moshcode 0.24.0

package/src/notify.mjs

@@ -0,0 +1,86 @@
+// notify + human-in-the-loop approvals — talks to the approvals app (app.moshcode.sh).
+//
+// notify()/ask() POST the approval to the app's ingest endpoint with the user's
+// API key; the app fans it out to the operator's channels (email/SMS/Slack/
+// Telegram/push) and returns the approval id + link. ask() then long-polls the
+// app until the human opens the link, reads the context, and submits a reply.
+//
+// Config (env): MOSHCODE_API (default https://app.moshcode.sh), MOSHCODE_API_KEY
+// (from the app's Settings → API keys). MOSHCODE_WEBHOOK_SECRET optionally signs
+// the ingest for defense in depth. The HTTP layer and API key are injectable for tests.
+import crypto from "node:crypto";
+import { loadCreds } from "./auth.mjs";
+
+// Prefer explicit env; otherwise fall back to `moshcode login` credentials, so a
+// script Just Works after login without exporting anything.
+const API = () => (process.env.MOSHCODE_API || loadCreds()?.api || "https://app.moshcode.sh").replace(/\/+$/, "");
+const KEY = () => process.env.MOSHCODE_API_KEY || loadCreds()?.token || "";
+const SECRET = () => process.env.MOSHCODE_WEBHOOK_SECRET || "";
+
+function signHeaders(body) {
+  const secret = SECRET();
+  if (!secret) return {};
+  const ts = Math.floor(Date.now() / 1000);
+  const sig = crypto.createHmac("sha256", secret).update(`${ts}.${body}`).digest("hex");
+  return { "x-moshcode-signature": `t=${ts},v1=${sig}` };
+}
+
+/** POST an approval to the app. Returns { ok, id, url, delivered, charged, warning } or { ok:false }. */
+export async function ingestApproval(payload, { fetchImpl = fetch, key } = {}) {
+  const apiKey = key ?? KEY();
+  if (!apiKey) return { ok: false, error: "not logged in" };
+  const body = JSON.stringify(payload);
+  let res;
+  try {
+    res = await fetchImpl(`${API()}/api/approvals`, {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}`, ...signHeaders(body) },
+      body,
+    });
+  } catch (e) {
+    return { ok: false, error: String(e.message || e) };
+  }
+  if (!res.ok) return { ok: false, status: res.status };
+  // A 200 is not a promise of JSON: a proxy, captive portal, or HTML error page
+  // still answers 200. Parsing outside the guard threw the raw SyntaxError all
+  // the way out of notify()/ask() and killed the script, instead of the
+  // documented { ok:false } the callers already print a friendly line for.
+  let data;
+  try {
+    data = await res.json();
+  } catch (e) {
+    return { ok: false, error: `bad response from ${API()} (${String(e.message || e)})` };
+  }
+  return { ok: true, ...data };
+}
+
+/**
+ * Long-poll the app for the human's submission to approval `id`.
+ * Resolves with their response string once submitted, null on timeout/kill.
+ */
+export async function pollApproval(id, opts = {}) {
+  const {
+    fetchImpl = fetch,
+    intervalMs = 3000,
+    timeoutMs = 0, // 0 = wait forever
+    now = () => Date.now(),
+    sleep = (ms) => new Promise((r) => setTimeout(r, ms)),
+  } = opts;
+
+  const url = `${API()}/api/approvals/${id}`;
+  const headers = KEY() ? { authorization: `Bearer ${KEY()}` } : {};
+  const start = now();
+  for (;;) {
+    let body = null;
+    try {
+      const res = await fetchImpl(url, { headers });
+      if (res && res.ok) body = await res.json();
+    } catch {
+      body = null; // network hiccup — keep polling
+    }
+    if (body && body.status === "submitted") return body.response ?? "";
+    if (body && body.status === "killed") return null;
+    if (timeoutMs && now() - start >= timeoutMs) return null;
+    await sleep(intervalMs);
+  }
+}

