╭─────────────╮ │scroll to top│ ╰─────────────╯ ╭ web.zig ──────────────────────────────────────────────────────╮ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ ╰───────────────────────────────────────────────────────────────╯
🬐 🬠 🬞🬂🬏 🬟 🬑 🬟 🬑 ╭b73a7dd3..╮ b73a7dd3.. see-em: 🬋🬋🬋 🬋🬋🬋 🬋 🬋 │files │ commits refs discuss issues new login 🬐 🬠 🬐 🬠 🬑 🬟 🬰 ╰──────────╯ (411) user
╭────╮ ╭ clone ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ╮ │http│ ssh │ │ ╰────╯ ╰ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ╯
.. embed/ event/ test/ ui/ command.zig diff3.zig event.zig fork.zig lib.zig main.zig main_wasm.zig patch.zig serve.zig serve_common.zig serve_http.zig serve_ssh.zig serve_ssh_protocol.zig test.zig testnet.zig try.zig ui.zig ╭─────────────────────────────────╮ │web.zig │ ╰─────────────────────────────────╯
1817 const inner_width = if (r.size.width > 2) r.size.width - 2 else 0; 1818 1819 try out.appendSlice(allocator, "<input type=\""); 1820 try out.appendSlice(allocator, if (root_child.focus.kind == .text_input_password) "password" else "text"); 1821 try out.appendSlice(allocator, if (action_url.len == 0) "\" readonly data-focus-id=\"" else "\" data-focus-id=\""); 1822 var id_buf: [32]u8 = undefined; 1823 try out.appendSlice(allocator, try std.fmt.bufPrint(&id_buf, "{d}", .{inner_id})); 1824 if (ti.options.name.len > 0) { 1825 try out.appendSlice(allocator, "\" name=\""); 1826 try appendEscapedHtml(allocator, &out, ti.options.name); 1827 } 1828 // never the live content as the `value`: the browser tracks user 1829 // input natively, and including the wasm-side value here would make 1830 // the overlay HTML differ on every keystroke — that would trip the 1831 // diff in _setOverlay and rebuild the <input>, eating the user's 1832 // caret. a page-constant initial value is safe. 1833 if (session.input_values.get(inner_id)) |value| { 1834 try out.appendSlice(allocator, "\" value=\""); 1835 try appendEscapedHtml(allocator, &out, value); 1836 } 1837 try out.appendSlice(allocator, "\" style=\"left:"); 1838 var pos_buf: [64]u8 = undefined; 1839 try out.appendSlice(allocator, try std.fmt.bufPrint(&pos_buf, "{d}ch;top:{d}em;width:{d}ch;height:1em", .{ inner_left, inner_top, inner_width })); 1840 try out.appendSlice(allocator, "\">"); 1841 }, 1842 .text_area => { 1843 const ti = session.text_inputs.get(inner_id) orelse continue; 1844 const inner_left = r.x + 1; 1845 const inner_top = r.y + 1; 1846 const inner_width = if (r.size.width > 2) r.size.width - 2 else 0; 1847 const inner_height = if (r.size.height > 2) r.size.height - 2 else 0; 1848 1849 try out.appendSlice(allocator, "<textarea data-focus-id=\""); 1850 var id_buf: [32]u8 = undefined; 1851 try out.appendSlice(allocator, try std.fmt.bufPrint(&id_buf, "{d}", .{inner_id})); 1852 if (ti.options.name.len > 0) { 1853 try out.appendSlice(allocator, "\" name=\""); 1854 try appendEscapedHtml(allocator, &out, ti.options.name); 1855 } 1856 // like the input above, only a page-constant initial value 1857 // inside: the browser tracks the live value and the 1858 // overlay diff must stay stable across keystrokes 1859 try out.appendSlice(allocator, "\" style=\"left:"); 1860 var pos_buf: [128]u8 = undefined; 1861 try out.appendSlice(allocator, try std.fmt.bufPrint(&pos_buf, "{d}ch;top:{d}em;width:{d}ch;height:{d}em", .