tickets

33.0 KB

1. // project.hl — tickets.worldapi.org: THE APP. Routes (pages + JSON API) and WHO HEARS WHAT.
2. import WebFramework from 'hl:web'
3. import { env } from 'hl:proc'
5. import Styles from './styles.hl'
6. import { dark, darker } from './shared/tokens.hl'
7. import { ticketRows, ticketWithEvents, projectNames, projectByAnySlug, projectByRef, projectRecords, projectRowOf, createProject, updateProject, memberRows, setMemberRole, removeMember, userByRef, isAdminOf, roleOf, createTicket, addComment, changeState, assignTicket, editTicket, pageEventOf, stateOf, states, roles, inboxRows, ticketByRef, ticketAt, ticketHref, setParent, changeBlocker, relatedViews, addMember, projectSlugOf } from './store.hl'
8. import { migrateAll } from './migrate.hl'
9. import { createInvite, acceptedInvite } from './invites.hl'
10. import { Response } from 'hl:http1'
11. import { reply, fail, queryOf, readBody, refuse, unauthorized } from './api.hl'
12. import { userOfBearer, exchangeCode, ensureUser, userRecord } from './users.hl'
13. import { createRequest, connectionOfKey, personOf, exchangeConnectCode, connectionRows, disconnect } from './connections.hl'
14. import { randomBytes } from 'hl:crypto'
15. import { wantsMarkdown, markdownReply, listDocument, ticketDocument } from './mdview.hl'
17. import TicketList from './components/ticket_list.hl'
18. import Ticket from './components/ticket.hl'
19. import Inbox from './components/inbox.hl'
20. import You from './components/you.hl'
21. import NewProject from './components/new_project.hl'
22. import Settings from './components/settings.hl'
23. import Connect from './components/connect.hl'
25. static siteName = "tickets"
27. appTitle = siteName
28. styles = Styles
30. // ---- THE INSTALLABLE APP (mission 046), the same way calendar.worldapi.org does it: hl:web's own web app manifest
31. // (/__hl/manifest.webmanifest, linked from every head with the apple-touch-icon and theme-color) and service worker
32. // (/__hl/sw.js) from these settings — no JavaScript of ours. Icons in icons/ (icon.svg, a ticket stub, is the source;
33. // the PNGs and favicon.ico are rendered from it with rsvg-convert / magick, README "PWA"). The theme colour is the
34. // header's background (darker, as tracker), the splash background the page's (dark) — both off the tokens, not written out again.
35. appThemeColor = darker.value
36. appBackgroundColor = dark.value
37. appIcons = [
38. { src = '/icons/icon-192.png' sizes = '192x192' purpose = 'any' }
39. { src = '/icons/icon-512.png' sizes = '512x512' purpose = 'any' }
40. { src = '/icons/icon-192.png' sizes = '192x192' purpose = 'maskable' }
41. { src = '/icons/icon-512.png' sizes = '512x512' purpose = 'maskable' }
42. ]
43. appTouchIcon = '/icons/apple-touch-icon.png'
44. appFavicon = '/icons/icon.svg'
45. // OFFLINE: the shell and `/` — `/` IS the ticket list, so offline it shows the list as this browser last loaded it,
46. // and the shell (components/main.hl) says "You are offline". Its value-form emits are never queued. Other pages are
47. // not kept, except a project list (/projects/<slug>, same component) this browser visited; the rest get hl:web's
48. // "Unavailable offline" page.
49. offline = [ TicketList ]
51. // ---- the JSON API (for the scheduler and a CLI) ----------------------------------------
52. // Every write pushes the same frames the web faces push, so an open browser follows an
53. // API write live. See README.md "API" for the shapes. Every POST body goes through
54. // readBody (api.hl): invalid JSON, unknown field, missing/empty required field, non-string
55. // value → 400.
56. // WRITES NEED A TOKEN (ticket #7): `Authorization: Bearer <token>` (users.hl; a logged-in user
57. // makes tokens on /you). No / bad / revoked token → 401, checked BEFORE the body. The author is
58. // the token's user; a body with `author` → 400 naming it. Reads stay public.
59. //
60. // THE MARKDOWN READ VIEW (ticket #6): `Accept: text/markdown` on the ticket GETs (the two lists,
61. // the two single-ticket forms) answers a compact Markdown document (mdview.hl); JSON otherwise,
62. // unchanged.
63. // EDITING (ticket #8): POST …/edit { subject?, summary? } — a member with the role edit or admin
64. // of the ticket's project → else 403; the history keeps the previous values.
65. //
66. // TWO WAYS TO NAME A TICKET (ticket #38): `/api/tickets/:ref` — :ref is the OLD global
67. // number of a migrated ticket (docs say "#38") or the ticket's UUID (`id`) — and the
68. // per-project form `/api/projects/:slug/tickets/:number`. Both answer the same shapes.
