masks-server 0.11.0 → 0.13.0

data/db/migrate/20261020140000_create_health_checks.rb

@@ -0,0 +1,25 @@
+class CreateHealthChecks < ActiveRecord::Migration[8.1]
+  include Masks::Server::TenantIsolation
+
+  def up
+    create_table :health_checks do |t|
+      t.references :tenant, null: false, foreign_key: { on_delete: :cascade }, index: false
+      t.string :name, null: false
+      t.string :status, null: false
+      t.string :summary, null: false
+      t.jsonb :details, null: false, default: {}
+      t.datetime :checked_at, null: false
+      t.datetime :changed_at, null: false
+      t.timestamps
+    end
+
+    add_index :health_checks, %i[tenant_id name], unique: true
+
+    enable_row_level_security(:health_checks)
+  end
+
+  def down
+    disable_row_level_security(:health_checks)
+    drop_table :health_checks
+  end
+end

data/db/migrate/20261020150000_add_link_lifetimes_to_tenants.rb

@@ -0,0 +1,8 @@
+class AddLinkLifetimesToTenants < ActiveRecord::Migration[8.1]
+  def change
+    add_column :tenants, :invitation_lifetime, :integer, null: false, default: 7 * 24 * 60 * 60
+    add_column :tenants, :organization_invitation_lifetime, :integer, null: false, default: 14 * 24 * 60 * 60
+    add_column :tenants, :password_reset_lifetime, :integer, null: false, default: 30 * 60
+    add_column :tenants, :email_verification_lifetime, :integer, null: false, default: 2 * 24 * 60 * 60
+  end
+end

data/db/migrate/20261021100000_add_pinned_origin_to_tenants.rb

@@ -0,0 +1,5 @@
+class AddPinnedOriginToTenants < ActiveRecord::Migration[8.1]
+  def change
+    add_column :tenants, :pinned_origin, :string
+  end
+end

data/db/migrate/20261031100000_default_key_rotation_to_ninety_days.rb

@@ -0,0 +1,5 @@
+class DefaultKeyRotationToNinetyDays < ActiveRecord::Migration[8.1]
+  def change
+    change_column_default :tenants, :key_rotation_days, from: nil, to: 90
+  end
+end

data/lib/generators/masks/server/install/install_generator.rb

@@ -39,9 +39,11 @@ module Masks
           say ""
 
           engine? ? say_engine_database : say_server_database
+          say_cache_store if engine?
 
-          say "In production, set MASKS_PUBLIC_ORIGIN_TEMPLATE to #{origin_example}, so the issuer and every"
-          say "emailed link are built from it and never from a request's Host header."
+          say "In production, masks keeps the address its setup screen was first opened at, and builds the"
+          say "issuer and every emailed link from it. To name the address yourself, set"
+          say "MASKS_PUBLIC_ORIGIN_TEMPLATE to #{origin_example}."
           say ""
           say "Then run bin/rails db:prepare and bin/rails masks:tenants, and open #{login_path} to set up"
           say "the first account with the setup token masks prints."
@@ -104,6 +106,24 @@ module Masks
             say ""
           end
 
+          def say_cache_store
+            say "masks holds one-time sign-in state, rate limits, and health findings in Rails.cache, so"
+            say "every process that serves it must share one cache store, such as :solid_cache_store,"
+            say ":redis_cache_store or :mem_cache_store. In production, masks refuses to boot on"
+            say ":memory_store or :null_store."
+
+            if Configuration.unshared_cache_store?(cache_store)
+              say ""
+              say "This app's cache_store is #{Array(cache_store).first.inspect}. Change it before you deploy.", :yellow
+            end
+
+            say ""
+          end
+
+          def cache_store
+            ::Rails.application&.config&.cache_store if defined?(::Rails.application)
+          end
+
           def say_server_database
             say "masks keeps its tables in the primary database. Connect as a role holding neither"
             say "SUPERUSER nor BYPASSRLS, and set config.active_record.schema_format = :sql, since"

data/lib/masks/server/configuration.rb

@@ -4,6 +4,7 @@ module Masks
   module Server
     module Configuration
       MODES = %i[server engine].freeze
+      UNSHARED_CACHE_STORES = %i[memory_store null_store].freeze
 
