From e22031ed4f5bec5e0102dce19065655b4dcac6e2 Mon Sep 17 00:00:00 2001 From: Alexander Heldt Date: Mon, 7 Sep 2026 11:16:15 +0000 Subject: [PATCH] Add guest links for temporary shared access MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Handing a dog sitter the ability to log a pee meant handing them the account password: permanent, total control, revocable only by changing it. Settings → Guest access now mints a URL that does the one thing instead. A link is a session, not an account. Opening /guest/ inserts an ordinary session row against the owner's user_id, tagged with the link it came from, so every data path downstream — sync, photos, the profile — stays scoped by user_id exactly as before and needed no changes at all. Only the capability checks differ by role, which is what kept this from touching the sync contract. Redemption is a plain GET so tapping the link in a message works, and the 303 to / leaves the token out of the address bar, bookmarks and the PWA start URL. What a guest cannot change is enforced in the upsert, not in the UI. The WHERE clause gains a logged_by_share test: an owner (empty share id) may change anything, a guest only rows carrying their own link's id. A sitter can fix up their own entries and cannot rewrite or delete one of the owner's, including everything logged before this existed, since those rows carry the empty id too. Deletes come along free, being tombstones. The test is on the link id rather than its label because two links can easily both be "Sitter", and the id is also why /api/me hands the guest its share id: the client needs it to know what to grey out. The exercise library is the owner's on the same reasoning — a guest trains against it but the server drops any exercise a guest sends. Attribution is stamped from the session on insert and left out of DO UPDATE SET, so it is decided once by whoever logged the event and survives every later edit. It never comes off the wire, so it cannot be forged — a guest re-POSTs the owner's whole event list on every sync, but those rows already exist and keep their stored values. Expiry is a date the owner picks; the link dies at the end of that day in their own timezone, which the client computes because the server has no way to know it. Sessions are capped at the link's own end, and every request re-checks the link is live rather than trusting the session row, so revoking kicks a guest out on their next request instead of whenever their session happens to lapse. Only the token hash is stored, as with session tokens, so the URL is shown once at creation and cannot be read back. The client side follows from that. A guest opening someone else's entry gets the edit dialog read-only rather than a form that would silently discard what they typed, and mergeSynced takes the server's copy for anything they may not change — otherwise a refused write would sit in their cache forever showing an edit that never happened. An ended link wipes their cached copy of someone else's history and says so, rather than offering a sign-in form they have no password for. --- README.md | 50 +++- server/auth.go | 389 +++++++++++++++++++++++--- server/auth_test.go | 647 ++++++++++++++++++++++++++++++++++++++++++++ server/main.go | 171 +++++++++--- src/app.js | 373 +++++++++++++++++++++++-- src/changelog.json | 1 + src/index.html | 94 ++++++- src/style.css | 78 ++++++ src/sw.js | 5 + 9 files changed, 1698 insertions(+), 110 deletions(-) create mode 100644 server/auth_test.go diff --git a/README.md b/README.md index 580e733..874b6a7 100644 --- a/README.md +++ b/README.md @@ -49,7 +49,7 @@ puppy-tracker/ │ ├── go.mod │ ├── go.sum │ ├── main.go # SQLite store, LWW sync, static file serving -│ ├── auth.go # accounts, sessions, invite-gated registration +│ ├── auth.go # accounts, sessions, invite-gated registration, guest links │ ├── reminders.go # reminder rules, the evaluation loop, push subscriptions │ ├── webpush.go # VAPID + RFC 8291/8188 message encryption │ ├── pedigree.go # SKK lookup, background crawl, per-dog cache @@ -100,6 +100,54 @@ events, profile and photos. when you pass `-secure-cookies` (enable it behind a TLS proxy), so passwords aren't sent in the clear. +## Guest links + +A dog sitter needs to log a pee; they do not need your password. **Settings → +Guest access** mints a link that does exactly the first thing. + +- **It is a session, not an account.** Opening `/guest/` mints an ordinary + session row against *your* `user_id`, tagged with the link it came from. Every + data path downstream — sync, photos, the profile — is scoped by `user_id` as + before, so a guest simply is you as far as the data is concerned. Only the + capability checks differ. +- **What a guest gets.** The whole app to read: every panel, every chart, all + history. They can log new events freely, and edit or delete the ones they + logged themselves. What they don't get is anything under Settings that belongs + to the account — the puppy profile, the pedigree id, reminders, other guest + links, and deleting the account. Those routes are behind `requireOwner` and + 403 for a guest; the client hides the matching UI. The two device-local + preferences (dark mode, confetti) stay, since they are the guest's own browser + and not your account. +- **A guest cannot change your logs.** The upsert in `Store.sync` only lets a + guest update rows carrying their own link's id, so a sitter can fix up their + own entries and cannot rewrite or delete a single one of yours — including + everything logged before guest links existed. The check is on the link *id*, + not its label, because two links can easily both be called "Sitter". You keep + full control either way and can edit anything on your own account, theirs + included. The exercise library is the owner's for the same reason: a guest + logs training sessions against it but the server drops any exercise a guest + sends. In the app a guest opening someone else's entry gets a read-only view + rather than a form that would throw away what they typed. +- **It expires, and you can revoke it.