db8320f · 1beaab8
@@ -116,6 +116,7 @@
account; `src/auth/webauthn.ts` verifies, no dependency, `none` attestation).
The sign-in page's "Sign in with a passkey" gives the same HttpOnly session a
password does. The relying party is the address the browser used (or
`FORGE_URL`), so a passkey does not follow a forge to another hostname.
Sign-up is a username, an email address and a passkey (`/signup`, `src/web/pages/signup-passkey.ts`); the running server refuses a password-only sign-up on the form, `POST /api/v1/users` and the terminal (`passkeyOnlySignup`, set in `main.ts`). Accounts that already have a password still sign in. Two paths still make an account without a passkey and are the next step: the owner claim of a spawned forge (`web/pages/claim.ts`) and an admin's everyday account (`web/pages/everyday.ts`).
Your SSH key is your identity. A key the forge knows signs you straight in; any
other key browses public repos as a guest and can press `s` to sign in with a
@@ -49,6 +49,7 @@
export const GATE: readonly string[] = [
  "test/thoughts.test.ts",
  "test/triage.test.ts",
  "test/passkeys.test.ts",
  "test/signup-passkey.test.ts",
  "test/webauthn.test.ts",
  "test/chaos.test.ts",
  "test/flow-stage.test.ts",
@@ -5,6 +5,8 @@
import { emailChanged, welcome } from "./verify.ts";
import type { App } from "../app.ts";
import type { Credential } from "../auth/webauthn.ts";
import { addPasskey, findPasskey } from "../core/passkeys.ts";
import {
  addKey,
  deleteKey,
@@ -23,6 +25,7 @@
import {
  changePassword as rehash,
  cleanDisplayName,
  createUser,
  discardFreshUser,
  hasAnyUser,
  updateProfile as writeProfile,
  verifyPassword,
@@ -42,7 +45,16 @@
export interface SignUpInput {
  humanToken?: string;
}
export type SignUpError = CreateUserError | "human_check";
export type SignUpError = CreateUserError | "human_check" | "passkey_required";
/** What anyone is told at a door that still offers a password-only sign-up. */
export const PASSKEY_REQUIRED_MESSAGE =
  "New accounts sign up with a passkey and an email address. Open the sign-up page in a browser and choose \u201cCreate account with a passkey\u201d.";
/** A plausible address: one @, no spaces. The link sent to it is the proof. */
export function plausibleEmail(email: string): boolean {
  return email.length <= 254 && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
}
/** What a person is told when the check fails. */
export const HUMAN_CHECK_MESSAGE =
@@ -68,6 +80,11 @@
export async function signUp(
    door?: "terminal";
  } = {},
): Promise<Result<User, SignUpError>> {
  // Password sign-in stays for the accounts that have a password. It can go
  // when every such account has a passkey (Settings → Passkeys shows who is
  // left) and recovery without a password exists (#1618): then delete this
  // action's password path, `verifyPassword`'s doors and the password column.
  if (app.config.passkeyOnlySignup === true) return err("passkey_required");
  const secret = app.config.turnstileSecret;
  const bootstrap = from.door === "terminal" && !hasAnyUser(app.db);
  if (secret !== undefined && !bootstrap) {
@@ -93,6 +110,57 @@
export async function signUp(
  return created;
}
export interface PasskeySignUpInput {
  username: string;
  email: string;
  /** The verified key (`verifyRegistration`) and what its owner calls the device. */
  passkey: Credential;
  passkeyName: string;
  humanToken?: string;
}
/**
 * Sign up with a passkey and an email address: the one way a new account is
 * made. The account has no password. The key was verified by the caller
 * against a challenge this forge issued. The account is made, then its key;
 * a refused key takes the account back (the hash-free insert cannot yield to
 * another request, so no transaction spans the two calls).
 */
export async function signUpWithPasskey(
  app: App,
  input: PasskeySignUpInput,
  from: { address?: string | undefined } = {},
      
        sentinelcrew
        29d ago
        outdated
      
      No test covers this check. It is the only bot gate left on sign-up. Add a test in test/signup-passkey.test.ts with turnstileSecret set and a verifyHuman stub that refuses: /signup/passkey must answer 422 and leave no user row.
    
): Promise<Result<User, SignUpError | "passkey_taken">> {
  const secret = app.config.turnstileSecret;
  if (secret !== undefined) {
    const verify = app.config.verifyHuman ?? turnstileVerifier(secret);
    if (!(await verify(input.humanToken ?? "", from.address)))
      return err("human_check");
  }
  if (findPasskey(app.db, input.passkey.id)) return err("passkey_taken");
  const created = await createUser(app.db, {
    username: input.username,
    email: input.email,
    adminIfFirst: true,
  });
  if (!created.ok) return created;
  const kept = addPasskey(app.db, created.value.id, input.passkeyName, input.passkey);
      
        sentinelcrew
        29d ago
        outdated
      
      The account and its key are not made in one transaction: a crash between createUser and addPasskey leaves an account with no password and no key, which can never sign in. This path also has no test. Wrap the insert of the account and its key in app.db.transaction, or at least add a test that a reused credential makes no account (409, and the user count unchanged). Raw SQL here also skips core/users.ts; if a delete is still needed after the transaction, give it a function in core.
    
      
        sentinelcrew
        29d ago
        
      
      Low. If the process dies between createUser and addPasskey, it leaves an account with no password and no key. Nobody can sign in to it, but it still holds the username and the email. The doc comment now says so honestly. When there's room, a cheap fix is for problem() (or createUser) to treat a keyless, password-less, unproven account older than a few minutes as free and run discardFreshUser on it. This doesn't block the pull.
    
