pinomad 0.10.0 → 0.11.0

package/dist/{chunk-p978qj9m.js → chunk-9h5vawnm.js}

@@ -9,14 +9,14 @@ import {
   relayWsBase,
   verifyRelayChallenge,
   verifyRelayChallengeV2
-} from "./chunk-cx8k63by.js";
+} from "./chunk-y127fe1a.js";
+import {
+  normalizeHostName
+} from "./chunk-pqe7q1s7.js";
 import {
   commandHint,
   webRoot
-} from "./chunk-zehwx009.js";
-import {
-  normalizeHostName
-} from "./chunk-sygeb9qb.js";
+} from "./chunk-sd5fkxjj.js";
 import"./chunk-df32avw6.js";
 
 // apps/server/src/main.ts
@@ -25,7 +25,7 @@ import { join as join2, resolve } from "node:path";
 import { parseArgs } from "node:util";
 
 // apps/server/src/accounts.ts
-import { createHash, randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+import { createHash, randomBytes, randomInt, scrypt, timingSafeEqual } from "node:crypto";
 import { mkdir } from "node:fs/promises";
 import { join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
@@ -58,9 +58,26 @@ async function lockDataDir(dir, options) {
 
 // apps/server/src/accounts.ts
 var DB_FILE = "server.sqlite";
-var SCHEMA_VERSION = 4;
+var SCHEMA_VERSION = 6;
 var SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 var JOIN_TOKEN_TTL_MS = 10 * 60 * 1000;
+var USER_CODE_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ";
+var USER_CODE_LENGTH = 8;
+var HOST_LINK_TTL_MS = JOIN_TOKEN_TTL_MS;
+var HOST_LINK_INTERVAL_S = 5;
+var SLOW_DOWN_STEP_S = 5;
+var POLL_SLACK_MS = 1000;
+var HOST_OS_MAX_CODEPOINTS = 64;
+function normalizeUserCode(input) {
+  const code = input.replace(/[\s-]/g, "").toUpperCase();
+  if (code.length !== USER_CODE_LENGTH)
+    return;
+  for (const letter of code)
+    if (!USER_CODE_ALPHABET.includes(letter))
+      return;
+  return code;
+}
+var formatUserCode = (code) => `${code.slice(0, 4)}-${code.slice(4)}`;
 var INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 var SIGN_UP_USERNAME = /^[a-z0-9][a-z0-9._-]{1,31}$/;
 var PUSH_TOKEN_TTL_MS = 90 * 24 * 60 * 60 * 1000;
@@ -190,6 +207,38 @@ function migrate(db) {
   }
   if (version < 4)
     migrateTo4(db);
+  if (version < 5) {
+    db.exec(`
+      BEGIN;
+      ALTER TABLE push_tokens ADD COLUMN device_id INTEGER REFERENCES account_devices(id) ON DELETE SET NULL;
+      CREATE INDEX push_tokens_device ON push_tokens (device_id);
+      PRAGMA user_version = 5;
+      COMMIT;
+    `);
+  }
+  if (version < 6) {
+    db.exec(`
+      BEGIN;
+      CREATE TABLE host_link_requests (
+        device_code_hash TEXT PRIMARY KEY,
+        user_code_hash TEXT NOT NULL UNIQUE,
+        host_id TEXT NOT NULL,
+        host_name TEXT,
+        host_os TEXT,
+        source_ip TEXT,
+        state TEXT NOT NULL DEFAULT 'pending',
+        user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
+        interval_s INTEGER NOT NULL,
+        last_poll_at INTEGER,
+        created_at INTEGER NOT NULL,
+        expires_at INTEGER NOT NULL
+      );
+      CREATE INDEX host_link_requests_expiry ON host_link_requests (expires_at);
+      ALTER TABLE join_tokens ADD COLUMN host_id TEXT;
+      PRAGMA user_version = 6;
+      COMMIT;
+    `);
+  }
 }
 function migrateTo4(db) {
   db.exec("BEGIN");
@@ -386,6 +435,53 @@ async function openAccounts(options) {
   const gate = new ScryptGate(limits.scryptConcurrency, limits.scryptQueue);
   const ipAttempts = new WindowedCounter(limits.counterMaxEntries, now);