** You pick the last day the link should + work; it stops at the end of that day in your own timezone. Sessions minted + from a link are capped at the link's own expiry, so one can never outlive it, + and every request re-checks that the link is still live — so revoking kicks + whoever is already using it out on their very next request, not whenever their + session happens to lapse. Revoking also deletes those session rows outright. +- **The URL is shown once.** Only a hash of the token is stored, exactly as with + session tokens, so a leaked database yields no working links — and the app + cannot show you the URL again later. Settings lists each live link by label, + expiry and when it was last used. +- **Events say who logged them.** An event created through a link carries that + link's label (badged in the History log) and its id (which is what authorises + changes). The server stamps both from the session on insert and never reads + them off the wire, so neither can be forged; both are left out of the update + path, so a later edit by anyone keeps the original attribution. +- **A link is a bearer token — serve over HTTPS.** Anyone holding the URL can + redeem it until it expires. Send it over something private, and run behind TLS + (`-secure-cookies`) as above. When a link ends, the guest's browser drops its + cached copy of your history rather than keeping it around. + ## Reminders Opt-in push notifications for the two things that are easy to lose track of: diff --git a/server/auth.go b/server/auth.go index fa2adc2..1e14b77 100644 --- a/server/auth.go +++ b/server/auth.go @@ -23,20 +23,50 @@ import ( const ( sessionCookie = "puppy_session" sessionValidity = 30 * 24 * time.Hour + // A guest link's last_used is only refreshed this often, so "last used" can + // be shown in Settings without a write on every single request. + lastUsedResolution = 5 * time.Minute + // How far ahead a guest link may be set to expire. The owner picks the date, + // so this is only a backstop against a mistyped year turning a sitter's link + // into a permanent credential. + maxShareAhead = 365 * 24 * time.Hour ) // ctxKey is an unexported type so our context values can't collide with any // set elsewhere. type ctxKey int -const userIDKey ctxKey = 0 +const sessionKey ctxKey = 0 // User is the public shape returned to clients — never the password hash. +// Role is "owner" for a normal login and "guest" for a session minted from a +// share link, in which case Label names the link and Email is blanked (it is +// the owner's address, and a guest has no business seeing it). type User struct { ID string `json:"id"` Email string `json:"email"` + Role string `json:"role,omitempty"` + Label string `json:"label,omitempty"` + // ShareID is the guest's own link id, which is what decides the events they + // are allowed to change (see Store.sync). The client uses it to grey out + // everything logged by someone else. + ShareID string `json:"shareId,omitempty"` + // Expires is the guest session's end, in Unix milliseconds. Owner sessions + // leave it zero — they only end by logging out. + Expires int64 `json:"expires,omitempty"` } +// session is a resolved cookie: who the request acts as, and whether it got +// there through a guest link. ShareID is empty for an owner session. +type session struct { + userID string + shareID string + label string + expires int64 +} + +func (s session) guest() bool { return s.shareID != "" } + // Auth owns everything account-related: the users/sessions tables, the shared // invite code required to register, and whether session cookies are marked // Secure (on behind TLS/a proxy). photosDir is needed so the first account can @@ -121,8 +151,10 @@ func (a *Auth) verify(email, password string) (User, bool) { } // startSession mints a token, stores its hash, and returns the raw token for -// the cookie. -func (a *Auth) startSession(userID string) (string, error) { +// the cookie. shareID is empty for an owner login; for a guest it names the +// share link, and expires is capped at that link's own end so the session can +// never outlive the link it came from. +func (a *Auth) startSession(userID, shareID string, expires int64) (string, error) { raw := make([]byte, 32) if _, err := rand.Read(raw); err != nil { return "", err @@ -130,28 +162,53 @@ func (a *Auth) startSession(userID string) (string, error) { token := hex.EncodeToString(raw) now := time.Now() _, err := a.db.Exec( - `INSERT INTO sessions (token, user_id, created, expires) VALUES (?, ?, ?, ?)`, - hashToken(token), userID, now.UnixMilli(), now.Add(sessionValidity).UnixMilli()) + `INSERT INTO sessions (token, user_id, created, expires, share_id) VALUES (?, ?, ?, ?, ?)`, + hashToken(token), userID, now.UnixMilli(), expires, shareID) if err != nil { return "", err } return token, nil } -// userForToken resolves a raw cookie token to a user id, honouring expiry. -func (a *Auth) userForToken(token string) (string, bool) { +// sessionForToken resolves a raw cookie token to the session it stands for, +// honouring expiry. A guest session is additionally only valid while its link +// is un-revoked and unexpired — checked here, on every request, so revoking a +// link kicks its live sessions out immediately rather than whenever their own +// row happens to lapse. +func (a *Auth) sessionForToken(token string) (session, bool) { if token == "" { - return "", false + return session{}, false } - var userID string - var expires int64 - err := a.db.QueryRow( - `SELECT user_id, expires FROM sessions WHERE token = ?