69. byRef = (route) => { return ticketByRef(route.params.ref) }
70. byNumber = (route) => { return ticketAt(route.params.slug, route.params.number) }
72. stateFilter = (q) => {
73. if (q.state == null || q.state == '') { return { state = null } }
74. let st = stateOf(q.state)
75. if (st == null) { return { bad = fail(400, 'unknown state — one of: ' + states.join(', ')) } }
76. return { state = st }
77. }
79. listTickets = (route, req) => {
80. if (req.method != 'GET') { return fail(405, 'GET only') }
81. // hl:http1 hands the parsed query string as `req.query`; the path carries none
82. let q = req.query != null ? req.query : queryOf(req.path)
83. let sf = stateFilter(q)
84. if (sf.bad != null) { return sf.bad }
85. let pr = q.project != null && q.project != '' ? q.project : null
86. let rows = ticketRows(pr, sf.state)
87. if (wantsMarkdown(req)) { return markdownReply(listDocument(rows, filterLabel(pr, sf.state))) }
88. return { tickets = rows }
89. }
91. // the filters of a list, for the Markdown heading ('' = none)
92. filterLabel = (project, state) => {
93. let parts = []
94. if (project != null) { parts.push('project ' + project) }
95. if (state != null) { parts.push('state ' + state) }
96. return parts.join(', ')
97. }
99. // the token's user of an API write, or null (→ 401)
100. apiUser = (req) => { return userOfBearer(req.headers['authorization']) }
102. // WHO WRITES, for the endpoints an app's KEY may also use (ticket #21: create a ticket, comment, change the state):
103. // { user } for a user's token, { conn } for a project key (connections.hl), null = 401 (checked before the body)
104. apiAuth = (req) => {
105. let h = req.headers['authorization']
106. let u = userOfBearer(h)
107. if (u != null) { return { user = u } }
108. let c = connectionOfKey(h)
109. return c != null ? { conn = c } : null
110. }
112. // the acting user inside project `projectId`: { user } or { response }. A key reaches ITS project only and names the
113. // person by `X-Tickets-Identity`; the project's roles then decide as for any user.
114. actorIn = (auth, req, projectId) => {
115. if (auth.user != null) { return { user = auth.user } }
116. if (projectId == null || auth.conn.project != projectId) { return { response = reply(403, { error = 'this key belongs to another project' field = '' }) } }
117. let a = personOf(req.headers['x-tickets-identity'])
118. if (a.error != null) { return { response = reply(403, { error = a.error field = '' }) } }
119. return { user = a.user }
120. }
122. // POST /api/tickets { project, … } and POST /api/projects/:slug/tickets { … }
123. createFromApi = (project, b, auth, req) => {
124. let pr = projectByRef(project)
125. let w = actorIn(auth, req, pr != null ? pr.id : null)
126. if (w.response != null) { return w.response }
127. let user = w.user
128. let r = createTicket(project, b.subject, b.summary, user, b.source, b.assignee)
129. if (r.forbidden == true) { return reply(403, { error = r.error field = r.field }) }
130. if (r.error != null) { return refuse({ error = r.error field = r.field }) }
131. if (!r.existed) { emit client ticketCreated(r.ticket) }
132. return reply(r.existed ? 200 : 201, { ticket = r.ticket existed = r.existed })
133. }
135. postTicket = (route, req) => {
136. if (req.method == 'GET') { return listTickets(route, req) }
137. if (req.method != 'POST') { return fail(405, 'GET or POST') }
138. let u = apiAuth(req)
139. if (u == null) { return unauthorized() }
140. let rb = readBody(req, ['project' 'subject'], ['summary' 'source' 'assignee'])
141. if (rb.bad != null) { return refuse(rb.bad) }
142. return createFromApi(rb.body.project, rb.body, u, req)
143. }
145. projectTickets = (route, req) => {
146. let slug = route.params.slug
147. if (req.method == 'GET') {
148. if (projectByAnySlug(slug) == null) { return fail(404, 'no such project') }
149. let q = req.query != null ? req.query : queryOf(req.path)
150. let sf = stateFilter(q)
151. if (sf.bad != null) { return sf.bad }
152. let rows = ticketRows(slug, sf.state)
153. if (wantsMarkdown(req)) { return markdownReply(listDocument(rows, filterLabel(slug, sf.state))) }
154. return { tickets = rows }
155. }
156. if (req.method != 'POST') { return fail(405, 'GET or POST') }
157. let u = apiAuth(req)
158. if (u == null) { return unauthorized() }
159. let rb = readBody(req, ['subject'], ['summary' 'source' 'assignee'])
160. if (rb.bad != null) { return refuse(rb.bad) }
161. return createFromApi(slug, rb.body, u, req)
162. }
