samagotchi 0.108.0 → 0.109.0

data/lib/samagotchi/web/app.rb

@@ -59,6 +59,7 @@ require_relative "principal"
 require_relative "participant_access"
 require_relative "participants_admin"
 require_relative "participant_review"
+require_relative "proxy_gate"
 require_relative "../log"
 require_relative "../paths"
 require_relative "../redacted_inspect"
@@ -79,6 +80,7 @@ module Samagotchi
       include ParticipantAccess
       include ParticipantsAdmin
       include ParticipantReview
+      include ProxyGate
 
       DEFAULT_HOST = BridgeClient::HOST
       BRIDGE_WAIT_TIMEOUT = 10.0
@@ -141,6 +143,10 @@ module Samagotchi
       #   loopback only, no token
       # @param grants [Grants, nil] the participants' grants (default: the
       #   store next to +state_dir+, Grants.path)
+      # @param public_url [PublicUrl, nil] behind an auth proxy
+      #   (web.public_url, ProxyGate): every request needs a token
+      # @param public_token [String, Token::Source, nil] the access token
+      #   with +public_url+ (the LAN one when both are set)
       def initialize(manager: nil, session_class: nil, state_dir: nil, public_dir: nil,
                      bridge_wait_timeout: BRIDGE_WAIT_TIMEOUT, markdown: false, view: Config::BY_KEY["web.view"].default, hub: nil,
                      annotate_presets: Config::BY_KEY["web.annotate_presets"].default,
@@ -148,7 +154,7 @@ module Samagotchi
                      events_heartbeat: EVENTS_HEARTBEAT, events_queue: EVENTS_QUEUE,
                      registry: nil, models_wait_timeout: MODELS_WAIT_TIMEOUT, lan: nil,
                      working_set: Config::BY_KEY["web.working_set"].default, wait_poll_interval: ReplyWait::POLL_INTERVAL,
-                     grants: nil)
+                     grants: nil, public_url: nil, public_token: nil)
         @manager = manager || SessionManager
         @registry = registry
         @registry_given = !registry.nil?
@@ -173,17 +179,36 @@ module Samagotchi
         @refused_logged = {}
         @wait_poll_interval = wait_poll_interval
         init_participant_access(grants, state_dir)
+        init_proxy_gate(public_url, public_token)
       end
 
       def call(env)
         started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-        response = route(env)
+        response = unframed(route(env))
         log_request(env, response, started)
         response
       end
 
       private
 
+      # No page of chi web's may be framed by another (clickjacking): every
+      # HTML answer says so. The page's full CSP is a later change.
+      FRAME_HEADERS = { "X-Frame-Options" => "DENY", "Content-Security-Policy" => "frame-ancestors 'none'" }.freeze
+      FRAME_DESTS = %w[iframe frame embed object].freeze
+
+      def unframed(response)
+        status, headers, body = response
+        return response unless headers["Content-Type"].to_s.start_with?("text/html")
+
+        [status, headers.merge(FRAME_HEADERS), body]
+      end
+
+      # A frame/embed/object load from anything but the page's own origin.
+      def framed?(env)
+        FRAME_DESTS.include?(env["HTTP_SEC_FETCH_DEST"].to_s.downcase) &&
+          env["HTTP_SEC_FETCH_SITE"].to_s.downcase != "same-origin"
+      end
+
       # The routes, first match wins: a handler takes the request and the
       # path's captures (the session id, an image's name). The fourth column
       # is who may use the route (ROUTE_PERMISSIONS, checked against the
@@ -200,6 +225,7 @@ module Samagotchi
         ["GET", %r{\A/api/sessions/resolve\z}, :handle_resolve, :participant],
         ["GET", %r{\A/api/sessions/summaries\z}, :handle_summaries, :owner],
         ["GET", %r{\A/api/info\z}, :handle_info, :participant],
+        ["POST", %r{\A/api/token\z}, :handle_token, :participant],
         ["GET", %r{\A/api/models\z}, :handle_models, :owner],
         ["GET", %r{\A/api/history\z}, :handle_history, :owner],
         ["GET", %r{\A/api/events\z}, :handle_events, :owner],
@@ -251,6 +277,10 @@ module Samagotchi
         req = Rack::Request.new(env)
         return forbidden unless local_host_header?(env)
         return cross_origin if cross_site?(env)
+        return error_response(403, "framed", "chi web's pages can't be framed by another page") if framed?(env)
+        # The fragment trade's script, which the 401 page loads: no secret in it.
+        return serve_static(req) if req.get? && GATE_FREE_PATHS.include?(req.path_info)
+        return probe_info if probe_info?(req)
 
