@monster-orange/den 0.4.20 → 0.4.21

package/src/ui/cli/doctor-owner.ts

@@ -0,0 +1,122 @@
+/**
+ * doctor's owner check (D17): who can connect their GitHub account to this
+ * instance from the browser.
+ *
+ *  - An owner is linked: ok, naming it.
+ *  - No owner, but web.owner_github or web.allowed_github_org says who may
+ *    claim it: ok, naming them.
+ *  - Neither, and the edge is reachable from other machines: ✗ (a fail):
+ *    nobody can get in from a browser there, and the page can only name
+ *    the settings.
+ *  - Neither, edge not reachable beyond this machine: a warning.
+ */
+import { readWebOwner } from "../../shared/web-owner.js";
+import {
+  readWebAuthConfig,
+  type WebAuthConfig,
+} from "../../shared/web-session.js";
+import { getDistRoot, getStateDir } from "../../shared/paths.js";
+import { product } from "../../shared/product.js";
+import { readEdgeConfig, readWebPort } from "../../shared/edge/config.js";
+import { edgeNames, webRouteHosts } from "../../shared/edge/render.js";
+import { edgeExposure } from "../../shared/edge/exposure.js";
+import type { OnboardCheck } from "./doctor-onboard.js";
+import { ghLogin, ghNotSignedInHint } from "../../shared/owner-github.js";
+
+export interface OwnerCheckDeps {
+  owner?: () => { login: string } | null;
+  web?: () => WebAuthConfig;
+  /** Why the edge is reachable beyond this machine, or null. */
+  exposed?: () => Promise<string | null>;
+  configFile?: string;
+  /** The login gh is signed in as here, or null (default: ask gh). */
+  ghLogin?: () => string | null;
+}
+
+/**
+ * What to do when web.owner_github isn't set: gh is signed in but nothing
+ * recorded it yet (a restart does), or gh isn't signed in.
+ */
+export function ownerGithubHint(login: string | null, cli: string): string {
+  return login
+    ? `gh is signed in as @${login}: run \`${cli} web restart\` to record it as this Den's owner (web.owner_github), then connect your GitHub account from any browser.`
+    : ghNotSignedInHint(cli);
+}
+
+async function defaultExposed(): Promise<string | null> {
+  try {
+    const cfg = readEdgeConfig();
+    const hosts = webRouteHosts(cfg, new Set([readWebPort()])).map(
+      (r) => r.host,
+    );
+    return await edgeExposure(
+      hosts,
+      cfg.ports ? edgeNames(cfg.org).container : null,
+    );
+  } catch {
+    return null; // no edge
+  }
+}
+
+export async function ownerCheck(
+  deps: OwnerCheckDeps = {},
+): Promise<OnboardCheck> {
+  const owner = (deps.owner ?? (() => readWebOwner(getStateDir())))();
+  if (owner)
+    return {
+      id: "web:owner",
+      status: "ok",
+      detail: `owner: @${owner.login} (linked; Sign in with GitHub from any browser)`,
+    };
+  let web: WebAuthConfig;
+  try {
+    web = (
+      deps.web ?? (() => readWebAuthConfig(getDistRoot(), product().configFile))
+    )();
+  } catch (e) {
+    return { id: "web:owner", status: "fail", detail: (e as Error).message };
+  }
+  const configFile = deps.configFile ?? product().configFile;
+  const who = [
+    ...(web.ownerGithub
+      ? [`@${web.ownerGithub} from any browser (web.owner_github)`]
+      : []),
+    ...(web.allowedGithubOrg
+      ? [
+          `a member of ${web.allowedGithubOrg} on this computer (web.allowed_github_org)`,
+        ]
+      : []),
+  ];
+  // D17: owner_github carries most people (org memberships are usually
+  // private); without it, say how to get it.
+  const ghHint = web.ownerGithub
+    ? {}
+    : { ask: ownerGithubHint((deps.ghLogin ?? ghLogin)(), product().cli) };
+  if (who.length)
+    return {
+      id: "web:owner",
+      status: "ok",
+      detail: `no owner yet; who may connect GitHub to claim it: ${who.join(", or ")}`,
+      ...ghHint,
+    };
+  const exposed = await (deps.exposed ?? defaultExposed)();
+  // Only this machine reaches it: a note, not a warning (every fresh
+  // install starts this way, D12).
+  return {
+    id: "web:owner",
+    status: exposed ? "fail" : "ok",
+    detail:
+      `no owner, and nothing says who may claim it, so nobody can connect GitHub from the browser` +
+      (exposed
+        ? `; the edge is reachable from other machines (${exposed})`
+        : ""),
+    ask: `Which GitHub org's members may claim it (web.allowed_github_org in ${configFile}), or which GitHub login runs it here (web.owner_github in config/local/user.yml)?`,
+  };
+}
+
+/** The check as doctor prints it. */
+export function ownerLine(c: OnboardCheck): string {
+  const mark =
+    c.status === "fail" ? "✗" : c.status === "warn" ? "⚠" : c.ask ? "ℹ" : "✓";
+  return `  ${mark} ${c.detail}${c.ask ? `\n    ${c.ask}` : ""}`;
+}

