c0d03e9aaa
A remote user is name@host here, in users.username, in paths (/@alice@music.example) and in mentions, through one handle rule in shared/validation.ts that paths, MENTION_RE and Markdown all build on; Markdown undoes GFM's email autolink of a handle. Their name, email and avatar come from their home at each sign-in and by its signed events (federation_outbox, delivered by the federation job with backoff): a rename at home leaves the old handle an alias here, and a password change or a withdrawn grant ends their sessions here. Their password, email, avatar and name can't change here (assertLocalUser), nor can they sign in elsewhere from here. An admin keeps the trusted and blocked instances on /manage (federation:manage): a trusted instance's users sign in from a button on the login page, a blocked one's can't and are signed out at once, and any other's join with an invite from the register page. The /authorize page asks the user once per instance, and /settings lists the instances their account signs in to, each disconnectable; /login?next= brings a signed-out visitor back to /authorize. Emails stay unique among local accounts only, and migration 0024 adds the tables, makes that index partial and reserves authorize and federation as category slugs. remote/gerbeur-instance.ts is the only way to other instances: https and public addresses only, no redirects, no certificate fallback, unless GERBEUR_FEDERATION_ALLOW_PRIVATE lets two instances on one machine talk. 298 backend tests and 702 frontend tests pass, and deno check, deno fmt, deno lint, tsc, eslint, doc:lint and i18n:compile --strict are clean; checked end to end with two built instances on one machine: sign-in through the other's login and consent pages, consent skipped once granted and asked again after disconnecting, a rename and a password change at home reaching the other, and blocking; screenshots of the login, consent, profile, settings and manage pages at 1280 and 390px. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
106 lines
3.6 KiB
TypeScript
106 lines
3.6 KiB
TypeScript
/**
|
|
* Prepares federated sign-in, by which a user signs in here with their
|
|
* account on another gerbeur instance, and the other way round. It adds the
|
|
* instance's signing key, the link from a local account to the one it stands
|
|
* for elsewhere, the instances an admin trusts or blocks, the state of the
|
|
* sign-ins in progress on both sides, the grants users gave other instances,
|
|
* and the events owed to them.
|
|
*
|
|
* `/authorize` and `/federation/callback` become pages, so their first
|
|
* segments are reserved.
|
|
*
|
|
* An account from another instance has no password here: its `password_hash`
|
|
* is `''`, which no password verifies. Emails stay unique among local accounts
|
|
* only, since the same person may also have a local account, or come from two
|
|
* instances, with one address.
|
|
*
|
|
* @module
|
|
*/
|
|
|
|
import type { DatabaseSync } from "node:sqlite";
|
|
import { renameReservedCategories } from "../../lib/reserved-slugs.ts";
|
|
|
|
/**
|
|
* Run once by `runMigrations`. Nothing exists to convert, since every account
|
|
* so far is local, but `authorize` and `federation` become the pages of a
|
|
* sign-in, so a category that had one as its slug is renamed.
|
|
*/
|
|
export function up(db: DatabaseSync): void {
|
|
db.exec(`
|
|
CREATE TABLE IF NOT EXISTS federation_keys (
|
|
kid TEXT PRIMARY KEY,
|
|
private_jwk TEXT NOT NULL,
|
|
public_jwk TEXT NOT NULL,
|
|
created_at TEXT NOT NULL
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS user_identities (
|
|
user_id TEXT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
|
|
issuer TEXT NOT NULL,
|
|
subject TEXT NOT NULL,
|
|
picture TEXT,
|
|
synced_at TEXT NOT NULL
|
|
);
|
|
CREATE UNIQUE INDEX IF NOT EXISTS idx_user_identities_subject
|
|
ON user_identities(issuer, subject);
|
|
|
|
CREATE TABLE IF NOT EXISTS federation_peers (
|
|
issuer TEXT PRIMARY KEY,
|
|
status TEXT NOT NULL,
|
|
name TEXT,
|
|
created_at TEXT NOT NULL
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS federation_logins (
|
|
state TEXT PRIMARY KEY,
|
|
issuer TEXT NOT NULL,
|
|
code_verifier TEXT NOT NULL,
|
|
nonce TEXT NOT NULL,
|
|
invite_token TEXT,
|
|
created_at TEXT NOT NULL
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS oauth_codes (
|
|
code_hash TEXT PRIMARY KEY,
|
|
user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
|
client_id TEXT NOT NULL,
|
|
redirect_uri TEXT NOT NULL,
|
|
code_challenge TEXT NOT NULL,
|
|
nonce TEXT NOT NULL,
|
|
expires_at TEXT NOT NULL
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS federation_grants (
|
|
user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
|
client_id TEXT NOT NULL,
|
|
client_name TEXT,
|
|
granted_at TEXT NOT NULL,
|
|
last_used_at TEXT NOT NULL,
|
|
PRIMARY KEY (user_id, client_id)
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS federation_outbox (
|
|
id TEXT PRIMARY KEY,
|
|
client_id TEXT NOT NULL,
|
|
event TEXT NOT NULL,
|
|
attempts INTEGER NOT NULL DEFAULT 0,
|
|
next_attempt_at TEXT NOT NULL,
|
|
created_at TEXT NOT NULL
|
|
);
|
|
CREATE INDEX IF NOT EXISTS idx_federation_outbox_next
|
|
ON federation_outbox(next_attempt_at);
|
|
`);
|
|
|
|
const emailIndex = db.prepare(
|
|
`SELECT sql FROM sqlite_master WHERE name = 'idx_users_email_lower';`,
|
|
).get() as { sql: string } | undefined;
|
|
if (!emailIndex?.sql.includes("WHERE")) {
|
|
db.exec(`
|
|
DROP INDEX IF EXISTS idx_users_email_lower;
|
|
CREATE UNIQUE INDEX idx_users_email_lower ON users(lower(email))
|
|
WHERE password_hash != '';
|
|
`);
|
|
}
|
|
renameReservedCategories(db);
|
|
}
|