6178e90 · c5e39f1 · 046e6cd · 965cdbf · f031e2b · 1aecf60
@@ -129,7 +129,7 @@
to `/recover`: give the email on your account and, if it is verified, a link
that lasts 30 minutes and works once registers a new passkey and signs you in.
The relying party is the address the browser used (or
`FORGE_URL`), so a passkey does not follow a forge to another hostname.
Sign-up is a username, an email address and a passkey (`/signup`, `src/web/pages/signup-passkey.ts`); the running server refuses a password-only sign-up on the form, `POST /api/v1/users` and the terminal (`passkeyOnlySignup`, set in `main.ts`). Accounts that already have a password still sign in. Two paths still make an account without a passkey and are the next step: the owner claim of a spawned forge (`web/pages/claim.ts`) and an admin's everyday account (`web/pages/everyday.ts`).
Sign-up is a username, an email address and a passkey (`/signup`, `src/web/pages/signup-passkey.ts`); the running server refuses a password-only sign-up on the form, `POST /api/v1/users` and the terminal (`passkeyOnlySignup`, set in `main.ts`). Accounts that already have a password still sign in. The owner claim of a spawned forge (`/claim`, `web/pages/claim.ts`) and an admin's everyday account (`web/pages/everyday.ts`) make their account with a passkey too (`web/passkey-ceremony.ts`, challenges from `POST /claim/options` and `POST /settings/everyday/options`); neither reads a password, and without JavaScript the page says a passkey needs it. A claim post with no passkey is refused and does not spend the link.
Your SSH key is your identity. A key the forge knows signs you straight in; any
other key browses public repos as a guest and can press `s` to sign in with a
@@ -212,8 +212,8 @@
import {
  composerSubmit,
  tellSubmit,
} from "../web/studio/actions.ts";
import { everydayCreate, everydayKeep, everydaySwitch } from "../web/pages/everyday.ts";
import { claimFragmentPage, claimSubmit } from "../web/pages/claim.ts";
import { everydayCreate, everydayKeep, everydayOptions, everydaySwitch } from "../web/pages/everyday.ts";
import { claimFragmentPage, claimOptions, claimSubmit } from "../web/pages/claim.ts";
import { familyPage } from "../web/pages/family.ts";
import { forgeLinkSubmit, forgesPage } from "../web/pages/forges.ts";
import { newForgePage, newForgeSubmit } from "../web/pages/new-forge.ts";
@@ -593,6 +593,7 @@
export function buildRouter(): Router<Handler> {
  // A spawned child's claim link: GET shows, POST takes it (spawn/claim.ts).
  router.add("GET", "/claim", claimFragmentPage);
  router.add("POST", "/claim", claimSubmit);
  router.add("POST", "/claim/options", claimOptions);
  // "+ New forge": the spawn door as a page, any signed-in person (spawn/door.ts).
  router.add("GET", "/forges", forgesPage);
  router.add("GET", "/family", familyPage);
@@ -691,6 +692,7 @@
export function buildRouter(): Router<Handler> {
  router.add("POST", "/settings/password", passwordUpdate);
  // The everyday account: an admin's daily account, apart from admin (#596).
  router.add("POST", "/settings/everyday", everydayCreate);
  router.add("POST", "/settings/everyday/options", everydayOptions);
  router.add("POST", "/settings/everyday/switch", everydaySwitch);
  router.add("POST", "/settings/everyday/keep", everydayKeep);
  router.add("GET", "/settings/tokens", tokensPage);
@@ -53,6 +53,7 @@
import {
  field as uiField,
} from "../ui.ts";
import { everydayLine } from "./everyday.ts";
import { passkeyJs } from "../passkey-client.ts";
type Section = "profile" | "password" | "tokens" | "keys" | "passkeys";
@@ -222,11 +223,15 @@
function profileView(ctx: Ctx, values: ProfileForm): Html {
// GET /settings
export function accountPage(ctx: Ctx): Response {
  if (!ctx.auth.user) return signInFirst(ctx);
  const pair = everydayLine(ctx, ctx.auth.user);
  return accountShell(
    ctx,
    "profile",
    "Settings",
    html`${everydayLine(ctx, ctx.auth.user)}${profileView(ctx, currentProfile(ctx.auth.user))}${notifyView(ctx)}`,
    html`${pair}${profileView(ctx, currentProfile(ctx.auth.user))}${notifyView(ctx)}`,
    200,
    // The everyday form makes its account with a passkey (#1890).
    pair ? passkeyJs : undefined,
  );
}
@@ -2,8 +2,9 @@
 * `/claim`: the page a spawned child's link opens (`spawn/claim.ts`).
 * The link is `/claim#<token>`, so the secret never leaves the browser in a
 * request line. The path: the person a forge was made for opens the link they were sent,
 * reads who will be able to see it, makes their account, and lands in
 * their forge as its admin. The GET only shows the form — a link unfurled
 * reads who will be able to see it, makes their account with a passkey
 * (`passkey-ceremony.ts`; there is no password), and lands in their forge
 * as its admin. The GET only shows the form — a link unfurled
 * in a chat app must not spend itself — and the POST, same-origin, makes
 * the account and burns the link in one step. A link that is used, expired
 * or made up says which, plainly; a forge that was not spawned has no
@@ -15,7 +16,11 @@
 * so before anyone submits, and where to remove it.
 */
import type { Ctx } from "../../http/context.ts";
import { crossOrigin, type Ctx } from "../../http/context.ts";
import { STRANGER_MAX } from "../../http/limits.ts";
import { clientAddress } from "../../http/peer.ts";
import { boundedBody, json, str } from "../../http/respond.ts";
import { addPasskey } from "../../core/passkeys.ts";
import {
  addTeamMember,
  listTeamMembers,
@@ -25,7 +30,7 @@
import {
  type Team,
} from "../../core/orgs.ts";
import { createSession } from "../../core/sessions.ts";
import { createUser, getUserByName, type User } from "../../core/users.ts";
import { createUser, discardFreshUser, getUserByName, type User } from "../../core/users.ts";
import {
  burnClaim,
  readClaim,
@@ -38,10 +43,11 @@
import { pageHead } from "../chrome.ts";
import { field, readForm } from "../form.ts";
import { html, type Html } from "../html.ts";
import { page, redirect } from "../layout.ts";
import { makeOptions, PASSKEY_WORDS, passkeyFields, readPasskey } from "../passkey-ceremony.ts";
import { passkeyJs } from "../passkey-client.ts";
import { btn, card, field as formField } from "../ui.ts";
import { sessionCookie } from "./site.ts";
import { sessionCookie, signinAllowed } from "./site.ts";
const MIN_PASSWORD = 10;
const USERNAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,38}$/;
interface Values {
@@ -50,7 +56,7 @@
interface Values {
  /** The claim code, from the form's body. */
  readonly token?: string;
}
type Errors = Partial<Record<"username" | "email" | "password", string>>;
type Errors = Partial<Record<"username" | "email" | "passkey", string>>;
function dead(ctx: Ctx, state: Exclude<ClaimState["state"], "ok">): Response {
  const says = {
@@ -164,18 +170,15 @@
function claimForm(
            required: true,
            ...(errors.email ? { error: errors.email } : {}),
          })}
          ${formField({
            label: "Password",
            name: "password",
            type: "password",
            autocomplete: "new-password",
            required: true,
            minlength: MIN_PASSWORD,
            hint: "At least 10 characters.",
            ...(errors.password ? { error: errors.password } : {}),
          })}
          ${passkeyFields()}
          <p class="muted small mb">
            You sign in with a passkey: a fingerprint, face or device PIN.
            There is no password to remember.
          </p>
          <p class="passkey-note mb" id="passkey-make-note" role="alert">${errors.passkey ?? ""}</p>
          <noscript><p class="muted small">Making the passkey needs JavaScript.</p></noscript>
          <div class="form-actions">
            ${btn("Claim this forge", { variant: "primary" })}
            <button type="submit" id="passkey-make" class="btn" data-variant="primary" data-options="/claim/options">Claim this forge with a passkey</button>
          </div>
        </form>`,
    )}
@@ -210,10 +213,44 @@
export async function claimFragmentPage(ctx: Ctx): Promise<Response> {
    ctx,
    title: "This forge is yours",
    body: claimForm(ctx, spawned, owners(ctx, spawned).spawner, {}, {}),
    scriptJs: fragmentJs,
    scriptJs: fragmentJs + passkeyJs,
  });
}
/** Whether a name and address are fit for the first admin; else the words. */
function problems(ctx: Ctx, username: string, email: string): Errors {
  const errors: Errors = {};
  if (!USERNAME.test(username))
    errors.username = "Usernames are letters, digits, dots, dashes.";
  else if (getUserByName(ctx.app.db, username))
    errors.username = "That username is taken.";
  if (!email.includes("@")) errors.email = "An email address, please.";
  return errors;
}
// POST /claim/options — a passkey challenge, for a live link and a fit name.
// Nothing is spent: the link burns only when the key comes back.
export async function claimOptions(ctx: Ctx): Promise<Response> {
  const refuse = (status: number, message: string) =>
    json({ error: "refused", message }, status);
  if (crossOrigin(ctx.request, ctx.url, ctx.app.log)) return refuse(403, "forbidden");
  const wait = signinAllowed(ctx, `claim:${clientAddress(ctx.request)}`);
      
        sentinelcrew
        29d ago
        
      
      The rate limit and the cross-origin refusal on this route have no tests. Add one for a 403 from a foreign Origin and one for a 429 with retry-after once the limit is reached.
    
  if (wait !== undefined)
    return json({ error: "rate_limited", message: `Too many attempts. Try again in ${wait}s.` }, 429, { "retry-after": String(wait) });
  const data = await boundedBody(ctx.request, STRANGER_MAX);
  if (data === "too_large") return refuse(413, "payload too large");
  const spawned = await spawnedOrg(ctx.app);
  if (spawned === undefined) return refuse(404, "This is not a claim link.");
  const state = readClaim(ctx.app.db, spawned.org.id, str(data.token)).state;
  if (state !== "ok")
    return refuse(state === "unknown" ? 404 : 410, state === "unknown" ? "This is not a claim link." : `This link is ${state === "owned" ? "already claimed" : state}.`);
  const username = str(data.username).trim();
  const bad = problems(ctx, username, str(data.email).trim());
  const first = bad.username ?? bad.email;
  if (first !== undefined) return refuse(422, first);
  return json(makeOptions(ctx, "claim", username));
}
// POST /claim — make the account, burn the link, sign the person in.
export async function claimSubmit(ctx: Ctx): Promise<Response> {
  const form = await readForm(ctx);
@@ -233,25 +270,21 @@
export async function claimSubmit(ctx: Ctx): Promise<Response> {
    email: field(form, "email"),
    token,
  };
  const password = field(form, "password");
  const errors: Errors = {};
  if (!USERNAME.test(values.username))
    errors.username = "Usernames are letters, digits, dots, dashes.";
  else if (getUserByName(ctx.app.db, values.username))
    errors.username = "That username is taken.";
  if (!values.email.includes("@")) errors.email = "An email address, please.";
  if (password.length < MIN_PASSWORD)
    errors.password = "Passwords need at least 10 characters.";
  const again = (e: Errors) =>
    page(
      {
        ctx,
        title: "This forge is yours",
        body: claimForm(ctx, spawned, spawner, values, e),
        scriptJs: passkeyJs,
      },
      422,
    );
  const errors = problems(ctx, values.username, values.email);
  if (Object.keys(errors).length > 0) return again(errors);
  // The key, or nothing: a password in the form is not read at all.
  const key = await readPasskey(ctx, "claim", form);
  if (!key.ok) return again({ passkey: PASSKEY_WORDS[key.error] });
  // Spent first, in one statement: of two people on one link, one wins.
  const spent = burnClaim(ctx.app.db, orgId, token);
@@ -259,7 +292,6 @@
export async function claimSubmit(ctx: Ctx): Promise<Response> {
  const made = await createUser(ctx.app.db, {
    username: values.username,
    email: values.email,
    password,
    isAdmin: true,
    // The one-time claim link the owner handed out is the proof.
    trusted: true,
@@ -274,6 +306,11 @@
export async function claimSubmit(ctx: Ctx): Promise<Response> {
          : { username: "That username is taken." },
    );
  }
  if (!addPasskey(ctx.app.db, made.value.id, "Passkey", key.value).ok) {
      
        sentinelcrew
        29d ago
        
      
      This rollback (discard the user, unburn the link) has no test. It is the part that keeps a failed claim from spending the owner's only link, so cover it, together with the taken test on passkey-ceremony.ts.
    
