@conciergeprotocol/server 0.1.0 → 0.3.0

package/README.md

@@ -102,8 +102,35 @@ const cap = await createCapServer({
 
 With a token, `answer` receives `account` and `scope` (`read` or `write`). A token sent by a different agent is `403`.
 
+If people are usually signed in to your site already, pass `currentAccount` too. It reads your own session from the request headers and returns the account id, or null. When it finds one, the login and confirm pages show only Allow or Approve. Without a session, they fall back to `login`. A confirm page asks for a login when the session is for a different account than the request.
+
+```js
+const cap = await createCapServer({
+  agent: { name: 'Harbor Goods' },
+  answer,
+  login: async ({ username, password }) => verifyUser(username, password),
+  currentAccount: async ({ headers }) => accountFromSessionCookie(headers.cookie),
+})
+```
+
+Serve `/oauth` on the same origin as your sign-in, so your session cookie reaches it. A signed-in approval also needs a `SameSite=Strict` cookie the page sets, so a form on another site cannot submit it.
+
 To hold a change for the person's approval, return `{ confirm: { summary, authorization_details }, reply }` instead of running it. After they approve, the server calls `act` once.
 
+## Account routes
+
+Another agent can call your own JSON routes with the same token, for example a hosted agent that answers public questions itself and fetches account data from you. `accountFor(request)` checks the bearer token against the agent in `CAP-From` and returns `{ account, scope, caller }`, or null. Filter every query by `account`.
+
+```js
+export async function GET(request) {
+  const access = await door.accountFor(request)
+  if (!access) return Response.json({ error: { code: 'login_required' } }, { status: 401 })
+  return Response.json({ account: access.account, orders: await ordersFor(access.account) })
+}
+```
+
+`requestApproval(request, { summary, authorization_details })` holds a change for the person's OK and returns `{ confirmation: { id, url, summary } }`. It needs a write login and `act`, which runs once after approval.
+
 ## cap.json
 
 `cap-server` reads `cap.json` from the working directory, or `CAP_CONFIG`. The same file the reference server uses:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@conciergeprotocol/server",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Run a Concierge Agent Protocol front door. You write the answer.",
   "type": "module",
   "exports": {

package/src/config.mjs

@@ -79,11 +79,12 @@ export async function boot(options = {}) {
     }
   }
   const oauthConfig = config.oauth
-  const oauth = oauthConfig || options.login
+  const oauth = oauthConfig || options.login || options.currentAccount
     ? createOAuth({
       store,
       agentName: config.agent.name,
       login: options.login || accountsLogin(oauthConfig?.accounts),
+      currentAccount: options.currentAccount || null,
       write: Boolean(oauthConfig?.write),
       act: options.act || handlerAct(config.handler),
       accessTokenSeconds: oauthConfig?.access_token_seconds ?? 3600,

package/src/index.d.ts

@@ -38,6 +38,11 @@ export type CapServerOptions = {
   answer: Answer
   /** Checks the company's own user store. Returning an account id turns on OAuth. */
   login?: (input: { username: string; password: string }) => string | null | Promise<string | null>
+  /**
+   * Reads the company's own session from the request headers and returns the
+   * signed-in account id. The login and confirm pages then ask only for the decision.
+   */
+  currentAccount?: (input: { headers: Record<string, string | string[] | undefined> }) => string | null | Promise<string | null>
   /** Runs once after a person approves a held action. */
   act?: (input: { account: string; authorization_details: unknown; caller: string }) => { message: string } | { error: { message: string } } | Promise<{ message: string } | { error: { message: string } }>
   write?: boolean
@@ -67,7 +72,20 @@ export type ListenAddress = {
   family: string
 }
 
-export type CapServer = {
+export type AccountAccess = { account: string; scope: 'read' | 'write'; caller: string }
+
+export type ApprovalResult =
+  | { confirmation: { id: string; status: 'pending'; url: string; summary: string; expires_at: string } }
+  | AnswerError
+
+export type AccountHelpers = {
+  /** The account behind the request's bearer token, for your own account routes. Null without a valid token for the agent in CAP-From. */
+  accountFor(request: Request | IncomingMessage): Promise<AccountAccess | null>
+  /** Holds an action until the person approves it on the confirm page. `act` runs it once after. */
+  requestApproval(request: Request | IncomingMessage, input: { summary: string; authorization_details?: unknown[] }): Promise<ApprovalResult>
+}
+
+export type CapServer = AccountHelpers & {
   listen(port?: number, host?: string): Promise<ListenAddress | string | null>
   close(): Promise<void>
   fetch(request: Request): Promise<Response>
@@ -76,7 +94,7 @@ export type CapServer = {
 
 export function createCapServer(options: CapServerOptions): Promise<CapServer>
 
-export function createCapHandler(options: CapServerOptions): Promise<{
+export function createCapHandler(options: CapServerOptions): Promise<AccountHelpers & {
   handle(request: Request): Promise<Response>
   close(): Promise<void>
 }>

package/src/index.js

@@ -35,11 +35,12 @@ export async function createCapServer(options = {}) {
     }
   }
 
