@heychunky/core 0.19.0 → 0.20.0

package/dist/admin/appkeys.d.ts

@@ -0,0 +1,23 @@
+import type { Register } from "./master.ts";
+import type { App } from "./apps.ts";
+export declare const APP_KEY_PREFIX = "hc_app_";
+/** Mint a key for an app, revoking any it had. The value is shown once. */
+export declare function mintAppKey(appId: string, register: Register): Promise<string>;
+/** The app a key belongs to, or nothing — a revoked key is nothing too. */
+export declare function appForKey(key: string | undefined, register: Register): Promise<App | undefined>;
+/**
+ * Whether an email may see an app's dev and next: a member of the app's
+ * organisation, or on its tester list.
+ */
+export declare function viewerAllowed(appId: string, email: string, register: Register): Promise<boolean>;
+export declare function addViewer(appId: string, email: string, addedBy: string, register: Register): Promise<void>;
+export declare function removeViewer(appId: string, email: string, register: Register): Promise<void>;
+export declare function viewersFor(appId: string, register: Register): Promise<{
+    email: string;
+    added_at: string;
+}[]>;
+/** A token the console hands an allowed viewer to carry to the app. Minutes, once. */
+export declare function mintViewerToken(appId: string, email: string, register: Register): Promise<string>;
+/** Redeem a viewer token for the app the key names: the email, once, in time. */
+export declare function redeemViewerToken(appId: string, token: string, register: Register): Promise<string | undefined>;
+//# sourceMappingURL=appkeys.d.ts.map

package/dist/admin/appkeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appkeys.d.ts","sourceRoot":"","sources":["../../src/admin/appkeys.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErC,eAAO,MAAM,cAAc,YAAY,CAAC;AAKxC,2EAA2E;AAC3E,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CASnF;AAED,2EAA2E;AAC3E,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAMrG;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAUtG;AAED,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhH;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAElG;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAAE,CAAC,CAIlH;AAED,sFAAsF;AACtF,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAOvG;AAED,iFAAiF;AACjF,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAMrH"}

