fix: clean up fixes after APP overhaul

Reviewed-on: andyburke/autonomous.contact#1

.gitignore

@@ -1,3 +1,4 @@
 data/
-.fsdb
+.fsdb*
 public/files/*
+.vscode/*

public/api/topics/:topic_id/events/index.ts

@@ -204,10 +204,6 @@ export async function POST(req: Request, meta: Record<string, any>): Promise<Res
 			});
 		}
 
-		console.dir({
-			event
-		});
-
 		await events.create(event);
 
 		return Response.json(event, {

public/api/users/index.ts

@@ -36,6 +36,20 @@ const DEFAULT_USER_PERMISSIONS: string[] = [
 	'watches.write.own'
 ];
 
+// TODO: figure out a better solution for doling out permissions
+const DEFAULT_SUPERUSER_PERMISSIONS: string[] = [
+	...DEFAULT_USER_PERMISSIONS,
+	'files.write.all',
+	'invites.read.all',
+	'signups.read.all',
+	'topics.create',
+	'topics.delete',
+	'topics.write',
+	'users.write',
+	'watches.read.all',
+	'watches.write.all'
+];
+
 export const PRECHECKS: PRECHECK_TABLE = {};
 
 // GET /api/users - get users
@@ -120,7 +134,7 @@ export async function POST(req: Request, meta: Record<string, any>): Promise<Res
 		const at_least_one_existing_user = (await USERS.all({
 			limit: 1,
 			offset: 0
-		})).shift()?.load();
+		})).shift();
 
 		let root_invite_code_secret = undefined;
 		if (!at_least_one_existing_user) {
@@ -201,6 +215,10 @@ export async function POST(req: Request, meta: Record<string, any>): Promise<Res
 			}
 		};
 
+		if (!at_least_one_existing_user) {
+			user.permissions = DEFAULT_SUPERUSER_PERMISSIONS;
+		}
+
 		await USERS.create(user);
 
 		// automatically salted

public/js/app.js

@@ -2,6 +2,7 @@ const HASH_EXTRACTOR = /^\#\/topic\/(?<topic_id>[A-Za-z\-]+)\/?(?<view>\w+)?/gm;
 const UPDATE_TOPICS_FREQUENCY = 60_000;
 
 const APP = {
+	user: undefined,
 	user_servers: [],
 	user_watches: [],
 
@@ -56,16 +57,19 @@ const APP = {
 			groups: {},
 		};
 
+		/*
 		console.dir({
 			url: window.location.href,
 			hash: window.location.hash,
 			topic_id,
 			view,
 		});
+		*/
 
 		if (!document.body.dataset.topic || document.body.dataset.topic !== topic_id) {
 			const previous = document.body.dataset.topic;
 
+			/*
 			console.dir({
 				topic_changed: {
 					detail: {
@@ -74,6 +78,7 @@ const APP = {
 					},
 				},
 			});
+			*/
 
 			document.body.dataset.topic = topic_id;
 
@@ -94,6 +99,7 @@ const APP = {
 			const previous = document.body.dataset.view;
 			document.body.dataset.view = view;
 
+			/*
 			console.dir({
 				view_changed: {
 					detail: {
@@ -102,6 +108,7 @@ const APP = {
 					},
 				},
 			});
+			*/
 
 			this._emit( 'view_changed', {
 				previous,
@@ -149,8 +156,9 @@ const APP = {
 		this._emit( 'load', this );
 	},
 
-	update_user: async function( updated_user ) {
-		const user = this.user = updated_user;
+	update_user: async function( user ) {
+		this.user = user;
+
 		document.body.dataset.user = JSON.stringify(user);
 		document.body.dataset.perms = user.permissions.join(":");
 

public/sidebar/sidebar.html

@@ -809,9 +809,10 @@
 
 							form.on_reply = (new_topic) => {
 								const topic_list = document.getElementById("topic-list");
+								topic_list.querySelectorAll( 'li' ).forEach( (li) => li.classList.remove( 'active' ) );
 								topic_list.insertAdjacentHTML(
 									"beforeend",
-									`<li id="topic-selector-${new_topic.id}" class="topic"><a href="#/topic/${new_topic.id}">${new_topic.name}</a></li>`,
+									`<li id="topic-selector-${new_topic.id}" class="topic active"><a href="#/topic/${new_topic.id}">${new_topic.name}</a></li>`,
 								);
 
 								new_topic_name_input.value = "";

public/signup_login_wall.html

@@ -35,9 +35,11 @@
 			width: 95%;
 			min-height: 24rem;
 			position: relative;
-			background: hsl(from var(--bg) h s 15);
+			background: hsl(from var(--bg) h s calc(l/1.1));
 			max-width: 40em;
 			margin: 0 auto;
+			border-radius: var(--border-radius);
+			overflow: hidden;
 		}
 
