8823674 · 133e281 · 6ab06a4 · 35c04c6 · 445e9b5 · 9fcb198
@@ -351,7 +351,12 @@
adds `FORGE_URL` (the canonical public base URL, needed for OAuth callbacks),
`FORGE_ORIGIN_ALLOW` (hosts an operator vouches for on a LAN). Behind a
platform edge that signs people in for every app it serves, `FORGE_EDGE_TOKEN`
is the edge's secret: a request carrying it and `X-Plat-User` is that person,
signed in by the platform, with an account made on first sight. Setting
signed in by the platform if an account of that name exists. An unknown login
makes none: it is sent to `/signup`, where the `signup` setting decides, and
the name there is pinned to the login the edge vouched for (a visitor the edge
has not vouched for is sent through it first), so a platform user's name can
never be taken by someone else. The terminal cannot see `X-Plat-User`, so
behind an edge sign-up is on the web page only and the terminal says so. Setting
`signin.edge` to `off` (Settings → Capacity → "Sign in through the platform
edge", boot default `FORGE_SIGNIN_EDGE`, also `/api/v1/admin/capacity` and the
MCP `capacity` tool) makes the forge ignore `X-Plat-User` even when the secret
@@ -6,7 +6,6 @@
import { markUnproven, markVerified } from "./verify.ts";
import type { Database } from "bun:sqlite";
import { isSafeName } from "../git/guard.ts";
import { noreplyAddress } from "./commit_identity.ts";
import { reservedName } from "./reserved.ts";
import { id } from "../kernel/id.ts";
import { err, ok, type Result } from "../kernel/result.ts";
@@ -452,31 +451,16 @@
export function getUserByName(
/**
 * The person behind an identity the platform edge vouched for: found by
 * name, or made on first sight — with no password, because the edge is how
 * they sign in, and a noreply address until they set one. Like a sign-up,
 * it is never the admin, first or not. A name that is an
 * organization or a crew member here is nobody's login.
 * name, never made. The edge vouches for a login, not for a right to an
 * account here, so an unknown login is signed out and goes to /signup, where
 * the `signup` setting decides. Accounts the edge made before still sign in.
 * A name that is an organization or a crew member here is nobody's login.
 */
      
        sentinelcrew
        25d ago
        
      
      Nit: the function never makes an account now, so the name ensure is misleading. Something like edgeUser or findEdgeUser would match what the doc comment says.
    
export async function ensureEdgeUser(
  db: Database,
  login: string,
  host: string,
): Promise<User | undefined> {
export function ensureEdgeUser(db: Database, login: string): User | undefined {
  const existing = getUserByName(db, login);
  if (existing)
    return existing.kind === "user" && isActive(existing) ? existing : undefined;
  // The edge vouches for a login, not for its right to a name: createUser
  // refuses a reserved one, so a platform account called after the crew or
  // the owner is not let in under it.
  const made = await createUser(db, {
    username: login,
    email: noreplyAddress(login, host),
    origin: "edge",
  });
  if (!made.ok) return undefined;
  // A newcomer through the edge starts unproven like one through /signup
  // (its placeholder is no address at all).
  return made.value;
  return existing && existing.kind === "user" && isActive(existing)
    ? existing
    : undefined;
}
/** Why a password was not accepted: wrong, or tried too often to check. */
@@ -369,7 +369,7 @@
import {
  undoFleetOp,
  type FleetError,
} from "../actions/fleet.ts";
import { sessionCookie, signupSlot } from "../web/pages/site.ts";
import { EDGE_NAME_MESSAGE, pinnedTo, sessionCookie, signupSlot } from "../web/pages/site.ts";
import {
  FIRST_ADMIN_TOKEN_MAX_S,
  FIRST_ADMIN_TOKEN_MIN_S,
@@ -1223,6 +1223,10 @@
export function apiRoutes(router: Router<Handler>): void {
    const input = await boundedBody(ctx.request, STRANGER_MAX);
    if (input === "too_large")
      
        sentinelcrew
        25d ago
        outdated
      
      pinnedTo decides closed-ness with inviteOf(ctx) (the query), but this route passes signUp the invite from the body (input.invite). With signup = invite and the invite sent only in the body, pinnedTo sees a closed door, returns true, and the pin is skipped, so any name can be taken. Pass the body's invite into the pin. Tracked in #2828.
    
      return apiError("too_large", 413, `at most ${STRANGER_MAX} bytes`);
    // The token of an invite link (`core/invites.ts`), when signup is `invite`.
      
        sentinelcrew
        25d ago
        outdated
      
      High: pinnedTo reads the invite from the URL query, but signUp below takes it from input.invite in the body. With signup = invite and the invite only in the body, pinnedTo treats signup as closed, returns true and skips the name check. Then signUp accepts the body invite and creates any name. Compute const invite = str(input.invite) || undefined once and pass it to both: pinnedTo(ctx, username, invite) and signUp(..., { invite }).
    
    const invite = str(input.invite) === "" ? undefined : str(input.invite);
    if (!pinnedTo(ctx, str(input.username).trim(), invite))
      return apiError("forbidden", 403, EDGE_NAME_MESSAGE);
    const created = await signUp(
      ctx.app,
      {
@@ -1233,8 +1237,7 @@
export function apiRoutes(router: Router<Handler>): void {
      },
      {
        slot,
        // The token of an invite link (`core/invites.ts`), when signup is `invite`.
        invite: str(input.invite) === "" ? undefined : str(input.invite),
        invite,
        address: clientAddress(ctx.request),
      },
    );
@@ -9,6 +9,7 @@
 */
import { createHash, timingSafeEqual } from "node:crypto";
import type { User } from "../core/users.ts";
import type { App } from "../app.ts";
import { edgeSigninOn } from "../core/capacity.ts";
@@ -33,6 +34,15 @@
export function edgeIdentity(
  return login === "" ? undefined : login;
}
/** The login the edge vouched for on this request when no account answered to it. */
export function edgeStrangerLogin(
  request: Request,
  edgeToken: string | undefined,
  user: User | undefined,
): string | undefined {
  return user === undefined ? edgeIdentity(request, edgeToken) : undefined;
}
// Compared as fixed-width digests, so neither the time taken nor the
// lengths compared depend on the secret.
function sameSecret(a: string, b: string): boolean {
@@ -64,7 +64,6 @@
import { trackPullHead } from "../core/pulls.ts";
import { createRepo, repositoryLimitMessage, resolveOwner } from "../actions/repos.ts";
import { sessionOf } from "../core/sessions.ts";
import { scopeAllows, verifyToken } from "../core/tokens.ts";
import { forgeHost } from "../core/commit_identity.ts";
import {
  ensureEdgeUser,
  getUserByName,
@@ -72,7 +71,6 @@
import {
  verifyPasswordThrottled,
} from "../core/users.ts";
import { activeEdgeToken, edgeIdentity } from "./edge.ts";
import { signupClosed } from "../actions/users.ts";
import { liveResponse, readyResponse } from "./health.ts";
import { running } from "../kernel/version.ts";
import { runGit } from "../git/env.ts";
@@ -517,23 +515,9 @@
async function resolveAuth(app: App, request: Request): Promise<Auth> {
  // in; its word outranks a cookie of ours.
  const login = edgeIdentity(request, activeEdgeToken(app));
  if (login !== undefined) {
    const existed = getUserByName(app.db, login) !== undefined;
    // Existing accounts sign in; a new one is made only while signup allows.
    const user =
      !existed && signupClosed(app)
        ? undefined
        : await ensureEdgeUser(app.db, login, forgeHost(app.config));
    if (user) {
      // An account the edge made is audited like one made at /signup.
      if (!existed) {
        app.bus.append({
          kind: "user.created",
          actorId: user.id,
          payload: { via: "edge", address: clientAddress(request) },
        });
      }
      return { user, scope: "admin", via: "edge" };
    }
    // Existing accounts sign in; an unknown login is signed out (/signup).
    const user = ensureEdgeUser(app.db, login);
    if (user) return { user, scope: "admin", via: "edge" };
  }
  const session = cookieValue(request, "forge_session");
@@ -8,6 +8,7 @@
 * account while signup allows — not an admin; the operator makes the admin.
 */
import { activeEdgeToken } from "../../http/edge.ts";
import { INVITE_SPENT_MESSAGE, SIGNUP_CLOSED_MESSAGE, signUp, signupClosed } from "../../actions/users.ts";
import { SignupSlot, waitText } from "../../actions/signup-window.ts";
import { hasAnyUser } from "../../core/users.ts";
@@ -42,8 +43,14 @@
const CREATE: Field[] = [
const INVITE_BLANK_MESSAGE = "Paste the token from your invite link.";
const INVITE: Field = { label: "Invite", secret: true, hint: "The token from your invite link." };
/** Behind an edge the terminal cannot know the login the edge will vouch for. */
const EDGE_SIGNUP_MESSAGE = "Sign up on the page: accounts here are tied to the login the edge vouches for.";
/**
 * Behind an edge the terminal cannot see the login the edge vouches for, so
 * sign-up is on the web page only, where the name is pinned to that login.
 */
const edgeSignupMessage = (f: Session): string =>
      
        sentinelcrew
        25d ago
        
      
      Low: this branch (no FORGE_URL) has no test. tui-signup-edge.test.ts only builds the app with a URL. Add a case without one so a relative or empty URL can't come back unnoticed.
    
