9b80001 · 99cd46f
@@ -193,7 +193,7 @@
bytes in `tools/list`. After changing a tool run `bun scripts/mcp-table.ts`;
| `sessions` | `list`, `end`, `end_idle`, `signins`, `shells` | Where you are signed in: your tokens and browsers, never a secret; `username` for a person as owner; action end + id signs a browser out | 385 |
| `sever` | — | Unlink a spawned forge from its parent (owner of its `forge` repo only) | 214 |
| `share` | — | Share a feed item: no `to` tells the app's crew and owners, else followers; budgeted | 258 |
| `signup` | — | Sign-ups: open (default); invite lets in only a person with an open invite link; closed refuses every new account | 281 |
| `signup` | — | Sign-ups: open (default); invite lets in only a person with an open invite link; closed refuses every new account | 291 |
| `sizes` | — | A child forge's sizes: small, medium and large, each with CPU, memory and disk | 196 |
| `snapshot_now` | — | Take a snapshot now, as Backups does (admin) | 133 |
| `spawn` | — | Spawn a child forge | 824 |
@@ -130,6 +130,8 @@
Machine routes are not pages and have no entry: `/audit.csv`,
- `/login` — `http/server.ts` (`signinAlias`) · the address people type to sign in · it is `/signin`, keeping a same-origin `next` · none (308, no page of its own).
- `/sign-in` — `http/server.ts` (`signinAlias`) · the same, hyphenated · it is `/signin` · none (308, no page of its own).
- `/signup` — `pages/site.ts` · make an account · `/signup` passkey flow (`signup-passkey.ts`) · colours 3 (file).
- `/signup/requested` — `pages/site.ts` · tells a stranger the request is sent · `/signin` · colours 3 (file).
- `/signup/welcome` — `pages/site.ts` · tells a person their request was allowed · `/` · colours 3 (file).
- `/verify` — `pages/site.ts` · confirm an email address · none · colours 3 (file).
- `/recover` — `pages/passkeys.ts` · get back in without a password · `/settings/passkeys` · none seen.
- `/settings` — `pages/account.ts` · my account · the rest of settings · colour 1.
@@ -0,0 +1,11 @@
# Request access
One setting, **New accounts**, on `/admin/limits`: `open` (anyone, at once), `request` (anyone may ask; an admin allows), `invite` (invite links only), `closed` (nobody, invite links included). Invite links work in every mode except `closed`. A forge that stored `closed` when this shipped now stores `request` (a migration, kept in the setting's history); a new forge still starts at `invite`.
**A stranger** opens `/signup` and gives a name, a password or passkey, and an optional "What do you want to build?". The account is made *waiting*: it is held suspended, so no session, token or key works. They land on "Your request is in…". Signing in later with the right password says where the request stands (in, or declined, politely) and makes no session. After Allow, the first sign-in says "You're in." once.
**By API:** `POST /api/v1/users` with `username`, `password`, optional `note` and `from` (which forge or agent asks) answers `202 {"state":"waiting"}`.
**The admin** sees "Waiting" (name, note, when, from where) with Allow and Decline on home ("Needs you") and at the top of `/settings/people`, and gets a line on the phone through the notify URL when someone asks. Decline keeps the record. A second tap on an answered request changes nothing.
Not done here: new-account quotas for `open`, and the agent start call landing as a request (#10912 is not in the code yet).
@@ -12,6 +12,7 @@
import type { Database } from "bun:sqlite";
import type { App } from "../app.ts";
import { waitingRequests } from "../core/account_requests.ts";
import { getAppByRepo } from "../core/apps.ts";
import { listTeams, retireOrg, soleOwnedOrgs } from "../core/orgs.ts";
import { appsRuntime } from "../apps/runtime.ts";
@@ -314,6 +315,22 @@
export function verifyAccount(
  return ok(user);
}
/**
 * One line per person waiting for an account (#10928), for an admin's phone.
 * The line names no one's note; Allow and Decline are on home and on the
 * people page, one tap from the link.
 */
export function requestLines(
  db: Database,
  user: User,
): { id: string; line: string; items: readonly string[] }[] {
  if (!user.isAdmin || user.kind !== "user") return [];
  return waitingRequests(db).map((r) => {
    const id = `request:${r.username}`;
    return { id, line: `${r.username} asked for an account: Allow or Decline`, items: [id] };
  });
}
/** An account counts as new for this long after it is made. */
export const NEW_FOR_MS = 7 * 24 * 3_600_000;
@@ -329,9 +346,11 @@
export function newAccountLines(
): { id: string; line: string; items: readonly string[] }[] {
  if (!user.isAdmin || user.kind !== "user") return [];
  const since = new Date(now - NEW_FOR_MS).toISOString();
  const asking = new Set(waitingRequests(db).map((r) => r.username));
  return readAccounts(db)
    .filter(
      (a) =>
        !asking.has(a.username) &&
        a.kind === "user" &&
        !a.isAdmin &&
        a.removedAt === null &&
@@ -0,0 +1,77 @@
/**
 * Requests for an account (#10928): an admin who is a person sees who is
 * waiting, and allows or declines each. Anyone else is told `not_found`,
 * like every admin surface. Allow lifts the hold on the account at once;
 * decline keeps the record. A second tap on a settled request changes
 * nothing and says so (`settled`).
 */
import type { App } from "../app.ts";
import {
  decideRequest,
  requestOf,
  waitingRequests,
  type AccountRequest,
} from "../core/account_requests.ts";
import { getUserByName, passwordMatches, type User } from "../core/users.ts";
import { err, ok, type Result } from "../kernel/result.ts";
export type RequestError = "not_found" | "settled";
function admin(actor: User | undefined): Result<User, "not_found"> {
  return actor?.isAdmin === true && actor.kind === "user" ? ok(actor) : err("not_found");
}
export function listWaiting(app: App, actor: User | undefined): Result<AccountRequest[], "not_found"> {
  const who = admin(actor);
  return who.ok ? ok(waitingRequests(app.db)) : who;
}
function decide(
  app: App,
  actor: User | undefined,
  username: string,
  to: "allowed" | "declined",
): Result<AccountRequest, RequestError> {
  const who = admin(actor);
  if (!who.ok) return who;
  const user = getUserByName(app.db, username);
  if (user === undefined || requestOf(app.db, user.id) === undefined) return err("not_found");
  if (!decideRequest(app.db, user.id, to, who.value.id, new Date().toISOString())) return err("settled");
  app.bus.append({
    kind: to === "allowed" ? "account.allowed" : "account.declined",
    actorId: who.value.id,
    payload: { username: user.username },
  });
  return ok(requestOf(app.db, user.id)!);
}
export const allowRequest = (app: App, actor: User | undefined, username: string) =>
  decide(app, actor, username, "allowed");
export const declineRequest = (app: App, actor: User | undefined, username: string) =>
  decide(app, actor, username, "declined");
/**
 * The answer to a person who signed in with the right password to an account
 * that has not been allowed (waiting or declined): its request, so the page
 * can say where it stands. No session is made, so it can do nothing else.
 * Asked only after the throttled password check refused, so a guess costs
 * what it always did.
 */
export async function pendingFor(
  app: App,
  username: string,
  password: string,
): Promise<AccountRequest | undefined> {
  const row = app.db
    .query<{ id: string; password_hash: string }, [string]>(
      "SELECT id, password_hash FROM user WHERE username = ?1 COLLATE NOCASE AND kind = 'user' AND is_agent = 0",
    )
    .get(username);
  if (row === null || row.password_hash === "") return undefined;
  const asked = requestOf(app.db, row.id);
  if (asked === undefined || asked.state === "allowed") return undefined;
  const valid = await passwordMatches(password, row.password_hash);
      
        sentinelcrew
        5d ago
        
      
      HIGH: this verify is unthrottled and runs even when the failure was the sign-in window refusing. It is a guessing oracle that bypasses the throttle, and it costs a second argon2 per request. Call it only when the failure was a plain bad password, and count it in the same windows. The early return for a missing user is also faster than a verify, so it leaks which accounts exist.
    
  return valid ? asked : undefined;
}
@@ -43,6 +43,7 @@
import {
} from "../core/users.ts";
import { err, ok, type Result } from "../kernel/result.ts";
import { requireUser } from "./access.ts";
import { requestOf } from "../core/account_requests.ts";
import type { SignupSlot } from "./signup-window.ts";
export interface SignUpInput {
@@ -52,6 +53,8 @@
export interface SignUpInput {
  password: string;
  /** The Turnstile token the browser's widget gave; read only when a secret is set. */
  humanToken?: string;
  /** While signup is `request`: what they want to build (optional, bounded). */
  note?: string;
}
export type SignUpError =
@@ -120,6 +123,8 @@
export async function signUp(
    /** The token of the invite link the person came by (`core/invites.ts`). */
    invite?: string | undefined;
    address?: string | undefined;
    /** Where an ask came from when it is not a person at the page: "api", "agent", a forge. */
    via?: string | undefined;
  },
): Promise<Result<User, SignUpError>> {
  // A username and a password is a way in that stays, beside the passkey
@@ -148,6 +153,8 @@
export async function signUp(
    origin: "signup",
    slot: from.slot,
    invite: from.invite,
    note: input.note,
    via: from.via ?? "web",
  });
  if (!created.ok) return created;
  app.bus.append({
@@ -158,6 +165,7 @@
export async function signUp(
      ...(from.address === undefined ? {} : { address: from.address }),
    },
  });
  announceRequest(app, created.value.id);
  auditInvite(app, created.value.id);
  // The address is proven by the link it is sent; until then nothing it
  // does may create or cost.