-  const oauth = options.login
+  const oauth = options.login || options.currentAccount
     ? createOAuth({
       store,
       agentName: agent.name,
       login: options.login,
+      currentAccount: options.currentAccount || null,
       write: Boolean(options.write),
       act: options.act || null,
       accessTokenSeconds: options.accessTokenSeconds ?? 3600,
@@ -70,6 +71,8 @@ export async function createCapServer(options = {}) {
     fetch(request) {
       return handleWeb(node.handle, request)
     },
+    accountFor: (req) => node.accountFor(nodeLike(req)),
+    requestApproval: (req, input) => node.requestApproval(nodeLike(req), input),
     listen(port = Number(process.env.PORT || 8088), host = process.env.HOST || '0.0.0.0') {
       return new Promise((resolve, reject) => {
         node.server.once('error', reject)
@@ -91,10 +94,29 @@ export async function createCapHandler(options) {
   const cap = await createCapServer(options)
   return {
     handle: (request) => cap.fetch(request),
+    accountFor: cap.accountFor,
+    requestApproval: cap.requestApproval,
     close: () => cap.close(),
   }
 }
 
+/** A Fetch API Request reads like a Node request for header checks. */
+function nodeLike(req) {
+  if (typeof req?.headers?.get !== 'function') return req
+  const headers = {}
+  req.headers.forEach((value, key) => {
+    headers[key] = value
+  })
+  try {
+    const url = new URL(req.url)
+    headers.host ||= url.host
+    headers['x-forwarded-proto'] ||= url.protocol.replace(':', '')
+  } catch {
+    // Without a URL the origin falls back to the Host header.
+  }
+  return { headers }
+}
+
 function normalizeAgent(agent) {
   if (!agent?.name || typeof agent.name !== 'string') throw new Error('createCapServer needs agent.name.')
   return {

package/src/node-server.mjs

@@ -168,6 +168,45 @@ export function createCapServer({
     return { grant }
   }
 
+  /**
+   * The account behind a request's bearer token, for the owner's own account
+   * routes. Null without a valid token for the agent named in CAP-From.
+   */
+  async function accountFor(req) {
+    const caller = callerId(req)
+    if (!caller || !req.headers.authorization) return null
+    const access = await grantFor(req, caller)
+    if (!access.grant) return null
+    return { account: access.grant.account, scope: access.grant.scope === 'write' ? 'write' : 'read', caller }
+  }
+
+  /** Holds an action from an owner's account route until the person approves it. */
+  async function requestApproval(req, { summary, authorization_details } = {}) {
+    const access = await accountFor(req)
+    if (!access) return { error: { code: 'login_required', message: 'Log in to make this change.' } }
+    if (access.scope !== 'write') {
+      return { error: { code: 'write_required', message: 'This login can read but not make changes. Log in again and allow changes.' } }
+    }
+    if (!oauth?.canConfirm) return { error: { code: 'failed', message: `${agent.name} cannot hold an action for approval.` } }
+    const text = String(summary || '').trim().slice(0, MAX_SUMMARY)
+    if (!text) return { error: { code: 'invalid_request', message: 'summary is required.' } }
+    const id = newConfirmationId()
+    const now = Date.now()
+    const expiresAt = new Date(now + CONFIRM_TTL_MS).toISOString()
+    await store.insertConfirmation({
+      id,
+      caller_id: access.caller,
+      account: access.account,
+      client_id: access.caller,
+      message_id: '',
+      summary: text,
+      authorization_details: Array.isArray(authorization_details) ? authorization_details : [],
+      expires_at: expiresAt,
+      created_at: new Date(now).toISOString(),
+    })
+    return { confirmation: { id, status: 'pending', url: oauth.confirmUrl(requestOrigin(req, publicUrl), id), summary: text, expires_at: expiresAt } }
+  }
+
   async function route(req, res) {
     const url = new URL(req.url || '/', 'http://localhost')
     if (req.method === 'OPTIONS') {
@@ -371,5 +410,5 @@ export function createCapServer({
     send(res, 200, await view(msg, origin))
   }
 