  f.app.config.url === undefined
      
        sentinelcrew
        25d ago
        outdated
      
      Low: when FORGE_URL is unset, this line reads "Sign up on the web page only: /signup", a relative path the terminal user cannot open. Print the full URL only when config.url is set, and otherwise just say "on the web page".
    
    ? "Sign up on the web page only."
    : `Sign up on the web page only: ${f.app.config.url}/signup`;
export function signInScreen(f: Session, ctx: Ctx, onDone: () => void): Screen {
  // "Is this forge empty?" is a existence question, not a count: `COUNT(*)`
@@ -55,9 +62,9 @@
export function signInScreen(f: Session, ctx: Ctx, onDone: () => void): Screen {
  const invited = (): boolean => getSignup(f.db) === "invite";
  // Behind an edge no account is made here: it would be one the edge may later
  // sign a platform user of the same name into. Sign-in is unchanged.
  const edge = f.app.config.edgeToken !== undefined;
  const edge = activeEdgeToken(f.app) !== undefined;
  const closed = (): boolean => edge || (!invited() && signupClosed(f.app));
  const closedText = (): string => (edge ? EDGE_SIGNUP_MESSAGE : SIGNUP_CLOSED_MESSAGE);
  const closedText = (): string => (edge ? edgeSignupMessage(f) : SIGNUP_CLOSED_MESSAGE);
  let mode: "signin" | "create" = first && !closed() ? "create" : "signin";
  let values = ["", "", "", ""];
  let focus = 0;
@@ -13,7 +13,7 @@
import { mayDirectCrew } from "../crew/direct.ts";
import { mayReadRuns } from "../actions/runs.ts";
import { getAppByRepo } from "../core/apps.ts";
import { audienceFacts, audienceOf } from "../core/audience.ts";
import { activeEdgeToken, edgeLoginUrl } from "../http/edge.ts";
import { activeEdgeToken, edgeLoginUrl, edgeStrangerLogin } from "../http/edge.ts";
import {
  canAdmin,
  canRead,
@@ -94,6 +94,8 @@
export function signInHref(ctx: Ctx): string {
  const next = ctx.url.pathname + ctx.url.search;
  // Behind a platform edge the edge is how people sign in; an account it
  // made has no password here, so the password form would only refuse them.
  if (edgeStrangerLogin(ctx.request, activeEdgeToken(ctx.app), ctx.auth.user) !== undefined)
      
        sentinelcrew
        25d ago
        outdated
      
      Right for redirects and the topbar. The / hero (studio/home.ts:491) uses its own edgeToken === undefined ? … : edgeLoginUrl(back) branch and was missed, so the biggest button on the front page still loops.
    
    return "/signup";
  if (activeEdgeToken(ctx.app) !== undefined) return edgeLoginUrl(next);
  return `/signin?next=${encodeURIComponent(next)}`;
}
@@ -13,7 +13,7 @@
import { appsForRepos } from "../core/apps.ts";
import { listReposVisibleTo } from "../core/repos.ts";
import type { User } from "../core/users.ts";
import type { Ctx } from "../http/context.ts";
import { activeEdgeToken, edgeLoginUrl, edgeLogoutUrl } from "../http/edge.ts";
import { activeEdgeToken, edgeLoginUrl, edgeLogoutUrl, edgeStrangerLogin } from "../http/edge.ts";
import { json } from "../http/respond.ts";
import { sha256 } from "../kernel/hash.ts";
import { secret } from "../kernel/id.ts";
@@ -477,8 +477,9 @@
function topbar(
                  : { label: "Sign out", post: "/logout", icon: "signOut" },
              )}`
          : html`${guestMenu(theme)}${btn("Sign in", {
              href:
                activeEdgeToken(ctx.app) === undefined
              href: edgeStrangerLogin(ctx.request, activeEdgeToken(ctx.app), ctx.auth.user) !== undefined
                ? "/signup"
                : activeEdgeToken(ctx.app) === undefined
                  ? "/signin"
                  : edgeLoginUrl(ctx.url.pathname + ctx.url.search),
            })}`}
@@ -11,12 +11,13 @@
import { plausibleEmail, signUpWithPasskey, signupClosed, HUMAN_CHECK_MESSAGE, S
import { createSession } from "../../core/sessions.ts";
import { getUserByName } from "../../core/users.ts";
import { isSafeName } from "../../git/guard.ts";
import { edgeStrangerLogin } from "../../http/edge.ts";
import { crossOrigin, type Ctx } from "../../http/context.ts";
import { STRANGER_MAX } from "../../http/limits.ts";
import { clientAddress } from "../../http/peer.ts";
import { boundedBody, json, str } from "../../http/respond.ts";
import { relying, store } from "./passkeys.ts";
import { inviteOf, safeNext, sessionCookie, signinAllowed, signupSlot } from "./site.ts";
import { EDGE_NAME_MESSAGE, inviteOf, pinnedTo, safeNext, sessionCookie, signinAllowed, signupSlot } from "./site.ts";
const refuse = (status: number, message: string) =>
  json({ error: "refused", message }, status);
@@ -28,6 +29,7 @@
const WORDS: Record<string, string> = {
  username_reserved: "That name is reserved.",
  email_taken: "That email already has an account.",
  invalid_email: "That does not look like an email address.",
  edge_name: EDGE_NAME_MESSAGE,
  human_check: HUMAN_CHECK_MESSAGE,
  passkey_taken: "That passkey is already registered.",
  signup_closed: SIGNUP_CLOSED_MESSAGE,
@@ -36,6 +38,7 @@
const WORDS: Record<string, string> = {
/** Whether the name and address are fit to sign up with; else the words. */
function problem(ctx: Ctx, username: string, email: string): string | undefined {
  if (!isSafeName(username)) return WORDS.invalid_username;
  if (!pinnedTo(ctx, username, inviteOf(ctx))) return WORDS.edge_name;
  if (!plausibleEmail(email)) return WORDS.invalid_email;
  if (getUserByName(ctx.app.db, username)) return WORDS.username_taken;
  return undefined;
@@ -25,7 +25,7 @@
import { isThemeName } from "../../design/themes.ts";
import { cookieValue, crossOrigin, type Ctx } from "../../http/context.ts";
import { studioDoor, studioHome } from "../studio/home.ts";
import { homeTop } from "../studio/asks_page.ts";
import { activeEdgeToken, edgeLoginUrl } from "../../http/edge.ts";
import { activeEdgeToken, edgeIdentity, edgeLoginUrl, edgeStrangerLogin } from "../../http/edge.ts";
import { sshCommand } from "../../ssh/command.ts";
import { hostOf, pageHead, signInFirst } from "../chrome.ts";
import { SignupSlot, signupWindow } from "../../actions/signup-window.ts";
@@ -247,8 +247,11 @@
function authForm(
  // Behind a platform edge, that is the door: the button first, and the
  // password form kept for the accounts that have one — an account the edge
  // made has none, and the note says so before anyone types.
  // A newcomer the edge vouched for is already through it: no button to go
  // round again, and the name is theirs alone.
  const vouched = edgeStrangerLogin(ctx.request, activeEdgeToken(ctx.app), ctx.auth.user);
  const edge =
    activeEdgeToken(ctx.app) === undefined
    activeEdgeToken(ctx.app) === undefined || vouched !== undefined
      ? undefined
      : (ctx.app.config.edgeName ?? "the platform");
  const throughEdge = when(
@@ -263,7 +266,7 @@
function authForm(
        <p class="muted small">
      
        sentinelcrew
        25d ago
        outdated
      
      This note is now on the page every edge newcomer is sent to, but the "Continue with …" button above it (edgeLoginUrl) still sends them back to the platform and round again. Drop it when edgeStranger holds. Pin the username field to the vouched login so nobody can sign up under another platform user's name, which ensureEdgeUser would later sign that user into.
    