@@ -172,6 +180,7 @@
export interface PasskeySignUpInput {
  passkey: Credential;
  passkeyName: string;
  humanToken?: string;
  note?: string;
}
/**
@@ -184,7 +193,7 @@
export interface PasskeySignUpInput {
export async function signUpWithPasskey(
  app: App,
  input: PasskeySignUpInput,
  from: { slot: SignupSlot; invite?: string | undefined; address?: string | undefined },
  from: { slot: SignupSlot; invite?: string | undefined; address?: string | undefined; via?: string | undefined },
): Promise<Result<User, SignUpError | "passkey_taken">> {
  if (signupClosed(app, from.invite)) return err("signup_closed");
  const secret = app.config.turnstileSecret;
@@ -202,6 +211,8 @@
export async function signUpWithPasskey(
    origin: "passkey",
    slot: from.slot,
    invite: from.invite,
    note: input.note,
    via: from.via ?? "web",
  });
  if (!created.ok) return created;
  const kept = addPasskey(app.db, created.value.id, input.passkeyName, input.passkey);
@@ -217,12 +228,26 @@
export async function signUpWithPasskey(
      ...(from.address === undefined ? {} : { address: from.address }),
    },
  });
  announceRequest(app, created.value.id);
  auditInvite(app, created.value.id);
  // As on the password path: no address given, no link to send.
  if (email !== "") await welcome(app, created.value);
  return created;
}
/** Whether this account is a request that has not been allowed (waiting or declined). */
export function isWaiting(app: App, userId: string): boolean {
  const asked = requestOf(app.db, userId);
  return asked !== undefined && asked.state !== "allowed";
}
/** A request is an event, so the admin's home and phone hear of it at once. The note stays in the table. */
function announceRequest(app: App, userId: string): void {
  const asked = requestOf(app.db, userId);
  if (asked?.state !== "waiting") return;
  app.bus.append({ kind: "account.requested", actorId: userId, payload: { via: asked.via } });
}
/** Using an invite link is an event: the invite's id and who it let in, never its token. */
function auditInvite(app: App, userId: string): void {
  const inviteId = inviteSpentBy(app.db, userId);
@@ -4,11 +4,12 @@
export const route: Route = {
  method: "post",
  path: "/api/v1/users",
  summary:
    "Sign up: answers 201 with the new account { id, username, displayName, isAdmin, commitEmail }, never the admin; `email` is optional; `invite` is an invite link's token, `turnstile_token` the human check when the forge asks for one; refused from another origin with 403 forbidden",
    "Sign up: answers 201 with the new account { id, username, displayName, isAdmin, commitEmail }, never the admin, or, while the forge takes requests (signup `request`), 202 { state: waiting }: the account waits until an admin allows it, and `note` (what you want to build) and `from` (which forge or agent asks) ride along; `email` is optional; `invite` is an invite link's token, `turnstile_token` the human check when the forge asks for one; refused from another origin with 403 forbidden",
  auth: false,
  role: "anonymous",
  status: 201,
  body: { username: "string", email: "string", password: "string", invite: "string", turnstile_token: "string" },
  alsoStatus: [202],
  body: { username: "string", email: "string", password: "string", note: "string", from: "string", invite: "string", turnstile_token: "string" },
  refusals: {
    rate_limited: "429, too many sign-ups; retry-after says when",
    too_large: "413, the body is over the limit for a stranger's",
@@ -0,0 +1,112 @@
/**
 * Requests for an account (`signup` = `request`, #10928). A request is a row
 * beside a user who is held suspended while it waits or is declined; Allow
 * lifts the suspension, Decline keeps the record. Plain data in and out: no
 * authz here (`actions/requests.ts` decides who may).
 */
import type { Database } from "bun:sqlite";
export type RequestState = "waiting" | "allowed" | "declined";
export interface AccountRequest {
  readonly userId: string;
  readonly username: string;
  readonly state: RequestState;
  readonly note: string;
  /** Where it came from: "web", "api", "agent" or a forge's name. */
  readonly via: string;
  readonly createdAt: string;
  readonly decidedAt: string | null;
  readonly greetedAt: string | null;
}
export const NOTE_MAX = 500;
export const VIA_MAX = 80;
/** A note from a stranger: control characters gone, trimmed, bounded. */
export function cleanNote(raw: unknown, max = NOTE_MAX): string {
  if (typeof raw !== "string") return "";
  // eslint-disable-next-line no-control-regex
  return raw.replace(/[\u0000-\u0008\u000b-\u001f\u007f]/g, "").trim().slice(0, max);
}
/** Record a request for a user just made; call inside the transaction that makes it. */
export function openRequest(db: Database, userId: string, note: string, via: string, at: string): void {
  db.query(
    "INSERT INTO account_request (user_id, state, note, via, created_at) VALUES (?1, 'waiting', ?2, ?3, ?4)",
  ).run(userId, cleanNote(note), cleanNote(via, VIA_MAX), at);
  db.query("UPDATE user SET suspended_at = ?2 WHERE id = ?1").run(userId, at);
}
interface Row {
  user_id: string;
  username: string;
  state: RequestState;
  note: string;
  via: string;
  created_at: string;
  decided_at: string | null;
  greeted_at: string | null;
}
const SELECT = `SELECT r.user_id, u.username, r.state, r.note, r.via, r.created_at, r.decided_at, r.greeted_at
  FROM account_request r JOIN user u ON u.id = r.user_id`;
const toRequest = (r: Row): AccountRequest => ({
  userId: r.user_id,
  username: r.username,
  state: r.state,
  note: r.note,
  via: r.via,
  createdAt: r.created_at,
  decidedAt: r.decided_at,
  greetedAt: r.greeted_at,
});
export function requestOf(db: Database, userId: string): AccountRequest | undefined {
  const row = db.query<Row, [string]>(`${SELECT} WHERE r.user_id = ?1`).get(userId);
  return row === null ? undefined : toRequest(row);
}
/** Those waiting, oldest first, at most `limit`. */
export function waitingRequests(db: Database, limit = 100): AccountRequest[] {
  return db
    .query<Row, [number]>(`${SELECT} WHERE r.state = 'waiting' ORDER BY r.created_at, r.user_id LIMIT ?1`)
    .all(Math.trunc(limit))
    .map(toRequest);
}
export function waitingCount(db: Database): number {
  return db.query<{ n: number }, []>("SELECT COUNT(*) AS n FROM account_request WHERE state = 'waiting'").get()?.n ?? 0;
}
/**
 * Settle a waiting request. Allow lifts the suspension; decline keeps it.
 * Only a waiting request changes: a second tap is a no-op (false).
 */
export function decideRequest(
  db: Database,
  userId: string,
  to: "allowed" | "declined",
  by: string,
  at: string,
): boolean {
  return db.transaction((): boolean => {
    const moved = db
      .query("UPDATE account_request SET state = ?2, decided_at = ?3, decided_by = ?4 WHERE user_id = ?1 AND state = 'waiting' RETURNING user_id")
      .all(userId, to, at, by);
    if (moved.length === 0) return false;
    if (to === "allowed") db.query("UPDATE user SET suspended_at = NULL WHERE id = ?1").run(userId);
    return true;
  })();
}
/** The person has been told "You're in": true once. */
export function greet(db: Database, userId: string, at: string): boolean {
  return (
    db
      .query("UPDATE account_request SET greeted_at = ?2 WHERE user_id = ?1 AND state = 'allowed' AND greeted_at IS NULL RETURNING user_id")
      .all(userId, at).length === 1
  );
}
@@ -156,6 +156,9 @@
const READER_KINDS: ReadonlySet<string> = new Set([
  "telemetry.revoked",
  "account.suspended",
  "account.unsuspended",
  "account.requested",
  "account.allowed",
  "account.declined",
  "org.retired",
  "account.removed",
  "branch.created",
@@ -0,0 +1,1 @@
595f52026600cc121defbdf9d4bb8bf23fb70a273a13963814dcf0d5180513b8
@@ -0,0 +1,25 @@
// A stranger's request for an account (#10928): one row per person who asked
// while signup is `request`. The account itself is held suspended while its
// request is waiting or declined, so every credential check already refuses
// it; Allow lifts that. Additive.
export default `
  CREATE TABLE account_request (
    user_id    TEXT PRIMARY KEY REFERENCES user(id) ON DELETE CASCADE,
    state      TEXT NOT NULL CHECK (state IN ('waiting', 'allowed', 'declined')),
    note       TEXT NOT NULL DEFAULT '',
    via        TEXT NOT NULL DEFAULT '',
    created_at TEXT NOT NULL,
    decided_at TEXT,
    decided_by TEXT,
    greeted_at TEXT
  );
  CREATE INDEX account_request_state ON account_request (state, created_at);
  -- The owner asked (#10928) that a forge now closed take requests instead.
  -- A forge that stored another value, or none, is left as it is.
  INSERT INTO forge_setting_change (key, from_value, to_value, actor_id, at)
    SELECT 'signup', 'closed', 'request', 'migration', strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
      FROM forge_setting WHERE key = 'signup' AND value = 'closed';
  UPDATE forge_setting SET value = 'request', updated_by = 'migration',
         updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
   WHERE key = 'signup' AND value = 'closed';
  `;
@@ -12,6 +12,7 @@
import { id } from "../kernel/id.ts";
import { err, ok, type Result } from "../kernel/result.ts";
import { admitSignin } from "./signin-window.ts";
import { getSignup } from "../settings/signup.ts";
import { openRequest } from "./account_requests.ts";
import { inviteOpen, redeemInvite, reopenInvite } from "./invites.ts";
import type { SignupSlot } from "../actions/signup-window.ts";
@@ -136,7 +137,14 @@
export type AccountOrigin =
   * `invite` is the token of an invite link (`core/invites.ts`): while
   * signup is `invite` it opens the door once, spent with the account.
