pi-roundtable-web 0.25.0 → 0.26.1

package/src/auth/authenticator.ts

@@ -4,8 +4,10 @@ import type { ResolvedAuth } from "../options.ts";
 import type { Verdict } from "../verifier.ts";
 import type { Identified, Visitor } from "../visitors.ts";
 import { checkNoneListener } from "./none.ts";
+import type { OidcLogin } from "./oidc.ts";
 import { checkPassword, PasswordCredential } from "./password.ts";
 import { loadSessionKey } from "./session-key.ts";
+import type { WebSessions } from "./sessions.ts";
 
 /** The plugin identity `none` and `password` speak through; `RoundtablePlugin.identities` links it to the owner. */
 export const WEB_CONSOLE_IDENTITY = "token:web-console";
@@ -22,6 +24,14 @@ export interface Authenticated {
 	visitor: Visitor;
 	actor?: ActorFacts;
 	expiresAt?: Date;
+	/** The session the credential is, when it is one: what an open socket asks about again. */
+	session?: string;
+}
+
+/** What a socket holds of the credential it came in on, to ask again whether it still stands. */
+export interface Held {
+	actor: ActorFacts | undefined;
+	session?: string | undefined;
 }
 
 /** A request that may not, with the status that says so; `login` when signing in would help. */
@@ -38,6 +48,12 @@ export interface Unauthenticated {
  */
 export interface Authenticator {
 	authenticate(request: Request): Promise<Authenticated | Unauthenticated>;
+	/**
+	 * Asks again about a credential already admitted, as an open socket does for every frame and on
+	 * a timer: does the session still stand, and who is the person now, at which tier. It reads the
+	 * same `IDENTITY` as a request does, so a person disabled or demoted since is seen at once.
+	 */
+	recheck(held: Held): Promise<{ visitor: Visitor } | Unauthenticated>;
 	/**
 	 * Answers the paths below the mount that need no session, such as the login page; undefined
 	 * for any other, and absent for a mode with none.
@@ -60,6 +76,11 @@ export interface AuthenticatorOptions {
 	dataDir: string;
 	/** The listener the console is served on and its address, for the check of `none`. */
 	listener: { id: string; address: Readonly<ListenerAddress> | undefined };
+	/** The sign-in flow and the session store, for `oidc`. */
+	oidc?: {
+		login: Pick<OidcLogin, "open" | "credential" | "verified">;
+		sessions: Pick<WebSessions, "alive">;
+	};
 	/** Where the password is read from; default `process.env`. */
 	env?: Readonly<Record<string, string | undefined>>;
 	/** How long each failed login waits; default 1000 ms. Tests set it lower. */
@@ -68,8 +89,15 @@ export interface AuthenticatorOptions {
 	now?: () => number;
 }
 
+/** A credential that admits: who it vouches for, and the session it is when it is one. */
+export type Admitted = Extract<Verdict, { admitted: true }> & {
+	session?: string;
+};
+
 /** What a credential says about a request, before the person is identified. */
-type Credential = (request: Request) => Promise<Verdict | Unauthenticated>;
+export type Credential = (
+	request: Request,
+) => Promise<Verdict | Admitted | Unauthenticated>;
 
 const READ_METHODS = new Set(["GET", "HEAD"]);
 
@@ -78,6 +106,16 @@ const denied = (refusal: string): Unauthenticated => ({
 	status: 403,
 });
 
