samagotchi 0.107.0 → 0.109.0

data/lib/samagotchi/web/public/data.js

@@ -1,9 +1,27 @@
+import { authProbe, lostAnswer } from "./auth_lost.js";
+
+// What the page does when an answer says the sign-in is gone (auth_lost.js;
+// app.js sets it). A no-op until then.
+let authLostHandler = () => {};
+export function onAuthLost(handler) {
+  authLostHandler = typeof handler === "function" ? handler : () => {};
+}
+
+// Accept: application/json: an auth proxy whose session ended answers 401
+// {} (oauth2-proxy) rather than a redirect to its sign-in. A fetch that
+// fails outright asks authProbe whether that was a sign-in redirect.
 export function api(path, opts = {}) {
   const { fetchImpl = globalThis.fetch } = opts;
   return fetchImpl(path, {
-    headers: { "Content-Type": "application/json", ...(opts.headers || {}) },
     ...opts,
+    headers: { "Content-Type": "application/json", Accept: "application/json", ...(opts.headers || {}) },
+  }).catch((error) => {
+    if (error instanceof TypeError) {
+      authProbe(fetchImpl).then((state) => { if (state === "lost") authLostHandler(`fetch ${path}`); }, () => {});
+    }
+    throw error;
   }).then(async (r) => {
+    if (lostAnswer(r)) authLostHandler(`${r.status} ${path}`);
     const j = await r.json().catch(() => ({}));
     if (!r.ok) {
       // The server's words as they are: what the page shows the user. The
@@ -279,10 +297,12 @@ export function openStream(id, fromSeq, handlers = {}, opts = {}) {
 // only when the browser gave up before the first frame (a chi web without
 // a hub answers 503, a bad ?dir 400): the caller falls back to fetching.
 // Later errors are left to EventSource's own reconnect, and a reconnect
-// always starts with a fresh snapshot.
+// always starts with a fresh snapshot, unless the browser gave up for good
+// (readyState CLOSED: an auth proxy answered the reconnect with its sign-in
+// page): onClosed then, and the caller probes and opens it again.
 // @return {{close(): void}}
 export function openEvents(handlers = {}, opts = {}) {
-  const { EventSourceImpl = globalThis.EventSource, dir, onError } = opts;
+  const { EventSourceImpl = globalThis.EventSource, dir, onError, onClosed } = opts;
   const url = dir ? `/api/events?dir=${encodeURIComponent(dir)}` : "/api/events";
   const es = new EventSourceImpl(url);
   let frameReceived = false;
@@ -290,10 +310,14 @@ export function openEvents(handlers = {}, opts = {}) {
   let live = true;
   es.onerror = () => {
     // readyState 2 (CLOSED): the browser won't retry on its own.
-    if (frameReceived || !live || es.readyState !== 2) return;
+    if (!live || es.readyState !== 2) return;
     live = false;
     try { es.close(); } catch (_) {}
-    if (typeof onError === "function") onError();
+    if (!frameReceived) {
+      if (typeof onError === "function") onError();
+    } else if (typeof onClosed === "function") {
+      onClosed();
+    }
   };
   return {
     close() {

data/lib/samagotchi/web/public/participant.js

@@ -6,9 +6,19 @@
 // progress from the stream in between. A participant's comment is
 // POST …/turn (text only); their queued ones come back with Dequeue.
 import {
-  authorColor, authorLabel, toolLine, toolsSummary, refusalText, dequeueText, endedText, streamURL, reloads, endsLiveTurn, liveFrom, applyLive,
+  authorColor, participantAuthor, authorLabel, toolLine, toolsSummary, refusalText, dequeueText, endedText, streamURL, reloads, endsLiveTurn, liveFrom, applyLive,
   liveText, withToolSteps, pickSubject, subjectBody, subjectsKey, narrowView, retryDelay, retries,
 } from "./participant_model.js";
+import { createAuthLost, lostAnswer } from "./auth_lost.js";
+import { REPLACE_SESSION_TEXT, fragmentCode, tradeFragmentCode } from "./token_fragment.js";
+
+// A link's #code= opened in a browser that already has a cookie: traded
+// first, the page reloads without it.
+// This page has a session already: the trade would replace it (a link
+// someone sent to swap this browser's session for theirs), so ask first.
+if (fragmentCode(globalThis.location?.hash)
+    && await tradeFragmentCode({ ask: () => globalThis.confirm(REPLACE_SESSION_TEXT) })) await new Promise(() => {});
+const authLost = createAuthLost();
 
