87ecc7d · 4bfcd1c · cd38d8c · 5837896
@@ -45,8 +45,13 @@
import { readServing } from "./serving.ts";
import { notFound, securityFloor } from "../http/respond.ts";
import { appMeasure } from "./measure.ts";
import { holdPortRequest, holdPortSocket } from "./handoff.ts";
import { secureFor } from "../http/cookie_secure.ts";
import { htmlAnswer, readPage, rewritable, withToolbar, type PillWhere } from "./toolbar.ts";
const proxySecure = (request: Request, url: URL, forgeUrl: string): boolean =>
  secureFor(url, forgeUrl) ||
  request.headers.get("x-forwarded-proto") === "https";
export interface AppTarget {
  readonly app: AppRecord;
  readonly env: EnvName;
@@ -599,9 +604,7 @@
export async function proxyApp(
    );
  }
  if (url.pathname === "/__forge/signout" && !target.nested) {
    const secure =
      url.protocol === "https:" ||
      request.headers.get("x-forwarded-proto") === "https";
    const secure = proxySecure(request, url, runtime.options.forgeUrl);
    return securityFloor(
      new Response(null, {
        status: 303,
@@ -752,9 +755,7 @@
export async function proxyApp(
      sealed,
      viewerId,
      grantCookie: cookie,
      secure:
        url.protocol === "https:" ||
        request.headers.get("x-forwarded-proto") === "https",
      secure: proxySecure(request, url, runtime.options.forgeUrl),
      source: clientBucket(request),
    });
    if (answer !== undefined) return securityFloor(answer);
@@ -1252,9 +1253,7 @@
function grant(
    vouched.who,
  );
  const path = safePath(url.searchParams.get("to"));
  const secure =
    url.protocol === "https:" ||
    request.headers.get("x-forwarded-proto") === "https";
  const secure = proxySecure(request, url, runtime.options.forgeUrl);
  return new Response(null, {
    status: 303,
    headers: {
@@ -0,0 +1,9 @@
/**
 * The one rule for `Secure` on every cookie the forge sets: the request is
      
        sentinelcrew
        19d ago
        
      
      "Every cookie the forge sets" is not true yet: rp.ts cookieHeader, themeSubmit and withoutMode still decide Secure themselves. Route them through secureFor, or narrow this sentence.
    
