@wizzlethorpe/vaults 0.13.2 → 0.14.0

package/dist/render/auth-template.js

@@ -2,11 +2,13 @@
 // role list and password hashes baked in. Validates session cookies, redirects
 // to /login on a missing/expired cookie, and rewrites every request to the
 // matching `_variants/<role>/` path before letting Pages serve it.
+import { htmlAttr, htmlEscape } from "../escape.js";
 export function renderAuthMiddleware(cfg) {
     const rolesLiteral = JSON.stringify(cfg.roles);
     const passwordsLiteral = JSON.stringify(cfg.rolePasswords);
     const patreonLiteral = JSON.stringify(cfg.patreon ?? null);
     const oidcLiteral = JSON.stringify(cfg.oidc ?? null);
+    const foundryLiteral = JSON.stringify(!!cfg.foundry);
     return `// Auto-generated by the vaults CLI. Do not edit by hand.
 // Roles, password hashes, and routing live here so the deployed Function
 // is fully self-contained and doesn't need any other binding besides
@@ -18,6 +20,9 @@ const ROLES = ${rolesLiteral};
 const PASSWORDS = ${passwordsLiteral};
 const PATREON = ${patreonLiteral};
 const OIDC = ${oidcLiteral};
+// False on a deploy that opted out of the Foundry integration; the /_batch
+// endpoints below are the API its module syncs through and nothing else uses.
+const FOUNDRY = ${foundryLiteral};
 const COOKIE_NAME = "vault_role";
 // Non-HttpOnly companion cookie carrying the role name only; the auth check
 // uses COOKIE_NAME (which is signed and HttpOnly), this one is purely for UI.
@@ -26,6 +31,20 @@ const COOKIE_MAX_AGE = 60 * 60 * 24 * 7; // 7 days
 // Bearer tokens (used by Foundry, MCP clients) get a much longer lifetime
 // since refreshing means reopening a browser-based approval flow.
 const BEARER_MAX_AGE = 60 * 60 * 24 * 90; // 90 days
+// Long enough to paste a URL somewhere and press install, short enough that a
+// leaked one is worthless. Deliberately not single-use: a use-count needs
+// server-side state, and this deploy has none by design, so the honest
+// stateless equivalent is a small window. Pre-signed URLs everywhere else
+// work the same way for the same reason.
+const LINK_MAX_AGE = 60 * 10; // 10 minutes
+// Tokens carry their purpose so the two are not interchangeable: without
+// this a 7-day session cookie and a 90-day bearer were byte-identical in
+// format, so either could be replayed as the other.
+const TOKEN_TYPE_SESSION = "s";
+const TOKEN_TYPE_BEARER = "b";
+// A link token. Separate from a bearer because it is honoured on ordinary
+// navigation, which a bearer deliberately is not — see readRole.
+const TOKEN_TYPE_LINK = "l";
 const PBKDF2_DEFAULT_ITERATIONS = 100000;
 // Same shape as a real PBKDF2 hash (iterations:saltHex:hashHex with the
 // expected lengths) but with all-zero salt + hash. Used to keep the
@@ -37,6 +56,25 @@ const DUMMY_PASSWORD_HASH = "100000:" + "0".repeat(32) + ":" + "0".repeat(64);
 // ── Public middleware entry ────────────────────────────────────────────────
 
 export const onRequest = async (ctx) => {
+  return withSecurityHeaders(await handleRequest(ctx));
+};
+
+/**
+ * Headers every response gets, added at the one exit so redirects and error
+ * responses are covered too.
+ *
+ * Referrer-Policy is load-bearing here rather than hygiene: the Foundry sync
+ * passes its bearer as ?_token= in the URL, and without this any external
+ * link on a page fetched that way would carry the token in the Referer.
+ */
+function withSecurityHeaders(response) {
+  const out = new Response(response.body, response);
+  out.headers.set("Referrer-Policy", "no-referrer");
+  out.headers.set("X-Content-Type-Options", "nosniff");
+  return out;
+}
+
+const handleRequest = async (ctx) => {
   const { request, env, next } = ctx;
   const url = new URL(request.url);
 
@@ -88,6 +126,14 @@ export const onRequest = async (ctx) => {
     return handleConnectApprove(request, env);
   }
 
