benjivers/notes Public Public: anyone can read this; nobody can change it.

/**

 * The app's own accounts: an email and a password, for people who have no

 * forge account. Whoever signs in this way is a `user` — exactly what the

 * forge would have signed for a person allowed to see the app — with an id

 * of `acct:<n>`, which no forge id can be, so the contract treats both kinds

 * of person the same and their vaults never meet. Admin is only ever the

 * forge's word.

 *

 * Passwords are hashed with argon2id (`Bun.password`). A session is a random

 * token in an HttpOnly cookie; only its SHA-256 is stored, so a copy of the

 * database opens nobody's vault. Signing in replaces nothing — each device

 * has its own session — and signing out ends that one.

 *

 * If `NOTES_SIGNUP_CODE` is set (Settings → App → Environment), creating an

 * account needs it: the switch for closing sign-up without a deploy.

 */

import type { Database } from "bun:sqlite";

import { createHash, randomBytes } from "node:crypto";

import { record } from "./audit.ts";

import type { Result } from "./actions.ts";

import type { Who } from "./who.ts";

export const SESSION_DAYS = 30;

export const PASSWORD_MIN = 8;

export const PASSWORD_MAX = 200;

const NAME_MAX = 60;

export interface Account {

  readonly id: number;

  readonly email: string;

  readonly name: string;

  readonly created_at: string;

}

const ok = <T>(value: T): Result<T> => ({ ok: true, value });

const fail = <T>(error: "invalid" | "forbidden" | "signin_required", message: string): Result<T> => ({

  ok: false,

  error,

  message,

});

/** The person an account signs in as. */

export const whoOf = (a: Pick<Account, "id" | "name">): Who & { role: "user" } => ({

  role: "user",

  id: `acct:${a.id}`,

  name: a.name,

});

/** Whether `who` signed in with the app's own account (and not the forge). */

export const isAccount = (who: Who): who is Who & { role: "user" } =>

  who.role !== "anon" && who.id.startsWith("acct:");

const digest = (token: string): string => createHash("sha256").update(token).digest("hex");

const cleanEmail = (raw: string): string => raw.trim().toLowerCase();

const EMAIL = /^[^\s@]{1,64}@[^\s@]{1,190}\.[^\s@]{2,63}$/;

// Spent on a sign-in for an email nobody has, so it takes as long as a real one.

let decoy: string | undefined;

const decoyHash = async (): Promise<string> => (decoy ??= await Bun.password.hash("not a password at all"));

function checkPassword(password: string): Result<string> {

  if (password.length < PASSWORD_MIN) return fail("invalid", `A password is at least ${PASSWORD_MIN} characters.`);

  if (password.length > PASSWORD_MAX) return fail("invalid", `A password is at most ${PASSWORD_MAX} characters.`);

  return ok(password);

}

/** A fresh session for an account: the token for the cookie, and only its hash kept. */

function startSession(db: Database, accountId: number): string {

  const token = randomBytes(32).toString("base64url");

  db.query(

    `INSERT INTO session (token_hash, account_id, expires_at)

     VALUES (?1, ?2, strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '+${SESSION_DAYS} days'))`,

  ).run(digest(token), accountId);

  // Expired sessions go as new ones come.

  db.query("DELETE FROM session WHERE expires_at < strftime('%Y-%m-%dT%H:%M:%fZ', 'now')").run();

  return token;

}

export async function signUp(

  db: Database,

  input: { email: string; password: string; name?: string; code?: string },

  signupCode = process.env.NOTES_SIGNUP_CODE ?? "",

): Promise<Result<{ account: Account; token: string }>> {

  const anon: Who = { role: "anon" };

  if (signupCode !== "" && (input.code ?? "").trim() !== signupCode) {

    record(db, { who: anon, resource: "account", verb: "create", outcome: "forbidden" });

    return fail("forbidden", "That sign-up code isn't right.");

  }

  const email = cleanEmail(input.email);

  if (!EMAIL.test(email)) return fail("invalid", "That doesn't look like an email address.");

  const password = checkPassword(input.password);

  if (!password.ok) return password;

  const name = (input.name ?? "").replace(/\s+/g, " ").trim().slice(0, NAME_MAX) || email.split("@")[0]!;

  const taken = db.query<{ id: number }, [string]>("SELECT id FROM account WHERE email = ?1").get(email);

  if (taken !== null) return fail("invalid", "There's already an account with that email. Log in instead.");

  const hash = await Bun.password.hash(password.value);

  const account = db

    .query<Account, [string, string, string]>(

      "INSERT INTO account (email, name, password_hash) VALUES (?1, ?2, ?3) RETURNING id, email, name, created_at",