         principal, denied = token_gate(req)
         return denied if denied
@@ -328,8 +358,11 @@ module Samagotchi
       # A viewer on this machine, whose editor can open the session's
       # paths: a loopback peer, or this Mac on its own LAN address (the LAN
       # URL or its QR code opened here). The phone isn't. An SSH tunnel or
-      # a local reverse proxy looks like loopback too (a known gap).
+      # a local reverse proxy looks like loopback too (a known gap), unless
+      # it leaves a trace and web.public_url is set (#proxied?).
       def local_viewer?(req)
+        return false if proxied?(req)
+
         peer = req.get_header("REMOTE_ADDR").to_s
         LOOPBACK_PEERS.include?(peer) || (!@lan.nil? && peer == @lan[:ip])
       end
@@ -342,10 +375,12 @@ module Samagotchi
       # check stops DNS-rebinding pages. It reads the raw Host header:
       # Rack's req.host trusts X-Forwarded-Host, which such a page could
       # set. A request with no Host (HTTP/1.0) is answered only for a
-      # loopback peer.
+      # loopback peer. With web.public_url its host (with its port, exactly)
+      # is answered too.
       def local_host_header?(env)
         host = env["HTTP_HOST"].to_s
         return LOOPBACK_PEERS.include?(env["REMOTE_ADDR"].to_s) if host.empty?
+        return true if @public_url&.host?(host)
 
         name = host.downcase.sub(/:\d*\z/, "")
         LOOPBACK_NAMES.include?(name) || (!@lan.nil? && name == @lan[:ip])
@@ -359,10 +394,17 @@ module Samagotchi
       # the cross-site check already refuses what Strict would add.
       TOKEN_COOKIE_ATTRIBUTES = "HttpOnly; SameSite=Lax; Path=/; Max-Age=34560000"
       REFUSED_LOG_INTERVAL = 60.0
+      REFUSED_LOG_KEYS = 256
 
       # Where #route keeps the request's Principal for its handlers.
       PRINCIPAL_ENV = "samagotchi.principal"
       PAGE_PATHS = ["/", "/index.html"].freeze
+      # POST {code} or {token}: the page trades a link's one-time code (its
+      # #code= fragment, token_fragment.js) or a pasted token (the 401 page's
+      # form) for the cookie.
+      TOKEN_TRADE_PATH = "/api/token"
+      TRADE_BODY_LIMIT = 4096
+      GATE_FREE_PATHS = ["/token_fragment.js"].freeze
 
       # The request's Principal, as #route resolved it.
       def principal(req) = req.env.fetch(PRINCIPAL_ENV)
@@ -378,9 +420,16 @@ module Samagotchi
       def token_gate(req)
         principal = principal_for(req)
         return [nil, refused_token(req)] if principal.nil?
+
         # The cookie gets the token that was presented: the owner's, or the
         # participant's grant's.
-        return [nil, token_redirect(req, req.env[GRANT_TOKEN_ENV] || current_token)] if token_trade?(req)
+        if token_trade?(req)
+          token = req.env[GRANT_TOKEN_ENV] || current_token
+          return [nil, token_redirect(req, token)] unless fragment_trade?(req)
+          return [nil, form_trade_redirect(req, token)] if form_post?(req)
+
+          return [nil, token_cookie_response(req, token)]
+        end
 
