tickets

23.0 KB

1. // lib/api.hl — THE FUNCTION ROUTES (project.hl `routes`): the JSON API for the scheduler, a CLI and connected apps,
2. // and the three page routes that are not components (/login/callback, /connect, /tickets/:ref). Thin wrappers:
3. // check the method, the token / key and the body (lib/api-helpers.hl), call the topic function, push what
4. // changed (the same frames the web faces push, so an open browser follows an API write live), answer.
5. // See README.md "API" for the shapes.
6. //
7. // Every POST body goes through readBody: invalid JSON, unknown field, missing/empty required field, non-string
8. // value → 400. WRITES NEED A TOKEN (ticket #7): no / bad / revoked token → 401, checked BEFORE the body. The
9. // author is the token's user; a body with `author` → 400 naming it. Reads stay public.
10. // THE MARKDOWN READ VIEW (ticket #6): `Accept: text/markdown` on the ticket GETs (the two lists,
11. // the two single-ticket forms) answers a compact Markdown document (mdview.hl); JSON otherwise, unchanged.
12. // TWO WAYS TO NAME A TICKET (ticket #38): `/api/tickets/:ref` — :ref is the OLD global
13. // number of a migrated ticket (docs say "#38") or the ticket's UUID (`id`) — and the
14. // per-project form `/api/projects/:slug/tickets/:number`. Both answer the same shapes.
15. import { Response } from 'hl:http1'
16. import { randomBytes } from 'hl:crypto'
17. import { reply, fail, queryOf, readBody, refuse, unauthorized, denied, apiUser, apiAuth, actorIn, stateFilter, filterLabel, wantsMarkdown, markdownReply, htmlPage, moved, missing } from './api-helpers.hl'
18. import { exchangeCode, ensureUser } from './users.hl'
19. import { projectNames, projectByAnySlug, projectByRef, projectRecords, projectRowOf, projectSlugOf, createProject, updateProject, memberRows, setMemberRole, userByRef, roles } from './projects.hl'
20. import { states } from './tickets-helpers.hl'
21. import { pageEventOf } from './events.hl'
22. import { ticketRows, ticketWithEvents, ticketByRef, ticketAt, createTicket, addComment, changeState, assignTicket, editTicket, setParent, changeBlocker, relatedViews, removeMember, inboxRows } from './tickets.hl'
23. import { mayInvite, createInvite, joinByInvite } from './invites.hl'
24. import { createRequest, exchangeConnectCode, connectionRows, disconnect } from './connections.hl'
25. import { listDocument, ticketDocument } from './mdview.hl'
26. import { ticketHref, projectHrefOf } from './util.hl'
28. // ---- tickets ------------------------------------------------------------------------------------
29. static byRef = (route) => { return ticketByRef(route.params.ref) }
30. static byNumber = (route) => { return ticketAt(route.params.slug, route.params.number) }
32. static listTickets = (route, req) => {
33. if (req.method != 'GET') { return fail(405, 'GET only') }
34. // hl:http1 hands the parsed query string as `req.query`; the path carries none
35. q = req.query != null ? req.query : queryOf(req.path)
36. sf = stateFilter(q)
37. if (sf.bad != null) { return sf.bad }
38. pr = q.project != null && q.project != '' ? q.project : null
39. rows = ticketRows(pr, sf.state)
40. if (wantsMarkdown(req)) { return markdownReply(listDocument(rows, filterLabel(pr, sf.state))) }
41. return { tickets = rows }
42. }
44. // POST /api/tickets { project, … } and POST /api/projects/:slug/tickets { … }
45. static createFromApi = (project, b, auth, req) => {
46. pr = projectByRef(project)
47. w = actorIn(auth, req, pr != null ? pr.id : null)
48. if (w.response != null) { return w.response }
49. user = w.user
50. r = createTicket(project, b.subject, b.summary, user, b.source, b.assignee)
51. if (r.forbidden == true) { return reply(403, { error = r.error field = r.field }) }