      
        sentinelcrew
        29d ago
        
      
      Low: this rollback (discardFreshUser + unburnClaim) has no test, and the everyday one has none either. It only runs in a race. If it ever regresses, the claim link is spent with no usable owner. A test that registers the credential to another user between readPasskey and here (for example, by stubbing findPasskey once) would pin it down. Not blocking.
    
    discardFreshUser(ctx.app.db, made.value.id);
    unburnClaim(ctx.app.db, orgId, token);
    return again({ passkey: PASSKEY_WORDS.taken });
  }
  if (team) {
    addTeamMember(ctx.app.db, team, made.value.id);
    // As the page said: unless the spawner kept access, they leave now.
@@ -19,17 +19,20 @@
import {
import { spawnedOrg } from "../../spawn/claim.ts";
import { requireVerified } from "../../actions/verify.ts";
import { createSession } from "../../core/sessions.ts";
import { createUser, getUserByName, type User } from "../../core/users.ts";
import { cookieValue, type Ctx } from "../../http/context.ts";
import { createUser, discardFreshUser, getUserByName, type User } from "../../core/users.ts";
import { addPasskey } from "../../core/passkeys.ts";
import { cookieValue, crossOrigin, type Ctx } from "../../http/context.ts";
import { STRANGER_MAX } from "../../http/limits.ts";
import { boundedBody, json, str } from "../../http/respond.ts";
import { signInFirst } from "../chrome.ts";
import { field, readForm } from "../form.ts";
import { html, type Html } from "../html.ts";
import { flashTo, redirect } from "../layout.ts";
import { makeOptions, PASSKEY_WORDS, passkeyFields, readPasskey } from "../passkey-ceremony.ts";
import { btn, card, field as formField } from "../ui.ts";
import { signOutHere } from "../../actions/signins.ts";
import { sessionCookie } from "./site.ts";
const MIN_PASSWORD = 10;
const USERNAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,38}$/;
/** The everyday name offered first: the admin's, with `-me`, if it is free. */
@@ -100,17 +103,15 @@
function everydayFields(ctx: Ctx, user: User, offerKeep: boolean): Html {
          autocomplete: "email",
          required: true,
        })}
        ${formField({
          label: "Password",
          name: "password",
          type: "password",
          autocomplete: "new-password",
          required: true,
          minlength: MIN_PASSWORD,
          hint: "At least 10 characters.",
        })}
        ${passkeyFields()}
        <p class="muted small">
          It signs in with a passkey of its own: a fingerprint, face or
          device PIN. There is no password.
        </p>
        <p class="passkey-note" id="passkey-make-note" role="alert"></p>
        <noscript><p class="muted small">Making the passkey needs JavaScript.</p></noscript>
        <div class="form-actions">
          ${btn("Make it", { variant: "primary" })}
          <button type="submit" id="passkey-make" class="btn" data-variant="primary" data-options="/settings/everyday/options">Make it with a passkey</button>
          <span class="spacer"></span>
          ${offerKeep ? btn("Keep using admin", {
            form: "everyday-keep",
@@ -127,6 +128,33 @@
function everydayFields(ctx: Ctx, user: User, offerKeep: boolean): Html {
      ></form>`;
}
/** Why `username` cannot be the everyday account's name, or undefined. */
      
        sentinelcrew
        29d ago
        
      
      Nit: this check and problems() in claim.ts are the same rule, along with the USERNAME regex each file copies. Moving the check next to the ceremony (or into core/users.ts) would keep the two forms from drifting apart.
    
function nameProblem(ctx: Ctx, username: string): string | undefined {
  if (!USERNAME.test(username)) return "Usernames are letters, digits, dots, dashes.";
  if (getUserByName(ctx.app.db, username)) return "That username is taken.";
  return undefined;
}
// POST /settings/everyday/options — a passkey challenge for the everyday
// account, for a signed-in admin without one. Nothing is written.
export async function everydayOptions(ctx: Ctx): Promise<Response> {
  const refuse = (status: number, message: string) =>
    json({ error: "refused", message }, status);
  if (crossOrigin(ctx.request, ctx.url, ctx.app.log)) return refuse(403, "forbidden");
  const admin = ctx.auth.user;
  if (!admin) return refuse(401, "Sign in first.");
  if (ctx.auth.via !== "session") return refuse(403, "Passkeys are made from a signed-in browser.");
  if (!admin.isAdmin) return refuse(403, "forbidden");
  if (everydayOf(ctx.app.db, admin) !== undefined)
    return refuse(409, "You already have an everyday account.");
  const data = await boundedBody(ctx.request, STRANGER_MAX);
  if (data === "too_large") return refuse(413, "payload too large");
  const username = str(data.username).trim();
  const bad = nameProblem(ctx, username) ?? (str(data.email).includes("@") ? undefined : "An email address, please.");
  if (bad !== undefined) return refuse(422, bad);
  return json(makeOptions(ctx, "everyday", username));
}
// POST /settings/everyday — make the everyday account, link it, sign in as it.
export async function everydayCreate(ctx: Ctx): Promise<Response> {
  const admin = ctx.auth.user;
@@ -141,13 +169,13 @@
export async function everydayCreate(ctx: Ctx): Promise<Response> {
    });
  const username = field(form, "username");
  const email = field(form, "email");
  const password = field(form, "password");
  const say = (message: string) =>
    flashTo(ctx, "/", { tone: "danger", message });
  if (!USERNAME.test(username))
    return say("Usernames are letters, digits, dots, dashes.");
  if (password.length < MIN_PASSWORD)
    return say("Passwords need at least 10 characters.");
  const bad = nameProblem(ctx, username);
  if (bad !== undefined) return say(bad);
  // The key, or nothing: a password in the form is not read at all.
  const key = await readPasskey(ctx, "everyday", form);
  if (!key.ok) return say(PASSKEY_WORDS[key.error]);
  // The same names a sign-up may not take (a crew member's, a page's,
  // another admin's), held where accounts are made; the admin's own handle
  // may appear in their everyday name ("ada-me"). A proven admin vouches for their own second account, as a claim
@@ -155,7 +183,6 @@
export async function everydayCreate(ctx: Ctx): Promise<Response> {
  const made = await createUser(ctx.app.db, {
    username,
    email,
    password,
    reservedSelf: admin.id,
    trusted: requireVerified(ctx.app, admin).ok,
  });
@@ -169,6 +196,10 @@
export async function everydayCreate(ctx: Ctx): Promise<Response> {
            ? "That name is taken by the forge itself; pick another."
            : "That account could not be made.",
    );
  if (!addPasskey(ctx.app.db, made.value.id, "Passkey", key.value).ok) {
    discardFreshUser(ctx.app.db, made.value.id);
    return say(PASSKEY_WORDS.taken);
  }
  linkEveryday(ctx.app.db, admin, made.value);
  // On a spawned forge the apps are the client's org's: the everyday
  // account writes to it, or it could not open or tell the crew anything.
@@ -36,10 +36,10 @@
import { accountShell } from "./account.ts";
import { safeNext, sessionCookie, signinAllowed } from "./site.ts";
/** One-time challenges, one store per ceremony per forge. */
const stores = new WeakMap<App, { add: ReturnType<typeof challenges>; signin: ReturnType<typeof challenges>; recover: ReturnType<typeof challenges>; signup: ReturnType<typeof challenges> }>();
const stores = new WeakMap<App, { add: ReturnType<typeof challenges>; signin: ReturnType<typeof challenges>; recover: ReturnType<typeof challenges>; signup: ReturnType<typeof challenges>; claim: ReturnType<typeof challenges>; everyday: ReturnType<typeof challenges> }>();
export function store(app: App) {
  let s = stores.get(app);
  if (!s) stores.set(app, (s = { add: challenges(), signin: challenges(), recover: challenges(), signup: challenges() }));
  if (!s) stores.set(app, (s = { add: challenges(), signin: challenges(), recover: challenges(), signup: challenges(), claim: challenges(), everyday: challenges() }));
  return s;
}
@@ -0,0 +1,75 @@
/**
 * The server half of a form that makes an account with a passkey — the
 * claim link (`pages/claim.ts`) and the everyday account
 * (`pages/everyday.ts`). The page's button asks its options route for a
 * challenge (`makeOptions`), the browser makes the key, `passkey-client.ts`
 * writes the answer into the form's hidden fields (`passkeyFields`) and
 * submits it; the page's POST reads it back (`readPasskey`). A form with no
 * key in it — a password, or a browser without script — makes nothing.
 */
import type { Credential } from "../auth/webauthn.ts";
import { newChallenge, verifyRegistration } from "../auth/webauthn.ts";
import { findPasskey } from "../core/passkeys.ts";
import type { Ctx } from "../http/context.ts";
import { field, type Form } from "./form.ts";
import { html, type Html } from "./html.ts";
import { relying, store } from "./pages/passkeys.ts";
/**
 * Which form is making the account. Each has its own challenge store, so a
 * challenge one options route issued is spent only at that form's POST.
 */
      
        sentinelcrew
        29d ago
        outdated
      
      Low: claimOptions and everydayOptions share one store, so a challenge from either can be spent at both POSTs. A store per ceremony (claim, everyday) keeps each options route's gate meaningful.
    
export type Ceremony = "claim" | "everyday";
/** What the browser needs for `navigator.credentials.create`, for `username`. */
export function makeOptions(ctx: Ctx, ceremony: Ceremony, username: string) {
  return {
    challenge: store(ctx.app)[ceremony].issue(),
    rpId: relying(ctx).rpId,
    rpName: "forge",
    user: { id: newChallenge(), name: username, displayName: username },
    exclude: [],
  };
}
/** The hidden fields the client script fills before the form posts. */
export const passkeyFields = (): Html =>
  html`<input type="hidden" name="challenge" value="" />
    <input type="hidden" name="clientDataJSON" value="" />
    <input type="hidden" name="attestationObject" value="" />`;
export type PasskeyRefusal = "missing" | "expired" | "rejected" | "taken";
/** The words for each way a posted key is refused, written for anyone. */
export const PASSKEY_WORDS: Record<PasskeyRefusal, string> = {
  missing: "This needs a passkey, and a browser with JavaScript on to make one. Passwords are not taken here.",
  expired: "That request expired. Try again.",
  rejected: "That passkey was not accepted.",
  taken: "That passkey is already registered.",
};
/**
 * The verified key a form carries, or why not. The challenge answers once,
 * whatever else is wrong; a key another account holds is refused here, so
 * the caller never makes an account it then cannot give a key.
 */
export async function readPasskey(
  ctx: Ctx,
  ceremony: Ceremony,
  form: Form,
): Promise<{ ok: true; value: Credential } | { ok: false; error: PasskeyRefusal }> {
  const clientDataJSON = field(form, "clientDataJSON");
  const attestationObject = field(form, "attestationObject");
  const challenge = field(form, "challenge");
  if (clientDataJSON === "" || attestationObject === "" || challenge === "")
    return { ok: false, error: "missing" };
      
        sentinelcrew
        29d ago
        outdated
      
      High (untested): refusing a credential another account holds matters for security, and no test reaches it. Add a test that claims with a device whose key is already registered. Assert a 422 with this message, no user made, and the link unspent.
    