`, hashToken(token), - ).Scan(&userID, &expires) - if err != nil || time.Now().UnixMilli() > expires { - return "", false + var s session + var expires, linkRevoked, linkExpires int64 + err := a.db.QueryRow(` + SELECT s.user_id, s.expires, s.share_id, + COALESCE(l.revoked, 0), COALESCE(l.expires, 0), COALESCE(l.label, '') + FROM sessions s LEFT JOIN share_links l ON l.id = s.share_id + WHERE s.token = ?`, hashToken(token), + ).Scan(&s.userID, &expires, &s.shareID, &linkRevoked, &linkExpires, &s.label) + now := time.Now().UnixMilli() + if err != nil || now > expires { + return session{}, false + } + if s.guest() { + if linkRevoked != 0 || now > linkExpires { + return session{}, false + } + s.expires = expires + a.touchShare(s.shareID, now) + } + return s, true +} + +// touchShare records that a link was used, at lastUsedResolution granularity so +// an active guest doesn't cause a write per request. +func (a *Auth) touchShare(shareID string, now int64) { + if _, err := a.db.Exec( + `UPDATE share_links SET last_used = ? WHERE id = ? AND last_used < ?`, + now, shareID, now-lastUsedResolution.Milliseconds()); err != nil { + log.Printf("touch share %s: %v", shareID, err) } - return userID, true } func (a *Auth) endSession(token string) { @@ -209,7 +266,10 @@ func (a *Auth) adoptPhotos(userID string) error { // ---------- cookies & middleware ---------- -func (a *Auth) setCookie(w http.ResponseWriter, token string) { +// setCookie writes the session cookie. expires mirrors the session row's own +// end, so a guest's cookie lapses with the link rather than sitting around for +// the full 30 days pointing at a session the server already refuses. +func (a *Auth) setCookie(w http.ResponseWriter, token string, expires time.Time) { http.SetCookie(w, &http.Cookie{ Name: sessionCookie, Value: token, @@ -217,7 +277,7 @@ func (a *Auth) setCookie(w http.ResponseWriter, token string) { HttpOnly: true, Secure: a.secure, SameSite: http.SameSiteLaxMode, - Expires: time.Now().Add(sessionValidity), + Expires: expires, }) } @@ -242,26 +302,50 @@ func cookieToken(r *http.Request) string { } // requireUser wraps a handler so it only runs for an authenticated request, -// stashing the user id in the context. Unauthenticated calls get a 401 that the -// client uses as its cue to show the login screen. +// stashing the resolved session in the context. Unauthenticated calls get a 401 +// that the client uses as its cue to show the login screen. func (a *Auth) requireUser(next http.HandlerFunc) http.HandlerFunc { return func(w http.ResponseWriter, r *http.Request) { - userID, ok := a.userForToken(cookieToken(r)) + s, ok := a.sessionForToken(cookieToken(r)) if !ok { http.Error(w, "unauthorized", http.StatusUnauthorized) return } - next(w, r.WithContext(context.WithValue(r.Context(), userIDKey, userID))) + next(w, r.WithContext(context.WithValue(r.Context(), sessionKey, s))) } } -// userID returns the authenticated user's id; only valid inside a requireUser -// handler. -func userID(r *http.Request) string { - id, _ := r.Context().Value(userIDKey).(string) - return id +// requireOwner is requireUser plus "and not through a guest link". It guards +// everything a temporary helper has no business touching: the profile, the +// owner's reminders, the share links themselves, and account deletion. +func (a *Auth) requireOwner(next http.HandlerFunc) http.HandlerFunc { + return a.requireUser(func(w http.ResponseWriter, r *http.Request) { + if isGuest(r) { + http.Error(w, "guest links cannot do this", http.StatusForbidden) + return + } + next(w, r) + }) } +// sessionOf returns the request's resolved session; only valid inside a +// requireUser handler. +func sessionOf(r *http.Request) session { + s, _ := r.Context().Value(sessionKey).(session) + return s +} + +// userID returns the authenticated user's id — the owner's, for a guest +// session, which is what keeps all data scoping working unchanged. +func userID(r *http.Request) string { return sessionOf(r).userID } + +// isGuest reports whether the request arrived through a share link. +func isGuest(r *http.Request) bool { return sessionOf(r).guest() } + +// guestLabel is the share link's label, or empty for the owner. It is what gets +// stamped onto events the request creates. +func guestLabel(r *http.Request) string { return sessionOf(r).label } + // ---------- handlers ---------- type credentials struct { @@ -349,15 +433,17 @@ func (a *Auth) handleLogin(w http.ResponseWriter, r *http.Request) { a.issue(w, u) } -// issue starts a session, sets the cookie, and returns the user. +// issue starts an owner session, sets the cookie, and returns the user. func (a *Auth) issue(w http.ResponseWriter, u User) { - token, err := a.startSession(u.ID) + expires := time.Now().Add(sessionValidity) + token, err := a.startSession(u.ID, "", expires.UnixMilli()) if err != nil { log.Printf("start session: %v", err) http.Error(w, "server error", http.StatusInternalServerError) return } - a.setCookie(w, token) + a.setCookie(w, token, expires) + u.Role = "owner" writeUser(w, u) } @@ -371,8 +457,10 @@ func (a *Auth) handleLogout(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusNoContent) } -// handleMe reports the current account. Wrapped in requireUser, so reaching it -// means the session is valid. +// handleMe reports the current account, and which role the caller holds over +// it. Wrapped in requireUser, so reaching it means the session is valid. The id +// is the owner's either way — it is what the client namespaces its local cache +// by — but a guest is told so, and never told whose account this is. func (a *Auth) handleMe(w