@songsid/agend 2.3.0 → 2.3.2-beta.1

package/dist/ui/shared/view-strings.js

@@ -52,6 +52,7 @@ register("view", {
   "usageFull": "Full",
   "usageFullTitle": "The full card for each login",
   "usageExpand": "Show the full card",
+  "usageCachedAt": "cached at {at}",
   "usageCollapse": "Back to one line",
   "usageWindowHours": "{n}h",
   "usageWindowDays": "{n}d",
@@ -294,6 +295,7 @@ register("view", {
   "usageFull": "完整",
   "usageFullTitle": "每個登入顯示完整卡片",
   "usageExpand": "顯示完整卡片",
+  "usageCachedAt": "快取於 {at}",
   "usageCollapse": "收回成一行",
   "usageWindowHours": "{n}小時",
   "usageWindowDays": "{n}天",

package/dist/ui/shared/web-authorize.js

@@ -12,7 +12,6 @@ register("webauth", {
     authorize: "Authorize this browser",
     waiting: "Waiting for your Confirm in Discord or Telegram ({0})",
     sent: "Sent — confirm it in your DM within 5 minutes.",
-    publicLink: "Not on the temporary public link: open the dashboard directly to authorize.",
     reason_disabled: "Web authority is turned off.",
     reason_loopback_only: "Only this computer can authorize, and this browser is not on it.",
     reason_no_account: "This browser was not signed in as an account (agend web): sign in with /web to authorize.",
@@ -20,7 +19,8 @@ register("webauth", {
     reason_not_admin_session: "Guests can't authorize.",
     reason_token_rotated: "The dashboard's token changed: sign in again.",
     reason_public_link: "Not on the temporary public link.",
-    reason_named_link_off: "Over your named link: turn on \"Also over my named link\" in Settings → Web on this computer.",
+    reason_named_link_off: "Over your named link: turn on \"Also over my named link\" in Settings → Access & security on this computer.",
+    reason_quick_link_off: "Over the temporary public link: turn on \"Also over the temporary public link\" in Settings → Access & security on this computer.",
     reason_not_session: "Sign in to authorize.",
     reason_other: "This browser can't be authorized here.",
     refusal_pending: "A request is already waiting in your DM.",
@@ -39,7 +39,6 @@ register("webauth", {
     authorize: "授權這個瀏覽器",
     waiting: "等你在 Discord 或 Telegram 按下確認（{0}）",
     sent: "已送出——請在 5 分鐘內到私訊確認。",
-    publicLink: "臨時公開連結上無法授權：請直接開啟儀表板再授權。",
     reason_disabled: "網頁授權已關閉。",
     reason_loopback_only: "只有這台電腦可以授權，而這個瀏覽器不在這台電腦上。",
     reason_no_account: "這個瀏覽器不是用帳號登入的（agend web）：請用 /web 登入後再授權。",
@@ -47,7 +46,8 @@ register("webauth", {
     reason_not_admin_session: "訪客無法授權。",
     reason_token_rotated: "儀表板的 token 已變更：請重新登入。",
     reason_public_link: "臨時公開連結上無法授權。",
-    reason_named_link_off: "透過固定網域：請在這台電腦的 設定 → 網頁 開啟「也允許透過我的固定網域」。",
+    reason_named_link_off: "透過固定網域：請在這台電腦的 設定 → 存取與安全 開啟「也允許透過我的固定網域」。",
+    reason_quick_link_off: "透過臨時公開連結：請在這台電腦的 設定 → 存取與安全 開啟「也允許透過臨時公開連結」。",
     reason_not_session: "登入後才能授權。",
     reason_other: "這個瀏覽器在這裡無法授權。",
     refusal_pending: "已經有一個請求在你的私訊中等待。",
@@ -62,7 +62,9 @@ register("webauth", {
   },
 });
 const tn = (k, ...v) => t(`webauth.${k}`, ...v);
-const REASONS = ["disabled", "loopback_only", "no_account", "not_admin", "not_admin_session", "token_rotated", "public_link", "named_link_off", "not_session"];
+// The switch and "Only this computer" are changed in Settings on this computer — never over the public link (#2525 review).