   */
  | { origin: "signup" | "passkey"; slot: SignupSlot; invite?: string | undefined }
  | {
      origin: "signup" | "passkey";
      slot: SignupSlot;
      invite?: string | undefined;
      /** While signup is `request`: what the person wants to build, and where the ask came from. */
      note?: string | undefined;
      via?: string | undefined;
    }
  | { origin: "edge" }
  | { origin: Exclude<ExemptOrigin, AdminOrigin> }
  | ({ origin: AdminOrigin } & AdminFields);
@@ -168,7 +176,8 @@
export function newAccountsClosed(db: Database, invite?: string): boolean {
/** Whether a stranger needs an invite (or cannot come in at all) now. */
function inviteNeeded(db: Database): boolean {
  return getSignup(db) !== "open";
  const mode = getSignup(db);
  return mode !== "open" && mode !== "request";
}
interface CreateUserFields {
@@ -230,9 +239,9 @@
export function discardFreshUser(db: Database, userId: string): void {
 */
type Admission =
  | { readonly admitted: false }
  | { readonly admitted: true; readonly spend: string | undefined };
  | { readonly admitted: true; readonly spend: string | undefined; readonly waiting: boolean };
const ADMITTED: Admission = { admitted: true, spend: undefined };
const ADMITTED: Admission = { admitted: true, spend: undefined, waiting: false };
const REFUSED: Admission = { admitted: false };
function admission(db: Database, input: AccountOrigin): Admission {
@@ -240,12 +249,19 @@
function admission(db: Database, input: AccountOrigin): Admission {
    case "signup":
    case "passkey":
      if (input.slot.spent) throw new Error("a sign-up slot makes one account");
      if (getSignup(db) === "request") {
        // An open invite link still lets a person straight in; anyone else asks.
        if (input.invite !== undefined && inviteOpen(db, input.invite))
          return { admitted: true, spend: input.invite, waiting: false };
        return { admitted: true, spend: undefined, waiting: true };
      }
      if (!inviteNeeded(db)) return ADMITTED;
      return newAccountsClosed(db, input.invite) || input.invite === undefined
        ? REFUSED
        : { admitted: true, spend: input.invite };
        : { admitted: true, spend: input.invite, waiting: false };
    case "edge":
      return newAccountsClosed(db) ? REFUSED : ADMITTED;
      // The edge vouches for a login, not for a right to an account: only `open` lets it make one.
      return getSignup(db) === "open" ? ADMITTED : REFUSED;
    case "claim":
    case "everyday":
    case "agent":
@@ -325,6 +341,7 @@
export async function createUser(
  const invite = admitted.spend;
  const insert = db.transaction((): boolean => {
    if (invite !== undefined && !redeemInvite(db, invite, userId)) return false;
    const now = new Date().toISOString();
    db.query(
      `INSERT INTO user (id, username, email, password_hash, display_name, is_admin, is_agent)
       VALUES (?1, ?2, ?3, ?4, ?5,
@@ -343,6 +360,9 @@
export async function createUser(
      admin.adminIfFirst ? 1 : 0,
      agent ? 1 : 0,
    );
    // A request waits, held suspended, in the same write as the account.
    if (admitted.waiting)
      openRequest(db, userId, "note" in input ? (input.note ?? "") : "", "via" in input ? (input.via ?? "") : "", now);
    return true;
  });
  try {
@@ -490,6 +510,15 @@
export interface PasswordAttempt {
  readonly source: string;
}
/**
 * A bare argon2 match, for the one door that answers a person whose account is
 * not yet allowed and so cannot sign in. Only called after the throttled check
 * has refused, so a guess costs what it always did.
 */
export async function passwordMatches(password: string, hash: string): Promise<boolean> {
  return Bun.password.verify(password, hash).catch(() => false);
}
/**
 * The only way to prove a password. The attempt is counted in the sign-in
 * windows (per account, per source, per forge: `core/signin-window.ts`)
@@ -21,7 +21,7 @@
 */
import { blockedLines } from "../actions/egress_refused.ts";
import { newAccountLines } from "../actions/accounts.ts";
import { newAccountLines, requestLines } from "../actions/accounts.ts";
import { mailCeilingLines } from "../actions/mail.ts";
import { forgetOnboarding, onboardedLines } from "../apps/onboarding.ts";
import type { Database } from "bun:sqlite";
@@ -501,6 +501,7 @@
export function startNotifier(app: App, options: NotifyOptions): Notifier {
    // to itself.
    const asks: { line: string; items: readonly string[]; link?: string }[] = [
      ...askLinesFor(app.db, user).map((a) => ({ line: a.line, items: a.items })),
      ...requestLines(app.db, user),
      
        sentinelcrew
        5d ago
        
      
      MEDIUM: one phone line per waiting stranger, unbounded. A flood of requests floods the admin. Collapse to one line with a count.
    
      ...newAccountLines(app.db, user, now()),
      ...landedLines(app.db, user, now()),
      ...mailCeilingLines(app, user, now()),
@@ -125,6 +125,7 @@
import {
  HUMAN_CHECK_MESSAGE,
  mintConversationToken,
  PASSKEY_REQUIRED_MESSAGE,
  isWaiting,
  signUp,
  SIGNUP_CLOSED_MESSAGE,
} from "../actions/users.ts";
@@ -1192,11 +1193,14 @@
export function apiRoutes(router: Router<Handler>): void {
        email: str(input.email),
        password: str(input.password),
        humanToken: str(input.turnstile_token),
        note: str(input.note),
      },
      {
        slot,
        invite,
        address: clientAddress(ctx.request),
        // Where the ask came from: a forge or an agent names itself; otherwise the API.
        via: str(input.from).trim() === "" ? "api" : `api: ${str(input.from).trim().slice(0, 60)}`,
      },
    );
    if (!created.ok && created.error === "signup_closed")
@@ -1206,6 +1210,8 @@
export function apiRoutes(router: Router<Handler>): void {
    if (!created.ok && created.error === "human_check")
      return apiError("human_check", 422, HUMAN_CHECK_MESSAGE);
    if (!created.ok) return json({ error: created.error }, 422);
    // A request waits: 202, and nothing to sign in with until an admin allows it.
    if (isWaiting(ctx.app, created.value.id)) return json({ state: "waiting" }, 202);
    return json(publicUser(created.value), 201);
  });
@@ -140,6 +140,8 @@
import {
  signinPage,
  signinSubmit,
  signupPage,
  signupRequestedPage,
  signupWelcomePage,
  signupSubmit,
  verifyPage,
  themeSubmit,
@@ -860,6 +862,8 @@
export function buildRouter(): Router<Handler> {
  router.add("GET", "/signin/parent", parentStart);
  router.add("GET", "/signin/parent/callback", parentCallback);
  router.add("GET", "/signup", signupPage);
  router.add("GET", "/signup/requested", signupRequestedPage);
  router.add("GET", "/signup/welcome", signupWelcomePage);
  router.add("GET", "/verify", verifyPage);
  router.add("POST", "/signup", signupSubmit);
  router.add("POST", "/logout", logoutSubmit);
@@ -72,7 +72,7 @@
import {
  subscriptionHeadroom,
  subscriptionWake,
} from "../web/pages/subscriptions.ts";
import { peoplePage, roleAct } from "../web/pages/people.ts";
import { peoplePage, requestAct, roleAct } from "../web/pages/people.ts";
import { ceilingAct, grantAct, modelAdd, modelPage } from "../web/pages/model.ts";
import {
  everydayCreate,
@@ -241,6 +241,8 @@
export function settingsRoutes(router: Router<Handler>, knownPatterns: () => rea
  router.add("GET", "/settings/accounts", accountsPage);
  router.add("GET", "/settings/people", peoplePage);
  router.add("POST", "/settings/people/:username/role", roleAct);
  router.add("POST", "/settings/people/:username/allow", requestAct);
  router.add("POST", "/settings/people/:username/decline", requestAct);
  router.add("GET", "/settings/model", modelPage);
  router.add("POST", "/settings/model", modelAdd);
  router.add("POST", "/settings/accounts/:username/model", grantAct);
@@ -1,5 +1,6 @@
/**
 * Who may make an account: `open`, `invite` or `closed`. Stored in
 * Who may make an account: `open`, `request`, `invite` or `closed`. `request`
 * lets a stranger ask: the account waits until an admin allows it (#10928). Stored in
 * `forge_setting` under `signup`, and every change is kept in
 * `forge_setting_change` (who, when, from what to what). Default `open` when nothing is stored; a new forge stores `invite` (`seedSignup`).
 * `/signup`, `POST /api/v1/users`, passkey signup and a first edge sign-in ask
@@ -11,10 +12,18 @@
import type { Database } from "bun:sqlite";
import { err, ok, type Result } from "../kernel/result.ts";
import { writeSetting } from "./limits.ts";
export const SIGNUP_MODES = ["open", "invite", "closed"] as const;
export const SIGNUP_MODES = ["open", "request", "invite", "closed"] as const;
export type SignupMode = (typeof SIGNUP_MODES)[number];
export const SIGNUP_DEFAULT: SignupMode = "open";
/** What each mode means, in one line, for the knob and the terminal. */
export const SIGNUP_MEANS: Record<SignupMode, string> = {
  open: "Anyone can make an account at once.",
  request: "Anyone can ask for an account; an admin allows or declines each one.",
  invite: "Only people with an invite link can make an account.",
  closed: "Nobody can make an account, invite links included.",
};
/** The actor kept for a change made by `FORGE_SIGNUP` at boot. */
export const BOOT_ACTOR = "boot";
@@ -66,7 +75,7 @@
export function signupFromEnv(raw: string | undefined): Result<SignupMode | null
  const parsed = parseSignup(s);
  return parsed.ok
    ? parsed
    : err(`FORGE_SIGNUP: open, invite or closed, not "${s.slice(0, 20)}"`);
    : err(`FORGE_SIGNUP: open, request, invite or closed, not "${s.slice(0, 20)}"`);
}
export interface SignupChange {
@@ -12,7 +12,7 @@
import { inviteLink, list as listInviteLinks, mint as mintInviteLink, revoke as
import { INVITE_NOT_OPEN } from "../../actions/sever_invite_words.ts";
import { DEFAULT_DAYS, MAX_DAYS } from "../../core/invites.ts";
import { changeSignup, readSignup } from "../../actions/signup.ts";
import { SIGNUP_MODES } from "../../settings/signup.ts";
import { SIGNUP_MEANS, SIGNUP_MODES } from "../../settings/signup.ts";
import { QUOTA_KEYS } from "../../settings/quotas.ts";
import type { Ctx } from "../../http/context.ts";
import { notePhase, takeSessionTime, timePhase } from "../../core/route_timing.ts";
@@ -122,7 +122,7 @@
export function limitsPage(ctx: Ctx): Response {
    }),
  );
  const signupRow = html`<div class="status-row">
    <dt>Signup</dt>
    <dt>New accounts</dt>
    <dd>
      <form class="row-fields" method="post" action="/admin/signup">
        <select class="input mono" name="signup" aria-label="Who may sign up">
@@ -132,6 +132,10 @@
export function limitsPage(ctx: Ctx): Response {
        </select>
        ${btn("Save", { size: "sm", variant: "primary", label: "Save signup" })}
      </form>
      <ul class="small muted" id="signup-means">
        ${SIGNUP_MODES.map((m) => html`<li><span class="mono">${m}</span>: ${SIGNUP_MEANS[m]}</li>`)}
      </ul>
      <p class="small muted">Invite links work in every mode except closed.</p>
      
        sentinelcrew
        5d ago
        
      
      Principle 1: the meanings list above already says this; the sentence explains itself twice. Drop it or fold it into the list.
