@gotcos/glasses-server 7.0.27 → 7.0.29

package/server/routes/web-key.ts

@@ -43,9 +43,21 @@ export interface WebKeyRouterDeps {
   isWebRequest: (req: Request) => boolean
   apiToken: () => string
   selfDnsName: () => string | null
+  /**
+   * 7.0.14: when selfDnsName() is null, GET status (after its auth check) awaits this before it
+   * answers, so a boot-time miss does not hand COS Control `origin: null` (lib/tailnet-self-name.ts
+   * refreshIfMissing: bounded, single-flight, rate-limited). Never called while a name is known.
+   */
+  refreshSelfDnsName?: () => Promise<unknown>
   expectedOrigin: () => string | null
   /** Served-asset integrity (Phase 6) for Control's audit; absent: not reported. */
   integrityStatus?: () => Record<string, unknown>
+  /**
+   * B2: whether 3144 presents a publicly trusted certificate for this Mac's tailnet name, and why not
+   * (lib/web-key-signer-tls.ts SignerTlsStatus, e.g. `tailnet_https_certs_off`). Authority mode only;
+   * absent or null (no 3144 listener): not reported.
+   */
+  signerTls?: () => object | null
   /**
    * Phase 3: whether this request reached the 3144 signer listener (index.ts: the socket's local
    * port). Given, the phone's key steps (enroll start and prove, nonce) and the handoff claim answer
@@ -97,13 +109,27 @@ export function createWebKeyRouter(deps: WebKeyRouterDeps): Router {
     next()
   }
 
-  router.get('/web-key/status', anchorRoutes, (req, res) => {
+  // 7.0.14: a request that passed the status route's own auth check, while this Mac's tailnet name is
+  // unknown, waits for one bounded lookup instead of answering a stale miss. Known name: no wait.
+  const learnSelfName = async (): Promise<void> => {
+    if (!deps.refreshSelfDnsName || deps.selfDnsName() !== null) return
+    try { await deps.refreshSelfDnsName() } catch { /* answer with what is known */ }
+  }
+
+  const signerTlsField = (): { signerTls?: object } => {
+    let state: object | null = null
+    try { state = deps.signerTls?.() ?? null } catch { state = null }
+    return state ? { signerTls: state } : {}
+  }
+
+  router.get('/web-key/status', anchorRoutes, async (req, res) => {
     const registry = deps.authority.registry
-    const selfDns = deps.selfDnsName()
     if (deps.authority.mode() !== 'authority') {
       // Bootstrap only: COS Control's anchor state, nothing that suggests approvals. Token only:
       // no web page needs it while no phone can enroll. `enabled: false` keeps older Controls hidden.
       if (!hasToken(req)) return refuse(res, 401, 'unauthorized')
+      await learnSelfName()
+      const selfDns = deps.selfDnsName()
       const anchor = registry.anchor()
       return void res.json({
         ok: true,
@@ -118,6 +144,8 @@ export function createWebKeyRouter(deps: WebKeyRouterDeps): Router {
       })
     }
     if (!hasToken(req) && !web(req)) return refuse(res, 401, 'unauthorized')
+    await learnSelfName()
+    const selfDns = deps.selfDnsName()
     res.json({
       ok: true,
       enabled: true,
@@ -131,6 +159,7 @@ export function createWebKeyRouter(deps: WebKeyRouterDeps): Router {
       epoch: registry.epoch(),
       activeKeys: registry.activeCount(selfDns),
       ...(deps.integrityStatus ? { integrity: deps.integrityStatus() } : {}),
+      ...signerTlsField(),
     })
   })
 