   const userFailures = new WindowedCounter(limits.counterMaxEntries, now);
+  const linkLimits = {
+    startMaxPerIp: options.hostLinkLimits?.startMaxPerIp ?? 10,
+    startWindowMs: options.hostLinkLimits?.startWindowMs ?? 10 * 60000,
+    maxPending: options.hostLinkLimits?.maxPending ?? 1000,
+    userMaxFailures: options.hostLinkLimits?.userMaxFailures ?? 10,
+    ipMaxFailures: options.hostLinkLimits?.ipMaxFailures ?? 30,
+    failureWindowMs: options.hostLinkLimits?.failureWindowMs ?? 15 * 60000,
+    counterMaxEntries: options.hostLinkLimits?.counterMaxEntries ?? 4096
+  };
+  const linkStarts = new WindowedCounter(linkLimits.counterMaxEntries, now);
+  const linkUserFailures = new WindowedCounter(linkLimits.counterMaxEntries, now);
+  const linkIpFailures = new WindowedCounter(linkLimits.counterMaxEntries, now);
+  const sweepExpired = () => {
+    const at = now();
+    db.prepare("DELETE FROM join_tokens WHERE expires_at <= ?").run(at);
+    db.prepare("DELETE FROM host_link_requests WHERE expires_at <= ?").run(at);
+  };
+  const mintJoinToken = (userId, hostId) => {
+    const token = randomBytes(32).toString("base64url");
+    const expiresAt = now() + JOIN_TOKEN_TTL_MS;
+    db.prepare("INSERT INTO join_tokens (token_hash, user_id, created_at, expires_at, host_id) VALUES (?, ?, ?, ?, ?)").run(sha256Hex(token), userId, now(), expiresAt, hostId);
+    return { token, expiresAt };
+  };
+  const pendingByCode = (userId, userCode, ip) => {
+    const userKey = String(userId);
+    if (linkUserFailures.isOver(userKey, linkLimits.userMaxFailures) || linkIpFailures.isOver(ip, linkLimits.ipMaxFailures)) {
+      return "limited";
+    }
+    const code = normalizeUserCode(userCode);
+    const codeHash = code === undefined ? undefined : sha256Hex(code);
+    const row = codeHash === undefined ? undefined : db.prepare(`SELECT host_id AS hostId, host_name AS name, host_os AS os, source_ip AS sourceIp, expires_at AS expiresAt
+               FROM host_link_requests WHERE user_code_hash = ? AND state = 'pending' AND expires_at > ?`).get(codeHash, now());
+    if (codeHash === undefined || row === undefined) {
+      linkUserFailures.bump(userKey, linkLimits.failureWindowMs);
+      linkIpFailures.bump(ip, linkLimits.failureWindowMs);
+      return "not_found";
+    }
+    return { codeHash, row };
+  };
+  const settleHostLink = (args, state) => {
+    const found = pendingByCode(args.userId, args.userCode, args.ip);
+    if (found === "limited" || found === "not_found")
+      return { status: found };
+    const settled = db.prepare(`UPDATE host_link_requests SET state = ?, user_id = ?, host_name = NULL, host_os = NULL, source_ip = NULL
+         WHERE user_code_hash = ? AND state = 'pending' AND expires_at > ?`).run(state, state === "confirmed" ? args.userId : null, found.codeHash, now());
+    return Number(settled.changes) === 1 ? { status: "ok" } : { status: "not_found" };
+  };
   const deviceForSignIn = (userId, claim) => {
     const at = now();
     if (claim === undefined) {
@@ -411,6 +507,19 @@ async function openAccounts(options) {
   const sweepVouchings = () => {
     db.prepare("DELETE FROM vouchings WHERE public_key IS NULL AND expires_at <= ?").run(now() - ADMISSION_REPORT_GRACE_MS);
   };
+  const withdrawDevice = (deviceId) => {
+    const at = now();
+    sweepVouchings();
+    db.prepare("DELETE FROM sessions WHERE device_id = ?").run(deviceId);