    
    </dd>
    <dd class="status-act"></dd>
  </div>`;
@@ -7,7 +7,9 @@
 * username wraps anywhere, so the page never scrolls sideways (#9374).
 */
import { allowRequest, declineRequest, listWaiting } from "../../actions/requests.ts";
import { setRole } from "../../actions/roles.ts";
import type { AccountRequest } from "../../core/account_requests.ts";
import { GRANT_MAX_USD } from "../../core/model_grant.ts";
import { listPeople, roleLimits, type Person } from "../../core/roles.ts";
import { getUserByName, type User } from "../../core/users.ts";
@@ -15,9 +17,9 @@
import { notePhase, takeSessionTime, timePhase } from "../../core/route_timing.t
import type { Ctx } from "../../http/context.ts";
import { notFoundPage, settingsLayout, signInFirst } from "../chrome.ts";
import { field, readForm } from "../form.ts";
import { html } from "../html.ts";
import { html, type Html } from "../html.ts";
import { flashTo, page } from "../layout.ts";
import { badge, btn, empty, userLink } from "../ui.ts";
import { badge, btn, empty, time, userLink } from "../ui.ts";
import { accountSections } from "./origins.ts";
/**
@@ -36,6 +38,60 @@
export function appsMade(ctx: Ctx): Map<string, string[]> {
  return made;
}
/** Where a decision may send the admin back to: the people list or home, nowhere else. */
const BACKS = new Set(["/settings/people", "/"]);
/**
 * Who is waiting for an account: name, what they want to build, when, and
 * from where, with Allow and Decline one tap each. Nothing when nobody waits.
 * Shown on this page and on the admin's home; `back` is where a tap returns.
 */
export function waitingList(waiting: readonly AccountRequest[], back: string): Html | null {
  if (waiting.length === 0) return null;
  const form = (r: AccountRequest, what: "allow" | "decline") =>
    html`<form method="post" action="/settings/people/${encodeURIComponent(r.username)}/${what}">
      <input type="hidden" name="back" value="${back}" />
      ${btn(what === "allow" ? "Allow" : "Decline", {
        type: "submit",
        size: "sm",
        ...(what === "allow" ? { variant: "primary" as const } : {}),
        label: `${what === "allow" ? "Allow" : "Decline"} ${r.username}`,
      })}
    </form>`;
  return html`<section class="settings-block" id="waiting">
    <h2>Waiting <span class="muted small">${waiting.length}</span></h2>
    <ul class="stack">
      ${waiting.map(
        (r) => html`<li class="waiting-request">
          <div><strong>${r.username}</strong> <span class="small muted">${time(r.createdAt)}${r.via === "" ? "" : html` · from ${r.via}`}</span></div>
          ${r.note === "" ? html`<p class="small muted">No note.</p>` : html`<p class="small">${r.note}</p>`}
          <div class="row-fields">${form(r, "allow")}${form(r, "decline")}</div>
        </li>`,
      )}
    </ul>
  </section>`;
}
// POST /settings/people/:username/allow and /decline
export async function requestAct(ctx: Ctx): Promise<Response> {
  if (!ctx.auth.user) return signInFirst(ctx);
  if (!ctx.auth.user.isAdmin) return notFoundPage(ctx);
  notePhase(ctx.request, "session", takeSessionTime(ctx.request));
  const form = await readForm(ctx, "admin");
  if (form instanceof Response) return form;
  const username = ctx.params.username ?? "";
  const allow = ctx.url.pathname.endsWith("/allow");
  const asked = field(form, "back");
  const back = BACKS.has(asked) ? asked : "/settings/people";
  const done = (allow ? allowRequest : declineRequest)(ctx.app, ctx.auth.user, username);
  if (!done.ok && done.error === "not_found") return notFoundPage(ctx);
  if (!done.ok)
    return flashTo(ctx, back, { tone: "danger", message: `${username}'s request was already answered.` });
  return flashTo(ctx, back, {
    message: allow ? `${username} is in.` : `${username} was declined, and has been told so politely.`,
  });
}
// GET /settings/people
export function peoplePage(ctx: Ctx): Response {
  if (!ctx.auth.user) return signInFirst(ctx);
@@ -43,6 +99,10 @@
export function peoplePage(ctx: Ctx): Response {
  notePhase(ctx.request, "session", takeSessionTime(ctx.request));
  const rows = timePhase(ctx.request, "people", () => listPeople(ctx.app.db));
  const made = appsMade(ctx);
  const waiting = timePhase(ctx.request, "waiting", () => {
    const l = listWaiting(ctx.app, ctx.auth.user);
    return l.ok ? l.value : [];
  });
  const rendering = performance.now();
  const line = (p: Person) => {
    const role = p.role;
@@ -79,7 +139,7 @@
export function peoplePage(ctx: Ctx): Response {
    body: html`<div class="page-head"><h1>People</h1></div>
      ${settingsLayout(
        accountSections("people", { admin: true }),
        html`<section class="settings-block">
        html`${waitingList(waiting, "/settings/people")}<section class="settings-block">
          <h2>Guests, members and admins</h2>
          <p class="muted">Make a guest a member, with an allowance if you like.</p>
          ${
@@ -7,7 +7,7 @@
 */
import { newChallenge, verifyRegistration } from "../../auth/webauthn.ts";
import { givenEmail, signUpWithPasskey, signupClosed, HUMAN_CHECK_MESSAGE, SIGNUP_CLOSED_MESSAGE } from "../../actions/users.ts";
import { givenEmail, isWaiting, signUpWithPasskey, signupClosed, HUMAN_CHECK_MESSAGE, SIGNUP_CLOSED_MESSAGE } from "../../actions/users.ts";
import { createSession } from "../../core/sessions.ts";
import { getUserByName } from "../../core/users.ts";
import { isSafeName } from "../../git/guard.ts";
@@ -102,11 +102,13 @@
export async function signupPasskey(ctx: Ctx): Promise<Response> {
  if (typeof slot === "number") return tooMany(slot);
  const created = await signUpWithPasskey(
    ctx.app,
    { username, email, passkey: made, passkeyName: "Passkey", humanToken: str(data.humanToken) },
    { slot, invite: inviteOf(ctx), address: clientAddress(ctx.request) },
    { username, email, passkey: made, passkeyName: "Passkey", humanToken: str(data.humanToken), note: str(data.note) },
    { slot, invite: inviteOf(ctx), address: clientAddress(ctx.request), via: "web" },
  );
  if (!created.ok)
    return refuse(created.error === "human_check" ? 422 : created.error === "signup_closed" ? 403 : 409, WORDS[created.error] ?? "Sign-up did not work. Try again.");
  // A request waits: no session, and the next page says it is in.
  if (isWaiting(ctx.app, created.value.id)) return json({ ok: true, next: "/signup/requested" }, 201);
  const session = createSession(ctx.app.db, created.value.id);
  return json(
    { ok: true, next: safeNext(ctx.url.searchParams.get("next")) ?? "/" },
@@ -18,7 +18,9 @@
import { verifyEmail } from "../../actions/verify.ts";
import { STRANGER_MAX } from "../../http/limits.ts";
import { createRepo, repositoryLimitMessage, resolveOwner } from "../../actions/repos.ts";
import { REPO_INIT_FAILED, REPO_NAME_RULES } from "../../actions/repo_words.ts";
import { HUMAN_CHECK_MESSAGE, INVITE_SPENT_MESSAGE, PASSKEY_REQUIRED_MESSAGE, SIGNUP_CLOSED_MESSAGE, signUp, signupClosed } from "../../actions/users.ts";
import { HUMAN_CHECK_MESSAGE, INVITE_SPENT_MESSAGE, PASSKEY_REQUIRED_MESSAGE, SIGNUP_CLOSED_MESSAGE, isWaiting, signUp, signupClosed } from "../../actions/users.ts";
import { pendingFor } from "../../actions/requests.ts";
import { greet, requestOf, type AccountRequest } from "../../core/account_requests.ts";
import { accessAllows, listOrgsForUser, orgAccess } from "../../core/orgs.ts";
import { listPins } from "../../core/pins.ts";
import { getReposByIds } from "../../core/repos.ts";
@@ -219,6 +221,7 @@
export async function home(ctx: Ctx): Promise<Response> {
interface AuthValues {
  username?: string;
  email?: string;
  note?: string;
}
interface AuthErrors {
@@ -231,6 +234,7 @@
interface AuthErrors {
/** What `/signin` says about new accounts in each signup mode; open says nothing. */
const SIGNUP_SENTENCES: Record<SignupMode, string | undefined> = {
  open: undefined,
  request: "New accounts here are looked at first: ask for one and someone who runs this forge will answer.",
  invite: "This forge is invite-only: new accounts need an invite link.",
  closed: "This forge is closed to new accounts.",
};
@@ -343,6 +347,16 @@
function authForm(
          ...(errors.email ? { error: errors.email } : {}),
        }),
      )}
      ${when(kind === "signup" && getSignup(ctx.app.db) === "request" && inviteOf(ctx) === undefined, () =>
        formField({
          label: "What do you want to build?",
          name: "note",
          type: "textarea",
          rows: 3,
          value: values.note ?? "",
          hint: "Optional. A line or two helps whoever reads your request.",
        }),
      )}
      ${when(!byPasskey, () =>
        formField({
          label: "Password",
@@ -556,6 +570,9 @@
export async function signinSubmit(ctx: Ctx): Promise<Response> {
    return response;
  }
  if (!verified.ok) {
    // The right password for an account still waiting (or declined) is told where it stands, with no session.
    const asked = await pendingFor(ctx.app, username, field(form, "password"));
      
        sentinelcrew
        5d ago
        
      
      HIGH: this is reached on every failed sign-in, throttled or not. See requests.ts: gate it on the failure reason.