-  return { server, handle: onRequest }
+  return { server, handle: onRequest, accountFor, requestApproval }
 }

package/src/oauth.mjs

@@ -1,4 +1,4 @@
-import { createHash, randomBytes } from 'node:crypto'
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto'
 import { isIP } from 'node:net'
 import { readBody, send } from './http.mjs'
 
@@ -13,6 +13,8 @@ const MAX_CLIENT_DOC = 16_000
 const CAP_FROM_RE = /^agent:([A-Za-z0-9_.-]{1,64})$/
 const PKCE_RE = /^[A-Za-z0-9._~-]{43,128}$/
 const LOOPBACK = new Set(['127.0.0.1', '[::1]'])
+const FORM_COOKIE = 'cap_form'
+const FORM_TTL_SECONDS = 600
 
 const random = (bytes = 32) => randomBytes(bytes).toString('base64url')
 const s256 = (verifier) => createHash('sha256').update(verifier).digest('base64url')
@@ -35,6 +37,19 @@ function withParams(uri, params) {
   return url.toString()
 }
 
+export function cookieValue(header, name) {
+  for (const part of String(header || '').split(';')) {
+    const split = part.indexOf('=')
+    if (split > 0 && part.slice(0, split).trim() === name) return part.slice(split + 1).trim()
+  }
+  return ''
+}
+
+function sameToken(a, b) {
+  if (!a || !b || a.length !== b.length) return false
+  return timingSafeEqual(Buffer.from(a), Buffer.from(b))
+}
+
 async function readForm(req) {
   const type = String(req.headers['content-type'] || '')
   if (!type.startsWith('application/x-www-form-urlencoded')) return null
@@ -155,6 +170,9 @@ export async function resolveDeviceClient(clientId, clientName, options) {
  * with PKCE, client id metadata documents, refresh rotation, and revocation.
  *
  * `login({ username, password })` resolves to the account id, or null.
+ * `currentAccount({ headers })` reads the company's own session from the
+ * request and resolves to the signed-in account id, or null. When it finds
+ * one, the login and confirm pages ask only for the decision.
  * `write` offers the `write` scope. `act({ account, authorization_details, caller })`
  * runs an action the person approved on the confirm page, and resolves to
  * `{ message }` or `{ error: { message } }`.
@@ -162,7 +180,8 @@ export async function resolveDeviceClient(clientId, clientName, options) {
 export function createOAuth({
   store,
   agentName,
-  login,
+  login = async () => null,
+  currentAccount = null,
   path = '/oauth',
   accessTokenSeconds = 3600,
   writeAccessTokenSeconds = 900,
@@ -195,24 +214,82 @@ export function createOAuth({
     }
   }
 
+  async function sessionAccount(req) {
+    if (!currentAccount) return null
+    try {
+      const account = await currentAccount({ headers: req.headers })
+      return typeof account === 'string' && account ? account : null
+    } catch {
+      return null
+    }
+  }
+
+  /**
+   * A signed-in approval is one click, so a cross-site form must not be able
+   * to make it. The page sets a SameSite=Strict cookie and posts the same value.
+   */
+  function formGuard(origin) {
+    const token = random(24)
+    const secure = origin.startsWith('https:') ? '; Secure' : ''
+    return {
+      token,
+      headers: { 'set-cookie': `${FORM_COOKIE}=${token}; Path=${path}; Max-Age=${FORM_TTL_SECONDS}; HttpOnly; SameSite=Strict${secure}` },
+    }
+  }
+
+  async function guardFor(req, origin, account = null) {
+    const signedIn = await sessionAccount(req)
+    if (!signedIn || (account && signedIn !== account)) return null
+    return formGuard(origin)
+  }
+
+  function guardFields(guard) {
+    return guard
+      ? `<input type="hidden" name="form_token" value="${escape(guard.token)}"><p class="muted">You are signed in.</p>`
+      : `<label>Username <input name="username" autocomplete="username" required></label>
+<label>Password <input name="password" type="password" autocomplete="current-password" required></label>`
+  }
+
+  /** The signed-in account when the form came from this site's own page, else the password login. */
+  async function approver(req, form) {
+    if (form.get('form_token')) {
+      const posted = form.get('form_token') || ''
+      if (!sameToken(posted, cookieValue(req.headers.cookie, FORM_COOKIE))) return null
+      return sessionAccount(req)
+    }
+    const username = form.get('username') || ''
+    const password = form.get('password') || ''
+    if (!username || !password) return null
+    return login({ username, password })
+  }
+
+  const failedLogin = (form) => (form.get('form_token')
+    ? 'Your sign-in could not be checked. Reload this page and try again.'
+    : 'That username and password did not match.')
+
   const wants = (scope) => (scope === 'write'
     ? `wants ${escape(agentName)} to read your account and make changes for you.`
     : `wants to ask ${escape(agentName)} about your account.`)
 
