notes

9.9 KB

1. // project.hl — notes.worldapi.org: THE APP. Routes and WHO HEARS WHAT. Hybriel on hl:web.
2. // Notes with an ident login (ticket notes#1): a sidebar of the user's notes (subject = first line, last edited
3. // first) and the selected note on the right, edited with <md-editor> (shared/md-editor.js, vendored from
4. // worldapi-components). Saved on the server in storage/mpackdb/. Offline use is ticket notes#2.
5. import WebFramework from 'hl:web'
6. import { env } from 'hl:proc'
7. import { Response } from 'hl:http1'
8. import { randomBytes } from 'hl:crypto'
10. import Styles from './styles.hl'
11. import { exchangeCode, ensureUser, userIdOfSession } from './users.hl'
12. import { metaRows, noteView, pushNote, removeNote } from './notes.hl'
13. import { jsonErrorAt } from './jsoncheck.hl'
14. import { dark, darker } from './shared/tokens.hl'
16. import Notes from './components/notes.hl'
17. import LoginFailed from './components/loginfailed.hl'
19. static siteName = "notes"
21. appTitle = siteName
23. // ---- THE INSTALLABLE APP (mission 046), as calendar.worldapi.org / tracker do it: hl:web's own web app manifest
24. // (/__hl/manifest.webmanifest, linked from every head with the apple-touch-icon and theme-color) from these settings.
25. // Icons in icons/ (icon.svg is the source, the PNGs are rendered from it with rsvg-convert, README "PWA"). The theme
26. // colour is the header's background (darker), the splash background the page's (dark) — both off the tokens.
27. // NO `offline = [...]` here ON PURPOSE: that would make hl:web register its own service worker (/__hl/sw.js, scope /)
28. // over notes' own /sw.js (notes-offline.js registers it, same scope) — one would replace the other. Notes keeps its
29. // own offline copy (sw.js + IndexedDB, ticket notes#2) until notes#4 moves it to Hybriel.
30. appThemeColor = darker.value
31. appBackgroundColor = dark.value
32. appIcons = [
33. { src = '/icons/icon-192.png' sizes = '192x192' purpose = 'any' }
34. { src = '/icons/icon-512.png' sizes = '512x512' purpose = 'any' }
35. { src = '/icons/icon-192.png' sizes = '192x192' purpose = 'maskable' }
36. { src = '/icons/icon-512.png' sizes = '512x512' purpose = 'maskable' }
37. ]
38. appTouchIcon = '/icons/apple-touch-icon.png'
39. appFavicon = '/icons/favicon.svg'
40. styles = Styles
42. // ---- THE LOGIN BUTTON'S RETURN (ident README "How apps use ident") ----------------------------
43. // BACK TO THE PAGE: /login.js puts `?next=` into the button's return URL at the click. Only a same-origin PATH
44. // goes (one `/`, URL-safe characters, ≤ 500). Anything else → `/`.