http.ResponseWriter, r *http.Request) { var u User err := a.db.QueryRow( @@ -382,6 +470,15 @@ func (a *Auth) handleMe(w http.ResponseWriter, r *http.Request) { http.Error(w, "unauthorized", http.StatusUnauthorized) return } + if s := sessionOf(r); s.guest() { + u.Email = "" + u.Role = "guest" + u.Label = s.label + u.ShareID = s.shareID + u.Expires = s.expires + } else { + u.Role = "owner" + } writeUser(w, u) } @@ -395,8 +492,8 @@ func (a *Auth) checkPassword(userID, password string) bool { } // deleteAccount removes a user and everything owned by them: events, profile, -// reminders, push subscriptions, sessions, the user row, and their photo -// directory. The table wipes run in one transaction; photos are best-effort +// reminders, push subscriptions, share links, sessions, the user row, and their +// photo directory. The table wipes run in one transaction; photos are best-effort // afterwards (orphaned files are harmless). func (a *Auth) deleteAccount(userID string) error { tx, err := a.db.Begin() @@ -410,6 +507,7 @@ func (a *Auth) deleteAccount(userID string) error { `DELETE FROM config WHERE user_id = ?`, `DELETE FROM push_subscriptions WHERE user_id = ?`, `DELETE FROM reminders WHERE user_id = ?`, + `DELETE FROM share_links WHERE user_id = ?`, `DELETE FROM sessions WHERE user_id = ?`, `DELETE FROM users WHERE id = ?`, } { @@ -447,3 +545,226 @@ func (a *Auth) handleDeleteAccount(w http.ResponseWriter, r *http.Request) { a.clearCookie(w) w.WriteHeader(http.StatusNoContent) } + +// ---------- guest links ---------- +// +// A guest link lets the owner hand someone (a dog sitter, family for a weekend) +// the ability to log events without handing over their password. Redeeming one +// mints an ordinary session row against the *owner's* user_id, tagged with the +// link it came from — so every data path downstream (sync, photos, config) keeps +// working untouched, and only the capability checks differ by role. +// +// The raw token is shown exactly once, at creation. Only its hash is stored, +// the same way session tokens are, so a leaked database yields no usable links. + +// ShareLink is the public shape of a guest link. Token is set only on the +// response to the call that created it, and never stored in the clear. +type ShareLink struct { + ID string `json:"id"` + Label string `json:"label"` + Created int64 `json:"created"` + Expires int64 `json:"expires"` + LastUsed int64 `json:"lastUsed,omitempty"` + Token string `json:"token,omitempty"` +} + +// createShare mints a link that stops working at expires (Unix milliseconds) +// and returns it with its one-time raw token attached. +func (a *Auth) createShare(userID, label string, expires int64) (ShareLink, error) { + raw := make([]byte, 32) + if _, err := rand.Read(raw); err != nil { + return ShareLink{}, err + } + token := hex.EncodeToString(raw) + now := time.Now() + link := ShareLink{ + ID: newID(), + Label: label, + Created: now.UnixMilli(), + Expires: expires, + Token: token, + } + _, err := a.db.Exec( + `INSERT INTO share_links (id, user_id, token, label, created, expires) VALUES (?, ?, ?, ?, ?, ?)`, + link.ID, userID, hashToken(token), link.Label, link.Created, link.Expires) + if err != nil { + return ShareLink{}, err + } + return link, nil +} + +// listShares returns the account's links that are still usable. Revoked and +// lapsed ones are of no interest to the UI — the point of the list is "who can +// get in right now". +func (a *Auth) listShares(userID string) ([]ShareLink, error) { + rows, err := a.db.Query(` + SELECT id, label, created, expires, last_used + FROM share_links + WHERE user_id = ? AND revoked = 0 AND expires > ? + ORDER BY created DESC`, userID, time.Now().UnixMilli()) + if err != nil { + return nil, err + } + defer rows.Close() + out := make([]ShareLink, 0) + for rows.Next() { + var l ShareLink + if err := rows.Scan(&l.ID, &l.Label, &l.Created, &l.Expires, &l.LastUsed); err != nil { + return nil, err + } + out = append(out, l) + } + return out, rows.Err() +} + +// revokeShare kills a link and every session already minted from it. The +// user_id guard means one account can never revoke another's link. +func (a *Auth) revokeShare(userID, id string) error { + res, err := a.db.Exec( + `UPDATE share_links SET revoked = 1 WHERE id = ? AND user_id = ?`, id, userID) + if err != nil { + return err + } + if n, err := res.RowsAffected(); err == nil && n == 0 { + return sql.ErrNoRows + } + // sessionForToken would reject these anyway, on the revoked flag; dropping + // the rows means a revoked link leaves nothing behind either way. + _, err = a.db.Exec(`DELETE FROM sessions WHERE share_id = ?`, id) + return err +} + +// redeemShare exchanges a raw token for a session on the owner's account. The +// session is capped at the link's own expiry, so it cannot outlive it. +func (a *Auth) redeemShare(token string) (raw string, sessionEnd int64, ok bool) { + if token == "" { + return "", 0, false + } + var id, ownerID string + var expires, revoked int64 + err := a.db.QueryRow( + `SELECT id, user_id, expires, revoked FROM share_links WHERE token = ?`, hashToken(token), + ).Scan(&id, &ownerID, &expires, &revoked) + now := time.Now() + if err != nil || revoked != 0 || now.UnixMilli() > expires { + return "", 0, false + } + sessionEnd = now.Add(sessionValidity).UnixMilli() + if expires < sessionEnd { + sessionEnd = expires + } + raw, err = a.startSession(ownerID, id, sessionEnd) + if err != nil { + log.Printf("redeem share %s: %v", id, err) + return "", 0, false + } + if _, err := a.db.Exec(`UPDATE share_links SET last_used = ? WHERE id = ?