@monster-orange/den 0.4.20 → 0.4.22

package/src/ui/server/device-flows.ts

@@ -22,8 +22,29 @@ import { GITHUB_DEVICE_PAGE } from "../../shared/github-app.js";
 import type {
   GithubDeviceClient,
   GithubIdentity,
+  OrgMembership,
 } from "../../shared/github-device.js";
 
+/** What `decide` may ask while the token is still held (D17). */
+export interface DecideContext {
+  /**
+   * D17: the sign-in started with this machine's proof ("This is my
+   * computer", attest-code.ts).
+   */
+  local: boolean;
+  /** Whether the approving account is a member of `org`. */
+  orgMember(org: string): Promise<OrgMembership>;
+}
+
+/** What an identity means: ok, or refused (with why, for the page). */
+export type Decision = "ok" | "refused" | { refused: string };
+
+export type Decide = (
+  purpose: FlowPurpose,
+  identity: GithubIdentity,
+  ctx: DecideContext,
+) => Decision | Promise<Decision>;
+
 export type FlowPurpose = "signin" | "link";
 export type FlowState =
   | "pending"
@@ -43,7 +64,7 @@ export interface FlowView {
   expiresAt: number;
   /** ok or refused: the GitHub login that approved it. */
   login?: string;
-  /** error: what went wrong (no secret in it). */
+  /** error: what went wrong; refused: why, when the decision said (no secret in it). */
   message?: string;
 }
 
@@ -53,6 +74,8 @@ interface Flow extends FlowView {
   errors: number;
   /** ok: who approved it (the id, for the caller). */
   identity?: GithubIdentity;
+  /** D17: started with this machine's proof. */
+  local: boolean;
   /** When a finished flow is forgotten. */
   forgetAt?: number;
   cancel?: () => void;
@@ -81,18 +104,12 @@ export class DeviceFlows {
   private readonly max: number;
   private readonly minIntervalMs: number;
   private readonly onExpiringToken?: () => void;
-  private readonly decide: (
-    purpose: FlowPurpose,
-    identity: GithubIdentity,
-  ) => "ok" | "refused";
+  private readonly decide: Decide;
 
   constructor(opts: {
     client: GithubDeviceClient;
     clientId: () => string;
-    decide: (
-      purpose: FlowPurpose,
-      identity: GithubIdentity,
-    ) => "ok" | "refused";
+    decide: Decide;
     now?: () => number;
     schedule?: Schedule;
     max?: number;
@@ -126,6 +143,7 @@ export class DeviceFlows {
    */
   async start(
     purpose: FlowPurpose,
+    meta: { local?: boolean } = {},
   ): Promise<FlowView | { error: "busy" | "no_client_id" }> {
     const clientId = this.clientId();
     if (!clientId) return { error: "no_client_id" };
@@ -142,6 +160,7 @@ export class DeviceFlows {
       deviceCode: "",
       intervalMs: this.minIntervalMs,
       errors: 0,
+      local: meta.local === true,
     };
     this.flows.set(id, placeholder);
     let code;
@@ -240,10 +259,26 @@ export class DeviceFlows {
         } catch (e) {
           return this.finish(f, "error", { message: (e as Error).message });
         }
-        const outcome = this.decide(f.purpose, identity);
+        let decision: Decision;
+        try {
+          // The token is still only for this flow's own calls, then dropped.
+          const token = r.token;
+          decision = await this.decide(f.purpose, identity, {
+            local: f.local,
+            orgMember: (org) =>
+              this.client.orgMember(token, org, identity.login),
+          });
+        } catch (e) {
+          return this.finish(f, "error", { message: (e as Error).message });
+        }
+        if (this.flows.get(id) !== f || f.state !== "pending") return;
+        const outcome = typeof decision === "string" ? decision : "refused";
         return this.finish(f, outcome, {
           login: identity.login,
           ...(outcome === "ok" ? { identity } : {}),
+          ...(typeof decision === "object"
+            ? { message: decision.refused }
+            : {}),
         });
       }
     }