 * https, or the forge's own address is https. Behind a proxy that ends TLS
 * the request itself arrives as http, so the configured address is the fact
 * and the request is only a hint.
 */
export function secureFor(url: URL | undefined, forgeUrl?: string): boolean {
  return url?.protocol === "https:" || forgeUrl?.startsWith("https://") === true;
}
@@ -11,6 +11,7 @@
 * Both are GETs that change nothing a stranger could use: a callback with
 * no matching cookie and state is refused before anything is fetched.
 */
import { secureFor } from "./cookie_secure.ts";
import { createHash, randomBytes } from "node:crypto";
import type { App } from "../app.ts";
import {
@@ -117,8 +118,8 @@
function failure(ctx: Ctx, message: string, status: number): Response {
  return response;
}
const cookieHeader = (value: string, maxAge: number, url: URL, forgeUrl?: string): string => {
  const secure = url.protocol === "https:" || forgeUrl?.startsWith("https://") ? "; Secure" : "";
export const cookieHeader = (value: string, maxAge: number, url: URL, forgeUrl?: string): string => {
  const secure = secureFor(url, forgeUrl) ? "; Secure" : "";
  return `${STATE_COOKIE}=${value}; Path=/signin/parent; HttpOnly; SameSite=Lax; Max-Age=${maxAge}${secure}`;
};
@@ -6,6 +6,7 @@
 */
import { followUpstreamCheck, followUpstreamUpdate } from "../web/pages/upstream-follow.ts";
import { secureFor } from "./cookie_secure.ts";
import { refusedByDatabase, shownRefusal } from "./refusal.ts";
import { NOT_A_MEMBER } from "../core/roles.ts";
import { signupOptions, signupPasskey } from "../web/pages/signup-passkey.ts";
@@ -1678,11 +1679,11 @@
function withRateHeaders(
 * a redirect to its own clean address, and the cookie that used to hold the
 * choice is let go on the way.
 */
function withoutMode(url: URL, request: Request): Response | undefined {
function withoutMode(url: URL, request: Request, forgeUrl?: string): Response | undefined {
  if (request.method !== "GET" || !url.searchParams.has("mode")) return undefined;
  const clean = new URL(url);
  clean.searchParams.delete("mode");
  const secure = url.protocol === "https:" ? "; Secure" : "";
  const secure = secureFor(url, forgeUrl) ? "; Secure" : "";
  return new Response(null, {
    status: 303,
    headers: {
@@ -2578,7 +2579,7 @@
async function answerGet(
  const themeCookie = cookieValue(request, "forge_theme") ?? "";
  if (!isApiPath) {
    const clean = withoutMode(url, request);
    const clean = withoutMode(url, request, app.config.url);
    if (clean !== undefined) return clean;
  }
  const invoke = (into: Request): Response | Promise<Response> =>
@@ -1,3 +1,5 @@
import { secureFor } from "../http/cookie_secure.ts";
/**
 * Flash messages: the missing half of post-redirect-get. A mutation sets a
 * short-lived cookie, the next page renders it exactly once as a `.toast` and
@@ -27,15 +29,15 @@
export interface Flash {
const MAX_FLASH = 2000;
/** The `Set-Cookie` value that carries a flash to the next request. */
export function flashCookie(flash: Flash, url?: URL): string {
export function flashCookie(flash: Flash, url?: URL, forgeUrl?: string): string {
  const encoded = encodeURIComponent(JSON.stringify(flash)).slice(0, MAX_FLASH);
  const secure = url?.protocol === "https:" ? "; Secure" : "";
  const secure = secureFor(url, forgeUrl) ? "; Secure" : "";
  return `${FLASH_COOKIE}=${encoded}; Path=/; Max-Age=60; SameSite=Lax; HttpOnly${secure}`;
}
/** The `Set-Cookie` value that clears it, sent with the page that showed it. */
export function clearFlashCookie(url?: URL): string {
  const secure = url?.protocol === "https:" ? "; Secure" : "";
export function clearFlashCookie(url?: URL, forgeUrl?: string): string {
  const secure = secureFor(url, forgeUrl) ? "; Secure" : "";
  return `${FLASH_COOKIE}=; Path=/; Max-Age=0; SameSite=Lax; HttpOnly${secure}`;
}
@@ -678,7 +678,7 @@
export function page(options: PageOptions, status = 200): Response {
    link: linkHeader(links),
  });
  // A flash is shown exactly once: rendering it is also what clears it.
  if (cookieFlash) headers.append("set-cookie", clearFlashCookie(ctx.url));
  if (cookieFlash) headers.append("set-cookie", clearFlashCookie(ctx.url, ctx.app.config.url));
  if (tagged) {
    const etag = weakEtag(text);
    headers.set("etag", etag);
@@ -697,6 +697,8 @@
export interface RedirectOptions {
  flash?: Flash;
  /** Needed only so the flash cookie learns whether to be Secure. */
  url?: URL;
  /** The forge's own address: https there makes the cookie Secure behind a TLS-ending proxy. */
  forgeUrl?: string | undefined;
      
        sentinelcrew
        19d ago
        
      
      Low: this is optional, so the one rule depends on each caller remembering to pass it, and every flash redirect in this diff had to be edited by hand to add it. A later redirect(to, { flash, url: ctx.url }) compiles and silently loses Secure behind the TLS-ending proxy. Fix: derive the flag from Ctx (e.g. redirect(ctx, to, …), or have flash redirects go only through flashTo), so leaving it out is impossible.
    
      
        sentinelcrew
        19d ago
        
      
      Every flash redirect now has to remember both url and forgeUrl. A caller that forgets forgeUrl silently falls back to not Secure, and nothing catches it. Optional, but sturdier: have redirect take secure?: boolean computed once by the caller with secureFor, or route these call sites through flashTo(ctx, …), which already has ctx.
    
      
        sentinelcrew
        19d ago
        
      
      Optional forgeUrl means a future redirect(..., { flash, url }) that forgets it silently falls back to the request scheme, which is the bug this pull fixes. flashTo(ctx, …) already covers most callers. Later, consider routing the remaining direct redirect callers through a ctx-taking helper so the rule can't be skipped.
    
