e341b0b · c9db8c9 · ef78705 · d08aa0a · ea64226 · 12ace39
@@ -173,6 +173,23 @@
The relying party is the address the browser used (or
`FORGE_URL`), so a passkey does not follow a forge to another hostname.
Sign-up is a username, an email address and a passkey (`/signup`, `src/web/pages/signup-passkey.ts`); the running server refuses a password-only sign-up on the form, `POST /api/v1/users` and the terminal (`passkeyOnlySignup`, set in `main.ts`). Accounts that already have a password still sign in. The owner claim of a spawned forge (`/claim`, `web/pages/claim.ts`) and an admin's everyday account (`web/pages/everyday.ts`) make their account with a passkey too (`web/passkey-ceremony.ts`, challenges from `POST /claim/options` and `POST /settings/everyday/options`); neither reads a password, and without JavaScript the page says a passkey needs it. A claim post with no passkey is refused and does not spend the link.
A forge with a parent (`FORGE_PARENT_URL`, or the `upstream` in a spawned
forge's `parent.json`) offers "Continue with <parent>" on `/signin`. The forge
registers itself once at the parent's `/oauth/register` (the client id is kept
in `rp_client`), sends the person through the parent's authorize page with
PKCE, and on return checks state (also bound to the browser by an HttpOnly
cookie), nonce, `iss`, `aud`, `exp` and the ES256 signature against the
parent's JWKS (`kernel/jwt.ts`; keys are cached ten minutes and an unknown
`kid` refetches them once a minute at most). The parent's `sub` — never the
username — maps to a local account made on first sight with no password
(`core/federation.ts`; `http/rp.ts` has the two routes). No dependency added.
The parent's answers are read by bytes and refused past 16 KiB (64 KiB for the
key set), and starting a sign-in is throttled like a password attempt.
An account made this way has no password, so the terminal's username-and-password
door (`s`) cannot let that person in. They add an SSH key under Settings → Keys
once signed in on the web; after that the terminal signs them straight in as
that account, as for anyone with a key.
Your SSH key is your identity. A key the forge knows signs you straight in; any
other key browses public repos as a guest and can press `s` to sign in with a
username and password — which links that key to your account, so the next
@@ -0,0 +1,153 @@
/**
 * Signing in through another forge (#748): what this forge, as a relying
 * party, keeps. The client id it was given at the issuer (one per redirect
 * address), a sign-in in flight (the state only as a hash, so a leaked
 * database starts nothing), and which local account an issuer's `sub` is.
 * The username is never the key: it can be renamed, and a name the parent
 * frees may be taken by someone else.
 */
import type { Database } from "bun:sqlite";
import { readFileSync } from "node:fs";
import { join } from "node:path";
import { sha256 } from "../kernel/hash.ts";
import { parentUrlProblem } from "./parent_releases.ts";
import { createUser, getUserById, getUserByName, isActive, type User } from "./users.ts";
/** Where the parent sends a person back; the address registered at the parent. */
      
        sentinelcrew
        29d ago
        outdated
      
      Low: this doc comment belongs to LOGIN_TTL_MS but sits above CALLBACK_PATH, which now carries two doc comments. Move it down.
    
export const CALLBACK_PATH = "/signin/parent/callback";
/** A sign-in not finished in this long is gone. */
export const LOGIN_TTL_MS = 10 * 60_000;
/** The most sign-ins in flight at once; the oldest make room. */
export const LOGIN_MAX = 1000;
/** A `sub` we accept: an id, not free text. */
export const SUB = /^[A-Za-z0-9_-]{1,64}$/;
export const clientFor = (db: Database, issuer: string, redirectUri: string): string | undefined =>
  db
    .query<{ client_id: string }, [string, string]>(
      "SELECT client_id FROM rp_client WHERE issuer = ?1 AND redirect_uri = ?2",
    )
    .get(issuer, redirectUri)?.client_id;
/** Keep the first client id for an address; a racing second registration loses. */
export function keepClient(db: Database, issuer: string, redirectUri: string, clientId: string): string {
  db.query(
    "INSERT INTO rp_client (issuer, redirect_uri, client_id) VALUES (?1, ?2, ?3) ON CONFLICT DO NOTHING",
  ).run(issuer, redirectUri, clientId);
  return clientFor(db, issuer, redirectUri) ?? clientId;
}
export interface Login {
  readonly verifier: string;
  readonly nonce: string;
  readonly issuer: string;
  readonly redirectUri: string;
}
export function startLogin(db: Database, state: string, login: Login, now = Date.now()): void {
  db.query("DELETE FROM rp_login WHERE expires_at <= ?1").run(now);
  db.query(
    `DELETE FROM rp_login WHERE state_hash IN
       (SELECT state_hash FROM rp_login ORDER BY expires_at LIMIT max(0, (SELECT count(*) FROM rp_login) - ?1))`,
  ).run(LOGIN_MAX - 1);
  db.query(
    "INSERT INTO rp_login (state_hash, verifier, nonce, issuer, redirect_uri, expires_at) VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
  ).run(sha256(state), login.verifier, login.nonce, login.issuer, login.redirectUri, now + LOGIN_TTL_MS);
}
/** The sign-in a state began, used up by asking: a state works once. */
export function takeLogin(db: Database, state: string, now = Date.now()): Login | undefined {
  const row = db
    .query<
      { verifier: string; nonce: string; issuer: string; redirect_uri: string; expires_at: number },
      [string]
    >("DELETE FROM rp_login WHERE state_hash = ?1 RETURNING verifier, nonce, issuer, redirect_uri, expires_at")
    .get(sha256(state));
  if (row === null || row.expires_at <= now) return undefined;
  return { verifier: row.verifier, nonce: row.nonce, issuer: row.issuer, redirectUri: row.redirect_uri };
}
/** A local username for a parent's person: their name if free and fit, else made unique by their `sub`. */
async function makeAccount(db: Database, sub: string, preferred: string): Promise<User | undefined> {
  const base = preferred.toLowerCase().replace(/[^a-z0-9.-]/g, "").replace(/^[.-]+/, "").slice(0, 30);
  const tail = sub.toLowerCase().replace(/[^a-z0-9]/g, "").slice(-8);
  for (const username of [base, `${base}-${tail}`, `user-${tail}`]) {
    if (username === "" || username.startsWith("-")) continue;
    if (getUserByName(db, username) !== undefined) continue;
    const made = await createUser(db, {
      username,
      // Unique, never mailed: `.invalid` is reserved and resolves nowhere.
      email: `${sub.toLowerCase()}@sso.invalid`,
      displayName: preferred,
    });
    if (made.ok) return made.value;
  }
  return undefined;
}
const making = new Map<string, Promise<User | undefined>>();
/**
 * The local account for an issuer's `sub`, made on first sight with no
 * password. Two returns of the same person at once make one account.
 */
export function accountFor(
  db: Database,
  issuer: string,
  sub: string,
  preferred: string,
): Promise<User | undefined> {
  const key = `${issuer}\0${sub}`;
  const pending = making.get(key);
  if (pending !== undefined) return pending;
  const attempt = (async (): Promise<User | undefined> => {
    const known = db
      .query<{ user_id: string }, [string, string]>(
        "SELECT user_id FROM federated_identity WHERE issuer = ?1 AND sub = ?2",
      )
      .get(issuer, sub);
    if (known !== null) {
      const user = getUserById(db, known.user_id);
      return user !== undefined && isActive(user) ? user : undefined;
    }
    const made = await makeAccount(db, sub, preferred);
    if (made === undefined) return undefined;
    db.query("INSERT INTO federated_identity (issuer, sub, user_id) VALUES (?1, ?2, ?3)").run(
      issuer,
      sub,
      made.id,
    );
    return made;
  })();
  making.set(key, attempt);
  void attempt.finally(() => making.delete(key));
  return attempt;
}
/** The spawn record's upstream, read once per forge: it does not change while the process runs. */
const recorded = new WeakMap<object, string | undefined>();
/** The parent forge's origin: the address this forge was started with, or the spawn record's. Undefined for a forge with none. */
export function parentIssuerOf(config: {
  parentUrl?: string;
  parentLoopback?: boolean;
  dataDir: string;
}): string | undefined {
  let raw = config.parentUrl;
  if (raw === undefined) {
    if (!recorded.has(config)) {
      let upstream: string | undefined;
      try {
        const doc = JSON.parse(readFileSync(join(config.dataDir, "parent.json"), "utf8")) as { upstream?: unknown };
        if (typeof doc.upstream === "string") upstream = doc.upstream;
      } catch {
        // No record: no parent.
      }
      recorded.set(config, upstream);
    }
    raw = recorded.get(config);
  }
  if (raw === undefined || parentUrlProblem(raw, config.parentLoopback === true) !== null) return undefined;
  return new URL(raw).origin;
}
@@ -0,0 +1,25 @@
// Sign in with the parent forge (#748, core/federation.ts): the client id this
// forge was given at its parent, a sign-in in flight (state kept only as a
// hash), and which local account a parent's `sub` is.
export default `
  CREATE TABLE rp_client (
    issuer       TEXT NOT NULL,
    redirect_uri TEXT NOT NULL,
    client_id    TEXT NOT NULL,
    PRIMARY KEY (issuer, redirect_uri)
  ) WITHOUT ROWID;
  CREATE TABLE rp_login (
    state_hash   TEXT PRIMARY KEY,
    verifier     TEXT NOT NULL,
    nonce        TEXT NOT NULL,
    issuer       TEXT NOT NULL,
    redirect_uri TEXT NOT NULL,
    expires_at   INTEGER NOT NULL
  ) WITHOUT ROWID;
  CREATE TABLE federated_identity (
    issuer  TEXT NOT NULL,
    sub     TEXT NOT NULL,
    user_id TEXT NOT NULL REFERENCES user(id) ON DELETE CASCADE,
    PRIMARY KEY (issuer, sub)
  ) WITHOUT ROWID;
`;
@@ -0,0 +1,5 @@
// A consent that only signs someone in (OpenID scopes, no ro/rw) mints no
// token at the exchange; the code remembers it was asked that way.
export default `
  ALTER TABLE oauth_code ADD COLUMN signin_only INTEGER NOT NULL DEFAULT 0;
  `;
@@ -163,6 +163,8 @@
export interface AuthRequest {
  /** `openid` and the OIDC scopes asked with it; empty for a plain OAuth grant. */
  readonly oidcScopes: readonly string[];
  readonly nonce: string;
  /** OpenID scopes and no `ro`/`rw`: the person is signed in, no API token is granted. */
  readonly signInOnly: boolean;
}
const CHALLENGE = /^[A-Za-z0-9_-]{43}$/;
@@ -206,6 +208,7 @@
export function parseAuthRequest(
    scope: asked ?? "ro",
    oidcScopes: openid ? oidc : [],
    nonce: openid ? nonce : "",
    signInOnly: openid && asked === undefined,
  });
}
@@ -234,10 +237,11 @@
export function issueCode(
  request: AuthRequest,
  grant: { scope: OAuthScope; name: string; lifetimeS: number | null },
): string {
  const signInOnly = request.signInOnly ? 1 : 0;
  const code = secret();
  db.query(
    `INSERT INTO oauth_code (code_hash, client_id, user_id, redirect_uri, challenge, scope, name, lifetime_s, expires_at, oidc_scopes, nonce)
     VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11)`,
    `INSERT INTO oauth_code (code_hash, client_id, user_id, redirect_uri, challenge, scope, name, lifetime_s, expires_at, oidc_scopes, nonce, signin_only)
     VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12)`,
  ).run(
    sha256(code),
    request.client.id,
@@ -250,6 +254,7 @@
export function issueCode(
    new Date(Date.now() + CODE_TTL_MS).toISOString(),
    request.oidcScopes.join(" "),
    request.nonce,
    signInOnly,
  );
  db.query("DELETE FROM oauth_code WHERE expires_at <= ?1").run(
    new Date().toISOString(),
@@ -258,7 +263,8 @@
export function issueCode(
}
export interface Minted {
  readonly token: string;
  /** Absent for a sign-in-only grant: no credential is left behind. */
  readonly token?: string;
  readonly scope: OAuthScope;
  /** Seconds the token lives, or null for one that does not expire. */
  readonly expiresIn: number | null;
@@ -295,6 +301,7 @@
export async function redeemCode(
        expires_at: string;
        oidc_scopes: string;
        nonce: string;
        signin_only: number;
      },
      [string]
    >("DELETE FROM oauth_code WHERE code_hash = ?1 RETURNING *")
@@ -310,6 +317,16 @@
export async function redeemCode(
  if (digest !== row.challenge) return err("invalid_grant");
  const user = getUserById(db, row.user_id);
  if (user === null || user === undefined || !isActive(user)) return err("invalid_grant");
  if (row.signin_only === 1) {
    const idToken = await signIdToken(db, dataDir, {
      issuer: input.issuer,
      clientId: row.client_id,
      user,
      scopes: row.oidc_scopes.split(" "),
      nonce: row.nonce,
    });
    return ok({ scope: row.scope, expiresIn: null, idToken });
  }
  const minted = createToken(db, row.user_id, row.name, row.scope, {
    ...(row.lifetime_s === null
      ? {}
@@ -0,0 +1,52 @@
/**
 * Another forge's signing keys, fetched once and kept. A key id that is not
 * in what was kept may mean the issuer rotated, so the set is fetched again
 * — once, and not again for a minute however many tokens name an unknown
 * kid, so a forged token cannot make this forge hammer its parent.
 */
import { readCapped } from "../origins/providers/http.ts";
import type { Jwk } from "../kernel/jwt.ts";
export const JWKS_FRESH_MS = 10 * 60_000;
export const JWKS_REFETCH_MS = 60_000;
const BODY_MAX = 64 * 1024;
export type Fetch = (url: string, init?: RequestInit) => Promise<Response>;
export class KeySet {
  private keys: Jwk[] = [];
  private at = -Infinity;
  private pending: Promise<void> | undefined;
  constructor(
    private readonly url: string,
    private readonly fetcher: Fetch = fetch,
  ) {}
  async find(kid: string, now = Date.now()): Promise<Jwk | undefined> {
    const kept = (): Jwk | undefined => this.keys.find((k) => k["kid"] === kid);
    if (now - this.at < JWKS_FRESH_MS && kept() !== undefined) return kept();
    if (now - this.at >= JWKS_REFETCH_MS) await this.load(now);
    return kept();
  }
  private load(now: number): Promise<void> {
    this.pending ??= (async () => {
      try {
        const res = await this.fetcher(this.url, { redirect: "error", signal: AbortSignal.timeout(5000) });
        if (!res.ok) return;
      