+  // /_link. Mints a short-lived, self-authenticating URL for one path, for
+  // consumers that cannot carry the session cookie. Foundry's module
+  // installer is the motivating one: it runs on the Foundry server, not in
+  // the browser, so it needs a URL that stands on its own.
+  if (url.pathname === "/_link" && request.method === "GET") {
+    return handleLink(request, env);
+  }
+
   // /auth/patreon/* — only mounted when the build saw a Patreon config.
   // Issues the same signed session cookie as password login on success;
   // failure paths bounce back to /login with an error param.
@@ -115,7 +161,7 @@ export const onRequest = async (ctx) => {
   // newline-separated paths under text/plain so the request stays CORS-
   // simple (no preflight per file → no OPTIONS rate-limit). Response is
   // JSON: { files: { path: content }, missing: [path, ...] }.
-  if (url.pathname === "/_batch" && request.method === "POST") {
+  if (FOUNDRY && url.pathname === "/_batch" && request.method === "POST") {
     return withCors(await handleBatch(request, env), request);
   }
 
@@ -123,7 +169,7 @@ export const onRequest = async (ctx) => {
   // /_batch but each file is base64-encoded so it can ride in JSON. Used by
   // the Foundry image cache so a 300-image sync is a handful of HTTP calls
   // instead of 300 GETs that hit Cloudflare's per-IP rate limit.
-  if (url.pathname === "/_batch-images" && request.method === "POST") {
+  if (FOUNDRY && url.pathname === "/_batch-images" && request.method === "POST") {
     return withCors(await handleBatchBinary(request, env), request);
   }
 
@@ -135,6 +181,20 @@ export const onRequest = async (ctx) => {
   // Determine the user's role from the session cookie (default = lowest).
   const role = await readRole(request, env);
 
+  // Installing a Foundry module is two fetches: the manifest, then the zip its
+  // download field names. A gated manifest is a static file, so it cannot
+  // carry a live token for that second fetch, and the zip would 401 — the
+  // install fails halfway with nothing useful said about why.
+  //
+  // So a manifest fetched with a link token gets its download URL signed to
+  // match, with the same short expiry. The rewrite only ever fires when a
+  // valid link token is present and the field points back at this site, so it
+  // cannot be used to attach our signature to somebody else's URL.
+  const linkToken = new URL(request.url).searchParams.get("_token");
+  const linkRole = linkToken
+    ? await verifyToken(linkToken, env.SESSION_SECRET, TOKEN_TYPE_LINK)
+    : null;
+
   // env.ASSETS canonicalizes URLs (strips .html, strips index.html, redirects
   // with 308s); passing those redirects through to the browser would expose
   // the /_variants/<role>/ path, which the guard at the top of this function
@@ -150,6 +210,11 @@ export const onRequest = async (ctx) => {
       response = await env.ASSETS.fetch(rewritten);
     }
   }
+  if (linkRole && response.ok && /\.json$/i.test(url.pathname)) {
+    const signed = await signManifestDownload(response, url, env, linkRole);
+    if (signed) return signed;
+  }
+
   // Replace bare 404s with the variant's styled 404 page so the reader stays
   // inside the site (sidebar, search, sitemap intact). Only HTML navigation
   // requests get the page; asset/API requests get the bare 404 unchanged.
@@ -280,10 +345,31 @@ async function handleBatchInner(request, env, maxPaths, encode) {
     if (!isSafePath(p)) return batchError(400, "Invalid path: " + p);
   }
 
-  // ASSETS.fetch is internal to the worker, so fan-out is cheap.
+  // Which rendering to return, which is not always the caller's own.
+  //
+  // A page carries its own role, and the sync client marks a page readable by
+  // players when that role is below the DM tier. If it then filled that page
+  // with the *DM's* rendering — which is what happens when the variant is
+  // always the caller's — a public page ends up holding DM content and
+  // readable by players. A base view filtered by role is exactly that shape:
+  // one row per creature for the DM, one for everyone else, same page.
+  //
+  // So a caller may ask for any variant at or below their own tier. Below,
+  // because that is content they can already read; never above.
   const url = new URL(request.url);
+  const requested = url.searchParams.get("role");
+  let variant = role;
+  if (requested !== null) {
+    const wantIdx = ROLES.indexOf(requested);
+    if (wantIdx === -1 || wantIdx > ROLES.indexOf(role)) {
+      return batchError(403, "Cannot request that variant.");
+    }
+    variant = requested;
+  }
+
+  // ASSETS.fetch is internal to the worker, so fan-out is cheap.
   const entries = await Promise.all(paths.map(async (p) => {
-    const target = new URL("/_variants/" + role + "/" + encodeVariantPath(p), url.origin).toString();
+    const target = new URL("/_variants/" + variant + "/" + encodeVariantPath(p), url.origin).toString();
     const res = await env.ASSETS.fetch(target);
     if (!res.ok) return [p, null];
     return [p, await encode(res)];
@@ -337,10 +423,11 @@ async function handleConnectGet(request, env) {
   const url = new URL(request.url);
   const app = url.searchParams.get("app") || "an external app";
 
