@monster-orange/den 0.4.4 → 0.4.5

package/src/shared/web-session.ts

@@ -21,6 +21,7 @@ import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
 import * as fs from "fs";
 import * as path from "path";
 import * as yaml from "yaml";
+import { parseMachineName } from "./cli-command.js";
 import { getStateDir } from "./paths.js";
 
 export const LOGIN_CODE_TTL_MS = 60_000;
@@ -98,6 +99,14 @@ export function checkLoginCode(
   return { ok: true, nonce: m[2], expiresAt };
 }
 
+/** A login code's nonce, from its shape alone (unverified), or null. */
+export function loginCodeNonce(code: string): string | null {
+  const m = /^v1\.([A-Za-z0-9_-]{22})\.[0-9a-z]{1,11}\.[A-Za-z0-9_-]{43}$/.exec(
+    code,
+  );
+  return m ? m[1] : null;
+}
+
 /**
  * Where a sign-in may send the browser: a same-origin relative path, else
  * `/`. `//evil`, `/\evil`, `http://evil`, a control character or a path back
@@ -167,8 +176,30 @@ export interface WebAuthConfig {
    * never the distribution's), and warned about at start.
    */
   plainHttpInDistribution?: string;
+  /**
+   * `web.github_client_id` (SEC-2a): the GitHub App whose device flow signs
+   * the owner in. user.yml over the distribution config; unset: the MO Den
+   * app's (github-app.ts).
+   */
+  githubClientId?: string;
+  /**
+   * `web.edge_unattested` (SEC-2a, user.yml only): what an edge request
+   * whose client Den can't place gets. `signin` (the default): it signs in;
+   * `local`: it is treated as this machine (0.4.4's allow).
+   */
+  edgeUnattested: EdgeUnattested;
+  /** The distribution config's file when it sets `web.edge_unattested`: ignored there. */
+  edgeUnattestedInDistribution?: string;
+  /**
+   * `web.machine_name` (SEC-2a, user.yml only): the name the signed-out
+   * page gives this machine ("runs on <name>"). Unset: the short hostname.
+   */
+  machineName?: string;
 }
 
+/** `web.edge_unattested`'s values. */
+export type EdgeUnattested = "local" | "signin";
+
 function readYaml(file: string): Record<string, unknown> {
   try {
     const v = yaml.parse(fs.readFileSync(file, "utf-8")) as unknown;
@@ -210,6 +241,12 @@ export function ignoredConfigWarning(cfg: WebAuthConfig): string | null {
       `${cfg.ignored.join(", ")}: ignored. A browser session never expires; ` +
         "it ends at sign-out or `web logout`. Remove the key to silence this.",
     );
+  if (cfg.edgeUnattestedInDistribution)
+    lines.push(
+      `web.edge_unattested (${cfg.edgeUnattestedInDistribution}): ignored. ` +
+        "It is a choice for one machine, read only from config/local/user.yml; " +
+        "move it there on the machine that needs it, and remove it here.",
+    );
   if (cfg.plainHttpInDistribution)
     lines.push(
       `web.allow_plain_http_remote (${cfg.plainHttpInDistribution}): ignored. ` +
@@ -241,15 +278,47 @@ export function readWebAuthConfig(
     throw new Error(
       `web.allow_plain_http_remote must be true or false, got ${JSON.stringify(plain)}`,
     );
+  const unattested = user.edge_unattested;
+  if (
+    unattested !== undefined &&
+    unattested !== "local" &&
+    unattested !== "signin"
+  )
+    throw new Error(
+      `web.edge_unattested must be local or signin, got ${JSON.stringify(unattested)}`,
+    );
+  const clientId =
+    clientIdOf(user, "config/local/user.yml") ?? clientIdOf(team, configFile);
+  const machineName = parseMachineName(user.machine_name);
   return {
+    ...(machineName ? { machineName } : {}),
     allowPlainHttpRemote: plain === true,
     ignored,
+    edgeUnattested: unattested ?? "signin",
+    ...(clientId !== undefined ? { githubClientId: clientId } : {}),
     ...(team.allow_plain_http_remote !== undefined
       ? { plainHttpInDistribution: configFile }
       : {}),
+    ...(team.edge_unattested !== undefined
+      ? { edgeUnattestedInDistribution: configFile }
+      : {}),
   };
 }
 
