ccdeck 3.29.11 → 3.31.0

package/src/server/lan-routes.mjs

@@ -0,0 +1,143 @@
+// The Local network panel's four routes: what the panel draws, and the three
+// writes it makes — an invite, a verb on one deck, and a round now.
+//
+// These lived in src/server/index.mjs, after the LAN engine, and moved once the
+// engine had (see lan-deck.mjs). Each is a body read and handed to the engine,
+// and the one that writes the settings — the peer route's accept and alias —
+// writes through prefs-state.mjs, as the engine's own callbacks do. The route
+// table and the gates in front of it stay in index.mjs, where the order they
+// are asked in is written down.
+import { cleanAlias, isAliasKey, lanEnabled, withAlias, withManualEntry } from "./deck-prefs.mjs";
+import { heldPrefs } from "./prefs-state.mjs";
+import { lanEngine, lastReach, refreshReach, tailnet } from "./lan-deck.mjs";
+import { IDLE_MS as TAILNET_IDLE_MS } from "./tailscale.mjs";
+import { readBody, send } from "./http-io.mjs";
+
+/** What the panel draws: the switch, this deck's own name and address, and who
+ *  else is in the group. No passphrase, for the reason prefsPayload gives in
+ *  prefs-routes.mjs. */
+export function handleLanStatus(req, res) {
+  refreshReach();
+  // Behind the answer, like the reach probe: the dialog's poll is what finds a
+  // Tailscale somebody installed while the deck was running.
+  if (lanEnabled(heldPrefs.current())) void tailnet.freshen(TAILNET_IDLE_MS);
+  return send(res, 200, { ok: true, ...lanEngine.status(), reach: lastReach() });
+}
+
+/**
+ * Make an invite, put one away, or join on somebody else's.
+ *
+ * The token is the secret and it is never stored: minted on request, held in
+ * memory until it expires or is used, and gone with the process. Nothing about
+ * it reaches prefs.json, so a deck that restarts is offering nothing rather
+ * than offering something its owner has forgotten they sent.
+ */
+export async function handleLanInvite(req, res) {
+  const raw = await readBody(req, res).catch(() => null);
+  let body = null;
+  try { body = JSON.parse(raw ?? ""); } catch { /* handled below */ }
+  switch (body?.action) {
+    case "make": {
+      const made = lanEngine.invite();
+      if (!made) return send(res, 409, { ok: false, reason: "not_running" });
+      // AFTER the spread, not before: status carries its own `invite` — the
+      // token and its expiry, which is all a panel needs — and letting that
+      // overwrite this one dropped the address list the caller asked for.
+      return send(res, 200, { ok: true, ...lanEngine.status(), invite: made });
+    }
+    case "withdraw":
+      lanEngine.withdraw();
+      return send(res, 200, { ok: true, ...lanEngine.status() });
+    case "join": {
+      const out = await lanEngine.join(body.token);
+      if (!out.ok) return send(res, 200, { ok: false, ...out, ...lanEngine.status() });
+      return send(res, 200, { ok: true, ...out, ...lanEngine.status() });
+    }
+    default:
+      return send(res, 400, { ok: false, reason: "unknown_action" });
+  }
+}
+
+/**
+ * Accept a deck, dismiss a request, or unpair one.
+ *
+ * ONE ROUTE, THREE VERBS, in the shape the accounts panel already uses for its
+ * own multi-verb writes. Each one takes a fingerprint and nothing else: the key
+ * being pinned comes from what this deck actually saw on the wire, never from
+ * the page, so a page cannot pair this deck with a key nobody has met.
+ */
+export async function handleLanPeer(req, res) {
+  const raw = await readBody(req, res).catch(() => null);
+  let body = null;
+  try { body = JSON.parse(raw ?? ""); } catch { /* handled below */ }
+  const fp = body && typeof body.fp === "string" ? body.fp : null;
+  if (!fp) return send(res, 400, { ok: false, reason: "bad_request" });
+  switch (body.action) {
+    case "accept": {
+      const added = lanEngine.accept(fp);
+      if (!added) return send(res, 409, { ok: false, reason: "not_seen" });
+      // A deck we only HEARD is not pinned, it is dialled — see accept. The
+      // address has to reach prefs or the next write of the settings wipes it:
+      // setPeers replaces the dial list wholesale, on purpose, so an address
+      // that lives only in memory disappears the first time anything else is
+      // saved.
+      if (added.dialled) {
+        const entry = `${added.addr}:${added.port}`;
+        // Inside the job, like `onDial` — the same whole-array patch computed
+        // from the same stale copy, and the same address lost when two of them
+        // land in one turn.