{ inner_left, inner_top, inner_width, inner_height })); 1862 // textarea discards the first newline immediately following 1863 // its start tag, so add one of our own so text that begins 1864 // with a newline doesn't lose it 1865 try out.appendSlice(allocator, "\">\n"); 1866 if (session.input_values.get(inner_id)) |value| try appendEscapedHtml(allocator, &out, value); 1867 try out.appendSlice(allocator, "</textarea>"); 1868 }, 1869 .custom => |custom| { 1870 if (std.mem.eql(u8, "submit", custom) or std.mem.startsWith(u8, custom, ui.submit_action_prefix)) { 1871 try out.appendSlice(allocator, "<button type=\"submit\" data-focus-id=\""); 1872 var id_buf: [32]u8 = undefined; 1873 try out.appendSlice(allocator, try std.fmt.bufPrint(&id_buf, "{d}", .{inner_id})); 1874 if (std.mem.startsWith(u8, custom, ui.submit_action_prefix)) { 1875 try out.appendSlice(allocator, "\" formaction=\""); 1876 try appendEscapedHtml(allocator, &out, custom[ui.submit_action_prefix.len..]); 1877 } 1878 try out.appendSlice(allocator, "\" style=\"left:"); 1879 var pos_buf: [128]u8 = undefined; 1880 try out.appendSlice(allocator, try std.fmt.bufPrint(&pos_buf, "{d}ch;top:{d}em;width:{d}ch;height:{d}em", .{ r.x, r.y, r.size.width, r.size.height })); 1881 try out.appendSlice(allocator, "\"></button>"); 1882 } 1883 }, 1884 else => {}, 1885 } 1886 } 1887 1888 try out.appendSlice(allocator, "</form>"); 1889 } 1890 1891 // a file picker isn't part of a form: it posts its file straight to the url 1892 // in its marker. it sits transparent over the button the tui drew, so 1893 // clicking that button opens the browser's own dialog. 1894 var file_iter = root_focus.children.iterator(); 1895 while (file_iter.next()) |entry| { 1896 const child = entry.value_ptr.*; 1897 const action_url = switch (child.focus.kind) { 1898 .custom => |custom| if (std.mem.startsWith(u8, custom, ui.file_input_prefix)) 1899 custom[ui.file_input_prefix.len..] 1900 else 1901 continue, 1902 else => continue, 1903 }; 1904 const r = child.rect; 1905 1906 try out.appendSlice(allocator, "<input type=\"file\" data-action=\""); 1907 try appendEscapedHtml(allocator, &out, action_url); 1908 try out.appendSlice(allocator, "\" data-focus-id=\""); 1909 var id_buf: [32]u8 = undefined; 1910 try out.appendSlice(allocator, try std.fmt.bufPrint(&id_buf, "{d}", .{entry.key_ptr.*})); 1911 try out.appendSlice(allocator, "\" style=\"opacity:0;left:"); 1912 var pos_buf: [128]u8 = undefined; 1913 try out.appendSlice(allocator, try std.fmt.bufPrint(&pos_buf, "{d}ch;top:{d}em;width:{d}ch;height:{d}em", .{ r.x, r.y, r.size.width, r.size.height })); 1914 try out.appendSlice(allocator, "\">"); 1915 } 1916 1917 return try out.toOwnedSlice(allocator); 1918 } 1919 1920 fn colorEql(a: ?Grid.Color, b: ?Grid.Color) bool { 1921 if (a) |av| return if (b) |bv| av.eql(bv) else false; 1922 return b == null; 1923 } 1924 1925 // builds an HTML ` style="color:#rrggbb;background-color:#rrggbb"` attribute 1926 // from a cell's fg/bg into `buf`, omitting whichever color is unset. returns an 1927 // empty slice when neither is set. 1928 fn styleAttr(buf: []u8, fg: ?Grid.Color, bg: ?Grid.Color) []const u8 { 1929 if (fg == null and bg == null) return buf[0..0]; 1930 const prefix = " style=\""; 1931 @memcpy(buf[0..prefix.len], prefix); 1932 var i: usize = prefix.len; 1933 if (fg) |c| { 1934 const s = std.fmt.bufPrint(buf[i..], "color:#{x:0>2}{x:0>2}{x:0>2};", .