         [principal, nil]
       end
@@ -394,9 +443,12 @@ module Samagotchi
       # machine's loopback), else nil. An ended or unknown grant's token is
       # nil anywhere: it never falls back to the owner.
       # @return [Principal, nil]
+      # With web.public_url (ProxyGate) every request needs a token, and a
+      # proxied one is #proxied_principal's.
       def principal_for(req)
         given = presented_tokens(req)
-        return Principal::OWNER if @lan && given.any? { |value| token_match?(value, current_token) }
+        return proxied_principal(req, given) if proxied?(req)
+        return Principal::OWNER if (@lan || @public_url) && owner_token?(given)
 
         grant_tokens = given.select { |value| Grants.token?(value) }
         return Principal::OWNER if grant_tokens.empty? && !token_required?(req)
@@ -404,19 +456,93 @@ module Samagotchi
         participant_principal(req, grant_tokens)
       end
 
+      # With web.public_url a request from this machine that didn't come
+      # through the proxy (curl, chi's own callers) presents the Bearer
+      # header only: no cookie, and no trade that would set one. A cookie for
+      # 127.0.0.1 goes to every server on any of its ports. A LAN peer
+      # (web.host lan) keeps the LAN's token link and cookie.
       def presented_tokens(req)
-        token_trade?(req) ? [req.params["token"]] : [bearer_token(req), req.cookies[TOKEN_COOKIE]]
+        return [traded_token(req)] if token_trade?(req)
+        return [bearer_token(req)] if direct_public?(req)
+
+        [bearer_token(req), req.cookies[token_cookie_name(req)]]
+      end
+
+      def direct_public?(req)
+        !@public_url.nil? && LOOPBACK_PEERS.include?(req.get_header("REMOTE_ADDR").to_s) && !proxied?(req)
+      end
+
+      # The token a trade presents: the page's ?token=, or POST /api/token's
+      # body's (read once): its token, or the token a one-time link code
+      # stands for (LinkCodes#redeem: used up here, whatever the gate says).
+      def traded_token(req)
+        return req.params["token"] unless fragment_trade?(req)
+
+        req.env.fetch(TRADED_TOKEN_ENV) do
+          raw = request_body(req, TRADE_BODY_LIMIT).to_s
+          value = if raw.bytesize >= TRADE_BODY_LIMIT then nil
+                  elsif form_post?(req) then Rack::Utils.parse_query(raw)
+                  else parse_json(raw)
+                  end
+          value = {} unless value.is_a?(Hash)
+          req.env[TRADED_TOKEN_ENV] = value.key?("code") ? code_token(value["code"]) : string_or_nil(value["token"])
+        end
+      end
+
+      def string_or_nil(value) = value.is_a?(String) ? value : nil
+
+      def code_token(code)
+        kind, token = @link_codes.redeem(code)
+        kind == :owner ? current_token : token
+      end
+
+      TRADED_TOKEN_ENV = "samagotchi.traded_token"
+
+      def fragment_trade?(req) = req.post? && req.path_info == TOKEN_TRADE_PATH
+
+      # The 401 page's paste box, posted as a form (no script needed).
+      def form_post?(req) = req.media_type == "application/x-www-form-urlencoded"
+
+      def owner_token?(given) = given.any? { |value| token_match?(value, current_token) }
+
+      # The cookie a request's token rides in, its name and attributes per
+      # request: a proxied request's is ProxyGate::SECURE_COOKIE, Secure (the
+      # public URL is https). A browser may hold both.
+      def token_cookie_name(req) = proxied?(req) ? SECURE_COOKIE : TOKEN_COOKIE
+
+      def token_cookie_attributes(req)
+        proxied?(req) ? "Secure; #{TOKEN_COOKIE_ATTRIBUTES}" : TOKEN_COOKIE_ATTRIBUTES
+      end
+
+      def token_cookie(req, value)
+        "#{token_cookie_name(req)}=#{value}; #{token_cookie_attributes(req)}"
       end
 
-      def token_required?(req) = @lan && !LOOPBACK_PEERS.include?(req.get_header("REMOTE_ADDR").to_s)
+      def cleared_token_cookie(req)
+        "#{token_cookie_name(req)}=; #{token_cookie_attributes(req).sub(/Max-Age=\d+/, "Max-Age=0")}"
+      end
+
+      def token_required?(req)
+        return true if @public_url
+
+        @lan && !LOOPBACK_PEERS.include?(req.get_header("REMOTE_ADDR").to_s)
+      end
 