        sentinelcrew
        29d ago
        outdated
      
      High: res.text() has already buffered everything before text.length > BODY_MAX runs, so the cap protects nothing. It also counts UTF-16 units, not bytes. Read with a byte-bounded reader that stops at BODY_MAX.
    
        const text = await readCapped(res, BODY_MAX, AbortSignal.timeout(5000));
        if (text === undefined) return;
        const list = (JSON.parse(text) as { keys?: unknown }).keys;
        if (!Array.isArray(list)) return;
        this.keys = list.filter((k): k is Jwk => typeof k === "object" && k !== null);
        this.at = now;
      } catch {
        // Unreachable or malformed: keep what we had; the caller refuses the token.
      } finally {
        this.pending = undefined;
      }
    })();
    return this.pending;
  }
}
@@ -82,9 +82,9 @@
export function oauthRoutes(router: Router<Handler>): void {
    if (!minted.ok) return grantError(minted.error);
    return json(
      {
        access_token: minted.value.token,
        ...(minted.value.token === undefined ? {} : { access_token: minted.value.token }),
        token_type: "Bearer",
        scope: minted.value.scope,
        ...(minted.value.token === undefined ? {} : { scope: minted.value.scope }),
        ...(minted.value.idToken === undefined ? {} : { id_token: minted.value.idToken }),
        ...(minted.value.expiresIn === null
          ? {}
@@ -0,0 +1,220 @@
/**
 * Continue with the parent forge (#748): this forge as a relying party of
 * the OpenID provider its parent already is. `/signin/parent` registers
 * this forge at the parent once (the client id is kept), then sends the
 * person there with a state, a nonce and a PKCE challenge; the state also
 * rides in an HttpOnly cookie so only the browser that began can finish.
 * `/signin/parent/callback` trades the code, checks the id_token (state,
 * nonce, iss, aud, exp, signature against the parent's JWKS) and signs in
 * the local account the parent's `sub` maps to, made on first sight.
 * Both are GETs that change nothing a stranger could use: a callback with
 * no matching cookie and state is refused before anything is fetched.
 */
import { createHash, randomBytes } from "node:crypto";
import type { App } from "../app.ts";
import {
  accountFor,
  clientFor,
  keepClient,
  parentIssuerOf,
  SUB,
  startLogin,
  takeLogin,
  CALLBACK_PATH,
} from "../core/federation.ts";
import { readCapped } from "../origins/providers/http.ts";
import { clientAddress } from "./peer.ts";
import { signinAllowed } from "../web/pages/site.ts";
import { createSession } from "../core/sessions.ts";
import { verifyJwt } from "../kernel/jwt.ts";
import { html } from "../web/html.ts";
import { page, redirect } from "../web/layout.ts";
import { sessionCookie } from "../web/pages/site.ts";
import { cookieValue, type Ctx } from "./context.ts";
import { KeySet } from "./jwks.ts";
export const STATE_COOKIE = "forge_rp";
const SCOPE = "openid profile";
      
        sentinelcrew
        28d ago
        
      
      With no ro/rw in the scope, the parent's parseAuthRequest falls back to ro, and its consent page offers Read/Read-and-act plus a lifetime. A sign-in should not ask for or receive API access: the parent needs an OpenID-only path, with a 'Sign in to <host>' consent and no token minted.
    
const rand = (bytes: number): string => randomBytes(bytes).toString("base64url");
const parentIssuer = (app: App): string | undefined => parentIssuerOf(app.config);
const keySets = new WeakMap<App, Map<string, KeySet>>();
const keysOf = (app: App, issuer: string): KeySet => {
  let sets = keySets.get(app);
  if (sets === undefined) keySets.set(app, (sets = new Map()));
  let set = sets.get(issuer);
  if (set === undefined) sets.set(issuer, (set = new KeySet(`${issuer}/oauth/jwks`)));
  return set;
};
/** What the parent may say in one answer: a client id or a token is small. */
const ANSWER_MAX = 16 * 1024;
/** The parent's JSON answer, read by bytes and refused past the cap. */
async function answerOf(res: Response): Promise<Record<string, unknown>> {
  const text = await readCapped(res, ANSWER_MAX, AbortSignal.timeout(5000));
  if (text === undefined) throw new Error("the parent's answer was too large");
  const body: unknown = JSON.parse(text);
  if (typeof body !== "object" || body === null) throw new Error("the parent's answer was not an object");
  return body as Record<string, unknown>;
}
const redirectUriOf = (ctx: Ctx): string => `${ctx.url.origin}${CALLBACK_PATH}`;
/** The client id at the issuer for this address, registering once if there is none. */
const registering = new Map<string, Promise<string>>();
async function clientId(ctx: Ctx, issuer: string, redirectUri: string): Promise<string> {
  const known = clientFor(ctx.app.db, issuer, redirectUri);
  if (known !== undefined) return known;
      
        sentinelcrew
        29d ago
        outdated
      
      High: res.json() reads the parent's whole answer into memory with no cap. Read it through readCapped (src/origins/providers/http.ts) with a small limit and refuse anything past it.
    
  const key = `${issuer}\0${redirectUri}`;
  let pending = registering.get(key);
  if (pending === undefined) {
    pending = (async () => {
      const res = await fetch(`${issuer}/oauth/register`, {
        method: "POST",
        headers: { "content-type": "application/json" },
        body: JSON.stringify({
          client_name: ctx.url.host.slice(0, 100),
          redirect_uris: [redirectUri],
        }),
        redirect: "error",
        signal: AbortSignal.timeout(5000),
      });
      const body = await answerOf(res);
      if (res.status !== 201 || typeof body.client_id !== "string" || body.client_id === "")
        throw new Error(`registration refused (${res.status})`);
      return keepClient(ctx.app.db, issuer, redirectUri, body.client_id);
    })();
    registering.set(key, pending);
    void pending.then(
      () => registering.delete(key),
      () => registering.delete(key),
    );
  }
  return pending;
}
function failure(ctx: Ctx, message: string, status: number): Response {
  const response = page(
    {
      ctx,
      title: "Sign in",
      body: html`<div class="narrow">
        <div class="page-head"><h1>Could not sign you in</h1></div>
        <p role="alert">${message}</p>
        <p><a href="/signin">Back to sign in</a></p>
      </div>`,
    },
    status,
  );
  response.headers.set("cache-control", "no-store");
  return response;
}
const cookieHeader = (value: string, maxAge: number, url: URL, forgeUrl?: string): string => {
  const secure = url.protocol === "https:" || forgeUrl?.startsWith("https://") ? "; Secure" : "";
  return `${STATE_COOKIE}=${value}; Path=/signin/parent; HttpOnly; SameSite=Lax; Max-Age=${maxAge}${secure}`;
};
      
        sentinelcrew
        29d ago
        outdated
      
      Medium: an anonymous GET writes a row here, and LOGIN_MAX evicts the oldest, so flooding this route cancels everyone's sign-in in flight. Throttle it (RateLimiter, keyed on the socket address or forge-wide) before startLogin.
    
