@monster-orange/den 0.4.3 → 0.4.5

package/src/ui/server/login-waits.ts

@@ -0,0 +1,203 @@
+/**
+ * SEC-2a: `<cli> web login` waits, and its link asks for a code (SEC-2
+ * spec, "Seeing that you're signed in"). The CLI mints the one-time link
+ * as before, makes an 8-character confirmation code, and registers both
+ * with the running server (its bearer): the link's nonce and a hash of the
+ * code. Then:
+ *
+ *  - the link (GET /auth) no longer signs in by itself: it opens a page
+ *    that asks for the code, so a leaked link alone is useless. Opening it
+ *    starts a 5-minute window to type the code;
+ *  - the page posts the code; the right one signs the browser in (the link
+ *    is consumed: still single-use), a wrong one is refused. Five wrong
+ *    codes burn the link; past 20 wrong codes a minute (any link), every
+ *    attempt waits;
+ *  - the CLI polls the wait by its own id and prints who signed in, or
+ *    that nobody did.
+ *
+ * In memory only. The code is kept as a hash and never logged; the nonce
+ * alone (without the link's mac) signs nothing in. Clock injected.
+ */
+import { createHash, randomBytes, timingSafeEqual } from "crypto";
+import { normalizeConfirmCode } from "../../shared/confirm-code.js";
+
+export {
+  newConfirmCode,
+  normalizeConfirmCode,
+} from "../../shared/confirm-code.js";
+
+/** How long an opened link's page waits for its code. */
+export const CONFIRM_WINDOW_MS = 5 * 60_000;
+/** Wrong codes before a link is burned. */
+export const MAX_WRONG_PER_LINK = 5;
+/** Wrong codes a minute, all links together, before every attempt waits. */
+export const MAX_WRONG_PER_MINUTE = 20;
+/** The most waits at once; a new one drops the oldest. */
+export const MAX_LOGIN_WAITS = 10;
+/** How long an ended wait still answers the CLI. */
+const ENDED_KEEP_MS = 5 * 60_000;
+
+const hash = (s: string) => createHash("sha256").update(s).digest();
+
+export type LoginWaitState =
+  | "waiting"
+  | "opened"
+  | "used"
+  | "expired"
+  | "refused";
+
+export interface LoginWaitView {
+  state: LoginWaitState;
+  /** used: the browser and OS that signed in, its address, and when. */
+  device?: string;
+  client?: string;
+  usedAt?: number;
+  expiresAt: number;
+}
+
+interface LoginWait extends LoginWaitView {
+  id: string;
+  nonce: string;
+  codeHash: Buffer;
+  createdAt: number;
+  openedAt?: number;
+  wrong: number;
+  forgetAt?: number;
+}
+
+export type ConfirmResult =
+  | { ok: true }
+  | {
+      ok: false;
+      error: "wrong" | "refused" | "expired" | "rate_limited";
+      left?: number;
+    };
+
+export class LoginWaits {
+  private readonly byId = new Map<string, LoginWait>();
+  private readonly now: () => number;
+  private wrongAt: number[] = [];
+
+  constructor(opts: { now?: () => number } = {}) {
+    this.now = opts.now ?? Date.now;
+  }
+
+  /**
+   * A wait for the link with this nonce (it must be opened by `linkExpiresAt`),
+   * confirmed by `code`. Its id is the CLI's to poll.