          ${kind === "signin"
            ? `Accounts made through ${name} sign in there and have no password here. The form below is for an account that was given one.`
            : `Signing in through ${name} makes your account on first sight; the form below makes one with a password instead.`}
            : `Signing in through ${name} does not make an account here; the form below does.`}
        </p>
      </div>`,
  );
@@ -277,10 +280,13 @@
function authForm(
      ${formField({
        label: "Username",
        name: "username",
        value: values.username ?? "",
        value: (kind === "signup" ? vouched : undefined) ?? values.username ?? "",
        autocomplete: "username",
        required: true,
        autofocus: true,
        ...(vouched === undefined || kind !== "signup" ? { autofocus: true } : {}),
        ...(kind === "signup" && vouched !== undefined
          ? { readonly: true }
      
        sentinelcrew
        25d ago
        outdated
      
      Low: this hint never shows, because the next spread (kind === "signup") overwrites hint with "Letters, digits, dots and dashes." Either put this object after that spread or drop the hint.
    
          : {}),
        ...(kind === "signup"
          ? {
              hint: "Letters, digits, dots and dashes.",
@@ -297,6 +303,8 @@
function authForm(
          value: values.email ?? "",
          autocomplete: "email",
          required: true,
          // A pinned name is not editable, so the keyboard goes to the email.
          ...(vouched !== undefined ? { autofocus: true } : {}),
          ...(errors.email ? { error: errors.email } : {}),
        }),
      )}
@@ -434,6 +442,8 @@
function signupClosedPage(ctx: Ctx): Response {
export function signupPage(ctx: Ctx): Response {
  if (signupClosed(ctx.app, inviteOf(ctx))) return signupClosedPage(ctx);
  const first = throughEdgeFirst(ctx);
  if (first) return first;
  return page({
    ctx,
    title: "Sign up",
@@ -538,12 +548,51 @@
export function verifyPage(ctx: Ctx): Response {
  );
}
export const EDGE_NAME_MESSAGE = "Sign up under the name your platform sign-in gave you.";
      
        sentinelcrew
        25d ago
        outdated
      
      High: with no vouched login this returns true, so behind an edge an unvouched visitor can sign up as any name. The edge later signs the real platform user into that account. Behind an edge, require a vouched login: ctx.app.config.edgeToken === undefined || (vouched !== undefined && vouched.toLowerCase() === username.toLowerCase()).
    
/**
 * Whether `username` is free to sign up. `invite` is the one the caller hands
 * to `signUp`, so closed-ness is decided from the same token on every door.
 * Behind an edge the edge's login is
 * the only name a newcomer may take, and one it has not vouched for takes
 * none: a name made here first would sign the platform's user of that name
 * into someone else's account.
 */
      
        sentinelcrew
        25d ago
        outdated
      
      Take the invite as a parameter (pinnedTo(ctx, username, invite?: string)) rather than reading inviteOf(ctx) here. The closed check must use the same invite the caller's signUp uses, or a door that carries the invite somewhere other than the query bypasses the pin.
    