-  // Require login first; the user's role is what we're authorising.
+  // Require login first; the user's role is what we're authorising. The
+  // default role is the unauthenticated one, so it is the whole test —
+  // any other role can only have come from a verified cookie or token.
   const role = await readRole(request, env);
-  const isLoggedIn = role !== ROLES[0] || PASSWORDS[role] != null;
-  if (!isLoggedIn || role === ROLES[0]) {
+  if (role === ROLES[0]) {
     // Default role; redirect to login first, come back here on success.
     const next = url.pathname + url.search;
     return new Response(null, {
@@ -363,11 +450,98 @@ async function handleConnectApprove(request, env) {
     return new Response("Not signed in.", { status: 401 });
   }
 
-  const token = await signToken(role, env.SESSION_SECRET, BEARER_MAX_AGE);
+  const token = await signToken(role, env.SESSION_SECRET, BEARER_MAX_AGE, TOKEN_TYPE_BEARER);
   const html = renderConnectCopyPage({ token, role, app });
   return new Response(html, { headers: { "Content-Type": "text/html; charset=utf-8" } });
 }
 
+/**
+ * Issue a short-lived URL for a single vault path.
+ *
+ * The token carries the caller's own role, so this grants nothing they could
+ * not already fetch with their cookie; it only moves that authority into a
+ * URL, and puts a short clock on it.
+ *
+ * The path is confined to this deploy: it is resolved against the origin and
+ * rejected if it leaves, so a caller cannot get us to sign a link pointing at
+ * somewhere else.
+ */
+async function handleLink(request, env) {
+  const url = new URL(request.url);
+  // Minting requires a session or a bearer, never a link token: otherwise one
+  // leaked install URL renews itself indefinitely instead of expiring.
+  const role = await readRole(request, env, { rejectLinkTokens: true });
+  if (role === ROLES[0]) {
+    return jsonResponse({ error: "not signed in" }, 401);
+  }
+  const requested = url.searchParams.get("path") || "";
+  if (!requested) {
+    return jsonResponse({ error: "missing path" }, 400);
+  }
+  let target;
+  try {
+    target = new URL(requested, url.origin);
+  } catch {
+    return jsonResponse({ error: "bad path" }, 400);
+  }
+  if (target.origin !== url.origin) {
+    return jsonResponse({ error: "path must be on this site" }, 400);
+  }
+  const token = await signToken(role, env.SESSION_SECRET, LINK_MAX_AGE, TOKEN_TYPE_LINK);
+  target.searchParams.set("_token", token);
+  return jsonResponse({
+    url: target.toString(),
+    role,
+    expiresInMinutes: Math.round(LINK_MAX_AGE / 60),
+  }, 200);
+}
+
+/**
+ * Re-sign a module manifest's download URL so the second half of a Foundry
+ * install authenticates too.
+ *
+ * Returns null and leaves the response untouched for anything that is not a
+ * manifest with a same-origin download field, so an ordinary JSON asset
+ * fetched with a link token is served exactly as stored.
+ */
+async function signManifestDownload(response, url, env, role) {
+  let manifest;
+  try { manifest = await response.clone().json(); }
+  catch { return null; }
+  if (!manifest || typeof manifest.download !== "string") return null;
+
+  // Relative resolves onto whichever host this request arrived on, which is
+  // the point: a vault can be served from several (a pages.dev name and a
+  // custom domain), and a manifest that hard-codes one of them is wrong on
+  // the others whether or not tokens are involved.
+  //
+  // An absolute URL naming a different host is left alone. That is the guard
+  // against attaching our signature to somebody else's URL, and it cannot
+  // distinguish the vault's own second hostname from anyone else's — so a
+  // manifest that hard-codes the pages.dev name will not be signed when
+  // fetched over the custom domain. Write the field relative. The CLI warns
+  // when it is not.
+  let target;
+  try { target = new URL(manifest.download, url.origin); }
+  catch { return null; }
+  if (target.origin !== url.origin) return null;
+
+  const token = await signToken(role, env.SESSION_SECRET, LINK_MAX_AGE, TOKEN_TYPE_LINK);
+  target.searchParams.set("_token", token);
+  manifest.download = target.toString();
+  return new Response(JSON.stringify(manifest), {
+    status: 200,
+    headers: { "Content-Type": "application/json", "Cache-Control": "no-store" },
+  });
+}
+
+function jsonResponse(body, status) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json", "Cache-Control": "no-store" },
+  });
+}
+
 function renderApprovePage({ app, role }) {
   const escapedApp = escHtml(app);
   const escapedRole = escHtml(role);
@@ -809,6 +983,15 @@ function base64UrlEncode(bytes) {
   return btoa(s).replace(/\\+/g, "-").replace(/\\//g, "_").replace(/=+$/, "");
 }
 