 const $ = (id) => document.getElementById(id);
 const body = document.body.dataset;
@@ -47,17 +57,21 @@ function el(tag, cls, text) {
 }
 
 // A request's answer; a network failure is status 0 (the page says it
-// can't reach the session), never a throw.
+// can't reach the session), never a throw. A 401 with chi's words is the
+// link ending (revoked, expired); one without (an auth proxy's own 401 {}),
+// a redirect or an HTML answer is the sign-in ending (auth_lost.js).
 async function api(path, options = {}) {
   let res;
   try {
-    res = await fetch(path, { credentials: "same-origin", ...options });
+    res = await fetch(path, { credentials: "same-origin", ...options,
+                              headers: { Accept: "application/json", ...(options.headers || {}) } });
   } catch {
     return { status: 0, ok: false, body: null };
   }
   let json = null;
   try { json = await res.json(); } catch { json = null; }
-  if (res.status === 401) showEnded(json);
+  if (lostAnswer(res) && !(res.status === 401 && json?.error)) authLost(`${res.status} ${path}`);
+  else if (res.status === 401) showEnded(json);
   return { status: res.status, ok: res.ok, body: json };
 }
 
@@ -160,7 +174,7 @@ function render() {
   status.className = `p-status ${waiting ? "waiting" : session.status === "running" ? "running" : ""}`;
   $("people").replaceChildren(...(data.participants || []).map((p) => {
     const chip = el("span", "p-person");
-    chip.style.setProperty("--author-color", authorColor(`p:${p.id}`));
+    chip.style.setProperty("--author-color", authorColor(participantAuthor(p.id)));
     chip.append(el("span", "p-dot"), `${p.name}${p.kind === "agent" ? " (agent)" : ""}`);
     return chip;
   }));

data/lib/samagotchi/web/public/participant_model.js

@@ -3,6 +3,11 @@
 // refusal in words, the stream's URL, and the live turn as filtered events
 // build it (ParticipantView on the server decides what arrives at all).
 
+// A participant's author: "p:" and its grant id, as the server writes it
+// (Steer.author_for / PARTICIPANT_PREFIX): the one place the web spells it.
+export const PARTICIPANT_PREFIX = "p:";
+export const participantAuthor = (id) => `${PARTICIPANT_PREFIX}${id}`;
+
 // Six author colours (tokens.css --author-1..6), one per participant id,
 // the same on every page that shows them (the owner's badges too).
 export const AUTHOR_SLOTS = 6;

data/lib/samagotchi/web/public/participant_names.js

@@ -4,7 +4,7 @@
 // prompt's own author_name (a saved message, turn_started) comes first; a
 // badge drawn before the list came, with neither, says UNNAMED until
 // nameUnnamedBadges names it.
-import { authorColor } from "./participant_model.js";
+import { authorColor, participantAuthor } from "./participant_model.js";
 
 export const UNNAMED = "a participant";
 
@@ -13,7 +13,7 @@ let names = new Map();
 // @return whether the names changed (the panel then names the badges drawn
 // without them)
 export function setParticipantNames(grants) {
-  const next = new Map((grants || []).filter((g) => g?.id).map((g) => [`p:${g.id}`, String(g.name || "")]));
+  const next = new Map((grants || []).filter((g) => g?.id).map((g) => [participantAuthor(g.id), String(g.name || "")]));
   const changed = next.size !== names.size || [...next].some(([author, name]) => names.get(author) !== name);
   names = next;
   return changed;

data/lib/samagotchi/web/public/participants_panel.js

@@ -14,7 +14,7 @@
 
 import { html, nothing, render } from "./vendor/lit-html.js";
 import { createChipPopover } from "./chip_popover.js";
-import { authorColor } from "./participant_model.js";
+import { authorColor, participantAuthor } from "./participant_model.js";
 import { setParticipantNames } from "./participant_names.js";
 
