pi-roundtable-web 0.24.2 → 0.26.0

package/src/profile/api.ts

@@ -0,0 +1,175 @@
+import {
+	IdentityError,
+	type IdentityService,
+	type PersonProfiles,
+} from "pi-roundtable";
+import type { ProfileView } from "../api-types.ts";
+import type { Gate } from "../gate.ts";
+import { ConsoleHttpError as HttpError, json } from "../http.ts";
+import { readLimited } from "../request-body.ts";
+import type { RouteArea, Viewer } from "../web-app.ts";
+import { LinkRefused, type LinkService } from "./links.ts";
+
+const MAX_BODY_BYTES = 4 * 1024;
+
+async function bodyOf(request: Request): Promise<Record<string, unknown>> {
+	const raw = await readLimited(request, MAX_BODY_BYTES);
+	if (!raw) throw new HttpError(413, "The body is too large.");
+	let value: unknown;
+	try {
+		value = JSON.parse(raw.toString("utf8"));
+	} catch {
+		throw new HttpError(400, "The body is not JSON.");
+	}
+	if (typeof value !== "object" || value === null || Array.isArray(value))
+		throw new HttpError(400, "The body is not an object.");
+	return value as Record<string, unknown>;
+}
+
+/** Turns what a handler throws into the response a person reads; anything else is a bug and rethrown. */
+function answer(error: unknown): Response {
+	if (error instanceof HttpError)
+		return json({ error: error.message }, error.status);
+	if (error instanceof LinkRefused)
+		return json({ error: error.message }, error.status);
+	if (error instanceof IdentityError)
+		return json({ error: error.message }, 400);
+	throw error;
+}
+
+export interface ProfileAreaOptions {
+	profiles: PersonProfiles;
+	identity: Pick<IdentityService, "identities">;
+	/**
+	 * What the account the person signed in with is called when it is not a registered source: a
+	 * sign-in reports its name to `PROFILES.observed`, so it can name the person without a fetch.
+	 */
+	sessionLabel: string;
+}
+
+/** `GET api/profile` and `PUT api/profile/source`: how the person is shown and which account names them. */
+export function profileArea(options: ProfileAreaOptions): RouteArea {
+	const view = async (viewer: Viewer, sessionProvider: string | undefined) => {
+		const { profiles, identity } = options;
+		const [display, linked] = await Promise.all([
+			profiles.of(viewer.principalId),
+			identity.identities(viewer.principalId),
+		]);
+		const linkedProviders = new Set(linked.map((link) => link.provider));
+		const sources: ProfileView["sources"] = profiles
+			.sources()
+			.filter((source) => linkedProviders.has(source.provider))
+			.map((source) => ({ provider: source.provider, label: source.label }));
+		if (
+			sessionProvider &&
+			linkedProviders.has(sessionProvider) &&
+			!sources.some((source) => source.provider === sessionProvider)
+		)
+			sources.push({ provider: sessionProvider, label: options.sessionLabel });
+		return {
+			name: display.name,
+			...(display.source ? { source: display.source } : {}),
+			picture: display.picture,
+			principal: viewer.principalId,
+			tier: viewer.tier,
+			sources,
+		} satisfies ProfileView;
+	};
+	return {
+		area: "profile",
+		async handle(request, parts, { viewer, visitor }) {
+			try {
+				const provider = visitor.speakerId.split(":").slice(0, -1).join(":");
+				if (parts.length === 0 && request.method === "GET")