+        try { await heldPrefs.update(withManualEntry(entry)); }
+        catch { /* it is dialled this session; the next accept re-adds it */ }
+      }
+      return send(res, 200, { ok: true, added, ...lanEngine.status() });
+    }
+    case "dismiss":
+      return send(res, 200, { ok: lanEngine.dismiss(fp), ...lanEngine.status() });
+    // The undo for the one above. A deck that was told no stops asking; this is
+    // how somebody who changed their mind lets it ask again.
+    case "allow":
+      return send(res, 200, { ok: lanEngine.allow(fp), ...lanEngine.status() });
+    case "unpair":
+      return send(res, 200, { ok: lanEngine.unpair(fp), ...lanEngine.status() });
+    // WHAT THIS DECK CALLS THAT ONE, and nobody else sees it. Keyed by the
+    // fingerprint, so it follows the machine across a new address or a new
+    // name of its own choosing. An empty name takes the alias away.
+    //
+    // The whole map is rebuilt from the one on disk rather than sent by the
+    // page, so two tabs renaming two decks cannot undo each other. It is
+    // rebuilt inside the write's own job for that to be true: the held prefs
+    // are an in-memory copy refreshed only when a previous write resolves, and
+    // the patch is the whole map — so two renames in one turn both read before
+    // either job ran, both answered 200, and the first name was never written.
+    case "alias": {
+      if (!isAliasKey(fp)) return send(res, 400, { ok: false, reason: "bad_request" });
+      const name = cleanAlias(body.name);
+      const next = await heldPrefs.update(withAlias(fp, name));
+      await lanEngine.apply({ aliases: next.lan.aliases });
+      return send(res, 200, { ok: true, ...lanEngine.status() });
+    }
+    default:
+      return send(res, 400, { ok: false, reason: "unknown_action" });
+  }
+}
+
+/** Ask every peer now rather than at the next tick — the button beside the
+ *  list, for somebody who has just fixed a login on the other machine and does
+ *  not want to wait a minute to see it arrive.
+ *
+ *  Or ONE peer, when the body names it: the `check now` in a deck's own
+ *  dialog. A deck that only calls in has no address here, and says so rather
+ *  than reporting a round that asked nobody. */
+export async function handleLanSync(req, res) {
+  const raw = await readBody(req, res).catch(() => null);
+  let body = null;
+  try { body = JSON.parse(raw ?? ""); } catch { /* the whole-list press sends nothing to read */ }
+  const fp = body && typeof body.fp === "string" ? body.fp : null;
+  if (fp) {
+    const done = await lanEngine.roundOne(fp);
+    if (done == null) return send(res, 409, { ok: false, reason: "no_address" });
+    return send(res, 200, { ok: true, done, ...lanEngine.status() });
+  }
+  const done = await lanEngine.round();
+  return send(res, 200, { ok: true, done, ...lanEngine.status() });
+}

package/src/server/lan-serve.mjs

@@ -0,0 +1,112 @@
+// What this deck answers a paired deck that asks — the list of logins it
+// offers, or one of them sealed for the asker — lifted out of createEngine in
+// lan-engine.mjs. The asking is the engine's round; this is the other end of
+// the same two questions, with the checks that decide whether either is
+// answered at all. It keeps nothing of its own: every check reads the
+// engine's settings, listener and key at the moment it is made, because any
+// of them can change while the store is read.
+import { credentialAad, seal, slotFor, transferChallenge, trustedPeer } from "./lan-sync.mjs";
+import { liveLoginIs } from "./account-health.mjs";
+
+/**
+ * `settings`, `serverNow` and `myFp` answer the engine's settings in force,
+ * its listener (null while it is down) and this deck's fingerprint, each at
+ * the moment of asking. `inbound` keeps who called (see lan-inbound.mjs), and
+ * `learnCaller` is the engine's dial-back for a paired deck nothing here
+ * dials. `keepManifest` and `manifestFrame` are lan-manifest.mjs's,
+ * `localAccounts` reads the store in the rules' shape, and `liveLogin`,
+ * `exportAccount` and `onError` are the engine's own.
+ */
+export function createServe({
+  settings, serverNow, myFp, inbound, learnCaller, keepManifest, manifestFrame, localAccounts, liveLogin, exportAccount,
+  onError,
+}) {
+  /** Frames from a deck that finished the handshake AND that somebody here has
+   *  accepted. Nothing reaches this before both, which is the whole point of
+   *  where the two checks sit. `ctx.key` is this connection's key and no other
+   *  connection's — see sessionKey. `ctx.send` seals whatever it is handed when
+   *  both ends said they seal, so nothing below has to know which kind of deck
+   *  asked — see frameChannel. */
+  const serve = async (msg, ctx) => {
+    // Authentication happened at connection setup; a previously trusted deck
+    // may have been unpaired while this socket remained open.