export async function parentStart(ctx: Ctx): Promise<Response> {
  const issuer = parentIssuer(ctx.app);
  if (issuer === undefined) return failure(ctx, "This forge has no parent to sign in through.", 404);
  // Each start writes a row and the table is bounded: a flood must not push
  // out the sign-ins of people in flight. By socket address, never a header.
  const wait = signinAllowed(ctx, `parent:${clientAddress(ctx.request)}`);
      
        sentinelcrew
        28d ago
        
      
      Low: signinAllowed takes the whole-forge bucket before the per-key one. A single address looping on this GET drains the forge-wide sign-in budget that password sign-ins share. Check the per-address bucket first, or give the parent start its own forge cap.
    
  if (wait !== undefined) {
    const slow = failure(ctx, `Too many attempts. Try again in ${wait}s.`, 429);
    slow.headers.set("retry-after", String(wait));
    return slow;
  }
  const redirectUri = redirectUriOf(ctx);
  let client: string;
  try {
    client = await clientId(ctx, issuer, redirectUri);
  } catch {
    return failure(ctx, "The parent forge could not be reached.", 502);
  }
  const state = rand(24);
  const verifier = rand(48);
  const nonce = rand(24);
  startLogin(ctx.app.db, state, { verifier, nonce, issuer, redirectUri });
  const query = new URLSearchParams({
    response_type: "code",
    client_id: client,
    redirect_uri: redirectUri,
    scope: SCOPE,
    state,
    nonce,
    code_challenge: createHash("sha256").update(verifier).digest("base64url"),
    code_challenge_method: "S256",
  });
  const headers = new Headers({
    location: `${issuer}/oauth/authorize?${query}`,
    "cache-control": "no-store",
  });
  headers.append("set-cookie", cookieHeader(state, 600, ctx.url, ctx.app.config.url));
  return new Response(null, { status: 303, headers });
}
const clean = (s: unknown, max: number): string =>
  // eslint-disable-next-line no-control-regex
  typeof s === "string" ? s.replace(/[\u0000-\u001f\u007f]/g, "").trim().slice(0, max) : "";
export async function parentCallback(ctx: Ctx): Promise<Response> {
  const q = ctx.url.searchParams;
  const state = q.get("state") ?? "";
  const code = q.get("code") ?? "";
  // The cookie is the browser that began; without it nothing is fetched or spent.
  if (state === "" || state !== cookieValue(ctx.request, STATE_COOKIE))
    return failure(ctx, "This sign-in did not start in this browser.", 400);
  const login = takeLogin(ctx.app.db, state);
  const clear = cookieHeader("", 0, ctx.url, ctx.app.config.url);
  const refuse = (message: string, status = 400): Response => {
      
        sentinelcrew
        29d ago
        outdated
      
      High: the same problem on the token response. Cap it by bytes read before parsing.
    
    const response = failure(ctx, message, status);
    response.headers.append("set-cookie", clear);
    return response;
  };
  if (login === undefined || login.issuer !== parentIssuer(ctx.app) || login.redirectUri !== redirectUriOf(ctx))
    return refuse("This sign-in took too long or was already used.");
  if (q.has("error") || code === "" || code.length > 512)
    return refuse("The parent forge did not sign you in.");
  try {
    const client = await clientId(ctx, login.issuer, login.redirectUri);
    const res = await fetch(`${login.issuer}/oauth/token`, {
      method: "POST",
      body: new URLSearchParams({
        grant_type: "authorization_code",
        code,
        client_id: client,
        redirect_uri: login.redirectUri,
        code_verifier: login.verifier,
      }),
      redirect: "error",
      signal: AbortSignal.timeout(5000),
    });
    const body = await answerOf(res);
    if (!res.ok || typeof body.id_token !== "string")
      
        sentinelcrew
        28d ago
        
      
      High: the token answer also carries an access_token, a live API token for the person's parent account (default lifetime "until I revoke it"). It is ignored here and never revoked, so each sign-in leaves one more behind at the parent. Make an OpenID-only grant at the parent mint no token, and assert here that none came back.
    
      return refuse("The parent forge did not accept the sign-in.", 502);
    const keys = keysOf(ctx.app, login.issuer);
    const verified = await verifyJwt(
      body.id_token,
      (kid) => keys.find(kid),
      { issuer: login.issuer, audience: client, nonce: login.nonce },
    );
    if (!verified.ok) return refuse("The parent forge's answer did not verify.", 502);
    const sub = verified.value["sub"];
    if (typeof sub !== "string" || !SUB.test(sub))
      return refuse("The parent forge's answer did not verify.", 502);
    const name = clean(verified.value["preferred_username"], 64);
    const user = await accountFor(ctx.app.db, login.issuer, sub, name);
    if (user === undefined) return refuse("An account for you could not be made or is not allowed in.", 403);
    const session = createSession(ctx.app.db, user.id);
    const done = redirect("/", sessionCookie(session.token, session.expiresAt, ctx.url, ctx.app.config.url));
    done.headers.append("set-cookie", clear);
    done.headers.set("cache-control", "no-store");
    return done;
  } catch {
    return refuse("The parent forge could not be reached.", 502);
  }
}
@@ -8,6 +8,7 @@
import { signupOptions, signupPasskey } from "../web/pages/signup-passkey.ts";
import { TOOLBAR_NAME, toolbarResponse } from "../apps/toolbar.ts";
import { unsealReleased } from "../actions/sealed.ts";
import { parentCallback, parentStart } from "./rp.ts";
import { accessPage } from "../web/pages/access.ts";
import { capacityPage, capacitySet } from "../web/pages/capacity.ts";
import { flowPage } from "../web/pages/flow.ts";
@@ -633,6 +634,8 @@
export function buildRouter(): Router<Handler> {
  router.add("POST", "/front", frontUpdate);
  router.add("GET", "/signin", signinPage);
  router.add("POST", "/signin", signinSubmit);
  router.add("GET", "/signin/parent", parentStart);
  router.add("GET", "/signin/parent/callback", parentCallback);
  router.add("GET", "/signup", signupPage);
  router.add("GET", "/verify", verifyPage);
  router.add("POST", "/signup", signupSubmit);
@@ -0,0 +1,63 @@
/**
 * Verifying a JWT someone else signed: ES256 only, the key looked up by
 * `kid` through a function the caller gives (so where keys come from — a
 * cache, a fetch, a test — is not this file's business), then the claims a
 * relying party must check: issuer, audience, expiry and, when asked, nonce.
 * Anything off is `invalid_token`; the reason is not told to the caller.
 */
import { err, ok, type Result } from "./result.ts";
export type Jwk = Record<string, unknown>;
export interface JwtExpect {
  readonly issuer: string;
  readonly audience: string;
  readonly nonce?: string;
}
const KEY = { name: "ECDSA", namedCurve: "P-256" } as const;
const SIGN = { name: "ECDSA", hash: "SHA-256" } as const;
const SEGMENT = /^[A-Za-z0-9_-]+$/;
const decode = (part: string): Record<string, unknown> => {
  const parsed: unknown = JSON.parse(Buffer.from(part, "base64url").toString());
  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
    throw new Error("not an object");
  return parsed as Record<string, unknown>;
};
export async function verifyJwt(
  jwt: string,
  keyFor: (kid: string) => Promise<Jwk | undefined>,
  expect: JwtExpect,
  now = Date.now(),
): Promise<Result<Record<string, unknown>, "invalid_token">> {
  const parts = jwt.split(".");
  if (parts.length !== 3 || !parts.every((p) => SEGMENT.test(p)))
    return err("invalid_token");
  try {
    const head = decode(parts[0]!);
    if (head["alg"] !== "ES256" || typeof head["kid"] !== "string")
      return err("invalid_token");
    const jwk = await keyFor(head["kid"]);
    if (jwk === undefined) return err("invalid_token");
    const pub = await crypto.subtle.importKey("jwk", jwk as never, KEY, false, ["verify"]);
    const good = await crypto.subtle.verify(
      SIGN,
      pub,
      Buffer.from(parts[2]!, "base64url"),
      new TextEncoder().encode(`${parts[0]}.${parts[1]}`),
    );
    if (!good) return err("invalid_token");
    const claims = decode(parts[1]!);
    if (claims["iss"] !== expect.issuer || claims["aud"] !== expect.audience)
      return err("invalid_token");
    if (typeof claims["exp"] !== "number" || claims["exp"] * 1000 <= now)
      return err("invalid_token");
    if (expect.nonce !== undefined && claims["nonce"] !== expect.nonce)
      return err("invalid_token");
    return ok(claims);
  } catch {
    return err("invalid_token");
  }
}
@@ -93,7 +93,29 @@
const identity = (request: AuthRequest): Html | "" =>
        </ul>
      </fieldset>`;
function signInConsent(request: AuthRequest, values: Params): Html {
  const host = new URL(request.redirectUri).host;
  return html`<div class="narrow">
    ${pageHead(`Sign in to ${host}`)}
    ${card(
      html`<p class="mb">
          Sign in to <strong>${host}</strong> as you. It learns only what is
          listed below, and gets no access to this forge.
        </p>
        <form method="post" action="/oauth/authorize">
          ${PARAMS.map((name) => hidden(name, values[name]))}
          ${identity(request)}
          <div class="form-actions">
            ${btn("Sign in", { variant: "primary", name: "decision", value: "allow" })}
            ${btn("Deny", { name: "decision", value: "deny" })}
          </div>
        </form>`,
    )}
  </div>`;
}
function consent(ctx: Ctx, request: AuthRequest, values: Params): Html {
  if (request.signInOnly) return signInConsent(request, values);
  const host = new URL(request.redirectUri).host;
  return html`<div class="narrow">
    ${pageHead(`Connect ${request.client.name}`)}
@@ -179,6 +201,14 @@
export async function authorizeSubmit(ctx: Ctx): Promise<Response> {
    return guard(
      redirect(redirectWith(redirectUri, { error: "access_denied", state })),
    );
  if (request.value.signInOnly) {
    const code = issueCode(ctx.app.db, ctx.auth.user.id, request.value, {
      scope: "ro",
      name: request.value.client.name,
      lifetimeS: null,
    });
    return guard(redirect(redirectWith(redirectUri, { code, state })));
  }
  const grant = field(form, "grant");
  const lifetime = LIFETIMES[field(form, "lifetime")];
  if (!isOAuthScope(grant) || lifetime === undefined)
@@ -46,6 +46,7 @@
import {
import { existsSync } from "node:fs";
import { join } from "node:path";
import { hasAdmin } from "../../spawn/claim.ts";
import { parentIssuerOf } from "../../core/federation.ts";
export function sessionCookie(
  value: string,
@@ -369,6 +370,15 @@
function authForm(
        <a class="small" href="/recover">Lost your device?</a>
      </p>`,
    )}
    ${when(
      
        sentinelcrew
        29d ago
        outdated
      
      Low: this calls readFileSync on parent.json for every /signin render. The spawn record does not change while the process runs; resolve it once (at app creation, or memoised per App).
    
