@timqi/pier 0.0.16 → 0.0.17

package/dist/web/public/index.html

@@ -33,8 +33,8 @@
        which style.css pays for with the safe-area inset. -->
   <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
   <title>Pier</title>
-  <script type="module" crossorigin src="/assets/index-DVUvzNK1.js"></script>
-  <link rel="stylesheet" crossorigin href="/assets/index-2E9_cwpg.css">
+  <script type="module" crossorigin src="/assets/index-DAxKtidH.js"></script>
+  <link rel="stylesheet" crossorigin href="/assets/index-CtR-Ob4T.css">
 </head>
 <!-- The document never scrolls: this is a fixed-viewport workbench, and every
      scrollable region is an inner pane. h-dvh, not h-screen, because 100vh can

package/dist/web/push.js

@@ -10,6 +10,7 @@
 import { readableTitle } from "../core/identity.js";
 import { pierDb } from "../db.js";
 import { logger } from "../log.js";
+import { sessionIdOf } from "./auth.js";
 import { generateVapidKeys, sendPush, } from "./webpush.js";
 const log = logger("push");
 /** Devices kept at once. A browser mints a new subscription whenever the old
@@ -29,6 +30,10 @@ const MAX_BODY_CHARS = 160;
  *  browser bug rather than as an unnamed session — and a listing that could
  *  not answer must not silence the push. */
 const label = (s) => readableTitle(s?.title) || s?.cwd.split("/").filter(Boolean).at(-1) || "Pier session";
+/** SQLite's "that parent row does not exist" — the session ended. Anything
+ *  else that goes wrong here is a broken database, not a signed-out browser. */
+const FOREIGN_KEY_VIOLATION = 787;
+const sessionGone = (err) => err.errcode === FOREIGN_KEY_VIOLATION;
 /** Subscriptions and the instance's VAPID identity. Both are per-instance
  *  facts nobody edits by hand, so they live beside every other one. */
 export class PushStore {
@@ -59,14 +64,16 @@ export class PushStore {
             .all();
     }
     /** Upsert: a browser re-posts the same subscription on every load, which is
-     *  what repairs a row this instance lost. */
-    save(target, label) {
+     *  what repairs a row this instance lost — and what re-attaches one to the
+     *  session that is signed in now. */
+    save(target, label, sessionId) {
         this.#db
-            .prepare(`INSERT INTO push_subscriptions(endpoint, p256dh, auth, label, created_at)
-         VALUES (?, ?, ?, ?, ?)
+            .prepare(`INSERT INTO push_subscriptions(endpoint, p256dh, auth, label, created_at, session_id)
+         VALUES (?, ?, ?, ?, ?, ?)
          ON CONFLICT(endpoint) DO UPDATE SET
-           p256dh = excluded.p256dh, auth = excluded.auth, label = excluded.label`)
-            .run(target.endpoint, target.p256dh, target.auth, label, Date.now());
+           p256dh = excluded.p256dh, auth = excluded.auth, label = excluded.label,
+           session_id = excluded.session_id`)
+            .run(target.endpoint, target.p256dh, target.auth, label, Date.now(), sessionId);
         this.#db
             .prepare(`DELETE FROM push_subscriptions WHERE endpoint NOT IN
            (SELECT endpoint FROM push_subscriptions ORDER BY created_at DESC LIMIT ?)`)
@@ -222,7 +229,23 @@ export function registerPushRoutes(app, deps) {
         if (!target)
             return c.json({ error: "not a push subscription" }, 400);
         const label = String(body.label ?? "a browser").slice(0, 80);
-        store.save(target, label);
+        // The session that is asking owns the subscription, and the foreign key is
+        // what makes signing this browser out take the subscription with it. It can
+        // refuse: the boundary let this request in and the browser was signed out
+        // while its body was still arriving. Say so rather than 500 — the browser
+        // is about to be sent to the login form by its next request anyway.
+        try {
+            store.save(target, label, sessionIdOf(c));
+        }
+        catch (err) {
+            // Only that. A full or read-only database answering 401 would send a
+            // signed-in browser to the login form, where the password it types will
+            // not help either.
+            if (!sessionGone(err))
+                throw err;
+            log.warn(`subscription refused for a session that ended: ${String(err)}`);
+            return c.json({ error: "session ended" }, 401);
+        }
         log.info(`subscribed ${label}`);
         return c.json({ ok: true }, 201);
     });

