@monster-orange/den 0.4.19 → 0.4.21

package/src/ui/cli/web-command.ts

@@ -1,3 +1,7 @@
+import {
+  ownerGithubLine,
+  recordOwnerGithub,
+} from "../../shared/owner-github.js";
 import chalk from "chalk";
 import { execFileSync, spawn, spawnSync } from "child_process";
 import * as fs from "fs";
@@ -27,6 +31,7 @@ import {
   ignoredConfigWarning,
   localhostOrigin,
   loginLink,
+  LOGIN_CODE_TTL_MS,
   mintLoginCode,
   parseOrigin,
   readWebAuthConfig,
@@ -1182,7 +1187,7 @@ export function displayWebHelp(): void {
     "  open               Start if needed, and sign this browser in (a new tab)",
   );
   console.log(
-    "  login              Print a one-time sign-in link (60 s) and its code, then wait until it's used",
+    "  login              Print a one-time sign-in link (5 min; web.login_link_ttl) and its code, then wait until it's used",
   );
   console.log("  sessions           List the signed-in browsers");
   console.log(
@@ -1330,6 +1335,13 @@ export async function cmdWeb(args: string[]): Promise<void> {
     return;
   }
 
+  // D17: whoever starts it can connect their GitHub account from any
+  // browser (web.owner_github, from gh), before the server reads it.
+  if (options.action === "up" || options.action === "restart") {
+    const line = ownerGithubLine(recordOwnerGithub(), product().cli);
+    if (line) console.log(chalk.dim(`\n  ${line}`));
+  }
+
   if (options.action === "restart") {
     const stopped = await stopDenWebServer(options.port, vouched);
     if (stopped.pids.length > 0 && !stopped.stopped) {
@@ -1411,7 +1423,8 @@ export async function cmdWeb(args: string[]): Promise<void> {
     return;
   }
 
-  // SEC-1b: what opens is a sign-in link (localhost, one-time, 60 s). It
+  // SEC-1b: what opens is a sign-in link (localhost, one-time, D16:
+  // web.login_link_ttl). It
   // is printed only when the browser couldn't be opened: the one line the
   // person then needs.
   // Inside an agent's session: the plain page, never a sign-in link.
@@ -1453,7 +1466,9 @@ export async function cmdWeb(args: string[]): Promise<void> {
   } else {
     console.log(chalk.yellow("\n  Could not open a browser automatically."));
   }
-  console.log(`  Sign in (once, within 60 s): ${signIn()}\n`);
+  console.log(
+    `  Sign in (once, within ${ttlText(loginLinkTtl())}): ${signIn()}\n`,
+  );
 }
 
 // ── SEC-1b: sign-in (`web login`, `web sessions`, `web logout`) ─────────────
@@ -1467,7 +1482,11 @@ export function freshLoginLink(
 ): string {
   const refused = personGrantRefusal(process.env);
   if (refused) throw new Error(refused);
-  return loginLink(origin, mintLoginCode(ensureWebSecret(stateDir)), next);
+  return loginLink(
+    origin,
+    mintLoginCode(ensureWebSecret(stateDir), Date.now(), loginLinkTtl()),
+    next,
+  );
 }
 
 /**
@@ -1616,7 +1635,8 @@ function parseLoginArgs(
 
 const LOGIN_HELP = () =>
   LOGIN_USAGE() +
-  "  Prints a one-time sign-in link (open it within 60 s) for one browser, and a\n" +
+  "  Prints a one-time sign-in link (open it within web.login_link_ttl, 5 minutes\n" +
+  "  unless set) for one browser, and a\n" +
   "  code the page behind the link asks for, then waits until the link is used:\n" +
   '  "Signed in: <browser> (<address>) at <time>", or "Expired: nobody used the\n' +
   '  link" (exit 1). On localhost nothing asks for a sign-in; it is needed when\n' +
@@ -1655,12 +1675,36 @@ export function cmdWebLogin(args: string[], io: CliIo = stdIo): number {
     io.stateDir ?? getStateDir(),
   );
   io.err(
-    `${product().cli}: open this link within 60 seconds; it signs in one browser, once.\n`,
+    `${product().cli}: open this link within ${ttlText(loginLinkTtl())}; it signs in one browser, once.\n`,
   );
   io.out(`${link}\n`);
   return 0;
 }
 
