@monster-orange/den 0.4.19 → 0.4.21

package/src/shared/owner-github.ts

@@ -0,0 +1,100 @@
+/**
+ * `web.owner_github` (D17): the GitHub login of the person who runs this
+ * instance, recorded in config/local/user.yml at `web up` or `service
+ * install` from `gh` when it is signed in here and no owner is linked yet.
+ * With it, that person connects their GitHub account from any browser, on
+ * any machine (a devbox they reach from a laptop), and nobody else can
+ * claim the instance from another machine (github-routes.ts decideFlow).
+ *
+ * Only the login is kept: never a token. `gh api user` runs with a short
+ * timeout; gh missing or signed out records nothing.
+ */
+import { execFileSync } from "child_process";
+import { readUserConfig, writeUserConfig } from "./den-config.js";
+import { parseGithubName } from "./web-session.js";
+import { readWebOwner } from "./web-owner.js";
+
+export interface OwnerGithubDeps {
+  /** The login `gh` is signed in as here, or null. */
+  ghLogin?: () => string | null;
+  /** Whether an owner is linked already. */
+  ownerLinked?: () => boolean;
+  read?: typeof readUserConfig;
+  write?: typeof writeUserConfig;
+}
+
+/** `gh api user`'s login, or null (gh missing, signed out, slow, odd output). */
+export function ghLogin(env: NodeJS.ProcessEnv = process.env): string | null {
+  try {
+    const out = execFileSync("gh", ["api", "user", "--jq", ".login"], {
+      env,
+      timeout: 8_000,
+      stdio: ["ignore", "pipe", "ignore"],
+      encoding: "utf-8",
+    }).trim();
+    return parseGithubName(out, "gh api user", "gh") ?? null;
+  } catch {
+    return null;
+  }
+}
+
+export type OwnerGithubResult =
+  | { state: "linked" }
+  | { state: "set"; login: string }
+  | { state: "recorded"; login: string }
+  | { state: "none" };
+
+/**
+ * Record `web.owner_github` from gh when no owner is linked and it isn't
+ * set: `recorded`. Already set: `set`. An owner linked: `linked` (nothing
+ * to do). gh can't say: `none`. Never throws.
+ */
+export function recordOwnerGithub(
+  deps: OwnerGithubDeps = {},
+): OwnerGithubResult {
+  try {
+    if ((deps.ownerLinked ?? (() => readWebOwner() !== null))())
+      return { state: "linked" };
+    const read = deps.read ?? readUserConfig;
+    const cfg = read();
+    const web = { ...((cfg as { web?: Record<string, unknown> }).web ?? {}) };
+    let set: string | undefined;
+    try {
+      set = parseGithubName(
+        web.owner_github,
+        "web.owner_github",
+        "config/local/user.yml",
+      );
+    } catch {
+      return { state: "none" }; // a value someone typed: leave it alone
+    }
+    if (set) return { state: "set", login: set };
+    const login = (deps.ghLogin ?? ghLogin)();
+    if (!login) return { state: "none" };
+    web.owner_github = login;
+    (deps.write ?? writeUserConfig)({ ...cfg, web } as typeof cfg);
+    return { state: "recorded", login };
+  } catch {
+    return { state: "none" };
+  }
+}
+
+/** The line `web up` and `service install` print, or null. */
+export function ownerGithubLine(
+  r: OwnerGithubResult,
+  cli = "den",
+): string | null {
+  if (r.state === "recorded")
+    return `GitHub owner: @${r.login} (from gh; web.owner_github in config/local/user.yml). Connect your GitHub account from any browser to sign in.`;
+  if (r.state === "none") return ghNotSignedInHint(cli);
+  return null;
+}
+
+/** No owner, no web.owner_github, and gh can't say who you are: the fix. */
+export function ghNotSignedInHint(cli = "den"): string {
+  return (
+    "GitHub owner: not known, because gh isn't signed in here. " +
+    `Run \`gh auth login\`, then \`${cli} web restart\`; or set web.owner_github: <your GitHub login> in config/local/user.yml. ` +
+    "Then you can connect your GitHub account from any browser."
+  );
+}

package/src/shared/product.ts

@@ -8,6 +8,9 @@
  * distribution root can be found (e.g. help text printed outside a checkout).
  */
 