package/src/ui/cli/service-command.ts

@@ -15,6 +15,11 @@
  * port, and writes and loads nothing; exit 1 when that server is foreign.
  * `status` also names a foreign server on the port.
  */
+import {
+  ownerGithubLine,
+  recordOwnerGithub,
+  type OwnerGithubResult,
+} from "../../shared/owner-github.js";
 import { spawnSync } from "child_process";
 import * as os from "os";
 import * as path from "path";
@@ -100,6 +105,8 @@ export async function waitForServerInfo(
 
 export interface ServiceDeps {
   run?: ServiceRunner;
+  /** D17: record web.owner_github (default: from gh, unless `run` is a test's). */
+  recordOwner?: () => OwnerGithubResult;
   config?: DenConfig;
   distRoot?: string;
   engineRoot?: string;
@@ -214,6 +221,15 @@ export async function cmdService(
     return 0;
   }
 
+  // D17: whoever installs it can connect their GitHub account from any
+  // browser (web.owner_github, from gh), before the server reads it.
+  if (sub === "install") {
+    const rec =
+      deps.recordOwner ??
+      (deps.run ? () => ({ state: "linked" as const }) : recordOwnerGithub);
+    const line = ownerGithubLine(rec(), product().cli);
+    if (line) log(line);
+  }
   const code = run("bash", [script, sub!], {
     ...env,
     // The script then leaves saying "running" to us (after the poll below).

package/src/ui/cli/web-command.ts

@@ -1,3 +1,7 @@
+import {
+  ownerGithubLine,
+  recordOwnerGithub,
+} from "../../shared/owner-github.js";
 import chalk from "chalk";
 import { execFileSync, spawn, spawnSync } from "child_process";
 import * as fs from "fs";
@@ -27,6 +31,7 @@ import {
   ignoredConfigWarning,
   localhostOrigin,
   loginLink,
+  LOGIN_CODE_TTL_MS,
   mintLoginCode,
   parseOrigin,
   readWebAuthConfig,
@@ -1182,7 +1187,7 @@ export function displayWebHelp(): void {
     "  open               Start if needed, and sign this browser in (a new tab)",
   );
   console.log(
-    "  login              Print a one-time sign-in link (60 s) and its code, then wait until it's used",
+    "  login              Print a one-time sign-in link (5 min; web.login_link_ttl) and its code, then wait until it's used",
   );
   console.log("  sessions           List the signed-in browsers");
   console.log(
@@ -1330,6 +1335,13 @@ export async function cmdWeb(args: string[]): Promise<void> {
     return;
   }
 