}
export function redirect(
@@ -708,7 +710,7 @@
export function redirect(
  const headers = new Headers({ location: to });
  if (o.cookie !== undefined) headers.append("set-cookie", o.cookie);
  if (o.flash !== undefined)
    headers.append("set-cookie", flashCookie(o.flash, o.url));
    headers.append("set-cookie", flashCookie(o.flash, o.url, o.forgeUrl));
  return new Response(null, { status: 303, headers });
}
@@ -768,7 +770,7 @@
export function missingFragment(request: Request): Response {
/** Redirect back to a page carrying a message — the shape most handlers want. */
export function flashTo(ctx: Ctx, to: string, flash: Flash): Response {
  return redirect(to, { flash, url: ctx.url });
  return redirect(to, { flash, url: ctx.url, forgeUrl: ctx.app.config.url });
}
/**
@@ -794,6 +794,7 @@
export async function appRedeploy(ctx: Ctx): Promise<Response> {
  // there (`envBack`); the run itself is one link away on that card.
  return redirect(envBack(ctx, repo), {
    url: ctx.url,
    forgeUrl: ctx.app.config.url,
    flash: {
      message:
        run === undefined
@@ -218,6 +218,7 @@
export async function everydayCreate(ctx: Ctx): Promise<Response> {
  return redirect("/", {
    cookie: sessionCookie(session.token, session.expiresAt, ctx.url, ctx.app.config.url),
    url: ctx.url,
    forgeUrl: ctx.app.config.url,
    flash: {
      message: `You are signed in as ${made.value.username}, your everyday account. Sign in as ${admin.username} when you mean to change the forge.`,
    },
@@ -251,6 +252,7 @@
export async function everydaySwitch(ctx: Ctx): Promise<Response> {
  return redirect("/signin", {
    cookie: sessionCookie("", new Date(0), ctx.url, ctx.app.config.url),
    url: ctx.url,
    forgeUrl: ctx.app.config.url,
    flash: { message: `Sign in as ${daily.username}, your everyday account.` },
  });
}
@@ -52,6 +52,7 @@
import {
} from "../ui.ts";
import { existsSync } from "node:fs";
import { join } from "node:path";
import { secureFor } from "../../http/cookie_secure.ts";
import { hasAdmin } from "../../spawn/claim.ts";
import { getSignup, type SignupMode } from "../../settings/signup.ts";
import { EMAIL_TAKEN_MESSAGE, NAME_RESERVED, USERNAME_TAKEN } from "../../actions/signup_words.ts";
@@ -64,10 +65,7 @@
export function sessionCookie(
): string {
  // Secure when the request or the forge's own address is https: behind a
  // proxy that ends TLS the request itself arrives as http.
  const secure =
    url.protocol === "https:" || forgeUrl?.startsWith("https://")
      ? "; Secure"
      : "";
  const secure = secureFor(url, forgeUrl) ? "; Secure" : "";
  return `forge_session=${value}; Path=/; HttpOnly; SameSite=Lax; Expires=${expires.toUTCString()}${secure}`;
}
@@ -696,7 +694,7 @@
export async function themeSubmit(ctx: Ctx): Promise<Response> {
  const form = await readForm(ctx, undefined, STRANGER_MAX);
  if (form instanceof Response) return form;
  const choice = field(form, "theme");
  const secure = ctx.url.protocol === "https:" ? "; Secure" : "";
  const secure = secureFor(ctx.url, ctx.app.config.url) ? "; Secure" : "";
  const cookie = isThemeName(choice)
    ? `forge_theme=${choice}; Path=/; Max-Age=31536000; SameSite=Lax; HttpOnly${secure}`
    : `forge_theme=; Path=/; Max-Age=0; SameSite=Lax; HttpOnly${secure}`;
@@ -629,6 +629,7 @@
export async function frontUpdate(ctx: Ctx): Promise<Response> {
  const set = setFront(ctx.app, ctx.auth.user, next);
  return redirect("/front", {
    url: ctx.url,
    forgeUrl: ctx.app.config.url,
    flash: set.ok
      ? { message: "The front page is updated." }
      : {
@@ -34,6 +34,7 @@
export async function homeArchive(ctx: Ctx): Promise<Response> {
  if (ids.length === 0 || ids.length > MAX_ROWS)
    return redirect("/", {
      url: ctx.url,
      forgeUrl: ctx.app.config.url,
      flash: { tone: "danger", message: "Tick the apps to archive first." },
    });
  const op = await applyFleetIds(
@@ -47,6 +48,7 @@
export async function homeArchive(ctx: Ctx): Promise<Response> {