  if (!store(ctx.app)[ceremony].consume(challenge)) return { ok: false, error: "expired" };
  const made = await verifyRegistration(
    { clientDataJSON, attestationObject },
    { challenge, ...relying(ctx) },
  );
  if (!made.ok) return { ok: false, error: "rejected" };
  if (findPasskey(ctx.app.db, made.id)) return { ok: false, error: "taken" };
  return { ok: true, value: made };
}
@@ -1,6 +1,6 @@
/**
 * The browser half of passkeys: two small ceremonies, inlined (nonce'd) on
 * the two pages that need them. A page without script still works; it just
 * The browser half of passkeys: small ceremonies, inlined (nonce'd) on the
 * pages that need them. A page without script still works; it just
 * has no passkey button. Binary travels as base64url, as the server expects.
 */
export const passkeyJs = /* js */ `
@@ -120,6 +120,30 @@
export const passkeyJs = /* js */ `
      });
    }).then(function (r) { location.href = r.next; });
  });
  // A form that makes an account (the claim link, the everyday account):
  // the key goes into its hidden fields and the form posts as it always did.
  wire('passkey-make', function () {
    var el = doc.getElementById('passkey-make'), form = el.form;
    function val(n) { var f = form.elements[n]; return f ? f.value : ''; }
    if (form.reportValidity && !form.reportValidity()) { el.disabled = false; return Promise.resolve(); }
    var who = { token: val('token'), username: val('username'), email: val('email') };
    return post(el.getAttribute('data-options'), who).then(function (o) {
      return navigator.credentials.create({ publicKey: {
        challenge: bytes(o.challenge),
        rp: { id: o.rpId, name: o.rpName },
        user: { id: bytes(o.user.id), name: o.user.name, displayName: o.user.displayName },
        pubKeyCredParams: [{ type: 'public-key', alg: -7 }, { type: 'public-key', alg: -257 }],
        authenticatorSelection: { residentKey: 'preferred', userVerification: 'required' },
        attestation: 'none',
        timeout: 120000
      } }).then(function (cred) {
        form.elements.challenge.value = o.challenge;
        form.elements.clientDataJSON.value = text(cred.response.clientDataJSON);
        form.elements.attestationObject.value = text(cred.response.attestationObject);
        form.submit();
      });
    });
  });
  wire('passkey-signin', function () {
    return post('/signin/passkey/options').then(function (o) {
      return navigator.credentials.get({ publicKey: {
@@ -54,6 +54,7 @@
import { everydayCard } from "../pages/everyday.ts";
import { nextStepsCard, nextStepsOf } from "../pages/next-steps.ts";
import { spawnedOrg } from "../../spawn/claim.ts";
import { clientApps } from "./client_home.ts";
import { passkeyJs } from "../passkey-client.ts";
/** The events that can change what is on you. */
const ON_YOU_LIVE =
@@ -212,10 +213,13 @@
export async function studioHome(
      ctx,
      title: "Home",
      body: lean,
      // The everyday step makes its account with a passkey (#1890).
      ...(firstSteps ? { scriptJs: passkeyJs } : {}),
    });
  }
  const ask = firstSteps ?? everydayCard(ctx, user);
  const body = html`<h1 class="sr-only">Home</h1>
    ${firstSteps ?? everydayCard(ctx, user)} ${address} ${liveLine(ctx)}
    ${ask} ${address} ${liveLine(ctx)}
    ${when(
      steps,
      () => html`<p class="small muted" id="lean-home">
@@ -250,7 +254,7 @@
export async function studioHome(
    ctx,
    title: "Home",
    body,
    scriptJs: `${liveClientJs}\n${liveRegionsJs}\n${feedJs}\n${needsYou.scriptJs}`,
    scriptJs: `${liveClientJs}\n${liveRegionsJs}\n${feedJs}\n${needsYou.scriptJs}${ask ? `\n${passkeyJs}` : ""}`,
  });
}
@@ -130,7 +130,8 @@
fieldset.field > .check + .check { margin-top: 8px; }
.field-row { display: flex; gap: 8px; flex-wrap: wrap; align-items: flex-end; }
.field-row .field { flex: 1; min-width: 160px; margin-bottom: 0; }
.form-actions { margin-top: 16px; display: flex; gap: 8px; align-items: center; flex-wrap: wrap; }
.error-note {
/* A passkey ceremony's note slot looks like an error only once it says one. */
.error-note, .passkey-note:not(:empty) {
  display: block; color: var(--danger); font-size: 13px; font-weight: 500;
  padding: 8px 12px; margin: 0 0 12px;
  border: 1px solid color-mix(in srgb, var(--danger) 32%, transparent);
@@ -5,7 +5,8 @@
 * the browser and posts it in the body. Any site admin of the parent can
 * re-issue a link for a child nobody has claimed; the old one dies at once.
 * Through MCP the link stays out of the agent's conversation unless asked
 * for there on purpose (#839).
 * for there on purpose (#839). The account a link makes has a passkey and
 * no password (#1890).
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
@@ -15,6 +16,8 @@
import { join } from "node:path";
import { createRepo } from "../src/actions/repos.ts";
import { childDirOf } from "../src/actions/spawn.ts";
import { createApp, type App } from "../src/app.ts";
import { verifyRegistration } from "../src/auth/webauthn.ts";
import { addPasskey, listPasskeys } from "../src/core/passkeys.ts";
import { createToken } from "../src/core/tokens.ts";
import { createUser, getUserByName } from "../src/core/users.ts";
import { commitFiles } from "../src/git/write.ts";
@@ -22,6 +25,7 @@
import { repoDir } from "../src/git/repos.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { firstBoot } from "../src/spawn/first-boot.ts";
import { quietLogs } from "./helpers/globals.ts";
import { device, passkeyFields } from "./helpers/passkey.ts";
quietLogs();
@@ -54,6 +58,9 @@
describe("the claim link in the fragment, and its re-issue", () => {
      body: new URLSearchParams(form),
      redirect: "manual",
    });
  /** What the page does: a passkey from `/claim/options`, then the form. */
  const claimWithKey = async (form: Record<string, string>) =>
    claim({ ...form, ...(await passkeyFields(childServers.url, "/claim/options", form)) });
  const tokenOf = (url: string) => url.split("#")[1] ?? "";
  beforeAll(async () => {
@@ -146,7 +153,6 @@
describe("the claim link in the fragment, and its re-issue", () => {
        body: new URLSearchParams({
          username: "q",
          email: "[email protected]",
          password: PASSWORD,
        }),
        redirect: "manual",
      },
@@ -174,29 +180,105 @@
describe("the claim link in the fragment, and its re-issue", () => {
      token: tokenOf(first),
      username: "old",
      email: "[email protected]",
      password: PASSWORD,
    });
    expect(old.status).toBe(404);
    expect(getUserByName(child.db, "old")).toBeUndefined();
    // A reserved name is refused for what it is (#720), and the link is
    // not spent by the refusal.
    const reserved = await claim({
      token: tokenOf(second),
      username: "admin",
      email: "[email protected]",
      password: PASSWORD,
    });
    const reservedForm = { token: tokenOf(second), username: "admin", email: "[email protected]" };
    const reservedKey = await passkeyFields(childServers.url, "/claim/options", reservedForm);
    const reserved = await claim({ ...reservedForm, ...reservedKey });
    expect(reserved.status).toBe(422);
    expect(await reserved.text()).toContain("That name is reserved.");
    expect(getUserByName(child.db, "admin")).toBeUndefined();
    const ok = await claim({
    // The same filled form again: its challenge answered once already.
    const replayed = await claim({ ...reservedForm, ...reservedKey });
    expect(replayed.status).toBe(422);
    expect(await replayed.text()).toContain("That request expired.");
    expect(getUserByName(child.db, "admin")).toBeUndefined();
    // A device whose key another account on this forge already holds.
    const holder = await createUser(child.db, { trusted: true, username: "holder", email: "[email protected]" });
    if (!holder.ok) throw new Error(holder.error);
    const shared = await device(childServers.url);
    const held = await passkeyFields(childServers.url, "/claim/options", { token: tokenOf(second), username: "holder-two", email: "[email protected]" }, { device: shared });
    const cred = await verifyRegistration(held, { challenge: held.challenge, origin: childServers.url, rpId: new URL(childServers.url).hostname });
    if (!cred.ok) throw new Error("registration");
    expect(addPasskey(child.db, holder.value.id, "Passkey", cred).ok).toBe(true);
    const takenForm = { token: tokenOf(second), username: "taker", email: "[email protected]" };
    const taken = await claim({
      ...takenForm,
      ...(await passkeyFields(childServers.url, "/claim/options", takenForm, { device: shared })),
    });
    expect(taken.status).toBe(422);
    expect(await taken.text()).toContain("That passkey is already registered.");
    expect(getUserByName(child.db, "taker")).toBeUndefined();
    expect(listPasskeys(child.db, holder.value.id)).toHaveLength(1);
    // Still unspent: the link gives a challenge yet.
    const live = await fetch(`${childServers.url}/claim/options`, {
      method: "POST",
      headers: { origin: childServers.url, "content-type": "application/json" },
      body: JSON.stringify(takenForm),
    });
    expect(live.status).toBe(200);
    // A claim challenge, kept to try at the everyday form once signed in.
    const claimOnly = await passkeyFields(childServers.url, "/claim/options", takenForm);
    // A password and no passkey is refused, and spends nothing.
    const password = await claim({
      token: tokenOf(second),
      username: "maria-owner",
      email: "[email protected]",
      password: PASSWORD,
    });
    expect(password.status).toBe(422);
    expect(await password.text()).toContain("Passwords are not taken here.");
    expect(getUserByName(child.db, "maria-owner")).toBeUndefined();
    const ok = await claimWithKey({
      token: tokenOf(second),
      username: "maria-owner",
      email: "[email protected]",
    });
    expect(ok.status).toBe(303);
    expect(getUserByName(child.db, "maria-owner")?.isAdmin).toBe(true);
    const owner = getUserByName(child.db, "maria-owner")!;
    expect(owner.isAdmin).toBe(true);
    expect(listPasskeys(child.db, owner.id)).toHaveLength(1);
    expect(
      (child.db.query("SELECT password_hash AS h FROM user WHERE id = ?1").get(owner.id) as { h: string }).h,
    ).toBe("");
    // Single-use: the spent link gives no second challenge and no second account.
    const twice = await fetch(`${childServers.url}/claim/options`, {
      method: "POST",
      headers: { origin: childServers.url, "content-type": "application/json" },
      body: JSON.stringify({ token: tokenOf(second), username: "maria-two", email: "[email protected]" }),
    });
    expect(twice.status).toBe(410);
    expect(getUserByName(child.db, "maria-two")).toBeUndefined();
    // A challenge from /claim/options is not spent at the everyday form.
    const cookie = (ok.headers.get("set-cookie") ?? "").split(";")[0]!;
    const crossed = await fetch(`${childServers.url}/settings/everyday`, {
      method: "POST",
      headers: { cookie, origin: childServers.url },