 		#signup-login-wall form {
@@ -103,12 +105,7 @@
 								const form = document.currentScript.closest("form");
 								form.on_reply = (response) => {
 									const user = response.user;
-									document.body.dataset.user = JSON.stringify(user);
-									document.body.dataset.perms = user.permissions.join(":");
-
-									document.dispatchEvent(
-										new CustomEvent("user_logged_in", { detail: { user } }),
-									);
+									APP.login( user );
 								};
 							}
 						</script>
@@ -138,7 +135,6 @@
 								id="signup-invite-code"
 								type="text"
 								name="invite_code"
-								required
 							/>
 							<label class="placeholder" for="signup-invite-code">invite code</label>
 						</div>

tests/03_login.test.ts

@@ -44,7 +44,7 @@ Deno.test({
 				}
 			});
 
-			const authed_user: USER | undefined = auth_response.user;
+			const _authed_user: USER | undefined = auth_response.user;
 			const authed_session: Record<string, any> | undefined = auth_response.session;
 
 			cookies.push({

tests/04_create_topic.test.ts

@@ -22,14 +22,34 @@ Deno.test({
 				port: test_server_info.port
 			});
 
-			const info = await get_new_user(client);
+			const root_user_info = await get_new_user(client);
+
+			try {
+				const root_user_topic = await client.fetch('/topics', {
+					method: 'POST',
+					headers: {
+						'x-session_id': root_user_info.session.id,
+						'x-totp': await generateTotp(root_user_info.session.secret)
+					},
+					json: {
+						name: 'this is the root user topic'
+					}
+				});
+
+				asserts.assert(root_user_topic);
+			} catch (error) {
+				const reason: string = (error as Error).cause as string ?? (error as Error).toString();
+				asserts.fail(reason);
+			}
+
+			const regular_user_info = await get_new_user(client, {}, root_user_info);
 
 			try {
 				const _permission_denied_topic = await client.fetch('/topics', {
 					method: 'POST',
 					headers: {
-						'x-session_id': info.session.id,
-						'x-totp': await generateTotp(info.session.secret)
+						'x-session_id': regular_user_info.session.id,
+						'x-totp': await generateTotp(regular_user_info.session.secret)
 					},
 					json: {
 						name: 'this should not be allowed'
@@ -41,14 +61,14 @@ Deno.test({
 				asserts.assertEquals((error as Error).cause, 'permission_denied');
 			}
 
-			await set_user_permissions(client, info.user, info.session, [...info.user.permissions, 'topics.create']);
+			await set_user_permissions(client, regular_user_info.user, regular_user_info.session, [...regular_user_info.user.permissions, 'topics.create']);
 
 			try {
 				const _too_long_name_topic = await client.fetch('/topics', {
 					method: 'POST',
 					headers: {
-						'x-session_id': info.session.id,
-						'x-totp': await generateTotp(info.session.secret)
+						'x-session_id': regular_user_info.session.id,
+						'x-totp': await generateTotp(regular_user_info.session.secret)
 					},
 					json: {
 						name: 'X'.repeat(1024)
@@ -63,8 +83,8 @@ Deno.test({
 			const new_topic = await client.fetch('/topics', {
 				method: 'POST',
 				headers: {
-					'x-session_id': info.session.id,
-					'x-totp': await generateTotp(info.session.secret)
+					'x-session_id': regular_user_info.session.id,
+					'x-totp': await generateTotp(regular_user_info.session.secret)
 				},
 				json: {
 					name: 'test topic'
@@ -73,7 +93,8 @@ Deno.test({
 
 			asserts.assert(new_topic);
 