+    db.prepare("DELETE FROM push_tokens WHERE device_id = ?").run(deviceId);
+    db.prepare("UPDATE account_devices SET kicked_at = ? WHERE id = ?").run(at, deviceId);
+    const hostIds = db.prepare("SELECT DISTINCT host_id AS hostId FROM vouchings WHERE device_id = ? AND public_key IS NOT NULL AND revoked_at IS NULL").all(deviceId).map((row) => row.hostId);
+    db.prepare(`INSERT OR IGNORE INTO pending_revocations (host_id, public_key, created_at)
+       SELECT host_id, public_key, ? FROM vouchings
+       WHERE device_id = ? AND public_key IS NOT NULL AND revoked_at IS NULL`).run(at, deviceId);
+    db.prepare("UPDATE vouchings SET revoked_at = ? WHERE device_id = ? AND revoked_at IS NULL").run(at, deviceId);
+    return hostIds;
+  };
   const currentHash = (userId) => db.prepare("SELECT password_hash AS passwordHash FROM users WHERE id = ?").get(userId)?.passwordHash;
   const checkPassword = async (userId, username, password) => {
     if (userFailures.isOver(username, limits.userMaxFailures))
@@ -549,8 +658,23 @@ async function openAccounts(options) {
         ...row.deviceId === null ? {} : { deviceId: row.deviceId }
       };
     },
-    logout(token) {
-      db.prepare("DELETE FROM sessions WHERE token_hash = ?").run(sha256Hex(token));
+    logout(token, options2) {
+      const tokenHash = sha256Hex(token);
+      if (options2?.revoke !== true) {
+        db.prepare("DELETE FROM sessions WHERE token_hash = ?").run(tokenHash);
+        return [];
+      }
+      db.exec("BEGIN IMMEDIATE");
+      try {
+        const session = db.prepare("SELECT device_id AS deviceId FROM sessions WHERE token_hash = ?").get(tokenHash);
+        db.prepare("DELETE FROM sessions WHERE token_hash = ?").run(tokenHash);
+        const hostIds = session?.deviceId == null ? [] : withdrawDevice(session.deviceId);
+        db.exec("COMMIT");
+        return hostIds;
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
     },
     async changePassword({ userId, username, keepToken, currentPassword, newPassword }) {
       const length = [...newPassword].length;
@@ -622,13 +746,14 @@ async function openAccounts(options) {
       const row = db.prepare("SELECT user_id AS userId FROM hosts WHERE host_id = ?").get(hostId);
       return row?.userId;
     },
-    registerPushToken(userId, token, environment) {
+    registerPushToken(userId, token, environment, deviceId) {
       const at = now();
       db.exec("BEGIN");
       try {
         db.prepare("DELETE FROM push_tokens WHERE updated_at < ?").run(at - PUSH_TOKEN_TTL_MS);
-        db.prepare(`INSERT INTO push_tokens (token, environment, user_id, updated_at) VALUES (?, ?, ?, ?)
-           ON CONFLICT (token, environment) DO UPDATE SET user_id = excluded.user_id, updated_at = excluded.updated_at`).run(token.toLowerCase(), environment, userId, at);
+        db.prepare(`INSERT INTO push_tokens (token, environment, user_id, updated_at, device_id) VALUES (?, ?, ?, ?, ?)
+           ON CONFLICT (token, environment) DO UPDATE SET
+             user_id = excluded.user_id, updated_at = excluded.updated_at, device_id = excluded.device_id`).run(token.toLowerCase(), environment, userId, at, deviceId ?? null);
         db.prepare(`DELETE FROM push_tokens WHERE user_id = ? AND rowid NOT IN (
              SELECT rowid FROM push_tokens WHERE user_id = ? ORDER BY updated_at DESC LIMIT ?