+					return json(await view(viewer, provider || undefined));
+				if (parts.length === 1 && parts[0] === "source") {
+					if (request.method !== "PUT")
+						throw new HttpError(405, "Method not allowed.");
+					const body = await bodyOf(request);
+					const chosen = body.provider;
+					if (chosen !== null && typeof chosen !== "string")
+						throw new HttpError(
+							400,
+							"Send provider: the account's provider, or null for the default.",
+						);
+					await options.profiles.choose(viewer.principalId, chosen);
+					return json(await view(viewer, provider || undefined));
+				}
+				throw new HttpError(404, "There is no such API.");
+			} catch (error) {
+				return answer(error);
+			}
+		},
+	};
+}
+
+/**
+ * `GET api/people/<principal>/picture`: the person's picture through the picture proxy. Anyone past
+ * the gate may fetch another person's picture; a person still at the gate only their own.
+ */
+export function peopleArea(options: {
+	profiles: Pick<PersonProfiles, "picture">;
+	gate: Pick<Gate, "required">;
+}): RouteArea {
+	return {
+		area: "people",
+		async handle(request, parts, { viewer }) {
+			try {
+				const [id, what] = parts;
+				if (id === undefined || what !== "picture" || parts.length !== 2)
+					throw new HttpError(404, "There is no such API.");
+				if (request.method !== "GET" && request.method !== "HEAD")
+					throw new HttpError(405, "Method not allowed.");
+				if (
+					id !== viewer.principalId &&
+					(await options.gate.required(viewer)).length > 0
+				)
+					throw new HttpError(403, "Finish setting up first.");
+				const picture = await options.profiles.picture(id);
+				if (!picture) throw new HttpError(404, "There is no picture.");
+				return picture;
+			} catch (error) {
+				return answer(error);
+			}
+		},
+	};
+}
+
+/** `GET api/links`, `POST api/links/<provider>/issue|confirm|cancel` and `DELETE api/links/<provider>`. */
+export function linksArea(links: LinkService): RouteArea {
+	return {
+		area: "links",
+		async handle(request, parts, { viewer }) {
+			try {
+				const me = viewer.principalId;
+				const [provider, action] = parts;
+				const { method } = request;
+				if (provider === undefined && method === "GET")
+					return json(await links.list(me));
+				if (provider !== undefined && action === undefined) {
+					if (method === "GET") return json(await links.one(provider, me));
+					if (method === "DELETE")
+						return json(await links.unlink(provider, me));
+					throw new HttpError(405, "Method not allowed.");
+				}
+				if (provider !== undefined && parts.length === 2 && method === "POST") {
+					if (action === "issue") return json(await links.issue(provider, me));
+					if (action === "cancel")
+						return json(await links.cancel(provider, me));
+					if (action === "confirm") {
+						const { request: ref } = await bodyOf(request);
+						if (typeof ref !== "string" || ref.length === 0 || ref.length > 200)
+							throw new HttpError(
+								400,
+								"Send request: the id the code came with.",
+							);
+						return json(await links.confirm(provider, me, ref));
+					}
+				}
+				throw new HttpError(404, "There is no such API.");
+			} catch (error) {
+				return answer(error);
+			}
+		},
+	};
+}