 // Seen this recently: here now (the chip's dot). The gate writes
@@ -63,7 +63,7 @@ export function rowModel(grant, now) {
     kind: grant.kind,
     active,
     present,
-    color: authorColor(`p:${grant.id}`),
+    color: authorColor(participantAuthor(grant.id)),
     state: active ? (present ? "here now" : `seen ${agoText(grant.last_used_at, now)}`)
       : grant.state === "expired" ? "expired" : `revoked${grant.revoked_by ? ` (${grant.revoked_by})` : ""}`,
     expires: active ? `expires ${untilText(grant.expires_at, now)}` : "",

data/lib/samagotchi/web/public/token_fragment.js

@@ -0,0 +1,57 @@
+// A link's one-time code in its fragment (https://<public url>/#code=…&s=ID,
+// what chi web makes behind an auth proxy: never a token, since a fragment
+// outlives the sign-in redirects and stays in the browser's history). The
+// page posts it to POST /api/token, which uses it up and sets the cookie,
+// then loads itself again without it. The 401 page runs it (chi web serves
+// this file without the token); the owner's and participant's pages do on
+// load, asking first, since the trade replaces the browser's session. Plain
+// module, no imports.
+
+// {code, rest}: the fragment's code and what else it says ("s=ID"), or
+// null without one.
+export function fragmentCode(hash) {
+  const params = new URLSearchParams(String(hash || "").replace(/^#/, ""));
+  const code = params.get("code");
+  if (!code) return null;
+  params.delete("code");
+  return { code, rest: params.toString() };
+}
+
+export const REPLACE_SESSION_TEXT = "This link signs this browser in as its holder, in place of the session it has now. Open it?";
+
+// Trades the fragment's code, if there is one: the URL loses it at once
+// (history.replaceState), the page reloads once the cookie is set. ask():
+// whether to go ahead (a page that already has a session); declined, the
+// code is dropped unused. Resolves true when it reloads, false when there
+// was nothing to trade, it was declined, or the code was refused
+// (onRefused gets the server's words).
+export async function tradeFragmentCode({
+  loc = globalThis.location, hist = globalThis.history, fetchImpl = globalThis.fetch, onRefused = () => {},
+  ask = () => true,
+} = {}) {
+  const found = fragmentCode(loc?.hash);
+  if (!found) return false;
+  try {
+    hist.replaceState(null, "", `${loc.pathname}${loc.search}${found.rest ? `#${found.rest}` : ""}`);
+  } catch (_) {}
+  if (!ask()) return false;
+  let res;
+  try {
+    res = await fetchImpl("/api/token", {
+      method: "POST",
+      credentials: "same-origin",
+      headers: { "Content-Type": "application/json", Accept: "application/json" },
+      body: JSON.stringify({ code: found.code }),
+    });
+  } catch (_) {
+    onRefused("chi web can't be reached: reload to try again.");
+    return false;
+  }
+  if (res.ok) {
+    loc.reload();
+    return true;
+  }
+  const body = await res.json().catch(() => ({}));
+  onRefused(body.detail || `That link was refused (HTTP ${res.status}): it works once, and an owner's link for 10 minutes.`);
+  return false;
+}