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { parse as parseYaml } from "yaml";
 import { getDistRoot } from "./paths.js";
 import {
   loadProfile,
@@ -17,7 +20,11 @@ import {
 } from "./profile.js";
 
 export interface Product extends ProductProfile {
-  /** Display name: the name with its first letter upper-cased ("Den"). */
+  /**
+   * Display name (D11): the org config's brand.name ("Acme Den") when it is
+   * safe to show anywhere (TITLE_SAFE), else the name with its first letter
+   * upper-cased ("Acme-den").
+   */
   title: string;
   /** The YAML manifest file name (".den.yml"). */
   manifestYml: string;
@@ -25,11 +32,43 @@ export interface Product extends ProductProfile {
   manifestJson: string;
 }
 
-function withDerived(p: ProductProfile): Product {
+/**
+ * What a brand.name may hold to be the display title: letters, digits,
+ * spaces, ".", "_" and "-", up to 40. The title is filled into page scripts
+ * (inside "…" and '…' strings) and HTML attributes, so no quote, backslash,
+ * "<" or "&" may reach it (the 0.4.20 hyphen bug's kin).
+ */
+export const TITLE_SAFE = /^[\p{L}\p{N}][\p{L}\p{N} ._-]{0,39}$/u;
+
+/** The name, first letter upper-cased: "acme-den" → "Acme-den". */
+export function nameTitle(name: string): string {
+  return name.charAt(0).toUpperCase() + name.slice(1);
+}
+
+/** The org config's brand.name, trimmed, or undefined. Never throws. */
+export function brandNameAt(root: string | null, configFile: string) {
+  if (!root) return undefined;
+  try {
+    const raw = parseYaml(
+      fs.readFileSync(path.join(root, configFile), "utf-8"),
+    ) as { brand?: { name?: unknown } } | null;
+    const n = raw?.brand?.name;
+    return typeof n === "string" && n.trim() ? n.trim() : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/** The display title: a safe brand.name, else nameTitle. */
+export function titleOf(name: string, brandName?: string): string {
+  return brandName && TITLE_SAFE.test(brandName) ? brandName : nameTitle(name);
+}
+
+function withDerived(p: ProductProfile, root: string | null = null): Product {
   const yml = p.manifestFiles[0];
   return {
     ...p,
-    title: p.name.charAt(0).toUpperCase() + p.name.slice(1),
+    title: titleOf(p.name, brandNameAt(root, p.configFile)),
     manifestYml: yml,
     manifestJson: p.manifestFiles[1] ?? yml.replace(/\.ya?ml$/, "") + ".json",
   };
@@ -40,10 +79,11 @@ let derived: { profile: ProductProfile; product: Product } | null = null;
 /** The running product. Never throws. */
 export function product(): Product {
   try {
-    const profile = loadProfile(getDistRoot());
+    const root = getDistRoot();
+    const profile = loadProfile(root);
     // Same profile object (loadProfile caches it): same derived names.
     if (derived?.profile !== profile)
-      derived = { profile, product: withDerived(profile) };
+      derived = { profile, product: withDerived(profile, root) };
     return derived.product;
   } catch {
     const pinned = process.env.DEN_PROFILE?.trim();

package/src/shared/profile.ts

@@ -58,6 +58,13 @@ interface RawProduct {
 }
 
 const SLUG = /^[a-z][a-z0-9-]*$/;
+/**
+ * A path the pages show (config, manifest, services and workspaces dirs):
+ * letters, digits, ".", "_", "-" and "/". The web pages carry these
+ * names as placeholders filled when served (product.ts productTokens), so
+ * a quote, backslash, "$" or "<" in one would break a page's script.
+ */
+const SAFE_PATH = /^[A-Za-z0-9._/-]+$/;
 const PREFIX = /^[A-Z][A-Z0-9_]*$/;
 