package/src/profile/links.ts

@@ -0,0 +1,162 @@
+import type { IdentityService, Logger } from "pi-roundtable";
+import type { LinksView, LinkView } from "../api-types.ts";
+import type { Gate } from "../gate.ts";
+import type { LinkProver, WebAppRegistry } from "../web-app.ts";
+
+/** Why a link request was refused, in words the page shows. `status` is the HTTP status. */
+export class LinkRefused extends Error {
+	readonly status: number;
+	constructor(message: string, status = 409) {
+		super(message);
+		this.name = "LinkRefused";
+		this.status = status;
+	}
+}
+
+export interface LinkServiceOptions {
+	registry: Pick<WebAppRegistry, "provers" | "prover">;
+	/** `onboarding.links`: which providers are required or only nudged. */
+	steps: Readonly<Record<string, "required" | "nudge">>;
+	identity: Pick<IdentityService, "identities">;
+	gate: Pick<Gate, "changed">;
+	logger: Logger;
+}
+
+/** Link sources that the configuration, the CLI or a plugin made, which a person cannot remove. */
+const LOCKED = new Set(["config", "cli", "plugin"]);
+
+/**
+ * The accounts a person can link and how they stand. Every call to a prover carries the session's
+ * principal, never one a request names; a prover's `requires` must be linked first, and a link
+ * the configuration, CLI or a plugin made is never unlinked here.
+ */
+export class LinkService {
+	readonly #options: LinkServiceOptions;
+
+	constructor(options: LinkServiceOptions) {
+		this.#options = options;
+	}
+
+	prover(provider: string): LinkProver {
+		const found = this.#options.registry.prover(provider);
+		if (!found) throw new LinkRefused("There is no such account to link.", 404);
+		return found;
+	}
+
+	async list(principalId: string): Promise<LinksView> {
+		const links = await Promise.all(
+			this.#options.registry
+				.provers()
+				.map((prover) => this.#view(prover, principalId)),
+		);
+		return { links };
+	}
+
+	async one(provider: string, principalId: string): Promise<LinkView> {
+		return this.#view(this.prover(provider), principalId);
+	}
+
+	async issue(provider: string, principalId: string) {
+		const prover = this.prover(provider);
+		const blocked = await this.#blockedBy(prover, principalId);
+		if (blocked.length > 0)
+			throw new LinkRefused(
+				`Link ${blocked.map((p) => this.#options.registry.prover(p)?.label ?? p).join(" and ")} first.`,
+			);
+		if ((await prover.status(principalId)).linked)
+			throw new LinkRefused("That account is already linked.");
+		const issued = await prover.issue(principalId);
+		return {
+			code: issued.code,
+			request: issued.request,
+			expiresAt: issued.expiresAt.toISOString(),
+			instructions: issued.instructions,
+		};
+	}
+
+	async confirm(provider: string, principalId: string, request: string) {
+		const prover = this.prover(provider);
+		await prover.confirm(principalId, request);
+		this.#options.gate.changed(principalId);
+		return this.#view(prover, principalId);
+	}
+
+	async cancel(provider: string, principalId: string): Promise<LinkView> {
+		const prover = this.prover(provider);
+		await prover.cancel(principalId);
+		return this.#view(prover, principalId);
+	}
+
+	async unlink(provider: string, principalId: string): Promise<LinkView> {
+		const prover = this.prover(provider);
+		const locked = (await this.#options.identity.identities(principalId)).some(
+			(link) => link.provider === provider && LOCKED.has(link.source),
+		);
+		if (locked)
+			throw new LinkRefused(
+				"That account was linked by the host's configuration, so it cannot be removed here.",
+			);
+		await prover.unlink(principalId);
+		this.#options.gate.changed(principalId);
+		return this.#view(prover, principalId);
+	}
+
+	/** The providers `prover` requires that the person has not linked. */
+	async #blockedBy(prover: LinkProver, principalId: string): Promise<string[]> {
+		const blocked: string[] = [];
+		for (const needed of prover.requires ?? []) {
+			const other = this.#options.registry.prover(needed);
+			const linked = other
+				? Boolean((await other.status(principalId)).linked)
+				: false;
+			const known = (await this.#options.identity.identities(principalId)).some(
+				(link) => link.provider === needed,
+			);
+			if (!linked && !known) blocked.push(needed);
+		}
+		return blocked;
+	}
+
+	async #view(prover: LinkProver, principalId: string): Promise<LinkView> {
+		const [state, identities, blocked] = await Promise.all([
+			prover.status(principalId),
+			this.#options.identity.identities(principalId),
+			this.#blockedBy(prover, principalId),
+		]);
+		const own = identities.find((link) => link.provider === prover.provider);
+		const linked = state.linked
+			? {
+					...(state.linked.displayName
+						? { displayName: state.linked.displayName }
+						: {}),
+					linkedAt: state.linked.linkedAt.toISOString(),
+					...(own && LOCKED.has(own.source) ? { locked: true as const } : {}),
+				}
+			: own
+				? {
+						linkedAt: own.linkedAt.toISOString(),
+						...(LOCKED.has(own.source) ? { locked: true as const } : {}),
+					}
+				: undefined;
+		const step = this.#options.steps[prover.provider];
+		return {
+			provider: prover.provider,
+			label: prover.label,
+			...(step ? { step } : {}),
+			requires: [...(prover.requires ?? [])],
+			blockedBy: blocked,
+			...(linked ? { linked } : {}),
+			...(state.pending && !linked
+				? {
+						pending: {
+							request: state.pending.request,
+							expiresAt: state.pending.expiresAt.toISOString(),
+							...(state.pending.redeemedBy
+								? { redeemedBy: state.pending.redeemedBy }
+								: {}),
+						},
+					}
+				: {}),
+		};
+	}
+}