            )`).run(userId, userId, MAX_PUSH_TOKENS_PER_USER);
@@ -649,22 +774,96 @@ async function openAccounts(options) {
       db.prepare("DELETE FROM push_tokens WHERE token = ? AND environment = ? AND updated_at < ?").run(token.toLowerCase(), environment, unregisteredAt);
     },
     createJoinToken(userId) {
-      db.prepare("DELETE FROM join_tokens WHERE expires_at <= ?").run(now());
-      const token = randomBytes(32).toString("base64url");
-      const expiresAt = now() + JOIN_TOKEN_TTL_MS;
-      db.prepare("INSERT INTO join_tokens (token_hash, user_id, created_at, expires_at) VALUES (?, ?, ?, ?)").run(sha256Hex(token), userId, now(), expiresAt);
-      return { token, expiresAt };
+      sweepExpired();
+      return mintJoinToken(userId, null);
+    },
+    startHostLink({ hostId, name, os, ip }) {
+      if (linkStarts.hit(ip, linkLimits.startMaxPerIp, linkLimits.startWindowMs))
+        return { status: "limited" };
+      sweepExpired();
+      const live = db.prepare("SELECT COUNT(*) AS n FROM host_link_requests").get().n;
+      if (live >= linkLimits.maxPending)
+        return { status: "busy" };
+      const deviceCode = randomBytes(32).toString("base64url");
+      const at = now();
+      const expiresAt = at + HOST_LINK_TTL_MS;
+      const insert = db.prepare(`INSERT INTO host_link_requests
+           (device_code_hash, user_code_hash, host_id, host_name, host_os, source_ip, interval_s, created_at, expires_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`);
+      for (let attempt = 0;; attempt++) {
+        const code = Array.from({ length: USER_CODE_LENGTH }, () => USER_CODE_ALPHABET[randomInt(USER_CODE_ALPHABET.length)]).join("");
+        try {
+          insert.run(sha256Hex(deviceCode), sha256Hex(code), hostId, normalizeHostName(name), [...os.trim()].slice(0, HOST_OS_MAX_CODEPOINTS).join(""), ip, HOST_LINK_INTERVAL_S, at, expiresAt);
+          return { status: "ok", deviceCode, userCode: formatUserCode(code), expiresAt, interval: HOST_LINK_INTERVAL_S };
+        } catch (error) {
+          if (attempt >= 4 || !String(error).includes("UNIQUE"))
+            throw error;
+        }
+      }
+    },
+    pollHostLink(deviceCode) {
+      const deviceCodeHash = sha256Hex(deviceCode);
+      const at = now();
+      db.exec("BEGIN IMMEDIATE");
+      try {
+        const row = db.prepare(`SELECT host_id AS hostId, state, user_id AS userId, interval_s AS intervalS, last_poll_at AS lastPollAt, expires_at AS expiresAt
+             FROM host_link_requests WHERE device_code_hash = ?`).get(deviceCodeHash);
+        let result;
+        if (row === undefined || row.expiresAt <= at) {
+          db.prepare("DELETE FROM host_link_requests WHERE device_code_hash = ?").run(deviceCodeHash);
+          result = { status: "expired" };
+        } else if (row.lastPollAt !== null && at - row.lastPollAt < row.intervalS * 1000 - POLL_SLACK_MS) {
+          const interval = row.intervalS + SLOW_DOWN_STEP_S;
+          db.prepare("UPDATE host_link_requests SET interval_s = ?, last_poll_at = ? WHERE device_code_hash = ?").run(interval, at, deviceCodeHash);
+          result = { status: "slow_down", interval };
+        } else if (row.state === "pending") {
+          db.prepare("UPDATE host_link_requests SET last_poll_at = ? WHERE device_code_hash = ?").run(at, deviceCodeHash);
+          result = { status: "pending" };
+        } else {
+          db.prepare("DELETE FROM host_link_requests WHERE device_code_hash = ?").run(deviceCodeHash);
+          result = row.state === "confirmed" && row.userId !== null ? { status: "confirmed", ...mintJoinToken(row.userId, row.hostId) } : { status: "denied" };
+        }
+        db.exec("COMMIT");
+        return result;
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
+    },
+    lookupHostLink({ userId, userCode, ip }) {
+      const found = pendingByCode(userId, userCode, ip);
+      if (found === "limited" || found === "not_found")