`, now.UnixMilli(), id); err != nil { + log.Printf("stamp share %s: %v", id, err) + } + return raw, sessionEnd, true +} + +type shareRequest struct { + Label string `json:"label"` + // Expires is when the link should stop working, in Unix milliseconds. The + // client computes it from the date the owner picked — end of that day in + // their own timezone, which is the only place that timezone is known. + Expires int64 `json:"expires"` +} + +// handleShares lists (GET) and creates (POST) guest links. Wrapped in +// requireOwner: a guest cannot see, mint or extend links. +func (a *Auth) handleShares(w http.ResponseWriter, r *http.Request) { + writeJSON := func(v any) { + w.Header().Set("Content-Type", "application/json") + w.Header().Set("Cache-Control", "no-store") + _ = json.NewEncoder(w).Encode(v) + } + switch r.Method { + case http.MethodGet: + links, err := a.listShares(userID(r)) + if err != nil { + log.Printf("list shares: %v", err) + http.Error(w, "server error", http.StatusInternalServerError) + return + } + writeJSON(map[string]any{"links": links}) + case http.MethodPost: + var req shareRequest + if err := json.NewDecoder(io.LimitReader(r.Body, 1<<16)).Decode(&req); err != nil { + http.Error(w, "bad json", http.StatusBadRequest) + return + } + label := strings.TrimSpace(req.Label) + if len(label) > 40 { + label = label[:40] + } + if label == "" { + label = "Guest" + } + now := time.Now() + if req.Expires <= now.UnixMilli() { + http.Error(w, "pick a date in the future", http.StatusBadRequest) + return + } + if req.Expires > now.Add(maxShareAhead).UnixMilli() { + http.Error(w, "that date is too far off", http.StatusBadRequest) + return + } + link, err := a.createShare(userID(r), label, req.Expires) + if err != nil { + log.Printf("create share: %v", err) + http.Error(w, "server error", http.StatusInternalServerError) + return + } + writeJSON(link) + default: + http.Error(w, "method not allowed", http.StatusMethodNotAllowed) + } +} + +// handleShare revokes one link: DELETE /api/shares/. Wrapped in +// requireOwner. +func (a *Auth) handleShare(w http.ResponseWriter, r *http.Request) { + if r.Method != http.MethodDelete { + http.Error(w, "method not allowed", http.StatusMethodNotAllowed) + return + } + id := strings.TrimPrefix(r.URL.Path, "/api/shares/") + if id == "" || strings.Contains(id, "/") { + http.Error(w, "invalid id", http.StatusBadRequest) + return + } + if err := a.revokeShare(userID(r), id); err != nil { + if errors.Is(err, sql.ErrNoRows) { + http.Error(w, "no such link", http.StatusNotFound) + return + } + log.Printf("revoke share %s: %v", id, err) + http.Error(w, "server error", http.StatusInternalServerError) + return + } + w.WriteHeader(http.StatusNoContent) +} + +// handleRedeem is what a guest link actually points at: GET /guest/. +// A plain navigation so tapping the link in a message just works — it sets the +// session cookie and bounces to the app, which keeps the token out of the +// address bar, out of bookmarks and out of the PWA's start URL. SameSite=Lax +// permits the cookie on a top-level GET like this one. +func (a *Auth) handleRedeem(w http.ResponseWriter, r *http.Request) { + if r.Method != http.MethodGet && r.Method != http.MethodHead { + http.Error(w, "method not allowed", http.StatusMethodNotAllowed) + return + } + token := strings.TrimPrefix(r.URL.Path, "/guest/") + raw, expires, ok := a.redeemShare(token) + if !ok { + // Nothing usable — send them to the app with a marker it renders as + // "this link has ended" rather than a login form they can't fill in. + http.Redirect(w, r, "/?guest=expired", http.StatusSeeOther) + return + } + a.setCookie(w, raw, time.UnixMilli(expires)) + http.Redirect(w, r, "/", http.StatusSeeOther) +} diff --git a/server/auth_test.go b/server/auth_test.go new file mode 100644 index 0000000..e7db219 --- /dev/null +++ b/server/auth_test.go @@ -0,0 +1,647 @@ +package main + +import ( + "database/sql" + "encoding/json" + "net/http" + "net/http/httptest" + "path/filepath" + "strconv" + "strings" + "testing" + "time" +) + +func testAuth(t *testing.T) *Auth { + t.Helper() + dir := t.TempDir() + db, err := openDB(filepath.Join(dir, "test.db")) + if err != nil { + t.Fatalf("open db: %v", err) + } + t.Cleanup(func() { db.Close() }) + return newAuth(db, "letmein", false, filepath.Join(dir, "photos")) +} + +// testOwner registers an account and returns its id. +func testOwner(t *testing.T, a *Auth) string { + t.Helper() + u, err := a.createUser("owner@example.com", "hunter2hunter2") + if err != nil { + t.Fatalf("create user: %v", err) + } + return u.ID +} + +// hoursAhead is an expiry that many hours from now, in Unix milliseconds — +// what the client sends after the owner picks a date. +func hoursAhead(h int) int64 { + return time.Now().Add(time.Duration(h) * time.Hour).UnixMilli() +} + +// guestToken mints a link and redeems it, returning the raw session token a +// guest's cookie would carry. +func guestToken(t *testing.T, a *Auth, ownerID, label string, hours int) string { + t.Helper() + link, err := a.createShare(ownerID, label, hoursAhead(hours)) + if err != nil { + t.Fatalf("create share: %v", err) + } + raw, _, ok := a.redeemShare(link.Token) + if !ok { + t.Fatal("redeem: fresh link was rejected") + } + return raw +} + +// request builds a request carrying the given session cookie. +func request(method, path, cookie, body string) *http.Request { + r := httptest.NewRequest(method, path, strings.NewReader(body)) + if cookie != "" { + r.AddCookie(&http.Cookie{Name: sessionCookie, Value: cookie}) + } + return r +} + +func TestRedeemedLinkActsAsTheOwner(t *testing.T) { + a := testAuth(t) + ownerID := testOwner(t, a) + token := guestToken(t, a, ownerID, "Anna", 24) + + s, ok := a.sessionForToken(token) + if !ok { + t.Fatal("session for a fresh guest token was rejected") + } + if s.userID != ownerID { + t.Errorf("guest session scoped to %q, want the