatar must be an uploaded PNG, JPEG or WebP picture' } }
179. let data = t.slice(start, t.length)
180. if (!data.startsWith(kind)) { return { error = 'field avatar is not a valid picture' } }
181. let i = 0
182. while (i < data.length) {
183. if (!avatarChars.includes(data[i])) { return { error = 'field avatar is not valid base64' } }
184. i = i + 1
185. }
186. return { avatar = t }
187. }
189. // the avatar to show: only an uploaded picture (a data URL). Before the upload existed an avatar
190. // was an http(s) URL; those are no longer shown (never fetched from a third-party address).
191. static shownAvatar = (r) => { return str(r.avatar).startsWith('data:image/') ? str(r.avatar) : '' }
193. // THE IDENTITY FIELDS, STRICT: `fields` is an object whose keys are among fieldNames plus
194. // `avatar`. A name field is a string (trimmed, at most 60 chars, no control characters);
195. // `avatar` is checked by checkAvatarUrl. Absent keys are absent from the answer.
196. // Answers { error, field } or { fields }.
197. static checkFields = (fields) => {
198. if (fields == null || hlTypeName(fields) != 'Hybrid' || fields.length != null) { return { error = 'the identity fields must be an object' field = '' } }
199. let out = {}
200. for (k of fields.keys()) {
201. if (k == 'avatar') {
202. let c = checkAvatarUrl(fields[k])
203. if (c.error != null) { return { error = c.error field = 'avatar' } }
204. out.avatar = c.avatar
205. } else if (!fieldNames.includes(k)) { return { error = 'unknown field: ' + k field = k } }
206. else {
207. let v = fields[k]
208. if (v == null || hlTypeName(v) != 'String') { return { error = 'field ' + k + ' must be a string' field = k } }
209. let t = v.trim()
210. if (t.length > maxField) { return { error = 'field ' + k + ' is longer than ' + maxField + ' characters' field = k } }
211. if (hasControl(t)) { return { error = 'field ' + k + ' contains a control character' field = k } }
212. out[k] = t
213. }
214. }
215. return { fields = out }
216. }
218. // ---- codes --------------------------------------------------------------------------
219. // six digits from the kernel CSPRNG (randomBytes answers hex)
220. static newOtp = () => {
221. let hex = randomBytes(8)
222. let n = 0
223. let i = 0
224. while (i < 12) {
225. n = (n * 16 + '0123456789abcdef'.indexOf(hex[i])) % 1000000
226. i = i + 1
227. }
228. let s = '' + n
229. while (s.length < 6) { s = '0' + s }
230. return s
231. }
232. static otpHash = (email, code) => { return sha256(email + ':' + code) }
234. // ---- accounts -------------------------------------------------------------------------
235. // PUBLIC ACCOUNT / IDENTITY IDS are the records' UUIDs
236. static accountRowOf = (a) => { return a == null ? null : { id = a.id email = a.email timeZone = a.timeZone } }
237. static accountById = (id) => { return isId(id) ? accountRowOf(accountsTable.fetch(id)) : null }
238. static accountByEmail = (email) => { return accountRowOf(first(accountsTable.find('email', normEmail(email)))) }
240. // the account a session carries, re-read from the table (null when signed out or gone).
241. // ONLY A REAL SESSION COUNTS: a face's trailing `session` argument is positional, so a
242. // hand-made emit with one argument too many would hand the face its own object in the
243. // session's place (see README "Lessons"); the framework's session is a class instance (hlTypeName 'Instance'), JSON never is.
245. // SIGNS A SESSION IN (ticket #2): stamps `since` (this session's own expiry, sessionUserTtl)
246. // and `epoch` (the account's current sessionEpoch — "sign out everywhere" bumps it, which
247. // makes every session that still carries the old epoch read as signed out, see below).
248. // `&session` on every lambda here that writes the session: since hybriel #48 a lambda parameter COPIES its
249. // argument (the framework Session instance included), so without `&` the write lands on a copy.