      kind === "signin" ? parentIssuerOf(ctx.app.config) : undefined,
      (parent) => html`<p class="mt">
        ${btn(`Continue with ${new URL(parent).host}`, {
          href: "/signin/parent",
          variant: "outline",
        })}
      </p>`,
    )}
    ${claimable
      ? html`<p class="muted small mt" id="claim-door">
          Was this forge made for you? <a href="/claim">Claim it with your code</a>.
@@ -426,10 +436,11 @@
export function signinAllowed(ctx: Ctx, username: string): number | undefined {
    adminPerMinute: limitValue(ctx.app.db, "signin.per_forge"),
    enabled: true,
  });
  const whole = limiter.take("forge", "admin");
  if (!whole.allowed) return whole.retryAfter;
  // The one key first: a key already refused must not spend the forge's budget.
  const one = limiter.take(`account:${username.toLowerCase()}`, "ro");
  return one.allowed ? undefined : one.retryAfter;
  if (!one.allowed) return one.retryAfter;
  const whole = limiter.take("forge", "admin");
  return whole.allowed ? undefined : whole.retryAfter;
}
export async function signinSubmit(ctx: Ctx): Promise<Response> {
@@ -0,0 +1,389 @@
/**
 * Sign in with your forge (#748): two forges booted, a person signed into the
 * child through the parent's OpenID provider. The id_token's checks are tried
 * one spoiled claim at a time, and the parent's keys are fetched once and
 * again only for a key id they do not hold.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { createSession } from "../src/core/sessions.ts";
import { createUser, getUserByName, verifyPassword } from "../src/core/users.ts";
import { addKey, findKeyByFingerprint, fingerprint, parseAuthorizedKey } from "../src/core/keys.ts";
import { KeySet } from "../src/http/jwks.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { verifyJwt } from "../src/kernel/jwt.ts";
import { signinAllowed } from "../src/web/pages/site.ts";
import type { Ctx } from "../src/http/context.ts";
import { quietLogs } from "./helpers/globals.ts";
quietLogs();
const PASSWORD = "a-long-family-passphrase";
describe("sign in through the parent forge", () => {
  let dirs: string[] = [];
  let parent: App;
  let child: App;
  let parentServers: Servers;
  let childServers: Servers;
  let alice = "";
  let aliceCookie = "";
  const cookieOf = (res: Response, name: string): string | undefined =>
    res.headers
      .getSetCookie()
      .map((c) => c.split(";")[0]!)
      .find((c) => c.startsWith(`${name}=`));
  /** Begin at the child, consent at the parent as the person with `cookie`; the child's callback address and its state cookie. */
  const begin = async (cookie: string) => {
    const start = await fetch(`${childServers.url}/signin/parent`, { redirect: "manual" });
    expect(start.status).toBe(303);
    const to = new URL(start.headers.get("location")!);
    expect(to.origin).toBe(parentServers.url);
    expect(to.pathname).toBe("/oauth/authorize");
    const state = cookieOf(start, "forge_rp")!;
    expect(state).toBeDefined();
    const consent = await fetch(`${parentServers.url}/oauth/authorize`, {
      method: "POST",
      redirect: "manual",
      headers: { cookie, origin: parentServers.url },
      body: new URLSearchParams({
        ...Object.fromEntries(to.searchParams),
        decision: "allow",
      }),
    });
    expect(consent.status).toBe(303);
    return { callback: new URL(consent.headers.get("location")!), state };
  };
  const finish = (callback: URL, state: string | undefined) =>
    fetch(`${childServers.url}${callback.pathname}${callback.search}`, {
      redirect: "manual",
      headers: state === undefined ? {} : { cookie: state },
    });
  beforeAll(async () => {
    const make = async () => {
      const dir = await mkdtemp(join(tmpdir(), "forge-signin-"));
      dirs.push(dir);
      return dir;
    };
    parent = createApp({ dataDir: await make(), port: 0 });
    parentServers = await serve(parent);
    child = createApp({
      dataDir: await make(),
      port: 0,
      parentUrl: parentServers.url,
      parentLoopback: true,
    });
    childServers = await serve(child);
    const made = await createUser(parent.db, {
      username: "alice",
      email: "[email protected]",
      password: PASSWORD,
      adminIfFirst: true,
    });
    if (!made.ok) throw new Error(made.error);
    alice = made.value.id;
    aliceCookie = `forge_session=${createSession(parent.db, alice).token}`;
  });
  afterAll(async () => {
    parentServers.stop();
    childServers.stop();
    for (const dir of dirs) await rm(dir, { recursive: true, force: true });
  });
  test("only a forge with a parent offers the button", async () => {
    const onChild = await (await fetch(`${childServers.url}/signin`)).text();
    expect(onChild).toContain(`Continue with ${new URL(parentServers.url).host}`);
    expect(onChild).toContain('href="/signin/parent"');
    expect(await (await fetch(`${parentServers.url}/signin`)).text()).not.toContain("Continue with");
    const none = await fetch(`${parentServers.url}/signin/parent`, { redirect: "manual" });
    expect(none.status).toBe(404);
  });
  test("a person signs into the child through the parent, and the account keys on sub", async () => {
    const { callback, state } = await begin(aliceCookie);
    expect(callback.origin).toBe(childServers.url);
    const done = await finish(callback, state);
    expect(done.status).toBe(303);
    expect(done.headers.get("location")).toBe("/");
    const session = cookieOf(done, "forge_session")!;
    expect(session).toBeDefined();
    expect(done.headers.getSetCookie().find((c) => c.startsWith("forge_session="))).toContain("HttpOnly");
    const local = getUserByName(child.db, "alice")!;
    expect(local.id).not.toBe("");
    // No password was ever set: only the parent vouches for this account.
    expect((await verifyPassword(child.db, "alice", "")).ok).toBe(false);
    expect((await verifyPassword(child.db, "alice", PASSWORD)).ok).toBe(false);
    const settings = await fetch(`${childServers.url}/settings`, { headers: { cookie: session }, redirect: "manual" });
    expect(settings.status).toBe(200);
    // Renamed at the parent, the same person is the same local account.
    parent.db.query("UPDATE user SET username = 'alice-renamed' WHERE id = ?1").run(alice);
    const again = await begin(aliceCookie);
    const second = await finish(again.callback, again.state);
    expect(second.status).toBe(303);
    expect(getUserByName(child.db, "alice-renamed")).toBeUndefined();
    expect(child.db.query("SELECT COUNT(*) AS n FROM user WHERE username LIKE 'alice%'").get()).toEqual({ n: 1 });
    // Registered at the parent once, and the id kept.
    expect(parent.db.query("SELECT COUNT(*) AS n FROM oauth_client").get()).toEqual({ n: 1 });
    expect(child.db.query("SELECT COUNT(*) AS n FROM rp_client").get()).toEqual({ n: 1 });
    parent.db.query("UPDATE user SET username = 'alice' WHERE id = ?1").run(alice);
  });
  test("signing in leaves no API credential at the parent, and the token answer carries none", async () => {
    const tokens = () => parent.db.query("SELECT COUNT(*) AS n FROM token WHERE user_id = ?1").get(alice);
    const before = tokens();
    const page = await fetch(
      `${parentServers.url}/oauth/authorize?` +
        new URL((await fetch(`${childServers.url}/signin/parent`, { redirect: "manual" })).headers.get("location")!).searchParams,
      { headers: { cookie: aliceCookie } },
    );
    const text = await page.text();
    expect(text).toContain("Sign in");
    expect(text).not.toContain('name="lifetime"');
    expect(text).not.toContain('name="grant"');
    const { callback, state } = await begin(aliceCookie);
    expect((await finish(callback, state)).status).toBe(303);
    expect(tokens()).toEqual(before);
    // The exchange itself, done by hand: an id_token and nothing to call the API with.
    const client = parent.db
      .query<{ id: string; redirect_uris: string }, []>("SELECT id, redirect_uris FROM oauth_client")
      .get()!;
    const redirect = (JSON.parse(client.redirect_uris) as string[])[0]!;
    const verifier = "v".repeat(64);
    const challenge = new Bun.CryptoHasher("sha256").update(verifier).digest("base64url");
    const asked = await fetch(`${parentServers.url}/oauth/authorize`, {
      method: "POST",
      redirect: "manual",
      headers: { cookie: aliceCookie, origin: parentServers.url },
      body: new URLSearchParams({
        response_type: "code",
        client_id: client.id,
        redirect_uri: redirect,
        scope: "openid profile",
        state: "s",
        nonce: "n",
        code_challenge: challenge,
        code_challenge_method: "S256",
        decision: "allow",
      }),
    });
    const code = new URL(asked.headers.get("location")!).searchParams.get("code")!;
    const answer = await fetch(`${parentServers.url}/oauth/token`, {
      method: "POST",
      body: new URLSearchParams({
        grant_type: "authorization_code",
        code,
        client_id: client.id,
        redirect_uri: redirect,
        code_verifier: verifier,
      }),
    });
    const body = (await answer.json()) as Record<string, unknown>;
    expect(answer.status).toBe(200);
    expect(typeof body.id_token).toBe("string");
    expect(body.access_token).toBeUndefined();
    expect(tokens()).toEqual(before);
  });
  test("a parent's name that is taken here does not take over the local account", async () => {
    const bob = await createUser(parent.db, { username: "bob", email: "[email protected]", password: PASSWORD });
    if (!bob.ok) throw new Error(bob.error);
    const local = await createUser(child.db, { username: "bob", email: "[email protected]", password: PASSWORD });
    if (!local.ok) throw new Error(local.error);
    const { callback, state } = await begin(`forge_session=${createSession(parent.db, bob.value.id).token}`);
    const done = await finish(callback, state);
    expect(done.status).toBe(303);
    const row = child.db