164. getOne = (t, req) => {
165. if (req.method != 'GET') { return fail(405, 'GET only') }
166. if (t == null) { return fail(404, 'no such ticket') }
167. let data = ticketWithEvents(t)
168. if (wantsMarkdown(req)) { return markdownReply(ticketDocument(data)) }
169. return data
170. }
172. commentOnTicket = (t, req) => {
173. if (req.method != 'POST') { return fail(405, 'POST only') }
174. let auth = apiAuth(req)
175. if (auth == null) { return unauthorized() }
176. let rb = readBody(req, ['text'], [])
177. if (rb.bad != null) { return refuse(rb.bad) }
178. if (t == null) { return fail(404, 'no such ticket') }
179. let w = actorIn(auth, req, t.project)
180. if (w.response != null) { return w.response }
181. let u = w.user
182. let b = rb.body
183. let r = addComment(t.id, u, b.text)
184. if (r.error == 'no such ticket') { return fail(404, r.error) }
185. if (r.forbidden == true) { return reply(403, { error = r.error field = r.field }) }
186. if (r.error != null) { return refuse({ error = r.error field = r.field }) }
187. emit client ticketEvent(r.ticket.id, pageEventOf(r.event), r.ticket)
188. return reply(201, r)
189. }
191. stateOfTicket = (t, req) => {
192. if (req.method != 'POST') { return fail(405, 'POST only') }
193. let auth = apiAuth(req)
194. if (auth == null) { return unauthorized() }
195. let rb = readBody(req, ['state'], ['text'])
196. if (rb.bad != null) { return refuse(rb.bad) }
197. if (t == null) { return fail(404, 'no such ticket') }
198. let w = actorIn(auth, req, t.project)
199. if (w.response != null) { return w.response }
200. let u = w.user
201. let b = rb.body
202. let r = changeState(t.id, b.state, u, b.text)
203. if (r.error == 'no such ticket') { return fail(404, r.error) }
204. if (r.forbidden == true) { return reply(403, { error = r.error field = r.field }) }
205. if (r.error != null) { return refuse({ error = r.error field = r.field }) }
206. emit client ticketEvent(r.ticket.id, pageEventOf(r.event), r.ticket)
207. if (r.assignEvent != null) { emit client ticketEvent(r.ticket.id, pageEventOf(r.assignEvent), r.ticket) }
208. emit client ticketsRelated(relatedViews(r.ticket.id, []))
209. return reply(201, r)
210. }
212. // POST …/assign { assignee } (ticket #20): a member's display name (or users id, or ident id); '' = nobody.
213. // Needs the role edit or admin → else 403.
214. assignOfTicket = (t, req) => {
215. if (req.method != 'POST') { return fail(405, 'POST only') }
216. let u = apiUser(req)
217. if (u == null) { return unauthorized() }
218. let rb = readBody(req, [], ['assignee'])
219. if (rb.bad != null) { return refuse(rb.bad) }
220. if (rb.body.assignee == null) { return refuse({ error = "field 'assignee' is required: a member's name, or an empty string for nobody" field = 'assignee' }) }
221. if (t == null) { return fail(404, 'no such ticket') }
222. let who = ''
223. if (rb.body.assignee.trim() != '') {
224. let f = userByRef(rb.body.assignee, t.project)
225. if (f.error != null) { return refuse({ error = f.error field = 'assignee' }) }
226. who = f.user.id
227. }
228. let r = assignTicket(t.id, u, who)
229. if (r.forbidden == true) { return reply(403, { error = r.error field = r.field }) }
230. if (r.error != null) { return refuse({ error = r.error field = r.field }) }
231. emit client ticketEvent(r.ticket.id, pageEventOf(r.event), r.ticket)
232. return reply(201, r)
233. }
235. // POST …/edit { subject?, summary? } (ticket #8): the token's user must be the ticket's author
236. editOfTicket = (t, req) => {
237. if (req.method != 'POST') { return fail(405, 'POST only') }
238. let u = apiUser(req)
239. if (u == null) { return unauthorized() }
240. let rb = readBody(req, [], ['subject' 'summary'])
241. if (rb.bad != null) { return refuse(rb.bad) }
242. if (t == null) { return fail(404, 'no such ticket') }
243. let b = rb.body
244. let r = editTicket(t.id, u, b.subject, b.summary)
245. if (r.error == 'no such ticket') { return fail(404, r.error) }
246. if (r.forbidden == true) { return reply(403, { error = r.error }) }
247. if (r.error != null) { return refuse({ error = r.error field = r.field }) }
248. emit client ticketEvent(r.ticket.id, pageEventOf(r.event), r.ticket)
249. emit client ticketsRelated(relatedViews(r.ticket.id, []))
250. return reply(201, r)
251. }
253. // RELATIONS (ticket #4, mission 017; store.hl "relations"): a ticket is named as
254. // `<project>#<number>` or by its UUID. Who may: a member with the role edit or admin in either ticket's project → else 403.