package/server/web-control/.manifest.json

@@ -2,14 +2,14 @@
   "v": 1,
   "algorithm": "sha256",
   "files": {
-    "/app.css": "a4dbdb42ba6c9de5dc02235985fde499854693c41fca54ad3f3395587ab9834a",
-    "/app.js": "9a26933a5bd72724b620c9c61d11508d895f63ddea620df684f62bb585d761de",
+    "/app.css": "1204f3b57d312c94e96a1430ba036292873ecbe132073c8a4f03e37063172a70",
+    "/app.js": "1491f6dd957f47881e55a47caf98a3ce8fcb6df43a58b6e6877dd86807bebea6",
     "/apple-touch-icon.png": "04ec7eca0bf6f53d89900d146ac32d4826759d6258bcdbd1ccdcc517f26f532c",
     "/control.css": "e7b287aa4acc1b3895a9ce61512fe449c555b6335a7145684fd78108ae008c75",
     "/fonts/DMSans.ttf": "8cd08d97e89c24d0aa92edd2f0f4c8ee6195eee9b7c9f154865a58b02f0c1c0d",
     "/fonts/Fraunces.ttf": "177ff6c0f14e5550a3c624247cd1189611d4eb65d000b14944c63d967958abbb",
     "/fonts/JetBrainsMono.ttf": "48715a42ec242c21e9f02692891e147d022299a52e48d5e413e1a942193ffeda",
-    "/index.html": "736f56bbeec449f2204b815594d74042924622ef3004227202a0374df8bc82b5",
+    "/index.html": "8664ebf9ae7635c1fcf5fce333b89d272b6ce0df9529120523b99a3d49eb5ebb",
     "/mark.svg": "8e380d33d393027df192eb1afa08f15a380c2070c72d68f27311b49d9e94ca18",
     "/memories/d3.min.js": "f2094bbf6141b359722c4fe454eb6c4b0f0e42cc10cc7af921fc158fceb86539",
     "/memories/graph-explorer.css": "ec128de59811f45c71b6bededd737989309205e903951eb8211ade7664f87486",
@@ -38,7 +38,7 @@
     "/panes/work.css": "da50355dac690f712d1f6331f70ee5eadbf5982d37508648ae7786afc99ac7b1",
     "/panes/work.js": "1ef872b8c7e1a57bd7bd314e11eee7ac5fa9668871da7e644a1fbf5fd9c0d9e8",
     "/shell.js": "f1cc6a52c78e01ddba89ff27c6bd0e8f8bd8f29bdfcbb5150ee4ed66a8128d9d",
-    "/theme.js": "360df6013cd638524543728f8fa3d35f5641d4d230da7c290de40c79216670ee",
+    "/theme.js": "e3e6422eaac43979d03149da114f5b83757b7361dd7b309cdf76be36a596044b",
     "/vendor/qrcode-encoder.js": "61d87cc7445cc66b862cff913de4571634746ea62bcd50d0f592be14f6d1ce46"
   }
 }