 const str = (v: unknown): string | undefined =>
@@ -83,7 +90,7 @@ export function profileFrom(
   const name = str(raw.name) ?? "den";
   if (!SLUG.test(name))
     throw new Error(
-      `den.yml: product.name "${name}" must be lower-case letters, digits and "-"`,
+      `den.yml: product.name "${name}" must be lower-case letters, digits and "-", starting with a letter`,
     );
   const envPrefix =
     str(raw.env_prefix) ?? name.toUpperCase().replace(/-/g, "_");
@@ -91,11 +98,28 @@ export function profileFrom(
     throw new Error(
       `den.yml: product.env_prefix "${envPrefix}" must be upper-case letters, digits and "_"`,
     );
+  const cli = str(raw.cli) ?? name;
+  if (!SLUG.test(cli))
+    throw new Error(
+      `den.yml: product.cli "${cli}" must be lower-case letters, digits and "-", starting with a letter`,
+    );
+  for (const key of [
+    "config",
+    "manifest",
+    "services_dir",
+    "workspaces_dir",
+  ] as const) {
+    const v = str(raw[key]);
+    if (v !== undefined && !SAFE_PATH.test(v))
+      throw new Error(
+        `den.yml: product.${key} "${v}" may use only letters, digits, ".", "_", "-" and "/"`,
+      );
+  }
   const manifest = str(raw.manifest) ?? `.${name}.yml`;
   const json = manifest.replace(/\.ya?ml$/, ".json");
   return {
     name,
-    cli: str(raw.cli) ?? name,
+    cli,
     envPrefix,
     configFile: str(raw.config) ?? `config/${name}.yml`,
     manifestFiles: json === manifest ? [manifest] : [manifest, json],

package/src/shared/secrets/index.ts

@@ -17,6 +17,12 @@
  */
 import { readDenConfig, readUserConfig } from "../den-config.js";
 import type { DetectResult } from "../strategies/registry.js";
+import { ConfigError } from "../config-error.js";
+import {
+  describeOpTokenSource,
+  opTokenSourceError,
+  parseOpTokenSource,
+} from "./op-token.js";
 import { notConfiguredMessage, SecretsNotConfiguredError } from "./none.js";
 import { secretsStrategy, type SecretsStrategy } from "./strategies.js";
 import type {
@@ -37,6 +43,7 @@ export { notConfiguredMessage, SecretsNotConfiguredError } from "./none.js";
 export { secretsStrategy, secretsStrategyIds } from "./strategies.js";
 export type { SecretsStrategy, SecretsSetupContext } from "./strategies.js";
 export * from "./secret-env.js";
+export * from "./op-token.js";
 
 export interface SecretsConfig {
   provider?: SecretsProviderName;
@@ -48,7 +55,16 @@ export interface SecretsConfig {
    */
   required?: boolean;
   doppler?: { project?: string; config?: string };
-  onepassword?: { account?: string };
+  onepassword?: {
+    account?: string;
+    /**
+     * Where the service-account token comes from: `keychain:<service>`,
+     * `file:<path>` (mode 600) or `env:<VAR>` (the default,
+     * `env:OP_SERVICE_ACCOUNT_TOKEN`). Per machine: read from
+     * config/local/user.yml only, never from the distribution's config.
+     */
+    token?: string;
+  };
   /** `"vault/item/field": FLAT_KEY` overrides for doppler/env. */
   keys?: Record<string, string>;
   /**
@@ -126,11 +142,32 @@ export function readSecretsConfig(): SecretsConfig {
   } catch {
     /* no user config */
   }
+  // The token source is this machine's: the distribution's config never
+  // names one, and a bad one is refused here, naming the key.
+  const tokenErr =
+    user.onepassword?.token === undefined || user.onepassword.token === null
+      ? null
+      : opTokenSourceError(user.onepassword.token);
+  if (tokenErr) {
+    const key = "secrets.onepassword.token";
+    throw new ConfigError([
+      {
+        file: "config/local/user.yml",
+        key,
+        message: tokenErr,
+        text: `${key} ${tokenErr}`,
+      },
+    ]);
+  }
   return {
     ...team,
     ...user,
     doppler: { ...team.doppler, ...user.doppler },
-    onepassword: { ...team.onepassword, ...user.onepassword },
+    onepassword: {
+      ...team.onepassword,
+      ...user.onepassword,
+      token: user.onepassword?.token ?? undefined,
+    },
     keys: { ...team.keys, ...user.keys },
     refs: { ...team.refs, ...user.refs },
   };
@@ -251,6 +288,14 @@ class DetectedProvider implements SecretsProvider {
   async tryGet(ref: SecretRef): Promise<string | null> {
     return this.unavailable() ? null : this.inner.tryGet(ref);
   }
+  async tryGetWithReason(
+    ref: SecretRef,
+  ): Promise<{ value: string | null; reason?: string }> {
+    const why = this.unavailable();
+    if (why) return { value: null, reason: why };
+    if (this.inner.tryGetWithReason) return this.inner.tryGetWithReason(ref);
+    return { value: await this.inner.tryGet(ref) };
+  }
   async set(ref: SecretRef, value: string): Promise<void> {
     const why = this.unavailable();
     if (why) throw new Error(`${this.name} secrets backend ${why}`);
@@ -364,6 +409,24 @@ export function secretsProcessEnv(
   return strategyFor(name).capabilities.env?.(cfg, env) ?? {};
 }
 