owner %q", s.userID, ownerID) + } + if !s.guest() { + t.Error("session from a share link does not report itself as a guest") + } + if s.label != "Anna" { + t.Errorf("label = %q, want %q", s.label, "Anna") + } +} + +func TestOwnerSessionIsNotAGuest(t *testing.T) { + a := testAuth(t) + ownerID := testOwner(t, a) + raw, err := a.startSession(ownerID, "", time.Now().Add(sessionValidity).UnixMilli()) + if err != nil { + t.Fatalf("start session: %v", err) + } + s, ok := a.sessionForToken(raw) + if !ok { + t.Fatal("owner session was rejected") + } + if s.guest() || s.label != "" { + t.Errorf("owner session reports guest=%v label=%q, want false/empty", s.guest(), s.label) + } +} + +func TestUnusableTokensAreRejected(t *testing.T) { + a := testAuth(t) + ownerID := testOwner(t, a) + + if _, _, ok := a.redeemShare("not-a-real-token"); ok { + t.Error("a garbage token was redeemed") + } + if _, _, ok := a.redeemShare(""); ok { + t.Error("an empty token was redeemed") + } + + // An expired link: backdate it past its own end. + link, err := a.createShare(ownerID, "Stale", hoursAhead(12)) + if err != nil { + t.Fatalf("create share: %v", err) + } + if _, err := a.db.Exec( + `UPDATE share_links SET expires = ? WHERE id = ?`, + time.Now().Add(-time.Minute).UnixMilli(), link.ID); err != nil { + t.Fatalf("backdate: %v", err) + } + if _, _, ok := a.redeemShare(link.Token); ok { + t.Error("an expired link was redeemed") + } + + // A revoked link. + revoked, err := a.createShare(ownerID, "Revoked", hoursAhead(12)) + if err != nil { + t.Fatalf("create share: %v", err) + } + if err := a.revokeShare(ownerID, revoked.ID); err != nil { + t.Fatalf("revoke: %v", err) + } + if _, _, ok := a.redeemShare(revoked.Token); ok { + t.Error("a revoked link was redeemed") + } +} + +// Revocation has to bite on the next request, not whenever the guest's own +// session row happens to lapse — that is the whole point of being able to +// revoke. +func TestRevokingKillsLiveSessions(t *testing.T) { + a := testAuth(t) + ownerID := testOwner(t, a) + link, err := a.createShare(ownerID, "Anna", hoursAhead(24)) + if err != nil { + t.Fatalf("create share: %v", err) + } + token, _, ok := a.redeemShare(link.Token) + if !ok { + t.Fatal("redeem: fresh link was rejected") + } + if _, ok := a.sessionForToken(token); !ok { + t.Fatal("session invalid before revoking") + } + if err := a.revokeShare(ownerID, link.ID); err != nil { + t.Fatalf("revoke: %v", err) + } + if _, ok := a.sessionForToken(token); ok { + t.Error("session still valid after its link was revoked") + } +} + +// A guest session must never outlive its link, however long the default +// session validity is. +func TestGuestSessionIsCappedAtTheLinkExpiry(t *testing.T) { + a := testAuth(t) + ownerID := testOwner(t, a) + link, err := a.createShare(ownerID, "Anna", hoursAhead(12)) + if err != nil { + t.Fatalf("create share: %v", err) + } + _, sessionEnd, ok := a.redeemShare(link.Token) + if !ok { + t.Fatal("redeem: fresh link was rejected") + } + if sessionEnd != link.Expires { + t.Errorf("session ends at %d, want the link's own %d", sessionEnd, link.Expires) + } +} + +func TestRevokeIsScopedToTheOwner(t *testing.T) { + a := testAuth(t) + ownerID := testOwner(t, a) + other, err := a.createUser("other@example.com", "hunter2hunter2") + if err != nil { + t.Fatalf("create user: %v", err) + } + link, err := a.createShare(ownerID, "Anna", hoursAhead(24)) + if err != nil { + t.Fatalf("create share: %v", err) + } + if err := a.revokeShare(other.ID, link.ID); err == nil { + t.Error("another account revoked a link it does not own") + } + if _, _, ok := a.redeemShare(link.Token); !ok { + t.Error("link was revoked by an account that does not own it") + } +} + +func TestListSharesHidesRevokedAndExpired(t *testing.T) { + a := testAuth(t) + ownerID := testOwner(t, a) + live, err := a.createShare(ownerID, "Live", hoursAhead(24)) + if err != nil { + t.Fatalf("create share: %v", err) + } + gone, err := a.createShare(ownerID, "Gone", hoursAhead(24)) + if err != nil { + t.Fatalf("create share: %v", err) + } + if err := a.revokeShare(ownerID, gone.ID); err != nil { + t.Fatalf("revoke: %v", err) + } + stale, err := a.createShare(ownerID, "Stale", hoursAhead(24)) + if err != nil { + t.Fatalf("create share: %v", err) + } + if _, err := a.db.Exec( + `UPDATE share_links SET expires = ? WHERE id = ?`, + time.Now().Add(-time.Minute).UnixMilli(), stale.ID); err != nil { + t.Fatalf("backdate: %v", err) + } + + links, err := a.listShares(ownerID) + if err != nil { + t.Fatalf("list: %v", err) + } + if len(links) != 1 || links[0].ID != live.ID { + t.Fatalf("listed %d link(s), want only the live one", len(links)) + } + if links[0].Token != "" { + t.Error("listing leaked a raw token") + } +} + +// The raw token is only ever handed back once, at creation. +func TestOnlyTheTokenHashIsStored(t *testing.T) { + a := testAuth(t) + ownerID := testOwner(t, a) + link, err := a.createShare(ownerID, "Anna", hoursAhead(24)) + if err != nil { + t.Fatalf("create share: %v", err) + } + var stored string + if err := a.db.QueryRow(`SELECT token FROM share_links WHERE id = ?`, link.ID).Scan(&stored); err != nil { + t.Fatalf("read back: %v", err) + } + if stored == link.Token { + t.Error("the raw token is stored in the clear") + } + if stored != hashToken(link.Token) { + t.Error("stored token is not the hash of the issued one") + } +} + +func TestDeletingAnAccountDropsItsLinks(t *testing.T) { + a := testAuth(t) + ownerID := testOwner(t, a) + link, err := a.createShare(ownerID, "Anna", hoursAhead(24)) + if err != nil { + t.Fatalf("create share: %v", err) + } + if err := a.deleteAccount(ownerID); err != nil { + t.Fatalf("delete account: %v", err) + } + var n int + if err := a.db.QueryRow(`SELECT COUNT(*) FROM share_links WHERE id = ?