+  // D17: whoever starts it can connect their GitHub account from any
+  // browser (web.owner_github, from gh), before the server reads it.
+  if (options.action === "up" || options.action === "restart") {
+    const line = ownerGithubLine(recordOwnerGithub(), product().cli);
+    if (line) console.log(chalk.dim(`\n  ${line}`));
+  }
+
   if (options.action === "restart") {
     const stopped = await stopDenWebServer(options.port, vouched);
     if (stopped.pids.length > 0 && !stopped.stopped) {
@@ -1411,7 +1423,8 @@ export async function cmdWeb(args: string[]): Promise<void> {
     return;
   }
 
-  // SEC-1b: what opens is a sign-in link (localhost, one-time, 60 s). It
+  // SEC-1b: what opens is a sign-in link (localhost, one-time, D16:
+  // web.login_link_ttl). It
   // is printed only when the browser couldn't be opened: the one line the
   // person then needs.
   // Inside an agent's session: the plain page, never a sign-in link.
@@ -1453,7 +1466,9 @@ export async function cmdWeb(args: string[]): Promise<void> {
   } else {
     console.log(chalk.yellow("\n  Could not open a browser automatically."));
   }
-  console.log(`  Sign in (once, within 60 s): ${signIn()}\n`);
+  console.log(
+    `  Sign in (once, within ${ttlText(loginLinkTtl())}): ${signIn()}\n`,
+  );
 }
 
 // ── SEC-1b: sign-in (`web login`, `web sessions`, `web logout`) ─────────────
@@ -1467,7 +1482,11 @@ export function freshLoginLink(
 ): string {
   const refused = personGrantRefusal(process.env);
   if (refused) throw new Error(refused);
-  return loginLink(origin, mintLoginCode(ensureWebSecret(stateDir)), next);
+  return loginLink(
+    origin,
+    mintLoginCode(ensureWebSecret(stateDir), Date.now(), loginLinkTtl()),
+    next,
+  );
 }
 
 /**
@@ -1616,7 +1635,8 @@ function parseLoginArgs(
 
 const LOGIN_HELP = () =>
   LOGIN_USAGE() +
-  "  Prints a one-time sign-in link (open it within 60 s) for one browser, and a\n" +
+  "  Prints a one-time sign-in link (open it within web.login_link_ttl, 5 minutes\n" +
+  "  unless set) for one browser, and a\n" +
   "  code the page behind the link asks for, then waits until the link is used:\n" +
   '  "Signed in: <browser> (<address>) at <time>", or "Expired: nobody used the\n' +
   '  link" (exit 1). On localhost nothing asks for a sign-in; it is needed when\n' +
@@ -1655,12 +1675,36 @@ export function cmdWebLogin(args: string[], io: CliIo = stdIo): number {
     io.stateDir ?? getStateDir(),
   );
   io.err(
-    `${product().cli}: open this link within 60 seconds; it signs in one browser, once.\n`,
+    `${product().cli}: open this link within ${ttlText(loginLinkTtl())}; it signs in one browser, once.\n`,
   );
   io.out(`${link}\n`);
   return 0;
 }
 