+   */
+  register(nonce: string, code: string, linkExpiresAt: number): string | null {
+    const norm = normalizeConfirmCode(code);
+    if (!norm || !/^[A-Za-z0-9_-]{16,64}$/.test(nonce)) return null;
+    this.sweep();
+    const live = [...this.byId.values()].sort(
+      (a, b) => a.createdAt - b.createdAt,
+    );
+    while (live.length >= MAX_LOGIN_WAITS) this.byId.delete(live.shift()!.id);
+    const id = randomBytes(24).toString("base64url");
+    this.byId.set(id, {
+      id,
+      nonce,
+      codeHash: hash(norm),
+      state: "waiting",
+      createdAt: this.now(),
+      expiresAt: linkExpiresAt,
+      wrong: 0,
+    });
+    return id;
+  }
+
+  /** A wait by its id (the CLI's poll). */
+  get(id: string): LoginWaitView | null {
+    this.sweep();
+    const w = this.byId.get(id);
+    return w ? view(w) : null;
+  }
+
+  /** The wait for a link's nonce, still open to use, or null. */
+  forNonce(nonce: string): (LoginWaitView & { openedAt?: number }) | null {
+    this.sweep();
+    const w = this.find(nonce);
+    return w
+      ? { ...view(w), ...(w.openedAt ? { openedAt: w.openedAt } : {}) }
+      : null;
+  }
+
+  /** Whether a link with this nonce has a wait at all (any state). */
+  has(nonce: string): boolean {
+    return !!this.find(nonce);
+  }
+
+  /** The link was opened: its code window starts (once). */
+  open(nonce: string): void {
+    this.sweep();
+    const w = this.find(nonce);
+    if (!w || w.state !== "waiting") return;
+    const now = this.now();
+    w.state = "opened";
+    w.openedAt = now;
+    w.expiresAt = now + CONFIRM_WINDOW_MS;
+  }
+
+  /** The page's code for this link. */
+  confirm(nonce: string, typed: string): ConfirmResult {
+    this.sweep();
+    const now = this.now();
+    const w = this.find(nonce);
+    if (!w || w.state === "used") return { ok: false, error: "expired" };
+    if (w.state === "expired") return { ok: false, error: "expired" };
+    if (w.state === "refused") return { ok: false, error: "refused" };
+    this.wrongAt = this.wrongAt.filter((t) => now - t < 60_000);
+    if (this.wrongAt.length >= MAX_WRONG_PER_MINUTE)
+      return { ok: false, error: "rate_limited" };
+    const norm = normalizeConfirmCode(typed);
+    const given = hash(norm ?? `\u0000${typed}`);
+    if (norm && timingSafeEqual(given, w.codeHash)) return { ok: true };
+    this.wrongAt.push(now);
+    w.wrong++;
+    if (w.wrong >= MAX_WRONG_PER_LINK) {
+      this.end(w, "refused");
+      return { ok: false, error: "refused" };
+    }
+    return { ok: false, error: "wrong", left: MAX_WRONG_PER_LINK - w.wrong };
+  }
+
+  /** The link signed a browser in: the CLI is told who. */
+  used(nonce: string, meta: { device: string; client?: string }): void {
+    const w = this.find(nonce);
+    if (!w) return;
+    w.device = meta.device;
+    if (meta.client) w.client = meta.client;
+    w.usedAt = this.now();
+    this.end(w, "used");
+  }
+
+  private find(nonce: string): LoginWait | undefined {
+    for (const w of this.byId.values()) if (w.nonce === nonce) return w;
+    return undefined;
+  }
+
+  private end(w: LoginWait, state: "used" | "expired" | "refused"): void {
+    w.state = state;
+    w.forgetAt = this.now() + ENDED_KEEP_MS;
+  }
+
+  private sweep(): void {
+    const now = this.now();
+    for (const [id, w] of this.byId) {
+      if ((w.state === "waiting" || w.state === "opened") && now >= w.expiresAt)
+        this.end(w, "expired");
+      if (w.forgetAt !== undefined && now >= w.forgetAt) this.byId.delete(id);
+    }
+  }
+}
+
+function view(w: LoginWait): LoginWaitView {
+  return {
+    state: w.state,
+    ...(w.device ? { device: w.device } : {}),
+    ...(w.client ? { client: w.client } : {}),
+    ...(w.usedAt ? { usedAt: w.usedAt } : {}),
+    expiresAt: w.expiresAt,
+  };
+}

package/src/ui/server/pair-requests.ts

@@ -0,0 +1,237 @@
+/**
+ * SEC-2a: approve this computer with a code (reverse pairing). The
+ * signed-out page asks for a request; the server keeps it in memory and
+ * hands that page two things:
+ *
+ *  - a short code (`K7Q-42M`: six Crockford base32 characters, 30 bits)
+ *    that a person who is already in (the CLI's bearer, `<cli> web approve
+ *    <code>`, or a signed-in Settings › Access › Waiting devices) types or
+ *    clicks to approve it. The code is never a credential by itself: it
+ *    only names a request to someone already trusted;
+ *  - a separate poll id (192 bits) that only that page holds. Once the
+ *    request is approved, the page's poll with this id gets the session
+ *    cookie, once.