data/lib/samagotchi/web/public_url.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+require "uri"
+require_relative "../redacted_inspect"
+
+module Samagotchi
+  module Web
+    # chi web behind an auth proxy (web.public_url, docs/configuration.md
+    # "Behind an auth proxy"): the https origin people open, the request
+    # header the proxy puts the signed-in user's email in (nil: none is
+    # trusted, the chi token alone decides) and the owner's email. Set, it
+    # turns on proxied mode (Web::ProxyGate): every request needs a token.
+    PublicUrl = Data.define(:origin, :host, :identity_header, :owner) do
+      # The Rack env key of the identity header (HTTP_X_FORWARDED_EMAIL),
+      # nil without one.
+      def identity_env = identity_header && PublicUrl.env_key(identity_header)
+
+      # Whether a Host header names the public host: any case, a trailing
+      # dot, and an explicit :443 for a 443 origin are the same host.
+      def host?(header)
+        name, port = header.to_s.downcase.match(/\A(.*?)(?::(\d+))?\z/).captures
+        name = name.delete_suffix(".")
+        port = nil if port == "443"
+        host == (port ? "#{name}:#{port}" : name)
+      end
+
+      # The header's name as people write it, or "none".
+      def identity_label = identity_header || "none"
+
+      # https://host[:port]/#code=CODE[&FRAGMENT]: a link with a one-time
+      # code (LinkCodes) in its fragment, never a token: a fragment outlives
+      # the sign-in redirects and stays in the browser's history.
+      def link(code, fragment = nil) = "#{origin}/##{["code=#{code}", fragment].compact.join("&")}"
+    end
+
+    class PublicUrl
+      class Invalid < StandardError; end
+
+      # An HTTP header name (RFC 9110 token characters chi accepts).
+      HEADER_NAME = /\A[A-Za-z0-9][A-Za-z0-9-]*\z/
+
+      # @return [PublicUrl, nil] nil when +url+ is unset
+      # @raise [Invalid] a url that isn't an https origin, a bad header name,
+      #   or an owner without an identity header to check it against
+      def self.from_config(url:, identity_header: nil, owner: nil)
+        text = url.to_s.strip
+        return nil if text.empty?
+
+        origin, host = parse_origin(text)
+        header = identity_header.to_s.strip
+        header = nil if header.empty? || header.casecmp?("none")
+        if header && !HEADER_NAME.match?(header)
+          raise Invalid, "web.proxy.identity_header must be a header name (letters, digits and -), not #{header}"
+        end
+
+        owner = owner.to_s.strip.downcase
+        owner = nil if owner.empty?
+        if owner && header.nil?
+          raise Invalid, "web.proxy.owner needs web.proxy.identity_header (the header the proxy puts #{owner} in); " \
+                         "without one only the chi token decides, so leave owner unset"
+        end
+
+        new(origin: origin, host: host, identity_header: header, owner: owner)
+      end
+
+      def self.parse_origin(text)
+        uri = URI.parse(text)
+        bare = uri.path.to_s.empty? || uri.path == "/"
+        unless uri.scheme&.downcase == "https" && uri.host && !uri.host.empty? && bare && uri.query.nil? &&
+               uri.fragment.nil? && uri.userinfo.nil?
+          raise Invalid, invalid_url(text)
+        end
+
+        name = uri.host.downcase
+        host = uri.port == 443 ? name : "#{name}:#{uri.port}"
+        ["https://#{host}", host]
+      rescue URI::InvalidURIError
+        raise Invalid, invalid_url(text)
+      end
+
+      def self.invalid_url(text) = "web.public_url must be an https origin (https://host or https://host:port), not #{text}"
+
+      # The Rack env key WEBrick makes of a header name.
+      def self.env_key(name) = "HTTP_#{name.upcase.tr("-", "_")}"
+    end
+  end
+end

data/lib/samagotchi/web/server.rb

@@ -9,6 +9,9 @@ require "webrick"
 require_relative "app"
 require_relative "info_probe"
 require_relative "lan"
+require_relative "link_codes"
+require_relative "proxy_gate"
+require_relative "public_url"
 require_relative "qr"
 require_relative "running"
 require_relative "session_hub"
@@ -58,6 +61,10 @@ module Samagotchi
       # How long `chi web` waits for a server already on its port to answer.
       PROBE_TIMEOUT = 0.3
 