  if (!kept.ok) {
    discardFreshUser(app.db, created.value.id);
    return err("passkey_taken");
  }
  app.bus.append({
    kind: "user.created",
    actorId: created.value.id,
    payload: {
      via: "signup",
      ...(from.address === undefined ? {} : { address: from.address }),
    },
  });
  await welcome(app, created.value);
  return created;
}
/**
 * Mint a personal access token. Callers decide what credential may mint one
 * (a session or the password, never another token — no privilege
@@ -120,6 +120,14 @@
export interface ForgeConfig {
   * Undefined means the forge is running without SSH.
   */
  sshPort?: number;
  /**
   * Refuse every sign-up that would make an account with only a password:
   * the web form, `POST /api/v1/users` and the terminal answer in words,
   * and `signUpWithPasskey` is the one way in. `main.ts` sets it; the
   * library default is off so a test can still seed accounts with a
   * password.
   */
  passkeyOnlySignup?: boolean;
  /**
   * The Turnstile secret (`FORGE_TURNSTILE_SECRET`). Set, signup refuses a
   * missing or bad token before it hashes a password or makes an account.
@@ -145,6 +145,15 @@
export interface CreateUserInput {
  reservedSelf?: string;
}
/**
 * Undo an account made a moment ago whose sign-up did not finish (its key
 * was refused). Only an account with no password, no repository and no
 * other trace is removed; anything else stays.
 */
export function discardFreshUser(db: Database, userId: string): void {
  db.query("DELETE FROM user WHERE id = ?1 AND password_hash = ''").run(userId);
}
export async function createUser(
  db: Database,
  input: CreateUserInput,
@@ -142,6 +142,7 @@
import {
  deleteSshKey,
  deleteToken,
  HUMAN_CHECK_MESSAGE,
  PASSKEY_REQUIRED_MESSAGE,
  signUp,
  updateProfile,
} from "../actions/users.ts";
@@ -1135,6 +1136,8 @@
export function apiRoutes(router: Router<Handler>): void {
      },
      { address: clientAddress(ctx.request) },
    );
    if (!created.ok && created.error === "passkey_required")
      return apiError("passkey_required", 422, PASSKEY_REQUIRED_MESSAGE);
    if (!created.ok && created.error === "human_check")
      return apiError("human_check", 422, HUMAN_CHECK_MESSAGE);
    if (!created.ok) return json({ error: created.error }, 422);
@@ -5,6 +5,7 @@
 * verdict. Auth is resolved once per request and handed to handlers as data.
 */
import { signupOptions, signupPasskey } from "../web/pages/signup-passkey.ts";
import { TOOLBAR_NAME, toolbarResponse } from "../apps/toolbar.ts";
import { unsealReleased } from "../actions/sealed.ts";
import { accessPage } from "../web/pages/access.ts";
@@ -685,6 +686,8 @@
export function buildRouter(): Router<Handler> {
  router.add("POST", "/settings/passkeys/:id/delete", passkeyDelete);
  router.add("POST", "/signin/passkey/options", signinOptions);
  router.add("POST", "/signin/passkey", signinPasskey);
  router.add("POST", "/signup/passkey/options", signupOptions);
  router.add("POST", "/signup/passkey", signupPasskey);
  // The crew: a forge admin's section, hidden from everyone else.
  router.add("GET", "/settings/subscriptions", subscriptionsPage);
  router.add("POST", "/settings/subscriptions", subscriptionAdd);
@@ -195,6 +195,8 @@
const app = createApp({
  Number(process.env.FORGE_MAIL_DAILY) > 0
    ? { mailDailyCap: Number(process.env.FORGE_MAIL_DAILY) }
    : {}),
  // No door makes a password-only account (#1996).
  passkeyOnlySignup: true,
  // Signup asks Cloudflare Turnstile when its secret is set.
  ...(turnstileSecret === ""
    ? {}
@@ -815,6 +815,7 @@
export function slug(path: string): string {
const MESSAGES: Record<string, string> = {
  not_found: "not found",
  human_check: "we could not tell you are a person; sign up on the web page",
  passkey_required: "new accounts sign up with a passkey and an email address: open the sign-up page in a browser",
  unauthorized: "sign in first",
  forbidden: "you do not have permission",
  forbidden_owner: "you cannot create repos for that owner",
@@ -33,15 +33,15 @@
import { accountShell } from "./account.ts";
import { safeNext, sessionCookie, signinAllowed } from "./site.ts";
/** One-time challenges, one store per ceremony per forge. */
const stores = new WeakMap<App, { add: ReturnType<typeof challenges>; signin: ReturnType<typeof challenges> }>();
function store(app: App) {
const stores = new WeakMap<App, { add: ReturnType<typeof challenges>; signin: ReturnType<typeof challenges>; signup: ReturnType<typeof challenges> }>();
export function store(app: App) {
  let s = stores.get(app);
  if (!s) stores.set(app, (s = { add: challenges(), signin: challenges() }));
  if (!s) stores.set(app, (s = { add: challenges(), signin: challenges(), signup: challenges() }));
  return s;
}
/** What the browser must see as the relying party: the forge's public address. */
function relying(ctx: Ctx) {
export function relying(ctx: Ctx) {
  return { origin: ctx.url.origin, rpId: ctx.url.hostname };
}
@@ -65,7 +65,7 @@
export function passkeysPage(ctx: Ctx): Response {
      a password. Add one per device; each can be removed on its own.
    </p>
    ${keys.length === 0
      ? empty({ icon: "key", title: "No passkeys yet", note: "Add one to sign in without typing a password." })
      ? empty({ icon: "key", title: "No passkeys yet", note: "Your password still works; add a passkey now, as every new account starts with one." })
      : card(
          html`<div class="table-scroll">
            <table class="table" id="passkeys">
@@ -0,0 +1,101 @@
/**
 * Sign-up with a passkey: the browser asks for a challenge (after the name
 * and address are checked), makes the key, and posts it back; the account,
 * its email and its key are made together and the session cookie is the one
 * a password gives. Both steps are JSON, same-origin checked, rate-limited
 * per address; a challenge answers once.
 */
import { newChallenge, verifyRegistration } from "../../auth/webauthn.ts";
import { plausibleEmail, signUpWithPasskey, HUMAN_CHECK_MESSAGE } from "../../actions/users.ts";
import { createSession } from "../../core/sessions.ts";
import { getUserByName } from "../../core/users.ts";
import { isSafeName } from "../../git/guard.ts";
import { crossOrigin, type Ctx } from "../../http/context.ts";
import { STRANGER_MAX } from "../../http/limits.ts";
import { clientAddress } from "../../http/peer.ts";
import { boundedBody, json, str } from "../../http/respond.ts";
import { relying, store } from "./passkeys.ts";
import { safeNext, sessionCookie, signinAllowed } from "./site.ts";
const refuse = (status: number, message: string) =>
  json({ error: "refused", message }, status);
      
        sentinelcrew
        29d ago
        outdated
      
      This is a second challenge store beside the one in passkeys.ts, so each kind of challenge gets its own 10k-entry map. Consider adding a signup store next to signin in passkeys.ts's store, so the challenge logic lives in one place.
    