+const fixable = (reason) => (reason === "disabled" || reason === "loopback_only") && globalThis.document?.body?.dataset?.publicLink !== "1";
+const REASONS = ["disabled", "loopback_only", "no_account", "not_admin", "not_admin_session", "token_rotated", "public_link", "named_link_off", "quick_link_off", "not_session"];
 // Until when: the time, with the day when it isn't today (an authorization lasts up to 48 h).
 const clock = (ms) => {
   const d = new Date(ms), today = new Date().toDateString() === d.toDateString();
@@ -70,7 +72,6 @@ const clock = (ms) => {
     : d.toLocaleString([], { weekday: "short", month: "short", day: "numeric", hour: "2-digit", minute: "2-digit" });
 };
 const mmss = (ms) => { const s = Math.max(0, Math.ceil(ms / 1000)); return `${Math.floor(s / 60)}:${String(s % 60).padStart(2, "0")}`; };
-const publicLink = () => globalThis.document?.body?.dataset?.publicLink === "1";
 
 // One read per page load, shared by every line that shows it (the composer's, the session menu's): coming back to a chat
 // reads nothing (#1374). It is read again only after an ask, and while a card is pending.
@@ -98,7 +99,9 @@ export function useWebAuthorization() {
   const [deadline, setDeadline] = useState(0), [now, setNow] = useState(() => Date.now());
   const alive = useRef(true);
   const load = async () => {
-    if (publicLink() || guestPage()) return;
+    // §0.2 / §0.3: over the public link too — the server says whether this browser may be authorized there (its link's
+    // option on) or why not; a guest never asks.
+    if (guestPage()) return;
     const body = await readStatus();
     if (!alive.current) return;
     if (signedOut) { setSt(null); setNotice(null); return; }
@@ -144,7 +147,6 @@ export function resetWebAuthorization() { shared = null; answered = false; infli
 export function AuthorizeChip() {
   const a = useWebAuthorization();
   if (guestPage()) return null;
-  if (publicLink()) return html`<p class="webauth-chip note" data-state="public">${tn("publicLink")}</p>`;
   if (!a.st) return null;
   return html`<div class="webauth-chip" data-state=${a.st.state}>${body(a)}${a.notice ? html` <span class="note" role="status">${a.notice}</span>` : null}</div>`;
 }
@@ -163,7 +165,6 @@ export function ComposerAuth() {
   const tip = useRef("wa-tip-" + Math.random().toString(36).slice(2, 8));
   useEffect(() => { setOpen(false); }, [a.st && a.st.state]);              // a new state closes the bubble
   if (guestPage()) return null;
-  if (publicLink()) return html`<span class="webauth-row note" data-state="public" title=${tn("publicLink")}>${tn("publicLink")}</span>`;
   if (!a.st) return null;
   const st = a.st, id = tip.current;
   const said = a.notice ? html`<span class="webauth-notice" role="status">${a.notice}</span>` : null;
@@ -184,8 +185,8 @@ export function ComposerAuth() {
       title=${tn("authorizeWhy")} aria-label=${tn("authorizeWhy")} onClick=${a.ask}>${tn("authorizeShort")}</button>${said}</span>`;
   }
   const why = REASONS.includes(st.reason) ? tn(`reason_${st.reason}`) : tn("reason_other");
-  return html`<span class="webauth-row" data-state="none"><span class="note" title=${why}>${tn("notVerified")}<span class="sr-only">: ${why}</span></span>${st.reason === "disabled" || st.reason === "loopback_only"
-    ? html` · <a href="/settings/web" title=${why}>${tn("settings")}</a>` : null}</span>`;
+  return html`<span class="webauth-row" data-state="none"><span class="note" title=${why}>${tn("notVerified")}<span class="sr-only">: ${why}</span></span>${fixable(st.reason)
+    ? html` · <a href="/settings/access" title=${why}>${tn("settings")}</a>` : null}</span>`;
 }
 
 function body(a) {
@@ -196,5 +197,5 @@ function body(a) {
     return html`<span class="note">${tn("notVerified")} ·</span> <button type="button" class="btn btn-sm" onClick=${a.ask}>${tn("authorize")}</button>`;
   const why = REASONS.includes(st.reason) ? tn(`reason_${st.reason}`) : tn("reason_other");
   // The fix, where there is one the person can take here: the switch lives in Settings → Web.