      body: new URLSearchParams({ username: "owner-me", email: "[email protected]", ...claimOnly }),
      redirect: "manual",
    });
    expect(crossed.status).toBe(303);
    const flash = (crossed.headers.get("set-cookie") ?? "").split(";")[0]!;
    const home = await (await fetch(`${childServers.url}/`, { headers: { cookie: `${cookie}; ${flash}` } })).text();
    expect(home).toContain("That request expired.");
    expect(getUserByName(child.db, "owner-me")).toBeUndefined();
  });
  test("/claim/options refuses another site, and slows a stream of asks", async () => {
    const ask = (origin: string) =>
      fetch(`${childServers.url}/claim/options`, {
        method: "POST",
        headers: { origin, "content-type": "application/json" },
        body: JSON.stringify({ token: "x", username: "someone", email: "[email protected]" }),
      });
    expect((await ask("https://evil.test")).status).toBe(403);
    let res = await ask(childServers.url);
    for (let i = 0; i < 100 && res.status !== 429; i++) res = await ask(childServers.url);
    expect(res.status).toBe(429);
    expect(Number(res.headers.get("retry-after"))).toBeGreaterThan(0);
  });
  test("once claimed, the sign-in page no longer offers a claim", async () => {
@@ -25,6 +25,7 @@
import { createForgeApp } from "../src/tui/forge.ts";
import { headlessTerminal } from "../src/tui/term/terminal.ts";
import { quietLogs } from "./helpers/globals.ts";
import { settleApp } from "./helpers/tui.ts";
import { passkeyFields } from "./helpers/passkey.ts";
quietLogs();
@@ -136,10 +137,8 @@
describe("a client's first screen", () => {
      method: "POST",
      headers: { origin: servers.url },
      body: new URLSearchParams({
        token,
        username: "maria",
        email: "[email protected]",
        password: PASSWORD,
        ...{ token, username: "maria", email: "[email protected]" },
        ...(await passkeyFields(servers.url, "/claim/options", { token, username: "maria", email: "[email protected]" })),
      }),
      redirect: "manual",
    });
@@ -22,6 +22,7 @@
import { serve, type Servers } from "../src/http/server.ts";
import { useChildFetch } from "../src/spawn/clients.ts";
import { firstBoot } from "../src/spawn/first-boot.ts";
import { quietLogs } from "./helpers/globals.ts";
import { passkeyFields } from "./helpers/passkey.ts";
quietLogs();
@@ -225,14 +226,13 @@
describe("the client list", () => {
  });
  test("once claimed, the row says so, and the MCP tool answers the same rows", async () => {
    const who = { token: claimUrl.split("#")[1]!, username: "mara", email: "[email protected]" };
    const claimed = await fetch(`${childServers.url}/claim`, {
      method: "POST",
      headers: { origin: childServers.url },
      body: new URLSearchParams({
        token: claimUrl.split("#")[1]!,
        username: "mara",
        email: "[email protected]",
        password: PASSWORD,
        ...who,
        ...(await passkeyFields(childServers.url, "/claim/options", who)),
      }),
      redirect: "manual",
    });
@@ -1,7 +1,8 @@
/**
 * The everyday account (#596): a forge's admin is asked once, kindly, to
 * make an account apart from admin for daily work; making it signs them in
 * as it, keeping admin is recorded; both account pages name the pair. A
 * as it, keeping admin is recorded; both account pages name the pair. The
 * everyday account is made with a passkey and never a password (#1890). A
 * token for an admin is minted only on purpose, and an MCP client holding
 * one is told it acts as admin.
 */
@@ -26,9 +27,11 @@
import {
  orgAccessByOrg,
} from "../src/core/orgs.ts";
import { createToken } from "../src/core/tokens.ts";
import { listPasskeys } from "../src/core/passkeys.ts";
import { createUser, getUserByName } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { quietLogs } from "./helpers/globals.ts";
import { passkeyFields } from "./helpers/passkey.ts";
quietLogs();
@@ -66,6 +69,14 @@
describe("the everyday account", () => {
      body: new URLSearchParams(form),
      redirect: "manual",
    });
  /** What the page does: a passkey from the options route, then the form. */
  const make = async (cookie: string, form: Record<string, string>) =>
    post(cookie, "/settings/everyday", {
      ...form,
      ...(await passkeyFields(servers.url, "/settings/everyday/options", form, { headers: { cookie } })),
    });
  const hasPassword = (username: string) =>
    (app.db.query("SELECT password_hash AS h FROM user WHERE username = ?1").get(username) as { h: string }).h !== "";
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-everyday-"));
@@ -109,14 +120,19 @@
describe("the everyday account", () => {
    const refused = await post(kim, "/settings/everyday", {
      username: "kim-me",
      email: "[email protected]",
      password: PASSWORD,
    });
    expect(refused.status).toBe(403);
    const asked = await fetch(url("/settings/everyday/options"), {
      method: "POST",
      headers: { cookie: kim, origin: servers.url, "content-type": "application/json" },
      body: JSON.stringify({ username: "kim-me", email: "[email protected]" }),
    });
    expect(asked.status).toBe(403);
    const root = await signIn("ada");
    const crossed = await post(
      root,
      "/settings/everyday",
      { username: "x-me", email: "[email protected]", password: PASSWORD },
      { username: "x-me", email: "[email protected]" },
      "https://evil.test",
    );
    expect(crossed.status).toBe(403);
@@ -124,18 +140,24 @@
describe("the everyday account", () => {
    expect(getUserByName(app.db, "x-me")).toBeUndefined();
  });
  test("a weak password or a taken name makes nothing", async () => {
  test("a password and no passkey, or a taken name, makes nothing", async () => {
    const root = await signIn("ada");
    await post(root, "/settings/everyday", {
    const refused = await post(root, "/settings/everyday", {
      username: "ada-me",
      email: "[email protected]",
      password: "short",
    });
    await post(root, "/settings/everyday", {
      username: "kim",
      email: "[email protected]",
      password: PASSWORD,
    });
    expect(refused.status).toBe(303);
    const flash = (refused.headers.get("set-cookie") ?? "").split(";")[0]!;
    expect(await page(`${root}; ${flash}`, "/")).toContain("Passwords are not taken here.");
    // A taken name is refused before any key is made.
    const asked = await fetch(url("/settings/everyday/options"), {
      method: "POST",
      headers: { cookie: root, origin: servers.url, "content-type": "application/json" },
      body: JSON.stringify({ username: "kim", email: "[email protected]" }),
    });
    expect(asked.status).toBe(422);
    expect(await asked.text()).toContain("That username is taken.");
    expect(getUserByName(app.db, "ada-me")).toBeUndefined();
    expect(everydayOf(app.db, getUserByName(app.db, "ada")!)).toBeUndefined();
  });
@@ -143,10 +165,9 @@
describe("the everyday account", () => {
  test("a reserved name makes nothing (#720): a page's, or another admin's; the admin's own stays theirs", async () => {
    const root = await signIn("ada");
    for (const username of ["settings", "bea-me"]) {
      const res = await post(root, "/settings/everyday", {
      const res = await make(root, {
        username,
        email: `${username}@x.test`,
        password: PASSWORD,
      });
      expect(res.status).toBe(303);
      expect(getUserByName(app.db, username)).toBeUndefined();
@@ -156,10 +177,12 @@
describe("the everyday account", () => {
  test("Make it: an ordinary account, linked both ways, and the person is signed in as it", async () => {
    const root = await signIn("ada");
    const res = await post(root, "/settings/everyday", {
    const home = await page(root, "/");
    expect(home).toContain('id="passkey-make"');
    expect(home).not.toContain('name="password"');
    const res = await make(root, {
      username: "ada-me",
      email: "[email protected]",
      password: PASSWORD,
    });
    expect(res.status).toBe(303);
    expect(res.headers.get("location")).toBe("/");
@@ -167,6 +190,8 @@
describe("the everyday account", () => {
    expect(cookie).toContain("forge_session=");
    const daily = getUserByName(app.db, "ada-me")!;
    expect(daily.isAdmin).toBe(false);
    expect(listPasskeys(app.db, daily.id)).toHaveLength(1);
    expect(hasPassword("ada-me")).toBe(false);
    const admin = getUserByName(app.db, "ada")!;
    expect(everydayOf(app.db, admin)?.username).toBe("ada-me");
    expect(adminOf(app.db, daily)?.username).toBe("ada");
@@ -287,7 +312,7 @@
describe("the everyday account", () => {
  test("an admin who already has one is shown the way to it: asked again, and on their settings, a sign-in as it", async () => {
    const ada = await signIn("ada");
    const again = await post(ada, "/settings/everyday", { username: "ada-two", email: "[email protected]", password: PASSWORD });
    const again = await post(ada, "/settings/everyday", { username: "ada-two", email: "[email protected]" });
    expect(again.status).toBe(303);
    const flash = (again.headers.get("set-cookie") ?? "").split(";")[0]!;
    const settings = await page(`${ada}; ${flash}`, again.headers.get("location")!);
@@ -307,7 +332,7 @@
describe("the everyday account", () => {
  test("an everyday account may not take a name the forge reserves", async () => {
    const boss = await signIn("bea");
    await post(boss, "/settings/everyday", { username: "settings", email: "[email protected]", password: PASSWORD });
    await make(boss, { username: "settings", email: "[email protected]" });
    expect(getUserByName(app.db, "settings")).toBeUndefined();
  });
@@ -351,7 +376,7 @@
describe("the everyday account", () => {
    if (!cyd.ok) throw new Error("cyd");
    await Bun.write(join(dataDir, "parent.json"), JSON.stringify({ org: "stalls" }));
    const admin = await signIn("cyd");
    const res = await post(admin, "/settings/everyday", { username: "cyd-me", email: "[email protected]", password: PASSWORD });
    const res = await make(admin, { username: "cyd-me", email: "[email protected]" });
    expect(res.status).toBe(303);
    expect(res.headers.get("location")).toContain("/stalls#teams");
    // No session for the new account: the admin is still the one signed in.
@@ -26,6 +26,7 @@
import { serve, type Servers } from "../src/http/server.ts";
import { firstBoot } from "../src/spawn/first-boot.ts";
import { hostedPlacement } from "../src/spawn/placement.ts";
import { quietLogs } from "./helpers/globals.ts";
import { passkeyFields } from "./helpers/passkey.ts";
quietLogs();
@@ -143,14 +144,13 @@
describe("the first login to a spawned forge", () => {
    servers = await serve(child);
    const link = spawned.value.claimUrl!;
    const token = link.split("/claim#")[1]!;
    const who = { token, username: "maria", email: "[email protected]" };
    const claimed = await fetch(url("/claim"), {
      method: "POST",
      headers: { origin: servers.url },
      body: new URLSearchParams({
        token,
        username: "maria",
        email: "[email protected]",