+      # The raw header names next to Rack's env (ProxyGate's identity check):
+      # chi web is the only WEBrick server chi runs.
+      WEBrick::HTTPRequest.prepend(ProxyGate::RawHeaderNames) unless WEBrick::HTTPRequest < ProxyGate::RawHeaderNames
+
       # `chi web`: one server serves every project, the scope is in the page
       # URL. If a chi web already runs on the port, print (and with --open,
       # open) its page for +dir+ and leave it be; else start one.
@@ -70,6 +77,7 @@ module Samagotchi
                       editor: Config::BY_KEY["web.editor"].default, new_token: false,
                       working_set: Config::BY_KEY["web.working_set"].default)
         rotate_token if new_token
+        public_url = public_url_setting
         setting = host_setting(host)
         lan = Lan.wanted?(setting) ? Lan.choose(setting) : nil
         host = resolve_host(setting)
@@ -85,6 +93,7 @@ module Samagotchi
           end
           puts "chi web already runs on port #{port} (pid #{found["pid"]}): #{url}"
           puts running_lan_lines(found["lan"], port) if found["lan"]
+          puts running_public_lines(public_url) if public_url
           puts lan_off_line(setting) if new_token && !found["lan"]
           open_url(url) if open_browser
           0
@@ -92,20 +101,21 @@ module Samagotchi
           warn in_use_message(port)
           1
         else
-          if new_token && !lan
+          if new_token && !lan && !public_url
             puts lan_off_line(setting)
             return 0
           end
           # The participants' grants: never served from a store others can read.
           Grants.check_permissions!(Grants.path)
           if start(port: port, host: host, url: url, open_browser: open_browser, markdown: markdown, view: view,
-                   annotate_presets: annotate_presets, editor: editor, lan: lan, working_set: working_set)
+                   annotate_presets: annotate_presets, editor: editor, lan: lan, working_set: working_set,
+                   public_url: public_url)
             0
           else
             1
           end
         end
-      rescue Lan::Error, Grants::Insecure => e
+      rescue Lan::Error, Grants::Insecure, PublicUrl::Invalid => e
         warn "Error: #{e.message}"
         1
       rescue Interrupt
@@ -120,11 +130,13 @@ module Samagotchi
       # @param lan [Lan::Choice, nil] also listen on this LAN address, where
       #   every request but this machine's needs the access token
       # @param token_path [String] the LAN access token's file
+      # @param public_url [PublicUrl, nil] behind an auth proxy
+      #   (web.public_url): every request needs the access token
       # @return [Boolean] false when the port was taken (said so on stderr)
       def self.start(port: nil, host: nil, url: nil, open_browser: false, state_dir: nil, manager: nil, markdown: false,
                      view: Config::BY_KEY["web.view"].default, annotate_presets: Config::BY_KEY["web.annotate_presets"].default, hub: nil, lan: nil,
                      editor: Config::BY_KEY["web.editor"].default, token_path: Token.path,
-                     working_set: Config::BY_KEY["web.working_set"].default)
+                     working_set: Config::BY_KEY["web.working_set"].default, public_url: nil)
         config_restart_unsubscribe = ConfigFile.watch_restart_settings!(process: :web) do |message|
           Samagotchi::Log.warn(:config, "restart_required", echo: "Warning: config: #{message}")
         end
@@ -133,14 +145,18 @@ module Samagotchi
         url ||= "http://#{url_host(host)}:#{port}/"
 