52. if (r.error != null) { return refuse({ error = r.error field = r.field }) }
53. if (!r.existed) { emit client ticketCreated(r.ticket) }
54. return reply(r.existed ? 200 : 201, { ticket = r.ticket existed = r.existed })
55. }
57. static postTicket = (route, req) => {
58. if (req.method == 'GET') { return listTickets(route, req) }
59. if (req.method != 'POST') { return fail(405, 'GET or POST') }
60. u = apiAuth(req)
61. if (u == null) { return unauthorized() }
62. rb = readBody(req, ['project' 'subject'], ['summary' 'source' 'assignee'])
63. if (rb.bad != null) { return refuse(rb.bad) }
64. return createFromApi(rb.body.project, rb.body, u, req)
65. }
67. static projectTickets = (route, req) => {
68. slug = route.params.slug
69. if (req.method == 'GET') {
70. if (projectByAnySlug(slug) == null) { return fail(404, 'no such project') }
71. q = req.query != null ? req.query : queryOf(req.path)
72. sf = stateFilter(q)
73. if (sf.bad != null) { return sf.bad }
74. rows = ticketRows(slug, sf.state)
75. if (wantsMarkdown(req)) { return markdownReply(listDocument(rows, filterLabel(slug, sf.state))) }
76. return { tickets = rows }
77. }
78. if (req.method != 'POST') { return fail(405, 'GET or POST') }
79. u = apiAuth(req)
80. if (u == null) { return unauthorized() }
81. rb = readBody(req, ['subject'], ['summary' 'source' 'assignee'])
82. if (rb.bad != null) { return refuse(rb.bad) }
83. return createFromApi(slug, rb.body, u, req)
84. }
86. static getOne = (t, req) => {
87. if (req.method != 'GET') { return fail(405, 'GET only') }
88. if (t == null) { return fail(404, 'no such ticket') }
89. data = ticketWithEvents(t)
90. if (wantsMarkdown(req)) { return markdownReply(ticketDocument(data)) }
91. return data
92. }
94. static commentOnTicket = (t, req) => {
95. if (req.method != 'POST') { return fail(405, 'POST only') }
96. auth = apiAuth(req)
97. if (auth == null) { return unauthorized() }
98. rb = readBody(req, ['text'], [])
99. if (rb.bad != null) { return refuse(rb.bad) }
100. if (t == null) { return fail(404, 'no such ticket') }
101. w = actorIn(auth, req, t.project)
102. if (w.response != null) { return w.response }
103. u = w.user
104. b = rb.body
105. r = addComment(t.id, u, b.text)
106. if (r.error == 'no such ticket') { return fail(404, r.error) }
107. if (r.forbidden == true) { return reply(403, { error = r.error field = r.field }) }
108. if (r.error != null) { return refuse({ error = r.error field = r.field }) }
109. emit client ticketEvent(r.ticket.id, pageEventOf(r.event), r.ticket)
110. return reply(201, r)
111. }
113. static stateOfTicket = (t, req) => {
114. if (req.method != 'POST') { return fail(405, 'POST only') }
115. auth = apiAuth(req)
116. if (auth == null) { return unauthorized() }
117. rb = readBody(req, ['state'], ['text'])
118. if (rb.bad != null) { return refuse(rb.bad) }
119. if (t == null) { return fail(404, 'no such ticket') }
120. w = actorIn(auth, req, t.project)
121. if (w.response != null) { return w.response }
122. u = w.user
123. b = rb.body
124. r = changeState(t.id, b.state, u, b.text)
125. if (r.error == 'no such ticket') { return fail(404, r.error) }
126. if (r.forbidden == true) { return reply(403, { error = r.error field = r.field }) }
127. if (r.error != null) { return refuse({ error = r.error field = r.field }) }
128. emit client ticketEvent(r.ticket.id, pageEventOf(r.event), r.ticket)
129. if (r.assignEvent != null) { emit client ticketEvent(r.ticket.id, pageEventOf(r.assignEvent), r.ticket) }
130. emit client ticketsRelated(relatedViews(r.ticket.id, []))
131. return reply(201, r)
132. }
134. // POST …/assign { assignee } (ticket #20): a member's display name (or users id, or ident id); '' = nobody.
135. // Needs the role edit or admin → else 403.