package/src/open-url.mjs

@@ -0,0 +1,34 @@
+import { spawn } from "node:child_process";
+
+/**
+ * Opening a URL in the user's browser.
+ *
+ * auth.mjs and commands.mjs each carry a private copy of this; new callers get
+ * this one rather than making a third. Folding those two in is a separate
+ * change — they sit on the login path and are not worth disturbing here.
+ */
+
+/** Is there plausibly a browser to open? False on headless boxes, CI and SSH. */
+export function canOpenBrowser() {
+  if (process.env.SSH_CONNECTION || process.env.SSH_TTY || process.env.SSH_CLIENT) return false;
+  if (process.platform === "darwin" || process.platform === "win32") return true;
+  // Linux/BSD: only with a display server. Spawning xdg-open on a server does
+  // nothing useful and can hang.
+  return Boolean(process.env.DISPLAY || process.env.WAYLAND_DISPLAY);
+}
+
+/** Fire-and-forget open of a URL. Never throws; returns whether it was attempted. */
+export function openBrowser(url, { spawnImpl = spawn } = {}) {
+  const [cmd, args] =
+    process.platform === "darwin" ? ["open", [url]]
+    : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]]
+    : ["xdg-open", [url]];
+  try {
+    const child = spawnImpl(cmd, args, { stdio: "ignore", detached: true });
+    child.on?.("error", () => {}); // no opener installed — stay quiet
+    child.unref?.();
+    return true;
+  } catch {
+    return false;
+  }
+}

package/src/parking-http.mjs

@@ -0,0 +1,65 @@
+import http from "node:http";
+import { DEFAULT_REGISTRY_BASE, pitNameUrl } from "./pit-url.mjs";
+
+/**
+ * The other half of parking: something that actually answers.
+ *
+ * DNS can only hand back an IP, so a parked name has always resolved *somewhere*
+ * — but the address it pointed at was a platform that routes by Host header and
+ * returns "Application not found" for a name it has never heard of. `curl
+ * scrambled.eggs` resolved and then died one layer up.
+ *
+ * The bridge is already running on this machine for the name to resolve at all,
+ * so it can serve the answer too: parked names point at loopback, and this
+ * redirects whatever Host arrives to that name's page in the Pit. No public
+ * host, and no certificate for an ending that no CA will ever sign.
+ */
+
+/** Port 80, because `curl <name>` has no way to say otherwise. */
+export const DEFAULT_PARKING_HTTP_PORT = 80;
+
+export function parkingRedirect(hostHeader, registryBase = DEFAULT_REGISTRY_BASE) {
+  const name = String(hostHeader || "").split(":")[0].trim().toLowerCase();
+  // One label and one ending is the only shape the registry holds; anything
+  // else (an IP, a bare word, a subdomain) belongs at the Pit's front door.
+  const isName = /^[a-z0-9-]+\.[a-z0-9-]+$/.test(name);
+  return isName ? pitNameUrl(name, registryBase) : `${String(registryBase).replace(/\/+$/, "")}/pit`;
+}
+
+/**
+ * Start the parking responder. Resolves { port, address, close() }, or rejects
+ * when the port cannot be bound — port 80 needs privileges, and the caller
+ * decides whether that is fatal.
+ */
+export function createParkingServer(options = {}) {
+  const {
+    port = DEFAULT_PARKING_HTTP_PORT,
+    host = "127.0.0.1",
+    registryBase = DEFAULT_REGISTRY_BASE,
+    onRequest = () => {},
+  } = options;
+
+  const server = http.createServer((req, res) => {
+    const target = parkingRedirect(req.headers.host, registryBase);
+    onRequest({ host: req.headers.host || null, target });
+    // 302, not 301: the owner can point this name at a real target at any
+    // moment, and a cached permanent redirect would outlive that.
+    res.writeHead(302, { location: target, "content-type": "text/plain; charset=utf-8" });
+    // A body as well as the header, so `curl` without -L still says something
+    // useful instead of printing nothing at all.
+    res.end(`parked → ${target}\n`);
+  });
+
+  return new Promise((resolve, reject) => {
+    const onError = (err) => { server.close(); reject(err); };
+    server.once("error", onError);
+    server.listen(port, host, () => {
+      server.removeListener("error", onError);
+      resolve({
+        port: server.address().port,
+        address: host,
+        close: () => new Promise((done) => server.close(done)),
+      });
+    });
+  });
+}

