tracker

5.2 KB

1. // users.hl — WHO IS SIGNED IN (tracker.worldapi.org#1; copied from calendar.worldapi.org's users.hl unchanged in
2. // shape, per the architect: "Copy calendar.worldapi.org's login unchanged"). Login is ident's LOGIN BUTTON flow
3. // (ident README "How apps use ident", way 2): <ident>/login?key=&return=<public url>/login/callback → ?ident_code=
4. // → the server exchanges it (key + secret) for the per-app identity id. Way 3, the IDENTITY SELECTOR, sits beside the
5. // button (login.js hands its code to the shell).
6. //
7. // usersTable pk @id index !identity { identity, created } storage/mpackdb/users.db
8. // identity = what ident's exchange answers: the identity's public SHORT id (ident#23, `a68sz`) — stays SERVER
9. // SIDE, never sent to a page.
10. // The session (hl:web) carries `user = { id = <users @id> }` only. No display name: nothing else is stored.
11. //
12. // Config (environment, or `.env` beside project.hl — never read or printed by workers):
13. // IDENT_URL, IDENT_EXCHANGE_URL, TRACKER_KEY, TRACKER_SECRET as calendar's IDENT_API_KEY/IDENT_API_SECRET
14. // TRACKER_URL the app's own address, default https://tracker.worldapi.org
15. // TRACKER_STORAGE table directory, default ./storage/mpackdb
16. import { MPackDB } from 'hl:mpackdb'
17. import { env } from 'hl:proc'
18. import { now } from 'hl:time'
19. import { fetch } from 'hl:fetch'
21. static envOr = (name, fallback) => {
22. let v = env(name)
23. return v != null && v.trim() != '' ? v.trim() : fallback
24. }
26. static identUrl = envOr('IDENT_URL', 'https://ident.worldapi.org')
27. static identExchangeUrl = envOr('IDENT_EXCHANGE_URL', identUrl)
28. static identKey = envOr('TRACKER_KEY', '')
29. static identSecret = envOr('TRACKER_SECRET', '')
30. static publicUrl = envOr('TRACKER_URL', 'https://tracker.worldapi.org')
32. static storageDir = envOr('TRACKER_STORAGE', './storage/mpackdb')
33. static usersTable = new MPackDB(file = storageDir + '/users.db', primaryKey = '@id', indexes = ['!identity'])
35. static countOfList = (list) => {
36. if (list == null) { return 0 }
37. let n = list.length
38. return n == null ? 0 : n
39. }
40. static firstOf = (list) => { return countOfList(list) > 0 ? list[0] : null }
42. static selectorScript = identUrl + '/selector.js'
43. static callbackUrl = publicUrl.replaceAll('/', '') == '' ? '' : publicUrl + '/login/callback'
44. static loginHref = identUrl + '/login?key=' + identKey + '&return=' + encodeURIComponent(callbackUrl)
46. // only lowercase hex (ident's one-time codes are 48 hex)
47. static isHex = (s, max) => {
48. if (s == null || hlTypeName(s) != 'String' || s.length == 0 || s.length > max) { return false }
49. let i = 0
50. while (i < s.length) {
51. let c = s.charCodeAt(i)
52. if (!((c >= 48 && c <= 57) || (c >= 97 && c <= 102))) { return false }
53. i = i + 1
54. }
55. return true
56. }
58. // an identity id as ident answers it: its public SHORT ID since ident#23 (5 characters like `a68sz`: 2-9 and a-z),
59. // before that the old per-app id (32 hex) — lower case letters and digits, at most 64
60. static isIdentId = (s) => {
61. if (s == null || hlTypeName(s) != 'String' || s.length == 0 || s.length > 64) { return false }
62. let i = 0
63. while (i < s.length) {
64. let c = s.charCodeAt(i)
65. if (!((c >= 48 && c <= 57) || (c >= 97 && c <= 122))) { return false }
66. i = i + 1
67. }
68. return true
69. }
71. // THE EXCHANGE: POST <ident>/api/exchange { key, secret, code } → { identity } | { error }
72. // (a failed fetch is an `Error` event, absorbed by project.hl's `on Error`; the fetch then yields null)
73. static exchangeCode = (code) => {
74. if (identKey == '' || identSecret == '') { return { error = 'login is not set up on this server (TRACKER_KEY / TRACKER_SECRET missing)' } }
75. if (!isHex(code, 200)) { return { error = 'that is not an ident login code' } }
76. let r = fetch(identExchangeUrl + '/api/exchange', { method = 'POST' json = { key = identKey secret = identSecret code = code } headers = { 'user-agent' = 'tracker.worldapi.org (ident exchange)' } timeoutMs = 10000 })
77. if (r == null || r.status == null || r.status == 0) { return { error = 'ident did not answer' } }
78. let j = r.status == 200 ? r.json() : null
79. if (j == null || j.identity == null || !isIdentId(j.identity)) {
80. let why = ''
81. if (r.status != 200) {
82. let e = r.json()
83. why = e != null && e.error != null ? ': ' + e.error : ''
84. }
85. return { error = 'ident refused the login (' + r.status + why + ')' }
86. }
87. return { identity = j.identity }
88. }
90. // ---- users --------------------------------------------------------------------------------
91. // a face's trailing `session` is always the server's since hybriel #16 (a peer's extra argument is refused)
93. static userRecord = (userId) => {
94. if (userId == null || hlTypeName(userId) != 'String' || userId == '') { return null }
95. return usersTable.fetch(userId)
96. }
98. // the user of an identity id, made at its first login
99. static ensureUser = (identity) => {
100. let u = firstOf(usersTable.find('identity', identity))
101. if (u != null) { return u }
102. let id = usersTable.put({ identity = identity created = now() })
103. if (id == null) { return null }
104. return usersTable.fetch(id)
105. }
107. static userOfSession = (session) => {
108. if (session == null || session.user == null) { return null }
109. return userRecord(session.user.id)
110. }
112. // the users @id of a session, or null (a page may know it: it is not the identity id)
113. static userIdOfSession = (session) => {
114. let u = userOfSession(session)
115. return u == null ? null : u.id
116. }