@magland/mochi 0.3.1 → 0.4.0

package/dist/vault.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VAULT_VERSION = exports.VAULT_FILE = void 0;
+exports.GITHUB_BINDING_PREFIX = exports.PASSKEY_BINDING_PREFIX = exports.VAULT_VERSION = exports.VAULT_FILE = void 0;
 exports.tokenId = tokenId;
 exports.vaultFilePath = vaultFilePath;
 exports.loadVault = loadVault;
@@ -47,15 +47,31 @@ exports.finishPermsMigration = finishPermsMigration;
 exports.setSiteAdmin = setSiteAdmin;
 exports.bootstrapVault = bootstrapVault;
 exports.revokeToken = revokeToken;
+exports.passkeyBinding = passkeyBinding;
+exports.githubBinding = githubBinding;
+exports.authForBinding = authForBinding;
+exports.findPasskey = findPasskey;
+exports.addPasskey = addPasskey;
+exports.removePasskey = removePasskey;
+exports.setPasskeyCounter = setPasskeyCounter;
 exports.setUserEmails = setUserEmails;
+exports.setUserProfile = setUserProfile;
+exports.userExists = userExists;
 exports.accountForEmail = accountForEmail;
 exports.mergeContributors = mergeContributors;
+exports.findGithubAccount = findGithubAccount;
+exports.linkGithub = linkGithub;
+exports.unlinkGithub = unlinkGithub;
+exports.approveGithub = approveGithub;
+exports.unapproveGithub = unapproveGithub;
+exports.resolveGithubSignIn = resolveGithubSignIn;
 exports.removeUser = removeUser;
 const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const atomic_1 = require("./atomic");
 const filecache_1 = require("./filecache");
+const naming_1 = require("./naming");
 const scan_1 = require("./scan");
 exports.VAULT_FILE = 'vault.json';
 /** How a token is named in a listing or a revocation: its id, or a stand-in for one. */
@@ -65,7 +81,10 @@ function tokenId(t) {
 /** The version written to vault.json since roles replaced glob scopes. */
 exports.VAULT_VERSION = 2;
 function vaultFilePath(root) {
-    return path.join(root, exports.VAULT_FILE);
+    // naming.stateFile rather than VAULT_FILE, so an application that renamed
+    // the file (see src/naming.ts) reads and writes its own; for mochiforge the
+    // two spell the same name.
+    return path.join(root, naming_1.naming.stateFile);
 }
 function asStringArray(v) {
     return Array.isArray(v) && v.every((x) => typeof x === 'string') ? v : null;
@@ -111,6 +130,8 @@ function normalizeVault(parsed) {
                     rec.id = tRec.id;
                 if (typeof tRec.created === 'string' && tRec.created !== '')
                     rec.created = tRec.created;
+                if (typeof tRec.by === 'string' && tRec.by !== '')
+                    rec.by = tRec.by;
                 if (tRec.scope !== undefined) {
                     const ts = asStringArray(tRec.scope);
                     if (!ts)
@@ -125,14 +146,120 @@ function normalizeVault(parsed) {
         if (!emails) {
             throw new Error(`user ${name}: "emails" must be a list of strings`);
         }
+        // Parsed explicitly, like every other field: normalizeVault builds a fresh
+        // object, so a field it did not read would be dropped by the next write.