+/** D16: web.login_link_ttl, read now (LOGIN_CODE_TTL_MS when unreadable). */
+export function loginLinkTtl(): number {
+  try {
+    return readWebAuthConfig(getDistRoot(), product().configFile)
+      .loginLinkTtlMs;
+  } catch {
+    return LOGIN_CODE_TTL_MS;
+  }
+}
+
+/** "5 minutes", "90 seconds", "1 minute". */
+export function ttlText(ms: number): string {
+  const s = Math.round(ms / 1000);
+  if (s % 60 !== 0) return `${s} seconds`;
+  const m = s / 60;
+  return m === 1 ? "1 minute" : `${m} minutes`;
+}
+
+/** D16: the countdown's text, "4:59 left". */
+export function countdownLeft(ms: number): string {
+  const s = Math.max(0, Math.ceil(ms / 1000));
+  return `${Math.floor(s / 60)}:${String(s % 60).padStart(2, "0")} left`;
+}
+
 /** "10:42" in this machine's time. */
 function clockTime(iso: string): string {
   const d = new Date(iso);
@@ -1680,7 +1724,7 @@ function clockTime(iso: string): string {
 export async function cmdWebLoginWait(
   args: string[],
   io: CliIo = stdIo,
-  opts: { pollMs?: number; maxWaitMs?: number } = {},
+  opts: { pollMs?: number; maxWaitMs?: number; countdown?: boolean } = {},
 ): Promise<number> {
   if (isHelp(args)) {
     io.out(LOGIN_HELP());
@@ -1701,7 +1745,8 @@ export async function cmdWebLoginWait(
   const stateDir = io.stateDir ?? getStateDir();
   const secret = ensureWebSecret(stateDir);
   const now = Date.now();
-  const loginCode = mintLoginCode(secret, now);
+  const ttl = loginLinkTtl();
+  const loginCode = mintLoginCode(secret, now, ttl);
   const checked = checkLoginCode(loginCode, secret, now);
   if (!checked.ok) {
     io.err(`${product().cli}: could not make a sign-in link\n`);
@@ -1722,7 +1767,7 @@ export async function cmdWebLoginWait(
     io.err(
       `${product().cli}: no ${product().title} web server answers on port ${a.port}, so this ` +
         "doesn't wait and the link asks for no code (as --no-wait). Start the server " +
-        `(\`${product().cli} web up\`), then open this link within 60 seconds; it signs in one browser, once.\n`,
+        `(\`${product().cli} web up\`), then open this link within ${ttlText(ttl)}; it signs in one browser, once.\n`,
     );
     io.out(`${link}\n`);
     return 0;
@@ -1733,15 +1778,23 @@ export async function cmdWebLoginWait(
     return 1;
   }
   io.err(
-    `${product().cli}: open this link within 60 seconds, in the browser to sign in. ` +
+    `${product().cli}: open this link within ${ttlText(ttl)}, in the browser to sign in. ` +
       `It asks for this code: ${confirm}\n`,
   );
   io.out(`${link}\n`);
-  io.err(`${product().cli}: waiting for the link to be used…\n`);
+  // D16: on a terminal, the time left, in place.
+  const tty = opts.countdown ?? (io === stdIo && !!process.stderr.isTTY);
+  const waiting = `${product().cli}: waiting for the link to be used…`;
+  const tick = () =>
+    io.err(`\r${waiting} ${countdownLeft(checked.expiresAt - Date.now())} `);
+  if (tty) tick();
+  else io.err(`${waiting}\n`);
   const pollMs = opts.pollMs ?? 1000;
-  const deadline = Date.now() + (opts.maxWaitMs ?? 7 * 60_000);
+  // The link's own time, then the 5 minutes an opened link has for its code.
+  const deadline = Date.now() + (opts.maxWaitMs ?? ttl + 6 * 60_000);
   for (;;) {
     await new Promise((r) => setTimeout(r, pollMs));
+    if (tty) tick();
     const r = await serverCall(
       stateDir,
       a.port,
@@ -1754,6 +1807,15 @@ export async function cmdWebLoginWait(
       client?: string;
       usedAt?: string;
     };
+    // The countdown's line ends before the outcome's.
+    const over =
+      !r ||
+      j.state === "used" ||
+      j.state === "refused" ||
+      j.state === "expired" ||
+      r.status === 404 ||
+      Date.now() > deadline;
+    if (tty && over) io.err("\n");
     if (r && j.state === "used") {
       io.out(
         `Signed in: ${j.device ?? "a browser"}${j.client ? ` (${j.client})` : ""}` +