  if (!op.ok)
    return redirect("/", {
      url: ctx.url,
      forgeUrl: ctx.app.config.url,
      flash: { tone: "danger", message: op.error.message },
    });
  return redirect(`/home/archived/${op.value.id}`);
@@ -110,6 +112,7 @@
export async function homeArchiveUndo(ctx: Ctx): Promise<Response> {
  if (!undone.ok)
    return redirect("/", {
      url: ctx.url,
      forgeUrl: ctx.app.config.url,
      flash: { tone: "danger", message: undone.error.message },
    });
  return redirect(`/home/archived/${undone.value.id}`);
@@ -165,6 +165,7 @@
export async function makeItYoursSubmit(ctx: Ctx): Promise<Response> {
  }
  return redirect(repoBase(made.value.made.repo), {
    url: ctx.url,
    forgeUrl: ctx.app.config.url,
    flash: {
      message: made.value.existing
        ? `This is your ${made.value.repo}.`
@@ -143,5 +143,5 @@
export async function reviewAct(ctx: Ctx): Promise<Response> {
  const after = orderedAsks(ctx.app.db, user).filter((a) => !acted(a));
  const later = new Set(before.slice(at + 1).map((a) => a.id));
  const next = at < 0 ? after[0] : (after.find((a) => later.has(a.id)) ?? after[0]);
  return redirect(back(next), { flash: { message: done }, url: ctx.url });
  return redirect(back(next), { flash: { message: done }, url: ctx.url, forgeUrl: ctx.app.config.url });
}
@@ -0,0 +1,117 @@
/** One rule decides `Secure` on every cookie (#6095): https request, https forge, or https app. */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { newApp } from "../src/actions/apps.ts";
import { AppsRuntime } from "../src/apps/runtime.ts";
import { createUser } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { secureFor } from "../src/http/cookie_secure.ts";
import { clearFlashCookie, flashCookie } from "../src/web/flash.ts";
import { cookieHeader } from "../src/http/rp.ts";
import { sessionCookie } from "../src/web/pages/site.ts";
import { quietLogs } from "./helpers/globals.ts";
quietLogs();
const http = new URL("http://forge.test/x");
const https = new URL("https://forge.test/x");
describe("secureFor", () => {
  test("true for an https request, forge or app; false for none", () => {
    expect(secureFor(https)).toBe(true);
    expect(secureFor(http, "https://forge.test")).toBe(true);
    expect(secureFor(http, "http://forge.test")).toBe(false);
    expect(secureFor(undefined)).toBe(false);
  });
  test("session and flash cookies follow the forge's address, not just the request", () => {
    const at = (forge: string) => [
      sessionCookie("t", new Date(0), http, forge),
      flashCookie({ message: "hi" }, http, forge),
      clearFlashCookie(http, forge),
    ];
    for (const c of at("https://forge.test")) expect(c).toContain("; Secure");
    for (const c of at("http://forge.test")) expect(c).not.toContain("Secure");
  });
});
describe("the visitor cookie on an app host", () => {
  let dir: string;
  let app: App;
  let servers: Servers;
  let runtime: AppsRuntime;
  beforeAll(async () => {
    dir = await mkdtemp(join(tmpdir(), "forge-secure-"));
    app = createApp({ dataDir: dir, port: 0, host: "forge.test" });
    servers = await serve(app);
    runtime = new AppsRuntime(app, { domain: "apps.test", scheme: "http", publicPort: servers.port, forgeUrl: servers.url, concurrency: 1 });
    await runtime.start();
    const a = await createUser(app.db, { origin: "seed", trusted: true, username: "alice", email: "[email protected]", password: "a-good-passphrase", adminIfFirst: true });
    if (!a.ok) throw new Error(a.error);
    const made = await newApp(app, a.value, { name: "notes", description: "Words", visibility: "public" });
    if (!made.ok) throw new Error(String(made.error));
  }, 120_000);
  afterAll(async () => {
    await runtime.stop();
    servers.stop();
    app.close();
    await rm(dir, { recursive: true, force: true });
  });
  const visitor = async (forgeUrl: string) => {
    (runtime.options as { forgeUrl: string }).forgeUrl = forgeUrl;
      