        password: PASSWORD,
        ...who,
        ...(await passkeyFields(servers.url, "/claim/options", who)),
      }),
      redirect: "manual",
    });
@@ -215,10 +215,10 @@
describe("the first login to a spawned forge", () => {
  });
  test("the everyday account, made first, joins the client's org and sees the card part-way, every step one it can do", async () => {
    const who = { username: "maria-me", email: "[email protected]" };
    const res = await post(owner, "/settings/everyday", {
      username: "maria-me",
      email: "me@bakery.test",
      password: PASSWORD,
      ...who,
      ...(await passkeyFields(servers.url, "/settings/everyday/options", who, { headers: { cookie: owner } })),
    });
    expect(res.status).toBe(303);
    daily = (res.headers.get("set-cookie") ?? "").split(";")[0]!;
@@ -0,0 +1,79 @@
/**
 * A software authenticator for tests: a P-256 key that answers the creation
 * and sign-in ceremonies the way a browser's would (attestation "none"), and
 * `passkeyFields`, which runs a page's options route and returns the hidden
 * fields `passkey-client.ts` fills before a form that makes an account posts.
 */
import { b64u } from "../../src/auth/webauthn.ts";
const te = new TextEncoder();
const sha = async (d: Uint8Array<ArrayBuffer>) => new Uint8Array(await crypto.subtle.digest("SHA-256", d));
const cat = (...p: Uint8Array[]): Uint8Array<ArrayBuffer> => { const o: Uint8Array<ArrayBuffer> = new Uint8Array(p.reduce((n, a) => n + a.length, 0)); let i = 0; for (const a of p) { o.set(a, i); i += a.length; } return o; };
function head(major: number, n: number): Uint8Array {
  if (n < 24) return Uint8Array.of((major << 5) | n);
  if (n < 256) return Uint8Array.of((major << 5) | 24, n);
  return Uint8Array.of((major << 5) | 25, n >> 8, n & 255);
}
type V = number | string | Uint8Array | [V, V][];
function enc(v: V): Uint8Array {
  if (typeof v === "number") return v >= 0 ? head(0, v) : head(1, -1 - v);
  if (typeof v === "string") { const b = te.encode(v); return cat(head(3, b.length), b); }
  if (v instanceof Uint8Array) return cat(head(2, v.length), v);
  return cat(head(5, v.length), ...v.flatMap(([k, x]) => [enc(k), enc(x)]));
}
function rawToDer(raw: Uint8Array): Uint8Array<ArrayBuffer> {
  const int = (b: Uint8Array) => { let i = 0; while (i < b.length - 1 && b[i] === 0) i++; b = b.subarray(i); if (b[0]! & 0x80) b = cat(Uint8Array.of(0), b); return cat(Uint8Array.of(2, b.length), b); };
  const body = cat(int(raw.subarray(0, 32)), int(raw.subarray(32)));
  return cat(Uint8Array.of(0x30, body.length), body);
}
export type Device = Awaited<ReturnType<typeof device>>;
/** An authenticator bound to one origin, e.g. `http://127.0.0.1:1234`. */
export async function device(origin: string, rp = new URL(origin).hostname) {
  const pair = (await crypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, ["sign"])) as CryptoKeyPair;
  const jwk = await crypto.subtle.exportKey("jwk", pair.publicKey);
  const unb = (s: string) => new Uint8Array(Buffer.from(s, "base64url"));
  const cose: [number, V][] = [[1, 2], [3, -7], [-1, 1], [-2, unb(jwk.x!)], [-3, unb(jwk.y!)]];
  const id = crypto.getRandomValues(new Uint8Array(32));
  let count = 0;
  const cd = (type: string, challenge: string) => te.encode(JSON.stringify({ type, challenge, origin }));
  const counter = (n: number) => Uint8Array.of(n >>> 24, (n >>> 16) & 255, (n >>> 8) & 255, n & 255);
  return {
    credId: b64u(id),
    async create(challenge: string) {
      const authData = cat(await sha(te.encode(rp)), Uint8Array.of(0x45), counter(0), new Uint8Array(16), Uint8Array.of(0, id.length), id, enc(cose as V));
      return { clientDataJSON: b64u(cd("webauthn.create", challenge)), attestationObject: b64u(enc([["fmt", "none"], ["attStmt", []], ["authData", authData]])) };
    },
    async get(challenge: string) {
      const clientData = cd("webauthn.get", challenge);
      const authData = cat(await sha(te.encode(rp)), Uint8Array.of(0x05), counter(++count));
      const sig = rawToDer(new Uint8Array(await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, pair.privateKey, cat(authData, await sha(clientData)))));
      return { id: b64u(id), clientDataJSON: b64u(clientData), authenticatorData: b64u(authData), signature: b64u(sig) };
    },
  };
}
/**
 * What the page's button does: ask `base + optionsPath` for a challenge with
 * `who` (the form's token, username, email), make the key, and return the
 * hidden fields to post with the form. `headers` carries a session cookie
 * where the page needs one. Throws when the options route refuses.
 */
export async function passkeyFields(
  base: string,
  optionsPath: string,
  who: Record<string, string>,
  opts: { headers?: Record<string, string>; device?: Device } = {},
): Promise<{ challenge: string; clientDataJSON: string; attestationObject: string }> {
  const origin = new URL(base).origin;
  const res = await fetch(`${base}${optionsPath}`, {
    method: "POST",
    headers: { "content-type": "application/json", origin, ...opts.headers },
    body: JSON.stringify(who),
  });
  if (res.status !== 200) throw new Error(`passkey options ${res.status} ${await res.text()}`);
  const { challenge } = (await res.json()) as { challenge: string };
  const d = opts.device ?? (await device(origin));
  return { challenge, ...(await d.create(challenge)) };
}
@@ -9,56 +9,11 @@
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { b64u } from "../src/auth/webauthn.ts";
import { signUp } from "../src/actions/users.ts";
import { createUser } from "../src/core/users.ts";
import { errorText } from "../src/tui/screens/common.ts";
import { serve, type Servers } from "../src/http/server.ts";
const te = new TextEncoder();
const sha = async (d: Uint8Array<ArrayBuffer>) => new Uint8Array(await crypto.subtle.digest("SHA-256", d));
const cat = (...p: Uint8Array[]): Uint8Array<ArrayBuffer> => { const o: Uint8Array<ArrayBuffer> = new Uint8Array(p.reduce((n, a) => n + a.length, 0)); let i = 0; for (const a of p) { o.set(a, i); i += a.length; } return o; };
function head(major: number, n: number): Uint8Array {
  if (n < 24) return Uint8Array.of((major << 5) | n);
  if (n < 256) return Uint8Array.of((major << 5) | 24, n);
  return Uint8Array.of((major << 5) | 25, n >> 8, n & 255);
}
type V = number | string | Uint8Array | [V, V][];
function enc(v: V): Uint8Array {
  if (typeof v === "number") return v >= 0 ? head(0, v) : head(1, -1 - v);
  if (typeof v === "string") { const b = te.encode(v); return cat(head(3, b.length), b); }
  if (v instanceof Uint8Array) return cat(head(2, v.length), v);
  return cat(head(5, v.length), ...v.flatMap(([k, x]) => [enc(k), enc(x)]));
}
function rawToDer(raw: Uint8Array): Uint8Array<ArrayBuffer> {
  const int = (b: Uint8Array) => { let i = 0; while (i < b.length - 1 && b[i] === 0) i++; b = b.subarray(i); if (b[0]! & 0x80) b = cat(Uint8Array.of(0), b); return cat(Uint8Array.of(2, b.length), b); };
  const body = cat(int(raw.subarray(0, 32)), int(raw.subarray(32)));
  return cat(Uint8Array.of(0x30, body.length), body);
}
async function device(origin: string, rp: string) {
  const pair = (await crypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, ["sign"])) as CryptoKeyPair;
  const jwk = await crypto.subtle.exportKey("jwk", pair.publicKey);
  const unb = (s: string) => new Uint8Array(Buffer.from(s, "base64url"));
  const cose: [number, V][] = [[1, 2], [3, -7], [-1, 1], [-2, unb(jwk.x!)], [-3, unb(jwk.y!)]];
  const id = crypto.getRandomValues(new Uint8Array(32));
  let count = 0;
  const cd = (type: string, challenge: string) => te.encode(JSON.stringify({ type, challenge, origin }));
  const counter = (n: number) => Uint8Array.of(n >>> 24, (n >>> 16) & 255, (n >>> 8) & 255, n & 255);
  return {
    credId: b64u(id),
    async create(challenge: string) {
      const authData = cat(await sha(te.encode(rp)), Uint8Array.of(0x45), counter(0), new Uint8Array(16), Uint8Array.of(0, id.length), id, enc(cose as V));
      return { clientDataJSON: b64u(cd("webauthn.create", challenge)), attestationObject: b64u(enc([["fmt", "none"], ["attStmt", []], ["authData", authData]])) };
    },
    async get(challenge: string) {
      const clientData = cd("webauthn.get", challenge);
      const authData = cat(await sha(te.encode(rp)), Uint8Array.of(0x05), counter(++count));
      const sig = rawToDer(new Uint8Array(await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, pair.privateKey, cat(authData, await sha(clientData)))));
      return { id: b64u(id), clientDataJSON: b64u(clientData), authenticatorData: b64u(authData), signature: b64u(sig) };
    },
  };
}
import { device } from "./helpers/passkey.ts";
describe("passkey sign-up", () => {
  let dataDir: string;
@@ -28,6 +28,7 @@
import { firstBoot } from "../src/spawn/first-boot.ts";
import { hostedPlacement } from "../src/spawn/placement.ts";
import { quietLogs } from "./helpers/globals.ts";
import { emailVerified } from "../src/core/verify.ts";
import { passkeyFields } from "./helpers/passkey.ts";
quietLogs();
@@ -131,14 +132,13 @@
describe("a spawned child's apps", () => {
    await firstBoot(child);
    servers = await serve(child);
    const token = spawned.value.claimUrl!.split("/claim#")[1]!;
    const who = { token, username: "maria", email: "[email protected]" };
    const claimed = await fetch(`${servers.url}/claim`, {
      method: "POST",
      headers: { origin: servers.url },
      body: new URLSearchParams({
        token,
        username: "maria",
        email: "[email protected]",
        password: "a-long-bakery-passphrase",
        ...who,
        ...(await passkeyFields(servers.url, "/claim/options", who)),
      }),
      redirect: "manual",
    });
@@ -36,6 +36,7 @@
import { firstBoot } from "../src/spawn/first-boot.ts";
import { hostedPlacement } from "../src/spawn/placement.ts";
import type { SpawnSource } from "../src/spawn/plan.ts";
import { quietLogs } from "./helpers/globals.ts";
import { passkeyFields } from "./helpers/passkey.ts";
quietLogs();
@@ -65,13 +66,15 @@
describe("a spawned child's first boot", () => {
      body: new URLSearchParams({ token: t, ...form }),
      redirect: "manual",
    });
  /** What the page does: a passkey from `/claim/options`, then the form. */
  const claimWithKey = async (t: string, form: Record<string, string>) =>
    claim(t, { ...form, ...(await passkeyFields(servers.url, "/claim/options", { token: t, ...form })) });
  /** The link is still good: nothing claimed it yet. */
  const unspent = (t: string) =>
    readClaim(child.db, getOrg(child.db, "bakery")!.id, t).state === "ok";
  const maria = {
    username: "maria",
    email: "[email protected]",
    password: "a-long-bakery-passphrase",
  };
  beforeAll(async () => {
@@ -293,15 +296,16 @@
describe("a spawned child's first boot", () => {
    expect(unspent(token)).toBe(true);
  });
  test("a weak password is refused, and the link is not spent on it", async () => {
    const res = await claim(token, { ...maria, password: "short" });
  test("a password and no passkey is refused, and the link is not spent on it", async () => {