package/dist/web/terminal.js

@@ -11,7 +11,7 @@ import { isAbsolute } from "node:path";
 import { spawn } from "node-pty";
 import { WebSocketServer } from "ws";
 import { logger } from "../log.js";
-import { upgradeAuthorized } from "./auth.js";
+import { ALL, upgradeAuthorized } from "./auth.js";
 const log = logger("terminal");
 /** Live shells at once — a guard against forgotten spawns, not a quota. */
 const MAX_TERMS = 8;
@@ -276,10 +276,18 @@ export function attachTerminal(server, auth, opts = {}) {
     });
     server.once("close", () => hub.close());
     wss.on("error", (err) => log.error("terminal WebSocket server failed", err));
-    auth.onRotation(() => {
-        log.info("password changed; closing terminal clients");
-        for (const client of wss.clients)
-            client.close(1008, "password changed");
+    // A shell outlives the request that opened it, so revocation has to reach it
+    // here: the session that opened this socket was signed out (or every session
+    // was, by a password change), and the terminal goes with it.
+    const sessionOf = new WeakMap();
+    const revoked = new WeakSet();
+    auth.onRevoke((id) => {
+        for (const client of wss.clients) {
+            if (id !== ALL && sessionOf.get(client) !== id)
+                continue;
+            revoked.add(client);
+            client.close(1008, "signed out");
+        }
     });
     server.on("upgrade", (req, socket, head) => {
         let url;
@@ -296,14 +304,15 @@ export function attachTerminal(server, auth, opts = {}) {
             socket.destroy();
             return;
         }
-        if (!upgradeAuthorized(auth, req)) {
+        const sessionId = upgradeAuthorized(auth, req);
+        if (!sessionId) {
             log.warn("refused terminal upgrade (unauthorized)");
             socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
             socket.destroy();
             return;
         }
-        const authKey = auth.cookieKey;
         wss.handleUpgrade(req, socket, head, (ws) => {
+            sessionOf.set(ws, sessionId);
             alive.add(ws);
             ws.on("pong", () => alive.add(ws));
             // Frames can land while attach() is resolving realpath; hold a bounded
@@ -320,9 +329,10 @@ export function attachTerminal(server, auth, opts = {}) {
             ws.on("message", (data, binary) => {
                 if (closed)
                     return;
-                if (auth.cookieKey !== authKey) {
+                // A frame can already be in flight when the close above goes out.
+                if (revoked.has(ws)) {
                     closed = true;
-                    ws.close(1008, "password changed");
+                    ws.close(1008, "signed out");
                     return;
                 }
                 if (binary) {

package/docs/deploy.md

@@ -229,8 +229,16 @@ sqlite3 ~/.pier/db/pier.db 'DELETE FROM auth'
 pier restart
 ```
 
-Changing the password invalidates every session cookie: the cookies are signed
-with the stored hash.
+Changing the password signs out every browser: the session rows behind the
+cookies are deleted. So does the recovery above — a new password does not leave
+the old one's browsers signed in. To end one browser without changing the
+password, use Settings → Instance → Signed-in devices. A session that is not
+used expires 7 days after its last request. However a session ends — signed
+out, expired, password changed, password recovered — its push subscription is
+deleted with it, so that browser stops being notified as well.
+
+The upgrade that introduced these rows signs everyone out once: a cookie issued
+before it names no row. Have the password to hand.
 
 ## Restarting and reloading
 
@@ -400,7 +408,8 @@ elsewhere, pick a tunnel rather than a wider bind:
   there, preserve the external `Host` (or pass `X-Forwarded-Host`), and pass
   `X-Forwarded-For`; Pier uses the external host for write-origin checks and
   counts login failures per forwarded client. Its session cookie is marked
-  `Secure` when the proxy reports `X-Forwarded-Proto: https`. The proxy must
+  `Secure` when a loopback proxy reports `X-Forwarded-Proto: https` (the header
+  is ignored from anywhere else, where it is a header the client wrote). The proxy must
   pass WebSocket upgrades for `/api/terminal` (Caddy does automatically;
   nginx needs its usual HTTP/1.1 `Upgrade`/`Connection` forwarding).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timqi/pier",
-  "version": "0.0.16",
+  "version": "0.0.17",
   "description": "A self-hosted workspace for coding agents: web workbench and IM channels in front of Pi sessions",
   "license": "AGPL-3.0-only",
   "repository": "github:timqi/pier",