      .query<{ user_id: string }, [string]>("SELECT user_id FROM federated_identity WHERE sub = ?1")
      .get(bob.value.id)!;
    expect(row.user_id).not.toBe(local.value.id);
  });
  test("a callback is refused without its browser's cookie, with another state, or a second time", async () => {
    const { callback, state } = await begin(aliceCookie);
    expect((await finish(callback, undefined)).status).toBe(400);
    expect((await finish(callback, "forge_rp=other")).status).toBe(400);
    const sessions = () => child.db.query("SELECT COUNT(*) AS n FROM session").get();
    const before = sessions();
    expect((await finish(callback, state)).status).toBe(303);
    const replay = await finish(callback, state);
    expect(replay.status).toBe(400);
    expect(cookieOf(replay, "forge_session")).toBeUndefined();
    expect(sessions()).toEqual({ n: (before as { n: number }).n + 1 });
  });
  test("a nonce that is not the one this browser sent is refused", async () => {
    const { callback, state } = await begin(aliceCookie);
    child.db.query("UPDATE rp_login SET nonce = 'not-the-nonce'").run();
    const done = await finish(callback, state);
    expect(done.status).toBe(502);
    expect(cookieOf(done, "forge_session")).toBeUndefined();
  });
  test("an error from the parent, or no code, signs no one in", async () => {
    const { state } = await begin(aliceCookie);
    const value = state.slice("forge_rp=".length);
    const done = await finish(new URL(`${childServers.url}/signin/parent/callback?state=${value}&error=access_denied`), state);
    expect(done.status).toBe(400);
    expect(cookieOf(done, "forge_session")).toBeUndefined();
  });
  test("a person made here adds an SSH key, and the terminal's key door resolves it to that account", async () => {
    const local = getUserByName(child.db, "alice")!;
    const line = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB2S7bF0R4NmuTUvVJXPPjdI1AF8XHXeYSNfr8DJ5eDo alice";
    const parsed = parseAuthorizedKey(line);
    if (!parsed.ok) throw new Error("key");
    expect(addKey(child.db, local.id, "laptop", parsed.value).ok).toBe(true);
    expect(findKeyByFingerprint(child.db, fingerprint(parsed.value.blob))?.userId).toBe(local.id);
  });
  test("starting a sign-in is throttled, so a flood cannot push out those in flight", async () => {
    const statuses: number[] = [];
    for (let i = 0; i < 30; i++)
      statuses.push((await fetch(`${childServers.url}/signin/parent`, { redirect: "manual" })).status);
    expect(statuses).toContain(429);
    const slow = await fetch(`${childServers.url}/signin/parent`, { redirect: "manual" });
    expect(slow.status).toBe(429);
    expect(Number(slow.headers.get("retry-after"))).toBeGreaterThan(0);
  });
});
describe("the sign-in throttle", () => {
  test("a key that is refused does not spend the forge-wide budget", async () => {
    const dir = await mkdtemp(join(tmpdir(), "forge-signin-"));
    const app = createApp({ dataDir: dir, port: 0 });
    const ctx = { app } as unknown as Ctx;
    for (let i = 0; i < 60; i++) signinAllowed(ctx, "parent:one");
    // The forge's whole budget (200) is still there for 180 other keys.
    for (let i = 0; i < 180; i++) expect(signinAllowed(ctx, `k${i}`)).toBeUndefined();
    await rm(dir, { recursive: true, force: true });
  });
});
describe("verifyJwt", () => {
  const b64 = (v: unknown) => Buffer.from(typeof v === "string" ? v : JSON.stringify(v)).toString("base64url");
  let pair: CryptoKeyPair;
  let jwk: Record<string, unknown>;
  const now = 1_700_000_000_000;
  const expectation = { issuer: "https://p", audience: "c1", nonce: "n1" };
  beforeAll(async () => {
    pair = (await crypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, ["sign", "verify"])) as CryptoKeyPair;
    jwk = { ...(await crypto.subtle.exportKey("jwk", pair.publicKey)), kid: "k1" };
  });
  const mint = async (claims: Record<string, unknown> = {}, head: Record<string, unknown> = {}) => {
    const h = b64({ alg: "ES256", kid: "k1", ...head });
    const p = b64({ iss: "https://p", aud: "c1", nonce: "n1", sub: "s", exp: now / 1000 + 60, ...claims });
    const sig = await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, pair.privateKey, new TextEncoder().encode(`${h}.${p}`));
    return `${h}.${p}.${Buffer.from(sig).toString("base64url")}`;
  };
  const keys = async (kid: string) => (kid === "k1" ? jwk : undefined);
  test("a good token passes", async () => {
    const out = await verifyJwt(await mint(), keys, expectation, now);
    expect(out.ok && out.value["sub"]).toBe("s");
  });
  test("each spoiled claim, key and signature is refused", async () => {
    const good = await mint();
    const [h, p, s] = good.split(".");
    const forged = `${h}.${b64({ iss: "https://p", aud: "c1", nonce: "n1", sub: "root", exp: now / 1000 + 60 })}.${s}`;
    const cases: [string, string][] = [
      ["wrong iss", await mint({ iss: "https://evil" })],
      ["wrong aud", await mint({ aud: "c2" })],
      ["wrong nonce", await mint({ nonce: "n2" })],
      ["no nonce", await mint({ nonce: undefined })],
      ["expired", await mint({ exp: now / 1000 - 1 })],
      ["no exp", await mint({ exp: undefined })],
      ["unknown kid", await mint({}, { kid: "k2" })],
      ["alg none", await mint({}, { alg: "none" })],
      ["alg HS256", await mint({}, { alg: "HS256" })],
      ["tampered payload", forged],
      ["two parts", `${h}.${p}`],
      ["not base64", "a.b.c!"],
    ];
    for (const [name, jwt] of cases) {
      const out = await verifyJwt(jwt, keys, expectation, now);
      expect([name, out.ok]).toEqual([name, false]);
    }
    // A key that is not the signer's refuses a good token.
    const other = (await crypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, ["sign", "verify"])) as CryptoKeyPair;
    const otherJwk = { ...(await crypto.subtle.exportKey("jwk", other.publicKey)), kid: "k1" };
    expect((await verifyJwt(good, async () => otherJwk, expectation, now)).ok).toBe(false);
  });
});
describe("a parent's keys, cached", () => {
  const set = (keys: string[]) => {
    const calls: string[] = [];
    const fetcher = async (url: string) => {
      calls.push(url);
      return Response.json({ keys: keys.map((kid) => ({ kid, kty: "EC" })) });
    };
    return { calls, fetcher };
  };
  test("fetched once, then served from memory", async () => {
    const { calls, fetcher } = set(["a", "b"]);
    const keys = new KeySet("https://p/oauth/jwks", fetcher);
    expect((await keys.find("a", 1000))?.["kid"]).toBe("a");
    expect((await keys.find("b", 2000))?.["kid"]).toBe("b");
    expect((await keys.find("a", 3000))?.["kid"]).toBe("a");
    expect(calls).toHaveLength(1);
  });
  test("an unknown kid looks again once, and not again within the minute", async () => {
    const live = set(["a"]);
    const keys = new KeySet("https://p/oauth/jwks", live.fetcher);
    await keys.find("a", 0);
    // The parent rotated: the next fetch has the new key.
    const rotated = set(["a", "b"]);
    (keys as unknown as { fetcher: unknown }).fetcher = rotated.fetcher;
    expect(await keys.find("b", 70_000)).toBeDefined();
    expect(rotated.calls).toHaveLength(1);
    // A kid nobody has: one more look at most, then none for a minute.
    expect(await keys.find("zzz", 140_000)).toBeUndefined();
    expect(await keys.find("zzz", 141_000)).toBeUndefined();
    expect(await keys.find("yyy", 150_000)).toBeUndefined();
    expect(rotated.calls).toHaveLength(2);
  });
  test("an unreachable parent keeps the keys it had", async () => {
    const good = set(["a"]);
    const keys = new KeySet("https://p/oauth/jwks", good.fetcher);
    await keys.find("a", 0);
    (keys as unknown as { fetcher: unknown }).fetcher = async () => {
      throw new Error("down");
    };
    expect(await keys.find("nope", 100_000)).toBeUndefined();
    expect(await keys.find("a", 100_001)).toBeDefined();
  });
});
describe("a parent's oversized answer", () => {
  /** A body that never ends, counting how many chunks were pulled from it. */
  const endless = () => {
    const pulled = { n: 0 };
    const body = new ReadableStream<Uint8Array>({
      pull(controller) {
        pulled.n++;
        controller.enqueue(new Uint8Array(1024).fill(32));
      },
    });
    return { pulled, response: new Response(body) };
  };
  test("the key set is refused past its cap without reading on", async () => {
    const { pulled, response } = endless();
    const keys = new KeySet("https://p/oauth/jwks", async () => response);
    expect(await keys.find("a", 0)).toBeUndefined();
    expect(pulled.n).toBeLessThan(200);
  });
});
@@ -279,7 +279,7 @@
describe("oauth authorize and token", () => {
  const b64 = (part: string) => JSON.parse(Buffer.from(part, "base64url").toString());
  test("scope=openid with a nonce returns a verifiable id_token beside the access token, and userinfo answers", async () => {
    const q = query({ scope: "openid profile email", nonce: "n-0S6_WzA2Mj" });
    const q = query({ scope: "openid profile email ro", nonce: "n-0S6_WzA2Mj" });
    const code = new URL((await consent(q)).headers.get("location")!).searchParams.get("code")!;
    const res = await exchange({ code });
    expect(res.status).toBe(200);
		@@ -173,6 +173,23 @@ The relying party is the address the browser used (or
173	173	`FORGE_URL`), so a passkey does not follow a forge to another hostname.
174	174	Sign-up is a username, an email address and a passkey (`/signup`, `src/web/pages/signup-passkey.ts`); the running server refuses a password-only sign-up on the form, `POST /api/v1/users` and the terminal (`passkeyOnlySignup`, set in `main.ts`). Accounts that already have a password still sign in. The owner claim of a spawned forge (`/claim`, `web/pages/claim.ts`) and an admin's everyday account (`web/pages/everyday.ts`) make their account with a passkey too (`web/passkey-ceremony.ts`, challenges from `POST /claim/options` and `POST /settings/everyday/options`); neither reads a password, and without JavaScript the page says a passkey needs it. A claim post with no passkey is refused and does not spend the link.