+ *
+ * A request lasts 10 minutes and is single-use: claiming it (the cookie),
+ * denying it, or its expiry ends it. At most `max` are pending at once; a
+ * new one beyond that drops the oldest. Approve and deny attempts are
+ * rate-limited (a guess of a code costs one): past `maxAttempts` in
+ * `attemptWindowMs`, every attempt is refused until the window passes.
+ *
+ * Nothing is written to disk. Clock injected, so a test drives expiry.
+ */
+import { randomBytes, randomInt } from "crypto";
+import { PAIR_ALPHABET } from "../../shared/confirm-code.js";
+import { deviceName } from "../../shared/web-session.js";
+
+/** How long a request waits for its approval. */
+export const PAIR_TTL_MS = 10 * 60_000;
+/** The most pending requests at once; a new one drops the oldest. */
+export const MAX_PENDING_PAIRS = 5;
+/** How long an ended request still answers its page (denied, expired). */
+export const PAIR_ENDED_KEEP_MS = 60_000;
+/** Approve or deny attempts allowed per window. */
+export const MAX_APPROVE_ATTEMPTS = 10;
+export const APPROVE_WINDOW_MS = 60_000;
+
+export { PAIR_ALPHABET };
+const CODE_LEN = 6;
+
+/** A fresh code, unformatted (six characters of PAIR_ALPHABET). */
+export function newPairCode(rand: (n: number) => number = randomInt): string {
+  let s = "";
+  for (let i = 0; i < CODE_LEN; i++) s += PAIR_ALPHABET[rand(32)];
+  return s;
+}
+
+/** `K7Q42M` → `K7Q-42M`. */
+export function formatPairCode(code: string): string {
+  return `${code.slice(0, 3)}-${code.slice(3)}`;
+}
+
+/**
+ * What a person typed, as a code: case-insensitive, dashes and spaces
+ * ignored, and Crockford's look-alikes read as what they look like (O as
+ * 0, I and L as 1). Null when it can't be a code.
+ */
+export function normalizePairCode(input: string): string | null {
+  const s = String(input ?? "")
+    .toUpperCase()
+    .replace(/[\s-]/g, "")
+    .replace(/O/g, "0")
+    .replace(/[IL]/g, "1");
+  if (s.length !== CODE_LEN) return null;
+  for (const c of s) if (!PAIR_ALPHABET.includes(c)) return null;
+  return s;
+}
+
+export type PairState = "pending" | "approved" | "denied" | "expired";
+
+/** What the approver sees of a request (and the page, of its own). */
+export interface PairView {
+  code: string;
+  state: PairState;
+  /** "Chrome on macOS", from the User-Agent. */
+  device: string;
+  /** The client's address, when Den knows it. */
+  client?: string;
+  createdAt: number;
+  expiresAt: number;
+}
+
+interface PairRequest extends PairView {
+  id: string;
+  userAgent: string;
+  /** When an ended request is forgotten. */
+  forgetAt?: number;
+}
+
+export type ApproveResult =
+  | { ok: true; request: PairView }
+  | { ok: false; error: "malformed" | "unknown" | "expired" | "rate_limited" };
+
+export class PairRequests {
