tracker

4.9 KB

1. // users.hl — WHO IS SIGNED IN (tracker.worldapi.org#1; copied from calendar.worldapi.org's users.hl unchanged in
2. // shape, per the architect: "Copy calendar.worldapi.org's login unchanged"). Login is ident's LOGIN BUTTON flow
3. // (ident README "How apps use ident", way 2): <ident>/login?key=&return=<public url>/login/callback → ?ident_code=
4. // → the server exchanges it (key + secret) for the per-app identity id. Way 3, the IDENTITY SELECTOR, sits beside the
5. // button (login.js hands its code to the shell).
6. //
7. // usersTable pk @id index !identity { identity, created } storage/mpackdb/users.db
8. // identity = what ident's exchange answers: the identity's public SHORT id (ident#23, `a68sz`) — stays SERVER
9. // SIDE, never sent to a page.
10. // The session (hl:web) carries `user = { id = <users @id> }` only. No display name: nothing else is stored.
11. //
12. // Config (environment, or `.env` beside project.hl — never read or printed by workers):
13. // IDENT_URL, IDENT_EXCHANGE_URL, TRACKER_KEY, TRACKER_SECRET as calendar's IDENT_API_KEY/IDENT_API_SECRET
14. // TRACKER_URL the app's own address, default https://tracker.worldapi.org
15. // TRACKER_STORAGE table directory, default ./storage/mpackdb
16. import { MPackDB } from 'hl:mpackdb'
17. import { now } from 'hl:time'
18. import { fetch } from 'hl:fetch'
19. import { envOr, storageDir, firstOf } from './util.hl'
21. static identUrl = envOr('IDENT_URL', 'https://ident.worldapi.org')
22. static identExchangeUrl = envOr('IDENT_EXCHANGE_URL', identUrl)
23. static identKey = envOr('TRACKER_KEY', '')
24. static identSecret = envOr('TRACKER_SECRET', '')
25. static publicUrl = envOr('TRACKER_URL', 'https://tracker.worldapi.org')
27. static usersTable = new MPackDB(file = storageDir + '/users.db', primaryKey = '@id', indexes = ['!identity'])
29. static selectorScript = identUrl + '/selector.js'
30. static callbackUrl = publicUrl.replaceAll('/', '') == '' ? '' : publicUrl + '/login/callback'
31. static loginHref = identUrl + '/login?key=' + identKey + '&return=' + encodeURIComponent(callbackUrl)
33. // only lowercase hex (ident's one-time codes are 48 hex)
34. static isHex = (&s, &max) => {
35. if (s == null || hlTypeName(s) != 'String' || s.length == 0 || s.length > max) { return false }
36. let i = 0
37. while (i < s.length) {
38. let c = s.charCodeAt(i)
39. if (!((c >= 48 && c <= 57) || (c >= 97 && c <= 102))) { return false }
40. i = i + 1
41. }
42. return true
43. }
45. // an identity id as ident answers it: its public SHORT ID since ident#23 (5 characters like `a68sz`: 2-9 and a-z),
46. // before that the old per-app id (32 hex) — lower case letters and digits, at most 64
47. static isIdentId = (&s) => {
48. if (s == null || hlTypeName(s) != 'String' || s.length == 0 || s.length > 64) { return false }
49. let i = 0
50. while (i < s.length) {
51. let c = s.charCodeAt(i)
52. if (!((c >= 48 && c <= 57) || (c >= 97 && c <= 122))) { return false }
53. i = i + 1
54. }
55. return true
56. }
58. // THE EXCHANGE: POST <ident>/api/exchange { key, secret, code } → { identity } | { error }
59. // (a failed fetch is an `Error` event, absorbed by project.hl's `on Error`; the fetch then yields null)
60. static exchangeCode = (code) => {
61. if (identKey == '' || identSecret == '') { return { error = 'login is not set up on this server (TRACKER_KEY / TRACKER_SECRET missing)' } }
62. if (!isHex(code, 200)) { return { error = 'that is not an ident login code' } }
63. let r = fetch(identExchangeUrl + '/api/exchange', { method = 'POST' json = { key = identKey secret = identSecret code = code } headers = { 'user-agent' = 'tracker.worldapi.org (ident exchange)' } timeoutMs = 10000 })
64. if (r == null || r.status == null || r.status == 0) { return { error = 'ident did not answer' } }
65. let j = r.status == 200 ? r.json() : null
66. if (j == null || j.identity == null || !isIdentId(j.identity)) {
67. let why = ''
68. if (r.status != 200) {
69. let e = r.json()
70. why = e != null && e.error != null ? ': ' + e.error : ''
71. }
72. return { error = 'ident refused the login (' + r.status + why + ')' }
73. }
74. return { identity = j.identity }
75. }
77. // ---- users --------------------------------------------------------------------------------
78. // a face's trailing `session` is always the server's since hybriel #16 (a peer's extra argument is refused)
80. static userRecord = (&userId) => {
81. if (userId == null || hlTypeName(userId) != 'String' || userId == '') { return null }
82. return usersTable.fetch(userId)
83. }
85. // the user of an identity id, made at its first login
86. static ensureUser = (identity) => {
87. let u = firstOf(usersTable.find('identity', identity))
88. if (u != null) { return u }
89. let id = usersTable.put({ identity = identity created = now() })
90. if (id == null) { return null }
91. return usersTable.fetch(id)
92. }
94. static userOfSession = (&session) => {
95. if (session == null || session.user == null) { return null }
96. return userRecord(session.user.id)
97. }
99. // the users @id of a session, or null (a page may know it: it is not the identity id)
100. static userIdOfSession = (&session) => {
101. let u = userOfSession(session)
102. return u == null ? null : u.id
103. }