175	175
	176	A forge with a parent (`FORGE_PARENT_URL`, or the `upstream` in a spawned
	177	forge's `parent.json`) offers "Continue with <parent>" on `/signin`. The forge
	178	registers itself once at the parent's `/oauth/register` (the client id is kept
	179	in `rp_client`), sends the person through the parent's authorize page with
	180	PKCE, and on return checks state (also bound to the browser by an HttpOnly
	181	cookie), nonce, `iss`, `aud`, `exp` and the ES256 signature against the
	182	parent's JWKS (`kernel/jwt.ts`; keys are cached ten minutes and an unknown
	183	`kid` refetches them once a minute at most). The parent's `sub` — never the
	184	username — maps to a local account made on first sight with no password
	185	(`core/federation.ts`; `http/rp.ts` has the two routes). No dependency added.
	186	The parent's answers are read by bytes and refused past 16 KiB (64 KiB for the
	187	key set), and starting a sign-in is throttled like a password attempt.
	188	An account made this way has no password, so the terminal's username-and-password
	189	door (`s`) cannot let that person in. They add an SSH key under Settings → Keys
	190	once signed in on the web; after that the terminal signs them straight in as
	191	that account, as for anyone with a key.
	192
176	193	Your SSH key is your identity. A key the forge knows signs you straight in; any
177	194	other key browses public repos as a guest and can press `s` to sign in with a
178	195	username and password — which links that key to your account, so the next
		@@ -0,0 +1,153 @@
	1	/**
	2	* Signing in through another forge (#748): what this forge, as a relying
	3	* party, keeps. The client id it was given at the issuer (one per redirect
	4	* address), a sign-in in flight (the state only as a hash, so a leaked
	5	* database starts nothing), and which local account an issuer's `sub` is.
	6	* The username is never the key: it can be renamed, and a name the parent
	7	* frees may be taken by someone else.
	8	*/
	9	import type { Database } from "bun:sqlite";
	10	import { readFileSync } from "node:fs";
	11	import { join } from "node:path";
	12	import { sha256 } from "../kernel/hash.ts";
	13	import { parentUrlProblem } from "./parent_releases.ts";
	14	import { createUser, getUserById, getUserByName, isActive, type User } from "./users.ts";
	15
	16	/** Where the parent sends a person back; the address registered at the parent. */
		sentinelcrew 29d ago outdated Low: this doc comment belongs to `LOGIN_TTL_MS` but sits above `CALLBACK_PATH`, which now carries two doc comments. Move it down.
	17	export const CALLBACK_PATH = "/signin/parent/callback";
	18
	19	/** A sign-in not finished in this long is gone. */
	20	export const LOGIN_TTL_MS = 10 * 60_000;
	21	/** The most sign-ins in flight at once; the oldest make room. */
	22	export const LOGIN_MAX = 1000;
	23	/** A `sub` we accept: an id, not free text. */
	24	export const SUB = /^[A-Za-z0-9_-]{1,64}$/;
	25
	26	export const clientFor = (db: Database, issuer: string, redirectUri: string): string \| undefined =>
	27	db
	28	.query<{ client_id: string }, [string, string]>(
	29	"SELECT client_id FROM rp_client WHERE issuer = ?1 AND redirect_uri = ?2",
	30	)
	31	.get(issuer, redirectUri)?.client_id;
	32
	33	/** Keep the first client id for an address; a racing second registration loses. */
	34	export function keepClient(db: Database, issuer: string, redirectUri: string, clientId: string): string {
	35	db.query(
	36	"INSERT INTO rp_client (issuer, redirect_uri, client_id) VALUES (?1, ?2, ?3) ON CONFLICT DO NOTHING",
	37	).run(issuer, redirectUri, clientId);
	38	return clientFor(db, issuer, redirectUri) ?? clientId;
	39	}
	40
	41	export interface Login {
	42	readonly verifier: string;
	43	readonly nonce: string;
	44	readonly issuer: string;
	45	readonly redirectUri: string;
	46	}
	47
	48	export function startLogin(db: Database, state: string, login: Login, now = Date.now()): void {
	49	db.query("DELETE FROM rp_login WHERE expires_at <= ?1").run(now);
	50	db.query(
	51	`DELETE FROM rp_login WHERE state_hash IN
	52	(SELECT state_hash FROM rp_login ORDER BY expires_at LIMIT max(0, (SELECT count(*) FROM rp_login) - ?1))`,
	53	).run(LOGIN_MAX - 1);
	54	db.query(
	55	"INSERT INTO rp_login (state_hash, verifier, nonce, issuer, redirect_uri, expires_at) VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
	56	).run(sha256(state), login.verifier, login.nonce, login.issuer, login.redirectUri, now + LOGIN_TTL_MS);
	57	}
	58
	59	/** The sign-in a state began, used up by asking: a state works once. */
	60	export function takeLogin(db: Database, state: string, now = Date.now()): Login \| undefined {
	61	const row = db
	62	.query<
	63	{ verifier: string; nonce: string; issuer: string; redirect_uri: string; expires_at: number },
	64	[string]
	65	>("DELETE FROM rp_login WHERE state_hash = ?1 RETURNING verifier, nonce, issuer, redirect_uri, expires_at")
	66	.get(sha256(state));
	67	if (row === null \|\| row.expires_at <= now) return undefined;
	68	return { verifier: row.verifier, nonce: row.nonce, issuer: row.issuer, redirectUri: row.redirect_uri };
	69	}
	70
	71	/** A local username for a parent's person: their name if free and fit, else made unique by their `sub`. */
	72	async function makeAccount(db: Database, sub: string, preferred: string): Promise<User \| undefined> {
	73	const base = preferred.toLowerCase().replace(/[^a-z0-9.-]/g, "").replace(/^[.-]+/, "").slice(0, 30);
	74	const tail = sub.toLowerCase().replace(/[^a-z0-9]/g, "").slice(-8);
	75	for (const username of [base, `${base}-${tail}`, `user-${tail}`]) {
	76	if (username === "" \|\| username.startsWith("-")) continue;
	77	if (getUserByName(db, username) !== undefined) continue;
	78	const made = await createUser(db, {
	79	username,
	80	// Unique, never mailed: `.invalid` is reserved and resolves nowhere.
	81	email: `${sub.toLowerCase()}@sso.invalid`,
	82	displayName: preferred,
	83	});
	84	if (made.ok) return made.value;
	85	}
	86	return undefined;
	87	}
	88
	89	const making = new Map<string, Promise<User \| undefined>>();
	90
	91	/**
	92	* The local account for an issuer's `sub`, made on first sight with no
	93	* password. Two returns of the same person at once make one account.
	94	*/
	95	export function accountFor(
	96	db: Database,
	97	issuer: string,
	98	sub: string,
	99	preferred: string,
	100	): Promise<User \| undefined> {
	101	const key = `${issuer}\0${sub}`;
	102	const pending = making.get(key);
	103	if (pending !== undefined) return pending;
	104	const attempt = (async (): Promise<User \| undefined> => {
	105	const known = db
	106	.query<{ user_id: string }, [string, string]>(
	107	"SELECT user_id FROM federated_identity WHERE issuer = ?1 AND sub = ?2",
	108	)
	109	.get(issuer, sub);
	110	if (known !== null) {
	111	const user = getUserById(db, known.user_id);
	112	return user !== undefined && isActive(user) ? user : undefined;
	113	}
	114	const made = await makeAccount(db, sub, preferred);
	115	if (made === undefined) return undefined;
	116	db.query("INSERT INTO federated_identity (issuer, sub, user_id) VALUES (?1, ?2, ?3)").run(
	117	issuer,
	118	sub,
	119	made.id,
	120	);
	121	return made;
	122	})();
	123	making.set(key, attempt);
	124	void attempt.finally(() => making.delete(key));
	125	return attempt;
	126	}
	127
	128	/** The spawn record's upstream, read once per forge: it does not change while the process runs. */
	129	const recorded = new WeakMap<object, string \| undefined>();
	130
	131	/** The parent forge's origin: the address this forge was started with, or the spawn record's. Undefined for a forge with none. */
	132	export function parentIssuerOf(config: {
	133	parentUrl?: string;
	134	parentLoopback?: boolean;
	135	dataDir: string;
	136	}): string \| undefined {
	137	let raw = config.parentUrl;
	138	if (raw === undefined) {
	139	if (!recorded.has(config)) {
	140	let upstream: string \| undefined;
	141	try {
	142	const doc = JSON.parse(readFileSync(join(config.dataDir, "parent.json"), "utf8")) as { upstream?: unknown };
	143	if (typeof doc.upstream === "string") upstream = doc.upstream;
	144	} catch {
	145	// No record: no parent.
	146	}
	147	recorded.set(config, upstream);
	148	}
	149	raw = recorded.get(config);
	150	}
	151	if (raw === undefined \|\| parentUrlProblem(raw, config.parentLoopback === true) !== null) return undefined;
	152	return new URL(raw).origin;
	153	}
		@@ -0,0 +1,25 @@
	1	// Sign in with the parent forge (#748, core/federation.ts): the client id this
	2	// forge was given at its parent, a sign-in in flight (state kept only as a
	3	// hash), and which local account a parent's `sub` is.
	4	export default `
	5	CREATE TABLE rp_client (
	6	issuer TEXT NOT NULL,
	7	redirect_uri TEXT NOT NULL,
	8	client_id TEXT NOT NULL,
	9	PRIMARY KEY (issuer, redirect_uri)
	10	) WITHOUT ROWID;
	11	CREATE TABLE rp_login (
	12	state_hash TEXT PRIMARY KEY,
	13	verifier TEXT NOT NULL,
	14	nonce TEXT NOT NULL,
	15	issuer TEXT NOT NULL,
	16	redirect_uri TEXT NOT NULL,
	17	expires_at INTEGER NOT NULL
	18	) WITHOUT ROWID;
	19	CREATE TABLE federated_identity (
	20	issuer TEXT NOT NULL,
	21	sub TEXT NOT NULL,
	22	user_id TEXT NOT NULL REFERENCES user(id) ON DELETE CASCADE,
	23	PRIMARY KEY (issuer, sub)
	24	) WITHOUT ROWID;
	25	`;
		@@ -0,0 +1,5 @@
	1	// A consent that only signs someone in (OpenID scopes, no ro/rw) mints no
	2	// token at the exchange; the code remembers it was asked that way.
	3	export default `
	4	ALTER TABLE oauth_code ADD COLUMN signin_only INTEGER NOT NULL DEFAULT 0;
	5	`;
		@@ -163,6 +163,8 @@ export interface AuthRequest {
163	163	/** `openid` and the OIDC scopes asked with it; empty for a plain OAuth grant. */
164	164	readonly oidcScopes: readonly string[];
165	165	readonly nonce: string;
	166	/** OpenID scopes and no `ro`/`rw`: the person is signed in, no API token is granted. */
	167	readonly signInOnly: boolean;
166	168	}
167	169
168	170	const CHALLENGE = /^[A-Za-z0-9_-]{43}$/;
		@@ -206,6 +208,7 @@ export function parseAuthRequest(
