HAXY

▄▀▄ ▄▀▀▀▀▄ ▀ ▄▄▀▀▀▀▀▀▄ ▀ ▀ ▀▀▀▀▀▀▀▄▀▄ ▄▄ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀ ▄▀▄ ▀▀▄ ▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀▄ ▀▀▀ ▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄ ▀▀▀▀ ▀▀▀▄▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀▀▀▄▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▄▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀ ▄▀▀▀▀▀▀▀▄▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▄▄▄▄▄▄▀▀▀▀▀▀▀▀▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▄▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▄▄ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀▀▀ ▀▀▀▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▄▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀ ▀▀▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▄▀▀▀ ▀▀▀▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀▀▄▀▀ ▀▀▀▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▄▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀▀▀▀▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀ ▀▀▀▀▀▀▀▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▄▀▀ ▀▀▀▀▀▀▀▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▄▀▀▀▀▀▀▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▄ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▄▀▄ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀ ▄▄▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀▄

╭─────────────╮ │scroll to top│ ╰─────────────╯ ╭ web.zig ──────────────────────────────────────────────────────╮ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ ╰───────────────────────────────────────────────────────────────╯

╭────╮ ╭ clone ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ╮ │http│ ssh │ │ ╰────╯ ╰ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ╯

.. embed/ event/ test/ ui/ command.zig event.zig lib.zig main.zig main_wasm.zig serve.zig serve_common.zig serve_http.zig serve_ssh.zig serve_ssh_protocol.zig test.zig testnet.zig try.zig ui.zig ╭─────────────────────────────────╮ │web.zig │ ╰─────────────────────────────────╯