-  function decisionButtons(scope) {
+  function decisionButtons(scope, signedIn = false) {
+    const lead = signedIn ? 'Allow' : 'Log in and allow'
     const allow = scope === 'write'
-      ? '<button name="decision" value="allow_write">Log in and allow changes</button><button name="decision" value="allow">Allow read only</button>'
-      : '<button name="decision" value="allow">Log in and allow</button>'
+      ? `<button name="decision" value="allow_write">${lead} changes</button><button name="decision" value="allow">Allow read only</button>`
+      : `<button name="decision" value="allow">${lead}</button>`
     const warning = scope === 'write'
       ? '<p class="muted">Allow changes only if you asked this agent to make them. Deletes and other actions that are hard to undo still need your OK each time.</p>'
       : ''
     return `${warning}<div class="row">${allow}<button name="decision" value="deny" formnovalidate>Deny</button></div>`
   }
 
-  function page(res, status, { title, body }) {
+  function page(res, status, { title, body, guard = null }) {
     send(res, status, null, {
       type: 'text/html; charset=utf-8',
-      headers: { 'x-frame-options': 'DENY', 'content-security-policy': "default-src 'none'; style-src 'unsafe-inline'" },
+      headers: {
+        'x-frame-options': 'DENY',
+        'content-security-policy': "default-src 'none'; style-src 'unsafe-inline'",
+        ...(guard ? guard.headers : {}),
+      },
       raw: `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escape(title)}</title>
 <style>body{font:16px/1.5 system-ui,sans-serif;max-width:420px;margin:48px auto;padding:0 20px}label{display:block;margin-top:12px}input{width:100%;padding:8px;font:inherit;box-sizing:border-box}.row{display:flex;gap:8px;margin-top:20px}button{padding:10px 14px;font:inherit}.muted{color:#666}.error{color:#b00020}</style>
 </head><body>${body}</body></html>`,
@@ -223,9 +300,10 @@ export function createOAuth({
     page(res, status, { title: 'Login error', body: `<h1>Login error</h1><p>${escape(message)}</p><p class="muted">Go back to your agent and start again.</p>` })
   }
 
-  function consentPage(res, status, id, pending, error = '') {
+  function consentPage(res, status, id, pending, error = '', guard = null) {
     const { client } = pending
     page(res, status, {
+      guard,
       title: `Log in to ${agentName}`,
       body: `<h1>Log in to ${escape(agentName)}</h1>
 <p><strong>${escape(client.name)}</strong> (${escape(client.host)}) ${wants(pending.scope)}</p>
@@ -234,14 +312,13 @@ ${error ? `<p class="error">${escape(error)}</p>` : ''}
 ${hint ? `<p class="muted">${escape(hint)}</p>` : ''}
 <form method="post" action="${escape(path)}/authorize">
 <input type="hidden" name="request" value="${escape(id)}">
-<label>Username <input name="username" autocomplete="username" required></label>
-<label>Password <input name="password" type="password" autocomplete="current-password" required></label>
-${decisionButtons(pending.scope)}
+${guardFields(guard)}
+${decisionButtons(pending.scope, Boolean(guard))}
 </form>`,
     })
   }
 