+        const passkeysRaw = rec.passkeys ?? [];
+        if (!Array.isArray(passkeysRaw)) {
+            throw new Error(`user ${name}: "passkeys" must be a list`);
+        }
+        const passkeys = passkeysRaw.map((p, i) => {
+            if (typeof p !== 'object' ||
+                p === null ||
+                typeof p.id !== 'string' ||
+                typeof p.publicKey !== 'string' ||
+                typeof p.alg !== 'number') {
+                throw new Error(`user ${name}: passkey ${i} must be an object with "id", "publicKey", and "alg"`);
+            }
+            const pRec = p;
+            const out = {
+                id: pRec.id,
+                publicKey: pRec.publicKey,
+                alg: pRec.alg,
+                counter: typeof pRec.counter === 'number' && pRec.counter >= 0 ? Math.floor(pRec.counter) : 0,
+            };
+            if (typeof pRec.created === 'string' && pRec.created !== '')
+                out.created = pRec.created;
+            if (typeof pRec.name === 'string' && pRec.name !== '')
+                out.name = pRec.name;
+            return out;
+        });
+        const profile = normalizeProfile(rec.profile, name);
+        const github = normalizeGithubAccount(rec.github, name);
         users[name] = {
             tokens,
+            ...(passkeys.length ? { passkeys } : {}),
             ...(rec.siteAdmin === true ? { siteAdmin: true } : {}),
             ...(emails.length ? { emails } : {}),
+            ...(profile ? { profile } : {}),
+            ...(github ? { github } : {}),
             ...(legacy ? { legacy: { scope, admin } } : {}),
         };
     }
-    return { users, ...(legacy ? { legacy: true } : {}) };
+    const githubApproved = normalizeGithubApproved(parsed.githubApproved);
+    return {
+        users,
+        ...(githubApproved.length ? { githubApproved } : {}),
+        ...(legacy ? { legacy: true } : {}),
+    };
+}
+// Both GitHub shapes are parsed explicitly for the same reason passkeys are:
+// normalizeVault builds a fresh object, so a field it did not read would be
+// dropped by the next write.
+function normalizeGithubAccount(raw, username) {
+    if (raw === undefined || raw === null)
+        return null;
+    if (typeof raw !== 'object' ||
+        typeof raw.id !== 'number' ||
+        typeof raw.login !== 'string') {
+        throw new Error(`user ${username}: "github" must be an object with a numeric "id" and a "login"`);
+    }
+    const rec = raw;
+    const out = { id: Math.floor(rec.id), login: rec.login };
+    if (typeof rec.linked === 'string' && rec.linked !== '')
+        out.linked = rec.linked;
+    return out;
+}
+function normalizeGithubApproved(raw) {
+    if (raw === undefined || raw === null)
+        return [];
+    if (!Array.isArray(raw)) {
+        throw new Error('"githubApproved" must be a list');
+    }
+    return raw.map((a, i) => {
+        if (typeof a !== 'object' ||
+            a === null ||
+            typeof a.id !== 'number' ||
+            typeof a.login !== 'string') {
+            throw new Error(`githubApproved ${i} must be an object with a numeric "id" and a "login"`);
+        }
+        const rec = a;
+        const out = { id: Math.floor(rec.id), login: rec.login };
+        if (typeof rec.added === 'string' && rec.added !== '')
+            out.added = rec.added;
+        return out;
+    });
+}
+// A hand-edited vault.json should not take the vault down over a profile, so
+// the check is a shape check: fields that are not strings are refused, and a
+// profile with nothing in it reads as no profile at all.
+function normalizeProfile(raw, username) {
+    if (raw === undefined || raw === null)
+        return null;
+    if (typeof raw !== 'object') {
+        throw new Error(`user ${username}: "profile" must be an object`);
+    }
+    const rec = raw;
+    const profile = {};
+    if (rec.name !== undefined) {
+        if (typeof rec.name !== 'string')
+            throw new Error(`user ${username}: profile "name" must be a string`);
+        if (rec.name !== '')
+            profile.name = rec.name;
+    }
+    if (rec.bio !== undefined) {
+        if (typeof rec.bio !== 'string')
+            throw new Error(`user ${username}: profile "bio" must be a string`);
+        if (rec.bio !== '')
+            profile.bio = rec.bio;
+    }
+    if (rec.links !== undefined) {
+        const links = asStringArray(rec.links);
+        if (!links)
+            throw new Error(`user ${username}: profile "links" must be a list of strings`);
+        if (links.length)
+            profile.links = links;
+    }
+    return Object.keys(profile).length ? profile : null;
 }
 const cache = (0, filecache_1.fileCache)({
     read: (file) => {
@@ -152,7 +279,7 @@ function hashToken(token) {
     return crypto.createHash('sha256').update(token).digest('hex');
 }
 function mintToken() {
-    const token = 'mochi_' + crypto.randomBytes(32).toString('hex');
+    const token = naming_1.naming.tokenPrefix + crypto.randomBytes(32).toString('hex');
     return { token, hash: hashToken(token) };
 }
 function globMatch(pattern, target) {
@@ -207,7 +334,11 @@ function writeVault(file, vault) {
         const { legacy: _legacy, ...rest } = u;
         users[name] = rest;
     }
-    (0, atomic_1.writeFileAtomic)(file, JSON.stringify({ version: exports.VAULT_VERSION, users }, null, 2) + '\n', { mode: 0o600 });
+    (0, atomic_1.writeFileAtomic)(file, JSON.stringify({
+        version: exports.VAULT_VERSION,
+        users,
+        ...(vault.githubApproved?.length ? { githubApproved: vault.githubApproved } : {}),
+    }, null, 2) + '\n', { mode: 0o600 });
 }
 /**
  * Every edit to vault.json is a read, a change in memory, and a write back, and
@@ -218,7 +349,7 @@ function writeVault(file, vault) {
  * one, which the atomic rename already guarantees.