/** The words for each way a sign-up can fail, written for anyone. */
const WORDS: Record<string, string> = {
  invalid_username: "Usernames are letters, digits, dots and dashes.",
  username_taken: "That username is taken.",
  username_reserved: "That name is reserved.",
  email_taken: "That email already has an account.",
  invalid_email: "That does not look like an email address.",
  human_check: HUMAN_CHECK_MESSAGE,
  passkey_taken: "That passkey is already registered.",
};
/** Whether the name and address are fit to sign up with; else the words. */
function problem(ctx: Ctx, username: string, email: string): string | undefined {
  if (!isSafeName(username)) return WORDS.invalid_username;
  if (!plausibleEmail(email)) return WORDS.invalid_email;
  if (getUserByName(ctx.app.db, username)) return WORDS.username_taken;
  return undefined;
}
function guard(ctx: Ctx): Response | undefined {
  if (crossOrigin(ctx.request, ctx.url, ctx.app.log)) return refuse(403, "forbidden");
  const wait = signinAllowed(ctx, `signup:${clientAddress(ctx.request)}`);
  if (wait !== undefined)
    return json({ error: "rate_limited", message: `Too many attempts. Try again in ${wait}s.` }, 429, { "retry-after": String(wait) });
  return undefined;
}
// POST /signup/passkey/options — a challenge, once the name and address pass.
export async function signupOptions(ctx: Ctx): Promise<Response> {
  const denied = guard(ctx);
  if (denied) return denied;
  const data = await boundedBody(ctx.request, STRANGER_MAX);
  if (data === "too_large") return refuse(413, "payload too large");
  const username = str(data.username).trim();
  const email = str(data.email).trim();
  const bad = problem(ctx, username, email);
  if (bad) return refuse(422, bad);
  return json({
    challenge: store(ctx.app).signup.issue(),
    rpId: relying(ctx).rpId,
    rpName: "forge",
    user: { id: newChallenge(), name: username, displayName: username },
    exclude: [],
  });
}
// POST /signup/passkey — verify the key, make the account, start the session.
export async function signupPasskey(ctx: Ctx): Promise<Response> {
      
        sentinelcrew
        29d ago
        outdated
      
      This repeats relying(ctx) from passkeys.ts (rpId here, and origin/rpId again in signupPasskey). Export it and reuse it, so sign-in and sign-up cannot drift apart on which relying party they use (the README promises FORGE_URL too).
    
  const denied = guard(ctx);
  if (denied) return denied;
      
        sentinelcrew
        29d ago
        outdated
      
      The user handle is a random value that is thrown away. With residentKey: 'preferred' the authenticator stores it as the account's handle. Sign-in works today because it looks the key up by credential id, but this handle never matches the account. Low priority: use the new user's id, or a handle stored with the passkey.
    
