gitoria

3.3 KB

1. // tokens.hl — ACCESS TOKENS for git over HTTPS (ticket gitoria#7; docs/git-backend.md "Credentials"). A developer's
2. // git client cannot do the ident login, so a logged-in user makes a token here and gives it to git as the PASSWORD
3. // (the user name is ignored). Git's HTTP Basic login is not deprecated by git itself; GitHub's ban on account
4. // passwords is GitHub's. Only the sha256 of a token is stored: the token is shown ONCE, at its creation.
5. // tokensTable pk @id index !hash, user { user (users @id), name, hash, created } storage/mpackdb/tokens.db
6. // A token is `gtr_` + 40 hex characters from the kernel's random source (160 bits — the fast sha256 is enough).
7. import { MPackDB } from 'hl:mpackdb'
8. import { now } from 'hl:time'
9. import { randomBytes, sha256 } from 'hl:crypto'
10. import { storageDir, countOfList, firstOf, plainError, userRecord, isHex } from './users.hl'
11. import { localStamp } from './localtime.hl'
13. static tokensTable = new MPackDB(file = storageDir + '/tokens.db', primaryKey = '@id', indexes = ['!hash', 'user'])
14. static maxTokens = 20
16. static rowOfToken = (t) => { return { id = t.id name = t.name created = localStamp(t.created) createdMs = t.created } }
18. // a user's tokens, newest first (no sort(): hybriel #1) — never the token itself, only what identifies it to the owner
19. static tokenRows = (userId) => {
20. let out = []
21. let all = tokensTable.find('user', userId)
22. if (countOfList(all) == 0) { return out }
23. for (t of all) { out.push(rowOfToken(t)) }
24. let i = 1
25. while (i < out.length) {
26. let cur = out[i]
27. let j = i - 1
28. while (j >= 0 && out[j].createdMs < cur.createdMs) {
29. out[j + 1] = out[j]
30. j = j - 1
31. }
32. out[j + 1] = cur
33. i = i + 1
34. }
35. return out
36. }
38. // a new token: { token (the secret, this once), row } or { error }
39. static createToken = (userId, name) => {
40. let u = userRecord(userId)
41. if (u == null) { return { error = 'log in with ident (top right) first' } }
42. let n = name == null ? '' : ('' + name).trim()
43. let bad = plainError(n, 60, 'the token name')
44. if (bad != null) { return { error = bad } }
45. if (n == '') { return { error = 'give the token a name (for example the computer it is for)' } }
46. if (countOfList(tokensTable.find('user', u.id)) >= maxTokens) { return { error = 'you have ' + maxTokens + ' tokens already — remove one first' } }
47. let secret = 'gtr_' + randomBytes(20, 'hex')
48. let id = tokensTable.put({ user = u.id name = n hash = sha256(secret) created = now() })
49. if (id == null) { return { error = 'could not store the token: ' + tokensTable.lastError() } }
50. return { token = secret row = rowOfToken(tokensTable.fetch(id)) }
51. }
53. // remove one of the user's own tokens
54. static revokeToken = (userId, tokenId) => {
55. if (userId == null || tokenId == null || hlTypeName(tokenId) != 'String') { return { error = 'no such token' } }
56. let t = tokensTable.fetch(tokenId)
57. if (t == null || t.user != userId) { return { error = 'no such token' } }
58. tokensTable.delete(tokenId)
59. return { ok = true }
60. }
62. // the user a token belongs to (users @id) or null; anything that is not shaped like a token is null without a lookup
63. static userOfToken = (secret) => {
64. if (secret == null || hlTypeName(secret) != 'String' || secret.length != 44 || !secret.startsWith('gtr_') || !isHex(secret.slice(4), 40)) { return null }
65. let t = firstOf(tokensTable.find('hash', sha256(secret)))
66. return t == null ? null : t.user
67. }