package/src/ui/server/github-routes.ts

@@ -23,7 +23,62 @@ import {
   readWebOwner,
   writeWebOwner,
 } from "../../shared/web-owner.js";
-import type { DeviceFlows, FlowView } from "./device-flows.js";
+import type {
+  Decide,
+  Decision,
+  DeviceFlows,
+  FlowView,
+} from "./device-flows.js";
+
+/**
+ * D17: who may claim a Den that has no owner yet.
+ *  - `ownerGithub` (web.owner_github, recorded from `gh` where the
+ *    instance was started): that login, from any machine.
+ *  - `allowedGithubOrg` (web.allowed_github_org, the distribution's): a
+ *    member of the org, only with this machine's proof (a session, which
+ *    on a fresh Den only "This is my computer" or a terminal gives): the
+ *    owner link, never the signed-out sign-in.
+ * Anyone else is refused, with why. Neither set: nobody claims from the
+ * browser; the page names the settings.
+ */
+export interface ClaimRules {
+  ownerGithub?: string;
+  allowedGithubOrg?: string;
+  /** The file web.allowed_github_org is in (for the messages). */
+  allowedGithubOrgFile?: string;
+}
+
+const sameLogin = (a: string, b: string | undefined) =>
+  !!b && a.toLowerCase() === b.toLowerCase();
+
+/** Why a signed-out GitHub sign-in can't claim a Den with no owner. */
+export function unclaimedSigninReason(
+  login: string | null,
+  r: ClaimRules,
+): string {
+  const who = login ? `@${login}` : "This account";
+  if (r.allowedGithubOrg)
+    return (
+      `${who} can't claim this Den from here: it has no owner yet. ` +
+      `A member of the ${r.allowedGithubOrg} GitHub org claims it on the computer it runs on: ` +
+      `open this page there and choose This is my computer.` +
+      (r.ownerGithub
+        ? ` From another computer, only @${r.ownerGithub} (web.owner_github) can.`
+        : "")
+    );
+  if (r.ownerGithub)
+    return `${who} isn't the account this Den was started by (@${r.ownerGithub}, web.owner_github). Sign in as @${r.ownerGithub}.`;
+  return noRuleMessage(r);
+}
+
+/** Neither rule is set: the settings that would let someone claim it. */
+export function noRuleMessage(r: ClaimRules): string {
+  return (
+    "This Den has no owner yet, and nothing says who may claim it. " +
+    `Set web.allowed_github_org (your GitHub org) in ${r.allowedGithubOrgFile ?? "the distribution config"}, ` +
+    "or web.owner_github (your GitHub login) in config/local/user.yml on the computer it runs on."
+  );
+}
 
 export interface GithubRouteDeps {
   flows: DeviceFlows;
@@ -47,23 +102,76 @@ export interface GithubRouteDeps {
   log: (line: string) => void;
   /** Where the owner file lives (the server's state dir). */
   stateDir: () => string;
+  /** D17: who may claim a Den with no owner (read now). */
+  claimRules?: () => ClaimRules;
+  /**
+   * D17: spend a "This is my computer" code (attest-code.ts) for this
+   * request's host: true once, for a valid one.
+   */
+  spendAttest?: (req: http.IncomingMessage, code: string) => boolean;
 }
 
 const SIGNIN_PATH = /^\/api\/github\/signin\/([A-Za-z0-9_-]{16,64})$/;
 const LINK_PATH = /^\/api\/web\/owner\/link\/([A-Za-z0-9_-]{16,64})$/;
 
