cursedbelt-server 2.1.0 → 3.0.0

package/src/server/master-lock/index.ts

@@ -22,7 +22,10 @@ export {
 	masterLockPrincipalKey,
 } from "./principals";
 export {
+	FIRST_ACCOUNT_ID,
 	MasterLock,
+	type MasterLockAccount,
+	type MasterLockAddAccountResult,
 	type MasterLockEnrollResult,
 	type MasterLockOptions,
 	type MasterLockRecord,

package/src/server/master-lock/lockPage.ts

@@ -59,7 +59,7 @@ export function lockPageHtml(options: LockPageOptions): string {
 			(enroll
 				? "You are signed in, but this site needs a master password of your own. " +
 					"Choose one now. Nobody else can see it and nobody else can reset it — " +
-					"if you forget it, it cannot be recovered."
+					"if you forget it, it cannot be recovered, so leave yourself a hint."
 				: "This site is locked. Signing in is not enough — enter the master password to continue."),
 	);
 	return `<!doctype html>
@@ -93,12 +93,24 @@ export function lockPageHtml(options: LockPageOptions): string {
       <input id="ml-confirm" type="password" name="confirm-master-password"
              autocomplete="new-password" required spellcheck="false" enterkeyhint="go"
              minlength="10">
+    </label>
+    <label class="field">
+      <span>Hint <em>optional</em></span>
+      <input id="ml-hint" type="text" name="master-password-hint" maxlength="200"
+             spellcheck="false" autocomplete="off"
+             placeholder="Something only you would understand">
     </label>`
         : ""
     }
     <button id="ml-submit" type="submit">${enroll ? "Set master password" : "Unlock"}</button>
   </form>
-  <p id="ml-status" class="status" role="status" aria-live="polite"></p>
+  <p id="ml-status" class="status" role="status" aria-live="polite"></p>${
+    enroll
+      ? ""
+      : `
+  <button id="ml-forgot" type="button" class="quiet">I forgot which password</button>
+  <dl id="ml-hints" class="hints" hidden></dl>`
+  }
 </main>
 <script type="module" src="${MASTER_LOCK_PATHS.script}"></script>
 </body>
@@ -134,6 +146,16 @@ button{width:100%;height:40px;border:0;border-radius:9px;background:var(--ml-acc
 button[disabled]{opacity:.6;cursor:progress}
 .status{margin:14px 0 0;min-height:1.2em;font-size:12.5px;color:var(--ml-muted)}
 .status[data-tone="error"]{color:var(--ml-danger)}
+.field span em{font-style:normal;font-weight:500;text-transform:none;opacity:.7}
+button.quiet{margin-top:10px;height:32px;background:none;color:var(--ml-muted);font-weight:500;
+  font-size:12.5px;text-decoration:underline;text-underline-offset:3px}
+button.quiet:hover{color:var(--ml-text)}
+button.quiet[disabled]{opacity:.5}
+.hints{margin:10px 0 0;padding:12px 14px;text-align:left;border:1px solid var(--ml-border);
+  border-radius:10px;background:var(--ml-bg);font-size:12.5px}
+.hints dt{font-weight:650;color:var(--ml-text)}
+.hints dd{margin:2px 0 10px;color:var(--ml-muted);overflow-wrap:anywhere}
+.hints dd:last-child{margin-bottom:0}
 `;
 
 /**
@@ -150,8 +172,11 @@ export const LOCK_SCRIPT = `const paths = ${JSON.stringify(MASTER_LOCK_PATHS)};
 const form = document.getElementById("ml-form");
 const input = document.getElementById("ml-input");
 const confirmInput = document.getElementById("ml-confirm");
+const hintInput = document.getElementById("ml-hint");
 const submit = document.getElementById("ml-submit");
 const status = document.getElementById("ml-status");
+const forgot = document.getElementById("ml-forgot");
+const hints = document.getElementById("ml-hints");
 
 function say(message, tone) {
   status.textContent = message;
@@ -249,7 +274,11 @@ async function doEnroll(password) {
     method: "POST",
     credentials: "same-origin",
     headers: { "content-type": "application/json" },
-    body: JSON.stringify({ kdf: params, verifier: verifier }),
+    body: JSON.stringify({
+      kdf: params,
+      verifier: verifier,
+      hint: hintInput ? hintInput.value : "",
+    }),
   });
   if (res.ok) { say("Master password set."); location.reload(); return true; }
   // The server collapses every enrollment refusal into one, so this cannot say more
@@ -275,6 +304,44 @@ async function doUnlock(password) {
   return false;
 }
 