+        return { status: found };
+      const { row } = found;
+      return {
+        status: "ok",
+        request: {
+          hostId: row.hostId,
+          name: row.name ?? "",
+          os: row.os ?? "",
+          sourceIp: row.sourceIp ?? "",
+          ipDiffers: row.sourceIp !== ip,
+          expiresAt: row.expiresAt
+        }
+      };
     },
+    confirmHostLink(args) {
+      return settleHostLink(args, "confirmed");
+    },
+    denyHostLink(args) {
+      return settleHostLink(args, "denied");
+    },
+    sweepExpired,
     joinHost({ token, hostId, noisePublicKey, name }) {
       const tokenHash = sha256Hex(token);
       const at = now();
       db.exec("BEGIN");
       try {
-        const row = db.prepare("SELECT user_id AS userId, expires_at AS expiresAt, used_at AS usedAt FROM join_tokens WHERE token_hash = ?").get(tokenHash);
+        const row = db.prepare("SELECT user_id AS userId, expires_at AS expiresAt, used_at AS usedAt, host_id AS boundHostId FROM join_tokens WHERE token_hash = ?").get(tokenHash);
         let failure;
-        if (row === undefined || row.usedAt !== null)
+        if (row === undefined || row.usedAt !== null || row.boundHostId !== null && row.boundHostId !== hostId) {
           failure = "invalid_token";
-        else if (row.expiresAt <= at)
+        } else if (row.expiresAt <= at)
           failure = "expired_token";
         else {
           const consumed = db.prepare("UPDATE join_tokens SET used_at = ? WHERE token_hash = ? AND used_at IS NULL").run(at, tokenHash);
@@ -800,15 +999,7 @@ async function openAccounts(options) {
           db.exec("ROLLBACK");
           return { status: "refused", reason: "not_found" };
         }
-        const at = now();
-        sweepVouchings();
-        db.prepare("DELETE FROM sessions WHERE device_id = ?").run(deviceId);
-        db.prepare("UPDATE account_devices SET kicked_at = ? WHERE id = ?").run(at, deviceId);
-        const hostIds = db.prepare("SELECT DISTINCT host_id AS hostId FROM vouchings WHERE device_id = ? AND public_key IS NOT NULL AND revoked_at IS NULL").all(deviceId).map((row) => row.hostId);
-        db.prepare(`INSERT OR IGNORE INTO pending_revocations (host_id, public_key, created_at)
-           SELECT host_id, public_key, ? FROM vouchings
-           WHERE device_id = ? AND public_key IS NOT NULL AND revoked_at IS NULL`).run(at, deviceId);
-        db.prepare("UPDATE vouchings SET revoked_at = ? WHERE device_id = ? AND revoked_at IS NULL").run(at, deviceId);
+        const hostIds = withdrawDevice(deviceId);
         db.exec("COMMIT");
         return { status: "ok", hostIds };
       } catch (error) {
@@ -831,6 +1022,7 @@ function dropCredentials(db, userId, keepTokenHash) {
   else
     db.prepare("DELETE FROM sessions WHERE user_id = ? AND token_hash <> ?").run(userId, keepTokenHash);
   db.prepare("DELETE FROM join_tokens WHERE user_id = ? AND used_at IS NULL").run(userId);
+  db.prepare("DELETE FROM host_link_requests WHERE user_id = ?").run(userId);
   db.prepare("DELETE FROM push_tokens WHERE user_id = ?").run(userId);
 }
 async function resetPassword(options) {
@@ -1229,6 +1421,7 @@ function createRelayLimiter(limits, now = Date.now) {
 
 // apps/server/src/api.ts
 var SESSION_COOKIE = "__Host-pinomad-session";
+var HOST_ID_PATTERN = /^[A-Za-z0-9_-]{43}$/;
 var MAX_BODY = 8 * 1024;
 var MUTATING = new Set(["POST", "PUT", "PATCH", "DELETE"]);
 var DESKTOP_ORIGIN = "app://pinomad";
@@ -1254,7 +1447,7 @@ function respond(response, status, body, headers) {
   response.writeHead(status, all);
   response.end(body === undefined ? undefined : JSON.stringify(body));
 }
-async function readJson(request) {
+async function readJson(request, optional = false) {
   const chunks = [];
   let size = 0;
   let tooLarge = false;
@@ -1268,6 +1461,8 @@ async function readJson(request) {
   }
   if (tooLarge)
     return { ok: false, tooLarge: true };
+  if (optional && size === 0)