-  async function authorizeStart(res, url, origin) {
+  async function authorizeStart(req, res, url, origin) {
     const q = url.searchParams
     const clientId = q.get('client_id') || ''
     const redirectUri = q.get('redirect_uri') || ''
@@ -265,7 +342,7 @@ ${decisionButtons(pending.scope)}
     const id = random(24)
     const pending = { client: found.client, redirectUri, state, scope, codeChallenge: q.get('code_challenge'), expires: now + REQUEST_TTL_MS }
     requests.set(id, pending)
-    consentPage(res, 200, id, pending)
+    consentPage(res, 200, id, pending, '', await guardFor(req, origin))
   }
 
   async function authorizeFinish(req, res, origin) {
@@ -282,8 +359,8 @@ ${decisionButtons(pending.scope)}
       requests.delete(id)
       return back({ error: 'access_denied', error_description: 'The person denied access.' })
     }
-    const account = await login({ username: form.get('username') || '', password: form.get('password') || '' })
-    if (!account) return consentPage(res, 401, id, pending, 'That username and password did not match.')
+    const account = await approver(req, form)
+    if (!account) return consentPage(res, 401, id, pending, failedLogin(form), await guardFor(req, origin))
 
     requests.delete(id)
     const code = random()
@@ -335,7 +412,7 @@ ${decisionButtons(pending.scope)}
     })
   }
 
-  function devicePage(res, status, { userCode = '', device = null, error = '', done = '' }) {
+  function devicePage(res, status, { userCode = '', device = null, error = '', done = '', guard = null }) {
     const who = device
       ? device.verified_host
         ? `<p><strong>${escape(device.client_name)}</strong> (${escape(device.verified_host)}) ${wants(device.scope)}</p>`
@@ -350,22 +427,26 @@ ${error ? `<p class="error">${escape(error)}</p>` : ''}
 ${hint ? `<p class="muted">${escape(hint)}</p>` : ''}
 <form method="post" action="${escape(path)}/device/approve">
 <label>Code <input name="user_code" value="${escape(userCode)}" autocomplete="off" required></label>
-<label>Username <input name="username" autocomplete="username" required></label>
-<label>Password <input name="password" type="password" autocomplete="current-password" required></label>
-${decisionButtons(device?.scope)}
+${guardFields(guard)}
+${decisionButtons(device?.scope, Boolean(guard))}
 </form>`
-    page(res, status, { title: `Log in to ${agentName}`, body })
+    page(res, status, { title: `Log in to ${agentName}`, body, guard: done ? null : guard })
   }
 
-  async function deviceView(res, url) {
+  async function deviceView(req, res, url, origin) {
     const userCode = normalizeUserCode(url.searchParams.get('user_code'))
     const device = userCode ? await store.deviceByUserCode(userCode) : null
     const status = device && device.status === 'pending' ? 200 : userCode ? 400 : 200
     const error = userCode && (!device || device.status !== 'pending') ? 'That code is expired or already used.' : ''
-    devicePage(res, status, { userCode: device ? userCode : '', device: device && device.status === 'pending' ? device : null, error })
+    devicePage(res, status, {
+      userCode: device ? userCode : '',
+      device: device && device.status === 'pending' ? device : null,
+      error,
+      guard: await guardFor(req, origin),
+    })
   }
 
-  async function deviceApprove(req, res) {
+  async function deviceApprove(req, res, origin) {
     const form = await readForm(req)
     if (!form) return devicePage(res, 400, { error: 'The body must be a form.' })
     const userCode = normalizeUserCode(form.get('user_code'))
@@ -378,8 +459,8 @@ ${decisionButtons(device?.scope)}
       await store.decideDevice(userCode, { status: 'denied' })
       return devicePage(res, 200, { done: 'Access denied' })
     }
-    const account = await login({ username: form.get('username') || '', password: form.get('password') || '' })
-    if (!account) return devicePage(res, 401, { userCode, device, error: 'That username and password did not match.' })
+    const account = await approver(req, form)
+    if (!account) return devicePage(res, 401, { userCode, device, error: failedLogin(form), guard: await guardFor(req, origin) })
     // An agent that cannot keep polling asks once the person says so, so the
     // token stays collectable for a full window after approval.
     const scope = grantedScope(device.scope, decision)
@@ -482,13 +563,14 @@ ${decisionButtons(device?.scope)}
     expired: 'This request expired',
   }
 