+/**
+ * Settings › Secrets: where the 1Password token comes from, as text
+ * ("keychain: <service>", "file: <path>", "env: <VAR>") or "not set". The
+ * source only, never the token; reads nothing from the keychain or the file.
+ */
+export function opTokenSourceSetting(
+  cfg: SecretsConfig | (() => SecretsConfig) = readSecretsConfig,
+): string {
+  try {
+    const raw = (typeof cfg === "function" ? cfg() : cfg).onepassword?.token;
+    return raw === undefined || raw === null
+      ? "not set"
+      : describeOpTokenSource(parseOpTokenSource(raw));
+  } catch {
+    return "invalid: see secrets.onepassword.token";
+  }
+}
+
 /** The engine's own named refs, for the legacy warning. */
 export const ENGINE_SECRET_REFS = ["sudo", "journeys_agent_key"] as const;
 
@@ -379,9 +442,14 @@ export const IMPLICIT_PROVIDER_WARNING =
  * distribution that needs no secrets never hears about it.
  */
 export function secretsConfigWarnings(
-  cfg: SecretsConfig = readSecretsConfig(),
+  cfg?: SecretsConfig,
   env: NodeJS.ProcessEnv = process.env,
 ): string[] {
+  try {
+    cfg ??= readSecretsConfig();
+  } catch (err) {
+    return [(err as Error).message];
+  }
   let r: ResolvedProvider;
   try {
     r = resolveProvider(cfg, env);

package/src/shared/secrets/onepassword.ts

@@ -5,27 +5,95 @@
 import { execFile } from "child_process";
 import { promisify } from "util";
 import type { PreflightResult, SecretRef, SecretsProvider } from "./types.js";
+import {
+  DEFAULT_OP_TOKEN_SOURCE,
+  OP_TOKEN_ENV,
+  OpFailure,
+  mapOpFailure,
+  readOpToken,
+  type OpTokenDeps,
+  type OpTokenSource,
+} from "./op-token.js";
 
 import { product } from "../product.js";
 const execFileAsync = promisify(execFile);
 
 export interface OnePasswordOptions {
   account?: string;
+  /**
+   * Where the service-account token comes from (`secrets.onepassword.token`).
+   * Unset: the default `env:OP_SERVICE_ACCOUNT_TOKEN`, and `op` is run with
+   * this process's own env even when that has none (a signed-in desktop app
+   * still works).
+   */
+  tokenSource?: OpTokenSource;
+  /** Test seam: the env, platform and home the token source is read with. */
+  tokenDeps?: OpTokenDeps;
   timeoutMs?: number;
 }
 
 export class OnePasswordProvider implements SecretsProvider {
   readonly name = "1password" as const;
   private readonly timeout: number;
+  private readonly tokenSource: OpTokenSource | undefined;
+  private readonly tokenDeps: OpTokenDeps | undefined;
 
   constructor(opts: OnePasswordOptions = {}) {
     this.timeout = opts.timeoutMs ?? 60_000;
+    this.tokenSource = opts.tokenSource;
+    this.tokenDeps = opts.tokenDeps;
     if (opts.account) process.env.OP_ACCOUNT ||= opts.account;
   }
 