+/** Inverse of base64UrlEncode for UTF-8 text. */
+function base64UrlDecodeUtf8(s) {
+  const b64 = s.replace(/-/g, "+").replace(/_/g, "/");
+  const bin = atob(b64);
+  const bytes = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
+  return new TextDecoder().decode(bytes);
+}
+
 // State cookie: stores { state, next } (plus the PKCE verifier for OIDC)
 // signed with SESSION_SECRET, used to verify the OAuth callback came from
 // our /start handler and not a forgery. Shared by both OAuth flows.
@@ -819,7 +1002,12 @@ async function signStateCookie(payload, secret) {
   const exp = Math.floor(Date.now() / 1000) + STATE_TTL;
   const data = JSON.stringify({ ...payload, exp });
   const sig = await hmac(data, secret);
-  const value = btoa(data) + "." + sig;
+  // The payload carries the next path, and btoa throws on any code point
+  // above U+00FF — so a page whose name uses a non-Latin1 character
+  // (Sunawi with a w-circumflex, Ordogok, Japanese) turned the /start
+  // handler into an unhandled 500. Encode the UTF-8 bytes instead.
+  // (No backticks in this comment: it is inside the middleware template.)
+  const value = base64UrlEncode(new TextEncoder().encode(data)) + "." + sig;
   return STATE_COOKIE + "=" + value
     + "; Path=/; Secure; SameSite=Lax; HttpOnly; Max-Age=" + STATE_TTL;
 }
@@ -833,10 +1021,12 @@ async function readStateCookie(request, secret) {
   const dataB64 = raw.slice(0, dot);
   const sig = raw.slice(dot + 1);
   let data;
-  try { data = atob(dataB64); }
+  try { data = base64UrlDecodeUtf8(dataB64); }
   catch { return null; }
   const expected = await hmac(data, secret);
-  if (sig !== expected) return null;
+  // Constant-time, matching verifyToken; a plain !== leaks the signature
+  // byte-by-byte through response timing.
+  if (!constantTimeEqual(sig, expected)) return null;
   let parsed;
   try { parsed = JSON.parse(data); }
   catch { return null; }
@@ -846,7 +1036,7 @@ async function readStateCookie(request, secret) {
 
 // ── Cookie + role lookup ──────────────────────────────────────────────────
 
-async function readRole(request, env) {
+async function readRole(request, env, opts) {
   const fallback = ROLES[0];
   if (!env.SESSION_SECRET) return fallback;
 
@@ -856,35 +1046,78 @@ async function readRole(request, env) {
   const auth = request.headers.get("Authorization") || "";
   const bearerMatch = /^Bearer\\s+(.+)$/i.exec(auth);
   if (bearerMatch) {
-    const role = await verifyToken(bearerMatch[1], env.SESSION_SECRET);
+    const role = await verifyToken(bearerMatch[1], env.SESSION_SECRET, TOKEN_TYPE_BEARER);
     if (role && ROLES.includes(role)) return role;
   }
 