    
    if (asked !== undefined) return requestPage(ctx, asked.state === "declined" ? "Request declined" : "Request in", requestWords(asked));
    return page(
      {
        ctx,
@@ -574,8 +591,10 @@
export async function signinSubmit(ctx: Ctx): Promise<Response> {
    );
  }
  const session = createSession(ctx.app.db, verified.value.id);
  // The first time in after being allowed: say so once.
  const welcome = requestOf(ctx.app.db, verified.value.id)?.state === "allowed" && greet(ctx.app.db, verified.value.id, new Date().toISOString());
  return redirect(
    safeNext(ctx.url.searchParams.get("next")) ?? "/",
    welcome ? "/signup/welcome" : (safeNext(ctx.url.searchParams.get("next")) ?? "/"),
    sessionCookie(session.token, session.expiresAt, ctx.url, ctx.app.config.url),
  );
}
@@ -673,8 +692,9 @@
export async function signupSubmit(ctx: Ctx): Promise<Response> {
      email,
      password: field(form, "password"),
      humanToken: field(form, "cf-turnstile-response"),
      note: field(form, "note"),
    },
    { slot, invite: inviteOf(ctx), address: clientAddress(ctx.request) },
    { slot, invite: inviteOf(ctx), address: clientAddress(ctx.request), via: "web" },
  );
  if (!created.ok) {
    if (created.error === "signup_closed") return signupClosedPage(ctx);
@@ -695,13 +715,15 @@
export async function signupSubmit(ctx: Ctx): Promise<Response> {
      {
        ctx,
        title: "Sign up",
        body: authForm(ctx, "signup", { values: { username, email }, errors }),
        body: authForm(ctx, "signup", { values: { username, email, note: field(form, "note") }, errors }),
        turnstile: siteKey(ctx) !== undefined,
        scriptJs: passkeyJs,
      },
      422,
    );
  }
  // A request waits: no session, only the page that says it is in.
  if (isWaiting(ctx.app, created.value.id)) return redirect("/signup/requested");
  const session = createSession(ctx.app.db, created.value.id);
  return redirect(
    safeNext(ctx.url.searchParams.get("next")) ?? "/",
@@ -709,6 +731,58 @@
export async function signupSubmit(ctx: Ctx): Promise<Response> {
  );
}
/** What a person is told once their request is in; general, for people who do not know whoever answers. */
export const REQUEST_IN_MESSAGE =
  "Your request is in. Someone who runs this forge will look at it; you can close this page and sign in later to check.";
/** What a person is told when their request was declined. */
export const REQUEST_DECLINED_MESSAGE =
  "Thank you for asking. Your request was not accepted this time, and no account is open for you here. You can still run a forge of your own, with no account here.";
/** The words for an account that has not been allowed, by where its request stands. */
export const requestWords = (r: AccountRequest): string =>
  r.state === "declined" ? REQUEST_DECLINED_MESSAGE : REQUEST_IN_MESSAGE;
function requestPage(ctx: Ctx, title: string, message: string, status = 200): Response {
  return timePhase(ctx.request, "render", () =>
    page(
    {
      ctx,
      title,
      body: html`<div class="narrow stack" id="request-state">
        ${pageHead(title)}
        <p>${message}</p>
        <div class="form-actions">
          ${btn("Sign in", { href: "/signin", variant: "outline" })}
          ${btn("Get your own forge", { href: "/#yours", variant: "primary" })}
        </div>
      </div>`,
    },
    status,
  ));
}
// GET /signup/requested — static: it names nobody and reads no account.
export function signupRequestedPage(ctx: Ctx): Response {
  notePhase(ctx.request, "session", takeSessionTime(ctx.request));
  return requestPage(ctx, "Request sent", REQUEST_IN_MESSAGE);
}
// GET /signup/welcome — the first sign-in after an admin allowed the request.
export function signupWelcomePage(ctx: Ctx): Response {
  if (!ctx.auth.user) return redirect("/signin");
  notePhase(ctx.request, "session", takeSessionTime(ctx.request));
  return timePhase(ctx.request, "render", () => page({
    ctx,
    title: "You're in",
    body: html`<div class="narrow stack" id="request-allowed">
      ${pageHead("You're in.")}
      <p>Your request was allowed. Your account is ready.</p>
      <div class="form-actions">${btn("Go to the forge", { href: "/", variant: "primary" })}</div>
    </div>`,
  }));
}
// POST /theme — persist the theme choice in a cookie. Works as a plain form
// submit (redirect back to the referring page) and as a background fetch from
// the switcher script; "system" clears the cookie so the OS decides again.
@@ -131,6 +131,7 @@
export const passkeyJs = /* js */ `
        return post('/signup/passkey' + location.search, {
          username: who.username,
          email: who.email,
          note: val('note'),
          humanToken: val('cf-turnstile-response'),
          challenge: o.challenge,
          clientDataJSON: text(cred.response.clientDataJSON),
@@ -411,7 +411,7 @@
function renderLlmsTxt(ctx: Ctx, o: string, tell: string | undefined, running: s
      "",
      "If you are an assistant helping a person: say plainly what you can and cannot do from where you are. If you cannot reach this forge or hold an account on it, give the person these steps to do by hand.",
      "",
      `- Help build a public app here: each one is a repository at ${o}/{owner}/{name}. A person makes an account at ${o}/signup, then follows "Offer a change" below. If /signup answers 403, new accounts here are by invitation for now: send a suggestion through "Report a problem" below, or work from a forge of your own.`,
      `- Help build a public app here: each one is a repository at ${o}/{owner}/{name}. A person makes an account at ${o}/signup, then follows "Offer a change" below. Where the forge takes requests, \`POST ${o}/api/v1/users\` (username, password, optional \`note\` of what they want to build) answers 202 \`{"state":"waiting"}\`: the account waits until someone who runs the forge allows it, and the person can sign in later to check. If /signup answers 403, new accounts here are by invitation for now: send a suggestion through "Report a problem" below, or work from a forge of your own.`,
      `- Get your own forge: \`git clone ${UPSTREAM_REPO}.git && cd forge && bun install && bun run src/main.ts\`, then in a second terminal \`bun src/main.ts --first-admin\`, which prints a one-time link that makes you the admin. It needs Bun; its crew needs the claude CLI and a model credential. Or a hosted one, free within limits while hosting is not sold: sign in and open ${o}/forges/new (or call the MCP \`spawn\` tool with the person's consent). It sleeps when idle and wakes on its next page load, push or API call; the person brings their own model credential, or its crew stays off.`,
      `- Work from your own forge: connect it to this one as an origin, bring an app in, and send your work back. How: ${UPSTREAM_REPO}/raw/main/docs/ORIGINS.md`,
      `- Connect an assistant that can use tools: add a custom connector with the URL ${mcp.url}. It signs in with OAuth; only the report tool works without an account.`,
@@ -21,6 +21,8 @@
import {
import { catalog, refreshCatalogQuietly } from "../../packs/catalog.ts";
import { appsRuntime, type EnvState } from "../../apps/runtime.ts";
import { signupClosed } from "../../actions/users.ts";
import { listWaiting } from "../../actions/requests.ts";
import { waitingList } from "../pages/people.ts";
import { getSignup } from "../../settings/signup.ts";
import { appsForRepos } from "../../core/apps.ts";
import { WEIGHT_MAX, WEIGHT_NAMES } from "../../core/front.ts";
@@ -351,7 +353,14 @@
export async function studioHome(
    isNavigation(ctx.request) ? noteVisit(ctx.app.db, user.id, visitedAt) : lastVisit(ctx.app.db, user.id),
  );
  const since = timePhase(ctx.request, "since", () => sinceYouWere(ctx.app.db, user, before, visitedAt));
  const needsYou = html`${waiting}${held}${alarms}`;
  // Someone asking for an account: Allow or Decline, one tap, on the phone's first screen.
