pi-roundtable-web 0.25.0 → 0.26.1

package/src/push-sender/run.ts

@@ -0,0 +1,118 @@
+import type { Server, SQL } from "bun";
+import type { Logger } from "pi-roundtable";
+import { ConsoleHttpError, json } from "../http.ts";
+import { DeviceRoutes } from "../push/api.ts";
+import { OutboxSender, type PushTransport } from "../push/drain.ts";
+import { EndpointPolicy } from "../push/endpoint.ts";
+import { type OutboxRow, PushOutbox } from "../push/outbox.ts";
+import { PushSubscriptions } from "../push/subscriptions.ts";
+
+export interface PushSenderOptions {
+	/**
+	 * The sender's own database role. It needs to SELECT the outbox, subscriptions, sessions and
+	 * principals, UPDATE the outbox, and INSERT deliveries and subscriptions.
+	 */
+	database: SQL;
+	/** Tried in order for each row until one says `sent`; a row's `via` narrows them. */
+	transports: readonly PushTransport[];
+	/** Words a row; with `push.content: "none"` the row carries no text, so this is where it comes from. */
+	render(row: OutboxRow): { title: string; body?: string };
+	/** Serves the subscription routes at `path`, for `push.sender.external.subscribePath`. */
+	subscribe?: {
+		listener: { port: number; hostname?: string } | { socketPath: string };
+		/** The path the page posts devices to, such as `/push/subscriptions`. */
+		path: string;
+		/** Every request that is not a GET must carry exactly this `Origin`: the console's. */
+		origin: string;
+		/** The principal behind the request's session cookie, or undefined (use `webSessionPrincipal`). */
+		authenticate(request: Request): Promise<string | undefined>;
+		/** Push services besides the browsers' own, as `push.endpointHosts` writes them. */
+		endpointHosts?: readonly string[];
+	};
+	logger: Logger;
+	/** How often the outbox is looked at; default 1 s. */
+	intervalMs?: number;
+}
+
+/**
+ * Runs the process that signs and sends the app's pushes when the app holds no key
+ * (`push.sender.external`). It empties the outbox through the transports and, when asked, serves
+ * the subscription routes with the app's session cookie and the console's `Origin`.
+ */
+export function runPushSender(options: PushSenderOptions): {
+	stop(): Promise<void>;
+	/** Takes and sends what is queued now, for a test; returns how many rows it finished. */
+	drain(): Promise<number>;
+	/** The port the subscription routes listen on, when they are served over TCP. */
+	port?: number;
+} {
+	const sender = new OutboxSender({
+		outbox: new PushOutbox(options.database),
+		transports: options.transports,
+		render: options.render,
+		logger: options.logger,
+		...(options.intervalMs ? { intervalMs: options.intervalMs } : {}),
+	});
+	sender.start();
+	const server = options.subscribe ? serve(options) : undefined;
+	return {
+		stop: async () => {
+			await server?.stop(true);
+			await sender.stop();
+		},
+		drain: () => sender.drain(),
+		...(server?.port ? { port: server.port } : {}),
+	};
+}
+
+function serve(options: PushSenderOptions): Server<undefined> {
+	const { subscribe, logger } = options;
+	if (!subscribe) throw new Error("no subscribe options");
+	const devices = new DeviceRoutes({
+		policy: new EndpointPolicy(subscribe.endpointHosts),
+		subscriptions: new PushSubscriptions(options.database),
+		enabled: true,
+	});
+	const base = subscribe.path.replace(/\/$/, "");
+	return Bun.serve({
+		...("socketPath" in subscribe.listener
+			? { unix: subscribe.listener.socketPath }
+			: {
+					port: subscribe.listener.port,
+					hostname: subscribe.listener.hostname ?? "127.0.0.1",
+				}),
+		fetch: async (request) => {
+			const path = URL.parse(request.url)?.pathname ?? "";
+			if (path !== base && !path.startsWith(`${base}/`))
+				return new Response("Not Found", { status: 404 });
+			let id: string | undefined;
+			try {
+				id =
+					path === base
+						? undefined
+						: decodeURIComponent(path.slice(base.length + 1));
+			} catch {
+				return json({ error: "There is no such device." }, 404);
+			}
+			// A page on a sibling host of the same site carries the cookie too; the Origin is what stops it.
+			if (
+				request.method !== "GET" &&
+				request.headers.get("origin") !== subscribe.origin
+			)
+				return json({ error: "The request did not come from the app." }, 403);
+			try {
+				const principalId = await subscribe.authenticate(request);
+				if (!principalId) return json({ error: "Sign in again." }, 401);
+				return await devices.handle(request, id, principalId);
+			} catch (error) {
+				if (error instanceof ConsoleHttpError)
+					return json({ error: error.message }, error.status);
+				logger.error({ err: error }, "a subscription request failed");
+				return json(
+					{ error: "The sender could not complete the request." },
+					500,
+				);
+			}
+		},
+	});
+}