export function pinnedTo(ctx: Ctx, username: string, invite: string | undefined): boolean {
  const token = activeEdgeToken(ctx.app);
  // A closed door refuses on its own, and says so in its own words.
  if (token === undefined || signupClosed(ctx.app, invite)) return true;
  const vouched = edgeIdentity(ctx.request, token);
  return vouched !== undefined && vouched.toLowerCase() === username.toLowerCase();
}
/** Behind an edge, a visitor it has not vouched for goes through it first. */
function throughEdgeFirst(ctx: Ctx): Response | undefined {
  const token = activeEdgeToken(ctx.app);
  if (token === undefined || edgeIdentity(ctx.request, token) !== undefined) return undefined;
  const invite = inviteOf(ctx);
  if (signupClosed(ctx.app, invite)) return undefined;
  const query = invite === undefined ? "" : `?invite=${encodeURIComponent(invite)}`;
  return redirect(edgeLoginUrl(`/signup${query}`));
}
export async function signupSubmit(ctx: Ctx): Promise<Response> {
  // Posted by people with no account yet: a stranger's form.
  const form = await readForm(ctx, undefined, STRANGER_MAX);
  if (form instanceof Response) return form;
  const username = field(form, "username");
  const email = field(form, "email");
  const first = throughEdgeFirst(ctx);
  if (first) return first;
  if (!pinnedTo(ctx, username, inviteOf(ctx)))
    return page(
      {
        ctx,
        title: "Sign up",
        body: authForm(ctx, "signup", { values: { email }, errors: { username: EDGE_NAME_MESSAGE } }),
      },
      422,
    );
  const slot = signupSlot(ctx);
  if (typeof slot === "number") {
    const wait = slot;
@@ -22,7 +22,7 @@
import { LOOK_SIZES } from "../../core/looks.ts";
import { canRead, getRepo, type Repo } from "../../core/repos.ts";
import { type User } from "../../core/users.ts";
import type { Ctx } from "../../http/context.ts";
import { activeEdgeToken, edgeLoginUrl } from "../../http/edge.ts";
import { activeEdgeToken, edgeLoginUrl, edgeStrangerLogin } from "../../http/edge.ts";
import { sshCommand } from "../../ssh/command.ts";
import { repoBase, signInFirst } from "../chrome.ts";
import { field, readForm, type Form } from "../form.ts";
@@ -488,7 +488,7 @@
export function studioDoor(ctx: Ctx): Response {
      <div class="bar">
        ${ctx.auth.user !== undefined
          ? null
          : activeEdgeToken(ctx.app) === undefined
          : activeEdgeToken(ctx.app) === undefined || edgeStrangerLogin(ctx.request, activeEdgeToken(ctx.app), ctx.auth.user) !== undefined
            ? html`${btn("Create an account", {
                href: `/signup${nextQuery}`,
                variant: "primary",
@@ -1002,6 +1002,7 @@
export interface FieldOptions {
  error?: string;
  required?: boolean;
  autofocus?: boolean;
  readonly?: boolean;
  autocomplete?: string;
  placeholder?: string;
  pattern?: string;
@@ -1023,6 +1024,7 @@
export function field(o: FieldOptions): Html {
  ${o.error ? raw('aria-invalid="true"') : null}
  ${o.required ? raw("required") : null}
  ${o.autofocus ? raw("autofocus") : null}
  ${o.readonly ? raw("readonly") : null}
  ${o.placeholder ? html`placeholder="${o.placeholder}"` : null}`;
  const control =
    o.type === "textarea"
@@ -97,6 +97,7 @@
describe("accounts: the owner sees, suspends and removes", () => {
  const outsider = async (name: string) => {
    const res = await api("/api/v1/users", {
      method: "POST",
      headers: { "x-plat-user": name, "x-plat-edge-token": EDGE },
      body: JSON.stringify({
        username: name,
        email: `${name}@outsider.test`,
@@ -121,16 +122,24 @@
describe("accounts: the owner sees, suspends and removes", () => {
    expect(typeof made?.payload["address"]).toBe("string");
  });
  test("an account the edge makes is audited too", async () => {
    const res = await fetch(`${base}/api/v1/user`, {
      headers: { "x-plat-user": "edgy", "x-plat-edge-token": EDGE },
  test("an unknown edge login makes no account and no audit record; an old edge account still signs in", async () => {
    const as = (login: string) =>
      fetch(`${base}/api/v1/user`, {
        headers: { "x-plat-user": login, "x-plat-edge-token": EDGE },
      });
    const before = listEvents(app.db, { kind: "user.created" }).length;
    expect((await as("edgy")).status).toBe(401);
    expect(getUserByName(app.db, "edgy")).toBeUndefined();
    expect(listEvents(app.db, { kind: "user.created" }).length).toBe(before);
    // An account the edge made when it still did, audited as it was then.
    const old = await insertAgent(app.db, {
      origin: "edge",
      username: "edgy",
      email: "[email protected]",
    });
    expect(res.status).toBe(200);
    const user = getUserByName(app.db, "edgy")!;
    const made = listEvents(app.db, { kind: "user.created" }).find(
      (e) => e.actorId === user.id,
    );
    expect(made?.payload["via"]).toBe("edge");
    if (!old.ok) throw new Error(old.error);
    app.bus.append({ kind: "user.created", actorId: old.value.id, payload: { via: "edge", address: "127.0.0.1" } });
    expect((await as("edgy")).status).toBe(200);
  });
  test("the owner hears of a new account once", async () => {
@@ -474,6 +483,7 @@
describe("accounts: the owner sees, suspends and removes", () => {
    // The name stays taken, so nobody can step into it.
    const again = await api("/api/v1/users", {
      method: "POST",
      headers: { "x-plat-user": "oscar", "x-plat-edge-token": EDGE },
      body: JSON.stringify({
        username: "oscar",
        email: "[email protected]",
@@ -5,6 +5,9 @@
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { edgeIdentity, edgeLoginUrl, edgeLogoutUrl } from "../src/http/edge.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { createUser, getUserByName } from "../src/core/users.ts";
import { mintInvite } from "../src/core/invites.ts";
import { setSignup } from "../src/settings/signup.ts";
import { seedAdmin } from "./helpers/admin.ts";
const TOKEN = "edge-secret-0123456789";
@@ -69,6 +72,9 @@
describe("a forge behind the platform edge", () => {
    base = servers.url;
    const olive = await seedAdmin(app, { username: "olive", email: "[email protected]" });
    if (!olive.ok) throw new Error(olive.error);
    // An account the edge made when it still did.
    const ada = await createUser(app.db, { origin: "edge", username: "ada", email: "[email protected]" });
    if (!ada.ok) throw new Error(ada.error);
  });
  afterAll(async () => {
@@ -83,7 +89,68 @@
describe("a forge behind the platform edge", () => {
    expect(page).not.toContain('href="/signin"');
  });
  test("the first person the edge vouches for is made on sight, not as admin", async () => {
  test("an unknown edge login creates no user and is offered /signup", async () => {
    const stranger = { "x-plat-user": "newcomer", "x-plat-edge-token": TOKEN };
    expect((await fetch(`${base}/api/v1/user`, { headers: stranger })).status).toBe(401);
    expect(getUserByName(app.db, "newcomer")).toBeUndefined();
    const page = await fetch(`${base}/`, { headers: stranger }).then((r) => r.text());
    expect(page).toContain('href="/signup"');
    expect(page).not.toContain("Sign out");
    const gated = await fetch(`${base}/new`, { headers: stranger, redirect: "manual" });
    expect(gated.headers.get("location")).toBe("/signup");
    expect(getUserByName(app.db, "newcomer")).toBeUndefined();
  });
  test("a vouched newcomer's pages drop the edge button and pin the name", async () => {
    const stranger = { "x-plat-user": "newcomer", "x-plat-edge-token": TOKEN };
    const home = await fetch(`${base}/`, { headers: stranger }).then((r) => r.text());
    expect(home).toContain('href="/signup"');
    expect(home).not.toContain("/_plat/login");
    const signup = await fetch(`${base}/signup`, { headers: stranger }).then((r) => r.text());
    expect(signup).not.toContain("/_plat/login");
    expect(signup).toContain('value="newcomer"');
    expect(signup).toContain("readonly");
  });
  test("a vouched newcomer cannot sign up under another name", async () => {
    const stranger = {
      "x-plat-user": "newcomer",
      "x-plat-edge-token": TOKEN,
      "content-type": "application/x-www-form-urlencoded",
      origin: "https://forge.example",
    };
    const form = (username: string) =>
      new URLSearchParams({ username, email: "[email protected]", password: "correct horse battery" }).toString();
    const res = await fetch(`${base}/signup`, { method: "POST", headers: stranger, body: form("grace") });
    expect(res.status).toBe(422);
    expect(await res.text()).toContain("Sign up under the name");