    const res = await claim(token, { ...maria, password: "a-long-bakery-passphrase" });
    expect(res.status).toBe(422);
    expect(await res.text()).toContain("Passwords are not taken here.");
    expect(getUserByName(child.db, "maria")).toBeUndefined();
    expect(unspent(token)).toBe(true);
  });
  test("claiming makes the person the child's admin and an owner of its organisation, signed in", async () => {
    const res = await claim(token, maria);
    const res = await claimWithKey(token, maria);
    expect(res.status).toBe(303);
    expect(res.headers.get("location")).toBe("/");
    const cookie = res.headers.get("set-cookie") ?? "";
@@ -411,7 +415,7 @@
describe("claims are bound to a spawned forge, and the link is shown once", () =
    const res = await fetch(`${servers.url}/claim`, {
      method: "POST",
      headers: { origin: "https://forge.test" },
      body: new URLSearchParams({ token: crafted, username: "mallory", email: "[email protected]", password: "a-long-mallory-passphrase" }),
      body: new URLSearchParams({ token: crafted, username: "mallory", email: "[email protected]" }),
      redirect: "manual",
    });
    expect(res.status).toBe(404);
@@ -449,10 +453,11 @@
describe("claims are bound to a spawned forge, and the link is shown once", () =
    try {
      const page = (await (await fetch(`${kidServers.url}/claim`)).text()).replace(/\s+/g, " ");
      expect(page).toContain("alice keeps owner access to this forge; you can remove it in your organisation");
      const who = { token, username: "kai-owner", email: "[email protected]" };
      const res = await fetch(`${kidServers.url}/claim`, {
        method: "POST",
        headers: { origin: kidServers.url },
        body: new URLSearchParams({ token, username: "kai-owner", email: "[email protected]", password: "a-long-kai-passphrase" }),
        body: new URLSearchParams({ ...who, ...(await passkeyFields(kidServers.url, "/claim/options", who)) }),
        redirect: "manual",
      });
      expect(res.status).toBe(303);
@@ -465,7 +470,7 @@
describe("claims are bound to a spawned forge, and the link is shown once", () =
      const crafted = await fetch(`${kidServers.url}/claim`, {
        method: "POST",
        headers: { origin: kidServers.url },
        body: new URLSearchParams({ token: other, username: "mallory", email: "[email protected]", password: "a-long-mallory-passphrase" }),
        body: new URLSearchParams({ token: other, username: "mallory", email: "[email protected]" }),
        redirect: "manual",
      });
      expect(crafted.status).toBe(404);
@@ -36,6 +36,7 @@
import { loadKey, open } from "../src/kernel/secret.ts";
import { firstBoot } from "../src/spawn/first-boot.ts";
import { loadOrCreateHostKey } from "../src/ssh/keys.ts";
import { quietLogs } from "./helpers/globals.ts";
import { passkeyFields } from "./helpers/passkey.ts";
quietLogs();
@@ -391,10 +392,8 @@
describe("a spawned child's own keys and domain", () => {
        method: "POST",
        headers: { origin: childServers.url },
        body: new URLSearchParams({
          token,
          username: "maria-owner",
          email: "[email protected]",
          password: "a-long-maria-passphrase",
          ...{ token, username: "maria-owner", email: "[email protected]" },
          ...(await passkeyFields(childServers.url, "/claim/options", { token, username: "maria-owner", email: "[email protected]" })),
        }),
        redirect: "manual",
      });
		@@ -129,7 +129,7 @@ to `/recover`: give the email on your account and, if it is verified, a link
129	129	that lasts 30 minutes and works once registers a new passkey and signs you in.
130	130	The relying party is the address the browser used (or
131	131	`FORGE_URL`), so a passkey does not follow a forge to another hostname.
132		Sign-up is a username, an email address and a passkey (`/signup`, `src/web/pages/signup-passkey.ts`); the running server refuses a password-only sign-up on the form, `POST /api/v1/users` and the terminal (`passkeyOnlySignup`, set in `main.ts`). Accounts that already have a password still sign in. Two paths still make an account without a passkey and are the next step: the owner claim of a spawned forge (`web/pages/claim.ts`) and an admin's everyday account (`web/pages/everyday.ts`).
	132	Sign-up is a username, an email address and a passkey (`/signup`, `src/web/pages/signup-passkey.ts`); the running server refuses a password-only sign-up on the form, `POST /api/v1/users` and the terminal (`passkeyOnlySignup`, set in `main.ts`). Accounts that already have a password still sign in. The owner claim of a spawned forge (`/claim`, `web/pages/claim.ts`) and an admin's everyday account (`web/pages/everyday.ts`) make their account with a passkey too (`web/passkey-ceremony.ts`, challenges from `POST /claim/options` and `POST /settings/everyday/options`); neither reads a password, and without JavaScript the page says a passkey needs it. A claim post with no passkey is refused and does not spend the link.
133	133
134	134	Your SSH key is your identity. A key the forge knows signs you straight in; any
135	135	other key browses public repos as a guest and can press `s` to sign in with a
		@@ -212,8 +212,8 @@ import {
212	212	composerSubmit,
213	213	tellSubmit,
214	214	} from "../web/studio/actions.ts";
215		import { everydayCreate, everydayKeep, everydaySwitch } from "../web/pages/everyday.ts";
216		import { claimFragmentPage, claimSubmit } from "../web/pages/claim.ts";
	215	import { everydayCreate, everydayKeep, everydayOptions, everydaySwitch } from "../web/pages/everyday.ts";
	216	import { claimFragmentPage, claimOptions, claimSubmit } from "../web/pages/claim.ts";
217	217	import { familyPage } from "../web/pages/family.ts";
218	218	import { forgeLinkSubmit, forgesPage } from "../web/pages/forges.ts";
219	219	import { newForgePage, newForgeSubmit } from "../web/pages/new-forge.ts";
		@@ -593,6 +593,7 @@ export function buildRouter(): Router<Handler> {
593	593	// A spawned child's claim link: GET shows, POST takes it (spawn/claim.ts).
594	594	router.add("GET", "/claim", claimFragmentPage);
595	595	router.add("POST", "/claim", claimSubmit);
	596	router.add("POST", "/claim/options", claimOptions);
596	597	// "+ New forge": the spawn door as a page, any signed-in person (spawn/door.ts).
597	598	router.add("GET", "/forges", forgesPage);
598	599	router.add("GET", "/family", familyPage);
		@@ -691,6 +692,7 @@ export function buildRouter(): Router<Handler> {
691	692	router.add("POST", "/settings/password", passwordUpdate);
692	693	// The everyday account: an admin's daily account, apart from admin (#596).
693	694	router.add("POST", "/settings/everyday", everydayCreate);
	695	router.add("POST", "/settings/everyday/options", everydayOptions);
694	696	router.add("POST", "/settings/everyday/switch", everydaySwitch);
695	697	router.add("POST", "/settings/everyday/keep", everydayKeep);
696	698	router.add("GET", "/settings/tokens", tokensPage);
		@@ -53,6 +53,7 @@ import {
53	53	field as uiField,
54	54	} from "../ui.ts";
55	55	import { everydayLine } from "./everyday.ts";
	56	import { passkeyJs } from "../passkey-client.ts";
56	57
57	58	type Section = "profile" \| "password" \| "tokens" \| "keys" \| "passkeys";
58	59
		@@ -222,11 +223,15 @@ function profileView(ctx: Ctx, values: ProfileForm): Html {
222	223	// GET /settings
223	224	export function accountPage(ctx: Ctx): Response {
224	225	if (!ctx.auth.user) return signInFirst(ctx);
	226	const pair = everydayLine(ctx, ctx.auth.user);
225	227	return accountShell(
226	228	ctx,
227	229	"profile",
228	230	"Settings",
229		html`${everydayLine(ctx, ctx.auth.user)}${profileView(ctx, currentProfile(ctx.auth.user))}${notifyView(ctx)}`,
	231	html`${pair}${profileView(ctx, currentProfile(ctx.auth.user))}${notifyView(ctx)}`,
	232	200,
	233	// The everyday form makes its account with a passkey (#1890).
	234	pair ? passkeyJs : undefined,
230	235	);
231	236	}
232	237
		@@ -2,8 +2,9 @@
2	2	* `/claim`: the page a spawned child's link opens (`spawn/claim.ts`).
3	3	* The link is `/claim#<token>`, so the secret never leaves the browser in a
4	4	* request line. The path: the person a forge was made for opens the link they were sent,
5		* reads who will be able to see it, makes their account, and lands in
6		* their forge as its admin. The GET only shows the form — a link unfurled
	5	* reads who will be able to see it, makes their account with a passkey
	6	* (`passkey-ceremony.ts`; there is no password), and lands in their forge
	7	* as its admin. The GET only shows the form — a link unfurled
7	8	* in a chat app must not spend itself — and the POST, same-origin, makes
8	9	* the account and burns the link in one step. A link that is used, expired
9	10	* or made up says which, plainly; a forge that was not spawned has no
		@@ -15,7 +16,11 @@
15	16	* so before anyone submits, and where to remove it.
16	17	*/
17	18
18		import type { Ctx } from "../../http/context.ts";
	19	import { crossOrigin, type Ctx } from "../../http/context.ts";
	20	import { STRANGER_MAX } from "../../http/limits.ts";
	21	import { clientAddress } from "../../http/peer.ts";
	22	import { boundedBody, json, str } from "../../http/respond.ts";
	23	import { addPasskey } from "../../core/passkeys.ts";
19	24	import {
20	25	addTeamMember,
21	26	listTeamMembers,
		@@ -25,7 +30,7 @@ import {
25	30	type Team,
26	31	} from "../../core/orgs.ts";
27	32	import { createSession } from "../../core/sessions.ts";
28		import { createUser, getUserByName, type User } from "../../core/users.ts";
	33	import { createUser, discardFreshUser, getUserByName, type User } from "../../core/users.ts";
29	34	import {
30	35	burnClaim,
31	36	readClaim,
		@@ -38,10 +43,11 @@ import { pageHead } from "../chrome.ts";
38	43	import { field, readForm } from "../form.ts";
39	44	import { html, type Html } from "../html.ts";
40	45	import { page, redirect } from "../layout.ts";
	46	import { makeOptions, PASSKEY_WORDS, passkeyFields, readPasskey } from "../passkey-ceremony.ts";
	47	import { passkeyJs } from "../passkey-client.ts";
41	48	import { btn, card, field as formField } from "../ui.ts";
42		import { sessionCookie } from "./site.ts";
	49	import { sessionCookie, signinAllowed } from "./site.ts";
43	50
44		const MIN_PASSWORD = 10;
45	51	const USERNAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,38}$/;
46	52
47	53	interface Values {
		@@ -50,7 +56,7 @@ interface Values {
50	56	/** The claim code, from the form's body. */
51	57	readonly token?: string;
52	58	}
53		type Errors = Partial<Record<"username" \| "email" \| "password", string>>;
	59	type Errors = Partial<Record<"username" \| "email" \| "passkey", string>>;
54	60
55	61	function dead(ctx: Ctx, state: Exclude<ClaimState["state"], "ok">): Response {
56	62	const says = {
		@@ -164,18 +170,15 @@ function claimForm(
164	170	required: true,
165	171	...(errors.email ? { error: errors.email } : {}),
166	172	})}
167		${formField({
168		label: "Password",
169		name: "password",
170		type: "password",
171		autocomplete: "new-password",
172		required: true,