package/src/ui/server/device-flows.ts

@@ -22,8 +22,29 @@ import { GITHUB_DEVICE_PAGE } from "../../shared/github-app.js";
 import type {
   GithubDeviceClient,
   GithubIdentity,
+  OrgMembership,
 } from "../../shared/github-device.js";
 
+/** What `decide` may ask while the token is still held (D17). */
+export interface DecideContext {
+  /**
+   * D17: the sign-in started with this machine's proof ("This is my
+   * computer", attest-code.ts).
+   */
+  local: boolean;
+  /** Whether the approving account is a member of `org`. */
+  orgMember(org: string): Promise<OrgMembership>;
+}
+
+/** What an identity means: ok, or refused (with why, for the page). */
+export type Decision = "ok" | "refused" | { refused: string };
+
+export type Decide = (
+  purpose: FlowPurpose,
+  identity: GithubIdentity,
+  ctx: DecideContext,
+) => Decision | Promise<Decision>;
+
 export type FlowPurpose = "signin" | "link";
 export type FlowState =
   | "pending"
@@ -43,7 +64,7 @@ export interface FlowView {
   expiresAt: number;
   /** ok or refused: the GitHub login that approved it. */
   login?: string;
-  /** error: what went wrong (no secret in it). */
+  /** error: what went wrong; refused: why, when the decision said (no secret in it). */
   message?: string;
 }
 
@@ -53,6 +74,8 @@ interface Flow extends FlowView {
   errors: number;
   /** ok: who approved it (the id, for the caller). */
   identity?: GithubIdentity;
+  /** D17: started with this machine's proof. */
+  local: boolean;
   /** When a finished flow is forgotten. */
   forgetAt?: number;
   cancel?: () => void;
@@ -81,18 +104,12 @@ export class DeviceFlows {
   private readonly max: number;
   private readonly minIntervalMs: number;
   private readonly onExpiringToken?: () => void;
-  private readonly decide: (
-    purpose: FlowPurpose,
-    identity: GithubIdentity,
-  ) => "ok" | "refused";
+  private readonly decide: Decide;
 
