openclacky 0.9.37 → 0.9.38

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 951665db04cf6c2a4f8ef9b5c0555f4df91b84af08f63d21097d97cbd64d44b2
-  data.tar.gz: 82457a522007f54ecd5fcc36fee8e79cf16a65996dd9b95d7a00fd0dcfbc2cac
+  metadata.gz: 43106e90c922f80d2bb342d051d68a6cb4efa045143c97b08c26bf776a952a6d
+  data.tar.gz: 1faee045587d15517d25ab68df5003c5a210db1d009b9b8363d6c27f0b53157d
 SHA512:
-  metadata.gz: 031b1031a702aca3a7cee36ea8ba23bc4982e95f8381e59d07ecb652432f6bc8a40e9a386e4a254d640f18f0088d9e18fa1f6434d92c038844f4821cef40a703
-  data.tar.gz: 5c5c36517efebb37a7a44d0531e0baadedb8600319682c39696a971771852019f2649386e15a3505d9ae32e86cf8c5818c64cf36943247220a7db6e0df24e994
+  metadata.gz: 8e696b00d7e79c968851c1f5a194fe352d8d9f7971ca37f56321705dd83ec8a71a3cae1836468df94b3877d5ac6a25cf31c991f30e10d0997ec0a6b06b2c9825
+  data.tar.gz: 92628aced329eb6e7c9567034873a276a15a64692e3796cf995cfbe1303132d6720fc69115332ab69371d07e5f4963377c80a5bad568797619c58ecc48fca04c

data/lib/clacky/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Clacky
-  VERSION = "0.9.37"
+  VERSION = "0.9.38"
 end

data/lib/clacky/web/auth.js

@@ -1,101 +1,150 @@
-// ── auth.js — Access key authentication guard ──────────────────────────────
-//
-// Responsibilities:
-// - Prompt user for access key when server requires one
-// - Cache key in localStorage; pass via Authorization header
-// - Block app boot until auth passes
-// ─────────────────────────────────────────────────────────────────────────
 const Auth = (() => {
-  let _authCheckPromise = null;
-  let _authPassed = false;
+  // ── Constants ──────────────────────────────────────────────────────────
+  const COOKIE_NAME      = 'clacky_access_key';
+  const STORAGE_KEY      = 'clacky_access_key';
+  const PROBE_ENDPOINT   = '/api/sessions?limit=1';
+  const MAX_PROMPT_TRIES = 3;
 
-  async function check() {
-    if (_authCheckPromise) return _authCheckPromise;
-    _authCheckPromise = _doCheck();
-    return _authCheckPromise;
-  }
+  const PROBE = Object.freeze({
+    OK:           'ok',
+    UNAUTHORIZED: 'unauthorized',
+    SERVER_ERR:   'server_error',
+    NETWORK_ERR:  'network_error',
+  });
 
-  async function _doCheck() {
-    const key = _getStoredKey();
-
-    // Always probe first — server may not require auth at all (e.g. localhost).
-    try {
-      const r = await fetch('/api/sessions?limit=1', {
-        headers: key ? { 'Authorization': `Bearer ${key}` } : {}
-      });
+  // ── Module state ───────────────────────────────────────────────────────
+  let _authCheckPromise = null;
+  let _authPassed       = false;
 
-      if (r.ok) {
-        _authPassed = true;
-        return true;
-      }
+  // ── Storage helpers ────────────────────────────────────────────────────
+  const Cookie = {
+    set(key) {
+      const secure = location.protocol === 'https:' ? '; Secure' : '';
+      document.cookie =
+        `${COOKIE_NAME}=${encodeURIComponent(key)}; path=/; SameSite=Strict${secure}`;
+    },
+    clear() {
+      document.cookie =
+        `${COOKIE_NAME}=; path=/; max-age=0; SameSite=Strict`;
+    },
+  };
 
-      if (r.status === 401) {
-        // Server requires auth — prompt for key.
-        localStorage.removeItem('clacky_access_key');
-        return await _promptAndRetry();
-      }
+  function _getStoredKey() {
+    return (
+      localStorage.getItem(STORAGE_KEY) ||
+      new URLSearchParams(location.search).get('access_key') ||
+      null
+    );
+  }
 
-      // Other errors (5xx etc.) — let the app proceed.
-      _authPassed = true;
-      return true;
+  // ── Auth probe ─────────────────────────────────────────────────────────
+  async function _probe() {
+    try {
+      const r = await fetch(PROBE_ENDPOINT);
+      if (r.ok)             return PROBE.OK;
+      if (r.status === 401) return PROBE.UNAUTHORIZED;
+      return PROBE.SERVER_ERR;
     } catch {
-      // Network error — let the app proceed.
-      _authPassed = true;
-      return true;
+      return PROBE.NETWORK_ERR;
     }
   }
 