255. // POST …/parent { parent }: set the parent; `"parent": ""` removes it.
256. // POST …/blocked-by { add } or { remove }: this ticket is (no longer) blocked by that one.
257. // 201 { ticket, event (kind link) }; the ticket rows and every open page of the tickets involved follow.
258. linkReply = (r) => {
259. if (r.error == 'no such ticket') { return fail(404, r.error) }
260. if (r.forbidden == true) { return reply(403, { error = r.error }) }
261. if (r.error != null) { return refuse({ error = r.error field = r.field }) }
262. emit client ticketEvent(r.ticket.id, pageEventOf(r.event), r.ticket)
263. emit client ticketsRelated(r.related)
264. return reply(201, { ticket = r.ticket event = r.event })
265. }
267. parentOfTicket = (t, req) => {
268. if (req.method != 'POST') { return fail(405, 'POST only') }
269. let u = apiUser(req)
270. if (u == null) { return unauthorized() }
271. let rb = readBody(req, [], ['parent'])
272. if (rb.bad != null) { return refuse(rb.bad) }
273. if (rb.body.parent == null) { return refuse({ error = "field 'parent' is required: <project>#<number>, or an empty string to remove the parent" field = 'parent' }) }
274. if (t == null) { return fail(404, 'no such ticket') }
275. return linkReply(setParent(t.id, u, rb.body.parent))
276. }
278. blockersOfTicket = (t, req) => {
279. if (req.method != 'POST') { return fail(405, 'POST only') }
280. let u = apiUser(req)
281. if (u == null) { return unauthorized() }
282. let rb = readBody(req, [], ['add' 'remove'])
283. if (rb.bad != null) { return refuse(rb.bad) }
284. let b = rb.body
285. if ((b.add == null) == (b.remove == null)) { return refuse({ error = "give exactly one of 'add' or 'remove' (<project>#<number>)" field = b.add == null ? 'add' : 'remove' }) }
286. if (t == null) { return fail(404, 'no such ticket') }
287. let adding = b.add != null
288. return linkReply(changeBlocker(t.id, u, adding ? b.add : b.remove, adding, adding ? 'add' : 'remove'))
289. }
291. getTicket = (route, req) => { return getOne(byRef(route), req) }
292. postComment = (route, req) => { return commentOnTicket(byRef(route), req) }
293. postState = (route, req) => { return stateOfTicket(byRef(route), req) }
294. getProjectTicket = (route, req) => { return getOne(byNumber(route), req) }
295. postProjectComment = (route, req) => { return commentOnTicket(byNumber(route), req) }
296. postProjectState = (route, req) => { return stateOfTicket(byNumber(route), req) }
297. postAssign = (route, req) => { return assignOfTicket(byRef(route), req) }
298. postProjectAssign = (route, req) => { return assignOfTicket(byNumber(route), req) }
299. postEdit = (route, req) => { return editOfTicket(byRef(route), req) }
300. postProjectEdit = (route, req) => { return editOfTicket(byNumber(route), req) }
301. postParent = (route, req) => { return parentOfTicket(byRef(route), req) }
302. postProjectParent = (route, req) => { return parentOfTicket(byNumber(route), req) }
303. postBlockers = (route, req) => { return blockersOfTicket(byRef(route), req) }
304. postProjectBlockers = (route, req) => { return blockersOfTicket(byNumber(route), req) }
306. // ---- PROJECTS AND MEMBERS (ticket #20; store.hl) ---------------------------------------------------
307. // GET /api/projects → { projects (the slugs), details (title, slug, description, id …), states, roles }
308. // POST /api/projects { title, slug?, description? } → 201 { project, members } — any logged-in user opens
309. // a project and is its first admin; the slug is generated from the title unless given
310. // GET /api/projects/:slug → { project, members } (the slug may be an old one)
311. // POST /api/projects/:slug { title?, slug?, description? } → { project } — admin only; a new slug keeps the old one working
312. // POST /api/projects/:slug/members { user, role } — admin only: `user` = a display name, an ident id or a user id of someone
313. // who logged in here; sets (adds / changes) the role: use | edit | admin
314. // POST /api/projects/:slug/members/remove { user } — admin only
315. // POST /api/projects/:slug/invites { role, uses?, days?, email? } — admin only: an ident invite link → { url, id, expires, mailed }
316. // GET /api/inbox — the token's user: { pending, review }, the tickets assigned to them
317. getProjects = (route, req) => {
318. if (req.method == 'POST') { return postNewProject(req) }
319. if (req.method != 'GET') { return fail(405, 'GET or POST') }
320. let details = []
321. for (p of projectRecords()) { details.push(projectRowOf(p)) }