   // ?_token=<token>; used by the Foundry module so cross-origin GETs stay
   // CORS-simple and don't trigger a preflight per file (Cloudflare rate-
   // limits OPTIONS bursts and a sync is hundreds of unique URLs).
+  //
+  // Only honoured on a request that says it is a subresource fetch. A token
+  // in a URL is a shareable credential that lands in browser history, access
+  // logs and Referer, and bearers last 90 days — so a pasted link must not
+  // quietly browse the site at someone else's role.
+  //
+  // Fails CLOSED: an absent Sec-Fetch-Mode means the token is ignored. The
+  // earlier version only rejected an explicit "navigate", which left the hole
+  // open for anything that does not send Fetch Metadata — a proxy that strips
+  // it, or a browser older than Chrome 76 / Firefox 90 / Safari 16.4. The
+  // query param exists purely so the sync client's cross-origin GETs stay
+  // CORS-simple, and that client is a browser, so it always sends the header.
+  // Anything that cannot has no reason to prefer the param: it can set an
+  // Authorization: Bearer header freely, which is checked above.
   const queryToken = new URL(request.url).searchParams.get("_token");
-  if (queryToken) {
-    const role = await verifyToken(queryToken, env.SESSION_SECRET);
+  if (queryToken && isSubresourceFetch(request)) {
+    const role = await verifyToken(queryToken, env.SESSION_SECRET, TOKEN_TYPE_BEARER);
+    if (role && ROLES.includes(role)) return role;
+  }
+
+  // A link token IS honoured on navigation, which is the whole reason it is a
+  // separate type. The rule above rests on bearers lasting 90 days; a link
+  // token lasts ten minutes, so the same reasoning does not reach it. It also
+  // has to work this way: Foundry's module installer accepts a URL and
+  // nothing else, so it cannot send the Authorization header the rule above
+  // points anything header-capable towards.
+  //
+  // It authenticates one request and sets no cookie, so a shared link does
+  // not turn into a session at someone else's role.
+  // Not accepted where a caller could use one to obtain another. A link token
+  // is a ten-minute grant, and a request that can mint a fresh one renews
+  // itself forever — which would quietly turn the short window that justifies
+  // honouring these on navigation into no window at all.
+  if (queryToken && !opts?.rejectLinkTokens) {
+    const role = await verifyToken(queryToken, env.SESSION_SECRET, TOKEN_TYPE_LINK);
     if (role && ROLES.includes(role)) return role;
   }
 
   const cookie = parseCookie(request.headers.get("Cookie") || "")[COOKIE_NAME];
   if (!cookie) return fallback;
-  const role = await verifyToken(cookie, env.SESSION_SECRET);
+  const role = await verifyToken(cookie, env.SESSION_SECRET, TOKEN_TYPE_SESSION);
   return role && ROLES.includes(role) ? role : fallback;
 }
 
+/**
+ * True only when the request explicitly identifies itself as a subresource
+ * fetch rather than a navigation. Absent headers count as "not a fetch", so
+ * the caller refuses rather than guesses.
+ */
+function isSubresourceFetch(request) {
+  const mode = request.headers.get("Sec-Fetch-Mode");
+  if (!mode || mode === "navigate") return false;
+  return request.headers.get("Sec-Fetch-Dest") !== "document";
+}
+
 // Format: <role>.<expiryUnix>.<hmacHex>
-async function signToken(role, secret, maxAgeSeconds) {
+async function signToken(role, secret, maxAgeSeconds, typ) {
   const exp = Math.floor(Date.now() / 1000) + maxAgeSeconds;
-  const payload = role + "." + exp;
+  const payload = typ + "." + role + "." + exp;
   const sig = await hmac(payload, secret);
   return payload + "." + sig;
 }
 
 async function signSessionCookie(role, secret) {
-  const value = await signToken(role, secret, COOKIE_MAX_AGE);
+  const value = await signToken(role, secret, COOKIE_MAX_AGE, TOKEN_TYPE_SESSION);
   // SameSite=None + Partitioned (CHIPS); required so the cookie persists
   // when the vault is loaded inside a cross-origin iframe (the Foundry
   // connect dialog). Partitioned scopes the cookie per parent origin, so
@@ -894,13 +1127,20 @@ async function signSessionCookie(role, secret) {
     + "; Path=/; HttpOnly; Secure; SameSite=None; Partitioned; Max-Age=" + COOKIE_MAX_AGE;
 }
 
