@timqi/pier 0.1.7 → 0.1.9

package/dist/web/auth.js

@@ -20,6 +20,10 @@ const MAX_AGE_MS = 90 * 24 * 60 * 60_000;
 const TOUCH_MS = 5 * 60_000;
 /** Not an id any row can have. */
 export const ALL = "*";
+/** A `pier login` link is walked to a browser within this; single use. */
+const LINK_TTL_MS = 2 * 60_000;
+/** Outstanding links at once — an operator minting a handful, not a queue. */
+const MAX_LINKS = 10;
 const MAX_FAILURES = 10;
 const WINDOW_MS = 15 * 60_000;
 /** Distinct throttle buckets retained at once; the last is shared overflow. */
@@ -45,6 +49,8 @@ export class AuthStore {
     #db;
     #sql;
     #revokeListeners = new Set();
+    /** In memory only: a link outlives neither the process nor two minutes. */
+    #links = new Map();
     constructor(db = pierDb(), print = (m) => log.info(m)) {
         this.#db = db;
         this.#sql = statements(db);
@@ -97,6 +103,7 @@ export class AuthStore {
                 .run(salt, hash(password, salt), Date.now());
             this.#dropSessions();
         });
+        this.#links.clear();
         this.#revoked(ALL);
     }
     open(ip, agent) {
@@ -135,8 +142,11 @@ export class AuthStore {
     }
     /** Listeners hear the same id: a revoked cookie must also close what it opened. */
     revoke(id) {
-        if (id === ALL)
+        // An unspent link is a session about to exist: "sign everyone out" ends it too.
+        if (id === ALL) {
             this.#dropSessions();
+            this.#links.clear();
+        }
         else
             this.#sql("DELETE FROM web_sessions WHERE id = ?").run(id);
         this.#revoked(id);
@@ -145,6 +155,25 @@ export class AuthStore {
         return this.#sql("SELECT id, created_at AS createdAt, seen_at AS seenAt, ip, agent" +
             " FROM web_sessions WHERE seen_at > ? ORDER BY seen_at DESC").all(Date.now() - TTL_MS);
     }
+    /** A one-time sign-in token for `pier login`: the terminal on Pier's own
+     *  machine is the door, not the password or a passkey. Oldest evicted at cap. */
+    mintLink() {
+        const now = Date.now();
+        for (const [token, expiresAt] of this.#links)
+            if (expiresAt <= now)
+                this.#links.delete(token);
+        while (this.#links.size >= MAX_LINKS)
+            this.#links.delete(this.#links.keys().next().value);
+        const token = randomBytes(32).toString("base64url");
+        this.#links.set(token, now + LINK_TTL_MS);
+        return token;
+    }
+    /** Consumed on the first look, valid or not. */
+    redeemLink(token) {
+        const expiresAt = this.#links.get(token);
+        this.#links.delete(token);
+        return expiresAt !== undefined && expiresAt > Date.now();
+    }
     /** A long-lived authenticated surface (SSE) closes itself when its cookie is revoked. */
     onRevoke(listener) {
         this.#revokeListeners.add(listener);
@@ -163,12 +192,17 @@ export class AuthStore {
 }
 const hash = (password, salt) => scryptSync(password, salt, KEY_BYTES).toString("hex");
 const digest = (token) => createHash("sha256").update(token).digest("hex");
-/** The login form and `/p/*` — published boards and their stylesheet — are the
- *  one exempt prefix here (`/config-sync/:token` is mounted before this
- *  middleware, docs/architecture.md names both); `/boards/*` stays behind. */
+/** The login form, the passkey half of it (web/passkeys.ts) and `/p/*` —
+ *  published boards and their stylesheet — are the exemptions here
+ *  (`/config-sync/:token` is mounted before this middleware,
+ *  docs/architecture.md names both); `/boards/*` stays behind. */
 function isPublic(method, path) {
     if (path === "/login")
         return method === "GET" || method === "HEAD" || method === "POST";
+    if (path.startsWith("/login/"))
+        return method === "GET";
+    if (path === "/api/passkeys/login/options" || path === "/api/passkeys/login/verify")
+        return method === "POST";
     if (method !== "GET" && method !== "HEAD")
         return false;
     return path.startsWith("/p/");
@@ -182,10 +216,10 @@ function sameSecret(a, b) {
  *  to it — and they strip whitespace and control characters from a Location
  *  first, which turns `/<TAB>/evil.example` into one as well. Only a plain
  *  path survives; anything else is an open redirect. */
-const safeNext = (raw) => typeof raw === "string" && /^\/(?![/\\])\S*$/.test(raw) &&
+export const safeNext = (raw) => typeof raw === "string" && /^\/(?![/\\])\S*$/.test(raw) &&
     ![...raw].some((ch) => ch <= "\u001f" || ch === "\u007f")
     ? raw
-    : "/";
+    : "/app/";
 // In memory: the window is minutes, and the point is to make guessing slow.