250. static accountEpoch = (a) => { return a.sessionEpoch == null ? 0 : a.sessionEpoch }
251. static beginSession = (&session, accountId) => {
252. if (session == null) { return false }
253. let a = isId(accountId) ? accountsTable.fetch(accountId) : null
254. if (a == null) { return false }
255. session.user = { id = accountId since = now() epoch = accountEpoch(a) }
256. return true
257. }
259. static accountOfSession = (&session) => {
260. if (session == null || session.user == null) { return null }
261. let a = accountsTable.fetch(session.user.id)
262. if (a == null) { session.user = null return null }
263. // AN OLDER SESSION (before ticket #2, incl. one carried across the mission-009
264. // migration): it has no `since`/`epoch` yet. Adopt them now instead of forcing
265. // everyone signed out the moment this ships — its own-expiry clock starts here.
266. if (session.user.since == null || session.user.epoch == null) {
267. session.user = { id = session.user.id since = now() epoch = accountEpoch(a) }
268. return accountRowOf(a)
269. }
270. if (now() - session.user.since > sessionUserTtl || session.user.epoch != accountEpoch(a)) {
271. session.user = null
272. return null
273. }
274. return accountRowOf(a)
275. }
277. // "SIGN OUT EVERYWHERE": bumps the account's sessionEpoch, so every session that carries
278. // this account (this one included — the caller's UI resets the same as a normal sign out)
279. // stops working at its next check, on every device, without touching any other session file.
280. // The session files themselves are DELETED too (project.hl hands in `dropUser`, it owns the
281. // session store); the epoch stays as the second net for any session the sweep did not see.
282. static sessionHooks = { dropUser = null }
283. static signOutEverywhere = (accountId) => {
284. let a = isId(accountId) ? accountsTable.fetch(accountId) : null
285. if (a == null) { return { error = 'no such account' } }
286. if (sessionHooks.dropUser != null) { sessionHooks.dropUser(accountId) }
287. accountsTable.update(a.id, merged(a, { sessionEpoch = accountEpoch(a) + 1 }))
288. return { ok = true }
289. }
291. static setTimeZone = (accountId, tz) => {
292. let c = checkTimeZone(tz)
293. if (c.error != null) { return c }
294. let a = isId(accountId) ? accountsTable.fetch(accountId) : null
295. if (a == null) { return { error = 'no such account' } }
296. accountsTable.update(a.id, merged(a, { timeZone = c.timeZone }))
297. return { account = accountRowOf(accountsTable.fetch(a.id)) }
298. }
300. // ---- THE SHORT ID (ident#23) ------------------------------------------------------------
301. // ONE PUBLIC ID per identity, kept forever, the same in every app: 5 characters (e.g. a68sz)
302. // from an alphabet without look-alikes — digits 2-9 and the letters minus i, l, o (no 0/O,
303. // 1/l/I): 31 characters, 28.6 million ids. Case does not matter (stored lowercase, looked up
304. // lowercased). Unique: checked against the `!shortId` index when it is made. Random (not
305. // counted), so it says nothing about how many identities exist.
306. static shortAlphabet = '23456789abcdefghjkmnpqrstuvwxyz'
307. static shortLength = 5
308. static newShortId = () => {
309. let out = ''
310. while (out.length < shortLength) {
311. let hex = randomBytes(16)
312. let i = 0
313. while (i < 32 && out.length < shortLength) {
314. let b = '0123456789abcdef'.indexOf(hex[i]) * 16 + '0123456789abcdef'.indexOf(hex[i + 1])
315. // 248 = 8 * 31: bytes above it are dropped so every character is equally likely
316. if (b < 248) { out = out + shortAlphabet[b % 31] }
317. i = i + 2
318. }
319. }
320. return out
321. }
322. // a fresh short id nobody has
323. static freshShortId = () => {
324. let id = newShortId()
325. while (countOf(identitiesTable.find('shortId', id)) > 0) { id = newShortId() }
326. return id
327. }
328. // what a person typed → the lowercase form, or null when it cannot be a short id
329. static normShortId = (v) => {
330. if (v == null || hlTypeName(v) != 'String') { return null }
331. let t = v.trim().toLowerCase()
332. if (t.length != shortLength) { return null }
333. let i = 0
334. while (i < t.length) {
335. if (shortAlphabet.indexOf(t[i]) < 0) { return null }
336. i = i + 1
337. }
338. return t
339. }
340. static identityByShortId = (v) => {