+    return { ok: true, value: undefined };
   try {
     return { ok: true, value: JSON.parse(Buffer.concat(chunks).toString("utf8")) };
   } catch {
@@ -1317,7 +1512,8 @@ async function handleApiRequest(request, response, ctx) {
   }
   const bearer = (request.headers.authorization ?? "").startsWith("Bearer ");
   const loginTokenMode = (pathname === "/api/login" || pathname === "/api/register") && (origin === undefined || origin === DESKTOP_ORIGIN);
-  if (MUTATING.has(method) && !bearer && !loginTokenMode && origin !== ctx.publicOrigin) {
+  const hostLinkHostMode = (pathname === "/api/host-link/start" || pathname === "/api/host-link/poll") && origin === undefined;
+  if (MUTATING.has(method) && !bearer && !loginTokenMode && !hostLinkHostMode && origin !== ctx.publicOrigin) {
     deny(403, "origin_mismatch");
     return;
   }
@@ -1397,6 +1593,110 @@ async function handleApiRequest(request, response, ctx) {
     send(200, { user: { username }, expiresAt: result.expiresAt, ...cookieMode ? {} : { token: result.token } }, cookieMode ? { "set-cookie": setSessionCookie(result.token) } : undefined);
     return;
   }
+  if (pathname === "/api/host-link/start" || pathname === "/api/host-link/poll") {
+    if (method !== "POST") {
+      deny(405, "method_not_allowed", { allow: "POST" });
+      return;
+    }
+    const body = await readJson(request);
+    if (!body.ok) {
+      deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+      return;
+    }
+    if (pathname === "/api/host-link/start") {
+      const value = body.value;
+      if (typeof value?.hostId !== "string" || !HOST_ID_PATTERN.test(value.hostId) || typeof value.name !== "string" || typeof value.os !== "string") {
+        deny(400, "invalid_request");
+        return;
+      }
+      const result2 = accounts.startHostLink({
+        hostId: value.hostId,
+        name: value.name,
+        os: value.os,
+        ip: clientIp(request, ctx.trustProxy)
+      });
+      if (result2.status === "limited") {
+        deny(429, "rate_limited");
+        return;
+      }
+      if (result2.status === "busy") {
+        deny(503, "busy");
+        return;
+      }
+      send(200, {
+        deviceCode: result2.deviceCode,
+        userCode: result2.userCode,
+        verifyUrl: `${ctx.publicOrigin}/host-link`,
+        interval: result2.interval,
+        expiresAt: result2.expiresAt
+      });
+      return;
+    }
+    const deviceCode = body.value?.deviceCode;
+    if (typeof deviceCode !== "string" || deviceCode.length > 256) {
+      deny(400, "invalid_request");
+      return;
+    }
+    const result = accounts.pollHostLink(deviceCode);
+    switch (result.status) {
+      case "confirmed":
+        send(200, { token: result.token, expiresAt: result.expiresAt });
+        return;
+      case "pending":
+        deny(400, "authorization_pending");
+        return;
+      case "slow_down":
+        send(400, { error: "slow_down", interval: result.interval });
+        return;
+      case "denied":
+        deny(400, "access_denied");
+        return;
+      case "expired":
+        deny(400, "expired_token");
+        return;
+    }
+  }
+  if (pathname === "/api/host-link/lookup" || pathname === "/api/host-link/confirm" || pathname === "/api/host-link/deny") {
+    if (method !== "POST") {
+      deny(405, "method_not_allowed", { allow: "POST" });
+      return;
+    }
+    const token = sessionToken(request);
+    if (token === undefined || accounts.authenticate(token) === undefined) {
+      deny(401, "unauthenticated");
+      return;
+    }
+    const body = await readJson(request);
+    if (!body.ok) {
+      deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+      return;
+    }
+    const userCode = body.value?.userCode;
+    if (typeof userCode !== "string" || userCode.length > 64) {
+      deny(400, "invalid_request");
+      return;
+    }
+    const session = accounts.authenticate(token);
+    if (session === undefined) {