+  private readonly byId = new Map<string, PairRequest>();
+  private readonly now: () => number;
+  private readonly max: number;
+  private readonly ttlMs: number;
+  private readonly maxAttempts: number;
+  private readonly windowMs: number;
+  private attempts: number[] = [];
+
+  constructor(
+    opts: {
+      now?: () => number;
+      max?: number;
+      ttlMs?: number;
+      maxAttempts?: number;
+      windowMs?: number;
+    } = {},
+  ) {
+    this.now = opts.now ?? Date.now;
+    this.max = opts.max ?? MAX_PENDING_PAIRS;
+    this.ttlMs = opts.ttlMs ?? PAIR_TTL_MS;
+    this.maxAttempts = opts.maxAttempts ?? MAX_APPROVE_ATTEMPTS;
+    this.windowMs = opts.windowMs ?? APPROVE_WINDOW_MS;
+  }
+
+  /** A new request: its poll id (the page's only), code and expiry. */
+  create(meta: { userAgent?: string; client?: string }): {
+    id: string;
+    code: string;
+    expiresAt: number;
+  } {
+    this.sweep();
+    const pending = [...this.byId.values()]
+      .filter((r) => r.state === "pending")
+      .sort((a, b) => a.createdAt - b.createdAt);
+    while (pending.length >= this.max) {
+      const oldest = pending.shift()!;
+      this.byId.delete(oldest.id);
+    }
+    const live = new Set([...this.byId.values()].map((r) => r.code));
+    let code = newPairCode();
+    while (live.has(code)) code = newPairCode();
+    const now = this.now();
+    const ua = String(meta.userAgent ?? "").slice(0, 300);
+    const r: PairRequest = {
+      id: randomBytes(24).toString("base64url"),
+      code,
+      state: "pending",
+      device: deviceName(ua),
+      userAgent: ua,
+      ...(meta.client ? { client: String(meta.client).slice(0, 64) } : {}),
+      createdAt: now,
+      expiresAt: now + this.ttlMs,
+    };
+    this.byId.set(r.id, r);
+    return { id: r.id, code: formatPairCode(code), expiresAt: r.expiresAt };
+  }
+
+  /** A request's view by its poll id, or null (unknown, or forgotten). */
+  get(id: string): PairView | null {
+    this.sweep();
+    const r = this.byId.get(id);
+    return r ? view(r) : null;
+  }
+
+  /** The requests waiting for approval, oldest first. */
+  waiting(): PairView[] {
+    this.sweep();
+    return [...this.byId.values()]
+      .filter((r) => r.state === "pending")
+      .sort((a, b) => a.createdAt - b.createdAt)
+      .map(view);
+  }
+
+  /** Approve the pending request with this code (as typed). */
+  approve(input: string): ApproveResult {
+    return this.decide(input, "approved");
+  }
+
+  /** Deny the pending request with this code: its page offers a new one. */
+  deny(input: string): ApproveResult {
+    return this.decide(input, "denied");
+  }
+
+  /**
+   * An approved request, once, by its poll id: it is consumed, so a second
+   * claim gets null (an approval makes one session).