 // Fresh identities spill into one overflow bucket once the cap is reached.
 const failures = new Map();
@@ -198,7 +232,7 @@ function remoteOf(c) {
 }
 /** A forwarded address is trusted only from a local reverse proxy, and only
  *  the rightmost hop, which that proxy appended. */
-function clientOf(c) {
+export function clientOf(c) {
     const remote = remoteOf(c);
     if (remote && !loopback(remote))
         return remote;
@@ -209,14 +243,16 @@ function failureClient(client) {
         return client;
     return OVERFLOW_CLIENT;
 }
-function throttled(client) {
+/** One throttle for every unauthenticated door: a passkey assertion is
+ *  guessed at from the same address as a password. */
+export function throttled(client) {
     const now = Date.now();
     for (const [id, entry] of failures)
         if (entry.resetAt <= now)
             failures.delete(id);
     return (failures.get(failureClient(client))?.count ?? 0) >= MAX_FAILURES;
 }
-function noteFailure(client) {
+export function noteFailure(client) {
     client = failureClient(client);
     const entry = failures.get(client);
     if (entry && entry.resetAt > Date.now())
@@ -224,6 +260,7 @@ function noteFailure(client) {
     else
         failures.set(client, { count: 1, resetAt: Date.now() + WINDOW_MS });
 }
+export const forgetFailures = (client) => void failures.delete(client);
 /** Hosts, not schemes: TLS commonly terminates at the reverse proxy. */
 function originMatches(origin, host) {
     if (!origin)
@@ -293,8 +330,22 @@ export function requireAuth(store) {
         sealBoundary(c);
     };
 }
-export function registerAuthRoutes(app, store) {
-    app.get("/login", (c) => c.html(loginPage(safeNext(c.req.query("next")))));
+/** Both sign-in doors end here: this browser's previous session is replaced,
+ *  never added to. Verified first: the id in an unverified cookie is a string
+ *  the caller chose, and `ALL` is one of them. */
+export function openSession(c, store, client) {
+    forgetFailures(client);
+    const previous = store.check(getCookie(c, COOKIE));
+    if (previous)
+        store.revoke(previous.id);
+    setSessionCookie(c, store.open(client, c.req.header("user-agent") ?? ""));
+}
+export const PASSWORD_OFF = "Password sign-in is off while a passkey is registered.";
+export function registerAuthRoutes(app, store, 
+/** While it answers true the password is refused and the form offers only
+ *  the passkey; read per request, so removing the last passkey needs no restart. */
+passkeysRegistered = () => false) {
+    app.get("/login", (c) => c.html(loginPage(safeNext(c.req.query("next")), undefined, passkeysRegistered())));
     app.post("/login", async (c) => {
         const client = clientOf(c);
         // Before the body is touched: parsing is work, and this is the one write a
@@ -302,7 +353,11 @@ export function registerAuthRoutes(app, store) {
         if (throttled(client)) {
             // A burst here is the only warning an operator gets that the port is being knocked on.
             log.warn(`login throttled for ${client}`);
-            return c.html(loginPage("/", "Too many attempts. Wait a few minutes."), 429);
+            return c.html(loginPage("/app/", "Too many attempts. Wait a few minutes.", passkeysRegistered()), 429);
+        }
+        if (passkeysRegistered()) {
+            log.warn(`password sign-in refused for ${client}: a passkey is registered`);
+            return c.html(loginPage("/app/", PASSWORD_OFF, true), 403);
         }
         if (!c.req.header("content-type")?.startsWith("application/x-www-form-urlencoded")) {
             return c.text("expected the sign-in form", 400);
@@ -324,17 +379,35 @@ export function registerAuthRoutes(app, store) {
             log.warn(`wrong password from ${client}`);
             return c.html(loginPage(next, "Wrong password."), 401);
         }
-        failures.delete(client);
         log.info(`login from ${client}`);
-        // Replaces this browser's session rather than adding one. Verified first:
-        // the id in an unverified cookie is a string the caller chose, and `ALL` is
-        // one of them.
-        const previous = store.check(getCookie(c, COOKIE));
-        if (previous)
-            store.revoke(previous.id);
-        setSessionCookie(c, store.open(client, c.req.header("user-agent") ?? ""));
+        openSession(c, store, client);
         return c.redirect(next);
     });
+    // The link `pier login` printed. Both refusals read the same and count on
+    // the throttle: a stranger must not learn whether a token was ever minted.
+    app.get("/login/:token", (c) => {
+        // The URL is the credential: no cache may hold the answer, no referrer carry it.