`, link.ID).Scan(&n); err != nil { + t.Fatalf("count: %v", err) + } + if n != 0 { + t.Error("the deleted account's guest links survived") + } +} + +// ---------- capability gating ---------- + +func TestRequireOwnerBlocksGuests(t *testing.T) { + a := testAuth(t) + ownerID := testOwner(t, a) + guest := guestToken(t, a, ownerID, "Anna", 24) + owner, err := a.startSession(ownerID, "", time.Now().Add(sessionValidity).UnixMilli()) + if err != nil { + t.Fatalf("start session: %v", err) + } + + reached := false + h := a.requireOwner(func(w http.ResponseWriter, r *http.Request) { reached = true }) + + w := httptest.NewRecorder() + h(w, request(http.MethodPost, "/api/shares", guest, "{}")) + if w.Code != http.StatusForbidden { + t.Errorf("guest got %d, want %d", w.Code, http.StatusForbidden) + } + if reached { + t.Error("the guarded handler ran for a guest") + } + + w = httptest.NewRecorder() + h(w, request(http.MethodPost, "/api/shares", owner, "{}")) + if w.Code != http.StatusOK || !reached { + t.Errorf("owner got %d and reached=%v, want 200 and true", w.Code, reached) + } +} + +// A guest must still be able to do the thing the link exists for. +func TestRequireUserAllowsGuests(t *testing.T) { + a := testAuth(t) + ownerID := testOwner(t, a) + guest := guestToken(t, a, ownerID, "Anna", 24) + + var sawUser, sawLabel string + h := a.requireUser(func(w http.ResponseWriter, r *http.Request) { + sawUser, sawLabel = userID(r), guestLabel(r) + }) + w := httptest.NewRecorder() + h(w, request(http.MethodPost, "/api/events/sync", guest, "{}")) + if w.Code != http.StatusOK { + t.Fatalf("guest got %d on a shared route, want 200", w.Code) + } + if sawUser != ownerID { + t.Errorf("handler saw user %q, want the owner %q", sawUser, ownerID) + } + if sawLabel != "Anna" { + t.Errorf("handler saw label %q, want %q", sawLabel, "Anna") + } +} + +func TestHandleMeHidesTheOwnerFromAGuest(t *testing.T) { + a := testAuth(t) + ownerID := testOwner(t, a) + guest := guestToken(t, a, ownerID, "Anna", 24) + + w := httptest.NewRecorder() + a.requireUser(a.handleMe)(w, request(http.MethodGet, "/api/me", guest, "")) + if w.Code != http.StatusOK { + t.Fatalf("got %d, want 200", w.Code) + } + var u User + if err := json.NewDecoder(w.Body).Decode(&u); err != nil { + t.Fatalf("decode: %v", err) + } + if u.Email != "" { + t.Errorf("a guest was told the owner's email (%q)", u.Email) + } + if u.Role != "guest" || u.Label != "Anna" { + t.Errorf("role/label = %q/%q, want guest/Anna", u.Role, u.Label) + } + if u.ID != ownerID { + t.Errorf("id = %q, want the owner's %q so the client scopes its cache right", u.ID, ownerID) + } +} + +// ---------- attribution ---------- + +func loggedBy(t *testing.T, db *sql.DB, id string) string { + t.Helper() + var by string + if err := db.QueryRow(`SELECT logged_by FROM events WHERE id = ?`, id).Scan(&by); err != nil { + t.Fatalf("read logged_by: %v", err) + } + return by +} + +func TestAttributionIsStampedFromTheSession(t *testing.T) { + a := testAuth(t) + store := newStore(a.db) + ownerID := testOwner(t, a) + + if _, err := store.sync(ownerID, "Anna", "s1", []Event{ + {ID: "e1", Type: "pee", At: 1000, UpdatedAt: 1000}, + }); err != nil { + t.Fatalf("guest sync: %v", err) + } + if got := loggedBy(t, a.db, "e1"); got != "Anna" { + t.Errorf("logged_by = %q, want %q", got, "Anna") + } + + if _, err := store.sync(ownerID, "", "", []Event{ + {ID: "e2", Type: "poo", At: 2000, UpdatedAt: 2000}, + }); err != nil { + t.Fatalf("owner sync: %v", err) + } + if got := loggedBy(t, a.db, "e2"); got != "" { + t.Errorf("the owner's own event was attributed to %q", got) + } +} + +// Attribution is decided once, by whoever logged the event. A later edit — +// by the owner or by another guest — must not rewrite it. +func TestAttributionSurvivesLaterEdits(t *testing.T) { + a := testAuth(t) + store := newStore(a.db) + ownerID := testOwner(t, a) + + if _, err := store.sync(ownerID, "Anna", "s1", []Event{ + {ID: "e1", Type: "pee", At: 1000, UpdatedAt: 1000}, + }); err != nil { + t.Fatalf("guest sync: %v", err) + } + // The owner edits the note, bumping updatedAt so LWW takes the change. + if _, err := store.sync(ownerID, "", "", []Event{ + {ID: "e1", Type: "pee", At: 1000, Note: "on the walk", UpdatedAt: 2000}, + }); err != nil { + t.Fatalf("owner edit: %v", err) + } + if got := loggedBy(t, a.db, "e1"); got != "Anna" { + t.Errorf("logged_by = %q after an owner edit, want it to stay %q", got, "Anna") + } + // And the guest re-POSTing their own event leaves it alone too. + if _, err := store.sync(ownerID, "Anna", "s1", []Event{ + {ID: "e1", Type: "pee", At: 1000, Note: "on the walk", UpdatedAt: 3000}, + }); err != nil { + t.Fatalf("guest re-sync: %v", err) + } + if got := loggedBy(t, a.db, "e1"); got != "Anna" { + t.Errorf("logged_by = %q after the guest re-synced, want %q", got, "Anna") + } +} + +// The value never comes off the wire, so a client cannot claim to be someone +// else — or launder its own events into looking like the owner's. +func TestAttributionCannotBeSetByTheClient(t *testing.T) { + a := testAuth(t) + store := newStore(a.db) + ownerID := testOwner(t, a) + + merged, err := store.sync(ownerID, "Anna", "s1", []Event{ + {ID: "e1", Type: "pee", At: 1000, UpdatedAt: 1000, LoggedBy: ""}, + {ID: "e2", Type: "poo", At: 2000, UpdatedAt: 2000, LoggedBy: "The Owner", LoggedByShare: "s-other"}, + }) + if err != nil { + t.Fatalf("sync: %v", err) + } + for _, id := range []string{"e1", "e2"} { + if got := loggedBy(t, a.db, id); got != "Anna" { + t.Errorf("%s: logged_by = %q, want the session's %q", id, got, "Anna") + } + } + // And the server's own answer carries the stamp back, so the client can + // render the badge without having to guess. + for _, e := range merged { + if e.LoggedBy != "Anna" { + t.Errorf("%s came back as %q, want %q", e.ID, e.LoggedBy, "Anna") + } + if e.LoggedByShare != "s1" { + t.Errorf("%s came back from link %q, want %q", e.ID, e.LoggedByShare, "s1") + } + } +} + +// ---------- what a guest is allowed to change ---------- + +// eventNote reads back one event's note and tombstone flag — enough to tell +// whether an attempted edit or delete actually landed. +func eventState(t *testing.T, db *sql.DB, id string) (note string, deleted bool) { + t.Helper() + if err := db.QueryRow(`SELECT note, deleted FROM events WHERE id = ?