       module_function
 
@@ -12,19 +13,13 @@ module Masks
         config.mode = ENV.fetch("MASKS_MODE", "server").to_sym
         config.database = nil
         config.secret = nil
-        config.attempt_limit = ENV.fetch("MASKS_ATTEMPT_LIMIT", 10).to_i
-        config.account_attempt_limit = ENV.fetch("MASKS_ACCOUNT_ATTEMPT_LIMIT", 5).to_i
-        config.registration_limit = ENV.fetch("MASKS_REGISTRATION_LIMIT", 10).to_i
-        config.recovery_limit = ENV.fetch("MASKS_RECOVERY_LIMIT", 5).to_i
-        config.device_code_limit = ENV.fetch("MASKS_DEVICE_CODE_LIMIT", 30).to_i
-        config.claim_limit = ENV.fetch("MASKS_CLAIM_LIMIT", 3).to_i
-        config.claim_ceiling = ENV.fetch("MASKS_CLAIM_CEILING", 30).to_i
         config.setup_token = ENV["MASKS_SETUP_TOKEN"].presence
         config.recover = ENV["MASKS_RECOVER"].presence
         config.config_path = ENV["MASKS_CONFIG"].presence
         config.themes_path = ENV["MASKS_THEMES_PATH"].presence
         config.docs_url = ENV.fetch("MASKS_DOCS_URL", "https://masks.pages.dev")
         config.public_origin_template = ENV["MASKS_PUBLIC_ORIGIN_TEMPLATE"].presence
+        config.pin_origin = !::Rails.env.local?
         config.tenant = ENV["MASKS_TENANT"].presence
         config.tenants = ENV["MASKS_TENANTS"].to_s.split(/[\s,]+/).reject(&:empty?)
         config.dynamic_client_scopes = ENV["MASKS_DYNAMIC_CLIENT_SCOPES"].presence
@@ -35,11 +30,6 @@ module Masks
         config.mail_from = ENV["MASKS_MAIL_FROM"].presence
         config.smtp_address = ENV["MASKS_SMTP_ADDRESS"].presence
         config.smtp_settings = smtp_settings(config.smtp_address)
-        config.invitation_lifetime = ENV.fetch("MASKS_INVITATION_LIFETIME", 7 * 24 * 60 * 60).to_i.seconds
-        config.organization_invitation_lifetime =
-          ENV.fetch("MASKS_ORGANIZATION_INVITATION_LIFETIME", 14 * 24 * 60 * 60).to_i.seconds
-        config.password_reset_lifetime = ENV.fetch("MASKS_PASSWORD_RESET_LIFETIME", 30 * 60).to_i.seconds
-        config.email_verification_lifetime = ENV.fetch("MASKS_EMAIL_VERIFICATION_LIFETIME", 2 * 24 * 60 * 60).to_i.seconds
         config.outbound_allowed = outbound_allowed(ENV["MASKS_OUTBOUND_ALLOWED"])
         config.ldap_port = ENV.fetch("MASKS_LDAP_PORT", 3389).to_i
         config.on_demand_tls = ENV.fetch("MASKS_ON_DEMAND_TLS", "false")
@@ -50,6 +40,7 @@ module Masks
         config.queue_wait = ENV.fetch("MASKS_QUEUE_WAIT", 600).to_i.seconds
         config.finished_job_retention = ENV.fetch("MASKS_FINISHED_JOB_RETENTION", 7 * 24 * 60 * 60).to_i.seconds
         config.failed_job_retention = ENV.fetch("MASKS_FAILED_JOB_RETENTION", 30 * 24 * 60 * 60).to_i.seconds
+        config.release_check = %w[1 true].include?(ENV.fetch("MASKS_RELEASE_CHECK", "false"))
         config
       end
 
@@ -91,7 +82,11 @@ module Masks
         }.compact
       end
 
-      def validate!(config, local:, building:)
+      def unshared_cache_store?(cache_store)
+        UNSHARED_CACHE_STORES.include?(Array(cache_store).first&.to_sym)
+      end
+
+      def validate!(config, local:, building:, cache_store: nil)
         unless MODES.include?(config.mode)
           raise "masks runs in server or engine mode, and config.masks.mode is #{config.mode.inspect}."
         end
@@ -124,12 +119,6 @@ module Masks
                 "be dropped without an error anyone sees."
         end
 