+        c.header("cache-control", "no-store");
+        c.header("referrer-policy", "no-referrer");
+        // Hono routes HEAD through GET: a link checker with a live cookie would spend the token.
+        if (c.req.method !== "GET") {
+            c.header("allow", "GET");
+            return c.body(null, 405);
+        }
+        const client = clientOf(c);
+        if (throttled(client)) {
+            log.warn(`login throttled for ${client}`);
+            return c.html(loginPage("/app/", "Too many attempts. Wait a few minutes.", passkeysRegistered()), 429);
+        }
+        if (!store.redeemLink(c.req.param("token"))) {
+            noteFailure(client);
+            log.warn(`stale or unknown sign-in link from ${client}`);
+            return c.html(loginPage("/app/", "That sign-in link has expired. Run pier login again.", passkeysRegistered()), 401);
+        }
+        log.info(`login from ${client} by link`);
+        openSession(c, store, client);
+        return c.redirect("/app/");
+    });
     // Re-authenticates: the boundary requires a live cookie, and knowing a
     // password is not permission to call APIs.
     app.post("/api/password", async (c) => {
@@ -344,6 +417,10 @@ export function registerAuthRoutes(app, store) {
         const next = typeof body?.next === "string" ? body.next : "";
         if (throttled(client))
             return c.json({ error: "Too many attempts. Wait a few minutes." }, 429);
+        if (passkeysRegistered()) {
+            log.warn(`password change refused for ${client}: a passkey is registered`);
+            return c.json({ error: PASSWORD_OFF }, 403);
+        }
         if (!store.verify(current)) {
             noteFailure(client);
             return c.json({ error: "Wrong current password." }, 403);
@@ -351,7 +428,7 @@ export function registerAuthRoutes(app, store) {
         if (next.length < MIN_LENGTH) {
             return c.json({ error: `Use at least ${MIN_LENGTH} characters.` }, 400);
         }
-        failures.delete(client);
+        forgetFailures(client);
         store.setPassword(next);
         // The rotation dropped this caller's row too; clear the dead cookie.
         deleteCookie(c, COOKIE, { path: "/" });
@@ -396,9 +473,58 @@ function setSessionCookie(c, value) {
         maxAge: TTL_MS / 1000,
     });
 }
-/** Self-contained: it links nothing the boundary would refuse to serve. */
-function loginPage(next, error) {
+/** Self-contained: it links nothing the boundary would refuse to serve. With a
+ *  passkey registered the form is the one button; its script does the
+ *  base64url ↔ bytes conversion by hand, since Safari lacks
+ *  `parseRequestOptionsFromJSON`. */
+function loginPage(next, error, passkey = false) {
     const attr = (s) => s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;");
+    const fields = passkey
+        ? `<input type="hidden" name="next" value="${attr(next)}" />
+    <button type="submit" id="passkey" autofocus>Sign in with a passkey</button>`
+        : `<input type="password" name="password" placeholder="Password" autocomplete="current-password"
+      autofocus required />
+    <input type="hidden" name="next" value="${attr(next)}" />
+    <button type="submit">Sign in</button>`;
+    const script = passkey
+        ? `<script>
+(() => {
+  const form = document.querySelector("form"), button = document.getElementById("passkey");
+  const say = (text) => { document.getElementById("err").textContent = text; };
+  const bytes = (s) => Uint8Array.from(atob(s.replace(/-/g, "+").replace(/_/g, "/")), (ch) => ch.charCodeAt(0));
+  const text = (buf) => btoa(String.fromCharCode(...new Uint8Array(buf))).replace(/\\+/g, "-").replace(/\\//g, "_").replace(/=+$/, "");
+  if (!window.PublicKeyCredential) { say("This browser has no passkey support."); button.disabled = true; return; }
+  form.onsubmit = async (ev) => {
+    ev.preventDefault();
+    button.disabled = true;
+    say("");
+    try {
+      const opts = await fetch("/api/passkeys/login/options", { method: "POST" });
+      const publicKey = await opts.json().catch(() => ({}));
+      if (!opts.ok) throw new Error(publicKey.error || "Could not start the sign-in (" + opts.status + ")");
+      publicKey.challenge = bytes(publicKey.challenge);
+      publicKey.allowCredentials = publicKey.allowCredentials.map((cred) => ({ ...cred, id: bytes(cred.id) }));
+      const cred = await navigator.credentials.get({ publicKey });
+      const r = cred.response;
+      const res = await fetch("/api/passkeys/login/verify", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          id: cred.id, type: cred.type, next: form.elements.next.value,
+          response: { clientDataJSON: text(r.clientDataJSON), authenticatorData: text(r.authenticatorData), signature: text(r.signature) },
+        }),
+      });
+      const body = await res.json().catch(() => ({}));
+      if (!res.ok) throw new Error(body.error || "Sign-in refused (" + res.status + ")");
+      location.href = body.next;
+    } catch (err) {
+      say(String(err && err.message || err));
+      button.disabled = false;
+    }
+  };
+})();
+</script>`
+        : "";
     return `<!doctype html>
 <html lang="en">
 <head>
@@ -423,13 +549,10 @@ function loginPage(next, error) {
 <body>
   <form method="post" action="/login">
     <h1>Pier</h1>
-    ${error ? `<p>${attr(error)}</p>` : ""}
-    <input type="password" name="password" placeholder="Password" autocomplete="current-password"
-      autofocus required />
-    <input type="hidden" name="next" value="${attr(next)}" />
-    <button type="submit">Sign in</button>
+    <p id="err">${error ? attr(error) : ""}</p>
+    ${fields}
   </form>
-</body>
+${script}</body>
 </html>
 `;
 }

package/dist/web/instance.js

@@ -1,7 +1,8 @@
 // Routes about the Pier instance itself: settings, updates, secrets control,
 // the browser's error reports. Nothing here touches a session.