206	208	scope: asked ?? "ro",
207	209	oidcScopes: openid ? oidc : [],
208	210	nonce: openid ? nonce : "",
	211	signInOnly: openid && asked === undefined,
209	212	});
210	213	}
211	214
		@@ -234,10 +237,11 @@ export function issueCode(
234	237	request: AuthRequest,
235	238	grant: { scope: OAuthScope; name: string; lifetimeS: number \| null },
236	239	): string {
	240	const signInOnly = request.signInOnly ? 1 : 0;
237	241	const code = secret();
238	242	db.query(
239		`INSERT INTO oauth_code (code_hash, client_id, user_id, redirect_uri, challenge, scope, name, lifetime_s, expires_at, oidc_scopes, nonce)
240		VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11)`,
	243	`INSERT INTO oauth_code (code_hash, client_id, user_id, redirect_uri, challenge, scope, name, lifetime_s, expires_at, oidc_scopes, nonce, signin_only)
	244	VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12)`,
241	245	).run(
242	246	sha256(code),
243	247	request.client.id,
		@@ -250,6 +254,7 @@ export function issueCode(
250	254	new Date(Date.now() + CODE_TTL_MS).toISOString(),
251	255	request.oidcScopes.join(" "),
252	256	request.nonce,
	257	signInOnly,
253	258	);
254	259	db.query("DELETE FROM oauth_code WHERE expires_at <= ?1").run(
255	260	new Date().toISOString(),
		@@ -258,7 +263,8 @@ export function issueCode(
258	263	}
259	264
260	265	export interface Minted {
261		readonly token: string;
	266	/** Absent for a sign-in-only grant: no credential is left behind. */
	267	readonly token?: string;
262	268	readonly scope: OAuthScope;
263	269	/** Seconds the token lives, or null for one that does not expire. */
264	270	readonly expiresIn: number \| null;
		@@ -295,6 +301,7 @@ export async function redeemCode(
295	301	expires_at: string;
296	302	oidc_scopes: string;
297	303	nonce: string;
	304	signin_only: number;
298	305	},
299	306	[string]
300	307	>("DELETE FROM oauth_code WHERE code_hash = ?1 RETURNING *")
		@@ -310,6 +317,16 @@ export async function redeemCode(
310	317	if (digest !== row.challenge) return err("invalid_grant");
311	318	const user = getUserById(db, row.user_id);
312	319	if (user === null \|\| user === undefined \|\| !isActive(user)) return err("invalid_grant");
	320	if (row.signin_only === 1) {
	321	const idToken = await signIdToken(db, dataDir, {
	322	issuer: input.issuer,
	323	clientId: row.client_id,
	324	user,
	325	scopes: row.oidc_scopes.split(" "),
	326	nonce: row.nonce,
	327	});
	328	return ok({ scope: row.scope, expiresIn: null, idToken });
	329	}
313	330	const minted = createToken(db, row.user_id, row.name, row.scope, {
314	331	...(row.lifetime_s === null
315	332	? {}
		@@ -0,0 +1,52 @@
	1	/**
	2	* Another forge's signing keys, fetched once and kept. A key id that is not
	3	* in what was kept may mean the issuer rotated, so the set is fetched again
	4	* — once, and not again for a minute however many tokens name an unknown
	5	* kid, so a forged token cannot make this forge hammer its parent.
	6	*/
	7	import { readCapped } from "../origins/providers/http.ts";
	8	import type { Jwk } from "../kernel/jwt.ts";
	9
	10	export const JWKS_FRESH_MS = 10 * 60_000;
	11	export const JWKS_REFETCH_MS = 60_000;
	12	const BODY_MAX = 64 * 1024;
	13
	14	export type Fetch = (url: string, init?: RequestInit) => Promise<Response>;
	15
	16	export class KeySet {
	17	private keys: Jwk[] = [];
	18	private at = -Infinity;
	19	private pending: Promise<void> \| undefined;
	20
	21	constructor(
	22	private readonly url: string,
	23	private readonly fetcher: Fetch = fetch,
	24	) {}
	25
	26	async find(kid: string, now = Date.now()): Promise<Jwk \| undefined> {
	27	const kept = (): Jwk \| undefined => this.keys.find((k) => k["kid"] === kid);
	28	if (now - this.at < JWKS_FRESH_MS && kept() !== undefined) return kept();
	29	if (now - this.at >= JWKS_REFETCH_MS) await this.load(now);
	30	return kept();
	31	}
	32
	33	private load(now: number): Promise<void> {
	34	this.pending ??= (async () => {
	35	try {
	36	const res = await this.fetcher(this.url, { redirect: "error", signal: AbortSignal.timeout(5000) });
	37	if (!res.ok) return;
		sentinelcrew 29d ago outdated High: `res.text()` has already buffered everything before `text.length > BODY_MAX` runs, so the cap protects nothing. It also counts UTF-16 units, not bytes. Read with a byte-bounded reader that stops at BODY_MAX.
	38	const text = await readCapped(res, BODY_MAX, AbortSignal.timeout(5000));
	39	if (text === undefined) return;
	40	const list = (JSON.parse(text) as { keys?: unknown }).keys;
	41	if (!Array.isArray(list)) return;
	42	this.keys = list.filter((k): k is Jwk => typeof k === "object" && k !== null);
	43	this.at = now;
	44	} catch {
	45	// Unreachable or malformed: keep what we had; the caller refuses the token.
	46	} finally {
	47	this.pending = undefined;
	48	}
	49	})();
	50	return this.pending;
	51	}
	52	}
		@@ -82,9 +82,9 @@ export function oauthRoutes(router: Router<Handler>): void {
82	82	if (!minted.ok) return grantError(minted.error);
83	83	return json(
84	84	{
85		access_token: minted.value.token,
	85	...(minted.value.token === undefined ? {} : { access_token: minted.value.token }),
86	86	token_type: "Bearer",
87		scope: minted.value.scope,
	87	...(minted.value.token === undefined ? {} : { scope: minted.value.scope }),
88	88	...(minted.value.idToken === undefined ? {} : { id_token: minted.value.idToken }),
89	89	...(minted.value.expiresIn === null
90	90	? {}
		@@ -0,0 +1,220 @@
	1	/**
	2	* Continue with the parent forge (#748): this forge as a relying party of
	3	* the OpenID provider its parent already is. `/signin/parent` registers
	4	* this forge at the parent once (the client id is kept), then sends the
	5	* person there with a state, a nonce and a PKCE challenge; the state also
	6	* rides in an HttpOnly cookie so only the browser that began can finish.
	7	* `/signin/parent/callback` trades the code, checks the id_token (state,
	8	* nonce, iss, aud, exp, signature against the parent's JWKS) and signs in
	9	* the local account the parent's `sub` maps to, made on first sight.
	10	* Both are GETs that change nothing a stranger could use: a callback with
	11	* no matching cookie and state is refused before anything is fetched.
	12	*/
	13	import { createHash, randomBytes } from "node:crypto";
	14	import type { App } from "../app.ts";
	15	import {
	16	accountFor,
	17	clientFor,
	18	keepClient,
	19	parentIssuerOf,
	20	SUB,
	21	startLogin,
	22	takeLogin,
	23	CALLBACK_PATH,
	24	} from "../core/federation.ts";
	25	import { readCapped } from "../origins/providers/http.ts";
	26	import { clientAddress } from "./peer.ts";
	27	import { signinAllowed } from "../web/pages/site.ts";
	28	import { createSession } from "../core/sessions.ts";
	29	import { verifyJwt } from "../kernel/jwt.ts";
	30	import { html } from "../web/html.ts";
	31	import { page, redirect } from "../web/layout.ts";
	32	import { sessionCookie } from "../web/pages/site.ts";
	33	import { cookieValue, type Ctx } from "./context.ts";
	34	import { KeySet } from "./jwks.ts";
	35
	36	export const STATE_COOKIE = "forge_rp";
	37	const SCOPE = "openid profile";
		sentinelcrew 28d ago With no `ro`/`rw` in the scope, the parent's `parseAuthRequest` falls back to `ro`, and its consent page offers Read/Read-and-act plus a lifetime. A sign-in should not ask for or receive API access: the parent needs an OpenID-only path, with a 'Sign in to <host>' consent and no token minted.
	38	const rand = (bytes: number): string => randomBytes(bytes).toString("base64url");
	39
	40	const parentIssuer = (app: App): string \| undefined => parentIssuerOf(app.config);
	41
	42	const keySets = new WeakMap<App, Map<string, KeySet>>();
	43	const keysOf = (app: App, issuer: string): KeySet => {
	44	let sets = keySets.get(app);
	45	if (sets === undefined) keySets.set(app, (sets = new Map()));
	46	let set = sets.get(issuer);
	47	if (set === undefined) sets.set(issuer, (set = new KeySet(`${issuer}/oauth/jwks`)));
	48	return set;
	49	};
	50
	51	/** What the parent may say in one answer: a client id or a token is small. */
	52	const ANSWER_MAX = 16 * 1024;
	53
	54	/** The parent's JSON answer, read by bytes and refused past the cap. */
	55	async function answerOf(res: Response): Promise<Record<string, unknown>> {
	56	const text = await readCapped(res, ANSWER_MAX, AbortSignal.timeout(5000));
	57	if (text === undefined) throw new Error("the parent's answer was too large");
	58	const body: unknown = JSON.parse(text);
	59	if (typeof body !== "object" \|\| body === null) throw new Error("the parent's answer was not an object");
	60	return body as Record<string, unknown>;
	61	}
	62
	63	const redirectUriOf = (ctx: Ctx): string => `${ctx.url.origin}${CALLBACK_PATH}`;
	64
	65	/** The client id at the issuer for this address, registering once if there is none. */
	66	const registering = new Map<string, Promise<string>>();
	67	async function clientId(ctx: Ctx, issuer: string, redirectUri: string): Promise<string> {
	68	const known = clientFor(ctx.app.db, issuer, redirectUri);
	69	if (known !== undefined) return known;
		sentinelcrew 29d ago outdated High: `res.json()` reads the parent's whole answer into memory with no cap. Read it through `readCapped` (src/origins/providers/http.ts) with a small limit and refuse anything past it.
	70	const key = `${issuer}\0${redirectUri}`;
	71	let pending = registering.get(key);
	72	if (pending === undefined) {
	73	pending = (async () => {
	74	const res = await fetch(`${issuer}/oauth/register`, {
	75	method: "POST",
	76	headers: { "content-type": "application/json" },
	77	body: JSON.stringify({
	78	client_name: ctx.url.host.slice(0, 100),
	79	redirect_uris: [redirectUri],
	80	}),
	81	redirect: "error",
	82	signal: AbortSignal.timeout(5000),
	83	});
	84	const body = await answerOf(res);
	85	if (res.status !== 201 \|\| typeof body.client_id !== "string" \|\| body.client_id === "")
	86	throw new Error(`registration refused (${res.status})`);
	87	return keepClient(ctx.app.db, issuer, redirectUri, body.client_id);
	88	})();
	89	registering.set(key, pending);