-        if config.public_origin_template.nil?
-          raise "MASKS_PUBLIC_ORIGIN_TEMPLATE is required outside development. Without it the " \
-                "issuer, the registration endpoint and every emailed link follow the Host header, " \
-                "so anyone who can reach this server can have a password reset delivered to theirs."
-        end
-
         if config.setup_token && config.setup_token.length < 24
           raise "MASKS_SETUP_TOKEN is #{config.setup_token.length} characters, and at least 24 are " \
                 "required outside development. Whoever holds it creates the first account of every " \
@@ -140,6 +129,14 @@ module Masks
           raise "masks in engine mode needs a database of its own. Set config.masks.database to " \
                 "the name of a database.yml entry whose role cannot bypass row-level security."
         end
+
+        if unshared_cache_store?(cache_store)
+          raise "config.cache_store is #{Array(cache_store).first.inspect}, which every process keeps " \
+                "to itself. masks holds one-time sign-in state, rate limits, and health findings in " \
+                "Rails.cache, so a provider's callback redeemed in one process is lost in the next. " \
+                "Use a store every process shares, such as :solid_cache_store, :redis_cache_store " \
+                "or :mem_cache_store."
+        end
       end
     end
   end

data/lib/masks/server/engine.rb

@@ -20,7 +20,8 @@ module Masks
         Configuration.validate!(
           app.config.masks,
           local: ::Rails.env.local?,
-          building: ENV["SECRET_KEY_BASE_DUMMY"].present?
+          building: ENV["SECRET_KEY_BASE_DUMMY"].present?,
+          cache_store: app.config.cache_store
         )
 
         middleware.insert_before Tenancy::Middleware, Isolation if app.config.masks.mode == :engine

data/lib/masks/server/forwarding.rb

@@ -1,7 +1,11 @@
 module Masks
   module Server
     class Forwarding
-      HEADERS = %w[HTTP_X_FORWARDED_FOR HTTP_X_FORWARDED_HOST HTTP_CLIENT_IP HTTP_FORWARDED].freeze
+      HEADERS = %w[
+        HTTP_X_FORWARDED_FOR HTTP_X_FORWARDED_HOST HTTP_CLIENT_IP HTTP_FORWARDED
+        HTTP_X_FORWARDED_PROTO HTTP_X_FORWARDED_SCHEME HTTP_X_FORWARDED_SSL HTTP_X_FORWARDED_PORT
+      ].freeze
+      PROTO = "HTTP_X_FORWARDED_PROTO".freeze
 
       def initialize(app, proxies)
         @app = app
@@ -9,9 +13,20 @@ module Masks
       end
 
       def call(env)
-        HEADERS.each { |header| env.delete(header) } unless trusted?(env["REMOTE_ADDR"])
+        address = env["REMOTE_ADDR"]
+        trusted = trusted?(address)
 
-        @app.call(env)
+        unless trusted
+          Health.note_proxy!("untrusted", address) if HEADERS.any? { |header| env.key?(header) }
+          HEADERS.each { |header| env.delete(header) }
+        end
+
+        plain = trusted && plain?(env)
+        status, headers, body = @app.call(env)
+
+        Health.note_proxy!("plain", address) if plain && !sent_to_https?(status, headers)
+
+        [ status, headers, body ]
       end
 
       private
@@ -24,6 +39,14 @@ module Masks
         rescue IPAddr::InvalidAddressError, IPAddr::AddressFamilyError
           false
         end
+
+        def plain?(env)
+          env[PROTO].to_s.split(",").first.to_s.strip.casecmp?("http")
+        end
+
+        def sent_to_https?(status, headers)
+          (300..399).cover?(status) && headers["location"].to_s.downcase.start_with?("https://")
+        end
     end
   end
 end

data/lib/masks/server/schema_reference.rb

@@ -65,6 +65,8 @@ module Masks
             values(type)
           elsif type.kind.scalar?
             "A scalar.\n"
+          elsif type.kind.input_object?
+            arguments(type)
           else
             fields(type)
           end
@@ -88,6 +90,16 @@ module Masks
           table([ "Value", "Description" ], rows, described)
         end
 