-/** What an identity means for a flow: the owner's sign-in, or the owner's link. */
+/**
+ * What an identity means for a flow: the owner's sign-in, or the owner's
+ * link; with no owner yet, a claim by ClaimRules (D17).
+ */
 export function decideFlow(
   stateDir: () => string,
   log: (line: string) => void,
-): (
-  purpose: "signin" | "link",
-  identity: { id: number; login: string },
-) => "ok" | "refused" {
-  return (purpose, identity) => {
+  rules: () => ClaimRules = () => ({}),
+): Decide {
+  /** Link `identity` as the owner unless one appeared meanwhile. */
+  const claim = (
+    identity: { id: number; login: string },
+    how: string,
+  ): "ok" | "refused" => {
+    const now = readWebOwner(stateDir());
+    if (now)
+      return now.owner === githubPrincipal(identity.id) ? "ok" : "refused";
+    writeWebOwner(identity, stateDir());
+    log(`  ✓ owner linked: @${identity.login} (${how})`);
+    return "ok";
+  };
+  /** A member of `org` claims it; anyone else is refused, with why. */
+  const memberClaim = async (
+    identity: { id: number; login: string },
+    org: string,
+    ctx: { orgMember(org: string): Promise<string> },
+  ): Promise<Decision> => {
+    const m = await ctx.orgMember(org);
+    if (m === "member") return claim(identity, `member of ${org}`);
+    log(
+      `  ✗ owner claim refused: @${identity.login} ${m === "not_member" ? "isn't a member of" : "has no readable membership in"} ${org}`,
+    );
+    return {
+      refused:
+        m === "not_member"
+          ? `@${identity.login} isn't a member of the ${org} GitHub org (web.allowed_github_org), so it can't own this Den.`
+          : `Den couldn't tell whether @${identity.login} is a member of ${org}: the membership is private, and the GitHub App can't read it. ` +
+            `Either make your membership public (github.com/orgs/${org}/people), or have an ${org} org admin grant the GitHub App Members (read) access. ` +
+            `Or set web.owner_github: ${identity.login} in config/local/user.yml on this computer (\`gh auth login\` before \`web up\` does it for you).`,
+    };
+  };
+  return async (purpose, identity, ctx) => {
     const owner = readWebOwner(stateDir());
+    const r = rules();
+    const named = sameLogin(identity.login, r.ownerGithub);
     if (purpose === "signin") {
-      const ok = owner?.owner === githubPrincipal(identity.id);
+      if (!owner) {
+        // D17: the login web.owner_github names claims it from anywhere;
+        // a member of the org, only with this machine's proof.
+        if (named) return claim(identity, "web.owner_github");
+        if (r.allowedGithubOrg && ctx.local)
+          return memberClaim(identity, r.allowedGithubOrg, ctx);
+        log(
+          `  ✗ GitHub sign-in refused: @${identity.login} can't claim this Den (no owner yet)`,
+        );
+        return { refused: unclaimedSigninReason(identity.login, r) };
+      }
+      const ok = owner.owner === githubPrincipal(identity.id);
       log(
         ok
           ? `  ✓ signed in with GitHub (@${identity.login})`
@@ -72,9 +180,19 @@ export function decideFlow(
       return ok ? "ok" : "refused";
     }
     if (owner) return "refused";
-    writeWebOwner(identity, stateDir());
-    log(`  ✓ owner linked: @${identity.login}`);
-    return "ok";
+    // The link: a signed-in session (this machine's proof on a fresh Den).
+    if (named) return claim(identity, "web.owner_github");
+    if (r.allowedGithubOrg)
+      return memberClaim(identity, r.allowedGithubOrg, ctx);
+    if (r.ownerGithub) {
+      log(
+        `  ✗ owner link refused: @${identity.login} isn't web.owner_github (@${r.ownerGithub})`,
+      );
+      return {
+        refused: `@${identity.login} isn't the account this Den was started by (@${r.ownerGithub}, web.owner_github). Link @${r.ownerGithub}, or change web.owner_github in config/local/user.yml.`,
+      };
+    }
+    return claim(identity, "linked in Settings");
   };
 }
 
@@ -97,6 +215,7 @@ function flowJson(v: FlowView): Record<string, unknown> {
 function finishedMessage(v: FlowView, cli: string): string | undefined {
   switch (v.state) {
     case "refused":
+      if (v.message) return v.message;
       return v.purpose === "signin"
         ? `@${v.login} isn't the owner of this Den. Only the owner's account can use Sign in with GitHub. Use Approve this computer instead.`
         : `An owner is linked already; \`${cli} web owner unlink\` first.`;
@@ -115,10 +234,11 @@ async function startFlow(
   deps: GithubRouteDeps,
   res: http.ServerResponse,
   purpose: "signin" | "link",
+  meta: { local?: boolean } = {},
 ): Promise<void> {
   let r;
   try {
-    r = await deps.flows.start(purpose);
+    r = await deps.flows.start(purpose, meta);
   } catch (e) {
     return deps.sendJson(
       res,
@@ -167,19 +287,52 @@ export async function handleGithubRoutes(
 