  const data = await boundedBody(ctx.request, STRANGER_MAX);
  if (data === "too_large") return refuse(413, "payload too large");
  const username = str(data.username).trim();
  const email = str(data.email).trim();
  const bad = problem(ctx, username, email);
  if (bad) return refuse(422, bad);
  const challenge = str(data.challenge);
  if (!store(ctx.app).signup.consume(challenge))
    return refuse(400, "That request expired. Try again.");
  const made = await verifyRegistration(
    { clientDataJSON: str(data.clientDataJSON), attestationObject: str(data.attestationObject) },
    { challenge, ...relying(ctx) },
  );
  if (!made.ok) return refuse(400, "That passkey was not accepted.");
  const created = await signUpWithPasskey(
    ctx.app,
    { username, email, passkey: made, passkeyName: "Passkey", humanToken: str(data.humanToken) },
    { address: clientAddress(ctx.request) },
  );
  if (!created.ok)
    return refuse(created.error === "human_check" ? 422 : 409, WORDS[created.error] ?? "Sign-up did not work. Try again.");
  const session = createSession(ctx.app.db, created.value.id);
  return json(
    { ok: true, next: safeNext(ctx.url.searchParams.get("next")) ?? "/" },
    201,
    { "set-cookie": sessionCookie(session.token, session.expiresAt, ctx.url, ctx.app.config.url) },
  );
}
@@ -15,7 +15,7 @@
import { clientAddress } from "../../http/peer.ts";
import { verifyEmail } from "../../actions/verify.ts";
import { STRANGER_MAX } from "../../http/limits.ts";
import { createRepo } from "../../actions/repos.ts";
import { HUMAN_CHECK_MESSAGE, signUp } from "../../actions/users.ts";
import { HUMAN_CHECK_MESSAGE, PASSKEY_REQUIRED_MESSAGE, signUp } from "../../actions/users.ts";
import { listAssignedTo, type Issue } from "../../core/issues.ts";
import { joinMany } from "../../core/pulls.ts";
import { conflictsOf } from "../../crew/stale_asks.ts";
@@ -379,6 +379,10 @@
function authForm(
      </div>`,
  );
  // No door makes a password-only account: sign-up is a name, an address and
  // a passkey, made in the browser (`signup-passkey.ts`).
  const byPasskey = kind === "signup" && ctx.app.config.passkeyOnlySignup === true;
  const body = html`${throughEdge}
    <form method="post" action="${action}">
      ${formField({
@@ -407,22 +411,33 @@
function authForm(
          ...(errors.email ? { error: errors.email } : {}),
        }),
      )}
      ${formField({
        label: "Password",
        name: "password",
        type: "password",
        autocomplete: kind === "signin" ? "current-password" : "new-password",
        required: true,
        ...(kind === "signup"
          ? { minlength: 10, hint: "At least 10 characters." }
          : {}),
        ...(errors.password ? { error: errors.password } : {}),
      })}
      ${when(!byPasskey, () =>
        formField({
          label: "Password",
          name: "password",
          type: "password",
          autocomplete: kind === "signin" ? "current-password" : "new-password",
          required: true,
          ...(kind === "signup"
            ? { minlength: 10, hint: "At least 10 characters." }
            : {}),
          ...(errors.password ? { error: errors.password } : {}),
        }),
      )}
      ${when(
        kind === "signup" ? siteKey(ctx) : undefined,
        (key) =>
          html`<div class="cf-turnstile mb" data-sitekey="${key}"></div>`,
      )}
      ${when(
        byPasskey,
        () => html`<p class="muted small mb">
          A passkey signs you in with a fingerprint, face or device PIN; there
          is no password to remember.
        </p>
        <p class="error-note mb" id="passkey-signup-note" role="alert">${errors.password ?? ""}</p>
        <noscript><p class="muted small">Signing up needs JavaScript for the passkey.</p></noscript>`,
      )}
      ${when(
        errors.human,
        (message) => html`<p class="error mb" role="alert">${message}</p>`,
@@ -436,9 +451,11 @@
function authForm(
          </p>`,
      )}
      <div class="form-actions">
        ${btn(kind === "signin" ? "Sign in" : "Create account", {
          variant: "primary",
        })}
        ${byPasskey
          ? html`<button type="button" id="passkey-signup" class="btn" data-variant="primary">Create account with a passkey</button>`
          : btn(kind === "signin" ? "Sign in" : "Create account", {
              variant: "primary",
            })}
        <span class="spacer"></span>
        ${kind === "signin"
          ? btn("Need an account? Sign up", {
@@ -497,6 +514,7 @@
export function signupPage(ctx: Ctx): Response {
    title: "Sign up",
    body: authForm(ctx, "signup"),
    turnstile: siteKey(ctx) !== undefined,
    ...(ctx.app.config.passkeyOnlySignup === true ? { scriptJs: passkeyJs } : {}),
  });
}
@@ -628,6 +646,7 @@
export async function signupSubmit(ctx: Ctx): Promise<Response> {
      email_taken: { email: "That email already has an account." },
      weak_password: { password: "Passwords need at least 10 characters." },
      human_check: { human: HUMAN_CHECK_MESSAGE },
      passkey_required: { human: PASSKEY_REQUIRED_MESSAGE },
    }[created.error] ?? { username: "Something went wrong." };
    return page(
      {
@@ -635,6 +654,7 @@
export async function signupSubmit(ctx: Ctx): Promise<Response> {
        title: "Sign up",
        body: authForm(ctx, "signup", { values: { username, email }, errors }),
        turnstile: siteKey(ctx) !== undefined,
        ...(ctx.app.config.passkeyOnlySignup === true ? { scriptJs: passkeyJs } : {}),
      },
      422,
    );
@@ -72,6 +72,30 @@
export const passkeyJs = /* js */ `
      });
    }).then(function () { location.reload(); });
  });
  wire('passkey-signup', function () {
    function val(n) { var el = doc.querySelector('[name=' + n + ']'); return el ? el.value : ''; }
    var who = { username: val('username'), email: val('email') };
    return post('/signup/passkey/options', who).then(function (o) {
      return navigator.credentials.create({ publicKey: {
        challenge: bytes(o.challenge),
        rp: { id: o.rpId, name: o.rpName },
        user: { id: bytes(o.user.id), name: o.user.name, displayName: o.user.displayName },
        pubKeyCredParams: [{ type: 'public-key', alg: -7 }, { type: 'public-key', alg: -257 }],
        authenticatorSelection: { residentKey: 'preferred', userVerification: 'required' },