322. return { projects = projectNames() details = details states = states roles = roles }
323. }
325. // a refusal of the store: 403 when the role is missing, else 400
326. denied = (r) => {
327. if (r.forbidden == true) { return reply(403, { error = r.error field = r.field }) }
328. return refuse({ error = r.error field = r.field })
329. }
331. postNewProject = (req) => {
332. let u = apiUser(req)
333. if (u == null) { return unauthorized() }
334. let rb = readBody(req, ['title'], ['slug' 'description'])
335. if (rb.bad != null) { return refuse(rb.bad) }
336. let r = createProject(u, rb.body.title, rb.body.slug, rb.body.description)
337. if (r.error != null) { return denied(r) }
338. return reply(201, r)
339. }
341. getProject = (route, req) => {
342. let p = projectByAnySlug(route.params.slug)
343. if (req.method == 'GET') {
344. if (p == null) { return fail(404, 'no such project') }
345. return { project = projectRowOf(p) members = memberRows(p.id) }
346. }
347. if (req.method != 'POST') { return fail(405, 'GET or POST') }
348. let u = apiUser(req)
349. if (u == null) { return unauthorized() }
350. let rb = readBody(req, [], ['title' 'slug' 'description'])
351. if (rb.bad != null) { return refuse(rb.bad) }
352. if (p == null) { return fail(404, 'no such project') }
353. let r = updateProject(p.id, u, rb.body.title, rb.body.slug, rb.body.description)
354. if (r.error != null) { return denied(r) }
355. return reply(200, r)
356. }
358. postMembers = (route, req) => {
359. if (req.method != 'POST') { return fail(405, 'POST only') }
360. let p = projectByAnySlug(route.params.slug)
361. let u = apiUser(req)
362. if (u == null) { return unauthorized() }
363. let rb = readBody(req, ['user' 'role'], [])
364. if (rb.bad != null) { return refuse(rb.bad) }
365. if (p == null) { return fail(404, 'no such project') }
366. let f = userByRef(rb.body.user, null)
367. if (f.error != null) { return refuse({ error = f.error field = 'user' }) }
368. let r = setMemberRole(p.id, u, f.user.id, rb.body.role)
369. if (r.error != null) { return denied(r) }
370. return reply(200, r)
371. }
373. postMemberRemove = (route, req) => {
374. if (req.method != 'POST') { return fail(405, 'POST only') }
375. let p = projectByAnySlug(route.params.slug)
376. let u = apiUser(req)
377. if (u == null) { return unauthorized() }
378. let rb = readBody(req, ['user'], [])
379. if (rb.bad != null) { return refuse(rb.bad) }
380. if (p == null) { return fail(404, 'no such project') }
381. let f = userByRef(rb.body.user, p.id)
382. if (f.error != null) { return refuse({ error = f.error field = 'user' }) }
383. let r = removeMember(p.id, u, f.user.id)
384. if (r.error != null) { return denied(r) }
385. return reply(200, r)
386. }
388. // an invite is only for an admin; ident makes the link (invites.hl)
389. makeInvite = (p, u, role, uses, days, email) => {
390. if (!isAdminOf(p.id, u)) { return { error = 'only an admin of the project can invite' field = '' forbidden = true } }
391. if (!roles.includes(role)) { return { error = 'role must be one of: ' + roles.join(', ') field = 'role' } }
392. let n = uses == null ? 1 : toNumber(uses)
393. let d = days == null ? 7 : toNumber(days)
394. if (n == null || n < 1 || n > 1000) { return { error = "'uses' must be a number from 1 to 1000" field = 'uses' } }
395. if (d == null || d < 1 || d > 90) { return { error = "'days' must be a number from 1 to 90" field = 'days' } }
396. return createInvite(p.id, role, n, d, email)
397. }
398. postInvites = (route, req) => {
399. if (req.method != 'POST') { return fail(405, 'POST only') }
400. let p = projectByAnySlug(route.params.slug)
401. let u = apiUser(req)
402. if (u == null) { return unauthorized() }
403. let rb = readBody(req, ['role'], ['uses' 'days' 'email'])
404. if (rb.bad != null) { return refuse(rb.bad) }
405. if (p == null) { return fail(404, 'no such project') }
406. let b = rb.body
407. let r = makeInvite(p, u, b.role, b.uses, b.days, b.email)
408. if (r.error != null) { return denied(r) }
409. return reply(201, r)
410. }
412. getInbox = (route, req) => {
413. if (req.method != 'GET') { return fail(405, 'GET only') }
414. let u = apiUser(req)
415. if (u == null) { return unauthorized() }
416. return inboxRows(u)
417. }
419. // ---- CONNECTING AN APP (ticket #21; connections.hl) --------------------------------------------------
420. // GET /connect?app=&label=&return=&state= — the app sends the person here; the request is stored and the browser goes to
421. // the page /connect/<nonce> (components/connect.hl), where they pick or make a project and confirm.