package/src/push/api.ts

@@ -1,14 +1,18 @@
 import { createHash } from "node:crypto";
-import type { IdentityService } from "pi-roundtable";
+import type { Tier } from "pi-roundtable";
 import type {
 	PushDevicesView,
 	PushDeviceView,
 	PushKeyView,
+	PushPrefsView,
+	PushTestView,
 } from "../api-types.ts";
 import type { Authenticated } from "../auth/authenticator.ts";
 import { ConsoleHttpError as HttpError, json } from "../http.ts";
 import { readLimited } from "../request-body.ts";
 import type { EndpointPolicy } from "./endpoint.ts";
+import type { ReceiptEvent } from "./outbox.ts";
+import { checkPrefs, PrefsRefused, type PushPrefs } from "./prefs.ts";
 import type { PushSubscriptions } from "./subscriptions.ts";
 import type { Vapid } from "./vapid.ts";
 
@@ -21,15 +25,6 @@ const MAX_LABEL_CHARS = 80;
 const P256DH_BYTES = 65;
 const AUTH_BYTES = 16;
 
-export interface PushApiOptions {
-	vapid: Pick<Vapid, "publicKey">;
-	policy: EndpointPolicy;
-	subscriptions: Pick<PushSubscriptions, "of" | "save" | "remove">;
-	identity: Pick<IdentityService, "tierOf">;
-	/** False when the server has no VAPID contact: devices cannot be added, since nothing would reach them. */
-	enabled: boolean;
-}
-
 /** What identifies a device in a list without handing its endpoint around: the endpoint's SHA-256, hex. */
 const deviceId = (endpoint: string): string =>
 	createHash("sha256").update(endpoint).digest("hex");
@@ -57,56 +52,41 @@ async function bodyOf(request: Request): Promise<Record<string, unknown>> {
 	return value as Record<string, unknown>;
 }
 
+export interface DeviceRoutesOptions {
+	policy: EndpointPolicy;
+	subscriptions: Pick<PushSubscriptions, "of" | "save" | "remove">;
+	/** False when the server has no VAPID contact: devices cannot be added, since nothing would reach them. */
+	enabled: boolean;
+}
+
 /**
- * The push routes under `<mount>/api/push/`: the key a browser subscribes against, and the
- * signed-in owner's own devices: list, add, remove. A device is only ever read or removed by the
- * person who added it, and an endpoint is accepted only on a push service the policy allows.
+ * A person's own devices: list, add, remove. A device is only ever read or removed by the person
+ * who added it, and an endpoint is accepted only on a push service the policy allows. The app
+ * serves these under `api/push/subscriptions`, and an external sender under its own path.
  */
-export class PushApi {
-	readonly #options: PushApiOptions;
+export class DeviceRoutes {
+	readonly #options: DeviceRoutesOptions;
 
-	constructor(options: PushApiOptions) {
+	constructor(options: DeviceRoutesOptions) {
 		this.#options = options;
 	}
 