    expect(getUserByName(app.db, "grace")).toBeUndefined();
    const key = await fetch(`${base}/signup/passkey/options`, {
      method: "POST",
      headers: { ...stranger, "content-type": "application/json" },
      body: JSON.stringify({ username: "grace", email: "[email protected]" }),
    });
    expect(key.status).toBe(422);
  });
  test("a visitor the edge has not vouched for cannot sign up behind an edge", async () => {
    const headers = { "content-type": "application/x-www-form-urlencoded", origin: "https://forge.example" };
    const body = new URLSearchParams({ username: "alice", email: "[email protected]", password: "correct horse battery" }).toString();
    const res = await fetch(`${base}/signup`, { method: "POST", headers, body, redirect: "manual" });
    expect(res.status).toBe(303);
    expect(res.headers.get("location")).toContain("/_plat/login");
    expect(getUserByName(app.db, "alice")).toBeUndefined();
    const key = await fetch(`${base}/signup/passkey/options`, {
      method: "POST",
      headers: { ...headers, "content-type": "application/json" },
      body: JSON.stringify({ username: "alice", email: "[email protected]" }),
    });
    expect(key.status).toBe(422);
    const get = await fetch(`${base}/signup`, { redirect: "manual" });
    expect(get.headers.get("location")).toContain("/_plat/login");
  });
  test("an account the edge made earlier still signs in, not as admin", async () => {
    const me = await fetch(`${base}/api/v1/user`, { headers: asAda });
    expect(me.status).toBe(200);
    const body = (await me.json()) as { username: string; isAdmin: boolean };
@@ -158,4 +225,25 @@
describe("a forge behind the platform edge", () => {
    });
    expect(((await me.json()) as { username: string }).username).toBe("ada");
  });
  test("with signup by invite, a body invite does not lift the name pin", async () => {
    const olive = getUserByName(app.db, "olive")!;
    setSignup(app.db, "invite", olive.id);
    try {
      const join = (headers: Record<string, string>) => {
        const { token } = mintInvite(app.db, olive.id);
        return fetch(`${base}/api/v1/users`, {
          method: "POST",
          headers: { ...headers, origin: "https://forge.example" },
          body: JSON.stringify({ username: "dave", email: "[email protected]", password: "correct horse battery", invite: token }),
        });
      };
      // A vouched carol may not take dave's name, nor may a visitor nobody vouched for.
      expect((await join({ "x-plat-user": "carol", "x-plat-edge-token": TOKEN })).status).toBe(403);
      expect((await join({})).status).toBe(403);
      expect(getUserByName(app.db, "dave")).toBeUndefined();
    } finally {
      setSignup(app.db, "open", olive.id);
    }
  });
});
@@ -88,9 +88,10 @@
test("the first account from the terminal's sign-up is not an admin", async () =
  expect(admins(app)).toBe(0);
});
test("the first account the platform edge makes is not an admin", async () => {
test("the platform edge makes no account, so no admin", async () => {
  const app = await fresh();
  expect((await ensureEdgeUser(app.db, "edgy", "f.test"))?.isAdmin).toBe(false);
  expect(ensureEdgeUser(app.db, "edgy")).toBeUndefined();
  expect(getUserByName(app.db, "edgy")).toBeUndefined();
  expect(admins(app)).toBe(0);
});
@@ -154,11 +154,11 @@
describe("reserved names", () => {
  });
  test("the edge cannot bring in a reserved name", async () => {
    expect(await ensureEdgeUser(app.db, "sc0ut", "f.dev")).toBeUndefined();
    expect(await ensureEdgeUser(app.db, "admin", "f.dev")).toBeUndefined();
    expect(ensureEdgeUser(app.db, "sc0ut")).toBeUndefined();
    expect(ensureEdgeUser(app.db, "admin")).toBeUndefined();
    expect(getUserByName(app.db, "sc0ut")).toBeUndefined();
    // An account that already exists still signs in by its own name.
    expect((await ensureEdgeUser(app.db, "trevato", "f.dev"))?.username).toBe(
    expect(ensureEdgeUser(app.db, "trevato")?.username).toBe(
      "trevato",
    );
  });
@@ -32,6 +32,9 @@
describe("signin.edge", () => {
    });
    if (!made.ok) throw new Error(made.error);
    olive = made.value;
    // An account the edge made before, with no password: it still signs in.
    const ada = await seedAdmin(app, { username: "ada", email: "[email protected]" });
    if (!ada.ok) throw new Error(ada.error);
  });
  afterAll(async () => {
@@ -43,7 +46,7 @@
describe("signin.edge", () => {
  const who = (headers: Record<string, string>) =>
    fetch(`${base}/api/v1/user`, { headers });
  test("on by default; the edge makes an account and signs it in", async () => {
  test("on by default; the edge signs in an account that exists", async () => {
    expect(capacityValue(app.db, "signin.edge")).toBe("on");
    expect((await who(asAda)).status).toBe(200);
    const page = await fetch(`${base}/`).then((r) => r.text());
@@ -11,7 +11,7 @@
import { createApp, type App } from "../src/app.ts";
import { setLimit } from "../src/settings/limits.ts";
import { setSignup, type SignupMode } from "../src/settings/signup.ts";
import { signUp, signUpWithPasskey } from "../src/actions/users.ts";
import { getUserByName } from "../src/core/users.ts";
import { createUser, getUserByName } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { fixtureSlot } from "./helpers/slot.ts";
@@ -29,6 +29,9 @@
describe("closed signup", () => {
    app = createApp({ dataDir, port: 0, url: "https://forge.example", edgeToken: TOKEN });
    servers = await serve(app);
    setLimit(app.db, "signup.per_source", 1000, "setup");
    // Accounts the edge made when it still did; they keep signing in.
    for (const name of ["founder", "edgy"])
      await createUser(app.db, { origin: "edge", username: name, email: `${name}@forge.example` });
    base = servers.url;
  });
  afterAll(async () => {
@@ -41,16 +44,18 @@
describe("closed signup", () => {
  const post = (username: string) =>
    fetch(`${base}/api/v1/users`, {
      method: "POST",
      headers: { "content-type": "application/json", origin: "https://forge.example" },
      headers: { "content-type": "application/json", origin: "https://forge.example", ...edge(username) },
      body: JSON.stringify({ username, email: `${username}@example.com`, password: "a-good-passphrase" }),
    });
  const me = (login: string) => fetch(`${base}/api/v1/user`, { headers: edge(login) });
  test("a fresh forge's first account is refused while closed, like any other", async () => {
  test("closed: an unknown edge login is signed out and told signup is closed", async () => {
    mode("closed");
    expect((await me("founder")).status).toBe(401);
    expect((await post("founder")).status).toBe(403);
    expect(getUserByName(app.db, "founder")).toBeUndefined();
    expect((await me("stranger")).status).toBe(401);
    const page = await fetch(`${base}/signup`, { headers: edge("stranger") }).then((r) => r.text());
    expect(page).toContain("Signup is closed on this forge.");
    expect(page).not.toContain("Sign out");
    expect(getUserByName(app.db, "stranger")).toBeUndefined();
  });
  for (const closed of ["closed", "invite"] as const) {
@@ -82,9 +87,10 @@
describe("closed signup", () => {
  test("open makes accounts; switching takes effect on the next request", async () => {
    mode("open");
    expect(await (await fetch(`${base}/signup`)).text()).toContain('name="password"');
    expect(await (await fetch(`${base}/signup`, { headers: edge("newcomer") })).text()).toContain('name="password"');
    expect((await post("newcomer")).status).toBe(201);
    expect((await me("edgy")).status).toBe(200);
    expect((await me("later")).status).toBe(401);
    mode("closed");
    expect((await post("late")).status).toBe(403);
    expect((await me("later")).status).toBe(401);
@@ -121,7 +121,6 @@
test("every caller of createUser says where its account comes from", async () =>
    "src/actions/users.ts": ["signup", "passkey"],
    "src/chaos/world.ts": ["seed"],
    "src/core/federation.ts": ["parent"],
    "src/core/users.ts": ["edge"],
    "src/web/pages/claim.ts": ["claim"],
    "src/web/pages/everyday.ts": ["everyday"],
  });
@@ -168,7 +168,12 @@
describe("signup closed (#2166)", () => {
  const post = (body: unknown) =>
    fetch(`${servers.url}/api/v1/users`, {
      method: "POST",
      headers: { "content-type": "application/json" },
      headers: {
        "content-type": "application/json",
        // Behind an edge a newcomer signs up as the login it vouched for.
        "x-plat-user": String((body as { username?: string }).username ?? ""),
        "x-plat-edge-token": EDGE,