+/** D16: web.login_link_ttl, read now (LOGIN_CODE_TTL_MS when unreadable). */
+export function loginLinkTtl(): number {
+  try {
+    return readWebAuthConfig(getDistRoot(), product().configFile)
+      .loginLinkTtlMs;
+  } catch {
+    return LOGIN_CODE_TTL_MS;
+  }
+}
+
+/** "5 minutes", "90 seconds", "1 minute". */
+export function ttlText(ms: number): string {
+  const s = Math.round(ms / 1000);
+  if (s % 60 !== 0) return `${s} seconds`;
+  const m = s / 60;
+  return m === 1 ? "1 minute" : `${m} minutes`;
+}
+
+/** D16: the countdown's text, "4:59 left". */
+export function countdownLeft(ms: number): string {
+  const s = Math.max(0, Math.ceil(ms / 1000));
+  return `${Math.floor(s / 60)}:${String(s % 60).padStart(2, "0")} left`;
+}
+
 /** "10:42" in this machine's time. */
 function clockTime(iso: string): string {
   const d = new Date(iso);
@@ -1680,7 +1724,7 @@ function clockTime(iso: string): string {
 export async function cmdWebLoginWait(
   args: string[],
   io: CliIo = stdIo,
-  opts: { pollMs?: number; maxWaitMs?: number } = {},
+  opts: { pollMs?: number; maxWaitMs?: number; countdown?: boolean } = {},
 ): Promise<number> {
   if (isHelp(args)) {
     io.out(LOGIN_HELP());
@@ -1701,7 +1745,8 @@ export async function cmdWebLoginWait(
   const stateDir = io.stateDir ?? getStateDir();
   const secret = ensureWebSecret(stateDir);
   const now = Date.now();
-  const loginCode = mintLoginCode(secret, now);
+  const ttl = loginLinkTtl();
+  const loginCode = mintLoginCode(secret, now, ttl);
   const checked = checkLoginCode(loginCode, secret, now);
   if (!checked.ok) {
     io.err(`${product().cli}: could not make a sign-in link\n`);
@@ -1722,7 +1767,7 @@ export async function cmdWebLoginWait(
     io.err(
       `${product().cli}: no ${product().title} web server answers on port ${a.port}, so this ` +
         "doesn't wait and the link asks for no code (as --no-wait). Start the server " +
-        `(\`${product().cli} web up\`), then open this link within 60 seconds; it signs in one browser, once.\n`,
+        `(\`${product().cli} web up\`), then open this link within ${ttlText(ttl)}; it signs in one browser, once.\n`,
     );
     io.out(`${link}\n`);
     return 0;
@@ -1733,15 +1778,23 @@ export async function cmdWebLoginWait(
     return 1;
   }
   io.err(
-    `${product().cli}: open this link within 60 seconds, in the browser to sign in. ` +
+    `${product().cli}: open this link within ${ttlText(ttl)}, in the browser to sign in. ` +
       `It asks for this code: ${confirm}\n`,
   );
   io.out(`${link}\n`);
-  io.err(`${product().cli}: waiting for the link to be used…\n`);
+  // D16: on a terminal, the time left, in place.
+  const tty = opts.countdown ?? (io === stdIo && !!process.stderr.isTTY);
+  const waiting = `${product().cli}: waiting for the link to be used…`;
+  const tick = () =>
+    io.err(`\r${waiting} ${countdownLeft(checked.expiresAt - Date.now())} `);
+  if (tty) tick();
+  else io.err(`${waiting}\n`);
   const pollMs = opts.pollMs ?? 1000;
-  const deadline = Date.now() + (opts.maxWaitMs ?? 7 * 60_000);
+  // The link's own time, then the 5 minutes an opened link has for its code.
+  const deadline = Date.now() + (opts.maxWaitMs ?? ttl + 6 * 60_000);
   for (;;) {
     await new Promise((r) => setTimeout(r, pollMs));
+    if (tty) tick();
     const r = await serverCall(
       stateDir,
       a.port,
@@ -1754,6 +1807,15 @@ export async function cmdWebLoginWait(
       client?: string;
       usedAt?: string;
     };
+    // The countdown's line ends before the outcome's.
+    const over =
+      !r ||
+      j.state === "used" ||
+      j.state === "refused" ||
+      j.state === "expired" ||
+      r.status === 404 ||
+      Date.now() > deadline;
+    if (tty && over) io.err("\n");
     if (r && j.state === "used") {
       io.out(
         `Signed in: ${j.device ?? "a browser"}${j.client ? ` (${j.client})` : ""}` +

package/src/ui/server/device-flows.ts

@@ -22,8 +22,29 @@ import { GITHUB_DEVICE_PAGE } from "../../shared/github-app.js";
 import type {
   GithubDeviceClient,
   GithubIdentity,
+  OrgMembership,
 } from "../../shared/github-device.js";
 