136. static assignOfTicket = (t, req) => {
137. if (req.method != 'POST') { return fail(405, 'POST only') }
138. u = apiUser(req)
139. if (u == null) { return unauthorized() }
140. rb = readBody(req, [], ['assignee'])
141. if (rb.bad != null) { return refuse(rb.bad) }
142. if (rb.body.assignee == null) { return refuse({ error = "field 'assignee' is required: a member's name, or an empty string for nobody" field = 'assignee' }) }
143. if (t == null) { return fail(404, 'no such ticket') }
144. let who = ''
145. if (rb.body.assignee.trim() != '') {
146. f = userByRef(rb.body.assignee, t.project)
147. if (f.error != null) { return refuse({ error = f.error field = 'assignee' }) }
148. who = f.user.id
149. }
150. r = assignTicket(t.id, u, who)
151. if (r.forbidden == true) { return reply(403, { error = r.error field = r.field }) }
152. if (r.error != null) { return refuse({ error = r.error field = r.field }) }
153. emit client ticketEvent(r.ticket.id, pageEventOf(r.event), r.ticket)
154. return reply(201, r)
155. }
157. // POST …/edit { subject?, summary? } (ticket #8): a member with the role edit or admin → else 403;
158. // the history keeps the previous values
159. static editOfTicket = (t, req) => {
160. if (req.method != 'POST') { return fail(405, 'POST only') }
161. u = apiUser(req)
162. if (u == null) { return unauthorized() }
163. rb = readBody(req, [], ['subject' 'summary'])
164. if (rb.bad != null) { return refuse(rb.bad) }
165. if (t == null) { return fail(404, 'no such ticket') }
166. b = rb.body
167. r = editTicket(t.id, u, b.subject, b.summary)
168. if (r.error == 'no such ticket') { return fail(404, r.error) }
169. if (r.forbidden == true) { return reply(403, { error = r.error }) }
170. if (r.error != null) { return refuse({ error = r.error field = r.field }) }
171. emit client ticketEvent(r.ticket.id, pageEventOf(r.event), r.ticket)
172. emit client ticketsRelated(relatedViews(r.ticket.id, []))
173. return reply(201, r)
174. }
176. // RELATIONS (ticket #4, mission 017; tickets.hl "relations"): a ticket is named as
177. // `<project>#<number>` or by its UUID. Who may: a member with the role edit or admin in either ticket's project → else 403.
178. // POST …/parent { parent }: set the parent; `"parent": ""` removes it.
179. // POST …/blocked-by { add } or { remove }: this ticket is (no longer) blocked by that one.
180. // 201 { ticket, event (kind link) }; the ticket rows and every open page of the tickets involved follow.
181. static linkReply = (r) => {
182. if (r.error == 'no such ticket') { return fail(404, r.error) }
183. if (r.forbidden == true) { return reply(403, { error = r.error }) }
184. if (r.error != null) { return refuse({ error = r.error field = r.field }) }
185. emit client ticketEvent(r.ticket.id, pageEventOf(r.event), r.ticket)
186. emit client ticketsRelated(r.related)
187. return reply(201, { ticket = r.ticket event = r.event })
188. }
190. static parentOfTicket = (t, req) => {
191. if (req.method != 'POST') { return fail(405, 'POST only') }
192. u = apiUser(req)
193. if (u == null) { return unauthorized() }
194. rb = readBody(req, [], ['parent'])
195. if (rb.bad != null) { return refuse(rb.bad) }
196. if (rb.body.parent == null) { return refuse({ error = "field 'parent' is required: <project>#<number>, or an empty string to remove the parent" field = 'parent' }) }
197. if (t == null) { return fail(404, 'no such ticket') }
198. return linkReply(setParent(t.id, u, rb.body.parent))
199. }
201. static blockersOfTicket = (t, req) => {
202. if (req.method != 'POST') { return fail(405, 'POST only') }
203. u = apiUser(req)
204. if (u == null) { return unauthorized() }
205. rb = readBody(req, [], ['add' 'remove'])
206. if (rb.bad != null) { return refuse(rb.bad) }
207. b = rb.body
208. if ((b.add == null) == (b.remove == null)) { return refuse({ error = "give exactly one of 'add' or 'remove' (<project>#<number>)" field = b.add == null ? 'add' : 'remove' }) }
209. if (t == null) { return fail(404, 'no such ticket') }
210. adding = b.add != null
211. return linkReply(changeBlocker(t.id, u, adding ? b.add : b.remove, adding, adding ? 'add' : 'remove'))
212. }
214. static getTicket = (route, req) => { return getOne(byRef(route), req) }
215. static postComment = (route, req) => { return commentOnTicket(byRef(route), req) }
216. static postState = (route, req) => { return stateOfTicket(byRef(route), req) }
217. static getProjectTicket = (route, req) => { return getOne(byNumber(route), req) }