package/src/push-sender/session.ts

@@ -0,0 +1,54 @@
+import { createHash } from "node:crypto";
+import type { SQL } from "bun";
+import { WebSessions } from "../auth/sessions.ts";
+
+/** The session cookie the app sets: `__Secure-` because the console is never served at the root. */
+export const SESSION_COOKIE = "__Secure-rt_session";
+
+const cookieValue = (
+	header: string | null,
+	name: string,
+): string | undefined => {
+	for (const part of (header ?? "").split(";")) {
+		const at = part.indexOf("=");
+		if (at > 0 && part.slice(0, at).trim() === name)
+			return part.slice(at + 1).trim();
+	}
+	return undefined;
+};
+
+/**
+ * Looks the app's session cookie up in `web_sessions` (read only) and answers the principal it
+ * belongs to, or undefined for a cookie that names no session, a session past its limit, or a
+ * principal that is disabled. The cookie holds a random id; only its SHA-256 is stored.
+ */
+export function webSessionPrincipal(options: {
+	database: SQL;
+	/** The cookie's name; default the app's own. */
+	cookieName?: string;
+}): (request: Request) => Promise<string | undefined> {
+	const name = options.cookieName ?? SESSION_COOKIE;
+	return async (request) => {
+		const token = cookieValue(request.headers.get("cookie"), name);
+		if (!token) return undefined;
+		const [found]: { principal_id: string }[] = await options.database`
+			SELECT s.principal_id FROM web_sessions s
+			JOIN principals p ON p.id = s.principal_id
+			WHERE s.id_hash = ${createHash("sha256").update(token).digest()}
+				AND s.expires_at > now() AND p.disabled_at IS NULL`;
+		return found?.principal_id;
+	};
+}
+
+/**
+ * The id_token claims `oidc.storeClaims` kept for a person, from their newest live session;
+ * undefined when they have no live session or kept no claims. For a sender that needs, say, the
+ * person's mailbox address. Claims are the host's own data: never log them.
+ */
+export function webSessionClaims(
+	database: SQL,
+	principalId: string,
+): Promise<Readonly<Record<string, unknown>> | undefined> {
+	// The idle limit only matters for creating a session; reading one does not use it.
+	return new WebSessions(database, { days: 30 }).claimsOf(principalId);
+}

package/src/pwa.ts

@@ -1,4 +1,4 @@
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { basename, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import type { AssetBundle } from "./assets.ts";
@@ -34,7 +34,27 @@ export const DEFAULT_ICONS_DIR = fileURLToPath(
 	new URL("../assets/icons/", import.meta.url),
 );
 
-const ICON_FILE = /^[A-Za-z0-9-]+\.png$/;
+const ICON_FILE = /^[A-Za-z0-9-]+\.(png|svg)$/;
+
+/** The icon files the page, the manifest and the sign-in pages link. */
+const PUBLIC_ICONS: ReadonlySet<string> = new Set([
+	"192.png",
+	"512.png",
+	"maskable-512.png",
+	"apple-180.png",
+	"badge-96.png",
+	"mark.svg",
+	"mark-maskable.svg",
+]);
+
+/** The manifest and the linked icons answer without a session: a sign-in page and a link preview have none. Any other file of a host's icon directory stays behind it. */
+export const isPublicStatic = (rest: string): boolean =>
+	rest === "manifest.webmanifest" ||
+	(rest.startsWith("icons/") && PUBLIC_ICONS.has(rest.slice("icons/".length)));
+
+/** Whether the icon directory has the round-table mark as an SVG, which a tab shows crisper than a PNG. */
+export const hasMarkSvg = (iconsDir: string | undefined): boolean =>
+	existsSync(join(iconsDir ?? DEFAULT_ICONS_DIR, "mark.svg"));
 
 export interface PwaOptions {
 	mount: string;
@@ -116,10 +136,18 @@ export function servePwa(
 			const body = readFileSync(
 				join(options.iconsDir ?? DEFAULT_ICONS_DIR, name),
 			);
+			const svg = name.endsWith(".svg");
 			return new Response(new Uint8Array(body), {
 				headers: {
-					"content-type": "image/png",
-					"cache-control": "private, max-age=86400",
+					"content-type": svg ? "image/svg+xml" : "image/png",
+					"cache-control": "public, max-age=86400",
+					// An SVG opened as a page must not run anything of its own.
+					...(svg
+						? {
+								"content-security-policy":
+									"default-src 'none'; style-src 'unsafe-inline'",
+							}
+						: {}),
 				},
 			});
 		} catch {

package/src/visitors.ts

@@ -1,13 +1,24 @@
 import type {
 	ActorFacts,
+	ChannelKey,
 	IdentityService,
 	Logger,
 	Principal,
+	Tier,
 } from "pi-roundtable";
 
-/** Who a request the console admitted comes from: an owner's principal. */
+/**
+ * Who a request the console admitted comes from: the principal, the tier they hold on this
+ * request (read again for every request and every socket frame, never carried over from the
+ * sign-in), the identity they spoke as, and the roles their sign-in carried.
+ */
 export interface Visitor {
 	principal: Principal;
+	tier: Tier;
+	/** The identity they spoke as, `<provider>:<subject>`; the principal's id when the credential names none. */
+	speakerId: string;
+	/** The roles the sign-in carried, each `<surface>:role:<name>`. */
+	roles: readonly string[];
 }
 