-async function verifyToken(token, secret) {
+async function verifyToken(token, secret, expectedTyp) {
   const parts = token.split(".");
-  if (parts.length !== 3) return null;
-  const [role, expStr, sig] = parts;
+  // 4 parts is the typed form; 3 is the untyped one issued before session
+  // cookies and bearers were distinguishable. Legacy tokens still verify, for
+  // either purpose, so nobody is logged out by the upgrade — they age out on
+  // their own within 90 days. Drop this branch after that.
+  const legacy = parts.length === 3;
+  if (parts.length !== 4 && !legacy) return null;
+  const [typ, role, expStr, sig] = legacy ? [expectedTyp, ...parts] : parts;
+  if (typ !== expectedTyp) return null;
   const exp = Number(expStr);
   if (!Number.isFinite(exp) || exp < Math.floor(Date.now() / 1000)) return null;
-  const expected = await hmac(role + "." + expStr, secret);
+  const signed = legacy ? role + "." + expStr : typ + "." + role + "." + expStr;
+  const expected = await hmac(signed, secret);
   return constantTimeEqual(sig, expected) ? role : null;
 }
 
@@ -985,7 +1225,7 @@ function isSharedAsset(pathname) {
   //   - styles.css / user.css        — build.ts (writeFile join(outputDir, ...))
   //   - _handlers.js / _handlers.css — build.ts (handler asset bundles, root)
   //   - katex/…                      — build.ts (copyKatexAssets; math vaults only)
-  //   - _foundry/importer.js + version.json — build.ts (foundry-importer bundle)
+  //   - _foundry/importer.js            — build.ts (foundry-importer bundle)
   //   - login.html                   — build.ts (multi-role only)
   //   - favicon.ico                  — build.ts (buildFavicon)
   //   - functions/_middleware.js     — build.ts (multi-role only; not served)
@@ -1002,15 +1242,56 @@ function isSharedAsset(pathname) {
   if (pathname === "/_handlers.css") return true;
   if (pathname === "/katex/katex.min.css" || pathname.startsWith("/katex/fonts/")) return true;
   if (pathname === "/_foundry/importer.js") return true;
-  if (pathname === "/_foundry/version.json") return true;
   if (pathname === "/login.html") return true;
   if (pathname === "/favicon.ico" || pathname === "/favicon.svg") return true;
   if (pathname === "/robots.txt") return true;
+  if (pathname === "/sitemap.xml") return true;
   return false;
 }
 `;
 }
-export const LOGIN_HTML = `<!doctype html>
+/**
+ * Render `login.html` for a deploy, showing only the sign-in methods it
+ * actually has.
+ *
+ * A role is reachable by password only if a hash was set for it; Patreon and
+ * OIDC each carry their own role mappings. A deploy authenticating purely
+ * through a provider therefore gets no password form and no role selector —
+ * the selector only ever chose which password to check, so with one password
+ * role (or none) it is noise, and with none it would be a form that cannot
+ * succeed.
+ */
+export function renderLoginPage(opts) {
+    const { passwordRoles, patreonRoles, oidcDisplayName } = opts;
+    let form = "";
+    if (passwordRoles.length > 0) {
+        // One password role means there is nothing to choose, so the role rides
+        // as a hidden field and the visitor just types a password.
+        const rolePicker = passwordRoles.length === 1
+            ? `    <input type="hidden" name="role" value="${htmlAttr(passwordRoles[0])}">`
+            : `    <label for="role">Role</label>\n`
+                + `    <select id="role" name="role">`
+                + passwordRoles.map((r) => `<option value="${htmlAttr(r)}">${htmlEscape(r)}</option>`).join("")
+                + `</select>`;
+        form = `  <form id="login-form" method="POST" action="/login">\n`
+            + `${rolePicker}\n`
+            + `    <label for="password">Password</label>\n`
+            + `    <input id="password" type="password" name="password" autocomplete="current-password" required>\n`
+            + `    <input type="hidden" name="next" id="next">\n`
+            + `    <button type="submit">Sign in</button>\n`
+            + `  </form>`;
+    }
+    // Replacer *functions*, not strings: a string replacement interprets `$&`
+    // and friends, and oidcDisplayName is free text, so a provider named
+    // "Acme $& Co" would splice the placeholder back into the page.
+    const literal = (value) => () => value;
+    return LOGIN_HTML
+        .replace("__PASSWORD_FORM__", literal(form))
+        .replace("__PATREON_ROLES_ATTR__", literal(patreonRoles.length > 0
+        ? ` data-patreon-roles="${htmlAttr(patreonRoles.join(","))}"` : ""))
+        .replace("__OIDC_ATTR__", literal(oidcDisplayName ? ` data-oidc="${htmlAttr(oidcDisplayName)}"` : ""));
+}
+const LOGIN_HTML = `<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
@@ -1065,14 +1346,7 @@ export const LOGIN_HTML = `<!doctype html>
 <div class="login-card"__PATREON_ROLES_ATTR____OIDC_ATTR__>
   <h1>Sign in</h1>
   <p id="err" class="login-error" hidden></p>
-  <form method="POST" action="/login">
-    <label for="role">Role</label>
-    <select id="role" name="role">__ROLE_OPTIONS__</select>
-    <label for="password">Password</label>
-    <input id="password" type="password" name="password" autocomplete="current-password" required>
-    <input type="hidden" name="next" id="next">
-    <button type="submit">Sign in</button>
-  </form>
+__PASSWORD_FORM__
   <div id="patreon-section" hidden>
     <div class="login-divider">or</div>
     <a id="patreon-btn" class="patreon-btn" href="#">
@@ -1095,7 +1369,10 @@ export const LOGIN_HTML = `<!doctype html>
 <script>
   const params = new URLSearchParams(location.search);
   const next = params.get("next") || "/";
-  document.getElementById("next").value = next;
+  // The password form is omitted entirely on a deploy where no role has a
+  // password, so nothing here may assume its fields exist.
+  const nextField = document.getElementById("next");
+  if (nextField) nextField.value = next;
   const err = params.get("error");
   if (err) {
     const el = document.getElementById("err");
@@ -1135,6 +1412,17 @@ export const LOGIN_HTML = `<!doctype html>
     oidcBtn.textContent = "Sign in with " + card.dataset.oidc;
     oidcBtn.href = "/auth/oidc/start?next=" + encodeURIComponent(next);
   }
+  // Each provider section leads with an "or" divider, which only reads
+  // correctly as an alternative to the password form. With no form, the
+  // first provider is the only way in, so its divider comes off.
+  if (!document.getElementById("login-form")) {
+    const sections = [document.getElementById("patreon-section"), document.getElementById("oidc-section")];
+    const first = sections.find((s) => s && !s.hidden);
+    if (first) {
+      const divider = first.querySelector(".login-divider");
+      if (divider) divider.remove();
+    }
+  }
   // Autofocus moved here so it picks the right field whether the password
   // form is visible or the user is going for the Patreon button.
   const pwd = document.getElementById("password");