        sentinelcrew
        19d ago
        
      
      Low: this casts away readonly to change the runtime's options partway through the suite, and the order of the two tests then decides what the second one sees. Two small runtimes, one per forge address, would make each test stand on its own. Not blocking: each test sets the value it needs before it fetches.
    
      
        sentinelcrew
        19d ago
        
      
      Writing to runtime.options through a cast changes shared state between the two tests, so the order they run in matters. That is fine for now because they run in sequence. A cleaner version builds two runtimes, or restores the value in a finally.
    
      
        sentinelcrew
        19d ago
        
      
      Casting away readonly on runtime.options to flip the forge address between tests makes the two cases order-dependent. Two runtimes, or one built per case, would keep each test standalone. Fine for now: it passes and nothing else shares this runtime.
    
    const host = `notes.apps.test:${servers.port}`;
    const res = await fetch(`${servers.url}/__forge/notes`, { headers: { host } });
    return res.headers.get("set-cookie") ?? "";
  };
  test("Secure when the forge is https, though the request was http", async () => {
    expect(await visitor("https://forge.test")).toContain("; Secure");
  });
  test("not Secure on a plain-http forge", async () => {
    const cookie = await visitor(servers.url);
    expect(cookie).toContain("forge_visitor=");
    expect(cookie).not.toContain("Secure");
  });
});
describe("the parent, theme and mode cookies follow the same rule", () => {
  let dir: string;
  let app: App;
  let servers: Servers;
  beforeAll(async () => {
    dir = await mkdtemp(join(tmpdir(), "forge-secure-rule-"));
    app = createApp({ dataDir: dir, port: 0, host: "forge.test", url: "https://forge.test" });
    servers = await serve(app);
  }, 120_000);
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dir, { recursive: true, force: true });
  });
  test("the parent sign-in state cookie is Secure on an https forge, though the request was http", () => {
    expect(cookieHeader("s", 600, http, "https://forge.test")).toContain("; Secure");
    expect(cookieHeader("s", 600, http, "http://forge.test")).not.toContain("Secure");
  });
  test("forge_theme is Secure on an https forge, though the request was http", async () => {
    const res = await fetch(`${servers.url}/theme`, {
      method: "POST",
      headers: { origin: "https://forge.test", "content-type": "application/x-www-form-urlencoded" },
      body: new URLSearchParams({ theme: "dark" }),
      redirect: "manual",
    });
    const cookie = res.headers.get("set-cookie") ?? "";
    expect(cookie).toContain("forge_theme=dark");
    expect(cookie).toContain("; Secure");
  });
  test("forge_mode is Secure on an https forge, though the request was http", async () => {
    const res = await fetch(`${servers.url}/?mode=dev`, { redirect: "manual" });
    const cookie = res.headers.get("set-cookie") ?? "";
    expect(cookie).toContain("forge_mode=");
    expect(cookie).toContain("; Secure");
  });
});
		@@ -45,8 +45,13 @@ import { readServing } from "./serving.ts";
45	45	import { notFound, securityFloor } from "../http/respond.ts";
46	46	import { appMeasure } from "./measure.ts";
47	47	import { holdPortRequest, holdPortSocket } from "./handoff.ts";
	48	import { secureFor } from "../http/cookie_secure.ts";
48	49	import { htmlAnswer, readPage, rewritable, withToolbar, type PillWhere } from "./toolbar.ts";
49	50
	51	const proxySecure = (request: Request, url: URL, forgeUrl: string): boolean =>
	52	secureFor(url, forgeUrl) \|\|
	53	request.headers.get("x-forwarded-proto") === "https";
	54
50	55	export interface AppTarget {
51	56	readonly app: AppRecord;
52	57	readonly env: EnvName;
		@@ -599,9 +604,7 @@ export async function proxyApp(
599	604	);
600	605	}
601	606	if (url.pathname === "/__forge/signout" && !target.nested) {