 /** The visitor of a request, or why it is refused, for the operator's log. */
@@ -19,6 +30,12 @@ export type ConsoleIdentity = Pick<
 	"principalOf" | "principal" | "tierOf" | "owners"
 >;
 
+/** The reads (and the one first-contact write) of `IDENTITY` that admitting members uses. */
+export type AccessIdentity = Pick<
+	IdentityService,
+	"principalOf" | "principal" | "peek" | "resolve"
+>;
+
 export interface VisitorOptions {
 	/** Whom a request from a verifier that reports no actor stands for; default the primary owner. */
 	ownerId?: string;
@@ -50,13 +67,24 @@ export function consoleVisitors(
 		logger.warn(`web-console: ${message}`);
 	};
 
-	const owner = async (id: string): Promise<Identified> => {
+	const owner = async (
+		id: string,
+		actor: ActorFacts | undefined,
+	): Promise<Identified> => {
 		const principal = await identity.principal(id);
 		if (!principal) return { refusal: `there is no principal ${id}` };
 		if (principal.disabled) return { refusal: `principal ${id} is disabled` };
-		if ((await identity.tierOf(id)) !== "owner")
+		const tier = await identity.tierOf(id);
+		if (tier !== "owner")
 			return { refusal: `principal ${id} holds no owner role` };
-		return { visitor: { principal } };
+		return {
+			visitor: {
+				principal,
+				tier,
+				speakerId: actor ? `${actor.provider}:${actor.subject}` : id,
+				roles: actor?.roles ?? [],
+			},
+		};
 	};
 
 	return async (actor) => {
@@ -68,7 +96,7 @@ export function consoleVisitors(
 			const id = options.ownerId ?? (await identity.owners())[0]?.id;
 			return id === undefined
 				? { refusal: "the host has no owner" }
-				: owner(id);
+				: owner(id, undefined);
 		}
 		const named = `${actor.provider}:${actor.subject}`;
 		if (actor.provider === LEGACY_PROVIDER)
@@ -79,7 +107,7 @@ export function consoleVisitors(
 		} catch {
 			return { refusal: "the verifier's actor is no identity" };
 		}
-		if (id !== undefined) return owner(id);
+		if (id !== undefined) return owner(id, actor);
 		warnOnce(
 			named,
 			`${named} is linked to no principal, so the console refuses it. If it is an owner's, add "${named}" to that owner's access.owners[].identities, or run: roundtable principal link <owner's principal id> ${named}`,
@@ -87,3 +115,63 @@ export function consoleVisitors(
 		return { refusal: `${named} is linked to no principal` };
 	};
 }
+
+export interface AccessOptions {
+	/** The app's surface, such as `app`: the surface the facts name and the conversation `<surface>:session` the tier is read for. */
+	surface: string;
+	logger: Logger;
+}
+
+/**
+ * Identifies the person behind each request when the app admits everyone `IDENTITY` admits on its
+ * surface (`admission: "access"`). The credential must name a person: one shared actor names no
+ * one. The facts are the app's (`surface`, `partial`, and the roles the sign-in carried), so a
+ * sign-in shows less than a person may hold and never lowers a tier recorded elsewhere.
+ *
+ * A linked identity is only read (`peek`): a request writes nothing. An unlinked one goes through
+ * `resolve`, which admits it as a new principal where `access.provisioning` says so for the
+ * surface. A disabled principal, and a person the rules give no tier, are refused.
+ */
+export function accessVisitors(
+	identity: AccessIdentity,
+	options: AccessOptions,
+): (actor: ActorFacts | undefined) => Promise<Identified> {
+	const { surface, logger } = options;
+	const scope = { conversation: `${surface}:session` as ChannelKey };
+	return async (actor) => {
+		if (!actor) return { refusal: "the credential names no one" };
+		if (actor.provider === LEGACY_PROVIDER)
+			return { refusal: "a 0.8 id is not an identity" };
+		const named = `${actor.provider}:${actor.subject}`;
+		const facts: ActorFacts = { ...actor, surface, partial: true };
+		let linked: string | undefined;
+		try {
+			linked = await identity.principalOf(named);
+		} catch {
+			return { refusal: "the credential's actor is no identity" };
+		}
+		const speaker =
+			linked === undefined
+				? await identity.resolve(facts, scope)
+				: await identity.peek(facts, scope);
+		if (!speaker) {
+			logger.debug(
+				{ linked: linked !== undefined },
+				"web-console: the access rules serve no one by this sign-in",
+			);
+			return { refusal: `${named} holds no tier on this surface` };
+		}
+		const principal = await identity.principal(speaker.principalId);
+		if (!principal) return { refusal: "the principal is gone" };
+		if (principal.disabled)
+			return { refusal: `principal ${principal.id} is disabled` };
+		return {
+			visitor: {
+				principal,
+				tier: speaker.tier,
+				speakerId: named,
+				roles: actor.roles ?? [],
+			},
+		};
+	};
+}