341. let t = normShortId(v)
342. return t == null ? null : first(identitiesTable.find('shortId', t))
343. }
344. // every identity made before ident#23 gets its short id now, once (at load)
345. static backfillShortIds = () => {
346. let n = 0
347. let rows = identitiesTable.find(null, null)
348. if (countOf(rows) > 0) {
349. for (r of rows) {
350. if (r.shortId == null || r.shortId == '') {
351. identitiesTable.update(r.id, merged(r, { shortId = freshShortId() }))
352. n = n + 1
353. }
354. }
355. }
356. return n
357. }
358. static shortIdsBackfilled = backfillShortIds()
360. // ---- identities -----------------------------------------------------------------------
361. static str = (v) => { return v == null ? '' : v }
363. // the account's identities, oldest first (stored `created`); the first is the DEFAULT one
364. static identityRecords = (accountId) => {
365. if (!isId(accountId)) { return [] }
366. return oldestFirst(identitiesTable.find('account', accountId))
367. }
369. // WHAT A LIST SHOWS: the identity name; without one, nickname, then first + last name,
370. // then "Identity <n>" (n = its place in the list)
371. static labelOf = (r, n) => {
372. if (str(r.identityName) != '') { return r.identityName }
373. if (str(r.nickname) != '') { return r.nickname }
374. let full = (str(r.firstname) + ' ' + str(r.lastname)).trim()
375. if (full != '') { return full }
376. return 'Identity ' + n
377. }
379. static identityRows = (accountId) => {
380. let recs = identityRecords(accountId)
381. let out = []
382. let n = 1
383. for (r of recs) {
384. let full = (str(r.firstname) + ' ' + str(r.lastname)).trim()
385. let parts = []
386. if (str(r.nickname) != '') { parts.push('“' + r.nickname + '”') }
387. if (full != '') { parts.push(full) }
388. out.push({
389. id = r.id
390. shortId = str(r.shortId)
391. label = labelOf(r, n)
392. identityName = str(r.identityName)
393. nickname = str(r.nickname)
394. firstname = str(r.firstname)
395. lastname = str(r.lastname)
396. avatar = shownAvatar(r)
397. hasAvatar = shownAvatar(r) != ''
398. details = parts.length > 0 ? parts.join(' · ') : 'no names'
399. isDefault = n == 1
400. canDelete = recs.length > 1
401. })
402. n = n + 1
403. }
404. return out
405. }
407. // the identity `id` if it belongs to the account, else null
408. static ownIdentity = (accountId, id) => {
409. if (!isId(id)) { return null }
410. let r = identitiesTable.fetch(id)
411. if (r == null || r.account != accountId) { return null }
412. return r
413. }
415. // answers { error, field } or { identity (public id) }
416. static createIdentity = (accountId, fields) => {
417. let c = checkFields(fields)
418. if (c.error != null) { return c }
419. let rec = { account = accountId shortId = freshShortId() identityName = '' nickname = '' firstname = '' lastname = '' avatar = '' created = now() updated = now() }
420. for (k of c.fields.keys()) { rec[k] = c.fields[k] }
421. let id = identitiesTable.put(rec)
422. return { identity = id }
423. }
425. // only the fields named change; answers { error, field } or { identity }
426. static updateIdentity = (accountId, id, fields) => {
427. let r = ownIdentity(accountId, id)
428. if (r == null) { return { error = 'no such identity' field = 'id' } }
429. let c = checkFields(fields)
430. if (c.error != null) { return c }
431. let changes = { updated = now() }
432. for (k of c.fields.keys()) { changes[k] = c.fields[k] }
433. identitiesTable.update(r.id, merged(r, changes))
434. return { identity = id }
435. }
437. // THE LAST IDENTITY STAYS: answers { error } or { deleted }
438. static deleteIdentity = (accountId, id) => {
439. let r = ownIdentity(accountId, id)
440. if (r == null) { return { error = 'no such identity' } }
441. if (identityRecords(accountId).length <= 1) { return { error = 'this is your only identity — an account always keeps one' } }
442. identitiesTable.delete(r.id)
443. return { deleted = id }
444. }
446. // ---- the client's IP bucket (mission 010) -------------------------------------------
447. // `ip` is the X-Client-IP header nginx sets on Byrodin (CF-Connecting-IP when the request
448. // really came through Cloudflare, else the TCP peer; nginx OVERWRITES what a client sent),
449. // or null when there is none (dev without nginx: hl:web's req.remoteAddress would be nginx's; hl:http1 did not expose the