-  function confirmPage(res, status, { confirmation = null, error = '', done = '', message = '' }) {
+  function confirmPage(res, status, { confirmation = null, error = '', done = '', message = '', guard = null }) {
     if (done || !confirmation) {
       const heading = done || 'Request not found'
       const note = message || (confirmation ? 'Go back to your agent.' : 'It may have expired. Ask your agent again.')
       return page(res, status, { title: heading, body: `<h1>${escape(heading)}</h1><p class="muted">${escape(note)}</p>` })
     }
     page(res, status, {
+      guard,
       title: `Confirm with ${agentName}`,
       body: `<h1>Confirm with ${escape(agentName)}</h1>
 <p><strong>${escape(confirmation.summary)}</strong></p>
@@ -497,26 +579,25 @@ ${error ? `<p class="error">${escape(error)}</p>` : ''}
 ${hint ? `<p class="muted">${escape(hint)}</p>` : ''}
 <form method="post" action="${escape(path)}/confirm">
 <input type="hidden" name="id" value="${escape(confirmation.id)}">
-<label>Username <input name="username" autocomplete="username" required></label>
-<label>Password <input name="password" type="password" autocomplete="current-password" required></label>
-<div class="row"><button name="decision" value="approve">Log in and approve</button><button name="decision" value="deny" formnovalidate>Deny</button></div>
+${guardFields(guard)}
+<div class="row"><button name="decision" value="approve">${guard ? 'Approve' : 'Log in and approve'}</button><button name="decision" value="deny" formnovalidate>Deny</button></div>
 </form>`,
     })
   }
 
   const isOpen = (c) => c && c.status === 'pending' && Date.parse(c.expires_at) > Date.now()
 
-  async function confirmView(res, url) {
+  async function confirmView(req, res, url, origin) {
     const confirmation = await store.confirmationById(url.searchParams.get('id') || '')
     if (!confirmation) return confirmPage(res, 404, {})
     if (!isOpen(confirmation)) {
       const status = confirmation.status === 'pending' ? 'expired' : confirmation.status
       return confirmPage(res, 200, { confirmation, done: CONFIRM_DONE[status] || 'This request is closed' })
     }
-    confirmPage(res, 200, { confirmation })
+    confirmPage(res, 200, { confirmation, guard: await guardFor(req, origin, confirmation.account) })
   }
 
-  async function confirmDecide(req, res) {
+  async function confirmDecide(req, res, origin) {
     const form = await readForm(req)
     const confirmation = form ? await store.confirmationById(form.get('id') || '') : null
     if (!confirmation) return confirmPage(res, 404, {})
@@ -529,9 +610,13 @@ ${hint ? `<p class="muted">${escape(hint)}</p>` : ''}
       return confirmPage(res, 200, { confirmation, done: CONFIRM_DONE.denied, message: 'Nothing changed. Go back to your agent.' })
     }
     // The person who approves must be the account the request is for.
-    const account = await login({ username: form.get('username') || '', password: form.get('password') || '' })
+    const account = await approver(req, form)
     if (!account || account !== confirmation.account) {
-      return confirmPage(res, 401, { confirmation, error: 'That login does not match the account this request is for.' })
+      return confirmPage(res, 401, {
+        confirmation,
+        error: 'That login does not match the account this request is for.',
+        guard: await guardFor(req, origin, confirmation.account),
+      })
     }
     const claimed = await store.claimConfirmation(confirmation.id, 'working')
     if (!claimed) return confirmPage(res, 400, { confirmation, done: 'This request is closed' })
@@ -552,8 +637,8 @@ ${hint ? `<p class="muted">${escape(hint)}</p>` : ''}
 
   async function handle(req, res, url, origin) {
     if (url.pathname === `${path}/confirm`) {
-      if (req.method === 'GET') await confirmView(res, url)
-      else if (req.method === 'POST') await confirmDecide(req, res)
+      if (req.method === 'GET') await confirmView(req, res, url, origin)
+      else if (req.method === 'POST') await confirmDecide(req, res, origin)
       else return false
       return true
     }
@@ -562,19 +647,19 @@ ${hint ? `<p class="muted">${escape(hint)}</p>` : ''}
       return true
     }
     if (url.pathname === `${path}/authorize`) {
-      if (req.method === 'GET') await authorizeStart(res, url, origin)
+      if (req.method === 'GET') await authorizeStart(req, res, url, origin)
       else if (req.method === 'POST') await authorizeFinish(req, res, origin)
       else return false
       return true
     }
     if (url.pathname === `${path}/device`) {
       if (req.method === 'POST') await deviceStart(req, res, origin)
-      else if (req.method === 'GET') await deviceView(res, url)
+      else if (req.method === 'GET') await deviceView(req, res, url, origin)
       else return false
       return true
     }
     if (req.method === 'POST' && url.pathname === `${path}/device/approve`) {
-      await deviceApprove(req, res)
+      await deviceApprove(req, res, origin)
       return true
     }
     if (req.method === 'POST' && url.pathname === `${path}/token`) {