package/src/pins.mjs

@@ -0,0 +1,190 @@
+// TLS for a Moshpit name, without anybody having to learn what a pin is.
+//
+// Names outside the DNS root cannot have CA-issued certificates: a CA validates
+// control through the public hierarchy, and `.hacker` is not in it. So Moshpit
+// verifies the other way round — the registry publishes the key a name's
+// certificate must present, and clients check the certificate against that
+// instead of against a chain of issuers.
+//
+// That is a good trade. A CA attests that somebody proved control to some
+// issuer; a pin says this is exactly the key the registry has on record. There
+// is no third party to mis-issue.
+//
+// It only works if the pin actually gets published, which is the part that was
+// failing. Publishing meant running a script, reading a base64 hash out of it,
+// and pasting that into a web form — three steps where the interesting one is
+// invisible, so the honest outcome is that most names never get a pin at all
+// and their TLS is unverifiable.
+//
+// The key is created here, so the pin is known here with certainty. Nothing is
+// probed, nothing is trusted on first use, and the hash never has to be seen
+// by a person.
+
+import crypto from "node:crypto";
+
+/** Pins hang off the ending, not the name — the registry has no per-name record. */
+export function tldOf(name) {
+  const clean = String(name ?? "").trim().toLowerCase().replace(/\.$/, "");
+  const parts = clean.split(".").filter(Boolean);
+  return parts.length >= 2 ? parts[parts.length - 1] : "";
+}
+
+/**
+ * The pin for a public key: SHA-256 over the SubjectPublicKeyInfo, base64.
+ *
+ * Over the SPKI rather than the certificate, so re-issuing a certificate for
+ * the same key — a longer expiry, an added name — does not invalidate every
+ * client's pin. The key is the identity; the certificate is just its current
+ * wrapper.
+ */
+export function spkiPin(publicKeyPem) {
+  const key = crypto.createPublicKey(publicKeyPem);
+  const der = key.export({ type: "spki", format: "der" });
+  return crypto.createHash("sha256").update(der).digest("base64");
+}
+
+/** The same, from a certificate rather than a bare key. */
+export function pinFromCertificate(certPem) {
+  return spkiPin(new crypto.X509Certificate(certPem).publicKey.export({ type: "spki", format: "pem" }));
+}
+
+/**
+ * Where a name's key lives.
+ *
+ * One key per name, not per ending. This used to key off the TLD, on the
+ * belief that "that is the granularity the registry stores" — which is the
+ * opposite of true. Migration 009 is explicit about it, and about why:
+ *
+ *   Per name rather than per TLD, and that is forced by 008: names under a TLD
+ *   are sold, so `blue.eggs` can belong to someone who does not own `.eggs`.
+ *   Hanging keys off the TLD would let its operator publish a key for a name
+ *   they already sold — impersonating a buyer inside the namespace they bought
+ *   into.
+ *
+ * A shared per-ending key is that hole in private-key form: the ending's
+ * operator holds the key for every name they have sold, and every buyer holds
+ * a key that signs for every other buyer. Per-name keys make a compromise stop
+ * at one site.
+ *
+ * The dot is kept — `chovy.hacker.crt`, not `chovyhacker.crt` — which also
+ * matches the certificates setup-origin.sh has been writing all along.
+ * Separators that could climb out of `dir` are dropped rather than escaped:
+ * `../../etc/passwd` collapses to `etcpasswd`, which is a harmless filename
+ * inside the directory rather than a path anywhere else.
+ */
+export function keyPaths(name, dir = "/etc/ssl/moshpit") {
+  const safe = String(name ?? "")
+    .toLowerCase()
+    .replace(/[^a-z0-9.-]/g, "")
+    // Any run of dots becomes one, so no `..` survives to mean "parent".
+    .replace(/\.{2,}/g, ".")
+    .replace(/^[.-]+|[.-]+$/g, "");
+  if (!safe) return null;
+  return { key: `${dir}/${safe}.key`, cert: `${dir}/${safe}.crt`, dir };
+}
+
+/**
+ * The openssl invocation that mints a key and a self-signed certificate.
+ *
+ * P-256 to match what is already deployed, and a long expiry on purpose: the
+ * pin is what makes this certificate trustworthy, and rotating it means