+      deny(401, "unauthenticated");
+      return;
+    }
+    const args = { userId: session.userId, userCode, ip: clientIp(request, ctx.trustProxy) };
+    const result = pathname === "/api/host-link/lookup" ? accounts.lookupHostLink(args) : pathname === "/api/host-link/confirm" ? accounts.confirmHostLink(args) : accounts.denyHostLink(args);
+    if (result.status === "limited") {
+      deny(429, "rate_limited");
+      return;
+    }
+    if (result.status === "not_found") {
+      deny(404, "not_found");
+      return;
+    }
+    if ("request" in result)
+      send(200, result.request);
+    else
+      send(204);
+    return;
+  }
   if (pathname === "/api/invites" || pathname === "/api/invites/revoke") {
     const allowed = pathname === "/api/invites" ? ["GET", "POST"] : ["POST"];
     if (!allowed.includes(method)) {
@@ -1598,12 +1898,13 @@ async function handleApiRequest(request, response, ctx) {
         deny(400, "invalid_request");
         return;
       }
-      if (accounts.authenticate(token) === undefined) {
+      const current = accounts.authenticate(token);
+      if (current === undefined) {
         deny(401, "unauthenticated");
         return;
       }
       if (pathname === "/api/push-tokens")
-        accounts.registerPushToken(session.userId, apns, environment);
+        accounts.registerPushToken(session.userId, apns, environment, current.deviceId);
       else
         accounts.removePushToken(session.userId, apns, environment);
       send(204);
@@ -1669,12 +1970,24 @@ async function handleApiRequest(request, response, ctx) {
       send(200, {
         token: joinToken.token,
         expiresAt: joinToken.expiresAt,
-        command: `npm i -g pinomad && pinomad join ${ctx.publicOrigin} ${joinToken.token}`
+        command: `curl -fsSL https://pinomad.si/install.sh | sh -s -- join ${ctx.publicOrigin} ${joinToken.token}`
       });
       return;
     }
     if (pathname === "/api/logout") {
-      accounts.logout(token);
+      const body = await readJson(request, true);
+      if (!body.ok) {
+        deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+        return;
+      }
+      const value = body.value;
+      const revoke = typeof value === "object" && value !== null ? value.revoke : undefined;
+      if (value === null || value !== undefined && typeof value !== "object" || revoke !== undefined && typeof revoke !== "boolean") {
+        deny(400, "invalid_request");
+        return;
+      }
+      for (const hostId of accounts.logout(token, { revoke: revoke === true }))
+        ctx.sendRevocations(hostId);
       send(204, undefined, { "set-cookie": clearSessionCookie });
       return;
     }
@@ -2192,6 +2505,9 @@ async function startRelay(options) {
         socket.terminate();
       }
     }
+    try {
+      accounts?.sweepExpired();
+    } catch {}
   }, pingIntervalMs);
   return {
     port,

package/dist/{chunk-c5p9xkd8.js → chunk-as6pyf00.js}

@@ -1,9 +1,9 @@
-import {
-  packagedVersion
-} from "./chunk-zehwx009.js";
 import {
   hostAddress
 } from "./chunk-ngf1zatm.js";
+import {
+  packagedVersion
+} from "./chunk-sd5fkxjj.js";
 import"./chunk-df32avw6.js";
 
 // apps/host/src/cli/web-link.ts

package/dist/chunk-b457q0tm.js

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+import {
+  readServerConfig
+} from "./chunk-etf7ef97.js";
+import {
+  argValue,
+  reachabilityLine,
+  serviceManager,
+  versionLine
+} from "./chunk-vvj9b1gc.js";
+import"./chunk-jt34g8st.js";
+import"./chunk-kzbzacz9.js";
+import"./chunk-xqycs43g.js";
+import"./chunk-pqe7q1s7.js";
+import {
+  DEFAULT_DATA_DIR
+} from "./chunk-ngf1zatm.js";
+import {
+  commandHint
+} from "./chunk-sd5fkxjj.js";
+import"./chunk-df32avw6.js";
+
+// apps/host/src/cli/status.ts
+import { resolve } from "node:path";
+import { parseArgs } from "node:util";
+async function statusReport(args, deps) {
+  const dataDir = resolve(args.dataDir);
+  const manager = deps?.manager ?? serviceManager();