422. // POST /api/connect/exchange { code } — the app's SERVER swaps the one-time code for the project's key:
423. // 200 { key, project (slug), title, api }; 400 for an unknown, used or expired code. The key is shown here ONCE.
424. // GET /api/projects/:slug/connections — who is connected (public, like the project page)
425. // POST /api/projects/:slug/connections/remove { id } — an admin disconnects; the key is dead at once
426. connectStart = (route, req) => {
427. if (req.method != 'GET') { return htmlPage(405, 'Connect', 'GET only') }
428. let q = req.query != null ? req.query : {}
429. let r = createRequest(q.app, q.label, q['return'], q.state)
430. if (r.error != null) { return htmlPage(400, 'Connect', r.error) }
431. let to = '/connect/' + r.nonce
432. return new Response('continue at ' + to, { status = 302 headers = { 'Location' = to 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
433. }
435. connectExchange = (route, req) => {
436. if (req.method != 'POST') { return fail(405, 'POST only') }
437. let rb = readBody(req, ['code'], [])
438. if (rb.bad != null) { return refuse(rb.bad) }
439. let r = exchangeConnectCode(rb.body.code)
440. if (r.error != null) { return refuse({ error = r.error field = 'code' }) }
441. emit client connectionsChanged(r.project)
442. return new Response(JSON.stringify(r), { status = 200 headers = { 'Content-Type' = 'application/json; charset=utf-8' 'Cache-Control' = 'no-store' } })
443. }
445. projectConnections = (route, req) => {
446. if (req.method != 'GET') { return fail(405, 'GET only') }
447. let p = projectByAnySlug(route.params.slug)
448. if (p == null) { return fail(404, 'no such project') }
449. return { connections = connectionRows(p.id) }
450. }
452. projectDisconnect = (route, req) => {
453. if (req.method != 'POST') { return fail(405, 'POST only') }
454. let p = projectByAnySlug(route.params.slug)
455. let u = apiUser(req)
456. if (u == null) { return unauthorized() }
457. let rb = readBody(req, ['id'], [])
458. if (rb.bad != null) { return refuse(rb.bad) }
459. if (p == null) { return fail(404, 'no such project') }
460. let r = disconnect(p.id, u, rb.body.id)
461. if (r.error != null) { return denied(r) }
462. emit client connectionsChanged(p.slug)
463. return reply(200, r)
464. }
466. // OLD PAGE URLS (`/tickets/<old global number>`, also `/tickets/<uuid>`) move for good
467. // to `/projects/<slug>/<number>`
468. oldTicketPage = (route, req) => {
469. let t = ticketByRef(route.params.ref)
470. if (t == null) { return new Response('no such ticket', { status = 404 headers = { 'Content-Type' = 'text/plain; charset=utf-8' } }) }
471. let to = ticketHref(projectSlugOf(t), t.number)
472. return new Response('moved to ' + to, { status = 301 headers = { 'Location' = to 'Content-Type' = 'text/plain; charset=utf-8' } })
473. }
475. // ---- THE LOGIN BUTTON'S RETURN (ticket #7; ident README "How apps use ident") -------------
476. // The shell's "Log in with ident" goes to <ident>/login?key=<IDENT_API_KEY>&return=
477. // <TICKETS_PUBLIC_URL>/login/callback; ident sends the browser back here with ?ident_code=.
478. // The code is exchanged SERVER SIDE (users.hl exchangeCode, key + secret) for the per-app
479. // identity id; its tickets user (made at the first login) goes into THIS browser's hl:web
480. // session (`req.session`, the cookie's — hybriel#11; minted here when the browser brought none), then → the
481. // page the login started from (`?next=`, ticket #10, safeNext) or `/`, where the shell asks
482. // for a display name if there is none yet.
483. // (The identity selector logs in through the shell's face `identLogin` instead — no reload.)
