notes

8.1 KB

1. // project.hl — notes.worldapi.org: THE APP. Routes and WHO HEARS WHAT. Hybriel on hl:web.
2. // Notes with an ident login (ticket notes#1): a sidebar of the user's notes (subject = first line, last edited
3. // first) and the selected note on the right, edited with <md-editor> (shared/md-editor.js, vendored from
4. // worldapi-components). Saved on the server in storage/mpackdb/. Offline use is ticket notes#2.
5. import WebFramework from 'hl:web'
6. import { env } from 'hl:proc'
7. import { Response } from 'hl:http1'
8. import { randomBytes } from 'hl:crypto'
10. import Styles from './styles.hl'
11. import { exchangeCode, ensureUser, userIdOfSession } from './users.hl'
12. import { metaRows, noteView, pushNote, removeNote } from './notes.hl'
13. import { jsonErrorAt } from './jsoncheck.hl'
15. import Notes from './components/notes.hl'
16. import LoginFailed from './components/loginfailed.hl'
18. static siteName = "notes"
20. appTitle = siteName
21. styles = Styles
23. // ---- THE LOGIN BUTTON'S RETURN (ident README "How apps use ident") ----------------------------
24. // BACK TO THE PAGE: /login.js puts `?next=` into the button's return URL at the click. Only a same-origin PATH
25. // goes (one `/`, URL-safe characters, ≤ 500). Anything else → `/`.
26. nextChars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~/?&=%+,;@!$()*:'
27. safePath = (want) => {
28. if (want == null || hlTypeName(want) != 'String' || want == '' || want.length > 500) { return '/' }
29. if (want.slice(0, 1) != '/' || want.slice(0, 2) == '//' || want.slice(0, 7) == '/login/') { return '/' }
30. let i = 0
31. while (i < want.length) {
32. if (!nextChars.includes(want[i])) { return '/' }
33. i = i + 1
34. }
35. return want
36. }
38. // A FAILED LOGIN is a page (components/loginfailed.hl): the reason is parked in the session, then → /login/failed
39. failed = (req, why) => {
40. let s = req.session
41. let fresh = s == null
42. if (fresh) { s = server.sessions.mint() }
43. s.data.loginError = why
44. server.sessions.save(s)
45. let res = new Response('login failed: ' + why, { status = 302 headers = { 'Location' = '/login/failed' 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
46. if (fresh) { res.headers['Set-Cookie'] = server.sessions.cookieHeader(s.id) }
47. return res
48. }
50. // the function route gets the cookie's session as req.session (hybriel #11); none yet → minted here
51. loginCallback = (route, req) => {
52. if (req.method != 'GET') { return failed(req, 'GET only') }
53. let q = req.query != null ? req.query : {}
54. let code = q.ident_code
55. if (code == null || code == '') { return failed(req, 'ident sent no login code') }
56. let x = exchangeCode(code)
57. if (x.error != null) { return failed(req, x.error) }
58. let u = ensureUser(x.identity)
59. if (u == null) { return failed(req, 'could not store the user') }
60. let s = req.session
61. let fresh = s == null
62. if (fresh) { s = server.sessions.mint() }
63. s.user = { id = u.id }
64. s.data.tag = randomBytes(16)
65. s.data.loginError = null
66. server.sessions.save(s)
67. let res = new Response('logged in', { status = 302 headers = { 'Location' = safePath(q.next) 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
68. if (fresh) { res.headers['Set-Cookie'] = server.sessions.cookieHeader(s.id) }
69. return res
70. }
73. // ---- THE SYNC API (ticket notes#2): what the browser's offline copy talks to. JSON, the session cookie is the login.
74. // GET /api/me → { user } (an opaque id of the signed-in user, or null)
75. // GET /api/notes → { notes: [{ id, edited, gone }] } every note of the user, tombstones included
76. // GET /api/notes?id=<id> → { id, text, edited, created }
77. // POST /api/notes { op: 'save', id, local, text, base, at } → { id, edited, text, copy? }
78. // POST /api/notes { op: 'delete', id, base } → { ok } | { kept, id, edited, text }
79. // Invalid JSON is refused by jsoncheck.hl before JSON.parse sees it (hybriel #6); unknown/mistyped fields → 400.