218. static postProjectComment = (route, req) => { return commentOnTicket(byNumber(route), req) }
219. static postProjectState = (route, req) => { return stateOfTicket(byNumber(route), req) }
220. static postAssign = (route, req) => { return assignOfTicket(byRef(route), req) }
221. static postProjectAssign = (route, req) => { return assignOfTicket(byNumber(route), req) }
222. static postEdit = (route, req) => { return editOfTicket(byRef(route), req) }
223. static postProjectEdit = (route, req) => { return editOfTicket(byNumber(route), req) }
224. static postParent = (route, req) => { return parentOfTicket(byRef(route), req) }
225. static postProjectParent = (route, req) => { return parentOfTicket(byNumber(route), req) }
226. static postBlockers = (route, req) => { return blockersOfTicket(byRef(route), req) }
227. static postProjectBlockers = (route, req) => { return blockersOfTicket(byNumber(route), req) }
229. // ---- projects and members (ticket #20; projects.hl) ----------------------------------------------
230. // GET /api/projects → { projects (the slugs), details (title, slug, description, id …), states, roles }
231. // POST /api/projects { title, slug?, description? } → 201 { project, members } — any logged-in user opens
232. // a project and is its first admin; the slug is generated from the title unless given
233. // GET /api/projects/:slug → { project, members } (the slug may be an old one)
234. // POST /api/projects/:slug { title?, slug?, description? } → { project } — admin only; a new slug keeps the old one working
235. // POST /api/projects/:slug/members { user, role } — admin only: `user` = a display name, an ident id or a user id of someone
236. // who logged in here; sets (adds / changes) the role: use | edit | admin
237. // POST /api/projects/:slug/members/remove { user } — admin only
238. // POST /api/projects/:slug/invites { role, uses?, days?, email? } — admin only: an ident invite link → { url, id, expires, mailed }
239. // GET /api/inbox — the token's user: { pending, review }, the tickets assigned to them
240. static getProjects = (route, req) => {
241. if (req.method == 'POST') { return postNewProject(req) }
242. if (req.method != 'GET') { return fail(405, 'GET or POST') }
243. let details = []
244. for (p of projectRecords()) { details.push(projectRowOf(p)) }
245. return { projects = projectNames() details = details states = states roles = roles }
246. }
248. static postNewProject = (req) => {
249. u = apiUser(req)
250. if (u == null) { return unauthorized() }
251. rb = readBody(req, ['title'], ['slug' 'description'])
252. if (rb.bad != null) { return refuse(rb.bad) }
253. r = createProject(u, rb.body.title, rb.body.slug, rb.body.description)
254. if (r.error != null) { return denied(r) }
255. return reply(201, r)
256. }
258. static getProject = (route, req) => {
259. p = projectByAnySlug(route.params.slug)
260. if (req.method == 'GET') {
261. if (p == null) { return fail(404, 'no such project') }
262. return { project = projectRowOf(p) members = memberRows(p.id) }
263. }
264. if (req.method != 'POST') { return fail(405, 'GET or POST') }
265. u = apiUser(req)
266. if (u == null) { return unauthorized() }
267. rb = readBody(req, [], ['title' 'slug' 'description'])
268. if (rb.bad != null) { return refuse(rb.bad) }
269. if (p == null) { return fail(404, 'no such project') }
270. r = updateProject(p.id, u, rb.body.title, rb.body.slug, rb.body.description)
271. if (r.error != null) { return denied(r) }
272. return reply(200, r)
273. }
275. static postMembers = (route, req) => {
276. if (req.method != 'POST') { return fail(405, 'POST only') }
277. p = projectByAnySlug(route.params.slug)
278. u = apiUser(req)
279. if (u == null) { return unauthorized() }
280. rb = readBody(req, ['user' 'role'], [])
281. if (rb.bad != null) { return refuse(rb.bad) }
282. if (p == null) { return fail(404, 'no such project') }
283. f = userByRef(rb.body.user, null)
284. if (f.error != null) { return refuse({ error = f.error field = 'user' }) }
285. r = setMemberRole(p.id, u, f.user.id, rb.body.role)
286. if (r.error != null) { return denied(r) }
287. return reply(200, r)
288. }
290. static postMemberRemove = (route, req) => {
291. if (req.method != 'POST') { return fail(405, 'POST only') }
292. p = projectByAnySlug(route.params.slug)
293. u = apiUser(req)
294. if (u == null) { return unauthorized() }
295. rb = readBody(req, ['user'], [])