      },
      body: JSON.stringify(body),
    });
  const edge = (user: string) =>
@@ -265,6 +270,8 @@
describe("signup closed (#2166)", () => {
  test("existing accounts still sign in by the edge while closed", async () => {
    setSignup(app.db, "open", "boot");
    const old = await createUser(app.db, { origin: "edge", username: "returning", email: "[email protected]" });
    expect(old.ok).toBe(true);
    expect((await edge("returning")).status).toBe(200);
    setSignup(app.db, "closed", "boot");
    expect((await edge("returning")).status).toBe(200);
@@ -272,7 +279,9 @@
describe("signup closed (#2166)", () => {
  test("open: page has the form and the API makes the account", async () => {
    setSignup(app.db, "open", "boot");
    const text = await fetch(`${servers.url}/signup`).then((r) => r.text());
    const text = await fetch(`${servers.url}/signup`, {
      headers: { "x-plat-user": "pager", "x-plat-edge-token": EDGE },
    }).then((r) => r.text());
    expect(text).toContain('name="password"');
    expect((await post(newcomer())).status).toBe(201);
  });
@@ -282,6 +291,7 @@
describe("signup closed (#2166)", () => {
    expect((await post(newcomer())).status).toBe(403);
    setSignup(app.db, "open", "boot");
    expect((await post(newcomer())).status).toBe(201);
    expect((await edge("latecomer")).status).toBe(200);
    expect((await edge("latecomer")).status).toBe(401);
    expect(getUserByName(app.db, "latecomer")).toBeUndefined();
  });
});
@@ -24,7 +24,7 @@
let forge: Forge;
beforeAll(async () => {
  dir = await mkdtemp(join(tmpdir(), "forge-tui-edge-signup-"));
  forge = createApp({ dataDir: dir, port: 0, edgeToken: "edge-secret", disk: () => ({ freeBytes: 95, totalBytes: 100 }) });
  forge = createApp({ dataDir: dir, port: 0, url: "https://forge.example", edgeToken: "edge-secret", disk: () => ({ freeBytes: 95, totalBytes: 100 }) });
});
afterAll(async () => {
  forge.close();
@@ -45,7 +45,8 @@
test("with an edge token the terminal sign-up makes no row", async () => {
    key("t", true); // no create mode to switch to
    await settleApp(app);
    expect(app.screen.toText()).not.toContain("Email");
    expect(app.screen.toText()).toContain("Sign up on the page");
    expect(app.screen.toText()).toContain("Sign up on the web page only");
    expect(app.screen.toText()).toContain("https://forge.example/signup");
    type("mallory");
    key("tab");
    type("a-long-passphrase");
@@ -220,12 +220,11 @@
describe("verified email", () => {
      edgeToken: "edge-secret",
      mailer: async () => true,
    });
    const { ensureEdgeUser } = await import("../src/core/users.ts");
    const first = await ensureEdgeUser(edged.db, "founder", "forge.example");
    const second = await ensureEdgeUser(edged.db, "newcomer", "forge.example");
    // The first is no admin, so it is not proven by being first.
    expect(emailVerified(edged.db, first!.id)).toBe(false);
    expect(emailVerified(edged.db, second!.id)).toBe(false);
    const { createUser, ensureEdgeUser } = await import("../src/core/users.ts");
    // The edge makes none now; an account it made earlier is still unproven.
    expect(ensureEdgeUser(edged.db, "founder")).toBeUndefined();
    const made = await createUser(edged.db, { origin: "edge", username: "founder", email: "founder@forge.example" });
    expect(made.ok && emailVerified(edged.db, made.value.id)).toBe(false);
    edged.close();
  });
		@@ -351,7 +351,12 @@ adds `FORGE_URL` (the canonical public base URL, needed for OAuth callbacks),
351	351	`FORGE_ORIGIN_ALLOW` (hosts an operator vouches for on a LAN). Behind a
352	352	platform edge that signs people in for every app it serves, `FORGE_EDGE_TOKEN`
353	353	is the edge's secret: a request carrying it and `X-Plat-User` is that person,
354		signed in by the platform, with an account made on first sight. Setting
	354	signed in by the platform if an account of that name exists. An unknown login
	355	makes none: it is sent to `/signup`, where the `signup` setting decides, and
	356	the name there is pinned to the login the edge vouched for (a visitor the edge
	357	has not vouched for is sent through it first), so a platform user's name can
	358	never be taken by someone else. The terminal cannot see `X-Plat-User`, so
	359	behind an edge sign-up is on the web page only and the terminal says so. Setting
355	360	`signin.edge` to `off` (Settings → Capacity → "Sign in through the platform
356	361	edge", boot default `FORGE_SIGNIN_EDGE`, also `/api/v1/admin/capacity` and the
357	362	MCP `capacity` tool) makes the forge ignore `X-Plat-User` even when the secret
		@@ -6,7 +6,6 @@
6	6	import { markUnproven, markVerified } from "./verify.ts";
7	7	import type { Database } from "bun:sqlite";
8	8	import { isSafeName } from "../git/guard.ts";
9		import { noreplyAddress } from "./commit_identity.ts";
10	9	import { reservedName } from "./reserved.ts";
11	10	import { id } from "../kernel/id.ts";
12	11	import { err, ok, type Result } from "../kernel/result.ts";
		@@ -452,31 +451,16 @@ export function getUserByName(
452	451
453	452	/**
454	453	* The person behind an identity the platform edge vouched for: found by
455		* name, or made on first sight — with no password, because the edge is how
456		* they sign in, and a noreply address until they set one. Like a sign-up,
457		* it is never the admin, first or not. A name that is an
458		* organization or a crew member here is nobody's login.
	454	* name, never made. The edge vouches for a login, not for a right to an
	455	* account here, so an unknown login is signed out and goes to /signup, where
	456	* the `signup` setting decides. Accounts the edge made before still sign in.
	457	* A name that is an organization or a crew member here is nobody's login.
459	458	*/
		sentinelcrew 25d ago Nit: the function never makes an account now, so the name `ensure` is misleading. Something like `edgeUser` or `findEdgeUser` would match what the doc comment says.
460		export async function ensureEdgeUser(
461		db: Database,
462		login: string,
463		host: string,
464		): Promise<User \| undefined> {
	459	export function ensureEdgeUser(db: Database, login: string): User \| undefined {
465	460	const existing = getUserByName(db, login);
466		if (existing)
467		return existing.kind === "user" && isActive(existing) ? existing : undefined;
468		// The edge vouches for a login, not for its right to a name: createUser
469		// refuses a reserved one, so a platform account called after the crew or
470		// the owner is not let in under it.
471		const made = await createUser(db, {
472		username: login,
473		email: noreplyAddress(login, host),
474		origin: "edge",
475		});
476		if (!made.ok) return undefined;
477		// A newcomer through the edge starts unproven like one through /signup
478		// (its placeholder is no address at all).
479		return made.value;
	461	return existing && existing.kind === "user" && isActive(existing)
	462	? existing
	463	: undefined;
480	464	}
481	465
482	466	/** Why a password was not accepted: wrong, or tried too often to check. */
		@@ -369,7 +369,7 @@ import {
369	369	undoFleetOp,
370	370	type FleetError,
371	371	} from "../actions/fleet.ts";
372		import { sessionCookie, signupSlot } from "../web/pages/site.ts";
	372	import { EDGE_NAME_MESSAGE, pinnedTo, sessionCookie, signupSlot } from "../web/pages/site.ts";
373	373	import {
374	374	FIRST_ADMIN_TOKEN_MAX_S,
375	375	FIRST_ADMIN_TOKEN_MIN_S,
		@@ -1223,6 +1223,10 @@ export function apiRoutes(router: Router<Handler>): void {
1223	1223	const input = await boundedBody(ctx.request, STRANGER_MAX);
1224	1224	if (input === "too_large")
		sentinelcrew 25d ago outdated `pinnedTo` decides closed-ness with `inviteOf(ctx)` (the query), but this route passes `signUp` the invite from the body (`input.invite`). With signup = invite and the invite sent only in the body, `pinnedTo` sees a closed door, returns true, and the pin is skipped, so any name can be taken. Pass the body's invite into the pin. Tracked in #2828.
1225	1225	return apiError("too_large", 413, `at most ${STRANGER_MAX} bytes`);
	1226	// The token of an invite link (`core/invites.ts`), when signup is `invite`.
		sentinelcrew 25d ago outdated High: `pinnedTo` reads the invite from the URL query, but `signUp` below takes it from `input.invite` in the body. With `signup = invite` and the invite only in the body, `pinnedTo` treats signup as closed, returns true and skips the name check. Then `signUp` accepts the body invite and creates any name. Compute `const invite = str(input.invite) \|\| undefined` once and pass it to both: `pinnedTo(ctx, username, invite)` and `signUp(..., { invite })`.