+/** `web.github_client_id` in one file: a GitHub App client id, or unset. */
+function clientIdOf(
+  w: Record<string, unknown>,
+  file: string,
+): string | undefined {
+  const v = w.github_client_id;
+  if (v === undefined || v === null) return undefined;
+  if (typeof v !== "string" || !/^[A-Za-z0-9._-]{0,64}$/.test(v.trim()))
+    throw new Error(
+      `web.github_client_id (${file}) must be a GitHub App client id (letters, digits, dots, dashes), got ${JSON.stringify(v)}`,
+    );
+  return v.trim();
+}
+
 // ── The session store ──────────────────────────────────────────────────────
 
 export interface SessionRecord {
@@ -260,6 +329,14 @@ export interface SessionRecord {
   csrf: string;
   /** The Host it was issued on. */
   host: string;
+  /** SEC-2a: how it signed in: a GitHub sign-in, or a one-time link (pairing). Unset: a link (before 0.4.5). */
+  via?: "github" | "link" | "code";
+  /** SEC-2a: the client's address when Den could attest it. */
+  client?: string;
+  /** SEC-2a: a GitHub sign-in's login (the chip's "@login"). */
+  login?: string;
+  /** SEC-2a: not yet greeted ("This device is signed in…", once). */
+  welcome?: true;
 }
 
 interface StoreFile {
@@ -384,7 +461,13 @@ export class WebSessionStore {
   }
 
   /** A new session: its id (the cookie's value) and record. */
-  create(meta: { userAgent?: string; host?: string }): {
+  create(meta: {
+    userAgent?: string;
+    host?: string;
+    via?: "github" | "link" | "code";
+    client?: string;
+    login?: string;
+  }): {
     id: string;
     session: SessionView;
   } {
@@ -400,6 +483,10 @@ export class WebSessionStore {
       host: String(meta.host ?? "")
         .toLowerCase()
         .slice(0, 255),
+      ...(meta.via ? { via: meta.via } : {}),
+      ...(meta.client ? { client: String(meta.client).slice(0, 64) } : {}),
+      ...(meta.login ? { login: String(meta.login).slice(0, 64) } : {}),
+      welcome: true,
     };
     const data = structuredClone(this.load());
     this.prune(data, now);
@@ -438,6 +525,19 @@ export class WebSessionStore {
     }
   }
 
+  /**
+   * Whether this session is yet to be greeted, once: true the first time
+   * after its sign-in, and never again (the flag is cleared).
+   */
+  takeWelcome(key: string): boolean {
+    const data = this.load();
+    if (!data.sessions[key]?.welcome) return false;
+    const next = structuredClone(data);
+    delete next.sessions[key].welcome;
+    this.trySave(next);
+    return true;
+  }
+
   /** Every session, newest first. */
   list(): SessionView[] {
     return Object.entries(this.load().sessions)
@@ -489,3 +589,37 @@ export class WebSessionStore {
 export function sessionIdPrefix(key: string): string {
   return key.slice(0, 8);
 }
+
+/**
+ * A linked device's name from its User-Agent (SEC-2a: "Chrome on macOS"),
+ * or "Unknown browser".
+ */
+export function deviceName(userAgent: string | undefined): string {
+  const ua = String(userAgent ?? "");
+  const browser = /Edg\//.test(ua)
+    ? "Edge"
+    : /Firefox\//.test(ua)
+      ? "Firefox"
+      : /(Chrome|CriOS)\//.test(ua)
+        ? "Chrome"
+        : /Safari\//.test(ua)
+          ? "Safari"
+          : /curl\//.test(ua)
+            ? "curl"
+            : null;
+  const os = /iPhone|iPad|iPod/.test(ua)
+    ? "iOS"
+    : /Android/.test(ua)
+      ? "Android"
+      : /Mac OS X|Macintosh/.test(ua)
+        ? "macOS"
+        : /Windows/.test(ua)
+          ? "Windows"
+          : /CrOS/.test(ua)
+            ? "ChromeOS"
+            : /Linux/.test(ua)
+              ? "Linux"
+              : null;
+  if (browser && os) return `${browser} on ${os}`;
+  return browser ?? (os ? `A browser on ${os}` : "Unknown browser");
+}

package/src/ui/cli/flag-parser.ts

@@ -179,7 +179,7 @@ function validateFlagScopes(parsed: ParsedCliArgs): void {
  */
 export const SUBCOMMAND_OWN_HELP: Readonly<Record<string, readonly string[]>> =
   {
-    web: ["token", "login", "sessions", "logout"],
+    web: ["token", "login", "sessions", "logout", "owner", "approve"],
     mcp: ["connect", "disconnect", "clients", "config"],
   };