296. if (rb.bad != null) { return refuse(rb.bad) }
297. if (p == null) { return fail(404, 'no such project') }
298. f = userByRef(rb.body.user, p.id)
299. if (f.error != null) { return refuse({ error = f.error field = 'user' }) }
300. r = removeMember(p.id, u, f.user.id)
301. if (r.error != null) { return denied(r) }
302. return reply(200, r)
303. }
305. // an invite is only for an admin (invites.hl mayInvite); ident makes the link
306. static postInvites = (route, req) => {
307. if (req.method != 'POST') { return fail(405, 'POST only') }
308. p = projectByAnySlug(route.params.slug)
309. u = apiUser(req)
310. if (u == null) { return unauthorized() }
311. rb = readBody(req, ['role'], ['uses' 'days' 'email'])
312. if (rb.bad != null) { return refuse(rb.bad) }
313. if (p == null) { return fail(404, 'no such project') }
314. b = rb.body
315. no = mayInvite(p, u, b.role)
316. if (no != null) { return denied(no) }
317. n = b.uses == null ? 1 : toNumber(b.uses)
318. d = b.days == null ? 7 : toNumber(b.days)
319. if (n == null || n < 1 || n > 1000) { return denied({ error = "'uses' must be a number from 1 to 1000" field = 'uses' }) }
320. if (d == null || d < 1 || d > 90) { return denied({ error = "'days' must be a number from 1 to 90" field = 'days' }) }
321. r = createInvite(p.id, b.role, n, d, b.email)
322. if (r.error != null) { return denied(r) }
323. return reply(201, r)
324. }
326. static getInbox = (route, req) => {
327. if (req.method != 'GET') { return fail(405, 'GET only') }
328. u = apiUser(req)
329. if (u == null) { return unauthorized() }
330. return inboxRows(u)
331. }
333. // ---- connecting an app (ticket #21; connections.hl) ------------------------------------------------
334. // GET /connect?app=&label=&return=&state= — the app sends the person here; the request is stored and the browser goes to
335. // the page /connect/<nonce> (components/connect.hl), where they pick or make a project and confirm.
336. // POST /api/connect/exchange { code } — the app's SERVER swaps the one-time code for the project's key:
337. // 200 { key, project (slug), title, api }; 400 for an unknown, used or expired code. The key is shown here ONCE.
338. // GET /api/projects/:slug/connections — who is connected (public, like the project page)
339. // POST /api/projects/:slug/connections/remove { id } — an admin disconnects; the key is dead at once
340. static connectStart = (route, req) => {
341. if (req.method != 'GET') { return htmlPage(405, 'Connect', 'GET only') }
342. q = req.query != null ? req.query : {}
343. r = createRequest(q.app, q.label, q['return'], q.state)
344. if (r.error != null) { return htmlPage(400, 'Connect', r.error) }
345. to = '/connect/' + r.nonce
346. return new Response('continue at ' + to, { status = 302 headers = { 'Location' = to 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
347. }
349. static connectExchange = (route, req) => {
350. if (req.method != 'POST') { return fail(405, 'POST only') }
351. rb = readBody(req, ['code'], [])
352. if (rb.bad != null) { return refuse(rb.bad) }
353. r = exchangeConnectCode(rb.body.code)
354. if (r.error != null) { return refuse({ error = r.error field = 'code' }) }
355. emit client connectionsChanged(r.project)
356. return new Response(JSON.stringify(r), { status = 200 headers = { 'Content-Type' = 'application/json; charset=utf-8' 'Cache-Control' = 'no-store' } })
357. }
359. static projectConnections = (route, req) => {
360. if (req.method != 'GET') { return fail(405, 'GET only') }
361. p = projectByAnySlug(route.params.slug)
362. if (p == null) { return fail(404, 'no such project') }
363. return { connections = connectionRows(p.id) }
364. }
366. static projectDisconnect = (route, req) => {
367. if (req.method != 'POST') { return fail(405, 'POST only') }
368. p = projectByAnySlug(route.params.slug)
369. u = apiUser(req)
370. if (u == null) { return unauthorized() }
371. rb = readBody(req, ['id'], [])
372. if (rb.bad != null) { return refuse(rb.bad) }
373. if (p == null) { return fail(404, 'no such project') }
374. r = disconnect(p.id, u, rb.body.id)
375. if (r.error != null) { return denied(r) }
376. emit client connectionsChanged(p.slug)
377. return reply(200, r)
378. }
380. // ---- old page URLs -----------------------------------------------------------------------------
381. // They move for good (301) to the short page URLs of ticket #25, `/<slug>` and `/<slug>/<number>`, with the
382. // project's CURRENT slug; what names nothing → 404.