  */
 function editVault(root, fn) {
-    return (0, atomic_1.withFileLock)(path.join(root, `${exports.VAULT_FILE}.lock`), () => fn(vaultFilePath(root)));
+    return (0, atomic_1.withFileLock)(`${vaultFilePath(root)}.lock`, () => fn(vaultFilePath(root)));
 }
 // Reread under the lock, refusing a pre-roles file: writeVault writes the
 // current shape, so editing a legacy file in place would silently drop the
@@ -260,6 +391,8 @@ function addUserTokenLocked(file, username, opts) {
     const rec = { hash, id: crypto.randomBytes(4).toString('hex'), created: new Date().toISOString() };
     if (opts.tokenScope && opts.tokenScope.length)
         rec.scope = opts.tokenScope;
+    if (opts.by && opts.by !== username)
+        rec.by = opts.by;
     user.tokens.push(rec);
     writeVault(file, vault);
     return { token, created, user };
@@ -363,6 +496,108 @@ function revokeToken(root, username, id) {
         return { revoked: true, remaining: user.tokens.length };
     });
 }
+/** How a session bound to a passkey spells it in the cookie payload: never a
+ * hex token hash, so the two kinds of binding cannot collide. */
+exports.PASSKEY_BINDING_PREFIX = 'pk:';
+function passkeyBinding(credentialId) {
+    return exports.PASSKEY_BINDING_PREFIX + credentialId;
+}
+/** How a session signed in with GitHub spells its binding: the numeric GitHub
+ * id behind a prefix, so it can collide with neither a token hash nor a
+ * passkey binding. */
+exports.GITHUB_BINDING_PREFIX = 'gh:';
+function githubBinding(id) {
+    return exports.GITHUB_BINDING_PREFIX + String(id);
+}
+/**
+ * The AuthResult a session binding resolves to against a live vault: a token
+ * binding finds its TokenRecord, while a passkey or GitHub binding finds the
+ * credential and stands a synthetic token in for it. The synthetic record
+ * carries no scope, deliberately: a passkey or a GitHub sign-in proves the
+ * user, not a narrowed token, so a session signed in with one has the user's
+ * own rights, exactly as an unscoped token would. Its hash is the binding
+ * string, which is not hex and so can never name a real token anywhere else.
+ */
+function authForBinding(vault, username, binding) {
+    const user = vault.users[username];
+    if (!user)
+        return null;
+    if (binding.startsWith(exports.PASSKEY_BINDING_PREFIX)) {
+        const id = binding.slice(exports.PASSKEY_BINDING_PREFIX.length);
+        if (!user.passkeys?.some((p) => p.id === id))
+            return null;
+        return { username, user, token: { hash: binding } };
+    }
+    if (binding.startsWith(exports.GITHUB_BINDING_PREFIX)) {
+        const id = Number(binding.slice(exports.GITHUB_BINDING_PREFIX.length));
+        if (!Number.isInteger(id) || user.github?.id !== id)
+            return null;
+        return { username, user, token: { hash: binding } };
+    }
+    const token = user.tokens.find((t) => t.hash === binding);
+    return token ? { username, user, token } : null;
+}
+/** The user a credential id belongs to, for a sign-in that only knows the key. */
+function findPasskey(vault, credentialId) {
+    for (const [username, user] of Object.entries(vault.users)) {
+        const passkey = user.passkeys?.find((p) => p.id === credentialId);
+        if (passkey)
+            return { username, user, passkey };
+    }
+    return null;
+}
+/** Register a passkey. The credential id must be new to the whole vault: an
+ * authenticator names its keys uniquely, so a collision is a replayed
+ * registration rather than a coincidence to accommodate. */
+function addPasskey(root, username, rec) {
+    return editVault(root, (file) => {
+        const vault = readVaultForEdit(file);
+        const user = vault.users[username];
+        if (!user)
+            throw new Error(`no user ${username}`);
+        if (findPasskey(vault, rec.id))
+            throw new Error('this passkey is already registered');