484. htmlPage = (status, title, text) => {
485. let body = '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>tickets | ' + title + '</title><style>body{margin:0;padding:1.5rem 1rem;font:16px/1.5 system-ui,sans-serif;color:rgb(195, 200, 205);background:rgb(25, 30, 35)}main{max-width:34rem;margin:0 auto;display:grid;gap:1rem}h1{margin:0;font-size:1.3rem;color:rgb(245, 250, 255)}p{margin:0}a{color:#c586c0}.error{color:#f44747}</style></head><body><main><h1>' + title + '</h1><p id="error" class="error">' + text.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;') + '</p><p><a id="home" href="/">back to the tickets</a></p></main></body></html>'
486. return new Response(body, { status = status headers = { 'Content-Type' = 'text/html; charset=utf-8' 'Cache-Control' = 'no-store' } })
487. }
489. // BACK TO THE PAGE (ticket #10): login.js puts `?next=<path + query of the page>` into the
490. // button's return URL. Only a same-origin PATH goes: it starts with ONE `/` (not `//`, no
491. // backslash — `/\host` is another host to some browsers), only URL-safe characters (no
492. // scheme, no spaces, no control characters), at most 500 chars, never /login/… itself.
493. // Anything else → `/`.
494. nextChars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~/?&=%+,;@!$()*:'
495. safeNext = (want) => {
496. if (want == null || hlTypeName(want) != 'String' || want == '' || want.length > 500) { return '/' }
497. if (want.slice(0, 1) != '/' || want.slice(0, 2) == '//' || want.slice(0, 7) == '/login/') { return '/' }
498. let i = 0
499. while (i < want.length) {
500. if (!nextChars.includes(want[i])) { return '/' }
501. i = i + 1
502. }
503. return want
504. }
506. loginCallback = (route, req) => {
507. if (req.method != 'GET') { return htmlPage(405, 'Login failed', 'GET only') }
508. let q = req.query != null ? req.query : {}
509. let code = q.ident_code
510. if (code == null || code == '') { return htmlPage(400, 'Login failed', 'ident sent no login code') }
511. let x = exchangeCode(code)
512. if (x.error != null) { return htmlPage(400, 'Login failed', x.error) }
513. let u = ensureUser(x.identity)
514. if (u == null) { return htmlPage(500, 'Login failed', 'could not store the user') }
515. // an INVITE (ident#22, invites.hl): ident sends `invite=<id>` with the code; only when ident says this
516. // identity accepted it does the person join the project, with the invite's role
517. let joined = null
518. if (q.invite != null && q.invite != '') {
519. let a = acceptedInvite(q.invite, x.identity)
520. if (a.error != null) { return htmlPage(400, 'Invite failed', a.error) }
521. let jp = projectByRef(a.project)
522. if (jp == null || !roles.includes(a.role)) { return htmlPage(400, 'Invite failed', 'the invite is for a project or role that does not exist here') }
523. addMember(jp.id, u.id, a.role)
524. joined = jp
525. }
526. let s = req.session
527. let fresh = s == null
528. if (fresh) { s = server.sessions.mint() }
529. s.user = { id = u.id }
530. s.data.tag = randomBytes(16)
531. server.sessions.save(s)
532. let to = joined != null ? '/projects/' + joined.slug : safeNext(q.next)
533. let res = new Response('logged in', { status = 302 headers = { 'Location' = to 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
534. if (fresh) { res.headers['Set-Cookie'] = server.sessions.cookieHeader(s.id) }
535. return res
536. }
538. routes = [
539. { pattern = "/favicon.ico" file = "./icons/favicon.ico" headers = { 'Cache-Control' = 'no-cache' } }
540. // the installable app (mission 046): the icons (manifest and service worker are hl:web's own, from appIcons / offline)
541. { pattern = "/icons/icon-192.png" file = "./icons/icon-192.png" headers = { 'Cache-Control' = 'no-cache' } }
542. { pattern = "/icons/icon-512.png" file = "./icons/icon-512.png" headers = { 'Cache-Control' = 'no-cache' } }
543. { pattern = "/icons/apple-touch-icon.png" file = "./icons/apple-touch-icon.png" headers = { 'Cache-Control' = 'no-cache' } }
544. { pattern = "/icons/icon.svg" file = "./icons/icon.svg" headers = { 'Cache-Control' = 'no-cache' } }
545. { pattern = "/login/callback" function = loginCallback }
546. { pattern = "/login.js" file = "./login.js" headers = { 'Cache-Control' = 'no-cache' } }
547. // ticket #12 (mission 024): the Markdown editor <md-editor>, vendored from worldapi-components
548. { pattern = "/md-editor.js" file = "./shared/md-editor.js" headers = { 'Cache-Control' = 'no-cache' } }
549. { pattern = "/api/tickets" function = postTicket }
550. { pattern = "/api/tickets/:ref" function = getTicket }
551. { pattern = "/api/tickets/:ref/comments" function = postComment }
552. { pattern = "/api/tickets/:ref/state" function = postState }
553. { pattern = "/api/tickets/:ref/edit" function = postEdit }