383. // `/tickets/<old global number>` (also `/tickets/<uuid>`)
384. static oldTicketPage = (route, req) => {
385. t = ticketByRef(route.params.ref)
386. if (t == null) { return missing('no such ticket') }
387. return moved(ticketHref(projectSlugOf(t), t.number))
388. }
389. // `/projects/<slug>` (ticket #25)
390. static oldProjectPage = (route, req) => {
391. p = projectByAnySlug(route.params.slug)
392. if (p == null) { return missing('no such project') }
393. return moved(projectHrefOf(p.slug))
394. }
395. // `/projects/<slug>/<number>` and `/projects/<slug>/tickets/<number>` (the form the conductor sent in messages)
396. static oldProjectTicketPage = (route, req) => {
397. t = ticketAt(route.params.slug, route.params.number)
398. if (t == null) { return missing('no such ticket') }
399. return moved(ticketHref(projectSlugOf(t), t.number))
400. }
402. // ---- THE LOGIN BUTTON'S RETURN (ticket #7; ident README "How apps use ident") -------------
403. // The shell's "Log in with ident" goes to <ident>/login?key=<IDENT_API_KEY>&return=
404. // <TICKETS_PUBLIC_URL>/login/callback; ident sends the browser back here with ?ident_code=.
405. // The code is exchanged SERVER SIDE (users.hl exchangeCode, key + secret) for the per-app
406. // identity id; its tickets user (made at the first login) goes into THIS browser's hl:web
407. // session (`req.session`, the cookie's — hybriel#11; minted from `sessions` when the browser brought none), then →
408. // the page the login started from (`?next=`, ticket #10, safeNext) or `/`, where the shell asks for a display name
409. // if there is none yet. project.hl hands `req` AND the framework's session store BY REFERENCE: copied into this
410. // second call, the session inside `req` would be a copy too and the login would never reach the session the
411. // framework keeps (mission 010: the gate's logins failed that way).
412. // (The identity selector logs in through the shell's face `identLogin` instead — no reload.)
413. static loginCallback = (route, &req, &sessions) => {
414. if (req.method != 'GET') { return htmlPage(405, 'Login failed', 'GET only') }
415. q = req.query != null ? req.query : {}
416. code = q.ident_code
417. if (code == null || code == '') { return htmlPage(400, 'Login failed', 'ident sent no login code') }
418. x = exchangeCode(code)
419. if (x.error != null) { return htmlPage(400, 'Login failed', x.error) }
420. u = ensureUser(x.identity)
421. if (u == null) { return htmlPage(500, 'Login failed', 'could not store the user') }
422. // an INVITE (ident#22, invites.hl): ident sends `invite=<id>` with the code
423. let joined = null
424. if (q.invite != null && q.invite != '') {
425. j = joinByInvite(q.invite, x.identity, u.id)
426. if (j.error != null) { return htmlPage(400, 'Invite failed', j.error) }
427. joined = j.project
428. }
429. let s = req.session
430. fresh = s == null
431. if (fresh) { s = sessions.mint() }
432. s.user = { id = u.id }
433. s.data.tag = randomBytes(16)
434. sessions.save(s)
435. to = joined != null ? projectHrefOf(joined.slug) : safeNext(q.next)
436. res = new Response('logged in', { status = 302 headers = { 'Location' = to 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
437. if (fresh) { res.headers['Set-Cookie'] = sessions.cookieHeader(s.id) }
438. return res
439. }
441. // BACK TO THE PAGE (ticket #10): login.js puts `?next=<path + query of the page>` into the
442. // button's return URL. Only a same-origin PATH goes: it starts with ONE `/` (not `//`, no
443. // backslash — `/\host` is another host to some browsers), only URL-safe characters (no
444. // scheme, no spaces, no control characters), at most 500 chars, never /login/… itself.
445. // Anything else → `/`.
446. static nextChars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~/?&=%+,;@!$()*:'
447. static safeNext = (want) => {
448. if (want == null || hlTypeName(want) != 'String' || want == '' || want.length > 500) { return '/' }
449. if (want.slice(0, 1) != '/' || want.slice(0, 2) == '//' || want.slice(0, 7) == '/login/') { return '/' }
450. let i = 0
451. while (i < want.length) {
452. if (!nextChars.includes(want[i])) { return '/' }
453. i = i + 1
454. }
455. return want
456. }