-	/** Answers `api/push/...`; undefined for any other path. */
+	/**
+	 * Answers a request about the person's devices: `id` is the device in the path, if any. Throws
+	 * `ConsoleHttpError`, which the caller turns into a response.
+	 */
 	async handle(
 		request: Request,
-		parts: readonly string[],
-		admission: Authenticated,
-	): Promise<Response | undefined> {
-		const [head, area, name, id] = parts;
-		if (head !== "api" || area !== "push") return undefined;
-		try {
-			const principalId = await this.#owner(admission);
-			const { method } = request;
-			if (name === "key" && !id && method === "GET")
-				return json({
-					key: this.#options.vapid.publicKey,
-				} satisfies PushKeyView);
-			if (name !== "subscriptions")
-				throw new HttpError(404, "There is no such API.");
-			if (!id && method === "GET")
-				return json(await this.#devices(principalId));
-			if (!id && method === "POST")
-				return await this.#add(request, principalId);
-			if (!id && method === "DELETE")
-				return await this.#removeEndpoint(request, principalId);
-			if (id && method === "DELETE")
-				return await this.#removeId(id, principalId);
-			throw new HttpError(405, "Method not allowed.");
-		} catch (error) {
-			if (error instanceof HttpError)
-				return json({ error: error.message }, error.status);
-			throw error;
-		}
-	}
-
-	async #owner(admission: Authenticated): Promise<string> {
-		const { principal } = admission.visitor;
-		if ((await this.#options.identity.tierOf(principal.id)) !== "owner")
-			throw new HttpError(403, "Only an owner may do this.");
-		return principal.id;
+		id: string | undefined,
+		principalId: string,
+	): Promise<Response> {
+		const { method } = request;
+		if (!id && method === "GET") return json(await this.#devices(principalId));
+		if (!id && method === "POST") return await this.#add(request, principalId);
+		if (!id && method === "DELETE")
+			return await this.#removeEndpoint(request, principalId);
+		if (id && method === "DELETE") return await this.#removeId(id, principalId);
+		throw new HttpError(405, "Method not allowed.");
 	}
 