   constructor(opts: {
     client: GithubDeviceClient;
     clientId: () => string;
-    decide: (
-      purpose: FlowPurpose,
-      identity: GithubIdentity,
-    ) => "ok" | "refused";
+    decide: Decide;
     now?: () => number;
     schedule?: Schedule;
     max?: number;
@@ -126,6 +143,7 @@ export class DeviceFlows {
    */
   async start(
     purpose: FlowPurpose,
+    meta: { local?: boolean } = {},
   ): Promise<FlowView | { error: "busy" | "no_client_id" }> {
     const clientId = this.clientId();
     if (!clientId) return { error: "no_client_id" };
@@ -142,6 +160,7 @@ export class DeviceFlows {
       deviceCode: "",
       intervalMs: this.minIntervalMs,
       errors: 0,
+      local: meta.local === true,
     };
     this.flows.set(id, placeholder);
     let code;
@@ -240,10 +259,26 @@ export class DeviceFlows {
         } catch (e) {
           return this.finish(f, "error", { message: (e as Error).message });
         }
-        const outcome = this.decide(f.purpose, identity);
+        let decision: Decision;
+        try {
+          // The token is still only for this flow's own calls, then dropped.
+          const token = r.token;
+          decision = await this.decide(f.purpose, identity, {
+            local: f.local,
+            orgMember: (org) =>
+              this.client.orgMember(token, org, identity.login),
+          });
+        } catch (e) {
+          return this.finish(f, "error", { message: (e as Error).message });
+        }
+        if (this.flows.get(id) !== f || f.state !== "pending") return;
+        const outcome = typeof decision === "string" ? decision : "refused";
         return this.finish(f, outcome, {
           login: identity.login,
           ...(outcome === "ok" ? { identity } : {}),
+          ...(typeof decision === "object"
+            ? { message: decision.refused }
+            : {}),
         });
       }
     }

package/src/ui/server/github-routes.ts

@@ -23,7 +23,62 @@ import {
   readWebOwner,
   writeWebOwner,
 } from "../../shared/web-owner.js";
-import type { DeviceFlows, FlowView } from "./device-flows.js";
+import type {
+  Decide,
+  Decision,
+  DeviceFlows,
+  FlowView,
+} from "./device-flows.js";
+
+/**
+ * D17: who may claim a Den that has no owner yet.
+ *  - `ownerGithub` (web.owner_github, recorded from `gh` where the
+ *    instance was started): that login, from any machine.
+ *  - `allowedGithubOrg` (web.allowed_github_org, the distribution's): a
+ *    member of the org, only with this machine's proof (a session, which
+ *    on a fresh Den only "This is my computer" or a terminal gives): the
+ *    owner link, never the signed-out sign-in.
+ * Anyone else is refused, with why. Neither set: nobody claims from the
+ * browser; the page names the settings.
+ */
+export interface ClaimRules {
+  ownerGithub?: string;
+  allowedGithubOrg?: string;
+  /** The file web.allowed_github_org is in (for the messages). */
+  allowedGithubOrgFile?: string;
+}
+
+const sameLogin = (a: string, b: string | undefined) =>
+  !!b && a.toLowerCase() === b.toLowerCase();
+
+/** Why a signed-out GitHub sign-in can't claim a Den with no owner. */
+export function unclaimedSigninReason(
+  login: string | null,
+  r: ClaimRules,
+): string {
+  const who = login ? `@${login}` : "This account";
+  if (r.allowedGithubOrg)
+    return (
+      `${who} can't claim this Den from here: it has no owner yet. ` +
+      `A member of the ${r.allowedGithubOrg} GitHub org claims it on the computer it runs on: ` +
+      `open this page there and choose This is my computer.` +
+      (r.ownerGithub
+        ? ` From another computer, only @${r.ownerGithub} (web.owner_github) can.`
+        : "")
+    );
+  if (r.ownerGithub)
+    return `${who} isn't the account this Den was started by (@${r.ownerGithub}, web.owner_github). Sign in as @${r.ownerGithub}.`;
+  return noRuleMessage(r);
+}
+
+/** Neither rule is set: the settings that would let someone claim it. */
+export function noRuleMessage(r: ClaimRules): string {
+  return (
+    "This Den has no owner yet, and nothing says who may claim it. " +
+    `Set web.allowed_github_org (your GitHub org) in ${r.allowedGithubOrgFile ?? "the distribution config"}, ` +
+    "or web.owner_github (your GitHub login) in config/local/user.yml on the computer it runs on."
+  );
+}
 