+   */
+  claim(id: string): PairView | null {
+    this.sweep();
+    const r = this.byId.get(id);
+    if (!r || r.state !== "approved") return null;
+    this.byId.delete(id);
+    return view(r);
+  }
+
+  /** Forget every request (the server is stopping). */
+  clear(): void {
+    this.byId.clear();
+  }
+
+  private decide(input: string, state: "approved" | "denied"): ApproveResult {
+    const now = this.now();
+    this.attempts = this.attempts.filter((t) => now - t < this.windowMs);
+    if (this.attempts.length >= this.maxAttempts)
+      return { ok: false, error: "rate_limited" };
+    this.attempts.push(now);
+    const code = normalizePairCode(input);
+    if (!code) return { ok: false, error: "malformed" };
+    this.sweep();
+    const r = [...this.byId.values()].find((x) => x.code === code);
+    if (!r) return { ok: false, error: "unknown" };
+    if (r.state === "expired") return { ok: false, error: "expired" };
+    if (r.state !== "pending") return { ok: false, error: "unknown" };
+    r.state = state;
+    if (state === "denied") r.forgetAt = now + PAIR_ENDED_KEEP_MS;
+    return { ok: true, request: view(r) };
+  }
+
+  /** Expire requests past their time; forget ended ones. */
+  private sweep(): void {
+    const now = this.now();
+    for (const [id, r] of this.byId) {
+      if (
+        (r.state === "pending" || r.state === "approved") &&
+        now >= r.expiresAt
+      ) {
+        r.state = "expired";
+        r.forgetAt = r.expiresAt + PAIR_ENDED_KEEP_MS;
+      }
+      if (r.forgetAt !== undefined && now >= r.forgetAt) this.byId.delete(id);
+    }
+  }
+}
+
+function view(r: PairRequest): PairView {
+  return {
+    code: formatPairCode(r.code),
+    state: r.state,
+    device: r.device,
+    ...(r.client ? { client: r.client } : {}),
+    createdAt: r.createdAt,
+    expiresAt: r.expiresAt,
+  };
+}

package/src/ui/server/pair-routes.ts

@@ -0,0 +1,196 @@
+/**
+ * SEC-2a's approve-with-a-code routes (pair-requests.ts):
+ *
+ *   POST /api/signin/code          a new request (sign-in free; an allowed
+ *                                  Origin, no CSRF token: the signed-out
+ *                                  page holds none). Its poll id, code,
+ *                                  expiry, and the commands that approve it
+ *   GET  /api/signin/code/<id>     its state; approved: the session cookie,
+ *                                  once (the request is consumed)
+ *   GET  /api/web/waiting          the requests waiting (shell-grade)
+ *   POST /api/web/approve {code}   approve one (shell-grade: `<cli> web
+ *                                  approve`, Settings › Access)
+ *   POST /api/web/deny {code}      deny one (shell-grade)
+ *
+ * Approve and deny are audited with the actor; neither the code nor the
+ * poll id is logged.
+ */
+import type * as http from "http";
+import type { PairRequests, PairView } from "./pair-requests.js";
+
+export interface PairRouteDeps {
+  pairs: PairRequests;
+  sendJson: (res: http.ServerResponse, body: unknown, status?: number) => void;
+  readBody: (req: http.IncomingMessage) => Promise<string>;
+  /** A new browser session for this request (via "code"); its Set-Cookie line. */
+  signIn: (req: http.IncomingMessage) => string;
+  /** The client's address for a new request's record, when Den knows it. */
+  client: (req: http.IncomingMessage) => string | undefined;
+  /** The commands that approve `code`: on the server, and by ssh from the browser's machine. */
+  commands: (
+    req: http.IncomingMessage,
+    code: string,
+  ) => { approve: string; ssh: string };
+  /** Record an approve or deny (who, what, whether it was refused). */
+  audit: (
+    req: http.IncomingMessage,
+    verb: "approve" | "deny",
+    detail: string,
+    refused?: string,
+  ) => void;
+}
+
+const POLL_PATH = /^\/api\/signin\/code\/([A-Za-z0-9_-]{16,64})$/;
+
+/** Whether `pathname` is one of these routes' (index.ts dispatches them here). */
+export function isPairRoute(pathname: string): boolean {
+  return (
+    pathname === "/api/signin/code" ||
+    POLL_PATH.test(pathname) ||
+    pathname === "/api/web/waiting" ||