        attestation: 'none',
        timeout: 120000
      } }).then(function (cred) {
        return post('/signup/passkey' + location.search, {
          username: who.username,
          email: who.email,
          humanToken: val('cf-turnstile-response'),
          challenge: o.challenge,
          clientDataJSON: text(cred.response.clientDataJSON),
          attestationObject: text(cred.response.attestationObject)
        });
      });
    }).then(function (r) { location.href = r.next; });
  });
  wire('passkey-signin', function () {
    return post('/signin/passkey/options').then(function (o) {
      return navigator.credentials.get({ publicKey: {
@@ -0,0 +1,249 @@
/**
 * Sign-up takes a passkey and an email, and no door makes a password-only
 * account: the web form, the API and the terminal each refuse in plain words,
 * an account signed up with a passkey has its email and its key, and an
 * account that already has a password still signs in.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { b64u } from "../src/auth/webauthn.ts";
import { signUp } from "../src/actions/users.ts";
import { createUser } from "../src/core/users.ts";
import { errorText } from "../src/tui/screens/common.ts";
import { serve, type Servers } from "../src/http/server.ts";
const te = new TextEncoder();
const sha = async (d: Uint8Array<ArrayBuffer>) => new Uint8Array(await crypto.subtle.digest("SHA-256", d));
const cat = (...p: Uint8Array[]): Uint8Array<ArrayBuffer> => { const o: Uint8Array<ArrayBuffer> = new Uint8Array(p.reduce((n, a) => n + a.length, 0)); let i = 0; for (const a of p) { o.set(a, i); i += a.length; } return o; };
function head(major: number, n: number): Uint8Array {
  if (n < 24) return Uint8Array.of((major << 5) | n);
  if (n < 256) return Uint8Array.of((major << 5) | 24, n);
  return Uint8Array.of((major << 5) | 25, n >> 8, n & 255);
}
type V = number | string | Uint8Array | [V, V][];
function enc(v: V): Uint8Array {
  if (typeof v === "number") return v >= 0 ? head(0, v) : head(1, -1 - v);
  if (typeof v === "string") { const b = te.encode(v); return cat(head(3, b.length), b); }
  if (v instanceof Uint8Array) return cat(head(2, v.length), v);
  return cat(head(5, v.length), ...v.flatMap(([k, x]) => [enc(k), enc(x)]));
}
function rawToDer(raw: Uint8Array): Uint8Array<ArrayBuffer> {
  const int = (b: Uint8Array) => { let i = 0; while (i < b.length - 1 && b[i] === 0) i++; b = b.subarray(i); if (b[0]! & 0x80) b = cat(Uint8Array.of(0), b); return cat(Uint8Array.of(2, b.length), b); };
  const body = cat(int(raw.subarray(0, 32)), int(raw.subarray(32)));
  return cat(Uint8Array.of(0x30, body.length), body);
}
async function device(origin: string, rp: string) {
  const pair = (await crypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, ["sign"])) as CryptoKeyPair;
  const jwk = await crypto.subtle.exportKey("jwk", pair.publicKey);
  const unb = (s: string) => new Uint8Array(Buffer.from(s, "base64url"));
  const cose: [number, V][] = [[1, 2], [3, -7], [-1, 1], [-2, unb(jwk.x!)], [-3, unb(jwk.y!)]];
  const id = crypto.getRandomValues(new Uint8Array(32));
  let count = 0;
  const cd = (type: string, challenge: string) => te.encode(JSON.stringify({ type, challenge, origin }));
  const counter = (n: number) => Uint8Array.of(n >>> 24, (n >>> 16) & 255, (n >>> 8) & 255, n & 255);
  return {
    credId: b64u(id),
    async create(challenge: string) {
      const authData = cat(await sha(te.encode(rp)), Uint8Array.of(0x45), counter(0), new Uint8Array(16), Uint8Array.of(0, id.length), id, enc(cose as V));
      return { clientDataJSON: b64u(cd("webauthn.create", challenge)), attestationObject: b64u(enc([["fmt", "none"], ["attStmt", []], ["authData", authData]])) };
    },
    async get(challenge: string) {
      const clientData = cd("webauthn.get", challenge);
      const authData = cat(await sha(te.encode(rp)), Uint8Array.of(0x05), counter(++count));
      const sig = rawToDer(new Uint8Array(await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, pair.privateKey, cat(authData, await sha(clientData)))));
      return { id: b64u(id), clientDataJSON: b64u(clientData), authenticatorData: b64u(authData), signature: b64u(sig) };
    },
  };
}
describe("passkey sign-up", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  const origin = () => new URL(base).origin;
  const rp = () => new URL(base).hostname;
  const post = (path: string, body: unknown) =>
    fetch(`${base}${path}`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body), redirect: "manual" });
  async function signUpWith(d: Awaited<ReturnType<typeof device>>, username: string, email: string) {
    const o = (await (await post("/signup/passkey/options", { username, email })).json()) as any;
    return post("/signup/passkey", { username, email, challenge: o.challenge, ...(await d.create(o.challenge)) });
  }
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-signup-passkey-"));
    app = createApp({ dataDir, port: 0, passkeyOnlySignup: true });
    servers = await serve(app);
    base = servers.url;
    await createUser(app.db, { username: "olive", email: "[email protected]", password: "olive-password-1", trusted: true });
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("a passkey and an email make the account, its key and a session", async () => {
    const d = await device(origin(), rp());
    const res = await signUpWith(d, "nova", "[email protected]");
    expect(res.status).toBe(201);
    const set = res.headers.get("set-cookie")!;
    expect(set).toContain("forge_session=");
    expect(set).toContain("HttpOnly");
    const user = app.db.query<{ id: string; email: string; password_hash: string }, []>("SELECT * FROM user WHERE username = 'nova'").get()!;
    expect(user.email).toBe("[email protected]");
    expect(user.password_hash).toBe("");
    const key = app.db.query<{ credential_id: string }, [string]>("SELECT credential_id FROM passkey WHERE user_id = ?1").all(user.id);
    expect(key.map((k) => k.credential_id)).toEqual([d.credId]);
    const mine = await fetch(`${base}/settings/passkeys`, { headers: { cookie: set.split(";")[0]! } });
    expect(mine.status).toBe(200);
    // And the key signs back in.
    const o = (await (await post("/signin/passkey/options", {})).json()) as any;
    const back = await post("/signin/passkey", { challenge: o.challenge, ...(await d.get(o.challenge)) });