+        const stored = { ...rec, created: new Date().toISOString() };
+        user.passkeys = [...(user.passkeys ?? []), stored];
+        writeVault(file, vault);
+        return stored;
+    });
+}
+/** Remove one passkey, ending any session signed in with it. */
+function removePasskey(root, username, credentialId) {
+    return editVault(root, (file) => {
+        const vault = readVaultForEdit(file);
+        const user = vault.users[username];
+        if (!user)
+            throw new Error(`no user ${username}`);
+        const before = user.passkeys?.length ?? 0;
+        const after = (user.passkeys ?? []).filter((p) => p.id !== credentialId);
+        if (after.length === before)
+            return false;
+        if (after.length)
+            user.passkeys = after;
+        else
+            delete user.passkeys;
+        writeVault(file, vault);
+        return true;
+    });
+}
+/**
+ * Record the signature counter an assertion carried. Best effort: the write
+ * exists to catch a cloned authenticator replaying an old counter, and a
+ * vault.json that cannot be written right now is not worth failing a sign-in
+ * whose signature already verified.
+ */
+function setPasskeyCounter(root, username, credentialId, counter) {
+    editVault(root, (file) => {
+        const vault = readVaultForEdit(file);
+        const passkey = vault.users[username]?.passkeys?.find((p) => p.id === credentialId);
+        if (!passkey || passkey.counter >= counter)
+            return;
+        passkey.counter = counter;
+        writeVault(file, vault);
+    });
+}
 /** Replace the git author emails aliased to a user. An empty list clears them. */
 function setUserEmails(root, username, emails) {
     return editVault(root, (file) => {
@@ -378,6 +613,38 @@ function setUserEmails(root, username, emails) {
         return user;
     });
 }
+/**
+ * Replace a user's profile. Empty fields are dropped rather than stored, and a
+ * profile with nothing left is removed outright, so vault.json never carries an
+ * empty object for a user who cleared theirs.
+ */
+function setUserProfile(root, username, profile) {
+    return editVault(root, (file) => {
+        const vault = readVaultForEdit(file);
+        const user = vault.users[username];
+        if (!user)
+            throw new Error(`no user ${username}`);
+        const clean = {};
+        if (profile.name?.trim())
+            clean.name = profile.name.trim();
+        if (profile.bio?.trim())
+            clean.bio = profile.bio.trim();
+        const links = (profile.links ?? []).map((l) => l.trim()).filter((l) => l !== '');
+        if (links.length)
+            clean.links = links;
+        if (Object.keys(clean).length)
+            user.profile = clean;
+        else
+            delete user.profile;
+        writeVault(file, vault);
+        return user;
+    });
+}
+/** Whether the vault knows a user by this name; false when it failed to load. */
+function userExists(root, name) {
+    const state = loadVault(root);
+    return state.status === 'ok' && Object.prototype.hasOwnProperty.call(state.vault.users, name);
+}
 /**
  * The user a commit author email belongs to, or null when it belongs to no
  * one this vault knows. Two ways in: the synthetic `<user>@noreply.<anything>`
@@ -429,6 +696,132 @@ function mergeContributors(vault, people) {
         .map(({ bestCommits: _b, bestSynthetic: _s, ...c }) => c)
         .sort((a, b) => b.commits - a.commits);
 }
+/** The user a GitHub id is linked to, for a sign-in arriving from GitHub. */
+function findGithubAccount(vault, id) {
+    for (const [username, user] of Object.entries(vault.users)) {
+        if (user.github?.id === id)
+            return { username, user };
+    }
+    return null;
+}
+/**
+ * Link a GitHub account to a user. One GitHub id links to at most one user,
+ * or a sign-in with it would have two answers; relinking the same id to the
+ * same user only refreshes the login.