         hub ||= SessionHub.new(state_dir: state_dir || Session.default_state_dir, manager: manager || SessionManager)
-        if lan
-          Token.load_or_create(token_path)
-          lan_option = { ip: lan.ip, token: Token::Source.new(token_path) }
-        end
+        Token.load_or_create(token_path) if lan || public_url
+        lan_option = { ip: lan.ip, token: Token::Source.new(token_path) } if lan
+        public_token = Token::Source.new(token_path) if public_url
         app = App.new(manager: manager, state_dir: state_dir, markdown: markdown, view: view,
-                      annotate_presets: annotate_presets, editor: editor, hub: hub, lan: lan_option, working_set: working_set)
+                      annotate_presets: annotate_presets, editor: editor, hub: hub, lan: lan_option, working_set: working_set,
+                      public_url: public_url, public_token: public_token)
         Samagotchi::Log.info(:web, "start", url: "http://#{host}:#{port}", version: Samagotchi::VERSION)
         Samagotchi::Log.info(:web, "lan", ip: lan.ip, interface: lan.interface) if lan
+        if public_url
+          Samagotchi::Log.info(:web, "public_url", origin: public_url.origin, identity_header: public_url.identity_label,
+                                                   owner: public_url.owner ? "set" : "none")
+        end
         # Subscribed before the first scan, which makes the first check.
         hub.subscribe(method(:on_hub_event))
         hub.start
@@ -151,12 +167,15 @@ module Samagotchi
           record_running(running_path, port)
           puts "Chi Web on #{url} (public: #{File.expand_path("public", __dir__)})"
           puts lan_lines(ip: lan.ip, port: port, token: Token.read(token_path), others: lan.others, public: lan.public) if lan
+          puts public_lines(public_url, token: Token.read(token_path), codes: owner_codes(state_dir)) if public_url
           puts "Press Ctrl-C to stop."
           $stdout.flush # a log file isn't line-buffered
           if open_browser
+            # With web.public_url the page opens through the proxy.
+            open_target = public_url ? public_url.link(owner_codes(state_dir).issue(kind: :owner, ttl: LinkCodes::OWNER_TTL)) : url
             Thread.new do
               sleep 0.8
-              open_url(url)
+              open_url(open_target)
             end
           end
         end
@@ -224,6 +243,47 @@ module Samagotchi
         raise LanListenError, e.message
       end
 
+      # web.public_url as Server runs it, nil when unset.
+      # @raise [PublicUrl::Invalid]
+      def self.public_url_setting
+        PublicUrl.from_config(url: Samagotchi::Config.get("web.public_url"),
+                              identity_header: Samagotchi::Config.get("web.proxy.identity_header"),
+                              owner: Samagotchi::Config.get("web.proxy.owner"))
+      end
+
+      # What web.public_url adds to the start lines: the proxied link (the
+      # token in its fragment) and who the owner is. On this machine the
+      # page opens through the proxy too; a direct request takes the token
+      # as Authorization: Bearer only (no cookie for 127.0.0.1, which every
+      # local port would get).
+      def self.public_lines(public_url, token:, codes: owner_codes)
+        unless token
+          return ["Proxied: #{public_url.origin}/ (no access token: its file is gone; chi web --new-token makes one)"]
+        end
+
+        who = if public_url.identity_header.nil? then "token only, no identity header"
+              elsif public_url.owner then "owner #{public_url.owner} by #{public_url.identity_header}, and the token"
+              else "nobody is the owner by identity: web.proxy.owner is unset"
+              end
+        code = codes.issue(kind: :owner, ttl: LinkCodes::OWNER_TTL)
+        ["Proxied: #{public_url.link(code)}   ← opens chi web as you once, within #{LinkCodes::OWNER_TTL / 60} minutes " \
+         "(chi web again prints a new one)",
+         "         (#{who}; on this machine the page opens through the proxy too)"]
+      end
+
+      # The owner's one-time link codes, next to the grants.
+      def self.owner_codes(state_dir = nil) = LinkCodes.for_grants(Grants.path(state_dir: state_dir))
+
+      # A second chi web, when this machine's config has web.public_url: the
+      # link from this config and the token file, never from what answered
+      # on the port.
+      def self.running_public_lines(public_url, token_path: Token.path, codes: owner_codes)
+        return ["Proxied: #{public_url.origin}/"] unless Token.read(token_path)
+
+        ["Proxied: #{public_url.link(codes.issue(kind: :owner, ttl: LinkCodes::OWNER_TTL))}   (once, within " \
+         "#{LinkCodes::OWNER_TTL / 60} minutes)"]
+      end
+
       def self.host_setting(host)
         (host || Samagotchi::Config.get("web.host")).to_s.strip
       end