       # The page opened with ?token= (a gated request, or a grant's token
       # anywhere): its token is traded for the cookie, whatever else the
       # request carries.
+      # POST /api/token is the same trade for a token the page found in its
+      # URL's fragment.
       def token_trade?(req)
-        return false unless req.get? && PAGE_PATHS.include?(req.path_info) && req.params.key?("token")
+        return false if direct_public?(req)
+
+        # Through the proxy no GET trade (a ?token= rides the sign-in
+        # redirect, and a crafted link would swap the owner's cookie): a
+        # link's #code= and the 401 page's POST do it.
+        page = req.get? && PAGE_PATHS.include?(req.path_info) && req.params.key?("token") && !(@public_url && proxied?(req))
+        return false unless page || fragment_trade?(req)
 
-        token_required?(req) || Grants.token?(req.params["token"])
+        token_required?(req) || Grants.token?(traded_token(req))
       end
 
       # The 401 for a request #principal_for refused: an ended grant's, else
@@ -425,17 +551,16 @@ module Samagotchi
       # owner's, who opened a participant link) is the owner's again.
       def refused_token(req)
         response = grant_ended_response(req) || unauthorized(req)
-        return response if token_required?(req) || !Grants.token?(req.cookies[TOKEN_COOKIE])
+        return response if token_required?(req) || !Grants.token?(req.cookies[token_cookie_name(req)])
 
         status, headers, body = response
-        [status, headers.merge("Set-Cookie" => "#{TOKEN_COOKIE}=; #{TOKEN_COOKIE_ATTRIBUTES.sub(/Max-Age=\d+/, "Max-Age=0")}"),
-         body]
+        [status, headers.merge("Set-Cookie" => cleared_token_cookie(req)), body]
       end
 
       def bearer_token(req) = req.get_header("HTTP_AUTHORIZATION").to_s[/\ABearer +(\S+)\z/, 1]
 
       def current_token
-        token = @lan[:token]
+        token = @lan ? @lan[:token] : @public_token
         token.respond_to?(:current) ? token.current : token
       end
 
@@ -446,32 +571,87 @@ module Samagotchi
       end
 
       # The same page (and its other parameters, as they were written), the
-      # token traded for the cookie.
+      # token traded for the cookie. Proxied, the Location is absolute from
+      # web.public_url: WEBrick would make a relative one absolute from the
+      # first X-Forwarded-Host/-Proto, which a client sets through
+      # oauth2-proxy (an open redirect).
       def token_redirect(req, token)
         query = req.query_string.split("&").reject { |pair| pair.split("=", 2).first == "token" }.join("&")
         location = query.empty? ? req.path_info : "#{req.path_info}?#{query}"
-        [303, { "Location" => location, "Set-Cookie" => "#{TOKEN_COOKIE}=#{token}; #{TOKEN_COOKIE_ATTRIBUTES}",
+        location = "#{@public_url.origin}#{location}" if proxied?(req)
+        [303, { "Location" => location, "Set-Cookie" => token_cookie(req, token),
                 "Cache-Control" => "no-store", "Content-Length" => "0" }, []]
       end
 
+      # The paste box's trade: the cookie and a 303 to the page (absolute
+      # from web.public_url when proxied, as #token_redirect).
+      def form_trade_redirect(req, token)
+        location = proxied?(req) ? "#{@public_url.origin}/" : "/"
+        [303, { "Location" => location, "Set-Cookie" => token_cookie(req, token), "Cache-Control" => "no-store",
+                "Content-Length" => "0" }, []]
+      end
+
+      # The fragment trade's answer: the cookie, no body.
+      def token_cookie_response(req, token)
+        [204, { "Set-Cookie" => token_cookie(req, token), "Cache-Control" => "no-store" }, []]
+      end
+
+      # POST /api/token past the gate without a trade (nothing to trade here:
+      # no token is asked of this request): nothing to do.
+      def handle_token(_req) = [204, { "Cache-Control" => "no-store" }, []]
+
       def unauthorized(req)
-        log_refused(req.get_header("REMOTE_ADDR").to_s, req.path_info)
-        return error_response(401, "unauthorized", "chi web on the LAN needs its access token") if req.path_info.start_with?("/api/")
+        reason = req.env[REFUSED_ENV]
+        log_refused(refused_peer(req), req.path_info, reason)
+        return error_response(401, "unauthorized", unauthorized_detail(req, reason)) if req.path_info.start_with?("/api/")
 