package/server/web-control/app.css

@@ -653,3 +653,57 @@ html { touch-action: manipulation; }
 .sx-te-choices, .ta-te-choices { display: flex; flex-wrap: wrap; gap: 8px; margin: 8px 0 6px; }
 .sx-te-choices .cx-btn, .ta-te-choices .cx-btn { flex: 1 1 12rem; min-height: 44px; white-space: normal; text-align: center; line-height: 1.25; }
 .sx-mac-q .sx-note { margin: 6px 0 0; }
+
+/* ── 7.0.29: the folded Duo's side rail (Miles 21:39 "These side buttons are a must on the duo"; 21:42 tall phones keep
+   the top menu). theme.js sets html.short-screen from the screen's shape; this draws it only under 600 px on a touch
+   screen, so nothing changes from 600 px, on a mouse, or on a tall phone. It is the same nav.rail as the wide rail, so
+   the panes, their order, icons, badges and aria-current are one list: here it moves to the right edge as icons only,
+   with the top bar's Back at its foot on a reader. --rail-hit is 44 points on the phone: app.js railHitSync sets it from
+   the zoom (52 px at Safari's 85 percent Page Zoom, 44 px at 100); 52 px until it runs. Colours are the rail's own
+   tokens; the current pane keeps the wide rail's look (rail-active fill and its small shadow, no border). */
+.rail-back { display: none; }
+@media (max-width: 599px) and (pointer: coarse) {
+  html.short-screen { --rail-w: calc(var(--rail-hit, 52px) + 6px); }
+  html.short-screen .app-shell { display: flex; flex-direction: row; align-items: flex-start; }
+  html.short-screen.sx-frame .app-shell { flex-direction: row; align-items: stretch; }
+  html.short-screen .main-col { flex: 1 1 auto; min-width: 0; --safe-right: 0px; }
+  html.short-screen .rail {
+    order: 2; flex: none; width: calc(var(--rail-w) + var(--safe-right)); box-sizing: border-box;
+    display: flex; flex-direction: column; align-items: center; gap: 0;
+    position: sticky; top: 0; height: 100dvh; overflow-x: hidden; overflow-y: auto; overscroll-behavior: contain; scrollbar-width: none;
+    padding: calc(var(--safe-top) + 4px) var(--safe-right) calc(var(--safe-bottom) + 6px) 0;
+    background: var(--rail); border-left: 1px solid var(--rail-border);
+  }
+  html.short-screen.sx-frame .rail { position: static; height: auto; min-height: 0; }
+  html.short-screen .rail::-webkit-scrollbar { display: none; }
+  html.short-screen .rail-head, html.short-screen .rail-text, html.short-screen .rail-settings .rail-label, html.short-screen .server-line { display: none; }
+  html.short-screen .rail-btn, html.short-screen .rail-settings {
+    position: relative; flex: none; display: grid; place-items: center;
+    width: var(--rail-hit, 52px); height: var(--rail-hit, 52px); min-height: 0; padding: 0;
+    border-radius: 12px; color: var(--grey);
+  }
+  html.short-screen .rail-btn .icon, html.short-screen .rail-settings .icon { width: 22px; height: 22px; }
+  html.short-screen .rail-btn[aria-current='page'], html.short-screen .rail-settings[aria-current='page'] { background: var(--rail-active); color: var(--ink); box-shadow: 0 1px 2px rgba(43, 33, 26, 0.08); }
+  html.short-screen .rail-btn:active:not([aria-current='page']), html.short-screen .rail-settings:active:not([aria-current='page']) { background: var(--rail-border); color: var(--ink); }
+  html.short-screen .rail-btn .badge-dot { top: 9px; right: 9px; }
+  html.short-screen .rail-btn.hot::after { content: ''; position: absolute; top: 9px; right: 9px; width: 8px; height: 8px; border-radius: 50%; background: var(--hot); }
+  html.short-screen .rail-btn .inbox-count { position: absolute; top: 4px; right: 2px; }
+  html.short-screen .rail-btn .inbox-dot { position: absolute; top: 9px; right: 9px; }
+  html.short-screen .rail-sep { flex: none; width: 24px; height: 1px; margin: 3px 0; background: var(--rail-border); }
+  html.short-screen .rail-spacer { display: none; }
+  /* Back: alone at the foot, outlined so it never reads as a pane; it stays on screen when the panes scroll. */
+  html.short-screen .rail-back:not([hidden]) {
+    display: grid; place-items: center; flex: none; margin-top: auto;
+    position: sticky; bottom: 0; z-index: 1;
+    width: var(--rail-hit, 52px); height: var(--rail-hit, 52px);
+    border: 1px solid var(--btn-border); border-radius: 12px; background: var(--rail); color: var(--ink);
+  }
+  html.short-screen .rail-back .icon { width: 22px; height: 22px; stroke-width: 2; }
+  html.short-screen .rail-back:active { background: var(--rail-border); }
+  /* The focus ring sits inside the button: the rail clips anything past its edge. */
+  html.short-screen .rail :focus-visible { outline: 2px solid var(--accent); outline-offset: -4px; border-radius: 12px; }
+  /* One way to switch panes on a screen: the rail. The top bar keeps the pane's name, without the caret and its menu
+     (app.js makes the button inert), and its Back moves to the rail. */
+  html.short-screen .section-btn .caret, html.short-screen #topbar-back { display: none !important; }
+  html.short-screen .section-btn { cursor: default; }
+}