+/** What `decide` may ask while the token is still held (D17). */
+export interface DecideContext {
+  /**
+   * D17: the sign-in started with this machine's proof ("This is my
+   * computer", attest-code.ts).
+   */
+  local: boolean;
+  /** Whether the approving account is a member of `org`. */
+  orgMember(org: string): Promise<OrgMembership>;
+}
+
+/** What an identity means: ok, or refused (with why, for the page). */
+export type Decision = "ok" | "refused" | { refused: string };
+
+export type Decide = (
+  purpose: FlowPurpose,
+  identity: GithubIdentity,
+  ctx: DecideContext,
+) => Decision | Promise<Decision>;
+
 export type FlowPurpose = "signin" | "link";
 export type FlowState =
   | "pending"
@@ -43,7 +64,7 @@ export interface FlowView {
   expiresAt: number;
   /** ok or refused: the GitHub login that approved it. */
   login?: string;
-  /** error: what went wrong (no secret in it). */
+  /** error: what went wrong; refused: why, when the decision said (no secret in it). */
   message?: string;
 }
 
@@ -53,6 +74,8 @@ interface Flow extends FlowView {
   errors: number;
   /** ok: who approved it (the id, for the caller). */
   identity?: GithubIdentity;
+  /** D17: started with this machine's proof. */
+  local: boolean;
   /** When a finished flow is forgotten. */
   forgetAt?: number;
   cancel?: () => void;
@@ -81,18 +104,12 @@ export class DeviceFlows {
   private readonly max: number;
   private readonly minIntervalMs: number;
   private readonly onExpiringToken?: () => void;
-  private readonly decide: (
-    purpose: FlowPurpose,
-    identity: GithubIdentity,
-  ) => "ok" | "refused";
+  private readonly decide: Decide;
 
   constructor(opts: {
     client: GithubDeviceClient;
     clientId: () => string;
-    decide: (
-      purpose: FlowPurpose,
-      identity: GithubIdentity,
-    ) => "ok" | "refused";
+    decide: Decide;
     now?: () => number;
     schedule?: Schedule;
     max?: number;
@@ -126,6 +143,7 @@ export class DeviceFlows {
    */
   async start(
     purpose: FlowPurpose,
+    meta: { local?: boolean } = {},
   ): Promise<FlowView | { error: "busy" | "no_client_id" }> {
     const clientId = this.clientId();
     if (!clientId) return { error: "no_client_id" };
@@ -142,6 +160,7 @@ export class DeviceFlows {
       deviceCode: "",
       intervalMs: this.minIntervalMs,
       errors: 0,
+      local: meta.local === true,
     };
     this.flows.set(id, placeholder);
     let code;
@@ -240,10 +259,26 @@ export class DeviceFlows {
         } catch (e) {
           return this.finish(f, "error", { message: (e as Error).message });
         }
-        const outcome = this.decide(f.purpose, identity);
+        let decision: Decision;
+        try {
+          // The token is still only for this flow's own calls, then dropped.
+          const token = r.token;
+          decision = await this.decide(f.purpose, identity, {
+            local: f.local,
+            orgMember: (org) =>
+              this.client.orgMember(token, org, identity.login),
+          });
+        } catch (e) {
+          return this.finish(f, "error", { message: (e as Error).message });
+        }
+        if (this.flows.get(id) !== f || f.state !== "pending") return;
+        const outcome = typeof decision === "string" ? decision : "refused";
         return this.finish(f, outcome, {
           login: identity.login,
           ...(outcome === "ok" ? { identity } : {}),
+          ...(typeof decision === "object"
+            ? { message: decision.refused }
+            : {}),
         });
       }
     }