-        body = UNAUTHORIZED_PAGE
+        body = @public_url ? PUBLIC_UNAUTHORIZED_PAGE : UNAUTHORIZED_PAGE
         [401, { "Content-Type" => "text/html; charset=utf-8", "Content-Length" => body.bytesize.to_s, "Cache-Control" => "no-store" },
          [body]]
       end
 
+      def unauthorized_detail(req, reason)
+        return "chi web behind the proxy: #{reason || "needs its access token"}" if proxied?(req)
+        return "chi web with web.public_url needs its access token, on this machine too" if @public_url
+
+        "chi web on the LAN needs its access token"
+      end
+
+      # Who a refusal is logged as: the peer, or behind a proxy (every peer
+      # 127.0.0.1) the client: its identity, else the X-Forwarded-For hop the
+      # proxy appended (the last one).
+      def refused_peer(req)
+        return req.get_header("REMOTE_ADDR").to_s unless proxied?(req)
+
+        identity = @public_url.identity_env && req.env[@public_url.identity_env]
+        hop = req.get_header("HTTP_X_FORWARDED_FOR").to_s.split(",").last.to_s.strip
+        "proxy:#{[identity.to_s.strip, hop].find { |v| !v.empty? } || "?"}"[0, 200]
+      end
+
       # At most once a minute per peer: a phone with an old link retries.
-      def log_refused(peer, path)
+      # At most REFUSED_LOG_KEYS peers a minute (rotating headers can't
+      # fill the log).
+      def log_refused(peer, path, reason = nil)
         now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
         due = @refused_mutex.synchronize do
           @refused_logged.delete_if { |_, at| now - at >= REFUSED_LOG_INTERVAL } if @refused_logged.size > 64
+          next false if @refused_logged.size >= REFUSED_LOG_KEYS && !@refused_logged.key?(peer)
+
           last = @refused_logged[peer]
           (last.nil? || now - last >= REFUSED_LOG_INTERVAL).tap { |fresh| @refused_logged[peer] = now if fresh }
         end
-        Log.warn(:web, "unauthorized", peer: peer, path: path) if due
+        Log.warn(:web, "unauthorized", peer: peer, path: path, **(reason ? { reason: reason } : {})) if due
+      end
+
+      # Behind a proxy (web.public_url) the paste box posts the token in the
+      # body (POST /api/token): a GET would put it in the URL, the proxy's
+      # access log and the history. On this machine the page opens through
+      # the proxy too.
+      def self.public_unauthorized_page(page)
+        page.sub('<form method="get" action="/">', '<form method="post" action="/api/token">')
+            .sub("Open the link chi web printed in its terminal (LAN, or Proxied behind an\nauth proxy), or scan its QR code.",
+                 "Open the Proxied link chi web printed in its terminal (it works once; chi web again prints a new " \
+                 "one), or paste the token from its web-token file.")
       end
 
       # What a phone sees without the token. The field is for a home-screen
@@ -489,14 +669,26 @@ module Samagotchi
         </style></head>
         <body>
         <h1>chi web</h1>
-        <p>This page needs chi web's access token. Open the LAN link chi web printed in its terminal, or scan its QR code.</p>
+        <p>This page needs chi web's access token. Open the link chi web printed in its terminal (LAN, or Proxied behind an
+        auth proxy), or scan its QR code.</p>
+        <p id="trade" hidden></p>
         <form method="get" action="/">
           <label for="token">Or paste the token:</label>
           <input id="token" name="token" autocomplete="off" autocapitalize="off" spellcheck="false">
           <button type="submit">Open</button>
         </form>
+        <script type="module">
+          import { tradeFragmentCode } from "/token_fragment.js";
+          tradeFragmentCode({ onRefused: (words) => {
+            const line = document.getElementById("trade");
+            line.textContent = words;
+            line.hidden = false;
+          } });
+        </script>
         </body></html>
       HTML
+      PUBLIC_UNAUTHORIZED_PAGE = public_unauthorized_page(UNAUTHORIZED_PAGE).freeze
+      private_class_method :public_unauthorized_page
 
