@monster-orange/den 0.4.19 → 0.4.21

package/src/ui/server/public/settings-registry.js

@@ -81,6 +81,13 @@ export const DEN_SETTING_CATEGORIES = [
     description:
       "Reach this Den from your other devices: sign in with GitHub as its owner, or pair a device with a one-time link. On localhost nothing asks.",
   },
+  {
+    id: "secrets",
+    label: "Secrets",
+    order: 58,
+    description:
+      "Where this machine gets the credentials Den resolves secrets with. Per machine (config/local/user.yml); only the source is shown, never a secret.",
+  },
   {
     id: "cli",
     label: "Command line",
@@ -418,7 +425,7 @@ function drawPair(host, ctx) {
             out.innerHTML =
               `<div style="display:flex;gap:16px;flex-wrap:wrap;align-items:flex-start;margin-top:8px">` +
               `<div id="set-pair-qr" style="line-height:0">${qrSvg(p.url, { scale: 4, margin: 4 })}</div>` +
-              `<div style="flex:1 1 220px;min-width:0"><p class="set-note" style="margin:0 0 8px">Scan it with the other device, or open the link there. It works once, within 60 seconds, and signs that browser in for good.</p>` +
+              `<div style="flex:1 1 220px;min-width:0"><p class="set-note" style="margin:0 0 8px">Scan it with the other device, or open the link there. It works once, until it expires (below), and signs that browser in for good.</p>` +
               `<a id="set-pair-link" href="${escHtml(p.url)}" style="font:12px var(--mono);overflow-wrap:anywhere">${escHtml(p.url)}</a>` +
               `<p class="set-note" id="set-pair-left" style="margin:8px 0 0"></p></div></div>`;
             const until = Date.parse(p.expiresAt);
@@ -1033,6 +1040,21 @@ export const DEN_SETTINGS = [
     read: () => null,
   },
 
+  {
+    // 1Password for a Den running as a service: where its service-account
+    // token comes from (secrets.onepassword.token in user.yml). The source
+    // only, never the token.
+    id: "cli.op_token",
+    category: "secrets",
+    label: "1Password token source",
+    description:
+      "Where this machine's 1Password service-account token comes from, for a Den running as a service. Set secrets.onepassword.token in config/local/user.yml: keychain:<service>, file:<path> or env:<VAR>. The token itself is never shown.",
+    keywords: ["secrets", "1password", "op", "service account", "token"],
+    scope: "user",
+    control: { type: "readonly" },
+    read: (ctx) => ctx.data.op_token_source ?? "not set",
+  },
+
   ...ACCESS_ROWS,
 
   // ── Distribution (read-only) ───────────────────────────────────────────

package/src/ui/server/public/shell.js

@@ -420,6 +420,16 @@
     "err.signin.ghOnly":
       "Only the owner's GitHub account can sign in this way. For anyone else, use Approve this computer.",
     "err.signin.ghLearn": "Learn more",
+    "err.signin.claimTitle": "Connect your GitHub account",
+    "err.signin.claimLead":
+      "{name} has no owner yet. Connect your GitHub account to make it yours.",
+    "err.signin.claimOrg":
+      "Members of the {org} GitHub org can claim it, in a browser on {host}.",
+    "err.signin.claimHere": "This is my computer: connect GitHub",
+    "err.signin.claimAs": "Sign in as @{login}",
+    "err.signin.claimHereNote":
+      "This is my computer works only in a browser on {host}. Anywhere else it opens nothing.",
+    "err.signin.claimChecking": "Checking this is {host}…",
     "err.signin.githubRefused":
       "@{login} isn't the owner of this {name}. Only the owner's account can use Sign in with GitHub. Use Approve this computer instead.",
     "err.signin.approveOr": "Or approve this computer",
@@ -467,7 +477,6 @@
     "err.signin.github": "Sign in with GitHub",
     "err.signin.githubEnter": "Enter this code at {url}:",
     "err.signin.githubOpen": "Open GitHub",
-    "err.signin.githubCopy": "Copy code",
     "err.signin.githubWaiting": "Waiting for you to approve it on GitHub…",
     "err.signin.githubDone": "Signed in. Loading…",
     "err.signin.githubExpired": "The code expired before it was approved.",
@@ -516,6 +525,7 @@
     "set.cli.web_port": "Your web port",
     "set.cli.signin": "Browser sign-in",
     "set.cli.sudo": "Admin password",
+    "set.cli.op_token": "1Password token source",
     "set.access.owner": "Owner",
     "set.access.devices": "Linked devices",
     "ident.local": "Local",

package/src/ui/server/route-classes.ts

@@ -243,6 +243,10 @@ export const ROUTES: readonly RouteEntry[] = [
     "/signin",
     "the signed-out landing page (§6b.3): it renders signed out; signed in, it goes on to `next`",
   ),
+  R(
+    "/attest",
+    'D17: "This is my computer", on localhost only: a 303 back to one of this server\'s edge hosts with a short-lived code (it never makes a session)',
+  ),
   M(["POST"], "/api/session/logout", "ends this browser's session"),
   S(
     ["GET", "HEAD"],
@@ -452,6 +456,9 @@ export const SIGNIN_FREE: readonly string[] = [
   "/auth",
   "/signin",
   "/api/session",
+  // D17: "This is my computer" answers for itself: on localhost a 303,
+  // anywhere else its own "only on this computer" page (never a code).
+  "/attest",
   // SEC-2a: Sign in with GitHub, from the signed-out page.
   "/api/github/signin",
   "/api/github/signin/:id",