	90	void pending.then(
	91	() => registering.delete(key),
	92	() => registering.delete(key),
	93	);
	94	}
	95	return pending;
	96	}
	97
	98	function failure(ctx: Ctx, message: string, status: number): Response {
	99	const response = page(
	100	{
	101	ctx,
	102	title: "Sign in",
	103	body: html`<div class="narrow">
	104	<div class="page-head"><h1>Could not sign you in</h1></div>
	105	<p role="alert">${message}</p>
	106	<p><a href="/signin">Back to sign in</a></p>
	107	</div>`,
	108	},
	109	status,
	110	);
	111	response.headers.set("cache-control", "no-store");
	112	return response;
	113	}
	114
	115	const cookieHeader = (value: string, maxAge: number, url: URL, forgeUrl?: string): string => {
	116	const secure = url.protocol === "https:" \|\| forgeUrl?.startsWith("https://") ? "; Secure" : "";
	117	return `${STATE_COOKIE}=${value}; Path=/signin/parent; HttpOnly; SameSite=Lax; Max-Age=${maxAge}${secure}`;
	118	};
		sentinelcrew 29d ago outdated Medium: an anonymous GET writes a row here, and `LOGIN_MAX` evicts the oldest, so flooding this route cancels everyone's sign-in in flight. Throttle it (RateLimiter, keyed on the socket address or forge-wide) before `startLogin`.
	119
	120	export async function parentStart(ctx: Ctx): Promise<Response> {
	121	const issuer = parentIssuer(ctx.app);
	122	if (issuer === undefined) return failure(ctx, "This forge has no parent to sign in through.", 404);
	123	// Each start writes a row and the table is bounded: a flood must not push
	124	// out the sign-ins of people in flight. By socket address, never a header.
	125	const wait = signinAllowed(ctx, `parent:${clientAddress(ctx.request)}`);
		sentinelcrew 28d ago Low: `signinAllowed` takes the whole-forge bucket before the per-key one. A single address looping on this GET drains the forge-wide sign-in budget that password sign-ins share. Check the per-address bucket first, or give the parent start its own forge cap.
	126	if (wait !== undefined) {
	127	const slow = failure(ctx, `Too many attempts. Try again in ${wait}s.`, 429);
	128	slow.headers.set("retry-after", String(wait));
	129	return slow;
	130	}
	131	const redirectUri = redirectUriOf(ctx);
	132	let client: string;
	133	try {
	134	client = await clientId(ctx, issuer, redirectUri);
	135	} catch {
	136	return failure(ctx, "The parent forge could not be reached.", 502);
	137	}
	138	const state = rand(24);
	139	const verifier = rand(48);
	140	const nonce = rand(24);
	141	startLogin(ctx.app.db, state, { verifier, nonce, issuer, redirectUri });
	142	const query = new URLSearchParams({
	143	response_type: "code",
	144	client_id: client,
	145	redirect_uri: redirectUri,
	146	scope: SCOPE,
	147	state,
	148	nonce,
	149	code_challenge: createHash("sha256").update(verifier).digest("base64url"),
	150	code_challenge_method: "S256",
	151	});
	152	const headers = new Headers({
	153	location: `${issuer}/oauth/authorize?${query}`,
	154	"cache-control": "no-store",
	155	});
	156	headers.append("set-cookie", cookieHeader(state, 600, ctx.url, ctx.app.config.url));
	157	return new Response(null, { status: 303, headers });
	158	}
	159
	160	const clean = (s: unknown, max: number): string =>
	161	// eslint-disable-next-line no-control-regex
	162	typeof s === "string" ? s.replace(/[\u0000-\u001f\u007f]/g, "").trim().slice(0, max) : "";
	163
	164	export async function parentCallback(ctx: Ctx): Promise<Response> {
	165	const q = ctx.url.searchParams;
	166	const state = q.get("state") ?? "";
	167	const code = q.get("code") ?? "";
	168	// The cookie is the browser that began; without it nothing is fetched or spent.
	169	if (state === "" \|\| state !== cookieValue(ctx.request, STATE_COOKIE))
	170	return failure(ctx, "This sign-in did not start in this browser.", 400);
	171	const login = takeLogin(ctx.app.db, state);
	172	const clear = cookieHeader("", 0, ctx.url, ctx.app.config.url);
	173	const refuse = (message: string, status = 400): Response => {
		sentinelcrew 29d ago outdated High: the same problem on the token response. Cap it by bytes read before parsing.
	174	const response = failure(ctx, message, status);
	175	response.headers.append("set-cookie", clear);
	176	return response;
	177	};
	178	if (login === undefined \|\| login.issuer !== parentIssuer(ctx.app) \|\| login.redirectUri !== redirectUriOf(ctx))
	179	return refuse("This sign-in took too long or was already used.");
	180	if (q.has("error") \|\| code === "" \|\| code.length > 512)
	181	return refuse("The parent forge did not sign you in.");
	182	try {
	183	const client = await clientId(ctx, login.issuer, login.redirectUri);
	184	const res = await fetch(`${login.issuer}/oauth/token`, {
	185	method: "POST",
	186	body: new URLSearchParams({
	187	grant_type: "authorization_code",
	188	code,
	189	client_id: client,
	190	redirect_uri: login.redirectUri,
	191	code_verifier: login.verifier,
	192	}),
	193	redirect: "error",
	194	signal: AbortSignal.timeout(5000),
	195	});
	196	const body = await answerOf(res);
	197	if (!res.ok \|\| typeof body.id_token !== "string")
		sentinelcrew 28d ago High: the token answer also carries an `access_token`, a live API token for the person's parent account (default lifetime "until I revoke it"). It is ignored here and never revoked, so each sign-in leaves one more behind at the parent. Make an OpenID-only grant at the parent mint no token, and assert here that none came back.
	198	return refuse("The parent forge did not accept the sign-in.", 502);
	199	const keys = keysOf(ctx.app, login.issuer);
	200	const verified = await verifyJwt(
	201	body.id_token,
	202	(kid) => keys.find(kid),
	203	{ issuer: login.issuer, audience: client, nonce: login.nonce },
	204	);
	205	if (!verified.ok) return refuse("The parent forge's answer did not verify.", 502);
	206	const sub = verified.value["sub"];
	207	if (typeof sub !== "string" \|\| !SUB.test(sub))
	208	return refuse("The parent forge's answer did not verify.", 502);
	209	const name = clean(verified.value["preferred_username"], 64);
	210	const user = await accountFor(ctx.app.db, login.issuer, sub, name);
	211	if (user === undefined) return refuse("An account for you could not be made or is not allowed in.", 403);
	212	const session = createSession(ctx.app.db, user.id);
	213	const done = redirect("/", sessionCookie(session.token, session.expiresAt, ctx.url, ctx.app.config.url));
	214	done.headers.append("set-cookie", clear);
	215	done.headers.set("cache-control", "no-store");
	216	return done;
	217	} catch {
	218	return refuse("The parent forge could not be reached.", 502);
	219	}
	220	}
		@@ -8,6 +8,7 @@
8	8	import { signupOptions, signupPasskey } from "../web/pages/signup-passkey.ts";
9	9	import { TOOLBAR_NAME, toolbarResponse } from "../apps/toolbar.ts";
10	10	import { unsealReleased } from "../actions/sealed.ts";
	11	import { parentCallback, parentStart } from "./rp.ts";
11	12	import { accessPage } from "../web/pages/access.ts";
12	13	import { capacityPage, capacitySet } from "../web/pages/capacity.ts";
13	14	import { flowPage } from "../web/pages/flow.ts";
		@@ -633,6 +634,8 @@ export function buildRouter(): Router<Handler> {
633	634	router.add("POST", "/front", frontUpdate);
634	635	router.add("GET", "/signin", signinPage);
635	636	router.add("POST", "/signin", signinSubmit);
	637	router.add("GET", "/signin/parent", parentStart);
	638	router.add("GET", "/signin/parent/callback", parentCallback);
636	639	router.add("GET", "/signup", signupPage);
637	640	router.add("GET", "/verify", verifyPage);
638	641	router.add("POST", "/signup", signupSubmit);
		@@ -0,0 +1,63 @@
	1	/**
	2	* Verifying a JWT someone else signed: ES256 only, the key looked up by
	3	* `kid` through a function the caller gives (so where keys come from — a
	4	* cache, a fetch, a test — is not this file's business), then the claims a
	5	* relying party must check: issuer, audience, expiry and, when asked, nonce.
	6	* Anything off is `invalid_token`; the reason is not told to the caller.
	7	*/
	8	import { err, ok, type Result } from "./result.ts";
	9
	10	export type Jwk = Record<string, unknown>;
	11
	12	export interface JwtExpect {
	13	readonly issuer: string;
	14	readonly audience: string;
	15	readonly nonce?: string;
	16	}
	17
	18	const KEY = { name: "ECDSA", namedCurve: "P-256" } as const;
	19	const SIGN = { name: "ECDSA", hash: "SHA-256" } as const;
	20	const SEGMENT = /^[A-Za-z0-9_-]+$/;
	21
	22	const decode = (part: string): Record<string, unknown> => {
	23	const parsed: unknown = JSON.parse(Buffer.from(part, "base64url").toString());
	24	if (typeof parsed !== "object" \|\| parsed === null \|\| Array.isArray(parsed))
	25	throw new Error("not an object");
	26	return parsed as Record<string, unknown>;
	27	};
	28
	29	export async function verifyJwt(
	30	jwt: string,
	31	keyFor: (kid: string) => Promise<Jwk \| undefined>,
	32	expect: JwtExpect,
	33	now = Date.now(),
	34	): Promise<Result<Record<string, unknown>, "invalid_token">> {
	35	const parts = jwt.split(".");
	36	if (parts.length !== 3 \|\| !parts.every((p) => SEGMENT.test(p)))
	37	return err("invalid_token");
	38	try {
	39	const head = decode(parts[0]!);
	40	if (head["alg"] !== "ES256" \|\| typeof head["kid"] !== "string")
	41	return err("invalid_token");
	42	const jwk = await keyFor(head["kid"]);
	43	if (jwk === undefined) return err("invalid_token");
	44	const pub = await crypto.subtle.importKey("jwk", jwk as never, KEY, false, ["verify"]);
	45	const good = await crypto.subtle.verify(
	46	SIGN,
	47	pub,
	48	Buffer.from(parts[2]!, "base64url"),
	49	new TextEncoder().encode(`${parts[0]}.${parts[1]}`),
	50	);
	51	if (!good) return err("invalid_token");
	52	const claims = decode(parts[1]!);
	53	if (claims["iss"] !== expect.issuer \|\| claims["aud"] !== expect.audience)
	54	return err("invalid_token");
	55	if (typeof claims["exp"] !== "number" \|\| claims["exp"] * 1000 <= now)
	56	return err("invalid_token");
	57	if (expect.nonce !== undefined && claims["nonce"] !== expect.nonce)
	58	return err("invalid_token");
	59	return ok(claims);
	60	} catch {
	61	return err("invalid_token");
	62	}
	63	}