  const asking = user.isAdmin
    ? timePhase(ctx.request, "requests", () => {
        const l = listWaiting(ctx.app, user);
        return waitingList(l.ok ? l.value : [], "/");
      })
    : null;
  const needsYou = html`${asking}${waiting}${held}${alarms}`;
  const body = html`<h1 class="sr-only">Home</h1>
    ${tellBox(ctx, user)}
    ${ask} ${address}
@@ -372,7 +381,7 @@
export async function studioHome(
    body,
    scriptJs: `${liveClientJs}\n${liveRegionsJs}\n${refreshJs}\n${registerWorkerJs}${ask ? `\n${passkeyJs}` : ""}`,
  });
  notePhaseRest(ctx.request, "render", rendering, ["kpis", "moving", "access", "waiting", "held", "visit", "since"]);
  notePhaseRest(ctx.request, "render", rendering, ["kpis", "moving", "access", "waiting", "held", "visit", "since", "requests"]);
  return res;
}
@@ -0,0 +1,182 @@
/**
 * Request access (#10928): with signup on `request` a stranger's account
 * waits, the admin allows or declines it with one tap, and the person is told
 * plainly where it stands. By API and by page, the Allow path and the Decline path.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { newAccountLines, requestLines } from "../src/actions/accounts.ts";
import { getUserByName } from "../src/core/users.ts";
import { requestOf, waitingCount } from "../src/core/account_requests.ts";
import { mintInvite } from "../src/core/invites.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { setLimit } from "../src/settings/limits.ts";
import { setSignup } from "../src/settings/signup.ts";
import { adminCookie } from "./helpers/admin.ts";
const ORIGIN = "https://forge.example";
const PASSWORD = "a-good-passphrase";
describe("request access", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let admin: string;
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-request-access-"));
    app = createApp({ dataDir, port: 0, url: ORIGIN });
    servers = await serve(app);
    setLimit(app.db, "signup.per_source", 1000, "setup");
    setSignup(app.db, "request", "boot");
    admin = await adminCookie(app, { username: "boss", email: "[email protected]" });
    base = servers.url;
  });
  afterAll(async () => {
    await servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  const api = (username: string, extra: Record<string, string> = {}) =>
    fetch(`${base}/api/v1/users`, {
      method: "POST",
      headers: { "content-type": "application/json", origin: ORIGIN },
      body: JSON.stringify({ username, email: `${username}@example.com`, password: PASSWORD, ...extra }),
    });
  const form = (path: string, fields: Record<string, string>, cookie?: string) =>
    fetch(`${base}${path}`, {
      method: "POST",
      redirect: "manual",
      headers: { "content-type": "application/x-www-form-urlencoded", origin: ORIGIN, ...(cookie ? { cookie } : {}) },
      body: new URLSearchParams(fields),
    });
  const signin = (username: string) => form("/signin", { username, password: PASSWORD });
  test("the form asks what you want to build, and names no owner", async () => {
    const page = await fetch(`${base}/signup`).then((r) => r.text());
    expect(page).toContain("What do you want to build?");
    expect(page).toContain('name="password"');
  });
  test("API: 202 waiting, the account holds nothing, the admin hears at once", async () => {
    const res = await api("ada", { note: "a tide table for my boat", from: "my-agent" });
    expect(res.status).toBe(202);
    expect(await res.json()).toEqual({ state: "waiting" });
    const ada = getUserByName(app.db, "ada")!;
    expect(requestOf(app.db, ada.id)).toMatchObject({ state: "waiting", note: "a tide table for my boat", via: "api: my-agent" });
    // Nothing it can do: no credential works.
    const token = await fetch(`${base}/api/v1/user`, { headers: { cookie: "forge_session=nope" } });
    expect(token.status).toBe(401);
    const boss = getUserByName(app.db, "boss")!;
    expect(requestLines(app.db, boss).map((l) => l.line)).toEqual(["ada asked for an account: Allow or Decline"]);
    expect(newAccountLines(app.db, boss).some((l) => l.id === "account:ada")).toBe(false);
    // Anyone but an admin sees no list.
    const home = await fetch(`${base}/`, { headers: { cookie: admin } }).then((r) => r.text());
    expect(home).toContain("/settings/people/ada/allow");
    expect(home).toContain("a tide table for my boat");
  });
  test("page: signing in with the right password says the request is in; no session is made", async () => {
    const res = await signin("ada");
    expect(res.status).toBe(200);
    expect(res.headers.get("set-cookie")).toBeNull();
    const html = await res.text();
    expect(html).toContain("Your request is in. Someone who runs this forge will look at it; you can close this page and sign in later to check.");
    expect(html).not.toContain("boss");
    // A wrong password learns nothing about the request.
    const wrong = await form("/signin", { username: "ada", password: "not-the-passphrase" });
    expect(wrong.status).toBe(422);
    expect(await wrong.text()).not.toContain("request is in");
  });
  test("a stranger cannot allow, a cross-origin post cannot allow", async () => {
    const stranger = await form("/settings/people/ada/allow", {});
    expect([302, 303, 401, 403, 404]).toContain(stranger.status);
    const cross = await fetch(`${base}/settings/people/ada/allow`, {
      method: "POST",
      redirect: "manual",
      headers: { "content-type": "application/x-www-form-urlencoded", origin: "https://evil.example", cookie: admin },
      body: "",
    });
    expect(cross.status).toBeGreaterThanOrEqual(400);
    expect(requestOf(app.db, getUserByName(app.db, "ada")!.id)?.state).toBe("waiting");
  });
  test("Allow: one tap, then sign-in works and says You're in, once", async () => {
    const people = await fetch(`${base}/settings/people`, { headers: { cookie: admin } }).then((r) => r.text());
    expect(people).toContain("Waiting");
    expect(people).toContain("a tide table for my boat");
    const tap = await form("/settings/people/ada/allow", { back: "/" }, admin);
    expect(tap.status).toBe(303);
    expect(waitingCount(app.db)).toBe(0);
    const again = await form("/settings/people/ada/allow", { back: "/" }, admin);
    expect(again.status).toBe(303); // answered already: a flash, no change
    const res = await signin("ada");
    expect(res.status).toBe(303);
    expect(res.headers.get("location")).toBe("/signup/welcome");
    const cookie = res.headers.get("set-cookie")!.split(";")[0]!;
    const welcome = await fetch(`${base}/signup/welcome`, { headers: { cookie } }).then((r) => r.text());
    expect(welcome).toContain("You&#39;re in.");
    const next = await signin("ada");
    expect(next.headers.get("location")).toBe("/");
  });
  test("Decline: a record is kept, the person is told politely, no session", async () => {
    expect((await api("bea", { note: "just looking" })).status).toBe(202);
    const tap = await form("/settings/people/bea/decline", { back: "/settings/people" }, admin);
    expect(tap.status).toBe(303);
    const bea = getUserByName(app.db, "bea")!;
    expect(requestOf(app.db, bea.id)).toMatchObject({ state: "declined", note: "just looking" });
    const res = await signin("bea");
    expect(res.status).toBe(200);
    expect(res.headers.get("set-cookie")).toBeNull();
    expect(await res.text()).toContain("Your request was not accepted this time");
    // A declined request cannot be allowed by a second tap.
    await form("/settings/people/bea/allow", {}, admin);
    expect(requestOf(app.db, bea.id)?.state).toBe("declined");
  });
  test("page: the form makes a waiting account and sends to the request-in page", async () => {
    const res = await form("/signup", { username: "cy", email: "", password: PASSWORD, note: "<b>a game</b>" });
    expect(res.status).toBe(303);
    expect(res.headers.get("location")).toBe("/signup/requested");
    expect(res.headers.get("set-cookie")).toBeNull();
    const page = await fetch(`${base}/signup/requested`).then((r) => r.text());
    expect(page).toContain("Your request is in.");
    const home = await fetch(`${base}/`, { headers: { cookie: admin } }).then((r) => r.text());
    expect(home).toContain("&lt;b&gt;a game&lt;/b&gt;");
    expect(home).not.toContain("<b>a game</b>");
  });
  test("an open invite link still lets a person straight in", async () => {
    const boss = getUserByName(app.db, "boss")!;
    const { token } = mintInvite(app.db, boss.id);
    const res = await fetch(`${base}/api/v1/users?invite=${encodeURIComponent(token)}`, {
      method: "POST",
      headers: { "content-type": "application/json", origin: ORIGIN },
      body: JSON.stringify({ username: "dee", password: PASSWORD, invite: token }),
    });
    expect(res.status).toBe(201);
  });
  test("open makes accounts at once; closed refuses even a request", async () => {
    setSignup(app.db, "open", "boot");
    expect((await api("eli")).status).toBe(201);
    setSignup(app.db, "closed", "boot");
    expect((await api("fay")).status).toBe(403);
    setSignup(app.db, "request", "boot");
  });
  test("the knob shows what each mode means", async () => {
    const page = await fetch(`${base}/admin/limits`, { headers: { cookie: admin } });
    const html = await page.text();
    expect(html).toContain("New accounts");
    expect(html).toContain("Anyone can ask for an account; an admin allows or declines each one.");
  });
});
@@ -74,14 +74,14 @@
test("reads open, esc changes nothing, a confirm closes the door", async () => {
  await h.open();
  expect(h.text()).toContain("signup: open");
  // picker, closed, then esc on the plan
  await h.press("s", "j", "j", "enter");
  await h.press("s", "j", "j", "j", "enter");
  expect(h.text()).toContain("from open to closed");
  await h.press("esc");
  expect(getSignup(forge.db)).toBe("open");
  // esc on the picker too
  await h.press("s", "esc");
  expect(getSignup(forge.db)).toBe("open");
  await h.press("s", "j", "j", "enter", "enter");
  await h.press("s", "j", "j", "j", "enter", "enter");
  expect(getSignup(forge.db)).toBe("closed");
  expect(signupClosed({ db: forge.db } as never)).toBe(true);
  expect(h.text()).toContain("signup: closed");
@@ -100,7 +100,7 @@
test("a non-admin and an admin agent are never offered s", async () => {
    const h = boot(who);
    await h.open();
    expect(h.text()).not.toContain("signup:");
    await h.press("s", "j", "j", "enter", "enter");
    await h.press("s", "j", "j", "j", "enter", "enter");
    expect(getSignup(forge.db)).toBe("open");
    h.stop();
    const user = getUserByName(forge.db, who)!;
		@@ -193,7 +193,7 @@ bytes in `tools/list`. After changing a tool run `bun scripts/mcp-table.ts`;
193	193	\| `sessions` \| `list`, `end`, `end_idle`, `signins`, `shells` \| Where you are signed in: your tokens and browsers, never a secret; `username` for a person as owner; action end + id signs a browser out \| 385 \|
194	194	\| `sever` \| — \| Unlink a spawned forge from its parent (owner of its `forge` repo only) \| 214 \|
195	195	\| `share` \| — \| Share a feed item: no `to` tells the app's crew and owners, else followers; budgeted \| 258 \|
196		\| `signup` \| — \| Sign-ups: open (default); invite lets in only a person with an open invite link; closed refuses every new account \| 281 \|
	196	\| `signup` \| — \| Sign-ups: open (default); invite lets in only a person with an open invite link; closed refuses every new account \| 291 \|
197	197	\| `sizes` \| — \| A child forge's sizes: small, medium and large, each with CPU, memory and disk \| 196 \|
198	198	\| `snapshot_now` \| — \| Take a snapshot now, as Backups does (admin) \| 133 \|
199	199	\| `spawn` \| — \| Spawn a child forge \| 824 \|
		@@ -130,6 +130,8 @@ Machine routes are not pages and have no entry: `/audit.csv`,
130	130	- `/login` — `http/server.ts` (`signinAlias`) · the address people type to sign in · it is `/signin`, keeping a same-origin `next` · none (308, no page of its own).