+  /**
+   * The options for one `op` call. The token is read now (never cached) and
+   * goes only into the child's env. A configured source that yields none
+   * fails with its reason; the default source with no token runs `op` as
+   * before.
+   */
+  private async opOptions(): Promise<{
+    timeout: number;
+    env?: NodeJS.ProcessEnv;
+    token?: string;
+  }> {
+    const explicit = this.tokenSource !== undefined;
+    const t = await readOpToken(
+      this.tokenSource ?? DEFAULT_OP_TOKEN_SOURCE,
+      this.tokenDeps,
+    );
+    if (!t.ok) {
+      if (explicit) throw new OpFailure("token_source", t.reason);
+      return { timeout: this.timeout, env: process.env };
+    }
+    return {
+      timeout: this.timeout,
+      env: { ...process.env, [OP_TOKEN_ENV]: t.token },
+      token: t.token,
+    };
+  }
+
+  /** Run `op`; a failure carries op's reason in plain words, never the token. */
+  private async run(args: string[], rawErrors = false): Promise<string> {
+    const { token, ...opts } = await this.opOptions();
+    try {
+      const { stdout } = await execFileAsync("op", args, opts);
+      return String(stdout);
+    } catch (err) {
+      // `set` keeps op's own error: its caller strips the value it wrote.
+      if (rawErrors) throw err;
+      const e = err as { stderr?: unknown; killed?: boolean; code?: unknown };
+      if (e.killed)
+        throw new OpFailure("unknown", "1Password failed: op timed out");
+      if (e.code === "ENOENT")
+        throw new OpFailure("unknown", "1Password failed: op is not installed");
+      const m = mapOpFailure(String(e.stderr ?? ""), token ? [token] : []);
+      throw new OpFailure(m.code, m.text);
+    }
+  }
+
   async isReady(): Promise<boolean> {
     try {
-      await execFileAsync("op", ["whoami"], { timeout: this.timeout });
+      await this.run(["whoami"]);
       return true;
     } catch {
       return false;
@@ -37,18 +105,26 @@ export class OnePasswordProvider implements SecretsProvider {
     const args = ["item", "get", ref.item];
     if (ref.vault) args.push("--vault", ref.vault);
     args.push("--fields", `label=${ref.field}`, "--reveal");
-    const { stdout } = await execFileAsync("op", args, {
-      timeout: this.timeout,
-    });
-    return String(stdout).trim();
+    return (await this.run(args)).trim();
   }
 
   async tryGet(ref: SecretRef): Promise<string | null> {
+    return (await this.tryGetWithReason(ref)).value;
+  }
+
+  async tryGetWithReason(
+    ref: SecretRef,
+  ): Promise<{ value: string | null; reason?: string }> {
     try {
       const v = await this.get(ref);
-      return v.length > 0 ? v : null;
-    } catch {
-      return null;
+      return v.length > 0
+        ? { value: v }
+        : { value: null, reason: "the field is empty" };
+    } catch (err) {
+      return {
+        value: null,
+        reason: err instanceof OpFailure ? err.message : undefined,
+      };
     }
   }
 
@@ -57,13 +133,10 @@ export class OnePasswordProvider implements SecretsProvider {
     const vault = ref.vault ? ["--vault", ref.vault] : [];
     const field = `${ref.field}[password]=${value}`;
     try {
-      await execFileAsync("op", ["item", "edit", ref.item, ...vault, field], {
-        timeout: this.timeout,
-      });
+      await this.run(["item", "edit", ref.item, ...vault, field], true);
     } catch (err) {
       try {
-        await execFileAsync(
-          "op",
+        await this.run(
           [
             "item",
             "create",
@@ -74,7 +147,7 @@ export class OnePasswordProvider implements SecretsProvider {
             ...vault,
             field,
           ],
-          { timeout: this.timeout },
+          true,
         );
       } catch {
         throw err;