package/dist/admin/appkeys.js

@@ -0,0 +1,72 @@
+/**
+ * An app's own credential, and who may see it before it is live.
+ *
+ * From phase 5 on the app talks back to Chunky — who may see `dev` and
+ * `next`, later comments and feedback — and needs a credential of its own:
+ * not a person's key, which names a person and an organisation, but the
+ * app's. One rung down from a platform key. Minted at hosting, set in the
+ * app's environment, compared only as a hash.
+ *
+ * Viewing is two lists: the organisation's members, who may always see
+ * their own app, and the testers the app has invited by email. The sign-in
+ * is heychunky's own; what crosses to the app is a short-lived token the
+ * console mints for an allowed viewer and the app redeems once.
+ */
+import { createHash, randomBytes } from "node:crypto";
+export const APP_KEY_PREFIX = "hc_app_";
+const VIEWER_MINUTES = 5;
+const hash = (value) => createHash("sha256").update(value).digest("hex");
+/** Mint a key for an app, revoking any it had. The value is shown once. */
+export async function mintAppKey(appId, register) {
+    const key = APP_KEY_PREFIX + randomBytes(24).toString("base64url");
+    await register.write("update app_keys set revoked_at = now() where app_id = $1 and revoked_at is null", [appId]);
+    await register.write("insert into app_keys (app_id, key_hash, prefix) values ($1, $2, $3)", [appId, hash(key), key.slice(0, APP_KEY_PREFIX.length + 4) + "…"]);
+    return key;
+}
+/** The app a key belongs to, or nothing — a revoked key is nothing too. */
+export async function appForKey(key, register) {
+    if (!key?.startsWith(APP_KEY_PREFIX))
+        return undefined;
+    const { rows } = await register.query(`select a.* from app_keys k join apps a on a.id = k.app_id
+      where k.key_hash = $1 and k.revoked_at is null`, [hash(key)]);
+    return rows[0];
+}
+/**
+ * Whether an email may see an app's dev and next: a member of the app's
+ * organisation, or on its tester list.
+ */
+export async function viewerAllowed(appId, email, register) {
+    const { rows } = await register.query(`select 1 from apps a
+      where a.id = $1 and (
+        exists (select 1 from org_members m join users u on u.id = m.user_id
+                 where m.org_id = a.org_id and lower(u.email) = lower($2))
+        or exists (select 1 from app_viewers v where v.app_id = a.id and lower(v.email) = lower($2)))
+      limit 1`, [appId, email]);
+    return rows.length > 0;
+}
+export async function addViewer(appId, email, addedBy, register) {
+    await register.write(`insert into app_viewers (app_id, email, added_by) values ($1, $2, $3)
+     on conflict (app_id, lower(email)) do nothing`, [appId, email.trim(), addedBy]);
+}
+export async function removeViewer(appId, email, register) {
+    await register.write("delete from app_viewers where app_id = $1 and lower(email) = lower($2)", [appId, email]);
+}
+export async function viewersFor(appId, register) {
+    const { rows } = await register.query("select email, added_at from app_viewers where app_id = $1 order by added_at", [appId]);
+    return rows;
+}
+/** A token the console hands an allowed viewer to carry to the app. Minutes, once. */
+export async function mintViewerToken(appId, email, register) {
+    const token = randomBytes(24).toString("base64url");
+    await register.write(`insert into app_viewer_tokens (token_hash, app_id, email, expires_at)
+     values ($1, $2, $3, now() + interval '${VIEWER_MINUTES} minutes')`, [hash(token), appId, email]);
+    return token;
+}
+/** Redeem a viewer token for the app the key names: the email, once, in time. */
+export async function redeemViewerToken(appId, token, register) {
+    const { rows } = await register.write(`update app_viewer_tokens set redeemed_at = now()
+      where token_hash = $1 and app_id = $2 and redeemed_at is null and expires_at > now()
+      returning email`, [hash(token), appId]);
+    return rows[0]?.["email"];
+}
+//# sourceMappingURL=appkeys.js.map

package/dist/admin/appkeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appkeys.js","sourceRoot":"","sources":["../../src/admin/appkeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAItD,MAAM,CAAC,MAAM,cAAc,GAAG,SAAS,CAAC;AACxC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEjF,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAa,EAAE,QAAkB;IAChE,MAAM,GAAG,GAAG,cAAc,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,QAAQ,CAAC,KAAK,CAClB,iFAAiF,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9F,MAAM,QAAQ,CAAC,KAAK,CAClB,qEAAqE,EACrE,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAClE,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAuB,EAAE,QAAkB;IACzE,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,cAAc,CAAC;QAAE,OAAO,SAAS,CAAC;IACvD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CACnC;qDACiD,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC,CAAC,CAA+B,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa,EAAE,KAAa,EAAE,QAAkB;IAClF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CACnC;;;;;cAKU,EACV,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAClB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,KAAa,EAAE,OAAe,EAAE,QAAkB;IAC/F,MAAM,QAAQ,CAAC,KAAK,CAClB;mDAC+C,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,KAAa,EAAE,QAAkB;IACjF,MAAM,QAAQ,CAAC,KAAK,CAAC,wEAAwE,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AACjH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAa,EAAE,QAAkB;IAChE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CACnC,6EAA6E,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1F,OAAO,IAAwD,CAAC;AAClE,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa,EAAE,KAAa,EAAE,QAAkB;IACpF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,QAAQ,CAAC,KAAK,CAClB;6CACyC,cAAc,YAAY,EACnE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa,EAAE,KAAa,EAAE,QAAkB;IACtF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CACnC;;sBAEkB,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAuB,CAAC;AAClD,CAAC"}