package/dist/render/auth-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-template.js","sourceRoot":"","sources":["../../src/render/auth-template.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,+EAA+E;AAC/E,2EAA2E;AAC3E,mEAAmE;AAuCnE,MAAM,UAAU,oBAAoB,CAAC,GAAuB;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;IAErD,OAAO;;;;;;;gBAOO,YAAY;oBACR,gBAAgB;kBAClB,cAAc;eACjB,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+9BzB,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAmIlB,CAAC"}
+{"version":3,"file":"auth-template.js","sourceRoot":"","sources":["../../src/render/auth-template.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,+EAA+E;AAC/E,2EAA2E;AAC3E,mEAAmE;AAEnE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AA6CpD,MAAM,UAAU,oBAAoB,CAAC,GAAuB;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;IACrD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAErD,OAAO;;;;;;;gBAOO,YAAY;oBACR,gBAAgB;kBAClB,cAAc;eACjB,WAAW;;;kBAGR,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0sC/B,CAAC;AACF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,IAO/B;IACC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IAE9D,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,wEAAwE;QACxE,2DAA2D;QAC3D,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,KAAK,CAAC;YAC3C,CAAC,CAAC,+CAA+C,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAE,CAAC,IAAI;YAChF,CAAC,CAAC,sCAAsC;kBACpC,oCAAoC;kBACpC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,QAAQ,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;kBAC7F,WAAW,CAAC;QAClB,IAAI,GAAG,0DAA0D;cAC7D,GAAG,UAAU,IAAI;cACjB,8CAA8C;cAC9C,sGAAsG;cACtG,mDAAmD;cACnD,8CAA8C;cAC9C,WAAW,CAAC;IAClB,CAAC;IAED,0EAA0E;IAC1E,qEAAqE;IACrE,gEAAgE;IAChE,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;IAC/C,OAAO,UAAU;SACd,OAAO,CAAC,mBAAmB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;SAC3C,OAAO,CAAC,wBAAwB,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QAChE,CAAC,CAAC,wBAAwB,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACrE,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3G,CAAC;AAED,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA0IX,CAAC"}