+        def arguments(type)
+          described = type.arguments.values.map { |argument| argument.description.to_s.strip }
+
+          rows = type.arguments.values.zip(described).map do |argument, text|
+            cells([ "`#{argument.graphql_name}`", link(argument.type), text ], described)
+          end
+
+          table([ "Field", "Type", "Description" ], rows, described)
+        end
+
         def fields(type)
           described = type.fields.values.map { |field| field.description.to_s.strip }
 

data/lib/masks/server/tenancy/middleware.rb

@@ -3,8 +3,9 @@ module Masks
     module Tenancy
       class Middleware
         UNSERVED = "no tenant is served at this hostname".freeze
+        MOVED = "masks answers at %s. To serve it at another address, set MASKS_PUBLIC_ORIGIN_TEMPLATE to that address.".freeze
+        UNKEPT = "This tenant was set up without a kept address. Set MASKS_PUBLIC_ORIGIN_TEMPLATE to the address it answers at.".freeze
         CROWDED = "too many tenants were claimed recently; try again later".freeze
-        CLAIM_WINDOW = 1.hour
         TENANTLESS = %w[/up /metrics].freeze
         TLS_ASK = "/tls/allowed".freeze
 
@@ -40,11 +41,16 @@ module Masks
 
           return unserved if tenant.nil?
 
-          origin = origin_for(request, tenant)
+          held = tenant.held_origin
 
-          return unserved if origin.nil?
+          return unserved(UNKEPT) if held.nil? && Tenant.pins_origin? && tenant.set_up?
+
+          origin = origin_for(request, tenant, held)
+
+          return unserved(held ? format(MOVED, held) : UNSERVED) if origin.nil?
 
           Current.origin = origin
+          Health.note_origin!(tenant, Forwarded.origin(request.base_url), origin)
           Current.ip_address = request.remote_ip
           Current.user_agent = request.user_agent
 
@@ -67,9 +73,13 @@ module Masks
             nil
           end
 
-          def origin_for(request, tenant)
-            return "#{request.base_url}#{request.script_name}" if ::Rails.configuration.masks.public_origin_template.nil?
+          def origin_for(request, tenant, held)
+            untemplated = ::Rails.configuration.masks.public_origin_template.nil?
+            seen = "#{request.base_url}#{request.script_name}"
+
+            return seen if untemplated && held.nil?
             return tenant.custom_origin if tenant.custom_host&.casecmp?(request.host.to_s)
+            return (held if held.casecmp?(seen)) if untemplated
 
             canonical = tenant.templated_origin
 
@@ -83,27 +93,25 @@ module Masks
           end
 
           def crowded?(request)
-            window = Time.current.to_i / CLAIM_WINDOW.to_i
-            from_here = ::Rails.cache.increment("tenant-claims:#{window}:#{request.remote_ip}", 1, expires_in: CLAIM_WINDOW)
-            from_anywhere = ::Rails.cache.increment("tenant-claims:#{window}", 1, expires_in: CLAIM_WINDOW)
+            here = Throttle.crowded?(:claim, "claims:#{request.remote_ip}")
+            anywhere = Throttle.crowded?(:claim_ceiling, "claims")
 
-            from_here.to_i > ::Rails.configuration.masks.claim_limit ||
-              from_anywhere.to_i > ::Rails.configuration.masks.claim_ceiling
+            (here || anywhere).tap { |crowded| Throttle.hit!(here ? :claim : :claim_ceiling, address: request.remote_ip) if crowded }
           end
 
           def crowded
             [
               429,
-              { "content-type" => "text/plain; charset=utf-8", "cache-control" => "no-store", "retry-after" => CLAIM_WINDOW.to_i.to_s },
+              { "content-type" => "text/plain; charset=utf-8", "cache-control" => "no-store", "retry-after" => Throttle.budget(:claim).within.to_i.to_s },
               [ CROWDED ]
             ]
           end
 
-          def unserved
+          def unserved(body = UNSERVED)
             [
               404,
               { "content-type" => "text/plain; charset=utf-8", "cache-control" => "no-store" },
-              [ UNSERVED ]
+              [ body ]
             ]
           end
       end

data/lib/masks/server/tenant_isolation.rb

@@ -4,11 +4,23 @@ module Masks
       SETTING = "masks.tenant_id".freeze
 
       def self.adopt(connection)
+        return unless masks?(connection)
+
         connection.exec_query("SELECT set_config($1, $2, false)", "tenant", [ SETTING, Current.tenant&.id.to_s ])
       rescue ActiveRecord::NoDatabaseError, ActiveRecord::ConnectionNotEstablished, ActiveRecord::ConnectionFailed
         nil
       end
 