 	async #devices(principalId: string): Promise<PushDevicesView> {
@@ -188,3 +168,160 @@ export class PushApi {
 		return json({ ok: true });
 	}
 }
+
+export interface PushApiOptions {
+	/** The key browsers subscribe against; an external sender's is the one the operator configured. */
+	vapid: Pick<Vapid, "publicKey">;
+	devices: DeviceRoutes;
+	/** The tiers whose people may use push. */
+	tiers: readonly Tier[];
+	/** False when the sender serves the subscription routes itself: here they answer 404. */
+	subscriptions: boolean;
+	/** Queues a test push to the person's devices; returns its tag. Undefined when push is not set up. */
+	test?(principalId: string): Promise<PushTestView | "no-device">;
+	/** Records a receipt the service worker posted; false when the tag is not the person's. */
+	receipt(
+		principalId: string,
+		tag: string,
+		event: ReceiptEvent,
+	): Promise<boolean>;
+	prefs: {
+		get(principalId: string): Promise<PushPrefs | undefined>;
+		set(principalId: string, prefs: PushPrefs | undefined): Promise<void>;
+	};
+}
+
+const EVENTS: readonly string[] = ["received", "opened"];
+
+/**
+ * The push routes under `<mount>/api/push/`: the key a browser subscribes against, the person's
+ * devices, a test push, the receipts the service worker posts back, and their quiet hours. All of
+ * it is the signed-in person's own: the principal is the session's, never one a request names.
+ */
+export class PushApi {
+	readonly #options: PushApiOptions;
+
+	constructor(options: PushApiOptions) {
+		this.#options = options;
+	}
+
+	/** Answers `api/push/...`; undefined for any other path. */
+	async handle(
+		request: Request,
+		parts: readonly string[],
+		admission: Authenticated,
+	): Promise<Response | undefined> {
+		const [head, area, name, id] = parts;
+		if (head !== "api" || area !== "push") return undefined;
+		try {
+			const { principal, tier } = admission.visitor;
+			const { method } = request;
+			// A receipt is the person's own whatever their tier: the notice or the test it names must be theirs.
+			if (name === "receipts" && !id && method === "POST")
+				return await this.#receipt(request, principal.id);
+			this.#allowed(tier);
+			if (name === "key" && !id && method === "GET")
+				return json({
+					key: this.#options.vapid.publicKey,
+				} satisfies PushKeyView);
+			if (name === "subscriptions" && this.#options.subscriptions)
+				return await this.#options.devices.handle(request, id, principal.id);
+			if (name === "test" && !id && method === "POST")
+				return await this.#test(principal.id);
+			if (name === "prefs" && !id)
+				return await this.#prefs(request, principal.id);
+			throw new HttpError(404, "There is no such API.");
+		} catch (error) {
+			if (error instanceof HttpError)
+				return json({ error: error.message }, error.status);
+			throw error;
+		}
+	}
+
+	/** The person's tier may use push; the tier is the one this request was admitted at. */
+	#allowed(tier: Tier): void {
+		if (this.#options.tiers.includes(tier)) return;
+		if (this.#options.tiers.length === 1 && this.#options.tiers[0] === "owner")
+			throw new HttpError(403, "Only an owner may do this.");
+		throw new HttpError(403, "Push is not available to you.");
+	}
+
+	async #test(principalId: string): Promise<Response> {
+		if (!this.#options.test)
+			throw new HttpError(
+				503,
+				"Push is not set up: set push.subject on the server.",
+			);
+		const made = await this.#options.test(principalId);
+		if (made === "no-device")
+			throw new HttpError(
+				409,
+				"This account has no device that gets push yet. Turn it on first.",
+			);
+		return json(made);
+	}
+
+	async #receipt(request: Request, principalId: string): Promise<Response> {
+		const body = await bodyOf(request);
+		const { tag, event } = body;
+		if (
+			typeof tag !== "string" ||
+			tag.length === 0 ||
+			tag.length > 200 ||
+			typeof event !== "string" ||
+			!EVENTS.includes(event)
+		)
+			throw new HttpError(400, "A receipt needs a tag and received or opened.");
+		const taken = await this.#options.receipt(
+			principalId,
+			tag,
+			event as ReceiptEvent,
+		);
+		if (!taken) throw new HttpError(404, "There is no such notification.");
+		return json({ ok: true });
+	}
+
+	async #prefs(request: Request, principalId: string): Promise<Response> {
+		const { prefs } = this.#options;
+		if (request.method === "GET") return json(await this.#view(principalId));
+		if (request.method !== "PUT")
+			throw new HttpError(405, "Method not allowed.");
+		const body = await bodyOf(request);
+		if (!("quiet" in body))
+			throw new HttpError(400, "Send quiet: {start, end, timeZone} or null.");
+		if (body.quiet === null) await prefs.set(principalId, undefined);
+		else {
+			const quiet = body.quiet as Partial<
+				Record<"start" | "end" | "timeZone", unknown>
+			> | null;
+			try {
+				await prefs.set(
+					principalId,
+					checkPrefs({
+						quietStart: quiet?.start,
+						quietEnd: quiet?.end,
+						timeZone: quiet?.timeZone,
+					}),
+				);
+			} catch (error) {
+				if (error instanceof PrefsRefused)
+					throw new HttpError(400, error.message);
+				throw error;
+			}
+		}
+		return json(await this.#view(principalId));
+	}
+
+	async #view(principalId: string): Promise<PushPrefsView> {
+		const prefs = await this.#options.prefs.get(principalId);
+		return prefs
+			? {
+					quiet: {
+						start: prefs.quietStart,
+						end: prefs.quietEnd,
+						timeZone: prefs.timeZone,
+					},
+				}
+			: {};
+	}
+}