+  const server = await readServerConfig(dataDir);
+  const service = await manager.state();
+  const spec = service.installed ? await manager.read() : undefined;
+  const own = spec !== undefined && resolve(spec.dataDir) === dataDir;
+  const lanPort = own ? argValue(spec.hostArgs, "--remote-port") : undefined;
+  const port = own ? argValue(spec.hostArgs, "--port") : undefined;
+  return {
+    ...server === undefined ? {} : { server },
+    ...lanPort === undefined ? {} : { lanPort },
+    service,
+    ...port === undefined ? {} : { port },
+    ...spec === undefined || own ? {} : { otherDataDir: spec.dataDir }
+  };
+}
+async function main(argv) {
+  const { values } = parseArgs({ args: [...argv], options: { "data-dir": { type: "string" } } });
+  const dataDir = resolve(values["data-dir"] ?? DEFAULT_DATA_DIR);
+  try {
+    const report = await statusReport({ dataDir });
+    const { server } = report;
+    console.log(server === undefined ? `server: not joined (\`${commandHint("up")}\` to join)` : `server: ${server.username === undefined ? "joined" : server.username} at ${server.origin}`);
+    console.log(`LAN and tailnet: ${report.lanPort === undefined ? "off" : `port ${report.lanPort}`}`);
+    console.log(`service: ${report.service.installed ? report.service.detail : "not installed"}`);
+    if (report.otherDataDir !== undefined)
+      console.log(`note: the installed service runs ${report.otherDataDir}, not ${dataDir}`);
+    console.log(await versionLine());
+    console.log(await reachabilityLine([
+      "--data-dir",
+      dataDir,
+      ...report.port === undefined ? [] : ["--url", `ws://127.0.0.1:${report.port}`]
+    ]));
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  }
+}
+if (false)
+  ;
+export {
+  statusReport,
+  main
+};

package/dist/chunk-etf7ef97.js

@@ -0,0 +1,55 @@
+// apps/host/src/server-config.ts
+import { randomBytes } from "node:crypto";
+import { readFile, rename, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+var SERVER_CONFIG_FILE = "server.json";
+var normalizeOrigin = (origin) => origin.replace(/\/+$/, "");
+async function readServerConfig(dataDir) {
+  let text;
+  try {
+    text = await readFile(join(dataDir, SERVER_CONFIG_FILE), "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return;
+    throw error;
+  }
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    throw new Error(`${join(dataDir, SERVER_CONFIG_FILE)} is not valid JSON — delete it or run \`pinomad leave\``);
+  }
+  const origin = value?.origin;
+  if (typeof origin !== "string" || origin.trim() === "") {
+    throw new Error(`${join(dataDir, SERVER_CONFIG_FILE)} is missing a string "origin"`);
+  }
+  const { binding, username } = value;
+  return {
+    origin,
+    ...typeof binding === "string" && binding !== "" ? { binding } : {},
+    ...typeof username === "string" && username !== "" ? { username } : {}
+  };
+}
+async function writeServerConfig(dataDir, config) {
+  const path = join(dataDir, SERVER_CONFIG_FILE);
+  const tmp = `${path}.tmp-${process.pid}`;
+  await writeFile(tmp, `${JSON.stringify({
+    origin: normalizeOrigin(config.origin),
+    binding: randomBytes(16).toString("base64url"),
+    ...config.username === undefined ? {} : { username: config.username }
+  })}
+`, { mode: 384 });
+  await rename(tmp, path);
+}
+var removeServerConfig = (dataDir) => rm(join(dataDir, SERVER_CONFIG_FILE), { force: true });
+async function readServerBinding(dataDir) {
+  return (await readServerConfig(dataDir))?.binding;
+}
+function resolveRelayOrigin(flag, config) {
+  if (flag !== undefined && config !== undefined && normalizeOrigin(flag) !== normalizeOrigin(config.origin)) {
+    throw new Error(`--relay ${flag} disagrees with ${SERVER_CONFIG_FILE} (${config.origin}) — remove one`);
+  }
+  return flag ?? config?.origin;
+}
+
+export { normalizeOrigin, readServerConfig, writeServerConfig, removeServerConfig, readServerBinding, resolveRelayOrigin };