 export interface GithubRouteDeps {
   flows: DeviceFlows;
@@ -47,23 +102,76 @@ export interface GithubRouteDeps {
   log: (line: string) => void;
   /** Where the owner file lives (the server's state dir). */
   stateDir: () => string;
+  /** D17: who may claim a Den with no owner (read now). */
+  claimRules?: () => ClaimRules;
+  /**
+   * D17: spend a "This is my computer" code (attest-code.ts) for this
+   * request's host: true once, for a valid one.
+   */
+  spendAttest?: (req: http.IncomingMessage, code: string) => boolean;
 }
 
 const SIGNIN_PATH = /^\/api\/github\/signin\/([A-Za-z0-9_-]{16,64})$/;
 const LINK_PATH = /^\/api\/web\/owner\/link\/([A-Za-z0-9_-]{16,64})$/;
 
-/** What an identity means for a flow: the owner's sign-in, or the owner's link. */
+/**
+ * What an identity means for a flow: the owner's sign-in, or the owner's
+ * link; with no owner yet, a claim by ClaimRules (D17).
+ */
 export function decideFlow(
   stateDir: () => string,
   log: (line: string) => void,
-): (
-  purpose: "signin" | "link",
-  identity: { id: number; login: string },
-) => "ok" | "refused" {
-  return (purpose, identity) => {
+  rules: () => ClaimRules = () => ({}),
+): Decide {
+  /** Link `identity` as the owner unless one appeared meanwhile. */
+  const claim = (
+    identity: { id: number; login: string },
+    how: string,
+  ): "ok" | "refused" => {
+    const now = readWebOwner(stateDir());
+    if (now)
+      return now.owner === githubPrincipal(identity.id) ? "ok" : "refused";
+    writeWebOwner(identity, stateDir());
+    log(`  ✓ owner linked: @${identity.login} (${how})`);
+    return "ok";
+  };
+  /** A member of `org` claims it; anyone else is refused, with why. */
+  const memberClaim = async (
+    identity: { id: number; login: string },
+    org: string,
+    ctx: { orgMember(org: string): Promise<string> },
+  ): Promise<Decision> => {
+    const m = await ctx.orgMember(org);
+    if (m === "member") return claim(identity, `member of ${org}`);
+    log(
+      `  ✗ owner claim refused: @${identity.login} ${m === "not_member" ? "isn't a member of" : "has no readable membership in"} ${org}`,
+    );
+    return {
+      refused:
+        m === "not_member"
+          ? `@${identity.login} isn't a member of the ${org} GitHub org (web.allowed_github_org), so it can't own this Den.`
+          : `Den couldn't tell whether @${identity.login} is a member of ${org}: the membership is private, and the GitHub App can't read it. ` +
+            `Either make your membership public (github.com/orgs/${org}/people), or have an ${org} org admin grant the GitHub App Members (read) access. ` +
+            `Or set web.owner_github: ${identity.login} in config/local/user.yml on this computer (\`gh auth login\` before \`web up\` does it for you).`,
+    };
+  };
+  return async (purpose, identity, ctx) => {
     const owner = readWebOwner(stateDir());
+    const r = rules();
+    const named = sameLogin(identity.login, r.ownerGithub);
     if (purpose === "signin") {
-      const ok = owner?.owner === githubPrincipal(identity.id);
+      if (!owner) {
+        // D17: the login web.owner_github names claims it from anywhere;
+        // a member of the org, only with this machine's proof.
+        if (named) return claim(identity, "web.owner_github");
+        if (r.allowedGithubOrg && ctx.local)
+          return memberClaim(identity, r.allowedGithubOrg, ctx);
+        log(
+          `  ✗ GitHub sign-in refused: @${identity.login} can't claim this Den (no owner yet)`,
+        );
+        return { refused: unclaimedSigninReason(identity.login, r) };
+      }
+      const ok = owner.owner === githubPrincipal(identity.id);
       log(
         ok
           ? `  ✓ signed in with GitHub (@${identity.login})`
@@ -72,9 +180,19 @@ export function decideFlow(
       return ok ? "ok" : "refused";
     }
     if (owner) return "refused";
-    writeWebOwner(identity, stateDir());
-    log(`  ✓ owner linked: @${identity.login}`);
-    return "ok";
+    // The link: a signed-in session (this machine's proof on a fresh Den).
+    if (named) return claim(identity, "web.owner_github");
+    if (r.allowedGithubOrg)
+      return memberClaim(identity, r.allowedGithubOrg, ctx);
+    if (r.ownerGithub) {
+      log(
+        `  ✗ owner link refused: @${identity.login} isn't web.owner_github (@${r.ownerGithub})`,
+      );
+      return {
+        refused: `@${identity.login} isn't the account this Den was started by (@${r.ownerGithub}, web.owner_github). Link @${r.ownerGithub}, or change web.owner_github in config/local/user.yml.`,
+      };
+    }
+    return claim(identity, "linked in Settings");
   };
 }
 