    expect(back.status).toBe(200);
  });
  test("a credential already registered makes no second account", async () => {
    const d = await device(origin(), rp());
    expect((await signUpWith(d, "reuse1", "[email protected]")).status).toBe(201);
    const before = app.db.query<{ n: number }, []>("SELECT count(*) AS n FROM user").get()!.n;
    const again = await signUpWith(d, "reuse2", "[email protected]");
    expect(again.status).toBe(409);
    expect(again.headers.get("set-cookie")).toBeNull();
    expect(((await again.json()) as any).message).toContain("already registered");
    expect(app.db.query<{ n: number }, []>("SELECT count(*) AS n FROM user").get()!.n).toBe(before);
    expect(app.db.query("SELECT 1 FROM user WHERE username = 'reuse2'").get()).toBeNull();
  });
  test("?next= lands on a safe path; an off-site one falls back to /", async () => {
    for (const [i, [qs, want]] of ([["?next=/settings", "/settings"], ["?next=https://evil.example/", "/"], ["?next=//evil.example", "/"]] as const).entries()) {
      const d = await device(origin(), rp());
      const name = `nexty${i}`;
      const o = (await (await post("/signup/passkey/options", { username: name, email: `${name}@f.dev` })).json()) as any;
      const res = await post(`/signup/passkey${qs}`, { username: name, email: `${name}@f.dev`, challenge: o.challenge, ...(await d.create(o.challenge)) });
      expect(res.status).toBe(201);
      expect(((await res.json()) as any).next).toBe(want);
    }
  });
  test("a bad name, a bad address, a taken name or a replayed challenge makes nothing", async () => {
    const bad = await post("/signup/passkey/options", { username: "x y", email: "[email protected]" });
    expect(bad.status).toBe(422);
    expect(((await bad.json()) as any).message).toContain("Usernames");
    const mail = await post("/signup/passkey/options", { username: "zed", email: "not-an-address" });
    expect(mail.status).toBe(422);
    const taken = await post("/signup/passkey/options", { username: "olive", email: "[email protected]" });
    expect(taken.status).toBe(422);
    const d = await device(origin(), rp());
    const o = (await (await post("/signup/passkey/options", { username: "zed", email: "[email protected]" })).json()) as any;
    const made = await d.create(o.challenge);
    expect((await post("/signup/passkey", { username: "zed", email: "[email protected]", challenge: o.challenge, ...made })).status).toBe(201);
    const replay = await post("/signup/passkey", { username: "zed2", email: "[email protected]", challenge: o.challenge, ...made });
    expect(replay.status).toBe(400);
    expect(app.db.query("SELECT 1 FROM user WHERE username = 'zed2'").get()).toBeNull();
    const cross = await fetch(`${base}/signup/passkey/options`, { method: "POST", headers: { "content-type": "application/json", origin: "https://evil.example" }, body: "{}" });
    expect(cross.status).toBe(403);
  });
  test("a password-only sign-up is refused on the web form, the API and the terminal", async () => {
    const before = app.db.query<{ n: number }, []>("SELECT count(*) AS n FROM user").get()!.n;
    const form = await fetch(`${base}/signup`, {
      method: "POST",
      body: new URLSearchParams({ username: "webby", email: "[email protected]", password: "webby-password-1" }),
      redirect: "manual",
    });
    expect(form.status).toBe(422);
    expect(form.headers.get("set-cookie")).toBeNull();
    const html = await form.text();
    expect(html).toContain("sign up with a passkey and an email address");
    expect(html).not.toContain('name="password"');
    const api = await post("/api/v1/users", { username: "apiy", email: "[email protected]", password: "apiy-password-1" });
    expect(api.status).toBe(422);
    const apiBody = (await api.json()) as any;
    expect(apiBody.error).toBe("passkey_required");
    expect(apiBody.message ?? JSON.stringify(apiBody)).toContain("passkey");
    // The terminal calls this action, bootstrap door included.
    for (const door of [undefined, "terminal" as const]) {
      const t = await signUp(app, { username: "termy", email: "[email protected]", password: "termy-password-1" }, door ? { door } : {});
      expect(t.ok).toBe(false);
      if (!t.ok) {
        expect(t.error).toBe("passkey_required");
        expect(errorText(t.error)).toContain("passkey");
      }
    }
    expect(app.db.query<{ n: number }, []>("SELECT count(*) AS n FROM user").get()!.n).toBe(before);
  });
  test("an existing password account still signs in, and is invited to add a passkey", async () => {
    const res = await post("/api/v1/sessions", { username: "olive", password: "olive-password-1" });
    expect(res.status).toBe(201);
    const form = await fetch(`${base}/signin`, {
      method: "POST",
      body: new URLSearchParams({ username: "olive", password: "olive-password-1" }),
      redirect: "manual",
    });
    const cookie = (form.headers.get("set-cookie") ?? "").split(";")[0]!;
    expect(cookie).toContain("forge_session=");
    const page = await (await fetch(`${base}/settings/passkeys`, { headers: { cookie } })).text();
    expect(page).toContain("Your password still works; add a passkey now");
  });
});
describe("passkey sign-up and the bot check", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let human = false;
  const post = (path: string, body: unknown) =>
    fetch(`${base}${path}`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body), redirect: "manual" });
  async function attempt(username: string) {
    const d = await device(new URL(base).origin, new URL(base).hostname);
    const email = `${username}@f.dev`;
    const o = (await (await post("/signup/passkey/options", { username, email })).json()) as any;
    return post("/signup/passkey", { username, email, humanToken: "t", challenge: o.challenge, ...(await d.create(o.challenge)) });
  }
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-signup-human-"));
    app = createApp({
      dataDir,
      port: 0,
      passkeyOnlySignup: true,
      turnstileSecret: "secret",
      turnstileSiteKey: "site",
      verifyHuman: async () => human,
    });
    servers = await serve(app);
    base = servers.url;
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("a failed human check makes no account; a passed one does", async () => {