602		const secure =
603		url.protocol === "https:" \|\|
604		request.headers.get("x-forwarded-proto") === "https";
	607	const secure = proxySecure(request, url, runtime.options.forgeUrl);
605	608	return securityFloor(
606	609	new Response(null, {
607	610	status: 303,
		@@ -752,9 +755,7 @@ export async function proxyApp(
752	755	sealed,
753	756	viewerId,
754	757	grantCookie: cookie,
755		secure:
756		url.protocol === "https:" \|\|
757		request.headers.get("x-forwarded-proto") === "https",
	758	secure: proxySecure(request, url, runtime.options.forgeUrl),
758	759	source: clientBucket(request),
759	760	});
760	761	if (answer !== undefined) return securityFloor(answer);
		@@ -1252,9 +1253,7 @@ function grant(
1252	1253	vouched.who,
1253	1254	);
1254	1255	const path = safePath(url.searchParams.get("to"));
1255		const secure =
1256		url.protocol === "https:" \|\|
1257		request.headers.get("x-forwarded-proto") === "https";
	1256	const secure = proxySecure(request, url, runtime.options.forgeUrl);
1258	1257	return new Response(null, {
1259	1258	status: 303,
1260	1259	headers: {
		@@ -11,6 +11,7 @@
11	11	* Both are GETs that change nothing a stranger could use: a callback with
12	12	* no matching cookie and state is refused before anything is fetched.
13	13	*/
	14	import { secureFor } from "./cookie_secure.ts";
14	15	import { createHash, randomBytes } from "node:crypto";
15	16	import type { App } from "../app.ts";
16	17	import {
		@@ -117,8 +118,8 @@ function failure(ctx: Ctx, message: string, status: number): Response {
117	118	return response;
118	119	}
119	120
120		const cookieHeader = (value: string, maxAge: number, url: URL, forgeUrl?: string): string => {
121		const secure = url.protocol === "https:" \|\| forgeUrl?.startsWith("https://") ? "; Secure" : "";
	121	export const cookieHeader = (value: string, maxAge: number, url: URL, forgeUrl?: string): string => {
	122	const secure = secureFor(url, forgeUrl) ? "; Secure" : "";
122	123	return `${STATE_COOKIE}=${value}; Path=/signin/parent; HttpOnly; SameSite=Lax; Max-Age=${maxAge}${secure}`;
123	124	};
124	125
		@@ -6,6 +6,7 @@
6	6	*/
7	7
8	8	import { followUpstreamCheck, followUpstreamUpdate } from "../web/pages/upstream-follow.ts";
	9	import { secureFor } from "./cookie_secure.ts";
9	10	import { refusedByDatabase, shownRefusal } from "./refusal.ts";
10	11	import { NOT_A_MEMBER } from "../core/roles.ts";
11	12	import { signupOptions, signupPasskey } from "../web/pages/signup-passkey.ts";
		@@ -1678,11 +1679,11 @@ function withRateHeaders(
1678	1679	* a redirect to its own clean address, and the cookie that used to hold the
1679	1680	* choice is let go on the way.
1680	1681	*/
1681		function withoutMode(url: URL, request: Request): Response \| undefined {
	1682	function withoutMode(url: URL, request: Request, forgeUrl?: string): Response \| undefined {
1682	1683	if (request.method !== "GET" \|\| !url.searchParams.has("mode")) return undefined;
1683	1684	const clean = new URL(url);
1684	1685	clean.searchParams.delete("mode");
1685		const secure = url.protocol === "https:" ? "; Secure" : "";
	1686	const secure = secureFor(url, forgeUrl) ? "; Secure" : "";
1686	1687	return new Response(null, {
1687	1688	status: 303,
1688	1689	headers: {
		@@ -2578,7 +2579,7 @@ async function answerGet(
2578	2579
2579	2580	const themeCookie = cookieValue(request, "forge_theme") ?? "";
2580	2581	if (!isApiPath) {
2581		const clean = withoutMode(url, request);
	2582	const clean = withoutMode(url, request, app.config.url);
2582	2583	if (clean !== undefined) return clean;
2583	2584	}
2584	2585	const invoke = (into: Request): Response \| Promise<Response> =>
		@@ -1,3 +1,5 @@
	1	import { secureFor } from "../http/cookie_secure.ts";
	2
1	3	/**
2	4	* Flash messages: the missing half of post-redirect-get. A mutation sets a
3	5	* short-lived cookie, the next page renders it exactly once as a `.toast` and
		@@ -27,15 +29,15 @@ export interface Flash {