       # Another website's page in the desktop browser can send "simple"
       # requests here (a text/plain POST needs no preflight) and would start
@@ -510,18 +702,30 @@ module Samagotchi
       def cross_site?(env)
         foreign = %w[cross-site same-site].include?(env["HTTP_SEC_FETCH_SITE"].to_s.downcase)
         origin = env["HTTP_ORIGIN"]
-        foreign ||= !origin.nil? && origin.downcase != "http://#{env["HTTP_HOST"].to_s.downcase}"
+        foreign ||= !origin.nil? && !same_origin?(env, origin.downcase)
         return false unless foreign
 
         !%w[GET HEAD].include?(env["REQUEST_METHOD"]) || env["PATH_INFO"].to_s.start_with?("/api/")
       end
 
+      # The page's own origin: through the proxy only web.public_url's
+      # (https), else http://<Host> (or the public origin).
+      def same_origin?(env, origin)
+        return origin == @public_url.origin if @public_url && proxied?(Rack::Request.new(env))
+
+        origin == "http://#{env["HTTP_HOST"].to_s.downcase}" || public_origin?(origin)
+      end
+
+      # The page served through web.public_url (Origin https://<public host>).
+      def public_origin?(origin) = !@public_url.nil? && origin.downcase == @public_url.origin
+
       def cross_origin
         error_response(403, "cross_origin", "requests from other websites are refused")
       end
 
       def forbidden
-        names = @lan ? "127.0.0.1, [::1], localhost and #{@lan[:ip]}" : "127.0.0.1, [::1] and localhost"
+        names = ["127.0.0.1", "[::1]", "localhost", @lan && @lan[:ip], @public_url&.host].compact
+        names = "#{names[0..-2].join(", ")} and #{names.last}"
         error_response(403, "forbidden", "only the host names #{names} are answered")
       end
 
@@ -576,8 +780,9 @@ module Samagotchi
       # session_commands: the routes chi --remote needs
       # (SessionAccessRoutes::FEATURE); remote_attach: the ones a remote
       # attached TUI needs (ATTACH_FEATURE). lan: its LAN address, nil when it
-      # listens on loopback only. A participant gets app, version and
-      # features only (#participant_info).
+      # listens on loopback only; public_url: web.public_url's origin, nil
+      # without one. A participant gets app, version and features only
+      # (#participant_info).
       def handle_info(req)
         return participant_info unless principal(req).owner?
 

data/lib/samagotchi/web/grants.rb

@@ -91,8 +91,10 @@ module Samagotchi
       # grant from before them, which takes the config's (#spend_cap,
       # #queue_limit).
       Grant = Data.define(:id, :session_id, :digest, :kind, :name, :role, :created_at, :expires_at, :revoked_at,
-                          :revoked_by, :last_used_at, :cap, :queue) do
-        def initialize(cap: nil, queue: nil, **) = super
+                          :revoked_by, :last_used_at, :cap, :queue, :identity) do
+        # identity: the proxy identity (an email, lower case) the grant is
+        # bound to, nil for any (ProxyGate; issued from shared-sessions P6).
+        def initialize(cap: nil, queue: nil, identity: nil, **) = super
 
         def self.from_h(hash)
           new(**members.to_h { |key| [key, hash[key.to_s]] })
@@ -132,7 +134,8 @@ module Samagotchi
             state: state(now).to_s, cap: spend_cap, queue: queue_limit }
         end
 