997 if (ti.options.name.len > 0) { 998 try out.appendSlice(allocator, "\" name=\""); 999 try appendEscapedHtml(allocator, &out, ti.options.name); 1000 } 1001 // never the live content as the `value`: the browser tracks user 1002 // input natively, and including the wasm-side value here would make 1003 // the overlay HTML differ on every keystroke — that would trip the 1004 // diff in _setOverlay and rebuild the <input>, eating the user's 1005 // caret. a page-constant initial value is safe. 1006 if (session.input_values.get(inner_id)) |value| { 1007 try out.appendSlice(allocator, "\" value=\""); 1008 try appendEscapedHtml(allocator, &out, value); 1009 } 1010 try out.appendSlice(allocator, "\" style=\"left:"); 1011 var pos_buf: [64]u8 = undefined; 1012 try out.appendSlice(allocator, try std.fmt.bufPrint(&pos_buf, "{d}ch;top:{d}em;width:{d}ch;height:1em", .{ inner_left, inner_top, inner_width })); 1013 try out.appendSlice(allocator, "\">"); 1014 }, 1015 .text_area => { 1016 const ti = session.text_inputs.get(inner_id) orelse continue; 1017 const inner_left = r.x + 1; 1018 const inner_top = r.y + 1; 1019 const inner_width = if (r.size.width > 2) r.size.width - 2 else 0; 1020 const inner_height = if (r.size.height > 2) r.size.height - 2 else 0; 1021 1022 try out.appendSlice(allocator, "<textarea data-focus-id=\""); 1023 var id_buf: [32]u8 = undefined; 1024 try out.appendSlice(allocator, try std.fmt.bufPrint(&id_buf, "{d}", .{inner_id})); 1025 if (ti.options.name.len > 0) { 1026 try out.appendSlice(allocator, "\" name=\""); 1027 try appendEscapedHtml(allocator, &out, ti.options.name); 1028 } 1029 // like the input above, only a page-constant initial value 1030 // inside: the browser tracks the live value and the 1031 // overlay diff must stay stable across keystrokes 1032 try out.appendSlice(allocator, "\" style=\"left:"); 1033 var pos_buf: [128]u8 = undefined; 1034 try out.appendSlice(allocator, try std.fmt.bufPrint(&pos_buf, "{d}ch;top:{d}em;width:{d}ch;height:{d}em", .{ inner_left, inner_top, inner_width, inner_height })); 1035 try out.appendSlice(allocator, "\">"); 1036 if (session.input_values.get(inner_id)) |value| try appendEscapedHtml(allocator, &out, value); 1037 try out.appendSlice(allocator, "</textarea>"); 1038 }, 1039 .custom => |custom| { 1040 if (std.mem.eql(u8, "submit", custom)) { 1041 try out.appendSlice(allocator, "<button type=\"submit\" data-focus-id=\""); 1042 var id_buf: [32]u8 = undefined; 1043 try out.appendSlice(allocator, try std.fmt.bufPrint(&id_buf, "{d}", .{inner_id})); 1044 try out.appendSlice(allocator, "\" style=\"left:"); 1045 var pos_buf: [128]u8 = undefined; 1046 try out.appendSlice(allocator, try std.fmt.bufPrint(&pos_buf, "{d}ch;top:{d}em;width:{d}ch;height:{d}em", .{ r.x, r.y, r.size.width, r.size.height })); 1047 try out.appendSlice(allocator, "\"></button>"); 1048 } 1049 }, 1050 else => {}, 1051 } 1052 } 1053 1054 try out.appendSlice(allocator, "</form>"); 1055 } 1056 1057 return try out.toOwnedSlice(allocator); 1058 } 1059 1060 fn colorEql(a: ?Grid.Color, b: ?Grid.Color) bool { 1061 if (a) |av| return if (b) |bv| av.eql(bv) else false; 1062 return b == null; 1063 } 1064 1065 // builds an HTML ` style="color:#rrggbb;background-color:#rrggbb"` attribute 1066 // from a cell's fg/bg into `buf`, omitting whichever color is unset. returns an 1067 // empty slice when neither is set. 1068 fn styleAttr(buf: []u8, fg: ?Grid.Color, bg: ?Grid.Color) []const u8 { 1069 if (fg == null and bg == null) return buf[0..0]; 1070 const prefix = " style=\""; 1071 @memcpy(buf[0..prefix.len], prefix); 1072 var i: usize = prefix.len; 1073 if (fg) |c| { 1074 const s = std.fmt.bufPrint(buf[i..], "color:#{x:0>2}{x:0>2}{x:0>2};", .{ c.r, c.g, c.b }) catch return buf[0..0]; 1075 i += s.len; 1076 } 1077 if (bg) |c| { 1078 const s = std.fmt.bufPrint(buf[i..], "background-color:#{x:0>2}{x:0>2}{x:0>2};", .{ c.r, c.g, c.b }) catch return buf[0..0]; 1079 i += s.len; 1080 } 1081 buf[i] = '"'; 1082 i += 1; 1083 return buf[0..i]; 1084 } 1085 1086 fn appendEscapedHtml(allocator: std.mem.Allocator, out: *std.ArrayList(u8), input: []const u8) !void { 1087 for (input) |ch| { 1088 switch (ch) { 1089 '&' => try out.appendSlice(allocator, "&"), 1090 '<' => try out.appendSlice(allocator, "<"), 1091 '>' => try out.appendSlice(allocator, ">"), 1092 '"' => try out.appendSlice(allocator, """), 1093 '\'' => try out.appendSlice(allocator, "'"), 1094 else => try out.append(allocator, ch), 1095 } 1096 } 1097 } 1098 1099 // --- helpers -------------------------------------------------------------- 1100 1101 fn getCookieValue(request: *std.http.Server.Request, name: []const u8) ?