27	29	const MAX_FLASH = 2000;
28	30
29	31	/** The `Set-Cookie` value that carries a flash to the next request. */
30		export function flashCookie(flash: Flash, url?: URL): string {
	32	export function flashCookie(flash: Flash, url?: URL, forgeUrl?: string): string {
31	33	const encoded = encodeURIComponent(JSON.stringify(flash)).slice(0, MAX_FLASH);
32		const secure = url?.protocol === "https:" ? "; Secure" : "";
	34	const secure = secureFor(url, forgeUrl) ? "; Secure" : "";
33	35	return `${FLASH_COOKIE}=${encoded}; Path=/; Max-Age=60; SameSite=Lax; HttpOnly${secure}`;
34	36	}
35	37
36	38	/** The `Set-Cookie` value that clears it, sent with the page that showed it. */
37		export function clearFlashCookie(url?: URL): string {
38		const secure = url?.protocol === "https:" ? "; Secure" : "";
	39	export function clearFlashCookie(url?: URL, forgeUrl?: string): string {
	40	const secure = secureFor(url, forgeUrl) ? "; Secure" : "";
39	41	return `${FLASH_COOKIE}=; Path=/; Max-Age=0; SameSite=Lax; HttpOnly${secure}`;
40	42	}
41	43
		@@ -678,7 +678,7 @@ export function page(options: PageOptions, status = 200): Response {
678	678	link: linkHeader(links),
679	679	});
680	680	// A flash is shown exactly once: rendering it is also what clears it.
681		if (cookieFlash) headers.append("set-cookie", clearFlashCookie(ctx.url));
	681	if (cookieFlash) headers.append("set-cookie", clearFlashCookie(ctx.url, ctx.app.config.url));
682	682	if (tagged) {
683	683	const etag = weakEtag(text);
684	684	headers.set("etag", etag);
		@@ -697,6 +697,8 @@ export interface RedirectOptions {
697	697	flash?: Flash;
698	698	/** Needed only so the flash cookie learns whether to be Secure. */
699	699	url?: URL;
	700	/** The forge's own address: https there makes the cookie Secure behind a TLS-ending proxy. */
	701	forgeUrl?: string \| undefined;
		sentinelcrew 19d ago Low: this is optional, so the one rule depends on each caller remembering to pass it, and every flash redirect in this diff had to be edited by hand to add it. A later `redirect(to, { flash, url: ctx.url })` compiles and silently loses `Secure` behind the TLS-ending proxy. Fix: derive the flag from `Ctx` (e.g. `redirect(ctx, to, …)`, or have flash redirects go only through `flashTo`), so leaving it out is impossible. sentinelcrew 19d ago Every flash redirect now has to remember both `url` and `forgeUrl`. A caller that forgets `forgeUrl` silently falls back to not Secure, and nothing catches it. Optional, but sturdier: have `redirect` take `secure?: boolean` computed once by the caller with `secureFor`, or route these call sites through `flashTo(ctx, …)`, which already has `ctx`. sentinelcrew 19d ago Optional `forgeUrl` means a future `redirect(..., { flash, url })` that forgets it silently falls back to the request scheme, which is the bug this pull fixes. `flashTo(ctx, …)` already covers most callers. Later, consider routing the remaining direct `redirect` callers through a ctx-taking helper so the rule can't be skipped.
700	702	}
701	703
702	704	export function redirect(
		@@ -708,7 +710,7 @@ export function redirect(
708	710	const headers = new Headers({ location: to });
709	711	if (o.cookie !== undefined) headers.append("set-cookie", o.cookie);
710	712	if (o.flash !== undefined)
711		headers.append("set-cookie", flashCookie(o.flash, o.url));
	713	headers.append("set-cookie", flashCookie(o.flash, o.url, o.forgeUrl));
712	714	return new Response(null, { status: 303, headers });
713	715	}
714	716
		@@ -768,7 +770,7 @@ export function missingFragment(request: Request): Response {
768	770
769	771	/** Redirect back to a page carrying a message — the shape most handlers want. */
770	772	export function flashTo(ctx: Ctx, to: string, flash: Flash): Response {
771		return redirect(to, { flash, url: ctx.url });
	773	return redirect(to, { flash, url: ctx.url, forgeUrl: ctx.app.config.url });
772	774	}
773	775
774	776	/**
		@@ -794,6 +794,7 @@ export async function appRedeploy(ctx: Ctx): Promise<Response> {