173		minlength: MIN_PASSWORD,
174		hint: "At least 10 characters.",
175		...(errors.password ? { error: errors.password } : {}),
176		})}
	173	${passkeyFields()}
	174	<p class="muted small mb">
	175	You sign in with a passkey: a fingerprint, face or device PIN.
	176	There is no password to remember.
	177	</p>
	178	<p class="passkey-note mb" id="passkey-make-note" role="alert">${errors.passkey ?? ""}</p>
	179	<noscript><p class="muted small">Making the passkey needs JavaScript.</p></noscript>
177	180	<div class="form-actions">
178		${btn("Claim this forge", { variant: "primary" })}
	181	<button type="submit" id="passkey-make" class="btn" data-variant="primary" data-options="/claim/options">Claim this forge with a passkey</button>
179	182	</div>
180	183	</form>`,
181	184	)}
		@@ -210,10 +213,44 @@ export async function claimFragmentPage(ctx: Ctx): Promise<Response> {
210	213	ctx,
211	214	title: "This forge is yours",
212	215	body: claimForm(ctx, spawned, owners(ctx, spawned).spawner, {}, {}),
213		scriptJs: fragmentJs,
	216	scriptJs: fragmentJs + passkeyJs,
214	217	});
215	218	}
216	219
	220	/** Whether a name and address are fit for the first admin; else the words. */
	221	function problems(ctx: Ctx, username: string, email: string): Errors {
	222	const errors: Errors = {};
	223	if (!USERNAME.test(username))
	224	errors.username = "Usernames are letters, digits, dots, dashes.";
	225	else if (getUserByName(ctx.app.db, username))
	226	errors.username = "That username is taken.";
	227	if (!email.includes("@")) errors.email = "An email address, please.";
	228	return errors;
	229	}
	230
	231	// POST /claim/options — a passkey challenge, for a live link and a fit name.
	232	// Nothing is spent: the link burns only when the key comes back.
	233	export async function claimOptions(ctx: Ctx): Promise<Response> {
	234	const refuse = (status: number, message: string) =>
	235	json({ error: "refused", message }, status);
	236	if (crossOrigin(ctx.request, ctx.url, ctx.app.log)) return refuse(403, "forbidden");
	237	const wait = signinAllowed(ctx, `claim:${clientAddress(ctx.request)}`);
		sentinelcrew 29d ago The rate limit and the cross-origin refusal on this route have no tests. Add one for a 403 from a foreign Origin and one for a 429 with `retry-after` once the limit is reached.
	238	if (wait !== undefined)
	239	return json({ error: "rate_limited", message: `Too many attempts. Try again in ${wait}s.` }, 429, { "retry-after": String(wait) });
	240	const data = await boundedBody(ctx.request, STRANGER_MAX);
	241	if (data === "too_large") return refuse(413, "payload too large");
	242	const spawned = await spawnedOrg(ctx.app);
	243	if (spawned === undefined) return refuse(404, "This is not a claim link.");
	244	const state = readClaim(ctx.app.db, spawned.org.id, str(data.token)).state;
	245	if (state !== "ok")
	246	return refuse(state === "unknown" ? 404 : 410, state === "unknown" ? "This is not a claim link." : `This link is ${state === "owned" ? "already claimed" : state}.`);
	247	const username = str(data.username).trim();
	248	const bad = problems(ctx, username, str(data.email).trim());
	249	const first = bad.username ?? bad.email;
	250	if (first !== undefined) return refuse(422, first);
	251	return json(makeOptions(ctx, "claim", username));
	252	}
	253
217	254	// POST /claim — make the account, burn the link, sign the person in.
218	255	export async function claimSubmit(ctx: Ctx): Promise<Response> {
219	256	const form = await readForm(ctx);
		@@ -233,25 +270,21 @@ export async function claimSubmit(ctx: Ctx): Promise<Response> {
233	270	email: field(form, "email"),
234	271	token,
235	272	};
236		const password = field(form, "password");
237		const errors: Errors = {};
238		if (!USERNAME.test(values.username))
239		errors.username = "Usernames are letters, digits, dots, dashes.";
240		else if (getUserByName(ctx.app.db, values.username))
241		errors.username = "That username is taken.";
242		if (!values.email.includes("@")) errors.email = "An email address, please.";
243		if (password.length < MIN_PASSWORD)
244		errors.password = "Passwords need at least 10 characters.";
245	273	const again = (e: Errors) =>
246	274	page(
247	275	{
248	276	ctx,
249	277	title: "This forge is yours",
250	278	body: claimForm(ctx, spawned, spawner, values, e),
	279	scriptJs: passkeyJs,
251	280	},
252	281	422,
253	282	);
	283	const errors = problems(ctx, values.username, values.email);
254	284	if (Object.keys(errors).length > 0) return again(errors);
	285	// The key, or nothing: a password in the form is not read at all.
	286	const key = await readPasskey(ctx, "claim", form);
	287	if (!key.ok) return again({ passkey: PASSKEY_WORDS[key.error] });
255	288
256	289	// Spent first, in one statement: of two people on one link, one wins.
257	290	const spent = burnClaim(ctx.app.db, orgId, token);
		@@ -259,7 +292,6 @@ export async function claimSubmit(ctx: Ctx): Promise<Response> {
259	292	const made = await createUser(ctx.app.db, {
260	293	username: values.username,
261	294	email: values.email,
262		password,
263	295	isAdmin: true,
264	296	// The one-time claim link the owner handed out is the proof.
265	297	trusted: true,
		@@ -274,6 +306,11 @@ export async function claimSubmit(ctx: Ctx): Promise<Response> {
274	306	: { username: "That username is taken." },
275	307	);
276	308	}
	309	if (!addPasskey(ctx.app.db, made.value.id, "Passkey", key.value).ok) {
		sentinelcrew 29d ago This rollback (discard the user, unburn the link) has no test. It is the part that keeps a failed claim from spending the owner's only link, so cover it, together with the `taken` test on passkey-ceremony.ts. sentinelcrew 29d ago Low: this rollback (`discardFreshUser` + `unburnClaim`) has no test, and the everyday one has none either. It only runs in a race. If it ever regresses, the claim link is spent with no usable owner. A test that registers the credential to another user between `readPasskey` and here (for example, by stubbing `findPasskey` once) would pin it down. Not blocking.
	310	discardFreshUser(ctx.app.db, made.value.id);
	311	unburnClaim(ctx.app.db, orgId, token);
	312	return again({ passkey: PASSKEY_WORDS.taken });
	313	}
277	314	if (team) {
278	315	addTeamMember(ctx.app.db, team, made.value.id);
279	316	// As the page said: unless the spawner kept access, they leave now.
		@@ -19,17 +19,20 @@ import {
19	19	import { spawnedOrg } from "../../spawn/claim.ts";
20	20	import { requireVerified } from "../../actions/verify.ts";
21	21	import { createSession } from "../../core/sessions.ts";
22		import { createUser, getUserByName, type User } from "../../core/users.ts";
23		import { cookieValue, type Ctx } from "../../http/context.ts";
	22	import { createUser, discardFreshUser, getUserByName, type User } from "../../core/users.ts";
	23	import { addPasskey } from "../../core/passkeys.ts";
	24	import { cookieValue, crossOrigin, type Ctx } from "../../http/context.ts";
	25	import { STRANGER_MAX } from "../../http/limits.ts";
	26	import { boundedBody, json, str } from "../../http/respond.ts";
24	27	import { signInFirst } from "../chrome.ts";
25	28	import { field, readForm } from "../form.ts";
26	29	import { html, type Html } from "../html.ts";
27	30	import { flashTo, redirect } from "../layout.ts";
	31	import { makeOptions, PASSKEY_WORDS, passkeyFields, readPasskey } from "../passkey-ceremony.ts";
28	32	import { btn, card, field as formField } from "../ui.ts";
29	33	import { signOutHere } from "../../actions/signins.ts";
30	34	import { sessionCookie } from "./site.ts";
31	35
32		const MIN_PASSWORD = 10;
33	36	const USERNAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,38}$/;
34	37
35	38	/** The everyday name offered first: the admin's, with `-me`, if it is free. */
		@@ -100,17 +103,15 @@ function everydayFields(ctx: Ctx, user: User, offerKeep: boolean): Html {
100	103	autocomplete: "email",
101	104	required: true,
102	105	})}
103		${formField({
104		label: "Password",
105		name: "password",
106		type: "password",
107		autocomplete: "new-password",
108		required: true,
109		minlength: MIN_PASSWORD,
110		hint: "At least 10 characters.",
111		})}
	106	${passkeyFields()}
	107	<p class="muted small">
	108	It signs in with a passkey of its own: a fingerprint, face or
	109	device PIN. There is no password.
	110	</p>
	111	<p class="passkey-note" id="passkey-make-note" role="alert"></p>
	112	<noscript><p class="muted small">Making the passkey needs JavaScript.</p></noscript>
112	113	<div class="form-actions">
113		${btn("Make it", { variant: "primary" })}
	114	<button type="submit" id="passkey-make" class="btn" data-variant="primary" data-options="/settings/everyday/options">Make it with a passkey</button>
114	115	<span class="spacer"></span>
115	116	${offerKeep ? btn("Keep using admin", {
116	117	form: "everyday-keep",
		@@ -127,6 +128,33 @@ function everydayFields(ctx: Ctx, user: User, offerKeep: boolean): Html {
127	128	></form>`;
128	129	}
129	130
	131	/** Why `username` cannot be the everyday account's name, or undefined. */
		sentinelcrew 29d ago Nit: this check and `problems()` in `claim.ts` are the same rule, along with the `USERNAME` regex each file copies. Moving the check next to the ceremony (or into `core/users.ts`) would keep the two forms from drifting apart.
	132	function nameProblem(ctx: Ctx, username: string): string \| undefined {
	133	if (!USERNAME.test(username)) return "Usernames are letters, digits, dots, dashes.";
	134	if (getUserByName(ctx.app.db, username)) return "That username is taken.";
	135	return undefined;
	136	}
	137
	138	// POST /settings/everyday/options — a passkey challenge for the everyday
	139	// account, for a signed-in admin without one. Nothing is written.
	140	export async function everydayOptions(ctx: Ctx): Promise<Response> {
	141	const refuse = (status: number, message: string) =>
	142	json({ error: "refused", message }, status);
	143	if (crossOrigin(ctx.request, ctx.url, ctx.app.log)) return refuse(403, "forbidden");
	144	const admin = ctx.auth.user;
	145	if (!admin) return refuse(401, "Sign in first.");
	146	if (ctx.auth.via !== "session") return refuse(403, "Passkeys are made from a signed-in browser.");
	147	if (!admin.isAdmin) return refuse(403, "forbidden");
	148	if (everydayOf(ctx.app.db, admin) !== undefined)
	149	return refuse(409, "You already have an everyday account.");
	150	const data = await boundedBody(ctx.request, STRANGER_MAX);
	151	if (data === "too_large") return refuse(413, "payload too large");
	152	const username = str(data.username).trim();
	153	const bad = nameProblem(ctx, username) ?? (str(data.email).includes("@") ? undefined : "An email address, please.");
	154	if (bad !== undefined) return refuse(422, bad);
	155	return json(makeOptions(ctx, "everyday", username));
	156	}
	157
130	158	// POST /settings/everyday — make the everyday account, link it, sign in as it.
131	159	export async function everydayCreate(ctx: Ctx): Promise<Response> {
132	160	const admin = ctx.auth.user;
		@@ -141,13 +169,13 @@ export async function everydayCreate(ctx: Ctx): Promise<Response> {
141	169	});