+      def self.masks?(connection)
+        database = Server.config.database
+
+        return true if database.nil?
+
+        pool = connection.pool
+
+        pool.respond_to?(:db_config) && pool.db_config.name == database.to_s
+      end
+
       def enable_row_level_security(table)
         execute <<~SQL
           ALTER TABLE #{table} ENABLE ROW LEVEL SECURITY;

data/public/masks-assets/.vite/manifest.json

@@ -1,23 +1,23 @@
 {
-  "_initial-C1GpCiEh.js": {
-    "file": "assets/initial-C1GpCiEh.js",
+  "_initial-Cn-UuAsy.js": {
+    "file": "assets/initial-Cn-UuAsy.js",
     "name": "initial"
   },
-  "_passkey-DIj_5LCY.js": {
-    "file": "assets/passkey-DIj_5LCY.js",
+  "_passkey-5UYPVD3c.js": {
+    "file": "assets/passkey-5UYPVD3c.js",
     "name": "passkey"
   },
   "entrypoints/account.js": {
-    "file": "assets/account-D46qDQCo.js",
+    "file": "assets/account-h7I6VUPR.js",
     "name": "entrypoints/account.js",
     "src": "entrypoints/account.js",
     "isEntry": true,
     "imports": [
-      "_passkey-DIj_5LCY.js"
+      "_passkey-5UYPVD3c.js"
     ]
   },
   "entrypoints/app.css": {
-    "file": "assets/app-D7W0gAyT.css",
+    "file": "assets/app-BXOScMjL.css",
     "name": "entrypoints/app.css",
     "names": [
       "entrypoints/app.css"
@@ -35,28 +35,28 @@
     "isEntry": true
   },
   "entrypoints/handshake.js": {
-    "file": "assets/handshake-DIFZPSAK.js",
+    "file": "assets/handshake-YQpRNMIs.js",
     "name": "entrypoints/handshake.js",
     "src": "entrypoints/handshake.js",
     "isEntry": true
   },
   "entrypoints/login.js": {
-    "file": "assets/login-C_6igRZ3.js",
+    "file": "assets/login-C21_jb6L.js",
     "name": "entrypoints/login.js",
     "src": "entrypoints/login.js",
     "isEntry": true,
     "imports": [
-      "_passkey-DIj_5LCY.js",
-      "_initial-C1GpCiEh.js"
+      "_passkey-5UYPVD3c.js",
+      "_initial-Cn-UuAsy.js"
     ]
   },
   "entrypoints/manage.js": {
-    "file": "assets/manage-D4MzaDvM.js",
+    "file": "assets/manage-DpVxe5sv.js",
     "name": "entrypoints/manage.js",
     "src": "entrypoints/manage.js",
     "isEntry": true,
     "imports": [
-      "_initial-C1GpCiEh.js"
+      "_initial-Cn-UuAsy.js"
     ]
   }
 }