 import { logger } from "../log.js";
-import { normalizeModelMenu, normalizeModelRef, normalizePublicUrl, } from "../settings.js";
+import { ACCENTS, normalizeAccent, normalizeModelMenu, normalizeModelRef, normalizePublicUrl, } from "../settings.js";
+import { boundHost } from "./passkeys.js";
 /** A rule that failed inside the transaction, distinct from a real fault: 400
  *  for a name this Pier does not have, 409 for a collision with current state. */
 class Refusal extends Error {
@@ -15,7 +16,7 @@ const withName = (current, { name, on }) => on ? [...new Set([...current, name])
 /** A browser bug can fire in a loop, and the journal is shared. */
 const CLIENT_LOG_PER_MINUTE = 60;
 export function registerInstanceRoutes(app, deps) {
-    const { settings, updates, updater = null, secrets, catalog, names = [], onUnlocked, onSettingsChanged, onToolsChanged, validateCustomTools, } = deps;
+    const { settings, passkeys, updates, updater = null, secrets, catalog, names = [], onUnlocked, onSettingsChanged, onToolsChanged, validateCustomTools, } = deps;
     const updateLog = logger("update");
     // A busy Pier drains first, which can take minutes, and a response held that
     // long dies at every proxy: past this cap the answer is "draining".
@@ -47,6 +48,8 @@ export function registerInstanceRoutes(app, deps) {
         const shown = await catalog?.();
         return {
             ...settings.get(),
+            /** The presets the swatches are drawn from: one table, the server's. */
+            accents: ACCENTS,
             catalog: shown?.entries ?? [],
             /** The install and every daily update is one task's history. */
             toolsTaskId: shown?.toolsTaskId ?? null,
@@ -108,11 +111,11 @@ export function registerInstanceRoutes(app, deps) {
     app.put("/api/settings", async (c) => {
         const body = await c.req.json().catch(() => null);
         const fields = body
-            ? [body.publicUrl, body.modelMenu, body.titleModel, body.autoUpdate, body.customTools, body.tool]
+            ? [body.publicUrl, body.modelMenu, body.titleModel, body.autoUpdate, body.customTools, body.tool, body.accent]
             : [];
         if (!fields.some((v) => v !== undefined)) {
             return c.json({
-                error: "publicUrl, modelMenu, titleModel, autoUpdate, customTools or tool required",
+                error: "publicUrl, modelMenu, titleModel, autoUpdate, customTools, tool or accent required",
             }, 400);
         }
         // One transaction: a new custom tool and the switch that turns it on must
@@ -125,8 +128,20 @@ export function registerInstanceRoutes(app, deps) {
             const publicUrl = normalizePublicUrl(body.publicUrl);
             if (publicUrl === null)
                 return refuse("not a URL: expected http(s)://host, no query or fragment");
+            const bound = passkeys ? boundHost(passkeys, settings.get().publicUrl) : null;
+            if (bound && (!publicUrl.startsWith("https://") || new URL(publicUrl).hostname !== bound)) {
+                return refuse(`passkeys are bound to ${bound}; remove them first`);
+            }
             writes.push(() => settings.setPublicUrl(publicUrl));
         }
+        if (body?.accent !== undefined) {
+            if (typeof body.accent !== "string")
+                return refuse("accent must be a string");
+            const accent = normalizeAccent(body.accent);
+            if (accent === null)
+                return refuse(`accent must be one of ${Object.keys(ACCENTS).join(", ")}, or empty`);
+            writes.push(() => settings.setAccent(accent));
+        }
         if (body?.modelMenu !== undefined) {
             const menu = normalizeModelMenu(body.modelMenu);
             if (menu === null)