794	794	// there (`envBack`); the run itself is one link away on that card.
795	795	return redirect(envBack(ctx, repo), {
796	796	url: ctx.url,
	797	forgeUrl: ctx.app.config.url,
797	798	flash: {
798	799	message:
799	800	run === undefined
		@@ -218,6 +218,7 @@ export async function everydayCreate(ctx: Ctx): Promise<Response> {
218	218	return redirect("/", {
219	219	cookie: sessionCookie(session.token, session.expiresAt, ctx.url, ctx.app.config.url),
220	220	url: ctx.url,
	221	forgeUrl: ctx.app.config.url,
221	222	flash: {
222	223	message: `You are signed in as ${made.value.username}, your everyday account. Sign in as ${admin.username} when you mean to change the forge.`,
223	224	},
		@@ -251,6 +252,7 @@ export async function everydaySwitch(ctx: Ctx): Promise<Response> {
251	252	return redirect("/signin", {
252	253	cookie: sessionCookie("", new Date(0), ctx.url, ctx.app.config.url),
253	254	url: ctx.url,
	255	forgeUrl: ctx.app.config.url,
254	256	flash: { message: `Sign in as ${daily.username}, your everyday account.` },
255	257	});
256	258	}
		@@ -52,6 +52,7 @@ import {
52	52	} from "../ui.ts";
53	53	import { existsSync } from "node:fs";
54	54	import { join } from "node:path";
	55	import { secureFor } from "../../http/cookie_secure.ts";
55	56	import { hasAdmin } from "../../spawn/claim.ts";
56	57	import { getSignup, type SignupMode } from "../../settings/signup.ts";
57	58	import { EMAIL_TAKEN_MESSAGE, NAME_RESERVED, USERNAME_TAKEN } from "../../actions/signup_words.ts";
		@@ -64,10 +65,7 @@ export function sessionCookie(
64	65	): string {
65	66	// Secure when the request or the forge's own address is https: behind a
66	67	// proxy that ends TLS the request itself arrives as http.
67		const secure =
68		url.protocol === "https:" \|\| forgeUrl?.startsWith("https://")
69		? "; Secure"
70		: "";
	68	const secure = secureFor(url, forgeUrl) ? "; Secure" : "";
71	69	return `forge_session=${value}; Path=/; HttpOnly; SameSite=Lax; Expires=${expires.toUTCString()}${secure}`;
72	70	}
73	71
		@@ -696,7 +694,7 @@ export async function themeSubmit(ctx: Ctx): Promise<Response> {
696	694	const form = await readForm(ctx, undefined, STRANGER_MAX);
697	695	if (form instanceof Response) return form;
698	696	const choice = field(form, "theme");
699		const secure = ctx.url.protocol === "https:" ? "; Secure" : "";
	697	const secure = secureFor(ctx.url, ctx.app.config.url) ? "; Secure" : "";
700	698	const cookie = isThemeName(choice)
701	699	? `forge_theme=${choice}; Path=/; Max-Age=31536000; SameSite=Lax; HttpOnly${secure}`
702	700	: `forge_theme=; Path=/; Max-Age=0; SameSite=Lax; HttpOnly${secure}`;
		@@ -629,6 +629,7 @@ export async function frontUpdate(ctx: Ctx): Promise<Response> {
629	629	const set = setFront(ctx.app, ctx.auth.user, next);
630	630	return redirect("/front", {
631	631	url: ctx.url,
	632	forgeUrl: ctx.app.config.url,
632	633	flash: set.ok
633	634	? { message: "The front page is updated." }
634	635	: {
		@@ -34,6 +34,7 @@ export async function homeArchive(ctx: Ctx): Promise<Response> {
34	34	if (ids.length === 0 \|\| ids.length > MAX_ROWS)
35	35	return redirect("/", {
36	36	url: ctx.url,
	37	forgeUrl: ctx.app.config.url,
37	38	flash: { tone: "danger", message: "Tick the apps to archive first." },
38	39	});
39	40	const op = await applyFleetIds(
		@@ -47,6 +48,7 @@ export async function homeArchive(ctx: Ctx): Promise<Response> {
47	48	if (!op.ok)
48	49	return redirect("/", {
49	50	url: ctx.url,
	51	forgeUrl: ctx.app.config.url,
50	52	flash: { tone: "danger", message: op.error.message },
51	53	});
52	54	return redirect(`/home/archived/${op.value.id}`);
		@@ -110,6 +112,7 @@ export async function homeArchiveUndo(ctx: Ctx): Promise<Response> {
110	112	if (!undone.ok)
111	113	return redirect("/", {
112	114	url: ctx.url,
	115	forgeUrl: ctx.app.config.url,
113	116	flash: { tone: "danger", message: undone.error.message },
114	117	});
115	118	return redirect(`/home/archived/${undone.value.id}`);