data/public/masks-assets/assets/{account-D46qDQCo.js → account-h7I6VUPR.js}

@@ -1,2 +1,2 @@
-import{a as e,i as t,o as n}from"./passkey-DIj_5LCY.js";var r=()=>document.querySelector(`meta[name="csrf-token"]`)?.content??``,i=document.getElementById(`add-passkey`),a=document.getElementById(`passkey-credential`),o=document.getElementById(`passkey-name`),s=document.getElementById(`add-passkey-button`),c=document.getElementById(`passkey-unusable`);async function l(){let e=await fetch(i.dataset.challenge,{method:`POST`,credentials:`same-origin`,headers:{Accept:`application/json`,"X-CSRF-Token":r()}});if(e.status===401){let{redirectTo:t}=await e.json();throw window.location.assign(t),Error(`signing in again first`)}if(!e.ok)throw Error(`could not start enrolment: ${e.status}`);return e.json()}async function u(t){t.preventDefault(),s.disabled=!0,c.hidden=!0;try{a.value=await e(await l()),i.submit()}catch(e){n(e)||(c.textContent=`That passkey could not be added on this device.`,c.hidden=!1),s.disabled=!1}}i&&t()?(i.hidden=!1,s.addEventListener(`click`,u)):o&&o.closest(`[data-passkeys]`)?.setAttribute(`data-unsupported`,`true`);var d=document.getElementById(`picture-file`);d?.addEventListener(`change`,()=>{d.files?.length&&d.form?.requestSubmit()});for(let e of document.querySelectorAll(`[data-autosubmit]`)){let t=e.form?.querySelector(`[data-autosubmitted]`);t&&(t.hidden=!0),e.addEventListener(`change`,()=>e.form?.requestSubmit())}
-//# sourceMappingURL=account-D46qDQCo.js.map
+import{a as e,i as t,o as n}from"./passkey-5UYPVD3c.js";var r=()=>document.querySelector(`meta[name="csrf-token"]`)?.content??``,i=document.getElementById(`add-passkey`),a=document.getElementById(`passkey-credential`),o=document.getElementById(`passkey-name`),s=document.getElementById(`add-passkey-button`),c=document.getElementById(`passkey-unusable`);async function l(){let e=await fetch(i.dataset.challenge,{method:`POST`,credentials:`same-origin`,headers:{Accept:`application/json`,"X-CSRF-Token":r()}});if(e.status===401){let{redirectTo:t}=await e.json();throw window.location.assign(t),Error(`signing in again first`)}if(!e.ok)throw Error(`could not start enrolment: ${e.status}`);return e.json()}async function u(t){t.preventDefault(),s.disabled=!0,c.hidden=!0;try{a.value=await e(await l()),i.submit()}catch(e){n(e)||(c.textContent=`That passkey could not be added on this device.`,c.hidden=!1),s.disabled=!1}}i&&t()?(i.hidden=!1,s.addEventListener(`click`,u)):o&&o.closest(`[data-passkeys]`)?.setAttribute(`data-unsupported`,`true`);var d=document.getElementById(`picture-file`);d?.addEventListener(`change`,()=>{d.files?.length&&d.form?.requestSubmit()});for(let e of document.querySelectorAll(`[data-autosubmit]`)){let t=e.form?.querySelector(`[data-autosubmitted]`);t&&(t.hidden=!0),e.addEventListener(`change`,()=>e.form?.requestSubmit())}
+//# sourceMappingURL=account-h7I6VUPR.js.map

data/public/masks-assets/assets/{account-D46qDQCo.js.map → account-h7I6VUPR.js.map}