    )

    .get(email, name, hash)!;

  record(db, { who: whoOf(account), resource: "account", verb: "create", target: account.id, outcome: "ok" });

  return ok({ account, token: startSession(db, account.id) });

}

export async function logIn(

  db: Database,

  input: { email: string; password: string },

): Promise<Result<{ account: Account; token: string }>> {

  const email = cleanEmail(input.email);

  const row = db

    .query<Account & { password_hash: string }, [string]>("SELECT * FROM account WHERE email = ?1")

    .get(email);

  const good = await Bun.password.verify(input.password.slice(0, PASSWORD_MAX), row?.password_hash ?? (await decoyHash()));

  if (row === null || !good) {

    record(db, { who: { role: "anon" }, resource: "session", verb: "create", outcome: "forbidden" });

    return fail("forbidden", "That email and password don't match an account.");

  }

  const { password_hash: _, ...account } = row;

  record(db, { who: whoOf(account), resource: "session", verb: "create", target: account.id, outcome: "ok" });

  return ok({ account, token: startSession(db, account.id) });

}

/** The person a session cookie belongs to, or anonymous. */

export function sessionWho(db: Database, token: string | undefined): Who {

  if (token === undefined || token.length < 20 || token.length > 100) return { role: "anon" };

  const row = db

    .query<{ id: number; name: string }, [string]>(

      `SELECT a.id, a.name FROM session s JOIN account a ON a.id = s.account_id

       WHERE s.token_hash = ?1 AND s.expires_at > strftime('%Y-%m-%dT%H:%M:%fZ', 'now')`,

    )

    .get(digest(token));

  return row === null ? { role: "anon" } : whoOf(row);

}

export function logOut(db: Database, token: string | undefined): void {

  if (token !== undefined) db.query("DELETE FROM session WHERE token_hash = ?1").run(digest(token));

}

const accountIdOf = (who: Who): number | undefined =>

  isAccount(who) ? Number(who.id.slice("acct:".length)) : undefined;

export function getAccount(db: Database, who: Who): Account | undefined {

  const id = accountIdOf(who);

  if (id === undefined) return undefined;

  return db.query<Account, [number]>("SELECT id, email, name, created_at FROM account WHERE id = ?1").get(id) ?? undefined;

}

/** A new password, given the current one. Every other session ends; this device gets a fresh one. */

export async function changePassword(

  db: Database,

  who: Who,

  input: { current: string; next: string },

): Promise<Result<{ token: string }>> {

  const id = accountIdOf(who);

  if (id === undefined) return fail("signin_required", "Log in with an email account to change its password.");

  const row = db.query<{ password_hash: string }, [number]>("SELECT password_hash FROM account WHERE id = ?1").get(id);

  if (row === null || !(await Bun.password.verify(input.current.slice(0, PASSWORD_MAX), row.password_hash))) {

    record(db, { who, resource: "account", verb: "update", target: id, outcome: "forbidden" });

    return fail("forbidden", "Your current password isn't right.");

  }

  const next = checkPassword(input.next);

  if (!next.ok) return next;

  db.query("UPDATE account SET password_hash = ?1 WHERE id = ?2").run(await Bun.password.hash(next.value), id);

  db.query("DELETE FROM session WHERE account_id = ?1").run(id);

  record(db, { who, resource: "account", verb: "update", target: id, outcome: "ok" });

  return ok({ token: startSession(db, id) });

}

/** The account, its sessions and every note in its vault — gone, given the password. */

export async function deleteAccount(

  db: Database,

  who: Who,

  input: { password: string },

): Promise<Result<{ notes: number }>> {

  const id = accountIdOf(who);

  if (id === undefined) return fail("signin_required", "Log in with an email account to delete it.");

  const row = db.query<{ password_hash: string }, [number]>("SELECT password_hash FROM account WHERE id = ?1").get(id);

  if (row === null || !(await Bun.password.verify(input.password.slice(0, PASSWORD_MAX), row.password_hash))) {

    record(db, { who, resource: "account", verb: "delete", target: id, outcome: "forbidden" });

    return fail("forbidden", "That password isn't right.");

  }

  const notes = db.transaction(() => {

    const gone = db.query("DELETE FROM note WHERE author_id = ?1").run(`acct:${id}`).changes;

    db.query("DELETE FROM session WHERE account_id = ?1").run(id);

    db.query("DELETE FROM space_member WHERE who_id = ?1").run(`acct:${id}`);

    db.query("DELETE FROM account WHERE id = ?1").run(id);

    return gone;

  })();

  record(db, { who, resource: "account", verb: "delete", target: id, outcome: "ok" });

  return ok({ notes });

}