-        def to_store = to_h.transform_keys(&:to_s)
+        # A grant bound to no identity is stored as before identity existed.
+        def to_store = to_h.transform_keys(&:to_s).tap { |hash| hash.delete("identity") if identity.nil? }
 
         def inspect = "#<Grant #{id} #{session_id[0, 8]} #{name.inspect}>"
         alias_method :to_s, :inspect

data/lib/samagotchi/web/info_probe.rb

@@ -6,7 +6,11 @@ require "net/http"
 module Samagotchi
   module Web
     # What answers GET /api/info on host:port: the one probe for a running
-    # chi web (chi web's own port check, chi update, chi self).
+    # chi web (chi web's own port check, chi share's port, chi update, chi
+    # self). It never sends a token: whatever listens on the port may not be
+    # chi web (another user's process on a shared host). A chi web behind a
+    # proxy answers it without one (ProxyGate#probe_info). Nothing it
+    # answers is trusted for a link.
     module InfoProbe
       module_function
 

data/lib/samagotchi/web/link_codes.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+
+require "digest"
+require "fileutils"
+require "json"
+require "openssl"
+require "securerandom"
+require "time"
+require_relative "../atomic_file"
+
+module Samagotchi
+  module Web
+    # One-time link codes (web.public_url): what a link's fragment carries
+    # instead of a token (https://<public url>/#code=chc_…). A fragment
+    # outlives the proxy's sign-in redirects, so the sign-in page sits at
+    # that URL (its scripts can read it) and it lands in the browser's
+    # history: a code works once, then nothing. The page trades it at
+    # POST /api/token for the token's cookie.
+    #
+    # A code is the owner's (10 minutes) or a grant's (until the grant
+    # expires). Nothing secret is kept: the store has each code's digest,
+    # and a grant's token sealed (AES-256-GCM) under a key derived from the
+    # code itself, so only the code's holder can open it. The store is
+    # next to the grants (web-grants/link-codes.json, 0600 in that 0700
+    # folder), written under a lock: chi web and a local chi share both
+    # issue codes.
+    class LinkCodes
+      FILE = "link-codes.json"
+      LOCK = "link-codes.lock"
+      PREFIX = "chc_"
+      OWNER_TTL = 600
+      CODE_RE = /\Achc_[A-Za-z0-9_-]{43}\z/
+
+      # @param grants_path [String] the grants store's path (Grants#path)
+      def self.for_grants(grants_path, clock: -> { Time.now }) = new(File.join(File.dirname(grants_path), FILE), clock: clock)
+
+      def self.code?(value) = value.is_a?(String) && CODE_RE.match?(value)
+
+      attr_reader :path
+
+      def initialize(path, clock: -> { Time.now })
+        @path = path
+        @clock = clock
+      end
+
+      # @param kind [:owner, :grant]
+      # @param token [String, nil] the grant's token (sealed), nil for the owner
+      # @param ttl [Numeric] seconds
+      # @return [String] the code
+      def issue(kind:, ttl:, token: nil)
+        code = "#{PREFIX}#{SecureRandom.urlsafe_base64(32)}"
+        entry = { "digest" => digest(code), "kind" => kind.to_s, "expires_at" => (@clock.call + ttl).utc.iso8601 }
+        entry["sealed"] = seal(code, token) if token
+        update { |entries| entries << entry }
+        code
+      end
+
+      # The code's [kind, token] (token nil for the owner's), once: the code
+      # is gone after. nil for an unknown, used or expired code.
+      def redeem(code)
+        return nil unless LinkCodes.code?(code)
+
+        wanted = digest(code)
+        found = nil
+        update do |entries|
+          entries.reject do |entry|
+            next false unless same_digest?(entry["digest"].to_s, wanted)
+
+            found = entry
+            true
+          end
+        end
+        return nil unless found
+        return nil if Time.iso8601(found["expires_at"]) <= @clock.call
+
+        kind = found["kind"] == "grant" ? :grant : :owner
+        token = found["sealed"] && unseal(code, found["sealed"])
+        return nil if kind == :grant && token.nil?
+
+        [kind, token]
+      rescue ArgumentError
+        nil
+      end
+
+      private
+
+      def digest(code) = Digest::SHA256.hexdigest(code)
+
+      def same_digest?(left, right) = left.bytesize == right.bytesize && OpenSSL.fixed_length_secure_compare(left, right)
+
+      def key(code) = OpenSSL::KDF.hkdf(code, salt: "chi-link-code", info: "seal", length: 32, hash: "SHA256")
+
+      def seal(code, token)
+        cipher = OpenSSL::Cipher.new("aes-256-gcm").encrypt
+        cipher.key = key(code)
+        iv = cipher.random_iv
+        cipher.auth_data = ""
+        sealed = cipher.update(token) + cipher.final
+        [iv + cipher.auth_tag + sealed].pack("m0")
+      end
+
+      def unseal(code, value)
+        raw = value.unpack1("m0")
+        cipher = OpenSSL::Cipher.new("aes-256-gcm").decrypt
+        cipher.key = key(code)
+        cipher.iv = raw[0, 12]
+        cipher.auth_tag = raw[12, 16]
+        cipher.auth_data = ""
+        cipher.update(raw[28..]) + cipher.final
+      rescue OpenSSL::Cipher::CipherError, ArgumentError
+        nil
+      end
+
+      # Read, change and write under the lock; expired codes go. The block
+      # gets the live codes and returns the codes to keep.
+      def update
+        dir = File.dirname(@path)
+        FileUtils.mkdir_p(dir, mode: 0o700)
+        File.open(File.join(dir, LOCK), File::RDWR | File::CREAT, 0o600) do |lock|
+          lock.flock(File::LOCK_EX)
+          now = @clock.call
+          stored = read
+          entries = yield(stored.reject { |entry| expired?(entry, now) })
+          # Written only when it changes: a guessed code costs no write.
+          next if entries == stored
+
+          AtomicFile.write(@path, "#{JSON.generate({ "version" => 1, "codes" => entries })}\n", perm: 0o600)
+        end
+      end
+
+      def expired?(entry, now)
+        Time.iso8601(entry["expires_at"].to_s) <= now
+      rescue ArgumentError
+        true
+      end
+
+      def read
+        data = JSON.parse(File.read(@path))
+        codes = data.is_a?(Hash) ? data["codes"] : nil
+        codes.is_a?(Array) ? codes.select { |entry| entry.is_a?(Hash) } : []
+      rescue Errno::ENOENT, JSON::ParserError
+        []
+      end
+    end
+  end
+end

