tracker

5.4 KB

1. // project.hl — tracker.worldapi.org: STEP 1 (tracker.worldapi.org#1), an empty shell. Login copied unchanged from
2. // calendar.worldapi.org (rejected once for a centered sign-in and no header selector — architect, 2026-09-27):
3. // ident only, no own passwords (README "How apps use ident" of ident.worldapi.org), the identity selector in the
4. // header (components/main.hl). No shows, no data yet — later steps come from the creator (CONCEPT.md).
5. //
6. // the header's ident-selector / "Log in with ident" -> <ident>/login?key=&return=<this app>/login/callback
7. // /login/callback?ident_code=<code> the app's server exchanges the code for the identity's short id
8. // (POST <ident>/api/exchange) and signs this app's OWN session in
9. // (session.user = { id = <users @id> }, users.hl)
10. // the header's "Log out" button signs this app's session out via the face trackerLogOut (components/main.hl)
11. // — ident's own session, and the browser's ident cookie, are untouched
12. //
13. // Config (env; no committed secret — the first deploy registers this app in ident and sets these, done by the
14. // architect, as with ident's own .env for SMTP):
15. // TRACKER_PORT (45008), TRACKER_URL (this app's own public address, for the return URL),
16. // IDENT_URL (https://ident.worldapi.org), TRACKER_KEY (pk_…), TRACKER_SECRET (sk_…)
17. import WebFramework from 'hl:web'
18. import { Response } from 'hl:http1'
19. import { randomBytes } from 'hl:crypto'
20. import { env } from 'hl:proc'
22. import Styles from './styles.hl'
23. import { exchangeCode, ensureUser } from './users.hl'
24. import Home from './components/home.hl'
25. import LoginFailed from './components/loginfailed.hl'
27. static appTitle = "tracker"
29. styles = Styles
31. port = env('TRACKER_PORT') != null ? toNumber(env('TRACKER_PORT')) : 45008
32. watching = env('TRACKER_WATCH') != '0'
33. // read by hl:web's own manifest config (WebFramework.hl `cfg.sessionDir`), not the constructor call below
34. sessionDir = env('TRACKER_SESSIONS') != null ? env('TRACKER_SESSIONS') : null
36. // ---- THE LOGIN BUTTON'S RETURN (ident README "How apps use ident"), copied from calendar.worldapi.org's project.hl
37. // BACK TO THE PAGE: /login.js puts `?next=` into the button's return URL at the click. Only a same-origin PATH
38. // goes (one `/`, URL-safe characters, ≤ 500). Anything else → `/`.
39. nextChars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~/?&=%+,;@!$()*:'
40. safePath = (want) => {
41. if (want == null || hlTypeName(want) != 'String' || want == '' || want.length > 500) { return '/' }
42. if (want.slice(0, 1) != '/' || want.slice(0, 2) == '//' || want.slice(0, 7) == '/login/') { return '/' }
43. let i = 0
44. while (i < want.length) {
45. if (!nextChars.includes(want[i])) { return '/' }
46. i = i + 1
47. }
48. return want
49. }
51. // A FAILED LOGIN is a page (components/loginfailed.hl): the reason is parked in the session, then → /login/failed
52. failed = (req, why) => {
53. let s = req.session
54. let fresh = s == null
55. if (fresh) { s = server.sessions.mint() }
56. s.data.loginError = why
57. server.sessions.save(s)
58. let res = new Response('login failed: ' + why, { status = 302 headers = { 'Location' = '/login/failed' 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
59. if (fresh) { res.headers['Set-Cookie'] = server.sessions.cookieHeader(s.id) }
60. return res
61. }
63. // the function route gets the cookie's session as req.session (hybriel #11); none yet → minted here
64. loginCallback = (route, req) => {
65. if (req.method != 'GET') { return failed(req, 'GET only') }
66. let q = req.query != null ? req.query : {}
67. let code = q.ident_code
68. if (code == null || code == '') { return failed(req, 'ident sent no login code') }
69. let x = exchangeCode(code)
70. if (x.error != null) { return failed(req, x.error) }
71. let u = ensureUser(x.identity)
72. if (u == null) { return failed(req, 'could not store the user') }
73. let s = req.session
74. let fresh = s == null
75. if (fresh) { s = server.sessions.mint() }
76. s.user = { id = u.id }
77. s.data.tag = randomBytes(16)
78. s.data.loginError = null
79. server.sessions.save(s)
80. let res = new Response('logged in', { status = 302 headers = { 'Location' = safePath(q.next) 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
81. if (fresh) { res.headers['Set-Cookie'] = server.sessions.cookieHeader(s.id) }
82. return res
83. }
85. routes = [
86. { pattern = "/favicon.ico" direct = "" }
87. { pattern = "/login/callback" function = loginCallback }
88. { pattern = "/login/failed" component = LoginFailed }
89. { pattern = "/login.js" file = "./login.js" headers = { 'Cache-Control' = 'no-cache' } }
90. { pattern = "/" component = Home }
91. ]
93. // WHO GETS THE PUSH: the login state reaches the tabs of one session (components/main.hl trackerSignedIn/Out).
94. tagOf = (session) => { return session != null && session.data != null ? session.data.tag : null }
95. audience = {
96. trackerSignedIn = (tag, session) => { return tag != null && tagOf(session) == tag }
97. trackerSignedOut = (tag, session) => { return tag != null && tagOf(session) == tag }
98. }
100. // cookies are per host, not per port: an own name keeps this app's session apart from
101. // ident's own (and from any other worldapi app sharing a dev host), see ident README "Design
102. // tokens" / hybriel#10 hybriel#17.
103. sessionCookie = 'trackersid'
104. server = new WebFramework(routes = routes, styles = styles, port = port, sessionCookie = sessionCookie, watchMode = watching)
106. on Error(e) { console.log('error absorbed: ' + e.message) }