@@ -97,6 +215,7 @@ function flowJson(v: FlowView): Record<string, unknown> {
 function finishedMessage(v: FlowView, cli: string): string | undefined {
   switch (v.state) {
     case "refused":
+      if (v.message) return v.message;
       return v.purpose === "signin"
         ? `@${v.login} isn't the owner of this Den. Only the owner's account can use Sign in with GitHub. Use Approve this computer instead.`
         : `An owner is linked already; \`${cli} web owner unlink\` first.`;
@@ -115,10 +234,11 @@ async function startFlow(
   deps: GithubRouteDeps,
   res: http.ServerResponse,
   purpose: "signin" | "link",
+  meta: { local?: boolean } = {},
 ): Promise<void> {
   let r;
   try {
-    r = await deps.flows.start(purpose);
+    r = await deps.flows.start(purpose, meta);
   } catch (e) {
     return deps.sendJson(
       res,
@@ -167,19 +287,52 @@ export async function handleGithubRoutes(
 
   // ── Sign in with GitHub ──────────────────────────────────────────────
   if (pathname === "/api/github/signin" && method === "POST") {
-    if (!readWebOwner(deps.stateDir())) {
+    // D17: "This is my computer"'s code, if the page has one (the body's
+    // `attest`): spent here, once, for this host.
+    let body: { attest?: unknown } = {};
+    try {
+      body = (JSON.parse((await deps.readBody(req)) || "{}") ??
+        {}) as typeof body;
+    } catch {
+      body = {};
+    }
+    const attest = typeof body.attest === "string" ? body.attest : "";
+    const local = !!attest && !!deps.spendAttest?.(req, attest);
+    if (attest && !local) {
+      deps.sendJson(
+        res,
+        {
+          ok: false,
+          code: "attest_failed",
+          error:
+            "This browser isn't on the computer this Den runs on, or its proof expired. Try This is my computer again, on that computer.",
+        },
+        403,
+      );
+      return true;
+    }
+    // D17: with no owner, web.owner_github's login may claim it from
+    // anywhere; a member of web.allowed_github_org, with this machine's proof.
+    const rules = deps.claimRules?.() ?? {};
+    if (
+      !readWebOwner(deps.stateDir()) &&
+      !rules.ownerGithub &&
+      !(local && rules.allowedGithubOrg)
+    ) {
       deps.sendJson(
         res,
         {
           ok: false,
-          code: "no_owner",
-          error: `This Den has no owner yet. On the machine it runs on, run \`${deps.cli} web owner link\`.`,
+          code: rules.allowedGithubOrg ? "claim_here" : "no_owner",
+          error: rules.allowedGithubOrg
+            ? unclaimedSigninReason(null, rules)
+            : `${noRuleMessage(rules)} Or, on that computer, run \`${deps.cli} web owner link\`.`,
         },
         409,
       );
       return true;
     }
-    await startFlow(deps, res, "signin");
+    await startFlow(deps, res, "signin", { local });
     return true;
   }
   const s = SIGNIN_PATH.exec(pathname);