[]const u8 { 1102 var iter = request.iterateHeaders(); 1103 while (iter.next()) |header| { 1104 if (!std.ascii.eqlIgnoreCase(header.name, "cookie")) continue; 1105 var pairs = std.mem.splitScalar(u8, header.value, ';'); 1106 while (pairs.next()) |pair| { 1107 const trimmed = std.mem.trim(u8, pair, " \t"); 1108 const eq = std.mem.indexOfScalar(u8, trimmed, '=') orelse continue; 1109 if (std.mem.eql(u8, trimmed[0..eq], name)) { 1110 return trimmed[eq + 1 ..]; 1111 } 1112 } 1113 } 1114 return null; 1115 } 1116 1117 fn parseFormField(allocator: std.mem.Allocator, body: []const u8, key: []const u8) !?[]u8 { 1118 var iter = std.mem.splitScalar(u8, body, '&'); 1119 while (iter.next()) |pair| { 1120 const eq = std.mem.indexOfScalar(u8, pair, '=') orelse continue; 1121 if (std.mem.eql(u8, pair[0..eq], key)) { 1122 return try decodeFormValue(allocator, pair[eq + 1 ..]); 1123 } 1124 } 1125 return null; 1126 } 1127 1128 fn decodeFormValue(allocator: std.mem.Allocator, encoded: []const u8) ![]u8 { 1129 var out: std.ArrayList(u8) = .empty; 1130 errdefer out.deinit(allocator); 1131 var i: usize = 0; 1132 while (i < encoded.len) : (i += 1) { 1133 switch (encoded[i]) { 1134 '+' => try out.append(allocator, ' '), 1135 '%' => { 1136 if (i + 2 >= encoded.len) return error.InvalidPercentEncoding; 1137 const hi = std.fmt.charToDigit(encoded[i + 1], 16) catch return error.InvalidPercentEncoding; 1138 const lo = std.fmt.charToDigit(encoded[i + 2], 16) catch return error.InvalidPercentEncoding; 1139 try out.append(allocator, hi * 16 + lo); 1140 i += 2; 1141 }, 1142 else => try out.append(allocator, encoded[i]), 1143 } 1144 } 1145 return try out.toOwnedSlice(allocator); 1146 } 1147 1148 // disk-backed web session store. each login mints a random, opaque token 1149 // (not the user's id) that is stored as a file named by the token hex, whose 1150 // contents are the raw user_id bytes. authenticating a request is a lookup of 1151 // the cookie's token; logout deletes the file, revoking the session. there is 1152 // deliberately no expiry — a session lives until logout. 1153 pub const SessionStore = struct { 1154 io: std.Io, 1155 dir: std.Io.Dir, 1156 1157 pub const token_hex_len = evt.event_id_size * 2; 1158 1159 pub fn init(io: std.Io, data_dir: std.Io.Dir) !SessionStore { 1160 try data_dir.createDirPath(io, "sessions"); 1161 const dir = try data_dir.openDir(io, "sessions", .{}); 1162 return .{ .io = io, .dir = dir }; 1163 } 1164 1165 pub fn deinit(self: SessionStore) void { 1166 self.dir.close(self.io); 1167 } 1168 1169 // mint a new session for user_id, returning the token hex to set as the 1170 // cookie value. 1171 pub fn create(self: SessionStore, user_id: *const [evt.event_id_size]u8) ![token_hex_len]u8 { 1172 var token: [evt.event_id_size]u8 = undefined; 1173 self.io.random(&token); 1174 const token_hex = std.fmt.bytesToHex(token, .lower); 1175 const file = try self.dir.createFile(self.io, &token_hex, .{}); 1176 defer file.close(self.io); 1177 try file.writeStreamingAll(self.io, user_id); 1178 return token_hex; 1179 } 1180 1181 // resolve a cookie's token to its user_id. returns false (logged out) for a 1182 // missing, malformed, or unknown token. 1183 pub fn lookup(self: SessionStore, token_hex: []const u8, out: *[evt.event_id_size]u8) bool { 1184 if (!isToken(token_hex)) return false; 1185 const file = self.dir.openFile(self.io, token_hex, .{ .mode = .read_only }) catch return false; 1186 defer file.close(self.io); 1187 var storage: [evt.event_id_size]u8 = undefined; 1188 var file_reader = file.reader(self.io, &storage); 1189 file_reader.interface.readSliceAll(out) catch return false; 1190 return true; 1191 } 1192 1193 // revoke a session. a no-op for a missing or malformed token. 1194 pub fn remove(self: SessionStore, token_hex: []const u8) void { 1195 if (!isToken(token_hex)) return; 1196 self.dir.deleteFile(self.io, token_hex) catch {}; 1197 } 1198 1199 // a token is exactly token_hex_len hex chars. validating before using the 1200 // value as a path keeps attacker-supplied cookies from escaping the 1201 // sessions dir (e.g. via "/" or ".." bytes). 1202 fn isToken(token_hex: []const u8) bool { 1203 if (token_hex.len != token_hex_len) return false; 1204 for (token_hex) |c| if (!std.ascii.isHex(c)) return false; 1205 return true; 1206 } 1207 }; 1208