	1227	const invite = str(input.invite) === "" ? undefined : str(input.invite);
	1228	if (!pinnedTo(ctx, str(input.username).trim(), invite))
	1229	return apiError("forbidden", 403, EDGE_NAME_MESSAGE);
1226	1230	const created = await signUp(
1227	1231	ctx.app,
1228	1232	{
		@@ -1233,8 +1237,7 @@ export function apiRoutes(router: Router<Handler>): void {
1233	1237	},
1234	1238	{
1235	1239	slot,
1236		// The token of an invite link (`core/invites.ts`), when signup is `invite`.
1237		invite: str(input.invite) === "" ? undefined : str(input.invite),
	1240	invite,
1238	1241	address: clientAddress(ctx.request),
1239	1242	},
1240	1243	);
		@@ -9,6 +9,7 @@
9	9	*/
10	10
11	11	import { createHash, timingSafeEqual } from "node:crypto";
	12	import type { User } from "../core/users.ts";
12	13	import type { App } from "../app.ts";
13	14	import { edgeSigninOn } from "../core/capacity.ts";
14	15
		@@ -33,6 +34,15 @@ export function edgeIdentity(
33	34	return login === "" ? undefined : login;
34	35	}
35	36
	37	/** The login the edge vouched for on this request when no account answered to it. */
	38	export function edgeStrangerLogin(
	39	request: Request,
	40	edgeToken: string \| undefined,
	41	user: User \| undefined,
	42	): string \| undefined {
	43	return user === undefined ? edgeIdentity(request, edgeToken) : undefined;
	44	}
	45
36	46	// Compared as fixed-width digests, so neither the time taken nor the
37	47	// lengths compared depend on the secret.
38	48	function sameSecret(a: string, b: string): boolean {
		@@ -64,7 +64,6 @@ import { trackPullHead } from "../core/pulls.ts";
64	64	import { createRepo, repositoryLimitMessage, resolveOwner } from "../actions/repos.ts";
65	65	import { sessionOf } from "../core/sessions.ts";
66	66	import { scopeAllows, verifyToken } from "../core/tokens.ts";
67		import { forgeHost } from "../core/commit_identity.ts";
68	67	import {
69	68	ensureEdgeUser,
70	69	getUserByName,
		@@ -72,7 +71,6 @@ import {
72	71	verifyPasswordThrottled,
73	72	} from "../core/users.ts";
74	73	import { activeEdgeToken, edgeIdentity } from "./edge.ts";
75		import { signupClosed } from "../actions/users.ts";
76	74	import { liveResponse, readyResponse } from "./health.ts";
77	75	import { running } from "../kernel/version.ts";
78	76	import { runGit } from "../git/env.ts";
		@@ -517,23 +515,9 @@ async function resolveAuth(app: App, request: Request): Promise<Auth> {
517	515	// in; its word outranks a cookie of ours.
518	516	const login = edgeIdentity(request, activeEdgeToken(app));
519	517	if (login !== undefined) {
520		const existed = getUserByName(app.db, login) !== undefined;
521		// Existing accounts sign in; a new one is made only while signup allows.
522		const user =
523		!existed && signupClosed(app)
524		? undefined
525		: await ensureEdgeUser(app.db, login, forgeHost(app.config));
526		if (user) {
527		// An account the edge made is audited like one made at /signup.
528		if (!existed) {
529		app.bus.append({
530		kind: "user.created",
531		actorId: user.id,
532		payload: { via: "edge", address: clientAddress(request) },
533		});
534		}
535		return { user, scope: "admin", via: "edge" };
536		}
	518	// Existing accounts sign in; an unknown login is signed out (/signup).
	519	const user = ensureEdgeUser(app.db, login);
	520	if (user) return { user, scope: "admin", via: "edge" };
537	521	}
538	522
539	523	const session = cookieValue(request, "forge_session");
		@@ -8,6 +8,7 @@
8	8	* account while signup allows — not an admin; the operator makes the admin.
9	9	*/
10	10
	11	import { activeEdgeToken } from "../../http/edge.ts";
11	12	import { INVITE_SPENT_MESSAGE, SIGNUP_CLOSED_MESSAGE, signUp, signupClosed } from "../../actions/users.ts";
12	13	import { SignupSlot, waitText } from "../../actions/signup-window.ts";
13	14	import { hasAnyUser } from "../../core/users.ts";
		@@ -42,8 +43,14 @@ const CREATE: Field[] = [
42	43	const INVITE_BLANK_MESSAGE = "Paste the token from your invite link.";
43	44	const INVITE: Field = { label: "Invite", secret: true, hint: "The token from your invite link." };
44	45
45		/** Behind an edge the terminal cannot know the login the edge will vouch for. */
46		const EDGE_SIGNUP_MESSAGE = "Sign up on the page: accounts here are tied to the login the edge vouches for.";
	46	/**
	47	* Behind an edge the terminal cannot see the login the edge vouches for, so
	48	* sign-up is on the web page only, where the name is pinned to that login.
	49	*/
	50	const edgeSignupMessage = (f: Session): string =>
		sentinelcrew 25d ago Low: this branch (no `FORGE_URL`) has no test. `tui-signup-edge.test.ts` only builds the app with a URL. Add a case without one so a relative or empty URL can't come back unnoticed.
	51	f.app.config.url === undefined
		sentinelcrew 25d ago outdated Low: when `FORGE_URL` is unset, this line reads "Sign up on the web page only: /signup", a relative path the terminal user cannot open. Print the full URL only when `config.url` is set, and otherwise just say "on the web page".
	52	? "Sign up on the web page only."
	53	: `Sign up on the web page only: ${f.app.config.url}/signup`;
47	54
48	55	export function signInScreen(f: Session, ctx: Ctx, onDone: () => void): Screen {
49	56	// "Is this forge empty?" is a existence question, not a count: `COUNT(*)`
		@@ -55,9 +62,9 @@ export function signInScreen(f: Session, ctx: Ctx, onDone: () => void): Screen {
55	62	const invited = (): boolean => getSignup(f.db) === "invite";
56	63	// Behind an edge no account is made here: it would be one the edge may later
57	64	// sign a platform user of the same name into. Sign-in is unchanged.
58		const edge = f.app.config.edgeToken !== undefined;
	65	const edge = activeEdgeToken(f.app) !== undefined;
59	66	const closed = (): boolean => edge \|\| (!invited() && signupClosed(f.app));
60		const closedText = (): string => (edge ? EDGE_SIGNUP_MESSAGE : SIGNUP_CLOSED_MESSAGE);
	67	const closedText = (): string => (edge ? edgeSignupMessage(f) : SIGNUP_CLOSED_MESSAGE);
61	68	let mode: "signin" \| "create" = first && !closed() ? "create" : "signin";
62	69	let values = ["", "", "", ""];
63	70	let focus = 0;
		@@ -13,7 +13,7 @@ import { mayDirectCrew } from "../crew/direct.ts";
13	13	import { mayReadRuns } from "../actions/runs.ts";
14	14	import { getAppByRepo } from "../core/apps.ts";
15	15	import { audienceFacts, audienceOf } from "../core/audience.ts";
16		import { activeEdgeToken, edgeLoginUrl } from "../http/edge.ts";
	16	import { activeEdgeToken, edgeLoginUrl, edgeStrangerLogin } from "../http/edge.ts";
17	17	import {
18	18	canAdmin,
19	19	canRead,
		@@ -94,6 +94,8 @@ export function signInHref(ctx: Ctx): string {
94	94	const next = ctx.url.pathname + ctx.url.search;
95	95	// Behind a platform edge the edge is how people sign in; an account it
96	96	// made has no password here, so the password form would only refuse them.
	97	if (edgeStrangerLogin(ctx.request, activeEdgeToken(ctx.app), ctx.auth.user) !== undefined)
		sentinelcrew 25d ago outdated Right for redirects and the topbar. The `/` hero (`studio/home.ts:491`) uses its own `edgeToken === undefined ? … : edgeLoginUrl(back)` branch and was missed, so the biggest button on the front page still loops.
	98	return "/signup";
97	99	if (activeEdgeToken(ctx.app) !== undefined) return edgeLoginUrl(next);
98	100	return `/signin?next=${encodeURIComponent(next)}`;
99	101	}
		@@ -13,7 +13,7 @@ import { appsForRepos } from "../core/apps.ts";
13	13	import { listReposVisibleTo } from "../core/repos.ts";
14	14	import type { User } from "../core/users.ts";
15	15	import type { Ctx } from "../http/context.ts";
16		import { activeEdgeToken, edgeLoginUrl, edgeLogoutUrl } from "../http/edge.ts";
	16	import { activeEdgeToken, edgeLoginUrl, edgeLogoutUrl, edgeStrangerLogin } from "../http/edge.ts";
17	17	import { json } from "../http/respond.ts";
18	18	import { sha256 } from "../kernel/hash.ts";
19	19	import { secret } from "../kernel/id.ts";
		@@ -477,8 +477,9 @@ function topbar(
477	477	: { label: "Sign out", post: "/logout", icon: "signOut" },
478	478	)}`
479	479	: html`${guestMenu(theme)}${btn("Sign in", {
480		href:
481		activeEdgeToken(ctx.app) === undefined
	480	href: edgeStrangerLogin(ctx.request, activeEdgeToken(ctx.app), ctx.auth.user) !== undefined
	481	? "/signup"
	482	: activeEdgeToken(ctx.app) === undefined
482	483	? "/signin"
483	484	: edgeLoginUrl(ctx.url.pathname + ctx.url.search),
484	485	})}`}
		@@ -11,12 +11,13 @@ import { plausibleEmail, signUpWithPasskey, signupClosed, HUMAN_CHECK_MESSAGE, S
11	11	import { createSession } from "../../core/sessions.ts";