+/** A refusal in the shape identification answers with. */
+const refused = (reason: string): Identified => ({ refusal: reason });
+
+/** A session that is gone, which signing in again would fix. */
+const signedOut = (reason: string): Unauthenticated => ({
+	refusal: reason,
+	status: 401,
+	login: true,
+});
+
 /** Admits as the verifier says; one that throws or rejects admits no one. */
 function verifierCredential(
 	verifier: (request: Request) => Verdict | Promise<Verdict>,
@@ -112,6 +150,11 @@ export function createAuthenticator(
 			logger,
 		);
 		credential = async () => ({ admitted: true, actor: WEB_CONSOLE_ACTOR });
+	} else if (auth.mode === "oidc") {
+		if (!options.oidc) throw new Error("the oidc sign-in is not set up");
+		credential = options.oidc.login.credential;
+		open = (request, rest) =>
+			options.oidc?.login.open(request, rest) ?? Promise.resolve(undefined);
 	} else {
 		const password = new PasswordCredential({
 			password: checkPassword(options.env ?? process.env, auth.passwordEnv),
@@ -138,30 +181,56 @@ export function createAuthenticator(
 		};
 		open = (request, rest) => password.open(request, rest);
 	}
+	const identify = async (
+		actor: ActorFacts | undefined,
+	): Promise<Identified> => {
+		try {
+			return await options.identify(actor);
+		} catch {
+			// A lookup of who they are that fails admits no one.
+			return refused("identity failed");
+		}
+	};
 	return {
 		...(open ? { open } : {}),
 		async authenticate(request) {
 			const checked = await credential(request);
 			if ("refusal" in checked) return checked;
 			if (!checked.admitted) return denied(String(checked.reason));
-			let identified: Identified;
-			try {
-				identified = await options.identify(checked.actor);
-			} catch {
-				// A lookup of who they are that fails admits no one.
-				return denied("identity failed");
-			}
+			const identified = await identify(checked.actor);
 			if ("refusal" in identified) return denied(String(identified.refusal));
 			if (
 				!READ_METHODS.has(request.method) &&
 				request.headers.get("origin") !== options.origin
 			)
 				return denied("foreign origin");
+			const { session } = checked as Admitted;
+			if (session)
+				options.oidc?.login.verified(session, identified.visitor.principal.id);
 			return {
 				visitor: identified.visitor,
 				...(checked.actor ? { actor: checked.actor } : {}),
 				...(checked.expiresAt ? { expiresAt: checked.expiresAt } : {}),
+				...(session ? { session } : {}),
 			};
 		},
+		async recheck(held) {
+			if (held.session) {
+				try {
+					if (!(await options.oidc?.sessions.alive(held.session)))
+						return signedOut("session ended");
+				} catch {
+					return denied("session lookup failed");
+				}
+			}
+			const identified = await identify(held.actor);
+			if ("refusal" in identified) return denied(String(identified.refusal));
+			if (held.session)
+				options.oidc?.login.verified(
+					held.session,
+					identified.visitor.principal.id,
+				);
+			return { visitor: identified.visitor };
+		},
 	};
 }

package/src/auth/login-page.ts

@@ -1,9 +1,10 @@
 import { type ConsolePresentation, message } from "../features.ts";
 import { escapeHtml } from "../http.ts";
+import { iconLinks } from "../page-presentation.ts";
 
-/** The login page's CSP: no script at all, one inline style, and the form posts only to this origin. */
+/** The login page's CSP: no script at all, one inline style, its own icon, and the form posts only to this origin. */
 export const LOGIN_CSP =
-	"default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'";
+	"default-src 'none'; style-src 'unsafe-inline'; img-src 'self'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'";
 
 /** The login page, as one server-rendered document with no script; `note` is a line above the field. */
 export function loginPage(
@@ -19,6 +20,7 @@ export function loginPage(
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <meta name="robots" content="noindex">
+${iconLinks(mount, false)}
 <title>${escapeHtml(title)}</title>
 <style>
 body{font:16px/1.5 system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#f6f6f4;color:#1c1c1a}