+// ── the hints, and why they are behind a click ───────────────────────────────
+// Reading them says how many master passwords this app has and what each is called, which
+// is the one fact the rest of this page is built never to disclose. Fetching them on load
+// would leak it to anyone who merely opened the door; a button makes it something the
+// owner ASKS for. Everyone who gets this far has already passed the app's own sign-in.
+if (forgot && hints) {
+  forgot.addEventListener("click", async () => {
+    if (!hints.hidden) { hints.hidden = true; return; }
+    forgot.disabled = true;
+    try {
+      const res = await fetch(paths.hints, { credentials: "same-origin" });
+      const body = await res.json();
+      const rows = (body && body.hints) || [];
+      hints.replaceChildren();
+      if (rows.length === 0) {
+        const dd = document.createElement("dd");
+        dd.textContent = "No hints have been written yet.";
+        hints.append(dd);
+      }
+      for (const row of rows) {
+        const dt = document.createElement("dt");
+        dt.textContent = row.label;
+        const dd = document.createElement("dd");
+        // 🔴 textContent, never innerHTML. The hint is free text the owner typed and this
+        // page runs under a CSP that permits no inline script — writing it as markup would
+        // be the one way to get some in.
+        dd.textContent = row.hint || "— no hint —";
+        hints.append(dt, dd);
+      }
+      hints.hidden = false;
+    } catch {
+      say("Cannot reach this site right now.", "error");
+    } finally {
+      forgot.disabled = false;
+    }
+  });
+}
+
 form.addEventListener("submit", async (event) => {
   event.preventDefault();
   if (busy || submit.disabled) return;

package/src/server/master-lock/masterLock.spec.ts

@@ -77,10 +77,32 @@ describe("seeding", () => {
 		expect(lock.configured).toBe(false);
 	});
 
-	test("🔴 an UNCONFIGURED app reads as unlocked — a lock nobody can open is not protection", () => {
+	test("🔴 an UNCONFIGURED app reads as LOCKED, and offers to take a first password", () => {
+		// This INVERTS what it asserted until the accounts model, and the inversion is the
+		// owner's ruling: *"if there is no master password then it has to get one set before
+		// a user could add anything. It would be booting to nothing until the password is
+		// created."* Nothing is bricked, because `enroll` is the way out — which is the
+		// half that made the old "unconfigured means open" reasoning necessary.
 		const { lock } = build({ seed: null });
 		expect(lock.configured).toBe(false);
+		expect(lock.unlocked).toBe(false);
+		expect(lock.awaitingEnrollment).toBe(true);
+	});
+
+	test("🔴 an unlock is never AMBIENT — a second browser that typed nothing gets no account", async () => {
+		// The property the whole tenant model rests on. `unlocked` says somebody's device is
+		// open; it may never answer "whose library do I serve", because the answer would be
+		// "whichever one is open", and that is how one tenant's files reach a session that
+		// holds the other tenant's password.
+		const { lock } = build();
+		const opened = await lock.unlock(VERIFIER);
+		expect(opened.ok).toBe(true);
 		expect(lock.unlocked).toBe(true);
+		// A request carrying no token at all.
+		expect(lock.accountFor(req())).toBeNull();
+		expect(lock.presents(req())).toBe(false);
+		// An invented one.
+		expect(lock.accountFor(req("not-a-real-token"))).toBeNull();
 	});
 
 	test("a seed whose hash arrived shell-quoted is repaired, not refused", async () => {
@@ -262,24 +284,24 @@ describe("the guess throttle", () => {
 });
 
 describe("rotation", () => {
-	test("needs the current password, rewrites the record, and locks the site", async () => {
+	test("needs the current password, keeps the ACCOUNT, and locks the site", async () => {
 		const { lock, store, locked } = build();
-		await lock.unlock(VERIFIER);
+		const opened = await lock.unlock(VERIFIER);
+		const token = opened.ok ? opened.token : "";
+		const account = opened.ok ? opened.accountId : "";
+		expect(account).toBe("acct-1");
 