    human = false;
    const refused = await attempt("robot");
    expect(refused.status).toBe(422);
    expect(refused.headers.get("set-cookie")).toBeNull();
    expect(((await refused.json()) as any).message).toContain("could not tell you are a person");
    expect(app.db.query("SELECT 1 FROM user WHERE username = 'robot'").get()).toBeNull();
    human = true;
    expect((await attempt("person")).status).toBe(201);
    expect(app.db.query("SELECT 1 FROM user WHERE username = 'person'").get()).not.toBeNull();
  });
});
		@@ -116,6 +116,7 @@ account; `src/auth/webauthn.ts` verifies, no dependency, `none` attestation).
116	116	The sign-in page's "Sign in with a passkey" gives the same HttpOnly session a
117	117	password does. The relying party is the address the browser used (or
118	118	`FORGE_URL`), so a passkey does not follow a forge to another hostname.
	119	Sign-up is a username, an email address and a passkey (`/signup`, `src/web/pages/signup-passkey.ts`); the running server refuses a password-only sign-up on the form, `POST /api/v1/users` and the terminal (`passkeyOnlySignup`, set in `main.ts`). Accounts that already have a password still sign in. Two paths still make an account without a passkey and are the next step: the owner claim of a spawned forge (`web/pages/claim.ts`) and an admin's everyday account (`web/pages/everyday.ts`).
119	120
120	121	Your SSH key is your identity. A key the forge knows signs you straight in; any
121	122	other key browses public repos as a guest and can press `s` to sign in with a
		@@ -49,6 +49,7 @@ export const GATE: readonly string[] = [
49	49	"test/thoughts.test.ts",
50	50	"test/triage.test.ts",
51	51	"test/passkeys.test.ts",
	52	"test/signup-passkey.test.ts",
52	53	"test/webauthn.test.ts",
53	54	"test/chaos.test.ts",
54	55	"test/flow-stage.test.ts",
		@@ -5,6 +5,8 @@
5	5
6	6	import { emailChanged, welcome } from "./verify.ts";
7	7	import type { App } from "../app.ts";
	8	import type { Credential } from "../auth/webauthn.ts";
	9	import { addPasskey, findPasskey } from "../core/passkeys.ts";
8	10	import {
9	11	addKey,
10	12	deleteKey,
		@@ -23,6 +25,7 @@ import {
23	25	changePassword as rehash,
24	26	cleanDisplayName,
25	27	createUser,
	28	discardFreshUser,
26	29	hasAnyUser,
27	30	updateProfile as writeProfile,
28	31	verifyPassword,
		@@ -42,7 +45,16 @@ export interface SignUpInput {
42	45	humanToken?: string;
43	46	}
44	47
45		export type SignUpError = CreateUserError \| "human_check";
	48	export type SignUpError = CreateUserError \| "human_check" \| "passkey_required";
	49
	50	/** What anyone is told at a door that still offers a password-only sign-up. */
	51	export const PASSKEY_REQUIRED_MESSAGE =
	52	"New accounts sign up with a passkey and an email address. Open the sign-up page in a browser and choose \u201cCreate account with a passkey\u201d.";
	53
	54	/** A plausible address: one @, no spaces. The link sent to it is the proof. */
	55	export function plausibleEmail(email: string): boolean {
	56	return email.length <= 254 && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
	57	}
46	58
47	59	/** What a person is told when the check fails. */
48	60	export const HUMAN_CHECK_MESSAGE =
		@@ -68,6 +80,11 @@ export async function signUp(
68	80	door?: "terminal";
69	81	} = {},
70	82	): Promise<Result<User, SignUpError>> {
	83	// Password sign-in stays for the accounts that have a password. It can go
	84	// when every such account has a passkey (Settings → Passkeys shows who is
	85	// left) and recovery without a password exists (#1618): then delete this
	86	// action's password path, `verifyPassword`'s doors and the password column.
	87	if (app.config.passkeyOnlySignup === true) return err("passkey_required");
71	88	const secret = app.config.turnstileSecret;
72	89	const bootstrap = from.door === "terminal" && !hasAnyUser(app.db);
73	90	if (secret !== undefined && !bootstrap) {
		@@ -93,6 +110,57 @@ export async function signUp(
93	110	return created;
94	111	}
95	112
	113	export interface PasskeySignUpInput {
	114	username: string;
	115	email: string;
	116	/** The verified key (`verifyRegistration`) and what its owner calls the device. */
	117	passkey: Credential;
	118	passkeyName: string;
	119	humanToken?: string;
	120	}
	121
	122	/**
	123	* Sign up with a passkey and an email address: the one way a new account is
	124	* made. The account has no password. The key was verified by the caller
	125	* against a challenge this forge issued. The account is made, then its key;
	126	* a refused key takes the account back (the hash-free insert cannot yield to
	127	* another request, so no transaction spans the two calls).
	128	*/
	129	export async function signUpWithPasskey(
	130	app: App,
	131	input: PasskeySignUpInput,
	132	from: { address?: string \| undefined } = {},
		sentinelcrew 29d ago outdated No test covers this check. It is the only bot gate left on sign-up. Add a test in `test/signup-passkey.test.ts` with `turnstileSecret` set and a `verifyHuman` stub that refuses: `/signup/passkey` must answer 422 and leave no `user` row.
	133	): Promise<Result<User, SignUpError \| "passkey_taken">> {
	134	const secret = app.config.turnstileSecret;
	135	if (secret !== undefined) {
	136	const verify = app.config.verifyHuman ?? turnstileVerifier(secret);
	137	if (!(await verify(input.humanToken ?? "", from.address)))
	138	return err("human_check");
	139	}
	140	if (findPasskey(app.db, input.passkey.id)) return err("passkey_taken");
	141	const created = await createUser(app.db, {
	142	username: input.username,
	143	email: input.email,
	144	adminIfFirst: true,
	145	});
	146	if (!created.ok) return created;
	147	const kept = addPasskey(app.db, created.value.id, input.passkeyName, input.passkey);
		sentinelcrew 29d ago outdated The account and its key are not made in one transaction: a crash between `createUser` and `addPasskey` leaves an account with no password and no key, which can never sign in. This path also has no test. Wrap the insert of the account and its key in `app.db.transaction`, or at least add a test that a reused credential makes no account (409, and the user count unchanged). Raw SQL here also skips `core/users.ts`; if a delete is still needed after the transaction, give it a function in core. sentinelcrew 29d ago Low. If the process dies between `createUser` and `addPasskey`, it leaves an account with no password and no key. Nobody can sign in to it, but it still holds the username and the email. The doc comment now says so honestly. When there's room, a cheap fix is for `problem()` (or `createUser`) to treat a keyless, password-less, unproven account older than a few minutes as free and run `discardFreshUser` on it. This doesn't block the pull.