45. nextChars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~/?&=%+,;@!$()*:'
46. safePath = (want) => {
47. if (want == null || hlTypeName(want) != 'String' || want == '' || want.length > 500) { return '/' }
48. if (want.slice(0, 1) != '/' || want.slice(0, 2) == '//' || want.slice(0, 7) == '/login/') { return '/' }
49. let i = 0
50. while (i < want.length) {
51. if (!nextChars.includes(want[i])) { return '/' }
52. i = i + 1
53. }
54. return want
55. }
57. // A FAILED LOGIN is a page (components/loginfailed.hl): the reason is parked in the session, then → /login/failed
58. failed = (req, why) => {
59. let s = req.session
60. let fresh = s == null
61. if (fresh) { s = server.sessions.mint() }
62. s.data.loginError = why
63. server.sessions.save(s)
64. let res = new Response('login failed: ' + why, { status = 302 headers = { 'Location' = '/login/failed' 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
65. if (fresh) { res.headers['Set-Cookie'] = server.sessions.cookieHeader(s.id) }
66. return res
67. }
69. // the function route gets the cookie's session as req.session (hybriel #11); none yet → minted here
70. loginCallback = (route, req) => {
71. if (req.method != 'GET') { return failed(req, 'GET only') }
72. let q = req.query != null ? req.query : {}
73. let code = q.ident_code
74. if (code == null || code == '') { return failed(req, 'ident sent no login code') }
75. let x = exchangeCode(code)
76. if (x.error != null) { return failed(req, x.error) }
77. let u = ensureUser(x.identity)
78. if (u == null) { return failed(req, 'could not store the user') }
79. let s = req.session
80. let fresh = s == null
81. if (fresh) { s = server.sessions.mint() }
82. s.user = { id = u.id }
83. s.data.tag = randomBytes(16)
84. s.data.loginError = null
85. server.sessions.save(s)
86. let res = new Response('logged in', { status = 302 headers = { 'Location' = safePath(q.next) 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
87. if (fresh) { res.headers['Set-Cookie'] = server.sessions.cookieHeader(s.id) }
88. return res
89. }
92. // ---- THE SYNC API (ticket notes#2): what the browser's offline copy talks to. JSON, the session cookie is the login.
93. // GET /api/me → { user } (an opaque id of the signed-in user, or null)
94. // GET /api/notes → { notes: [{ id, edited, gone }] } every note of the user, tombstones included
95. // GET /api/notes?id=<id> → { id, text, edited, created }
96. // POST /api/notes { op: 'save', id, local, text, base, at } → { id, edited, text, copy? }
97. // POST /api/notes { op: 'delete', id, base } → { ok } | { kept, id, edited, text }
98. // Invalid JSON is refused by jsoncheck.hl before JSON.parse sees it (hybriel #6); unknown/mistyped fields → 400.
99. apiHeaders = { 'Content-Type' = 'application/json; charset=utf-8' 'Cache-Control' = 'no-store' }
100. reply = (status, value) => { return new Response(JSON.stringify(value), { status = status headers = apiHeaders }) }
101. isText = (v) => { return v != null && hlTypeName(v) == 'String' }
102. isTime = (v) => { return v != null && hlTypeName(v) == 'Number' && v >= 0 }
104. apiMe = (route, req) => {
105. let u = userIdOfSession(req.session)
106. return reply(200, { user = u })
107. }
109. apiNotes = (route, req) => {
110. let u = userIdOfSession(req.session)
111. if (u == null) { return reply(401, { error = 'log in with ident first' }) }
112. let q = req.query != null ? req.query : {}
113. if (req.method == 'GET') {
114. if (q.id != null) {
115. let v = noteView(u, q.id)
116. if (v == null) { return reply(404, { error = 'no such note' }) }
117. return reply(200, v)
118. }
119. return reply(200, { notes = metaRows(u) })
120. }
121. if (req.method != 'POST') { return reply(405, { error = 'GET or POST only' }) }
122. if (req.body == null || req.body == '') { return reply(400, { error = 'a JSON body is needed' }) }
123. let at = jsonErrorAt(req.body)
124. if (at >= 0) { return reply(400, { error = 'invalid JSON at character ' + at }) }
125. let b = JSON.parse(req.body)