-  return html`<span class="note">${tn("notVerified")}: ${why}</span>${st.reason === "disabled" || st.reason === "loopback_only" ? html` <a href="/settings/web">${tn("settings")}</a>` : null}`;
+  return html`<span class="note">${tn("notVerified")}: ${why}</span>${fixable(st.reason) ? html` <a href="/settings/access">${tn("settings")}</a>` : null}`;
 }

package/dist/web-api.d.ts

@@ -9,6 +9,7 @@ import type { ModStore } from "./web-mod-store.js";
 import type { WebEffectService } from "./web-effect-service.js";
 import type { ThemeStore } from "./web-theme-store.js";
 import type { OfficeStore, OfficeWriteLimiter } from "./web-office-store.js";
+import { type OfficeSkinStore } from "./web-office-skins.js";
 import type { WebAppearance } from "./web-appearance.js";
 import type { SendOpts } from "./channel/types.js";
 import type { IncomingMessage, ServerResponse } from "node:http";
@@ -195,6 +196,10 @@ export interface WebApiContext {
     readonly officeStore?: OfficeStore;
     /** How often a person may save the offices (absent: no limit, as in a test without it). */
     readonly officeWrites?: OfficeWriteLimiter;
+    /** #2513: the Office view's uploaded skin packs (web-office-skins/); absent: /ui/office-skins is not offered. */
+    readonly officeSkins?: OfficeSkinStore;
+    /** How often a person may upload or delete a skin pack (absent: no limit). */
+    readonly officeSkinWrites?: OfficeWriteLimiter;
     readonly webAppearance?: WebAppearance;
     /** #1629 r4-5: installed mods and a person's staged import. */
     readonly mods?: ModStore;
@@ -212,7 +217,7 @@ export interface WebApiContext {
     } | null;
     /** A fleet.yaml instance (own key) or a ClassicBot room, now. */
     isKnownInstance?(name: string): boolean;
-    startInstance(name: string, config: unknown, topicMode: boolean): Promise<void>;
+    startInstance(name: string, config: unknown, topicMode: boolean, kind?: "fleet-topic" | "classic", resumePaused?: boolean): Promise<void>;
     stopInstance(name: string): Promise<{
         backgroundWorkEnded: boolean;
     }>;
@@ -402,8 +407,9 @@ export interface WebPerson {
     readonly platformName?: string;
 }
 /**
- * #1939 §3.4 / #2453 §0.2: where this request came from — the admin's named link by the gateway's own provenance (its
- * exact hostname), else what the TCP peer and Host say (a quick tunnel's request is `lan`, and refused as public_link).
+ * #1939 §3.4 / #2453 §0.2 / §0.3: where this request came from — over the public gateway, the link itself by the
+ * gateway's own provenance (never a header): the admin's named tunnel on its exact hostname, else the temporary
+ * quick-tunnel link. Off the gateway, what the TCP peer and Host say.