   // ── Sign in with GitHub ──────────────────────────────────────────────
   if (pathname === "/api/github/signin" && method === "POST") {
-    if (!readWebOwner(deps.stateDir())) {
+    // D17: "This is my computer"'s code, if the page has one (the body's
+    // `attest`): spent here, once, for this host.
+    let body: { attest?: unknown } = {};
+    try {
+      body = (JSON.parse((await deps.readBody(req)) || "{}") ??
+        {}) as typeof body;
+    } catch {
+      body = {};
+    }
+    const attest = typeof body.attest === "string" ? body.attest : "";
+    const local = !!attest && !!deps.spendAttest?.(req, attest);
+    if (attest && !local) {
+      deps.sendJson(
+        res,
+        {
+          ok: false,
+          code: "attest_failed",
+          error:
+            "This browser isn't on the computer this Den runs on, or its proof expired. Try This is my computer again, on that computer.",
+        },
+        403,
+      );
+      return true;
+    }
+    // D17: with no owner, web.owner_github's login may claim it from
+    // anywhere; a member of web.allowed_github_org, with this machine's proof.
+    const rules = deps.claimRules?.() ?? {};
+    if (
+      !readWebOwner(deps.stateDir()) &&
+      !rules.ownerGithub &&
+      !(local && rules.allowedGithubOrg)
+    ) {
       deps.sendJson(
         res,
         {
           ok: false,
-          code: "no_owner",
-          error: `This Den has no owner yet. On the machine it runs on, run \`${deps.cli} web owner link\`.`,
+          code: rules.allowedGithubOrg ? "claim_here" : "no_owner",
+          error: rules.allowedGithubOrg
+            ? unclaimedSigninReason(null, rules)
+            : `${noRuleMessage(rules)} Or, on that computer, run \`${deps.cli} web owner link\`.`,
         },
         409,
       );
       return true;
     }
-    await startFlow(deps, res, "signin");
+    await startFlow(deps, res, "signin", { local });
     return true;
   }
   const s = SIGNIN_PATH.exec(pathname);

package/src/ui/server/index.ts

@@ -229,7 +229,7 @@ import {
   ignoredConfigWarning,
   localhostOrigin,
   loginLink,
-  LOGIN_CODE_TTL_MS,
+  LOGIN_CODE_MAX_TTL_MS,
   mintLoginCode,
   readWebAuthConfig,
   safeNext,
@@ -243,6 +243,14 @@ import {
 import { serveUiAsset } from "./ui-assets.js";
 import { PERSON_GRANT_ROUTES, personGrantAllowed } from "./approvals.js";
 import { ClaimNonces, checkClaimCode } from "../../shared/claim-code.js";
+import {
+  ATTEST_NONCES_FILE,
+  attestRedirect,
+  attestReturn,
+  checkAttestCode,
+  mintAttestCode,
+} from "../../shared/attest-code.js";
+import type { ClaimRules } from "./github-routes.js";
 import {
   expiringTokenWarning,
   githubClientId,
@@ -252,6 +260,7 @@ import {
 } from "../../shared/github-app.js";
 import { githubDeviceClient } from "../../shared/github-device.js";
 import { readWebOwner } from "../../shared/web-owner.js";
+import { noRuleMessage, unclaimedSigninReason } from "./github-routes.js";
 import { DeviceFlows } from "./device-flows.js";
 import {
   decideFlow,
@@ -897,7 +906,7 @@ import {
   edgeExposedMessage,
   edgeExposure,
   edgeNetworkSubnets,
-} from "./edge-exposure.js";
+} from "../../shared/edge/exposure.js";
 import { initLoginPath } from "../../shared/agents/runtime-search.js";
 import {
   linksFor,
@@ -909,6 +918,7 @@ import {
 
 import { product } from "../../shared/product.js";
 import { readBrand } from "../../shared/brand.js";
+import { launchdSession } from "../../shared/launchd-session.js";
 /** config `web.port` (user > team), falling back to the built-in default. */
 function readWebPortSafe(): number {
   try {
@@ -1053,6 +1063,89 @@ const WEB_AUTH: WebAuthConfig = (() => {
   }
 })();
 