{ c.r, c.g, c.b }) catch return buf[0..0]; 1935 i += s.len; 1936 } 1937 if (bg) |c| { 1938 const s = std.fmt.bufPrint(buf[i..], "background-color:#{x:0>2}{x:0>2}{x:0>2};", .{ c.r, c.g, c.b }) catch return buf[0..0]; 1939 i += s.len; 1940 } 1941 buf[i] = '"'; 1942 i += 1; 1943 return buf[0..i]; 1944 } 1945 1946 fn appendEscapedHtml(allocator: std.mem.Allocator, out: *std.ArrayList(u8), input: []const u8) !void { 1947 for (input) |ch| { 1948 switch (ch) { 1949 '&' => try out.appendSlice(allocator, "&amp;"), 1950 '<' => try out.appendSlice(allocator, "&lt;"), 1951 '>' => try out.appendSlice(allocator, "&gt;"), 1952 '"' => try out.appendSlice(allocator, "&quot;"), 1953 '\'' => try out.appendSlice(allocator, "&#39;"), 1954 else => try out.append(allocator, ch), 1955 } 1956 } 1957 } 1958 1959 // --- helpers -------------------------------------------------------------- 1960 1961 fn getCookieValue(request: *std.http.Server.Request, name: []const u8) ?[]const u8 { 1962 var iter = request.iterateHeaders(); 1963 while (iter.next()) |header| { 1964 if (!std.ascii.eqlIgnoreCase(header.name, "cookie")) continue; 1965 var pairs = std.mem.splitScalar(u8, header.value, ';'); 1966 while (pairs.next()) |pair| { 1967 const trimmed = std.mem.trim(u8, pair, " \t"); 1968 const eq = std.mem.indexOfScalar(u8, trimmed, '=') orelse continue; 1969 if (std.mem.eql(u8, trimmed[0..eq], name)) { 1970 return trimmed[eq + 1 ..]; 1971 } 1972 } 1973 } 1974 return null; 1975 } 1976 1977 fn parseFormField(allocator: std.mem.Allocator, body: []const u8, key: []const u8) !?[]u8 { 1978 var iter = std.mem.splitScalar(u8, body, '&'); 1979 while (iter.next()) |pair| { 1980 const eq = std.mem.indexOfScalar(u8, pair, '=') orelse continue; 1981 if (std.mem.eql(u8, pair[0..eq], key)) { 1982 return try decodeFormValue(allocator, pair[eq + 1 ..]); 1983 } 1984 } 1985 return null; 1986 } 1987 1988 fn readFormBody(request: *std.http.Server.Request, allocator: std.mem.Allocator) ![]u8 { 1989 var buffer: [256]u8 = undefined; 1990 return request.readerExpectNone(&buffer).allocRemaining(allocator, .limited(65536)); 1991 } 1992 1993 fn decodeFormValue(allocator: std.mem.Allocator, encoded: []const u8) ![]u8 { 1994 var out: std.ArrayList(u8) = .empty; 1995 errdefer out.deinit(allocator); 1996 var i: usize = 0; 1997 while (i < encoded.len) : (i += 1) { 1998 switch (encoded[i]) { 1999 '+' => try out.append(allocator, ' '), 2000 '%' => { 2001 if (i + 2 >= encoded.len) return error.InvalidPercentEncoding; 2002 const hi = std.fmt.charToDigit(encoded[i + 1], 16) catch return error.InvalidPercentEncoding; 2003 const lo = std.fmt.charToDigit(encoded[i + 2], 16) catch return error.InvalidPercentEncoding; 2004 try out.append(allocator, hi * 16 + lo); 2005 i += 2; 2006 }, 2007 else => try out.append(allocator, encoded[i]), 2008 } 2009 } 2010 return try out.toOwnedSlice(allocator); 2011 } 2012 2013 // disk-backed web session store. each login mints a random, opaque token 2014 // (not the user's id) that is stored as a file named by the token hex, whose 2015 // contents are the raw user_id bytes. authenticating a request is a lookup of 2016 // the cookie's token; logout deletes the file, revoking the session. there is 2017 // deliberately no expiry — a session lives until logout. 