-  async function _promptAndRetry() {
+  // ── Prompt helper ──────────────────────────────────────────────────────
+  async function _askUserForKey() {
     const message = (typeof I18n !== 'undefined')
       ? I18n.t('auth.accessKeyRequired')
       : 'Access key required:';
 
-    const inputKey = (typeof Modal !== 'undefined' && Modal.prompt)
-      ? await Modal.prompt(message)
-      : prompt(message);
+    const el = document.getElementById('prompt-modal-input');
+    if (el) el.type = 'password';
 
-    if (!inputKey || !inputKey.trim()) {
-      _authPassed = false;
-      return false;
+    try {
+      const input = (typeof Modal !== 'undefined' && Modal.prompt)
+        ? await Modal.prompt(message)
+        : prompt(message);
+      return input?.trim() || null;
+    } finally {
+      if (el) el.type = 'text';
     }
+  }
 
-    const trimmed = inputKey.trim();
-    localStorage.setItem('clacky_access_key', trimmed);
+  // ── Core flow ──────────────────────────────────────────────────────────
+  async function _doCheck() {
+    const existing = _getStoredKey();
+    if (existing) Cookie.set(existing);       // seed cookie before probe
 
-    // Validate the newly entered key without reloading.
-    try {
-      const r = await fetch('/api/sessions?limit=1', {
-        headers: { 'Authorization': `Bearer ${trimmed}` }
-      });
-      if (r.ok) {
-        _authPassed = true;
-        return true;
-      }
-      // Still wrong — clear storage and restart the auth flow.
-      localStorage.removeItem('clacky_access_key');
-      _authCheckPromise = null;
-      return check();
-    } catch {
+    const result = await _probe();
+
+    if (result === PROBE.OK) {
       _authPassed = true;
       return true;
     }
+
+    if (result === PROBE.UNAUTHORIZED) {
+      Cookie.clear();
+      localStorage.removeItem(STORAGE_KEY);
+      return _promptAndRetry();
+    }
+
+    // Server/network error — let app proceed
+    _authPassed = true;
+    return true;
   }
 
-  function _getStoredKey() {
-    return localStorage.getItem('clacky_access_key') ||
-      new URLSearchParams(location.search).get('access_key') || null;
+  async function _promptAndRetry() {
+    for (let attempt = 1; attempt <= MAX_PROMPT_TRIES; attempt++) {
+      const key = await _askUserForKey();
+      if (!key) {
+        _authPassed = false;
+        return false;
+      }
+
+      Cookie.set(key);
+      const result = await _probe();
+
+      if (result === PROBE.OK) {
+        localStorage.setItem(STORAGE_KEY, key);   // persist only after success
+        _authPassed = true;
+        return true;
+      }
+
+      if (result !== PROBE.UNAUTHORIZED) {
+        _authPassed = true;                        // transient — proceed
+        return true;
+      }
+
+      Cookie.clear();                              // wrong key → try again
+    }
+
+    _authPassed = false;
+    return false;
   }
 
-  function getHeaders() {
-    const key = _getStoredKey();
-    return key ? { 'Authorization': `Bearer ${key}` } : {};
+  // ── Public API (compatible with the original ws.js/app.js usage) ───────
+  function check() {
+    if (!_authCheckPromise) _authCheckPromise = _doCheck();
+    return _authCheckPromise;
   }
 
   return {
     check,
-    getHeaders,
+
+    // Returns an Authorization header object, or {} if no key present.
+    getHeaders() {
+      const k = _getStoredKey();
+      return k ? { Authorization: `Bearer ${k}` } : {};
+    },
+
+    // Returns the raw key (or null). Used by ws.js for WebSocket URLs.
     getKey: _getStoredKey,
-    reset() { _authCheckPromise = null; },
-    get passed() { return _authPassed; }
+
+    // Clears auth state so check() will re-probe on next call.
+    reset() {
+      _authCheckPromise = null;
+      _authPassed       = false;
+    },
+
+    // Read-only getter: `Auth.passed` (not a function call).
+    get passed() { return _authPassed; },
   };
 })();

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: openclacky
 version: !ruby/object:Gem::Version
-  version: 0.9.37
+  version: 0.9.38
 platform: ruby
 authors:
 - windy