131	131	- `/sign-in` — `http/server.ts` (`signinAlias`) · the same, hyphenated · it is `/signin` · none (308, no page of its own).
132	132	- `/signup` — `pages/site.ts` · make an account · `/signup` passkey flow (`signup-passkey.ts`) · colours 3 (file).
	133	- `/signup/requested` — `pages/site.ts` · tells a stranger the request is sent · `/signin` · colours 3 (file).
	134	- `/signup/welcome` — `pages/site.ts` · tells a person their request was allowed · `/` · colours 3 (file).
133	135	- `/verify` — `pages/site.ts` · confirm an email address · none · colours 3 (file).
134	136	- `/recover` — `pages/passkeys.ts` · get back in without a password · `/settings/passkeys` · none seen.
135	137	- `/settings` — `pages/account.ts` · my account · the rest of settings · colour 1.
		@@ -0,0 +1,11 @@
	1	# Request access
	2
	3	One setting, New accounts, on `/admin/limits`: `open` (anyone, at once), `request` (anyone may ask; an admin allows), `invite` (invite links only), `closed` (nobody, invite links included). Invite links work in every mode except `closed`. A forge that stored `closed` when this shipped now stores `request` (a migration, kept in the setting's history); a new forge still starts at `invite`.
	4
	5	A stranger opens `/signup` and gives a name, a password or passkey, and an optional "What do you want to build?". The account is made waiting: it is held suspended, so no session, token or key works. They land on "Your request is in…". Signing in later with the right password says where the request stands (in, or declined, politely) and makes no session. After Allow, the first sign-in says "You're in." once.
	6
	7	By API: `POST /api/v1/users` with `username`, `password`, optional `note` and `from` (which forge or agent asks) answers `202 {"state":"waiting"}`.
	8
	9	The admin sees "Waiting" (name, note, when, from where) with Allow and Decline on home ("Needs you") and at the top of `/settings/people`, and gets a line on the phone through the notify URL when someone asks. Decline keeps the record. A second tap on an answered request changes nothing.
	10
	11	Not done here: new-account quotas for `open`, and the agent start call landing as a request (#10912 is not in the code yet).
		@@ -12,6 +12,7 @@
12	12
13	13	import type { Database } from "bun:sqlite";
14	14	import type { App } from "../app.ts";
	15	import { waitingRequests } from "../core/account_requests.ts";
15	16	import { getAppByRepo } from "../core/apps.ts";
16	17	import { listTeams, retireOrg, soleOwnedOrgs } from "../core/orgs.ts";
17	18	import { appsRuntime } from "../apps/runtime.ts";
		@@ -314,6 +315,22 @@ export function verifyAccount(
314	315	return ok(user);
315	316	}
316	317
	318	/**
	319	* One line per person waiting for an account (#10928), for an admin's phone.
	320	* The line names no one's note; Allow and Decline are on home and on the
	321	* people page, one tap from the link.
	322	*/
	323	export function requestLines(
	324	db: Database,
	325	user: User,
	326	): { id: string; line: string; items: readonly string[] }[] {
	327	if (!user.isAdmin \|\| user.kind !== "user") return [];
	328	return waitingRequests(db).map((r) => {
	329	const id = `request:${r.username}`;
	330	return { id, line: `${r.username} asked for an account: Allow or Decline`, items: [id] };
	331	});
	332	}
	333
317	334	/** An account counts as new for this long after it is made. */
318	335	export const NEW_FOR_MS = 7 * 24 * 3_600_000;
319	336
		@@ -329,9 +346,11 @@ export function newAccountLines(
329	346	): { id: string; line: string; items: readonly string[] }[] {
330	347	if (!user.isAdmin \|\| user.kind !== "user") return [];
331	348	const since = new Date(now - NEW_FOR_MS).toISOString();
	349	const asking = new Set(waitingRequests(db).map((r) => r.username));
332	350	return readAccounts(db)
333	351	.filter(
334	352	(a) =>
	353	!asking.has(a.username) &&
335	354	a.kind === "user" &&
336	355	!a.isAdmin &&
337	356	a.removedAt === null &&
		@@ -0,0 +1,77 @@
	1	/**
	2	* Requests for an account (#10928): an admin who is a person sees who is
	3	* waiting, and allows or declines each. Anyone else is told `not_found`,
	4	* like every admin surface. Allow lifts the hold on the account at once;
	5	* decline keeps the record. A second tap on a settled request changes
	6	* nothing and says so (`settled`).
	7	*/
	8
	9	import type { App } from "../app.ts";
	10	import {
	11	decideRequest,
	12	requestOf,
	13	waitingRequests,
	14	type AccountRequest,
	15	} from "../core/account_requests.ts";
	16	import { getUserByName, passwordMatches, type User } from "../core/users.ts";
	17	import { err, ok, type Result } from "../kernel/result.ts";
	18
	19	export type RequestError = "not_found" \| "settled";
	20
	21	function admin(actor: User \| undefined): Result<User, "not_found"> {
	22	return actor?.isAdmin === true && actor.kind === "user" ? ok(actor) : err("not_found");
	23	}
	24
	25	export function listWaiting(app: App, actor: User \| undefined): Result<AccountRequest[], "not_found"> {
	26	const who = admin(actor);
	27	return who.ok ? ok(waitingRequests(app.db)) : who;
	28	}
	29
	30	function decide(
	31	app: App,
	32	actor: User \| undefined,
	33	username: string,
	34	to: "allowed" \| "declined",
	35	): Result<AccountRequest, RequestError> {
	36	const who = admin(actor);
	37	if (!who.ok) return who;
	38	const user = getUserByName(app.db, username);
	39	if (user === undefined \|\| requestOf(app.db, user.id) === undefined) return err("not_found");
	40	if (!decideRequest(app.db, user.id, to, who.value.id, new Date().toISOString())) return err("settled");
	41	app.bus.append({
	42	kind: to === "allowed" ? "account.allowed" : "account.declined",
	43	actorId: who.value.id,
	44	payload: { username: user.username },
	45	});
	46	return ok(requestOf(app.db, user.id)!);
	47	}
	48
	49	export const allowRequest = (app: App, actor: User \| undefined, username: string) =>
	50	decide(app, actor, username, "allowed");
	51
	52	export const declineRequest = (app: App, actor: User \| undefined, username: string) =>
	53	decide(app, actor, username, "declined");
	54
	55	/**
	56	* The answer to a person who signed in with the right password to an account
	57	* that has not been allowed (waiting or declined): its request, so the page
	58	* can say where it stands. No session is made, so it can do nothing else.
	59	* Asked only after the throttled password check refused, so a guess costs
	60	* what it always did.
	61	*/
	62	export async function pendingFor(
	63	app: App,
	64	username: string,
	65	password: string,
	66	): Promise<AccountRequest \| undefined> {
	67	const row = app.db
	68	.query<{ id: string; password_hash: string }, [string]>(
	69	"SELECT id, password_hash FROM user WHERE username = ?1 COLLATE NOCASE AND kind = 'user' AND is_agent = 0",
	70	)
	71	.get(username);
	72	if (row === null \|\| row.password_hash === "") return undefined;
	73	const asked = requestOf(app.db, row.id);
	74	if (asked === undefined \|\| asked.state === "allowed") return undefined;
	75	const valid = await passwordMatches(password, row.password_hash);
		sentinelcrew 5d ago HIGH: this verify is unthrottled and runs even when the failure was the sign-in window refusing. It is a guessing oracle that bypasses the throttle, and it costs a second argon2 per request. Call it only when the failure was a plain bad password, and count it in the same windows. The early return for a missing user is also faster than a verify, so it leaks which accounts exist.
	76	return valid ? asked : undefined;
	77	}
		@@ -43,6 +43,7 @@ import {
43	43	} from "../core/users.ts";
44	44	import { err, ok, type Result } from "../kernel/result.ts";
45	45	import { requireUser } from "./access.ts";
	46	import { requestOf } from "../core/account_requests.ts";
46	47	import type { SignupSlot } from "./signup-window.ts";
47	48
48	49	export interface SignUpInput {
		@@ -52,6 +53,8 @@ export interface SignUpInput {
52	53	password: string;
53	54	/** The Turnstile token the browser's widget gave; read only when a secret is set. */
54	55	humanToken?: string;
	56	/** While signup is `request`: what they want to build (optional, bounded). */
	57	note?: string;
55	58	}
56	59
57	60	export type SignUpError =
		@@ -120,6 +123,8 @@ export async function signUp(
120	123	/** The token of the invite link the person came by (`core/invites.ts`). */
121	124	invite?: string \| undefined;
122	125	address?: string \| undefined;
	126	/** Where an ask came from when it is not a person at the page: "api", "agent", a forge. */
	127	via?: string \| undefined;
123	128	},
124	129	): Promise<Result<User, SignUpError>> {
125	130	// A username and a password is a way in that stays, beside the passkey
		@@ -148,6 +153,8 @@ export async function signUp(
148	153	origin: "signup",
149	154	slot: from.slot,
150	155	invite: from.invite,
	156	note: input.note,
	157	via: from.via ?? "web",
151	158	});
152	159	if (!created.ok) return created;
153	160	app.bus.append({
		@@ -158,6 +165,7 @@ export async function signUp(
158	165	...(from.address === undefined ? {} : { address: from.address }),
159	166	},
160	167	});
	168	announceRequest(app, created.value.id);
161	169	auditInvite(app, created.value.id);
162	170	// The address is proven by the link it is sent; until then nothing it
163	171	// does may create or cost.