+    pathname === "/api/web/approve" ||
+    pathname === "/api/web/deny"
+  );
+}
+
+function waitingJson(v: PairView): Record<string, unknown> {
+  return {
+    code: v.code,
+    device: v.device,
+    ...(v.client ? { client: v.client } : {}),
+    createdAt: new Date(v.createdAt).toISOString(),
+    expiresAt: new Date(v.expiresAt).toISOString(),
+  };
+}
+
+const ERRORS: Record<string, { status: number; error: string }> = {
+  malformed: {
+    status: 400,
+    error:
+      "That isn't a code: it is six letters and digits, like K7Q-42M (the signed-out page shows it).",
+  },
+  unknown: {
+    status: 404,
+    error:
+      "No device is waiting with that code. Check the code on the other computer's page; it may have been used or replaced.",
+  },
+  expired: {
+    status: 410,
+    error:
+      "That code expired. On the other computer, click Get a new code and approve the new one.",
+  },
+  rate_limited: {
+    status: 429,
+    error: "Too many approve attempts. Wait a minute and try again.",
+  },
+};
+
+/** Handles a route here; false when `pathname` is none of them. */
+export async function handlePairRoutes(
+  req: http.IncomingMessage,
+  res: http.ServerResponse,
+  pathname: string,
+  deps: PairRouteDeps,
+): Promise<boolean> {
+  const method = (req.method ?? "GET").toUpperCase();
+  res.setHeader("Cache-Control", "no-store");
+
+  if (pathname === "/api/signin/code" && method === "POST") {
+    const r = deps.pairs.create({
+      userAgent: req.headers["user-agent"],
+      client: deps.client(req),
+    });
+    deps.sendJson(res, {
+      ok: true,
+      id: r.id,
+      code: r.code,
+      expiresAt: new Date(r.expiresAt).toISOString(),
+      // What is left, for the page's own countdown (no clock skew).
+      expiresIn: Math.max(0, r.expiresAt - Date.now()),
+      ...deps.commands(req, r.code),
+    });
+    return true;
+  }
+  const p = POLL_PATH.exec(pathname);
+  if (p && (method === "GET" || method === "HEAD")) {
+    const v = deps.pairs.get(p[1]);
+    if (!v) {
+      deps.sendJson(
+        res,
+        {
+          ok: false,
+          state: "gone",
+          code: "not_found",
+          error: "That request ended. Get a new code.",
+        },
+        404,
+      );
+      return true;
+    }
+    if (v.state === "approved") {
+      if (!deps.pairs.claim(p[1])) {
+        deps.sendJson(res, { ok: false, state: "gone" }, 404);
+        return true;
+      }
+      res.setHeader("Set-Cookie", deps.signIn(req));
+      deps.sendJson(res, { ok: true, state: "ok" });
+      return true;
+    }
+    deps.sendJson(res, {
+      ok: v.state === "pending",
+      state: v.state,
+      expiresAt: new Date(v.expiresAt).toISOString(),
+    });
+    return true;
+  }
+
+  if (
+    pathname === "/api/web/waiting" &&
+    (method === "GET" || method === "HEAD")
+  ) {
+    deps.sendJson(res, { waiting: deps.pairs.waiting().map(waitingJson) });
+    return true;
+  }
+
+  if (
+    (pathname === "/api/web/approve" || pathname === "/api/web/deny") &&
+    method === "POST"
+  ) {
+    const verb = pathname === "/api/web/approve" ? "approve" : "deny";
+    let body: { code?: unknown } = {};
+    try {
+      body = (JSON.parse((await deps.readBody(req)) || "{}") ??
+        {}) as typeof body;
+    } catch {
+      deps.sendJson(
+        res,
+        {
+          ok: false,
+          code: "bad_request",
+          error: "the body must be JSON: { code }",
+        },
+        400,
+      );
+      return true;
+    }
+    const r =
+      verb === "approve"
+        ? deps.pairs.approve(String(body.code ?? ""))
+        : deps.pairs.deny(String(body.code ?? ""));
+    if (!r.ok) {
+      const e = ERRORS[r.error];
+      deps.audit(req, verb, "a waiting device", e.error);
+      deps.sendJson(
+        res,
+        { ok: false, code: r.error, error: e.error },
+        e.status,
+      );
+      return true;
+    }
+    const who = [r.request.device, r.request.client].filter(Boolean).join(", ");
+    deps.audit(req, verb, `a waiting device (${who})`);
+    deps.sendJson(res, { ok: true, ...waitingJson(r.request) });
+    return true;
+  }
+  return false;
+}