package/dist/admin/index.d.ts

@@ -24,6 +24,7 @@ export * from "./decommission.ts";
 export * from "./migrations.ts";
 export * from "./promote.ts";
 export * from "./release.ts";
+export * from "./appkeys.ts";
 export * from "./runs.ts";
 export * from "./entrypoints.ts";
 export * from "./chunks.ts";

package/dist/admin/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,cAAc,wBAAwB,CAAC;AACvC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC;AACjC,cAAc,aAAa,CAAC;AAG5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,cAAc,wBAAwB,CAAC;AACvC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC;AACjC,cAAc,aAAa,CAAC;AAG5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC"}

package/dist/admin/index.js

@@ -24,6 +24,7 @@ export * from "./decommission.js";
 export * from "./migrations.js";
 export * from "./promote.js";
 export * from "./release.js";
+export * from "./appkeys.js";
 export * from "./runs.js";
 export * from "./entrypoints.js";
 export * from "./chunks.js";

package/dist/admin/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,cAAc,wBAAwB,CAAC;AACvC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC;AACjC,cAAc,aAAa,CAAC;AAE5B,+CAA+C;AAC/C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,cAAc,wBAAwB,CAAC;AACvC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC;AACjC,cAAc,aAAa,CAAC;AAE5B,+CAA+C;AAC/C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heychunky/core",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "The engine the Chunky CLI, worker and apps run on.",
   "license": "MIT",
   "type": "module",

package/register/0006-app-keys/01-app-keys.sql

@@ -0,0 +1,15 @@
+-- The credential an app talks back to Chunky with: who may see dev and
+-- next, later comments and feedback. Minted at hosting, set in the app's
+-- environment, and only ever compared as a hash. One rung down from a
+-- platform key; an app has at most one that is not revoked.
+create table app_keys (
+  id uuid default gen_random_uuid() not null,
+  app_id uuid not null,
+  key_hash text not null,
+  prefix text not null,
+  created_at timestamptz default now() not null,
+  revoked_at timestamptz,
+  constraint app_keys_pkey primary key (id),
+  constraint app_keys_key_hash_key unique (key_hash),
+  constraint app_keys_app_id_fkey foreign key (app_id) references apps(id) on delete cascade
+);

package/register/0006-app-keys/02-app-keys-app-idx.sql

@@ -0,0 +1 @@
+create index app_keys_app_idx on app_keys (app_id) where revoked_at is null;

package/register/0006-app-keys/03-app-viewers.sql

@@ -0,0 +1,12 @@
+-- Who may see an app's dev and next besides its organisation's members:
+-- the testers it has invited, by email. A row and nothing more; the
+-- sign-in is heychunky's own.
+create table app_viewers (
+  app_id uuid not null,
+  email text not null,
+  added_by uuid,
+  added_at timestamptz default now() not null,
+  constraint app_viewers_pkey primary key (app_id, email),
+  constraint app_viewers_app_id_fkey foreign key (app_id) references apps(id) on delete cascade,
+  constraint app_viewers_added_by_fkey foreign key (added_by) references users(id) on delete set null
+);

package/register/0006-app-keys/04-app-viewers-email-key.sql

@@ -0,0 +1 @@
+create unique index app_viewers_email_key on app_viewers (app_id, lower(email));

package/register/0006-app-keys/05-app-viewer-tokens.sql

@@ -0,0 +1,12 @@
+-- The hand-off from the console's sign-in to the app: a short-lived token
+-- the console mints for a signed-in, allowed viewer and the app redeems
+-- once with its app key. Nothing here outlives its expiry.
+create table app_viewer_tokens (
+  token_hash text not null,
+  app_id uuid not null,
+  email text not null,
+  expires_at timestamptz not null,
+  redeemed_at timestamptz,
+  constraint app_viewer_tokens_pkey primary key (token_hash),
+  constraint app_viewer_tokens_app_id_fkey foreign key (app_id) references apps(id) on delete cascade
+);