554. { pattern = "/api/tickets/:ref/assign" function = postAssign }
555. { pattern = "/api/tickets/:ref/parent" function = postParent }
556. { pattern = "/api/tickets/:ref/blocked-by" function = postBlockers }
557. { pattern = "/api/projects" function = getProjects }
558. { pattern = "/api/inbox" function = getInbox }
559. { pattern = "/api/projects/:slug" function = getProject }
560. { pattern = "/api/projects/:slug/members" function = postMembers }
561. { pattern = "/api/projects/:slug/members/remove" function = postMemberRemove }
562. { pattern = "/api/projects/:slug/invites" function = postInvites }
563. { pattern = "/api/connect/exchange" function = connectExchange }
564. { pattern = "/api/projects/:slug/connections" function = projectConnections }
565. { pattern = "/api/projects/:slug/connections/remove" function = projectDisconnect }
566. { pattern = "/connect" function = connectStart }
567. { pattern = "/api/projects/:slug/tickets" function = projectTickets }
568. { pattern = "/api/projects/:slug/tickets/:number" function = getProjectTicket }
569. { pattern = "/api/projects/:slug/tickets/:number/comments" function = postProjectComment }
570. { pattern = "/api/projects/:slug/tickets/:number/state" function = postProjectState }
571. { pattern = "/api/projects/:slug/tickets/:number/edit" function = postProjectEdit }
572. { pattern = "/api/projects/:slug/tickets/:number/assign" function = postProjectAssign }
573. { pattern = "/api/projects/:slug/tickets/:number/parent" function = postProjectParent }
574. { pattern = "/api/projects/:slug/tickets/:number/blocked-by" function = postProjectBlockers }
575. { pattern = "/" component = TicketList }
576. { pattern = "/project/:projectName" component = TicketList }
577. { pattern = "/projects/:projectName" component = TicketList }
578. { pattern = "/state/:stateSlug" component = TicketList }
579. { pattern = "/project/:projectName/state/:stateSlug" component = TicketList }
580. { pattern = "/inbox" component = Inbox }
581. { pattern = "/new-project" component = NewProject }
582. { pattern = "/connect/:nonce" component = Connect }
583. { pattern = "/projects/:projectSlug/settings" component = Settings }
584. { pattern = "/you" component = You }
585. { pattern = "/projects/:projectSlug/:ticketNumber" component = Ticket }
586. { pattern = "/tickets/:ref" function = oldTicketPage }
587. ]
589. // WHO GETS THE PUSH: tickets and events are public (reading needs no login). A frame
590. // reaches a connection only if a mounted component listens for it.
591. // `signedIn` / `signedOut` (ticket #7) go to the tabs of ONE session: the one whose login
592. // carries that random tag (session.data.tag, set at login) — every page of it switches to
593. // logged in / out without a reload.
594. tagOf = (session) => { return session != null && session.data != null ? session.data.tag : null }
595. audience = {
596. ticketCreated = (row, session) => { return true }
597. ticketEvent = (ticketId, ev, row, session) => { return true }
598. // ticket #4: the relation views (store.hl relationViewOf) of a ticket and its related ones
599. ticketsRelated = (views, session) => { return true }
600. // ticket #21: an app was connected / disconnected — the project page refreshes its line
601. connectionsChanged = (slug, session) => { return true }
602. signedIn = (tag, info, session) => { return tag != null && tagOf(session) == tag }
603. signedOut = (tag, session) => { return tag != null && tagOf(session) == tag }
604. }
606. sessionDir = env('TICKETS_SESSIONS') != null ? env('TICKETS_SESSIONS') : null
607. port = env('TICKETS_PORT') != null ? toNumber(env('TICKETS_PORT')) : 8350
608. // THE LISTENER's interface (mission 010, deploy to Byrodin): hl:web reads HL_HOST (or HOST)
609. // itself (hybriel#24): 127.0.0.1 on Byrodin behind nginx; unset = 0.0.0.0 (dev on Loreana).
610. // TICKETS_WATCH=0 turns the dev watcher off (the container: a deploy is an rsync + restart,
611. // half-copied .hl files must not be re-analysed); unset = on, as before.
612. watching = env('TICKETS_WATCH') != '0'
613. // THE MIGRATION of ticket #20 (migrate.hl): idempotent, runs at every start
614. for (line of migrateAll()) { console.log('migrated: ' + line) }
615. server = new WebFramework(routes = routes, styles = styles, minify = true, port = port, watchMode = watching)
617. // THE GLOBAL ERROR HANDLER (ticket #7): a plugin's failure — above all hl:fetch's refused /
618. // timed-out exchange with ident (users.hl exchangeCode) — arrives here instead of aborting the
619. // request with a 500 that shows source paths; the failed call yields null and the caller answers
620. // it ("ident did not answer"). Every absorbed error is logged.
621. on Error(e) { console.log('error absorbed: ' + e.message) }