+    const mayAnswer = () => settings().enabled && !!serverNow() && !!trustedPeer(settings().trusted, ctx?.peerFp);
+    if (!mayAnswer()) return ctx.send({ t: "no", why: "not paired" });
+    // Before the verbs, and for every one of them: something that proved it
+    // holds a key this deck accepted is talking, now.
+    if (ctx?.peerFp) {
+      inbound.spoke(ctx);
+      learnCaller(ctx);
+    }
+    try {
+      if (msg.t === "manifest") {
+        // THE CALLER'S CARD RIDES THE QUESTION, which is the only way a deck
+        // that calls in ever says what it is: nothing here dials it, so nothing
+        // here ever asks. A seal that does not open is a deck that said nothing.
+        // AND SO DOES ITS LIST, from a deck new enough to send one: what it
+        // offers, and which of those it is on. This is the only way a deck
+        // nothing here dials is ever known by what it offers.
+        keepManifest(ctx.key, msg, ctx.peerFp);
+        const accounts = await localAccounts();
+        // Reading the store can take long enough for the owner to unpair this
+        // deck. Do not disclose account identities or the active account from
+        // a manifest assembled before that decision.
+        if (!mayAnswer()) return ctx.send({ t: "no", why: "not paired" });
+        return ctx.send(manifestFrame(accounts, ctx.key, ctx.peerFp));
+      }
+      if (msg.t === "want") {
+        // A listener may have authenticated this socket before its owner
+        // unpaired the caller or switched sharing off. Recheck at the moment
+        // a credential is requested and again after every asynchronous read.
+        const maySend = () => settings().enabled && !!serverNow() && !!trustedPeer(settings().trusted, ctx.peerFp)
+          && settings().shared.includes(msg.key);
+        if (!maySend()) return ctx.send({ t: "no", why: "not shared" });
+        // A SECOND PROOF, for the one operation that moves a credential. The
+        // session says who connected; this says they are asking for this
+        // account, now. A long-lived connection authenticated an hour ago is
+        // not a statement about now.
+        const want = transferChallenge(ctx.key, {
+          nonce: msg.nonce, accountKey: msg.key, fromFp: ctx.peerFp, toFp: myFp(),
+        });
+        if (typeof msg.proof !== "string" || msg.proof !== want) {
+          return ctx.send({ t: "no", why: "proof" });
+        }
+        // Only what the user ticked, checked again here rather than trusted
+        // from the manifest we sent: the list can change between the two, and
+        // the answer that matters is the one at the moment of sending.
+        const accounts = await localAccounts();
+        if (!maySend()) return ctx.send({ t: "no", why: "not shared" });
+        // The slot manifestFor told the peer about, by the same rule: with two
+        // slots for one identity, an expired one listed first must not hide a
+        // live one behind it.
+        const mine = slotFor(accounts, msg.key);
+        if (!mine) return ctx.send({ t: "no", why: "not mine to give" });
+        // A LOGIN THIS DECK CANNOT READ IS SAID SO, from state rather than from
+        // a failed export: no subprocess, and nothing the CLI printed. The
+        // asking deck prints it under the account, so the person learns which
+        // machine to unlock instead of reading "export failed".
+        if (!mine.readable) return ctx.send({ t: "no", why: mine.unreadableWhy });
+        if (!mine.alive) return ctx.send({ t: "no", why: "not mine to give" });
+        // The active slot exports the live CLI login, and its verdict can
+        // predate a `/login` as somebody else, so ask the CLI who it is now.
+        if (mine.active && liveLogin && !liveLoginIs(await liveLogin(), mine.email, mine.org)) {
+          return ctx.send({ t: "no", why: "export failed" });
+        }
+        if (!maySend()) return ctx.send({ t: "no", why: "not shared" });
+        const blob = await exportAccount(mine.num, msg.key);
+        if (!maySend()) return ctx.send({ t: "no", why: "not shared" });
+        // A Mac's failed export refreshes the verdict behind `readable` in the
+        // background, so when the Keychain was why, the next ask is answered by
+        // the line above.
+        if (!blob) return ctx.send({ t: "no", why: "export failed" });
+        const aad = credentialAad(myFp(), ctx.peerFp, msg.key);
+        return ctx.send({ t: "have", key: msg.key, sealed: seal(ctx.key, blob, aad) });
+      }
+    } catch (err) {
+      onError?.("serve", err);
+      ctx.send({ t: "no", why: "error" });
+    }
+  };
+
+  return { serve };
+}