80. apiHeaders = { 'Content-Type' = 'application/json; charset=utf-8' 'Cache-Control' = 'no-store' }
81. reply = (status, value) => { return new Response(JSON.stringify(value), { status = status headers = apiHeaders }) }
82. isText = (v) => { return v != null && hlTypeName(v) == 'String' }
83. isTime = (v) => { return v != null && hlTypeName(v) == 'Number' && v >= 0 }
85. apiMe = (route, req) => {
86. let u = userIdOfSession(req.session)
87. return reply(200, { user = u })
88. }
90. apiNotes = (route, req) => {
91. let u = userIdOfSession(req.session)
92. if (u == null) { return reply(401, { error = 'log in with ident first' }) }
93. let q = req.query != null ? req.query : {}
94. if (req.method == 'GET') {
95. if (q.id != null) {
96. let v = noteView(u, q.id)
97. if (v == null) { return reply(404, { error = 'no such note' }) }
98. return reply(200, v)
99. }
100. return reply(200, { notes = metaRows(u) })
101. }
102. if (req.method != 'POST') { return reply(405, { error = 'GET or POST only' }) }
103. if (req.body == null || req.body == '') { return reply(400, { error = 'a JSON body is needed' }) }
104. let at = jsonErrorAt(req.body)
105. if (at >= 0) { return reply(400, { error = 'invalid JSON at character ' + at }) }
106. let b = JSON.parse(req.body)
107. if (b == null || hlTypeName(b) != 'Hybrid') { return reply(400, { error = 'the body must be a JSON object' }) }
108. if (b.op == 'save') {
109. if (!isText(b.id) || !isText(b.local) || !isText(b.text) || !isTime(b.base) || !isTime(b.at)) { return reply(400, { error = 'save needs id, local, text (strings) and base, at (numbers)' }) }
110. if (b.local.length > 64 || b.id.length > 64) { return reply(400, { error = 'id / local too long' }) }
111. let r = pushNote(u, b.id, b.local, b.text, b.base, b.at)
112. if (r.error != null) { return reply(400, r) }
113. return reply(200, r)
114. }
115. if (b.op == 'delete') {
116. if (!isText(b.id) || !isTime(b.base)) { return reply(400, { error = 'delete needs id (string) and base (number)' }) }
117. return reply(200, removeNote(u, b.id, b.base))
118. }
119. return reply(400, { error = "op must be 'save' or 'delete'" })
120. }
122. routes = [
123. { pattern = "/favicon.ico" direct = "" }
124. { pattern = "/login/callback" function = loginCallback }
125. { pattern = "/login/failed" component = LoginFailed }
126. { pattern = "/login.js" file = "./login.js" headers = { 'Cache-Control' = 'no-cache' } }
127. // the Markdown editor <md-editor>, vendored from worldapi-components (one <script> in the shell would do too:
128. // it is loaded by the page component's parent, see components/main.hl)
129. { pattern = "/md-editor.js" file = "./shared/md-editor.js" headers = { 'Cache-Control' = 'no-cache' } }
130. { pattern = "/api/me" function = apiMe }
131. { pattern = "/api/notes" function = apiNotes }
132. // the offline copy: the service worker (network first, the cached page when there is none) and the client that
133. // keeps the notes in IndexedDB and syncs them
134. { pattern = "/sw.js" file = "./sw.js" headers = { 'Cache-Control' = 'no-cache' } }
135. { pattern = "/notes-offline.js" file = "./notes-offline.js" headers = { 'Cache-Control' = 'no-cache' } }
136. { pattern = "/" component = Notes }
137. { pattern = "/note/:id" component = Notes }
138. ]
140. // WHO GETS THE PUSH: the login state reaches the tabs of one session. (Notes are not pushed: the browser's own copy
141. // pulls through /api/notes.)
142. // `notesSignedIn` / `notesSignedOut` go to the tabs of ONE session: the one whose login carries that random tag.
143. tagOf = (session) => { return session != null && session.data != null ? session.data.tag : null }
144. audience = {
145. notesSignedIn = (tag, session) => { return tag != null && tagOf(session) == tag }
146. notesSignedOut = (tag, session) => { return tag != null && tagOf(session) == tag }
147. }
149. sessionDir = env('NOTES_SESSIONS') != null ? env('NOTES_SESSIONS') : null
150. port = env('NOTES_PORT') != null ? toNumber(env('NOTES_PORT')) : 8710
151. // HL_HOST = the interface hl:web binds: 127.0.0.1 on Byrodin behind nginx; unset = 0.0.0.0 (dev on Loreana).
152. // NOTES_WATCH=0 = no dev watcher. The session cookie is `notessid` (hybriel #10). A note taker is not logged
153. // out after 15 minutes of thinking: the session idles out after the 14 days of sessionMaxAge.
154. watching = env('NOTES_WATCH') != '0'
155. sessionCookie = 'notessid'
156. sessionIdle = 1209600
157. server = new WebFramework(routes = routes, styles = styles, minify = true, port = port, watchMode = watching, sessionCookie = sessionCookie)
159. on Error(e) { console.log('error absorbed: ' + e.message) }