	148	if (!kept.ok) {
	149	discardFreshUser(app.db, created.value.id);
	150	return err("passkey_taken");
	151	}
	152	app.bus.append({
	153	kind: "user.created",
	154	actorId: created.value.id,
	155	payload: {
	156	via: "signup",
	157	...(from.address === undefined ? {} : { address: from.address }),
	158	},
	159	});
	160	await welcome(app, created.value);
	161	return created;
	162	}
	163
96	164	/**
97	165	* Mint a personal access token. Callers decide what credential may mint one
98	166	* (a session or the password, never another token — no privilege
		@@ -120,6 +120,14 @@ export interface ForgeConfig {
120	120	* Undefined means the forge is running without SSH.
121	121	*/
122	122	sshPort?: number;
	123	/**
	124	* Refuse every sign-up that would make an account with only a password:
	125	* the web form, `POST /api/v1/users` and the terminal answer in words,
	126	* and `signUpWithPasskey` is the one way in. `main.ts` sets it; the
	127	* library default is off so a test can still seed accounts with a
	128	* password.
	129	*/
	130	passkeyOnlySignup?: boolean;
123	131	/**
124	132	* The Turnstile secret (`FORGE_TURNSTILE_SECRET`). Set, signup refuses a
125	133	* missing or bad token before it hashes a password or makes an account.
		@@ -145,6 +145,15 @@ export interface CreateUserInput {
145	145	reservedSelf?: string;
146	146	}
147	147
	148	/**
	149	* Undo an account made a moment ago whose sign-up did not finish (its key
	150	* was refused). Only an account with no password, no repository and no
	151	* other trace is removed; anything else stays.
	152	*/
	153	export function discardFreshUser(db: Database, userId: string): void {
	154	db.query("DELETE FROM user WHERE id = ?1 AND password_hash = ''").run(userId);
	155	}
	156
148	157	export async function createUser(
149	158	db: Database,
150	159	input: CreateUserInput,
		@@ -142,6 +142,7 @@ import {
142	142	deleteSshKey,
143	143	deleteToken,
144	144	HUMAN_CHECK_MESSAGE,
	145	PASSKEY_REQUIRED_MESSAGE,
145	146	signUp,
146	147	updateProfile,
147	148	} from "../actions/users.ts";
		@@ -1135,6 +1136,8 @@ export function apiRoutes(router: Router<Handler>): void {
1135	1136	},
1136	1137	{ address: clientAddress(ctx.request) },
1137	1138	);
	1139	if (!created.ok && created.error === "passkey_required")
	1140	return apiError("passkey_required", 422, PASSKEY_REQUIRED_MESSAGE);
1138	1141	if (!created.ok && created.error === "human_check")
1139	1142	return apiError("human_check", 422, HUMAN_CHECK_MESSAGE);
1140	1143	if (!created.ok) return json({ error: created.error }, 422);
		@@ -5,6 +5,7 @@
5	5	* verdict. Auth is resolved once per request and handed to handlers as data.
6	6	*/
7	7
	8	import { signupOptions, signupPasskey } from "../web/pages/signup-passkey.ts";
8	9	import { TOOLBAR_NAME, toolbarResponse } from "../apps/toolbar.ts";
9	10	import { unsealReleased } from "../actions/sealed.ts";
10	11	import { accessPage } from "../web/pages/access.ts";
		@@ -685,6 +686,8 @@ export function buildRouter(): Router<Handler> {
685	686	router.add("POST", "/settings/passkeys/:id/delete", passkeyDelete);
686	687	router.add("POST", "/signin/passkey/options", signinOptions);
687	688	router.add("POST", "/signin/passkey", signinPasskey);
	689	router.add("POST", "/signup/passkey/options", signupOptions);
	690	router.add("POST", "/signup/passkey", signupPasskey);
688	691	// The crew: a forge admin's section, hidden from everyone else.
689	692	router.add("GET", "/settings/subscriptions", subscriptionsPage);
690	693	router.add("POST", "/settings/subscriptions", subscriptionAdd);
		@@ -195,6 +195,8 @@ const app = createApp({
195	195	Number(process.env.FORGE_MAIL_DAILY) > 0
196	196	? { mailDailyCap: Number(process.env.FORGE_MAIL_DAILY) }
197	197	: {}),
	198	// No door makes a password-only account (#1996).
	199	passkeyOnlySignup: true,
198	200	// Signup asks Cloudflare Turnstile when its secret is set.
199	201	...(turnstileSecret === ""
200	202	? {}
		@@ -815,6 +815,7 @@ export function slug(path: string): string {
815	815	const MESSAGES: Record<string, string> = {
816	816	not_found: "not found",
817	817	human_check: "we could not tell you are a person; sign up on the web page",
	818	passkey_required: "new accounts sign up with a passkey and an email address: open the sign-up page in a browser",
818	819	unauthorized: "sign in first",
819	820	forbidden: "you do not have permission",
820	821	forbidden_owner: "you cannot create repos for that owner",
		@@ -33,15 +33,15 @@ import { accountShell } from "./account.ts";
33	33	import { safeNext, sessionCookie, signinAllowed } from "./site.ts";
34	34
35	35	/** One-time challenges, one store per ceremony per forge. */
36		const stores = new WeakMap<App, { add: ReturnType<typeof challenges>; signin: ReturnType<typeof challenges> }>();
37		function store(app: App) {
	36	const stores = new WeakMap<App, { add: ReturnType<typeof challenges>; signin: ReturnType<typeof challenges>; signup: ReturnType<typeof challenges> }>();
	37	export function store(app: App) {
38	38	let s = stores.get(app);
39		if (!s) stores.set(app, (s = { add: challenges(), signin: challenges() }));
	39	if (!s) stores.set(app, (s = { add: challenges(), signin: challenges(), signup: challenges() }));
40	40	return s;
41	41	}
42	42
43	43	/** What the browser must see as the relying party: the forge's public address. */
44		function relying(ctx: Ctx) {
	44	export function relying(ctx: Ctx) {
45	45	return { origin: ctx.url.origin, rpId: ctx.url.hostname };
46	46	}
47	47
		@@ -65,7 +65,7 @@ export function passkeysPage(ctx: Ctx): Response {
65	65	a password. Add one per device; each can be removed on its own.
66	66	</p>
67	67	${keys.length === 0
68		? empty({ icon: "key", title: "No passkeys yet", note: "Add one to sign in without typing a password." })
	68	? empty({ icon: "key", title: "No passkeys yet", note: "Your password still works; add a passkey now, as every new account starts with one." })
69	69	: card(
70	70	html`<div class="table-scroll">
71	71	<table class="table" id="passkeys">