142	170	const username = field(form, "username");
143	171	const email = field(form, "email");
144		const password = field(form, "password");
145	172	const say = (message: string) =>
146	173	flashTo(ctx, "/", { tone: "danger", message });
147		if (!USERNAME.test(username))
148		return say("Usernames are letters, digits, dots, dashes.");
149		if (password.length < MIN_PASSWORD)
150		return say("Passwords need at least 10 characters.");
	174	const bad = nameProblem(ctx, username);
	175	if (bad !== undefined) return say(bad);
	176	// The key, or nothing: a password in the form is not read at all.
	177	const key = await readPasskey(ctx, "everyday", form);
	178	if (!key.ok) return say(PASSKEY_WORDS[key.error]);
151	179	// The same names a sign-up may not take (a crew member's, a page's,
152	180	// another admin's), held where accounts are made; the admin's own handle
153	181	// may appear in their everyday name ("ada-me"). A proven admin vouches for their own second account, as a claim
		@@ -155,7 +183,6 @@ export async function everydayCreate(ctx: Ctx): Promise<Response> {
155	183	const made = await createUser(ctx.app.db, {
156	184	username,
157	185	email,
158		password,
159	186	reservedSelf: admin.id,
160	187	trusted: requireVerified(ctx.app, admin).ok,
161	188	});
		@@ -169,6 +196,10 @@ export async function everydayCreate(ctx: Ctx): Promise<Response> {
169	196	? "That name is taken by the forge itself; pick another."
170	197	: "That account could not be made.",
171	198	);
	199	if (!addPasskey(ctx.app.db, made.value.id, "Passkey", key.value).ok) {
	200	discardFreshUser(ctx.app.db, made.value.id);
	201	return say(PASSKEY_WORDS.taken);
	202	}
172	203	linkEveryday(ctx.app.db, admin, made.value);
173	204	// On a spawned forge the apps are the client's org's: the everyday
174	205	// account writes to it, or it could not open or tell the crew anything.
		@@ -36,10 +36,10 @@ import { accountShell } from "./account.ts";
36	36	import { safeNext, sessionCookie, signinAllowed } from "./site.ts";
37	37
38	38	/** One-time challenges, one store per ceremony per forge. */
39		const stores = new WeakMap<App, { add: ReturnType<typeof challenges>; signin: ReturnType<typeof challenges>; recover: ReturnType<typeof challenges>; signup: ReturnType<typeof challenges> }>();
	39	const stores = new WeakMap<App, { add: ReturnType<typeof challenges>; signin: ReturnType<typeof challenges>; recover: ReturnType<typeof challenges>; signup: ReturnType<typeof challenges>; claim: ReturnType<typeof challenges>; everyday: ReturnType<typeof challenges> }>();
40	40	export function store(app: App) {
41	41	let s = stores.get(app);
42		if (!s) stores.set(app, (s = { add: challenges(), signin: challenges(), recover: challenges(), signup: challenges() }));
	42	if (!s) stores.set(app, (s = { add: challenges(), signin: challenges(), recover: challenges(), signup: challenges(), claim: challenges(), everyday: challenges() }));
43	43	return s;
44	44	}
45	45
		@@ -0,0 +1,75 @@
	1	/**
	2	* The server half of a form that makes an account with a passkey — the
	3	* claim link (`pages/claim.ts`) and the everyday account
	4	* (`pages/everyday.ts`). The page's button asks its options route for a
	5	* challenge (`makeOptions`), the browser makes the key, `passkey-client.ts`
	6	* writes the answer into the form's hidden fields (`passkeyFields`) and
	7	* submits it; the page's POST reads it back (`readPasskey`). A form with no
	8	* key in it — a password, or a browser without script — makes nothing.
	9	*/
	10
	11	import type { Credential } from "../auth/webauthn.ts";
	12	import { newChallenge, verifyRegistration } from "../auth/webauthn.ts";
	13	import { findPasskey } from "../core/passkeys.ts";
	14	import type { Ctx } from "../http/context.ts";
	15	import { field, type Form } from "./form.ts";
	16	import { html, type Html } from "./html.ts";
	17	import { relying, store } from "./pages/passkeys.ts";
	18
	19	/**
	20	* Which form is making the account. Each has its own challenge store, so a
	21	* challenge one options route issued is spent only at that form's POST.
	22	*/
		sentinelcrew 29d ago outdated Low: `claimOptions` and `everydayOptions` share one store, so a challenge from either can be spent at both POSTs. A store per ceremony (`claim`, `everyday`) keeps each options route's gate meaningful.
	23	export type Ceremony = "claim" \| "everyday";
	24
	25	/** What the browser needs for `navigator.credentials.create`, for `username`. */
	26	export function makeOptions(ctx: Ctx, ceremony: Ceremony, username: string) {
	27	return {
	28	challenge: store(ctx.app)[ceremony].issue(),
	29	rpId: relying(ctx).rpId,
	30	rpName: "forge",
	31	user: { id: newChallenge(), name: username, displayName: username },
	32	exclude: [],
	33	};
	34	}
	35
	36	/** The hidden fields the client script fills before the form posts. */
	37	export const passkeyFields = (): Html =>
	38	html`<input type="hidden" name="challenge" value="" />
	39	<input type="hidden" name="clientDataJSON" value="" />
	40	<input type="hidden" name="attestationObject" value="" />`;
	41
	42	export type PasskeyRefusal = "missing" \| "expired" \| "rejected" \| "taken";
	43
	44	/** The words for each way a posted key is refused, written for anyone. */
	45	export const PASSKEY_WORDS: Record<PasskeyRefusal, string> = {
	46	missing: "This needs a passkey, and a browser with JavaScript on to make one. Passwords are not taken here.",
	47	expired: "That request expired. Try again.",
	48	rejected: "That passkey was not accepted.",
	49	taken: "That passkey is already registered.",
	50	};
	51
	52	/**
	53	* The verified key a form carries, or why not. The challenge answers once,
	54	* whatever else is wrong; a key another account holds is refused here, so
	55	* the caller never makes an account it then cannot give a key.
	56	*/
	57	export async function readPasskey(
	58	ctx: Ctx,
	59	ceremony: Ceremony,
	60	form: Form,
	61	): Promise<{ ok: true; value: Credential } \| { ok: false; error: PasskeyRefusal }> {
	62	const clientDataJSON = field(form, "clientDataJSON");
	63	const attestationObject = field(form, "attestationObject");
	64	const challenge = field(form, "challenge");
	65	if (clientDataJSON === "" \|\| attestationObject === "" \|\| challenge === "")
	66	return { ok: false, error: "missing" };
		sentinelcrew 29d ago outdated High (untested): refusing a credential another account holds matters for security, and no test reaches it. Add a test that claims with a device whose key is already registered. Assert a 422 with this message, no user made, and the link unspent.
	67	if (!store(ctx.app)[ceremony].consume(challenge)) return { ok: false, error: "expired" };
	68	const made = await verifyRegistration(
	69	{ clientDataJSON, attestationObject },
	70	{ challenge, ...relying(ctx) },
	71	);
	72	if (!made.ok) return { ok: false, error: "rejected" };
	73	if (findPasskey(ctx.app.db, made.id)) return { ok: false, error: "taken" };
	74	return { ok: true, value: made };
	75	}
		@@ -1,6 +1,6 @@
1	1	/**
2		* The browser half of passkeys: two small ceremonies, inlined (nonce'd) on
3		* the two pages that need them. A page without script still works; it just
	2	* The browser half of passkeys: small ceremonies, inlined (nonce'd) on the
	3	* pages that need them. A page without script still works; it just
4	4	* has no passkey button. Binary travels as base64url, as the server expects.
5	5	*/
6	6	export const passkeyJs = /* js */ `
		@@ -120,6 +120,30 @@ export const passkeyJs = /* js */ `
120	120	});
121	121	}).then(function (r) { location.href = r.next; });
122	122	});
	123	// A form that makes an account (the claim link, the everyday account):
	124	// the key goes into its hidden fields and the form posts as it always did.
	125	wire('passkey-make', function () {
	126	var el = doc.getElementById('passkey-make'), form = el.form;
	127	function val(n) { var f = form.elements[n]; return f ? f.value : ''; }
	128	if (form.reportValidity && !form.reportValidity()) { el.disabled = false; return Promise.resolve(); }
	129	var who = { token: val('token'), username: val('username'), email: val('email') };
	130	return post(el.getAttribute('data-options'), who).then(function (o) {
	131	return navigator.credentials.create({ publicKey: {
	132	challenge: bytes(o.challenge),
	133	rp: { id: o.rpId, name: o.rpName },
	134	user: { id: bytes(o.user.id), name: o.user.name, displayName: o.user.displayName },
	135	pubKeyCredParams: [{ type: 'public-key', alg: -7 }, { type: 'public-key', alg: -257 }],
	136	authenticatorSelection: { residentKey: 'preferred', userVerification: 'required' },
	137	attestation: 'none',
	138	timeout: 120000
	139	} }).then(function (cred) {
	140	form.elements.challenge.value = o.challenge;
	141	form.elements.clientDataJSON.value = text(cred.response.clientDataJSON);
	142	form.elements.attestationObject.value = text(cred.response.attestationObject);
	143	form.submit();
	144	});
	145	});
	146	});
123	147	wire('passkey-signin', function () {
124	148	return post('/signin/passkey/options').then(function (o) {
125	149	return navigator.credentials.get({ publicKey: {
		@@ -54,6 +54,7 @@ import { everydayCard } from "../pages/everyday.ts";
54	54	import { nextStepsCard, nextStepsOf } from "../pages/next-steps.ts";
55	55	import { spawnedOrg } from "../../spawn/claim.ts";
56	56	import { clientApps } from "./client_home.ts";
	57	import { passkeyJs } from "../passkey-client.ts";
57	58
58	59	/** The events that can change what is on you. */
59	60	const ON_YOU_LIVE =
		@@ -212,10 +213,13 @@ export async function studioHome(
212	213	ctx,
213	214	title: "Home",
214	215	body: lean,
	216	// The everyday step makes its account with a passkey (#1890).
	217	...(firstSteps ? { scriptJs: passkeyJs } : {}),
215	218	});
216	219	}
	220	const ask = firstSteps ?? everydayCard(ctx, user);
217	221	const body = html`<h1 class="sr-only">Home</h1>
218		${firstSteps ?? everydayCard(ctx, user)} ${address} ${liveLine(ctx)}
	222	${ask} ${address} ${liveLine(ctx)}
219	223	${when(
220	224	steps,
221	225	() => html`<p class="small muted" id="lean-home">
		@@ -250,7 +254,7 @@ export async function studioHome(
250	254	ctx,
251	255	title: "Home",
252	256	body,
253		scriptJs: `${liveClientJs}\n${liveRegionsJs}\n${feedJs}\n${needsYou.scriptJs}`,
	257	scriptJs: `${liveClientJs}\n${liveRegionsJs}\n${feedJs}\n${needsYou.scriptJs}${ask ? `\n${passkeyJs}` : ""}`,
254	258	});
255	259	}
256	260
		@@ -130,7 +130,8 @@ fieldset.field > .check + .check { margin-top: 8px; }
130	130	.field-row { display: flex; gap: 8px; flex-wrap: wrap; align-items: flex-end; }
131	131	.field-row .field { flex: 1; min-width: 160px; margin-bottom: 0; }
132	132	.form-actions { margin-top: 16px; display: flex; gap: 8px; align-items: center; flex-wrap: wrap; }
133		.error-note {
	133	/* A passkey ceremony's note slot looks like an error only once it says one. */
	134	.error-note, .passkey-note:not(:empty) {
134	135	display: block; color: var(--danger); font-size: 13px; font-weight: 500;
135	136	padding: 8px 12px; margin: 0 0 12px;
136	137	border: 1px solid color-mix(in srgb, var(--danger) 32%, transparent);