+/** web's sign-in config read now (Settings may change it), else at start. */
+function webAuthNow(): WebAuthConfig {
+  try {
+    return readWebAuthConfig(getDistRoot(), product().configFile);
+  } catch {
+    return WEB_AUTH;
+  }
+}
+
+/** D17: who may claim this Den while it has no owner (read now). */
+function claimRulesNow(): ClaimRules {
+  const w = webAuthNow();
+  return {
+    ...(w.ownerGithub ? { ownerGithub: w.ownerGithub } : {}),
+    ...(w.allowedGithubOrg ? { allowedGithubOrg: w.allowedGithubOrg } : {}),
+    // Where it is, or would go: the distribution config.
+    allowedGithubOrgFile: w.allowedGithubOrgFile ?? product().configFile,
+  };
+}
+
+/** D17: the spent "This is my computer" codes (attest-code.ts). */
+const ATTEST_NONCES = new ClaimNonces(getStateDir(), ATTEST_NONCES_FILE);
+
+/** The request's Host without its port, lowercase. */
+function hostNameOf(req: http.IncomingMessage): string {
+  return String(req.headers.host ?? "")
+    .toLowerCase()
+    .replace(/:\d+$/, "");
+}
+
+/**
+ * D17: spend an attest code for this request's host: one of this server's
+ * edge hostnames, the code minted for it, unused. True once.
+ */
+function spendAttest(req: http.IncomingMessage, code: string): boolean {
+  const secret = webSecret.current();
+  const host = hostNameOf(req);
+  if (!secret || !denEdgeHosts().includes(host)) return false;
+  const c = checkAttestCode(code, secret, host);
+  return c.ok && ATTEST_NONCES.consume(c.nonce, c.expiresAt);
+}
+
+/**
+ * `GET /attest?return=<edge URL>` (D17, fix A): only on localhost (only a
+ * browser on this machine reaches it there). A 303 back to `return`, one of
+ * this server's own edge hosts, with a short-lived code in the fragment.
+ * Anything else: an error page, and no code.
+ */
+function handleAttest(
+  req: http.IncomingMessage,
+  res: http.ServerResponse,
+  url: URL,
+  guard: GuardResult,
+  requestId: string,
+): void {
+  res.setHeader("Cache-Control", "no-store");
+  res.setHeader("Referrer-Policy", "no-referrer");
+  const refuse = (status: 400 | 403, message: string) =>
+    sendErrorPage(req, res, {
+      status,
+      path: "/attest",
+      message,
+      code: status === 403 ? "not_this_computer" : "bad_return",
+      requestId,
+    });
+  if (!guard.ok || guard.via !== "loopback" || guard.beyond)
+    return refuse(
+      403,
+      "This works only on the computer this Den runs on, at localhost.",
+    );
+  const ret = attestReturn(url.searchParams.get("return"), denEdgeHosts());
+  const secret = webSecret.current();
+  if (!ret || !secret)
+    return refuse(
+      400,
+      "That address isn't one of this Den's own. Open this Den at its own address and try again.",
+    );
+  res.writeHead(303, {
+    Location: attestRedirect(ret, mintAttestCode(secret, ret.host)),
+  });
+  res.end();
+}
+
 /**
  * The loopback names, with the port: localhost (canonical), 127.0.0.1 and
  * [::1]; the product's own name when /etc/hosts maps it to 127.0.0.1 (the
@@ -1198,7 +1291,11 @@ const GITHUB = githubEndpoints();
 const DEVICE_FLOWS = new DeviceFlows({
   client: githubDeviceClient(GITHUB),
   clientId: () => GITHUB_CLIENT_ID,
-  decide: decideFlow(getStateDir, (l) => serverLog(l, "lifecycle")),
+  decide: decideFlow(
+    getStateDir,
+    (l) => serverLog(l, "lifecycle"),
+    () => claimRulesNow(),
+  ),
   // A test's fake GitHub may answer interval 0; the real one never does.
   minIntervalMs: GITHUB.fake ? 50 : 1000,
   onExpiringToken: noteExpiringToken,
@@ -1361,16 +1458,36 @@ function denEdgeRoutes(): { host: string; url: string }[] {
  */
 function githubSignin():
   | { state: "no_client_id" | "no_owner" }
-  | { state: "ready"; ownerLogin: string } {
+  | { state: "ready"; ownerLogin: string }
+  | {
+      state: "claim";
+      org?: string;
+      ownerGithub?: string;
+      /** "This is my computer"'s start, on localhost (fix A). */
+      attest?: string;
+      message: string;
+    } {
   if (!GITHUB_CLIENT_ID) return { state: "no_client_id" };
   const owner = readWebOwner(getStateDir());
-  return owner
-    ? { state: "ready", ownerLogin: owner.login }
-    : { state: "no_owner" };
+  if (owner) return { state: "ready", ownerLogin: owner.login };
+  // D17: no owner yet: who may claim it, and how.
+  const r = claimRulesNow();
+  if (!r.allowedGithubOrg && !r.ownerGithub) return { state: "no_owner" };
+  return {
+    state: "claim",
+    ...(r.allowedGithubOrg
+      ? {
+          org: r.allowedGithubOrg,
+          attest: `${localhostOrigin(PORT)}/attest`,
+        }
+      : {}),
+    ...(r.ownerGithub ? { ownerGithub: r.ownerGithub } : {}),
+    message: unclaimedSigninReason(null, r),
+  };
 }
 