package/src/auth/next.ts

@@ -0,0 +1,52 @@
+/**
+ * Where a sign-in goes back to. A page link (from the host's own dashboard, a notification, or a
+ * page the server turned away) names it as `?next=`, and only these shapes are taken: anything
+ * else is dropped, so the callback never redirects to a place a link chose.
+ *
+ * - `profile`, `notices`, `settings`: a page of the app;
+ * - `room:<key>`: a room of this app's surface (`<surface>:<kind>.<id>`);
+ * - `p:<id>`: a host page, `[a-z0-9-]{1,40}`.
+ */
+export function allowedNext(
+	value: string | null | undefined,
+	surface: string,
+): string | undefined {
+	if (!value) return undefined;
+	if (value === "profile" || value === "notices" || value === "settings")
+		return value;
+	const room = /^room:(.+)$/.exec(value)?.[1];
+	if (room !== undefined)
+		return new RegExp(`^${surface}:[A-Za-z0-9._~-]{1,160}$`).test(room)
+			? value
+			: undefined;
+	const page = /^p:(.+)$/.exec(value)?.[1];
+	return page !== undefined && /^[a-z0-9-]{1,40}$/.test(page)
+		? value
+		: undefined;
+}
+
+/** The app route a `next` names, as the page's router writes it: `room/<key>`, `p/<id>` or the page's name. */
+export function routeOfNext(next: string): string {
+	if (next.startsWith("room:"))
+		return `room/${encodeURIComponent(next.slice("room:".length))}`;
+	if (next.startsWith("p:")) return `p/${next.slice("p:".length)}`;
+	return next;
+}
+
+/**
+ * The `next` a page path stands for, for a server that turns away a page navigation (path
+ * routing only: a hash route never reaches the server). Undefined for a path that names none.
+ */
+export function nextOfPath(rest: string, surface: string): string | undefined {
+	const [first, second, ...more] = rest.split("/").filter(Boolean);
+	if (more.length > 0 || first === undefined) return undefined;
+	try {
+		if (second === undefined) return allowedNext(first, surface);
+		const key = decodeURIComponent(second);
+		if (first === "room") return allowedNext(`room:${key}`, surface);
+		if (first === "p") return allowedNext(`p:${key}`, surface);
+	} catch {
+		return undefined;
+	}
+	return undefined;
+}

package/src/auth/oidc-pages.ts

@@ -0,0 +1,62 @@
+import { type ConsolePresentation, message } from "../features.ts";
+import { escapeHtml } from "../http.ts";
+import { iconLinks } from "../page-presentation.ts";
+import { LOGIN_CSP } from "./login-page.ts";
+
+/** What a page of the sign-in flow tells, and the link it offers. */
+type Notice = "signed-out" | "failed" | "not-allowed";
+
+/**
+ * The static pages of the sign-in flow: logged out, a sign-in that did not complete, and a person
+ * the app does not admit. They carry no script and no detail of why: the reason goes to the log.
+ */
+export function oidcPage(
+	notice: Notice,
+	mount: string,
+	title: string,
+	presentation: ConsolePresentation | undefined,
+	status: number,
+): Response {
+	const say = (source: string) => escapeHtml(message(presentation, source));
+	const text =
+		notice === "signed-out"
+			? say("You are signed out.")
+			: notice === "not-allowed"
+				? say("This account is not allowed to use this app.")
+				: say("Sign-in did not complete.");
+	const link = notice === "signed-out" ? say("Sign in") : say("Try again");
+	const html = `<!doctype html>
+<html lang="${escapeHtml(presentation?.locale ?? "en")}">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+${iconLinks(mount, false)}
+<title>${escapeHtml(title)}</title>
+<style>
+body{font:16px/1.5 system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#f6f6f4;color:#1c1c1a}
+@media(prefers-color-scheme:dark){body{background:#151514;color:#ecece8}}
+main{width:min(22rem,calc(100vw - 2rem));display:grid;gap:1rem}
+h1{font-size:1.25rem;margin:0}
+p{margin:0}
+a{font:inherit;padding:.6rem .75rem;border-radius:.5rem;background:#2d5be3;color:#fff;text-decoration:none;text-align:center}
+</style>
+</head>
+<body>
+<main>
+<h1>${escapeHtml(title)}</h1>
+<p role="${notice === "signed-out" ? "status" : "alert"}">${text}</p>
+<a href="${escapeHtml(mount)}/login">${link}</a>
+</main>
+</body>
+</html>
+`;
+	return new Response(html, {
+		status,
+		headers: {
+			"content-type": "text/html;charset=utf-8",
+			"cache-control": "no-store",
+			"content-security-policy": LOGIN_CSP,
+		},
+	});
+}