  */
 export declare function webPeerOf(req: IncomingMessage): WebPeer;
 export declare function handleWebRequest(req: IncomingMessage, res: ServerResponse, url: URL, ctx: WebApiContext): boolean;

package/dist/web-api.js

@@ -15,6 +15,7 @@ import { AGENT_WIDGET_SLOTS, checkWidgetData, checkWidgetSpec } from "./web-widg
 import { checkOwnerCss, ownerCssAssetRefs } from "./web-owner-css.js";
 import { canonicalText } from "./web-theme.js";
 import { EFFECT_WIRE_LIMIT } from "./web-effect-upload.js";
+import { SKIN_WIRE_BYTES } from "./web-office-skins.js";
 import { gatewayRequestContext } from "./web-request-context.js";
 import { crossInstanceVisibility } from "./cross-instance-notice.js";
 import { permitWebContinuation } from "./web-continuation.js";
@@ -447,6 +448,141 @@ function handleAppIcon(req, res, url, ctx, method) {
     });
     return true;
 }
+/**
+ * #2513: the Office view's skin packs (web-office-skins.ts). The reads are the offices' (GET /ui/offices): whoever may
+ * open the org chart, the public link too (its manifest lists them; a guest's routes do not): the list, a pack's
+ * manifest (?v=<sha>: immutable, else no-store) and its pictures (by the sha of their bytes: immutable, image/png,
+ * nosniff, sandboxed). The writes are PUT /ui/offices's: an admin session only — never the CLI token, never the public
+ * link (absent from its manifest, and refused here too) — asked again once the body is in; rate limited per person.
+ * Every page hears `office_skins` on the stream and reads the list again.
+ */
+function handleOfficeSkins(req, res, url, ctx, path, method) {
+    const store = ctx.officeSkins;
+    if (!store) {
+        json(res, 404, { error: "Skin packs are not kept on this fleet" });
+        return true;
+    }
+    const one = /^\/ui\/office-skins\/([A-Za-z0-9_-]{1,40})$/.exec(path);
+    const picture = /^\/ui\/office-skins\/([A-Za-z0-9_-]{1,40})\/img\/([0-9a-f]{32})\.png$/.exec(path);
+    if (method === "GET" || method === "HEAD") {
+        res.setHeader("X-Content-Type-Options", "nosniff");
+        if (path === "/ui/office-skins") {
+            res.setHeader("Cache-Control", "private, no-store");
+            json(res, 200, store.list());
+            return true;
+        }
+        if (one) {
+            const pack = store.get(one[1]);
+            if (!pack) {
+                res.setHeader("Cache-Control", "private, no-store");
+                json(res, 404, { error: "skin_unknown" });
+                return true;
+            }
+            const v = url.searchParams.get("v");
+            res.setHeader("Cache-Control", v === pack.sha ? "private, max-age=31536000, immutable" : "private, no-store");
+            json(res, 200, pack);
+            return true;
+        }
+        if (picture) {
+            const bytes = store.picture(picture[1], picture[2]);
+            if (!bytes) {
+                res.setHeader("Cache-Control", "private, no-store");
+                json(res, 404, { error: "No such image" });
+                return true;
+            }
+            res.setHeader("Content-Type", "image/png");
+            // Keyed by the sha of its bytes: a picture at this URL never changes.