12	12	import { getUserByName } from "../../core/users.ts";
13	13	import { isSafeName } from "../../git/guard.ts";
	14	import { edgeStrangerLogin } from "../../http/edge.ts";
14	15	import { crossOrigin, type Ctx } from "../../http/context.ts";
15	16	import { STRANGER_MAX } from "../../http/limits.ts";
16	17	import { clientAddress } from "../../http/peer.ts";
17	18	import { boundedBody, json, str } from "../../http/respond.ts";
18	19	import { relying, store } from "./passkeys.ts";
19		import { inviteOf, safeNext, sessionCookie, signinAllowed, signupSlot } from "./site.ts";
	20	import { EDGE_NAME_MESSAGE, inviteOf, pinnedTo, safeNext, sessionCookie, signinAllowed, signupSlot } from "./site.ts";
20	21
21	22	const refuse = (status: number, message: string) =>
22	23	json({ error: "refused", message }, status);
		@@ -28,6 +29,7 @@ const WORDS: Record<string, string> = {
28	29	username_reserved: "That name is reserved.",
29	30	email_taken: "That email already has an account.",
30	31	invalid_email: "That does not look like an email address.",
	32	edge_name: EDGE_NAME_MESSAGE,
31	33	human_check: HUMAN_CHECK_MESSAGE,
32	34	passkey_taken: "That passkey is already registered.",
33	35	signup_closed: SIGNUP_CLOSED_MESSAGE,
		@@ -36,6 +38,7 @@ const WORDS: Record<string, string> = {
36	38	/** Whether the name and address are fit to sign up with; else the words. */
37	39	function problem(ctx: Ctx, username: string, email: string): string \| undefined {
38	40	if (!isSafeName(username)) return WORDS.invalid_username;
	41	if (!pinnedTo(ctx, username, inviteOf(ctx))) return WORDS.edge_name;
39	42	if (!plausibleEmail(email)) return WORDS.invalid_email;
40	43	if (getUserByName(ctx.app.db, username)) return WORDS.username_taken;
41	44	return undefined;
		@@ -25,7 +25,7 @@ import { isThemeName } from "../../design/themes.ts";
25	25	import { cookieValue, crossOrigin, type Ctx } from "../../http/context.ts";
26	26	import { studioDoor, studioHome } from "../studio/home.ts";
27	27	import { homeTop } from "../studio/asks_page.ts";
28		import { activeEdgeToken, edgeLoginUrl } from "../../http/edge.ts";
	28	import { activeEdgeToken, edgeIdentity, edgeLoginUrl, edgeStrangerLogin } from "../../http/edge.ts";
29	29	import { sshCommand } from "../../ssh/command.ts";
30	30	import { hostOf, pageHead, signInFirst } from "../chrome.ts";
31	31	import { SignupSlot, signupWindow } from "../../actions/signup-window.ts";
		@@ -247,8 +247,11 @@ function authForm(
247	247	// Behind a platform edge, that is the door: the button first, and the
248	248	// password form kept for the accounts that have one — an account the edge
249	249	// made has none, and the note says so before anyone types.
	250	// A newcomer the edge vouched for is already through it: no button to go
	251	// round again, and the name is theirs alone.
	252	const vouched = edgeStrangerLogin(ctx.request, activeEdgeToken(ctx.app), ctx.auth.user);
250	253	const edge =
251		activeEdgeToken(ctx.app) === undefined
	254	activeEdgeToken(ctx.app) === undefined \|\| vouched !== undefined
252	255	? undefined
253	256	: (ctx.app.config.edgeName ?? "the platform");
254	257	const throughEdge = when(
		@@ -263,7 +266,7 @@ function authForm(
263	266	<p class="muted small">
		sentinelcrew 25d ago outdated This note is now on the page every edge newcomer is sent to, but the "Continue with …" button above it (`edgeLoginUrl`) still sends them back to the platform and round again. Drop it when `edgeStranger` holds. Pin the username field to the vouched login so nobody can sign up under another platform user's name, which `ensureEdgeUser` would later sign that user into.
264	267	${kind === "signin"
265	268	? `Accounts made through ${name} sign in there and have no password here. The form below is for an account that was given one.`
266		: `Signing in through ${name} makes your account on first sight; the form below makes one with a password instead.`}
	269	: `Signing in through ${name} does not make an account here; the form below does.`}
267	270	</p>
268	271	</div>`,
269	272	);
		@@ -277,10 +280,13 @@ function authForm(
277	280	${formField({
278	281	label: "Username",
279	282	name: "username",
280		value: values.username ?? "",
	283	value: (kind === "signup" ? vouched : undefined) ?? values.username ?? "",
281	284	autocomplete: "username",
282	285	required: true,
283		autofocus: true,
	286	...(vouched === undefined \|\| kind !== "signup" ? { autofocus: true } : {}),
	287	...(kind === "signup" && vouched !== undefined
	288	? { readonly: true }
		sentinelcrew 25d ago outdated Low: this hint never shows, because the next spread (`kind === "signup"`) overwrites `hint` with "Letters, digits, dots and dashes." Either put this object after that spread or drop the hint.
	289	: {}),
284	290	...(kind === "signup"
285	291	? {
286	292	hint: "Letters, digits, dots and dashes.",
		@@ -297,6 +303,8 @@ function authForm(
297	303	value: values.email ?? "",
298	304	autocomplete: "email",
299	305	required: true,
	306	// A pinned name is not editable, so the keyboard goes to the email.
	307	...(vouched !== undefined ? { autofocus: true } : {}),
300	308	...(errors.email ? { error: errors.email } : {}),
301	309	}),
302	310	)}
		@@ -434,6 +442,8 @@ function signupClosedPage(ctx: Ctx): Response {
434	442
435	443	export function signupPage(ctx: Ctx): Response {
436	444	if (signupClosed(ctx.app, inviteOf(ctx))) return signupClosedPage(ctx);
	445	const first = throughEdgeFirst(ctx);
	446	if (first) return first;
437	447	return page({
438	448	ctx,
439	449	title: "Sign up",
		@@ -538,12 +548,51 @@ export function verifyPage(ctx: Ctx): Response {
538	548	);
539	549	}
540	550
	551	export const EDGE_NAME_MESSAGE = "Sign up under the name your platform sign-in gave you.";
	552
		sentinelcrew 25d ago outdated High: with no vouched login this returns true, so behind an edge an unvouched visitor can sign up as any name. The edge later signs the real platform user into that account. Behind an edge, require a vouched login: `ctx.app.config.edgeToken === undefined \|\| (vouched !== undefined && vouched.toLowerCase() === username.toLowerCase())`.
	553	/**
	554	* Whether `username` is free to sign up. `invite` is the one the caller hands
	555	* to `signUp`, so closed-ness is decided from the same token on every door.
	556	* Behind an edge the edge's login is
	557	* the only name a newcomer may take, and one it has not vouched for takes
	558	* none: a name made here first would sign the platform's user of that name
	559	* into someone else's account.
	560	*/
		sentinelcrew 25d ago outdated Take the invite as a parameter (`pinnedTo(ctx, username, invite?: string)`) rather than reading `inviteOf(ctx)` here. The closed check must use the same invite the caller's `signUp` uses, or a door that carries the invite somewhere other than the query bypasses the pin.
	561	export function pinnedTo(ctx: Ctx, username: string, invite: string \| undefined): boolean {
	562	const token = activeEdgeToken(ctx.app);
	563	// A closed door refuses on its own, and says so in its own words.
	564	if (token === undefined \|\| signupClosed(ctx.app, invite)) return true;
	565	const vouched = edgeIdentity(ctx.request, token);
	566	return vouched !== undefined && vouched.toLowerCase() === username.toLowerCase();
	567	}
	568
	569	/** Behind an edge, a visitor it has not vouched for goes through it first. */
	570	function throughEdgeFirst(ctx: Ctx): Response \| undefined {
	571	const token = activeEdgeToken(ctx.app);
	572	if (token === undefined \|\| edgeIdentity(ctx.request, token) !== undefined) return undefined;
	573	const invite = inviteOf(ctx);
	574	if (signupClosed(ctx.app, invite)) return undefined;
	575	const query = invite === undefined ? "" : `?invite=${encodeURIComponent(invite)}`;
	576	return redirect(edgeLoginUrl(`/signup${query}`));
	577	}
	578
541	579	export async function signupSubmit(ctx: Ctx): Promise<Response> {
542	580	// Posted by people with no account yet: a stranger's form.
543	581	const form = await readForm(ctx, undefined, STRANGER_MAX);
544	582	if (form instanceof Response) return form;
545	583	const username = field(form, "username");
546	584	const email = field(form, "email");
	585	const first = throughEdgeFirst(ctx);
	586	if (first) return first;
	587	if (!pinnedTo(ctx, username, inviteOf(ctx)))
	588	return page(
	589	{
	590	ctx,
	591	title: "Sign up",
	592	body: authForm(ctx, "signup", { values: { email }, errors: { username: EDGE_NAME_MESSAGE } }),
	593	},
	594	422,
	595	);
547	596	const slot = signupSlot(ctx);
548	597	if (typeof slot === "number") {
549	598	const wait = slot;