-		const nextKdf = newMasterLockKdfParams();
-		const nextVerifier = await deriveMasterLockVerifier("a different one", nextKdf);
+		const nextVerifier = await deriveMasterLockVerifier("a different one", KDF);
 
-		const refused = await lock.change({
+		const refused = await lock.change(req(token), {
 			currentVerifier: "wrong",
-			kdf: nextKdf,
 			verifier: nextVerifier,
 		});
 		expect(refused).toEqual({ ok: false, reason: "wrong" });
 		expect(lock.unlocked).toBe(true);
 
-		const done = await lock.change({
+		const done = await lock.change(req(token), {
 			currentVerifier: VERIFIER,
-			kdf: nextKdf,
 			verifier: nextVerifier,
 		});
 		expect(done).toEqual({ ok: true });
@@ -287,36 +309,47 @@ describe("rotation", () => {
 		expect(lock.unlocked).toBe(false);
 		expect(locked.at(-1)).toBe(true);
 
-		// The OLD one no longer opens it; the new one does.
+		// The OLD one no longer opens it; the new one does — and opens the SAME account.
 		expect((await lock.unlock(VERIFIER)).ok).toBe(false);
-		expect((await lock.unlock(nextVerifier)).ok).toBe(true);
-		expect(readRecord(store.read())?.kdf.salt).toBe(nextKdf.salt);
+		const again = await lock.unlock(nextVerifier);
+		expect(again.ok && again.accountId).toBe("acct-1");
+		// 🔴 The salt did NOT move. Every account derives under one app-wide descriptor, so
+		// a rotation that minted a fresh one would invalidate every sibling's stored hash.
+		expect(readRecord(store.read())?.kdf.salt).toBe(KDF.salt);
+	}, KDF_BULK_MS);
+
+	test("🔴 a rotation is refused outright without a live unlock of the account it names", async () => {
+		// An open session is not proof the owner is at the keyboard, and a caller with no
+		// session at all has not even got that far. There is no account to rotate.
+		const { lock, store } = build();
+		const before = store.read();
+		const result = await lock.change(req(), { currentVerifier: VERIFIER, verifier: "x" });
+		expect(result).toEqual({ ok: false, reason: "locked" });
+		expect(store.read()).toBe(before);
 	});
 
-	test("refuses params it could not derive under, before touching the record", async () => {
+	test("refuses an empty verifier before touching the record", async () => {
 		const { lock, store } = build();
+		const opened = await lock.unlock(VERIFIER);
 		const before = store.read();
-		const result = await lock.change({
+		const result = await lock.change(req(opened.ok ? opened.token : ""), {
 			currentVerifier: VERIFIER,
-			kdf: { v: 2 } as unknown as MasterLockKdfParams,
-			verifier: "x",
+			verifier: "",
 		});
 		expect(result).toEqual({ ok: false, reason: "invalid" });
 		expect(store.read()).toBe(before);
-	});
+	}, KDF_BULK_MS);
 
 	test("keeps this app's idle timeout across a rotation", async () => {
 		const { lock, store } = build();
 		lock.setIdleMs(120_000);
-		await lock.unlock(VERIFIER);
-		const nextKdf = newMasterLockKdfParams();
-		await lock.change({
+		const opened = await lock.unlock(VERIFIER);
+		await lock.change(req(opened.ok ? opened.token : ""), {
 			currentVerifier: VERIFIER,
-			kdf: nextKdf,
-			verifier: await deriveMasterLockVerifier("next", nextKdf),
+			verifier: await deriveMasterLockVerifier("next", KDF),
 		});
 		expect(readRecord(store.read())?.idleMs).toBe(120_000);
-	});
+	}, KDF_BULK_MS);
 });
 
 describe("readRecord", () => {