@@ -1 +1 @@
-{"version":3,"file":"account-D46qDQCo.js","names":["enrol","available","refused","csrf","form","field","name","button","unusable","options","response","redirectTo","add","event","error","picture"],"sources":["../../../../server/app/frontend/entrypoints/account.js"],"sourcesContent":["import { available, enrol, refused } from \"../lib/passkey.js\";\n\nconst csrf = () =>\n  document.querySelector('meta[name=\"csrf-token\"]')?.content ?? \"\";\n\nconst form = document.getElementById(\"add-passkey\");\nconst field = document.getElementById(\"passkey-credential\");\nconst name = document.getElementById(\"passkey-name\");\nconst button = document.getElementById(\"add-passkey-button\");\nconst unusable = document.getElementById(\"passkey-unusable\");\n\nasync function options() {\n  const response = await fetch(form.dataset.challenge, {\n    method: \"POST\",\n    credentials: \"same-origin\",\n    headers: { Accept: \"application/json\", \"X-CSRF-Token\": csrf() },\n  });\n\n  if (response.status === 401) {\n    const { redirectTo } = await response.json();\n    window.location.assign(redirectTo);\n    throw new Error(\"signing in again first\");\n  }\n\n  if (!response.ok)\n    throw new Error(`could not start enrolment: ${response.status}`);\n\n  return response.json();\n}\n\nasync function add(event) {\n  event.preventDefault();\n\n  button.disabled = true;\n  unusable.hidden = true;\n\n  try {\n    field.value = await enrol(await options());\n    form.submit();\n  } catch (error) {\n    if (!refused(error)) {\n      unusable.textContent = \"That passkey could not be added on this device.\";\n      unusable.hidden = false;\n    }\n\n    button.disabled = false;\n  }\n}\n\nif (form && available()) {\n  form.hidden = false;\n  button.addEventListener(\"click\", add);\n} else if (name) {\n  name.closest(\"[data-passkeys]\")?.setAttribute(\"data-unsupported\", \"true\");\n}\n\nconst picture = document.getElementById(\"picture-file\");\n\npicture?.addEventListener(\"change\", () => {\n  if (picture.files?.length) picture.form?.requestSubmit();\n});\n\nfor (const field of document.querySelectorAll(\"[data-autosubmit]\")) {\n  const button = field.form?.querySelector(\"[data-autosubmitted]\");\n\n  if (button) button.hidden = true;\n  field.addEventListener(\"change\", () => field.form?.requestSubmit());\n}\n"],"mappings":"wDAEA,IAAMG,MACJ,SAAS,cAAc,yBAAyB,CAAC,EAAE,SAAW,GAE1DC,EAAO,SAAS,eAAe,aAAa,EAC5CC,EAAQ,SAAS,eAAe,oBAAoB,EACpDC,EAAO,SAAS,eAAe,cAAc,EAC7CC,EAAS,SAAS,eAAe,oBAAoB,EACrDC,EAAW,SAAS,eAAe,kBAAkB,EAE3D,eAAeC,GAAU,CACvB,IAAMC,EAAW,MAAM,MAAMN,EAAK,QAAQ,UAAW,CACnD,OAAQ,OACR,YAAa,cACb,QAAS,CAAE,OAAQ,mBAAoB,eAAgBD,EAAK,CAAE,CAChE,CAAC,EAED,GAAIO,EAAS,SAAW,IAAK,CAC3B,GAAM,CAAE,cAAe,MAAMA,EAAS,KAAK,EAE3C,MADA,OAAO,SAAS,OAAOC,CAAU,EACvB,MAAM,wBAAwB,CAC1C,CAEA,GAAI,CAACD,EAAS,GACZ,MAAU,MAAM,8BAA8BA,EAAS,QAAQ,EAEjE,OAAOA,EAAS,KAAK,CACvB,CAEA,eAAeE,EAAI,EAAO,CACxBC,EAAM,eAAe,EAErB,EAAO,SAAW,GAClB,EAAS,OAAS,GAElB,GAAI,CACF,EAAM,MAAQ,MAAMb,EAAM,MAAMS,EAAQ,CAAC,EACzCL,EAAK,OAAO,CACd,OAASU,EAAO,CACTZ,EAAQY,CAAK,IAChB,EAAS,YAAc,kDACvB,EAAS,OAAS,IAGpB,EAAO,SAAW,EACpB,CACF,CAEIV,GAAQH,EAAU,GACpB,EAAK,OAAS,GACdM,EAAO,iBAAiB,QAASK,CAAG,GAC3BN,GACTA,EAAK,QAAQ,iBAAiB,CAAC,EAAE,aAAa,mBAAoB,MAAM,EAG1E,IAAMS,EAAU,SAAS,eAAe,cAAc,EAEtDA,GAAS,iBAAiB,aAAgB,CACpCA,EAAQ,OAAO,QAAQA,EAAQ,MAAM,cAAc,CACzD,CAAC,EAED,IAAK,IAAMV,KAAS,SAAS,iBAAiB,mBAAmB,EAAG,CAClE,IAAME,EAASF,EAAM,MAAM,cAAc,sBAAsB,EAE3DE,IAAQ,EAAO,OAAS,IAC5BF,EAAM,iBAAiB,aAAgBA,EAAM,MAAM,cAAc,CAAC,CACpE"}