+ */
+function linkGithub(root, username, account) {
+    return editVault(root, (file) => {
+        const vault = readVaultForEdit(file);
+        const user = vault.users[username];
+        if (!user)
+            throw new Error(`no user ${username}`);
+        const holder = findGithubAccount(vault, account.id);
+        if (holder && holder.username !== username) {
+            throw new Error(`The GitHub account ${account.login} is already linked to ${holder.username}.`);
+        }
+        const linked = user.github?.id === account.id ? user.github.linked : new Date().toISOString();
+        const stored = { id: account.id, login: account.login, ...(linked ? { linked } : {}) };
+        user.github = stored;
+        writeVault(file, vault);
+        return stored;
+    });
+}
+/** Remove a user's GitHub link, ending any session signed in with it. */
+function unlinkGithub(root, username) {
+    return editVault(root, (file) => {
+        const vault = readVaultForEdit(file);
+        const user = vault.users[username];
+        if (!user)
+            throw new Error(`no user ${username}`);
+        if (!user.github)
+            return false;
+        delete user.github;
+        writeVault(file, vault);
+        return true;
+    });
+}
+/** Add a GitHub account to the approved list, or refresh its login there. */
+function approveGithub(root, account) {
+    return editVault(root, (file) => {
+        const vault = readVaultForEdit(file);
+        const list = vault.githubApproved ?? [];
+        const existing = list.find((a) => a.id === account.id);
+        if (existing) {
+            existing.login = account.login;
+            vault.githubApproved = list;
+            writeVault(file, vault);
+            return existing;
+        }
+        const added = { id: account.id, login: account.login, added: new Date().toISOString() };
+        vault.githubApproved = [...list, added];
+        writeVault(file, vault);
+        return added;
+    });
+}
+/** Remove one approval by GitHub id. A user already linked is not touched:
+ * approval gates only the first sign-in, which creates an account. */
+function unapproveGithub(root, id) {
+    return editVault(root, (file) => {
+        const vault = readVaultForEdit(file);
+        const before = vault.githubApproved?.length ?? 0;
+        const after = (vault.githubApproved ?? []).filter((a) => a.id !== id);
+        if (after.length === before)
+            return false;
+        if (after.length)
+            vault.githubApproved = after;
+        else
+            delete vault.githubApproved;
+        writeVault(file, vault);
+        return true;
+    });
+}
+/**
+ * What a completed GitHub sign-in means to this vault. A linked account wins
+ * outright; failing that, an approved id has an account created for it, named
+ * after the GitHub login (with a numeric suffix when that name is taken or
+ * reserved); anything else is refused. One vault edit end to end, so the
+ * check and the provisioning cannot race a second sign-in into two accounts.
+ * The new account holds no tokens: it can use the web signed in with GitHub,
+ * and pushing over git waits until an administrator mints it a token.
+ */
+function resolveGithubSignIn(root, account) {
+    return editVault(root, (file) => {
+        if (!fs.existsSync(file))
+            return { kind: 'refused' };
+        const vault = readVaultForEdit(file);
+        const linked = findGithubAccount(vault, account.id);
+        if (linked) {
+            // A rename on GitHub's side refreshes the stored login, which is
+            // display only; the id did the matching.
+            if (linked.user.github && linked.user.github.login !== account.login) {
+                linked.user.github.login = account.login;
+                writeVault(file, vault);
+            }
+            return { kind: 'ok', username: linked.username, created: false };
+        }
+        const approval = (vault.githubApproved ?? []).find((a) => a.id === account.id);
+        if (!approval)
+            return { kind: 'refused' };
+        let username = null;
+        for (const candidate of [account.login, ...[2, 3, 4, 5, 6, 7, 8, 9].map((n) => `${account.login}-${n}`)]) {
+            if ((0, scan_1.isValidUserName)(candidate) && !vault.users[candidate]) {
+                username = candidate;
+                break;
+            }
+        }
+        if (!username) {
+            return { kind: 'error', message: `No free username could be derived from ${account.login}.` };
+        }
+        vault.users[username] = {
+            tokens: [],
+            github: { id: account.id, login: account.login, linked: new Date().toISOString() },
+        };
+        if (approval.login !== account.login)
+            approval.login = account.login;
+        writeVault(file, vault);
+        return { kind: 'ok', username, created: true };
+    });
+}
 /** Remove a user, and with them every token they hold. */
 function removeUser(root, username) {
     return editVault(root, (file) => {