2018 pub const SessionStore = struct { 2019 io: std.Io, 2020 dir: std.Io.Dir, 2021 auto_login: ?[token_hex_len]u8, 2022 2023 pub const token_hex_len = evt.event_id_size * 2; 2024 2025 pub fn init(io: std.Io, data_dir: std.Io.Dir) !SessionStore { 2026 try data_dir.createDirPath(io, "sessions"); 2027 const dir = try data_dir.openDir(io, "sessions", .{}); 2028 const auto_login = blk: { 2029 const file = dir.openFile(io, auto_login_name, .{ .mode = .read_only }) catch break :blk null; 2030 defer file.close(io); 2031 var token: [token_hex_len]u8 = undefined; 2032 var storage: [token_hex_len]u8 = undefined; 2033 var reader = file.reader(io, &storage); 2034 reader.interface.readSliceAll(&token) catch break :blk null; 2035 break :blk token; 2036 }; 2037 return .{ .io = io, .dir = dir, .auto_login = auto_login }; 2038 } 2039 2040 pub fn deinit(self: SessionStore) void { 2041 self.dir.close(self.io); 2042 } 2043 2044 // mint a new session for user_id, returning the token hex to set as the 2045 // cookie value. 2046 pub fn create(self: SessionStore, user_id: *const [evt.event_id_size]u8) ![token_hex_len]u8 { 2047 var token: [evt.event_id_size]u8 = undefined; 2048 self.io.random(&token); 2049 const token_hex = std.fmt.bytesToHex(token, .lower); 2050 const file = try self.dir.createFile(self.io, &token_hex, .{}); 2051 defer file.close(self.io); 2052 try file.writeStreamingAll(self.io, user_id); 2053 return token_hex; 2054 } 2055 2056 // resolve a cookie's token to its user_id. returns false (logged out) for a 2057 // missing, malformed, or unknown token. 2058 pub fn lookup(self: SessionStore, token_hex: []const u8, out: *[evt.event_id_size]u8) bool { 2059 if (!isToken(token_hex)) return false; 2060 const file = self.dir.openFile(self.io, token_hex, .{ .mode = .read_only }) catch return false; 2061 defer file.close(self.io); 2062 var storage: [evt.event_id_size]u8 = undefined; 2063 var file_reader = file.reader(self.io, &storage); 2064 file_reader.interface.readSliceAll(out) catch return false; 2065 return true; 2066 } 2067 2068 // revoke a session. a no-op for a missing or malformed token. 2069 pub fn remove(self: SessionStore, token_hex: []const u8) void { 2070 if (!isToken(token_hex)) return; 2071 self.dir.deleteFile(self.io, token_hex) catch {}; 2072 } 2073 2074 // leave `token_hex`'s session for visitors arriving without one. only the 2075 // `try` fixture writes one. the name can't collide with a session token. 2076 pub fn offerAutoLogin(self: SessionStore, token_hex: *const [token_hex_len]u8) !void { 2077 const file = try self.dir.createFile(self.io, auto_login_name, .{}); 2078 defer file.close(self.io); 2079 try file.writeStreamingAll(self.io, token_hex); 2080 } 2081 2082 pub fn autoLogin(self: SessionStore, out: *[token_hex_len]u8) bool { 2083 out.* = self.auto_login orelse return false; 2084 return true; 2085 } 2086 2087 const auto_login_name = "auto-login"; 2088 2089 // a token is exactly token_hex_len hex chars. validating before using the 2090 // value as a path keeps attacker-supplied cookies from escaping the 2091 // sessions dir (e.g. via "/" or ".." bytes). 2092 fn isToken(token_hex: []const u8) bool { 2093 if (token_hex.len != token_hex_len) return false; 2094 for (token_hex) |c| if (!std.ascii.isHex(c)) return false; 2095 return true; 2096 } 2097 }; 2098