+{"version":3,"file":"account-h7I6VUPR.js","names":["enrol","available","refused","csrf","form","field","name","button","unusable","options","response","redirectTo","add","event","error","picture"],"sources":["../../../../server/app/frontend/entrypoints/account.js"],"sourcesContent":["import { available, enrol, refused } from \"../lib/passkey.js\";\n\nconst csrf = () =>\n  document.querySelector('meta[name=\"csrf-token\"]')?.content ?? \"\";\n\nconst form = document.getElementById(\"add-passkey\");\nconst field = document.getElementById(\"passkey-credential\");\nconst name = document.getElementById(\"passkey-name\");\nconst button = document.getElementById(\"add-passkey-button\");\nconst unusable = document.getElementById(\"passkey-unusable\");\n\nasync function options() {\n  const response = await fetch(form.dataset.challenge, {\n    method: \"POST\",\n    credentials: \"same-origin\",\n    headers: { Accept: \"application/json\", \"X-CSRF-Token\": csrf() },\n  });\n\n  if (response.status === 401) {\n    const { redirectTo } = await response.json();\n    window.location.assign(redirectTo);\n    throw new Error(\"signing in again first\");\n  }\n\n  if (!response.ok)\n    throw new Error(`could not start enrolment: ${response.status}`);\n\n  return response.json();\n}\n\nasync function add(event) {\n  event.preventDefault();\n\n  button.disabled = true;\n  unusable.hidden = true;\n\n  try {\n    field.value = await enrol(await options());\n    form.submit();\n  } catch (error) {\n    if (!refused(error)) {\n      unusable.textContent = \"That passkey could not be added on this device.\";\n      unusable.hidden = false;\n    }\n\n    button.disabled = false;\n  }\n}\n\nif (form && available()) {\n  form.hidden = false;\n  button.addEventListener(\"click\", add);\n} else if (name) {\n  name.closest(\"[data-passkeys]\")?.setAttribute(\"data-unsupported\", \"true\");\n}\n\nconst picture = document.getElementById(\"picture-file\");\n\npicture?.addEventListener(\"change\", () => {\n  if (picture.files?.length) picture.form?.requestSubmit();\n});\n\nfor (const field of document.querySelectorAll(\"[data-autosubmit]\")) {\n  const button = field.form?.querySelector(\"[data-autosubmitted]\");\n\n  if (button) button.hidden = true;\n  field.addEventListener(\"change\", () => field.form?.requestSubmit());\n}\n"],"mappings":"A,wDAEA,IAAMG,MACJ,SAAS,cAAc,yBAAyB,CAAC,EAAE,SAAW,GAE1DC,EAAO,SAAS,eAAe,aAAa,EAC5CC,EAAQ,SAAS,eAAe,oBAAoB,EACpDC,EAAO,SAAS,eAAe,cAAc,EAC7CC,EAAS,SAAS,eAAe,oBAAoB,EACrDC,EAAW,SAAS,eAAe,kBAAkB,EAE3D,eAAeC,GAAU,CACvB,IAAMC,EAAW,MAAM,MAAMN,EAAK,QAAQ,UAAW,CACnD,OAAQ,OACR,YAAa,cACb,QAAS,CAAE,OAAQ,mBAAoB,eAAgBD,EAAK,CAAE,CAChE,CAAC,EAED,GAAIO,EAAS,SAAW,IAAK,CAC3B,GAAM,CAAE,cAAe,MAAMA,EAAS,KAAK,EAE3C,MADA,OAAO,SAAS,OAAOC,CAAU,EACvB,MAAM,wBAAwB,CAC1C,CAEA,GAAI,CAACD,EAAS,GACZ,MAAU,MAAM,8BAA8BA,EAAS,QAAQ,EAEjE,OAAOA,EAAS,KAAK,CACvB,CAEA,eAAeE,EAAI,EAAO,CACxBC,EAAM,eAAe,EAErB,EAAO,SAAW,GAClB,EAAS,OAAS,GAElB,GAAI,CACF,EAAM,MAAQ,MAAMb,EAAM,MAAMS,EAAQ,CAAC,EACzCL,EAAK,OAAO,CACd,OAASU,EAAO,CACTZ,EAAQY,CAAK,IAChB,EAAS,YAAc,kDACvB,EAAS,OAAS,IAGpB,EAAO,SAAW,EACpB,CACF,CAEIV,GAAQH,EAAU,GACpB,EAAK,OAAS,GACdM,EAAO,iBAAiB,QAASK,CAAG,GAC3BN,GACTA,EAAK,QAAQ,iBAAiB,CAAC,EAAE,aAAa,mBAAoB,MAAM,EAG1E,IAAMS,EAAU,SAAS,eAAe,cAAc,EAEtDA,GAAS,iBAAiB,aAAgB,CACpCA,EAAQ,OAAO,QAAQA,EAAQ,MAAM,cAAc,CACzD,CAAC,EAED,IAAK,IAAMV,KAAS,SAAS,iBAAiB,mBAAmB,EAAG,CAClE,IAAME,EAASF,EAAM,MAAM,cAAc,sBAAsB,EAE3DE,IAAQ,EAAO,OAAS,IAC5BF,EAAM,iBAAiB,aAAgBA,EAAM,MAAM,cAAc,CAAC,CACpE"}