450. // connection's peer address). The bucket:
451. // no header / empty → 'direct' ONE SHARED BUCKET for every header-less request
452. // IPv4 (also ::ffff:a.b.c.d) → the address
453. // IPv6 → its /64 prefix ('2a01:4f9:3080:1126::/64'): one client
454. // usually owns a whole /64, so per-address would not limit it
455. // anything else → the text itself (lowercased, cut to 64 chars)
456. static hexDigits = '0123456789abcdef'
457. static stripZeros = (g) => {
458. let t = g
459. while (t.length > 1 && t[0] == '0') { t = t.slice(1, t.length) }
460. return t
461. }
462. static ipBucket = (ip) => {
463. if (ip == null || hlTypeName(ip) != 'String') { return 'direct' }
464. let t = ip.trim().toLowerCase()
465. if (t == '') { return 'direct' }
466. if (t.length > 64) { t = t.slice(0, 64) }
467. if (!t.includes(':')) { return t }
468. // an IPv4-mapped IPv6 address counts as its IPv4 address
469. if (t.includes('.')) { return t.slice(t.lastIndexOf(':') + 1, t.length) }
470. let head = t
471. let tail = ''
472. let gap = t.indexOf('::')
473. if (gap >= 0) {
474. head = t.slice(0, gap)
475. tail = t.slice(gap + 2, t.length)
476. }
477. let groups = head == '' ? [] : head.split(':')
478. let rest = tail == '' ? [] : tail.split(':')
479. if (gap >= 0) {
480. let fill = 8 - groups.length - rest.length
481. while (fill > 0) {
482. groups.push('0')
483. fill = fill - 1
484. }
485. }
486. for (g of rest) { groups.push(g) }
487. if (groups.length != 8) { return t }
488. let out = []
489. let i = 0
490. while (i < 4) {
491. let g = groups[i]
492. if (g == '' || g.length > 4) { return t }
493. let j = 0
494. while (j < g.length) {
495. if (!hexDigits.includes(g[j])) { return t }
496. j = j + 1
497. }
498. out.push(stripZeros(g))
499. i = i + 1
500. }
501. return out.join(':') + '::/64'
502. }
504. // how many codes went to this bucket in the short and in the long window (and the rows
505. // older than the long window are removed on the way)
506. static ipCounts = (bucket, t0) => {
507. let inWindow = 0
508. let inDay = 0
509. let rows = ipSendsTable.find('ip', bucket)
510. if (countOf(rows) > 0) {
511. for (s of rows) {
512. if (s.at > t0 - ipDayWindow) {
513. inDay = inDay + 1
514. if (s.at > t0 - ipWindow) { inWindow = inWindow + 1 }
515. } else {
516. ipSendsTable.delete(s.id)
517. }
518. }
519. }
520. return { inWindow = inWindow inDay = inDay }
521. }
523. // ---- step 1: ask for a code ---------------------------------------------------------
524. // answers { error, limited } or { email, code } — the caller mails the code. The answer
525. // does not say whether the address has an account (the first login creates it).
526. // `ip` is the client's IP (the X-Client-IP header, or null — see ipBucket). `limited` is
527. // true when a limit refused it (the route answers 429 then).
528. static startLogin = (email, ip) => {
529. let e = normEmail(email)
530. if (!validEmail(e)) { return { error = 'that is not an email address' } }
531. let t0 = now()
532. // THE PER-IP LIMIT first: one client, many addresses
533. let bucket = ipBucket(ip)
534. let ipc = ipCounts(bucket, t0)
535. if (ipc.inWindow >= ipLimit || ipc.inDay >= ipDayLimit) {
536. return { error = 'too many codes were requested from your network — wait a while and try again' limited = true }
537. }
538. let recent = 0
539. let sends = sendsTable.find('email', e)
540. if (countOf(sends) > 0) {
541. for (s of sends) {
542. if (s.at > t0 - sendWindow) { recent = recent + 1 } else { sendsTable.delete(s.id) }
543. }
544. }
545. if (recent >= sendLimit) {
546. return { error = 'too many codes were sent to this address — wait a few minutes and try again' limited = true }
547. }
548. let olds = otpTable.find('email', e)
549. if (countOf(olds) > 0) { for (old of olds) { otpTable.delete(old.id) } }
550. let code = newOtp()
551. otpTable.put({ email = e hash = otpHash(e, code) expires = t0 + otpTtl tries = 0 })
552. sendsTable.put({ email = e at = t0 })
553. ipSendsTable.put({ ip = bucket at = t0 })
554. return { email = e code = code }
555. }
557. // ---- step 2: check it — and on the FIRST login create the account -------------------
558. // answers { error } or { account, created }. `timeZone` is the browser's (first use);
559. // a missing or malformed one is stored as UTC, it can be changed in ident.