+            res.setHeader("Cache-Control", "private, max-age=31536000, immutable");
+            res.setHeader("Content-Security-Policy", "default-src 'none'; sandbox");
+            res.writeHead(200);
+            res.end(method === "HEAD" ? undefined : bytes);
+            return true;
+        }
+        json(res, 404, { error: "not found" });
+        return true;
+    }
+    const upload = method === "POST" && path === "/ui/office-skins", removal = method === "DELETE" && !!one;
+    if (!upload && !removal) {
+        json(res, 404, { error: "not found" });
+        return true;
+    }
+    if (gatewayRequestContext(req)) {
+        json(res, 403, { error: "skins_not_over_public_link" });
+        return true;
+    }
+    const who = () => {
+        const verdict = evaluateWebRequest(req, url, ctx.webToken ?? null, ctx.webSessions, { touch: false });
+        if (verdict.kind !== "allow")
+            return { status: 401 };
+        return verdict.via === "session" && verdict.session?.tier === "admin" ? { person: verdict.session.owner ? webPersonKey(verdict.session.owner) : "admin-session" } : { status: 403 };
+    };
+    const refuse = (status) => json(res, status, { error: status === 401 ? WEB_TOKEN_INVALID_MESSAGE : "skins_need_an_admin_session" });
+    const first = who();
+    if ("status" in first) {
+        refuse(first.status);
+        return true;
+    }
+    const limited = (person) => {
+        const allowed = ctx.officeSkinWrites ? ctx.officeSkinWrites.check(person) : { ok: true };
+        if (allowed.ok)
+            return false;
+        res.setHeader("Retry-After", String(allowed.retry_after_s));
+        json(res, 429, { error: "skins_rate_limited", retry_after_s: allowed.retry_after_s });
+        return true;
+    };
+    const answer = (r, body, person) => {
+        if (!r.ok) {
+            json(res, r.status, { error: r.error, ...(r.detail ? { detail: r.detail } : {}) });
+            return;
+        }
+        ctx.officeSkinWrites?.record(person);
+        ctx.emitSseEvent("office_skins", { rev: r.rev });
+        json(res, 200, body());
+    };
+    if (removal) {
+        if (limited(first.person))
+            return true;
+        const r = store.remove(one[1]);
+        answer(r, () => ({ rev: r.ok ? r.rev : "" }), first.person);
+        return true;
+    }
+    (async () => {
+        let bytes;
+        try {
+            bytes = await readBoundedWebBody(req, SKIN_WIRE_BYTES);
+        }
+        catch {
+            json(res, 413, { error: "skin_too_large", detail: `at most ${Math.floor(SKIN_WIRE_BYTES / 1024 / 1024)} MiB a request` });
+            return;
+        }
+        if (!permitWebContinuation(req, res, ctx))
+            return;
+        const now = who();
+        if ("status" in now) {
+            refuse(now.status);
+            return;
+        }
+        let body;
+        try {
+            body = JSON.parse(bytes.toString("utf8"));
+        }
+        catch {
+            json(res, 400, { error: "Invalid JSON" });
+            return;
+        }
+        if (limited(now.person))
+            return;
+        const r = store.add(body, now.person);
+        answer(r, () => (r.ok ? { rev: r.rev, pack: r.pack } : null), now.person);
+    })().catch(err => {
+        ctx.logger.error({ err: err.message }, "Uploading a skin pack failed");
+        try {
+            json(res, 500, { error: "Uploading a skin pack failed" });
+        }
+        catch { /* already answered */ }
+    });
+    return true;
+}
 /**
  * #1629 r4 §3: the owner-CSS routes (see their call site). `who()`, asked first and again after any body: the person a
  * signed-in human session is, or the status to answer.
@@ -1311,11 +1447,13 @@ function webAuthorityOf(req, url, ctx, instance) {
         peer: webPeerOf(req), ...(instance !== undefined ? { instance } : {}) });
 }
 /**
- * #1939 §3.4 / #2453 §0.2: where this request came from — the admin's named link by the gateway's own provenance (its
- * exact hostname), else what the TCP peer and Host say (a quick tunnel's request is `lan`, and refused as public_link).
+ * #1939 §3.4 / #2453 §0.2 / §0.3: where this request came from — over the public gateway, the link itself by the
+ * gateway's own provenance (never a header): the admin's named tunnel on its exact hostname, else the temporary
+ * quick-tunnel link. Off the gateway, what the TCP peer and Host say.