-			await delete_user(client, info);
+			await delete_user(client, regular_user_info);
+			await delete_user(client, root_user_info);
 		} finally {
 			clear_topic_events_cache();
 			if (test_server_info) {

tests/11_file_uploads.test.ts

@@ -1,8 +1,7 @@
 import { api, API_CLIENT } from '../utils/api.ts';
 import * as asserts from '@std/assert';
-import { USER } from '../models/user.ts';
 import { delete_user, EPHEMERAL_SERVER, get_ephemeral_listen_server, get_new_user, random_username, set_user_permissions } from './helpers.ts';
-import { Cookie, getSetCookies } from '@std/http/cookie';
+import { Cookie } from '@std/http/cookie';
 import { generateTotp } from '../utils/totp.ts';
 import * as fs from '@std/fs';
 import * as path from '@std/path';
@@ -136,55 +135,11 @@ Deno.test({
 				port: test_server_info.port
 			});
 
-			const username = random_username();
-			const password = 'password';
+			const root_user_info = await get_new_user(client);
+			asserts.assert(root_user_info);
 
-			const user_creation_response: Record<string, any> = await client.fetch('/users', {
-				method: 'POST',
-				json: {
-					username,
-					password
-				}
-			});
-
-			asserts.assert(user_creation_response?.user);
-			asserts.assert(user_creation_response?.session);
-
-			let cookies: Cookie[] = [];
-			const auth_response: any = await client.fetch('/auth', {
-				method: 'POST',
-				json: {
-					username,
-					password: 'password'
-				},
-				done: (response) => {
-					cookies = getSetCookies(response.headers);
-				}
-			});
-
-			const user: USER | undefined = auth_response.user;
-			asserts.assert(user);
-			asserts.assert(user.id);
-
-			const session: Record<string, any> | undefined = auth_response.session;
-			asserts.assert(session);
-
-			cookies.push({
-				name: 'totp',
-				value: await generateTotp(session?.secret ?? ''),
-				maxAge: 30,
-				expires: Date.now() + 30_000,
-				path: '/'
-			});
-
-			const headers_for_upload_request = new Headers();
-			for (const cookie of cookies) {
-				headers_for_upload_request.append(`x-${cookie.name}`, cookie.value);
-			}
-			headers_for_upload_request.append(
-				'cookie',
-				cookies.map((cookie) => `${cookie.name}=${cookie.value}`).join('; ')
-			);
+			const regular_user_info = await get_new_user(client, {}, root_user_info);
+			asserts.assert(regular_user_info);
 
 			const upload_body = new FormData();
 			upload_body.append(
@@ -196,7 +151,10 @@ Deno.test({
 				`http://${test_server_info.hostname}:${test_server_info.port}/files/test_uploading_to_root_dir.txt`,
 				{
 					method: 'PUT',
-					headers: headers_for_upload_request,
+					headers: {
+						'x-session_id': regular_user_info.session.id,
+						'x-totp': await generateTotp(regular_user_info.session.secret)
+					},
 					body: upload_body
 				}
 			);
@@ -204,13 +162,16 @@ Deno.test({
 			asserts.assert(!disallowed_upload_response.ok);
 			await disallowed_upload_response.text();
 
-			await set_user_permissions(client, user, session, [...user.permissions, 'files.write.all']);
+			await set_user_permissions(client, regular_user_info.user, regular_user_info.session, [...regular_user_info.user.permissions, 'files.write.all']);
 
 			const allowed_upload_response = await fetch(
 				`http://${test_server_info.hostname}:${test_server_info.port}/files/test_uploading_to_root_dir.txt`,
 				{
 					method: 'PUT',
-					headers: headers_for_upload_request,
+					headers: {
+						'x-session_id': regular_user_info.session.id,
+						'x-totp': await generateTotp(regular_user_info.session.secret)
+					},
 					body: upload_body
 				}
 			);

utils/totp.ts

@@ -7,9 +7,10 @@ import { decodeBase32 } from '@std/encoding';
  *
  * @ignore
  */
-export function counterToBuffer(counter: number): DataView {
-	const buffer = new DataView(new ArrayBuffer(8));
-	buffer.setBigUint64(0, BigInt(counter), false);
+export function counterToBuffer(counter: number): ArrayBuffer {
+	const buffer = new ArrayBuffer(8);
+	const view = new DataView(buffer);
+	view.setBigUint64(0, BigInt(counter), false);
 	return buffer;
 }
 
@@ -23,7 +24,7 @@ export async function generateHmacSha1(
 ): Promise<Uint8Array> {
 	const importedKey = await crypto.subtle.importKey(
 		'raw',
-		key,
+		new Uint8Array(key),
 		{ name: 'HMAC', hash: 'SHA-1' },
 		false,
 		['sign']