560. static checkCode = (email, code, timeZone) => {
561. let e = normEmail(email)
562. let c = code == null ? '' : ('' + code).trim()
563. let p = first(otpTable.find('email', e))
564. if (p == null) { return { error = 'no code is waiting for this address — ask for a new one' } }
565. if (p.expires < now()) {
566. otpTable.delete(p.id)
567. return { error = 'the code expired — ask for a new one' }
568. }
569. if (otpHash(e, c) != p.hash) {
570. if (p.tries + 1 >= maxTries) {
571. otpTable.delete(p.id)
572. return { error = 'too many wrong codes — ask for a new one' }
573. }
574. otpTable.update(p.id, merged(p, { tries = p.tries + 1 }))
575. return { error = 'wrong code (' + (maxTries - p.tries - 1) + ' tries left)' }
576. }
577. otpTable.delete(p.id)
578. let known = accountByEmail(e)
579. if (known != null) { return { account = known created = false } }
580. let tz = checkTimeZone(timeZone)
581. let id = accountsTable.put({ email = e timeZone = tz.error == null ? tz.timeZone : 'UTC' created = now() })
582. // THE DEFAULT IDENTITY, from the beginning; its names are optional (asked next)
583. identitiesTable.put({ account = id shortId = freshShortId() identityName = 'Default' nickname = '' firstname = '' lastname = '' avatar = '' created = now() updated = now() })
584. return { account = accountRowOf(accountsTable.fetch(id)) created = true }
585. }
587. // ---- THE PENDING SIGN-IN (ticket ident#20, mission 032) ------------------------------
588. // After "Send me a code" the browser's SESSION remembers the address, so a reload (a phone
589. // reloading the tab while the user reads the mail, a second tab, a socket re-seed) still
590. // shows the code step. It lives in `session.data.pendingEmail` (the app's hybrid on the
591. // Session — an undeclared member of the instance would not read back, see session.hl).
592. // It is ONLY honoured while a code for that address is really waiting: in otpTable, not
593. // expired, not used, not killed by too many wrong tries — so it never shows a code step
594. // for an address no code was sent to. It holds no secret (the code is only in the mail).
595. // Cleared on: a successful sign-in (verifyCode), "Other address" (dropPending), and
596. // expiry / a dead code (pendingOf drops it the next time it reads it).
597. static codeWaiting = (email) => {
598. let e = normEmail(email)
599. if (e == '') { return false }
600. let p = first(otpTable.find('email', e))
601. return p != null && p.expires >= now() && p.tries < maxTries
602. }
604. // the face rememberPending (home.hl): { email } or { error }
605. static recordPending = (&session, email) => {
606. if (session == null) { return { error = 'no session — reload the page' } }
607. if (email == null || hlTypeName(email) != 'String') { return { error = 'field email must be a string' } }
608. let e = normEmail(email)
609. if (!codeWaiting(e)) { return { error = 'no code is waiting for this address' } }
610. session.data.pendingEmail = e
611. return { email = e }
612. }
614. // the address whose code step this session shows, or null (and a stale one is dropped)
615. static pendingOf = (&session) => {
616. if (session == null || session.data == null) { return null }
617. let e = session.data.pendingEmail
618. if (e == null || e == '') { return null }
619. if (!codeWaiting(e)) {
620. session.data.pendingEmail = null
621. return null
622. }
623. return e
624. }
626. static dropPending = (&session) => {
627. if (session != null && session.data != null) { session.data.pendingEmail = null }
628. return true
629. }