  */
 export function webPeerOf(req) {
-    return gatewayRequestContext(req)?.named === true ? "named_link" : classifyWebPeer(req);
+    const gateway = gatewayRequestContext(req);
+    return gateway ? (gateway.named === true ? "named_link" : "quick_link") : classifyWebPeer(req);
 }
 /**
  * #2122: what let this request in, asked now — its session (by handle, under the token it was signed in with) or the
@@ -2074,6 +2212,8 @@ export function handleWebRequest(req, res, url, ctx) {
         });
         return true;
     }
+    if (path === "/ui/office-skins" || path.startsWith("/ui/office-skins/"))
+        return handleOfficeSkins(req, res, url, ctx, path, method);
     // ── #1630: avatars and Discord server emoji, same-origin (the page never loads a platform's CDN; img-src stays 'self') ──
     const imageMatch = path.match(/^\/ui\/img\/(bot|avatar|emoji)\/([^/]+)$/);
     if (method === "GET" && imageMatch) {
@@ -2625,7 +2765,7 @@ export function handleWebRequest(req, res, url, ctx) {
         (async () => {
             let held = false;
             try {
-                await withSpawnHoldReply(async (message) => { held = true; json(res, 202, { held: true, message, instance: name }); }, () => ctx.startInstance(name, config, topicMode ?? false));
+                await withSpawnHoldReply(async (message) => { held = true; json(res, 202, { held: true, message, instance: name }); }, () => ctx.startInstance(name, config, topicMode ?? false, "fleet-topic", true));
                 ctx.emitSseEvent("status", ctx.getUiStatus());
                 if (!held)
                     json(res, 200, { started: name });
@@ -3268,10 +3408,10 @@ export function handleWebRequest(req, res, url, ctx) {
                 return [403, "usage_report_not_over_public_link"];
             return null;
         };
-        // Over the public link, where to turn it on: Settings → Web on the dashboard reached directly (this computer's own
+        // Over the public link, where to turn it on: Settings → Web dashboard on the dashboard reached directly (this computer's own
         // address — the public link's Settings only reads). Never the public origin's own Settings, which cannot change it.
         const answer = ([status, error]) => json(res, status, {
-            error, ...(status === 403 ? { settings: `http://localhost:${ctx.fleetConfig?.health_port ?? 19280}/settings/web` } : {})
+            error, ...(status === 403 ? { settings: `http://localhost:${ctx.fleetConfig?.health_port ?? 19280}/settings/web-dashboard` } : {})
         });
         const first = refusal();
         if (first) {
@@ -3866,6 +4006,11 @@ function handleUpload(req, res, url, ctx) {
     // staging a file never wakes it. A stopped or deleted recipient must not regain an upload id.
     const deliverable = () => uploadRecipient(ctx, instance);
     const gone = () => drop(() => json(res, 404, { error: `Instance not found: ${instance}` }));
+    // #2366: a guest's scope (and whether guests may chat) is asked again at each commit point — narrowed, revoked or made
+    // read-only while the body was arriving, the upload is refused and its part file removed, as it would have been at
+    // the start. Read now: the scope is never stored (guestRequestOf's scope() is the fleet's guestScope as it is now).
+    const guestNow = () => guestChatRefusal(guestRequestOf(req), instance);
+    const refuseGuest = (r) => drop(() => json(res, r.status, { error: r.error }));
     req.on("end", () => {
         if (over)
             return;
@@ -3880,6 +4025,11 @@ function handleUpload(req, res, url, ctx) {
             drop(() => json(res, 415, { error: "the file is empty" }));
             return;
         }
+        const refusedAtEnd = guestNow();
+        if (refusedAtEnd) {
+            refuseGuest(refusedAtEnd);
+            return;
+        }
         if (!deliverable()) {
             gone();
             return;
@@ -3892,6 +4042,11 @@ function handleUpload(req, res, url, ctx) {
                 drop();
                 return;
             }
+            const refusedAtFinish = guestNow(); // #2366: and the guest's scope may have changed in it
+            if (refusedAtFinish) {
+                refuseGuest(refusedAtFinish);
+                return;
+            }
             if (!deliverable()) {
                 gone();
                 return;