data/lib/samagotchi/web/participant_access.rb

@@ -57,11 +57,18 @@ module Samagotchi
       # request's env for #token_gate's answer (#grant_ended_response). A
       # grant whose session was archived or is gone is revoked here (archive
       # and delete revoke too; this catches retention's prune and a delete
-      # from another process).
+      # from another process). A grant bound to an identity (Grant#identity)
+      # is honoured only on a proxied request with that identity
+      # (ProxyGate): never on the LAN or this machine.
+      # @param identity [String, nil] the proxied request's identity
       # @return [Principal, nil]
-      def participant_principal(req, tokens)
+      def participant_principal(req, tokens, identity: nil, proxied: false)
         tokens.each do |token|
           grant = @grants.lookup(token) or next
+          if grant.identity && !(proxied && identity == grant.identity)
+            req.env[ProxyGate::REFUSED_ENV] = "grant #{grant.id} is bound to another identity than #{identity || "(none)"}"
+            next
+          end
           grant = settle_grant(grant)
           state = grant.state(@grants.now)
           if state == :active

data/lib/samagotchi/web/participant_review.rb

@@ -39,7 +39,7 @@ module Samagotchi
       # paths; the owner's token is never shown.
       def participant_viewer(req, session)
         author = principal(req).owner? ? nil : principal(req).grant.author
-        ParticipantView::Viewer.new(author: author, cwd: session.working_directory, secrets: [@lan && current_token].compact)
+        ParticipantView::Viewer.new(author: author, cwd: session.working_directory, secrets: [(@lan || @public_url) && current_token].compact)
       end
 
       # GET /api/sessions/:id/review: the participant page's data, always