		@@ -172,6 +180,7 @@ export interface PasskeySignUpInput {
172	180	passkey: Credential;
173	181	passkeyName: string;
174	182	humanToken?: string;
	183	note?: string;
175	184	}
176	185
177	186	/**
		@@ -184,7 +193,7 @@ export interface PasskeySignUpInput {
184	193	export async function signUpWithPasskey(
185	194	app: App,
186	195	input: PasskeySignUpInput,
187		from: { slot: SignupSlot; invite?: string \| undefined; address?: string \| undefined },
	196	from: { slot: SignupSlot; invite?: string \| undefined; address?: string \| undefined; via?: string \| undefined },
188	197	): Promise<Result<User, SignUpError \| "passkey_taken">> {
189	198	if (signupClosed(app, from.invite)) return err("signup_closed");
190	199	const secret = app.config.turnstileSecret;
		@@ -202,6 +211,8 @@ export async function signUpWithPasskey(
202	211	origin: "passkey",
203	212	slot: from.slot,
204	213	invite: from.invite,
	214	note: input.note,
	215	via: from.via ?? "web",
205	216	});
206	217	if (!created.ok) return created;
207	218	const kept = addPasskey(app.db, created.value.id, input.passkeyName, input.passkey);
		@@ -217,12 +228,26 @@ export async function signUpWithPasskey(
217	228	...(from.address === undefined ? {} : { address: from.address }),
218	229	},
219	230	});
	231	announceRequest(app, created.value.id);
220	232	auditInvite(app, created.value.id);
221	233	// As on the password path: no address given, no link to send.
222	234	if (email !== "") await welcome(app, created.value);
223	235	return created;
224	236	}
225	237
	238	/** Whether this account is a request that has not been allowed (waiting or declined). */
	239	export function isWaiting(app: App, userId: string): boolean {
	240	const asked = requestOf(app.db, userId);
	241	return asked !== undefined && asked.state !== "allowed";
	242	}
	243
	244	/** A request is an event, so the admin's home and phone hear of it at once. The note stays in the table. */
	245	function announceRequest(app: App, userId: string): void {
	246	const asked = requestOf(app.db, userId);
	247	if (asked?.state !== "waiting") return;
	248	app.bus.append({ kind: "account.requested", actorId: userId, payload: { via: asked.via } });
	249	}
	250
226	251	/** Using an invite link is an event: the invite's id and who it let in, never its token. */
227	252	function auditInvite(app: App, userId: string): void {
228	253	const inviteId = inviteSpentBy(app.db, userId);
		@@ -4,11 +4,12 @@ export const route: Route = {
4	4	method: "post",
5	5	path: "/api/v1/users",
6	6	summary:
7		"Sign up: answers 201 with the new account { id, username, displayName, isAdmin, commitEmail }, never the admin; `email` is optional; `invite` is an invite link's token, `turnstile_token` the human check when the forge asks for one; refused from another origin with 403 forbidden",
	7	"Sign up: answers 201 with the new account { id, username, displayName, isAdmin, commitEmail }, never the admin, or, while the forge takes requests (signup `request`), 202 { state: waiting }: the account waits until an admin allows it, and `note` (what you want to build) and `from` (which forge or agent asks) ride along; `email` is optional; `invite` is an invite link's token, `turnstile_token` the human check when the forge asks for one; refused from another origin with 403 forbidden",
8	8	auth: false,
9	9	role: "anonymous",
10	10	status: 201,
11		body: { username: "string", email: "string", password: "string", invite: "string", turnstile_token: "string" },
	11	alsoStatus: [202],
	12	body: { username: "string", email: "string", password: "string", note: "string", from: "string", invite: "string", turnstile_token: "string" },
12	13	refusals: {
13	14	rate_limited: "429, too many sign-ups; retry-after says when",
14	15	too_large: "413, the body is over the limit for a stranger's",
		@@ -0,0 +1,112 @@
	1	/**
	2	* Requests for an account (`signup` = `request`, #10928). A request is a row
	3	* beside a user who is held suspended while it waits or is declined; Allow
	4	* lifts the suspension, Decline keeps the record. Plain data in and out: no
	5	* authz here (`actions/requests.ts` decides who may).
	6	*/
	7
	8	import type { Database } from "bun:sqlite";
	9
	10	export type RequestState = "waiting" \| "allowed" \| "declined";
	11
	12	export interface AccountRequest {
	13	readonly userId: string;
	14	readonly username: string;
	15	readonly state: RequestState;
	16	readonly note: string;
	17	/** Where it came from: "web", "api", "agent" or a forge's name. */
	18	readonly via: string;
	19	readonly createdAt: string;
	20	readonly decidedAt: string \| null;
	21	readonly greetedAt: string \| null;
	22	}
	23
	24	export const NOTE_MAX = 500;
	25	export const VIA_MAX = 80;
	26
	27	/** A note from a stranger: control characters gone, trimmed, bounded. */
	28	export function cleanNote(raw: unknown, max = NOTE_MAX): string {
	29	if (typeof raw !== "string") return "";
	30	// eslint-disable-next-line no-control-regex
	31	return raw.replace(/[\u0000-\u0008\u000b-\u001f\u007f]/g, "").trim().slice(0, max);
	32	}
	33
	34	/** Record a request for a user just made; call inside the transaction that makes it. */
	35	export function openRequest(db: Database, userId: string, note: string, via: string, at: string): void {
	36	db.query(
	37	"INSERT INTO account_request (user_id, state, note, via, created_at) VALUES (?1, 'waiting', ?2, ?3, ?4)",
	38	).run(userId, cleanNote(note), cleanNote(via, VIA_MAX), at);
	39	db.query("UPDATE user SET suspended_at = ?2 WHERE id = ?1").run(userId, at);
	40	}
	41
	42	interface Row {
	43	user_id: string;
	44	username: string;
	45	state: RequestState;
	46	note: string;
	47	via: string;
	48	created_at: string;
	49	decided_at: string \| null;
	50	greeted_at: string \| null;
	51	}
	52
	53	const SELECT = `SELECT r.user_id, u.username, r.state, r.note, r.via, r.created_at, r.decided_at, r.greeted_at
	54	FROM account_request r JOIN user u ON u.id = r.user_id`;
	55
	56	const toRequest = (r: Row): AccountRequest => ({
	57	userId: r.user_id,
	58	username: r.username,
	59	state: r.state,
	60	note: r.note,
	61	via: r.via,
	62	createdAt: r.created_at,
	63	decidedAt: r.decided_at,
	64	greetedAt: r.greeted_at,
	65	});
	66
	67	export function requestOf(db: Database, userId: string): AccountRequest \| undefined {
	68	const row = db.query<Row, [string]>(`${SELECT} WHERE r.user_id = ?1`).get(userId);
	69	return row === null ? undefined : toRequest(row);
	70	}
	71
	72	/** Those waiting, oldest first, at most `limit`. */
	73	export function waitingRequests(db: Database, limit = 100): AccountRequest[] {
	74	return db
	75	.query<Row, [number]>(`${SELECT} WHERE r.state = 'waiting' ORDER BY r.created_at, r.user_id LIMIT ?1`)
	76	.all(Math.trunc(limit))
	77	.map(toRequest);
	78	}
	79
	80	export function waitingCount(db: Database): number {
	81	return db.query<{ n: number }, []>("SELECT COUNT(*) AS n FROM account_request WHERE state = 'waiting'").get()?.n ?? 0;
	82	}
	83
	84	/**
	85	* Settle a waiting request. Allow lifts the suspension; decline keeps it.
	86	* Only a waiting request changes: a second tap is a no-op (false).
	87	*/
	88	export function decideRequest(
	89	db: Database,
	90	userId: string,
	91	to: "allowed" \| "declined",
	92	by: string,
	93	at: string,
	94	): boolean {
	95	return db.transaction((): boolean => {
	96	const moved = db
	97	.query("UPDATE account_request SET state = ?2, decided_at = ?3, decided_by = ?4 WHERE user_id = ?1 AND state = 'waiting' RETURNING user_id")
	98	.all(userId, to, at, by);
	99	if (moved.length === 0) return false;
	100	if (to === "allowed") db.query("UPDATE user SET suspended_at = NULL WHERE id = ?1").run(userId);
	101	return true;
	102	})();
	103	}
	104
	105	/** The person has been told "You're in": true once. */
	106	export function greet(db: Database, userId: string, at: string): boolean {
	107	return (
	108	db
	109	.query("UPDATE account_request SET greeted_at = ?2 WHERE user_id = ?1 AND state = 'allowed' AND greeted_at IS NULL RETURNING user_id")
	110	.all(userId, at).length === 1
	111	);
	112	}
		@@ -156,6 +156,9 @@ const READER_KINDS: ReadonlySet<string> = new Set([
156	156	"telemetry.revoked",
157	157	"account.suspended",
158	158	"account.unsuspended",
	159	"account.requested",
	160	"account.allowed",
	161	"account.declined",
159	162	"org.retired",
160	163	"account.removed",
161	164	"branch.created",
		@@ -0,0 +1,1 @@
	1	595f52026600cc121defbdf9d4bb8bf23fb70a273a13963814dcf0d5180513b8