126. if (b == null || hlTypeName(b) != 'Hybrid') { return reply(400, { error = 'the body must be a JSON object' }) }
127. if (b.op == 'save') {
128. if (!isText(b.id) || !isText(b.local) || !isText(b.text) || !isTime(b.base) || !isTime(b.at)) { return reply(400, { error = 'save needs id, local, text (strings) and base, at (numbers)' }) }
129. if (b.local.length > 64 || b.id.length > 64) { return reply(400, { error = 'id / local too long' }) }
130. let r = pushNote(u, b.id, b.local, b.text, b.base, b.at)
131. if (r.error != null) { return reply(400, r) }
132. return reply(200, r)
133. }
134. if (b.op == 'delete') {
135. if (!isText(b.id) || !isTime(b.base)) { return reply(400, { error = 'delete needs id (string) and base (number)' }) }
136. return reply(200, removeNote(u, b.id, b.base))
137. }
138. return reply(400, { error = "op must be 'save' or 'delete'" })
139. }
141. routes = [
142. { pattern = "/favicon.ico" file = "./icons/favicon.ico" headers = { 'Cache-Control' = 'no-cache' } }
143. // the installable app (mission 046): the icons (the manifest is hl:web's own, from appIcons)
144. { pattern = "/icons/icon-192.png" file = "./icons/icon-192.png" headers = { 'Cache-Control' = 'no-cache' } }
145. { pattern = "/icons/icon-512.png" file = "./icons/icon-512.png" headers = { 'Cache-Control' = 'no-cache' } }
146. { pattern = "/icons/apple-touch-icon.png" file = "./icons/apple-touch-icon.png" headers = { 'Cache-Control' = 'no-cache' } }
147. { pattern = "/icons/favicon.svg" file = "./icons/favicon.svg" headers = { 'Cache-Control' = 'no-cache' } }
148. { pattern = "/login/callback" function = loginCallback }
149. { pattern = "/login/failed" component = LoginFailed }
150. { pattern = "/login.js" file = "./login.js" headers = { 'Cache-Control' = 'no-cache' } }
151. // the Markdown editor <md-editor>, vendored from worldapi-components (one <script> in the shell would do too:
152. // it is loaded by the page component's parent, see components/main.hl)
153. { pattern = "/md-editor.js" file = "./shared/md-editor.js" headers = { 'Cache-Control' = 'no-cache' } }
154. { pattern = "/api/me" function = apiMe }
155. { pattern = "/api/notes" function = apiNotes }
156. // the offline copy: the service worker (network first, the cached page when there is none) and the client that
157. // keeps the notes in IndexedDB and syncs them
158. { pattern = "/sw.js" file = "./sw.js" headers = { 'Cache-Control' = 'no-cache' } }
159. { pattern = "/notes-offline.js" file = "./notes-offline.js" headers = { 'Cache-Control' = 'no-cache' } }
160. { pattern = "/" component = Notes }
161. { pattern = "/note/:id" component = Notes }
162. ]
164. // WHO GETS THE PUSH: the login state reaches the tabs of one session. (Notes are not pushed: the browser's own copy
165. // pulls through /api/notes.)
166. // `notesSignedIn` / `notesSignedOut` go to the tabs of ONE session: the one whose login carries that random tag.
167. tagOf = (session) => { return session != null && session.data != null ? session.data.tag : null }
168. audience = {
169. notesSignedIn = (tag, session) => { return tag != null && tagOf(session) == tag }
170. notesSignedOut = (tag, session) => { return tag != null && tagOf(session) == tag }
171. }
173. sessionDir = env('NOTES_SESSIONS') != null ? env('NOTES_SESSIONS') : null
174. port = env('NOTES_PORT') != null ? toNumber(env('NOTES_PORT')) : 8710
175. // HL_HOST = the interface hl:web binds: 127.0.0.1 on Byrodin behind nginx; unset = 0.0.0.0 (dev on Loreana).
176. // NOTES_WATCH=0 = no dev watcher. The session cookie is `notessid` (hybriel #10). A note taker is not logged
177. // out after 15 minutes of thinking: the session idles out after the 14 days of sessionMaxAge.
178. watching = env('NOTES_WATCH') != '0'
179. sessionCookie = 'notessid'
180. sessionIdle = 1209600
181. server = new WebFramework(routes = routes, styles = styles, minify = true, port = port, watchMode = watching, sessionCookie = sessionCookie)
183. on Error(e) { console.log('error absorbed: ' + e.message) }