 /**
- * 0.4.3: why the edge is reachable beyond this machine (edge-exposure.ts),
+ * 0.4.3: why the edge is reachable beyond this machine (shared/edge/exposure.ts),
  * once at start; null until known, or when Den can't tell.
  */
 let EDGE_EXPOSED: string | null = null;
@@ -1487,7 +1604,16 @@ function sendSignedOut(
         ...(gh.state === "ready" ? { ownerLogin: gh.ownerLogin } : {}),
         learnMore: GITHUB_SIGNIN_DOCS,
         ...(GITHUB_CLIENT_ID
-          ? {}
+          ? gh.state === "no_owner"
+            ? { message: noRuleMessage(claimRulesNow()) }
+            : gh.state === "claim"
+              ? {
+                  message: gh.message,
+                  ...(gh.org ? { org: gh.org } : {}),
+                  ...(gh.ownerGithub ? { ownerGithub: gh.ownerGithub } : {}),
+                  ...(gh.attest ? { attest: gh.attest } : {}),
+                }
+              : {}
           : { message: noClientIdMessage(product().cli) }),
       },
       ...(opts.expired ? { expired: true } : {}),
@@ -1922,6 +2048,9 @@ async function handleRequest(
     (req.method === "GET" || req.method === "HEAD" || req.method === "POST")
   )
     return handleAuth(req, res, url, requestId);
+  // D17: "This is my computer" (fix A), on localhost only.
+  if (pathname === "/attest" && (req.method === "GET" || req.method === "HEAD"))
+    return handleAttest(req, res, url, guard, requestId);
   // SEC-2a: `web login` registers its link's wait, then polls it
   // (shell-grade: the CLI's bearer).
   if (pathname === "/api/web/logins" && req.method === "POST") {
@@ -1935,7 +2064,7 @@ async function handleRequest(
     const id =
       Number.isFinite(exp) &&
       exp > Date.now() &&
-      exp - Date.now() <= LOGIN_CODE_TTL_MS + 5_000
+      exp - Date.now() <= LOGIN_CODE_MAX_TTL_MS + 5_000
         ? LOGIN_WAITS.register(
             String(body.nonce ?? ""),
             String(body.code ?? ""),
@@ -2044,13 +2173,16 @@ async function handleRequest(
         const secret = webSecret.current();
         if (!secret) return null;
         const now = Date.now();
+        const ttl = webAuthNow().loginLinkTtlMs;
         return {
-          url: loginLink(origin, mintLoginCode(secret, now)),
-          expiresAt: now + LOGIN_CODE_TTL_MS,
+          url: loginLink(origin, mintLoginCode(secret, now, ttl)),
+          expiresAt: now + ttl,
         };
       },
       log: (l) => serverLog(l, "lifecycle"),
       stateDir: getStateDir,
+      claimRules: claimRulesNow,
+      spendAttest,
     }))
   )
     return;
@@ -4291,6 +4423,9 @@ async function handleRequest(
       // another distribution's server (see cli/server-identity.ts).
       root: ROOT,
       product: product().name,
+      // D20: the launchd session it runs in (Aqua ends at logout); doctor
+      // shows it. null off macOS.
+      launchd: launchdSession(),
       startedAt: new Date(SERVER_STARTED_AT).toISOString(),
       uptimeMs: Date.now() - SERVER_STARTED_AT,
       stale,