+ * republishing the pin. An annual scramble to re-pin every name would be a
+ * reliability problem invented to satisfy a CA convention that does not apply
+ * here.
+ */
+export function certificateCommand({ name, tld, paths, days = 3650 }) {
+  const subject = `/CN=${name}`;
+  return {
+    cmd: "openssl",
+    args: [
+      "req", "-x509", "-nodes",
+      "-newkey", "ec", "-pkeyopt", "ec_paramgen_curve:prime256v1",
+      "-keyout", paths.key, "-out", paths.cert,
+      "-days", String(days), "-subj", subject,
+      // This name and nothing else. It used to carry `DNS:*.${tld}` as well,
+      // on the assumption that every name under the ending shared one key —
+      // which would have each buyer's certificate assert authority over every
+      // other name in a namespace they merely bought into. Browsers and
+      // pin-checking clients both read SAN, not CN.
+      "-addext", `subjectAltName=DNS:${name}`,
+    ],
+  };
+}
+
+/**
+ * Publish a pin to the registry.
+ *
+ * Additive rather than replacing, matching the API: rotation wants a window
+ * where both keys are valid, so the new one can be published, deployed, and
+ * only then the old one withdrawn. Replacing outright breaks every client
+ * between the write and the deploy.
+ *
+ * A 409 means this exact pin is already published, which is success as far as
+ * the caller is concerned — running `site --install` twice should not be an
+ * error.
+ */
+export async function publishPin({
+  tld,
+  pin,
+  kind = "tls",
+  note = "moshcode site",
+  registryBase = "https://pit.moshcode.sh",
+  token,
+  fetchImpl = fetch,
+} = {}) {
+  if (!tld) return { ok: false, error: "no ending to publish under" };
+  if (!pin) return { ok: false, error: "no pin to publish" };
+  if (!token) {
+    return {
+      ok: false,
+      needsAuth: true,
+      error: "not logged in — run `moshcode login`, or set MOSHCODE_API_KEY",
+    };
+  }
+
+  const url = `${String(registryBase).replace(/\/+$/, "")}/api/moshpit/tlds/${encodeURIComponent(tld)}/pins`;
+  let response;
+  try {
+    response = await fetchImpl(url, {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
+      body: JSON.stringify({ pin, kind, note }),
+    });
+  } catch (error) {
+    return { ok: false, error: `registry unreachable: ${error.message}` };
+  }
+
+  if (response.status === 201) return { ok: true, published: true };
+  // Already there — the desired state, reached earlier.
+  if (response.status === 409) return { ok: true, published: false, already: true };
+  if (response.status === 401) {
+    return { ok: false, needsAuth: true, error: "the registry rejected the credentials" };
+  }
+  const body = await response.text().catch(() => "");
+  return { ok: false, error: `registry said ${response.status}${body ? `: ${body.slice(0, 200)}` : ""}` };
+}
+
+/**
+ * Whether this ending already publishes this pin.
+ *
+ * Checked before writing so a re-run is silent rather than a 409, and so the
+ * common case — the key is already deployed and published — costs one GET and
+ * no credentials at all.
+ */
+export async function pinPublished({
+  tld,
+  pin,
+  registryBase = "https://pit.moshcode.sh",
+  fetchImpl = fetch,
+} = {}) {
+  if (!tld || !pin) return false;
+  const url = `${String(registryBase).replace(/\/+$/, "")}/api/moshpit/tlds/${encodeURIComponent(tld)}/pins`;
+  try {
+    const response = await fetchImpl(url);
+    if (!response.ok) return false;
+    const body = await response.json();
+    return (body?.pins ?? []).some((entry) => (entry?.pin ?? entry) === pin);
+  } catch {
+    return false;
+  }
+}

package/src/pit-url.mjs

@@ -0,0 +1,13 @@
+export const DEFAULT_REGISTRY_BASE = "https://pit.moshcode.sh";
+
+/**
+ * The Pit's page for a name.
+ *
+ * Its own module because both halves of parking need it — the resolver, when it
+ * explains where a name went, and the parking responder, when it sends a
+ * browser there — and dns.mjs importing the responder that imports dns.mjs
+ * would be a cycle.
+ */
+export function pitNameUrl(name, registryBase = DEFAULT_REGISTRY_BASE) {
+  return `${String(registryBase).replace(/\/+$/, "")}/n/${encodeURIComponent(name)}`;
+}