`, id).Scan(¬e, &deleted); err != nil { + t.Fatalf("read event %s: %v", id, err) + } + return note, deleted +} + +// The point of the whole guard: a sitter must not be able to rewrite or delete +// what the owner logged, however their client asks. +func TestGuestCannotChangeTheOwnersEvents(t *testing.T) { + a := testAuth(t) + store := newStore(a.db) + ownerID := testOwner(t, a) + + // The owner logs something. + if _, err := store.sync(ownerID, "", "", []Event{ + {ID: "e1", Type: "pee", At: 1000, Note: "mine", UpdatedAt: 1000}, + }); err != nil { + t.Fatalf("owner sync: %v", err) + } + + // A guest tries to edit it, with a much newer timestamp so last-write-wins + // alone would take the change. + merged, err := store.sync(ownerID, "Anna", "s1", []Event{ + {ID: "e1", Type: "pee", At: 1000, Note: "rewritten by the sitter", UpdatedAt: 9000}, + }) + if err != nil { + t.Fatalf("guest edit: %v", err) + } + if note, _ := eventState(t, a.db, "e1"); note != "mine" { + t.Errorf("a guest rewrote the owner's event: note = %q", note) + } + // The guest gets the stored version back, so an honest client can heal. + for _, e := range merged { + if e.ID == "e1" && e.Note != "mine" { + t.Errorf("server returned %q for the owner's event, want %q", e.Note, "mine") + } + } + + // And cannot delete it either — a tombstone is just another update. + if _, err := store.sync(ownerID, "Anna", "s1", []Event{ + {ID: "e1", Type: "pee", At: 1000, Note: "mine", UpdatedAt: 9001, Deleted: true}, + }); err != nil { + t.Fatalf("guest delete: %v", err) + } + if _, deleted := eventState(t, a.db, "e1"); deleted { + t.Error("a guest deleted the owner's event") + } +} + +func TestGuestCanChangeItsOwnEvents(t *testing.T) { + a := testAuth(t) + store := newStore(a.db) + ownerID := testOwner(t, a) + + if _, err := store.sync(ownerID, "Anna", "s1", []Event{ + {ID: "e1", Type: "pee", At: 1000, Note: "oops", UpdatedAt: 1000}, + }); err != nil { + t.Fatalf("guest sync: %v", err) + } + if _, err := store.sync(ownerID, "Anna", "s1", []Event{ + {ID: "e1", Type: "pee", At: 1000, Note: "fixed", UpdatedAt: 2000}, + }); err != nil { + t.Fatalf("guest edit: %v", err) + } + if note, _ := eventState(t, a.db, "e1"); note != "fixed" { + t.Errorf("a guest could not fix up their own entry: note = %q", note) + } + if _, err := store.sync(ownerID, "Anna", "s1", []Event{ + {ID: "e1", Type: "pee", At: 1000, Note: "fixed", UpdatedAt: 3000, Deleted: true}, + }); err != nil { + t.Fatalf("guest delete: %v", err) + } + if _, deleted := eventState(t, a.db, "e1"); !deleted { + t.Error("a guest could not delete their own entry") + } +} + +// Two links can carry the same label ("Sitter"), so the id — not the label — +// has to be what authorises the change. +func TestGuestCannotChangeAnotherLinksEvents(t *testing.T) { + a := testAuth(t) + store := newStore(a.db) + ownerID := testOwner(t, a) + + if _, err := store.sync(ownerID, "Sitter", "s1", []Event{ + {ID: "e1", Type: "pee", At: 1000, Note: "anna's", UpdatedAt: 1000}, + }); err != nil { + t.Fatalf("first guest sync: %v", err) + } + // Same label, different link. + if _, err := store.sync(ownerID, "Sitter", "s2", []Event{ + {ID: "e1", Type: "pee", At: 1000, Note: "bob's", UpdatedAt: 2000}, + }); err != nil { + t.Fatalf("second guest sync: %v", err) + } + if note, _ := eventState(t, a.db, "e1"); note != "anna's" { + t.Errorf("one link's guest edited another's event: note = %q", note) + } +} + +// The owner keeps full control of everything on their account, including what +// a guest logged. +func TestOwnerCanChangeAGuestsEvents(t *testing.T) { + a := testAuth(t) + store := newStore(a.db) + ownerID := testOwner(t, a) + + if _, err := store.sync(ownerID, "Anna", "s1", []Event{ + {ID: "e1", Type: "pee", At: 1000, Note: "sitter's", UpdatedAt: 1000}, + }); err != nil { + t.Fatalf("guest sync: %v", err) + } + if _, err := store.sync(ownerID, "", "", []Event{ + {ID: "e1", Type: "pee", At: 1000, Note: "corrected", UpdatedAt: 2000}, + }); err != nil { + t.Fatalf("owner edit: %v", err) + } + if note, _ := eventState(t, a.db, "e1"); note != "corrected" { + t.Errorf("the owner could not edit a guest's event: note = %q", note) + } + // And delete it. A tombstone is just another update, so this rides the same + // clause — but it is the half that matters if a sitter logs something wrong + // and the owner wants it gone rather than fixed. + if _, err := store.sync(ownerID, "", "", []Event{ + {ID: "e1", Type: "pee", At: 1000, Note: "corrected", UpdatedAt: 3000, Deleted: true}, + }); err != nil { + t.Fatalf("owner delete: %v", err) + } + if _, deleted := eventState(t, a.db, "e1"); !deleted { + t.Error("the owner could not delete a guest's event") + } +} + +// Guests still log freely — the guard is on changing what already exists. +func TestGuestCanStillAddEvents(t *testing.T) { + a := testAuth(t) + store := newStore(a.db) + ownerID := testOwner(t, a) + + merged, err := store.sync(ownerID, "Anna", "s1", []Event{ + {ID: "e1", Type: "pee", At: 1000, UpdatedAt: 1000}, + }) + if err != nil { + t.Fatalf("guest sync: %v", err) + } + if len(merged) != 1 || merged[0].ID != "e1" { + t.Fatalf("guest's new event did not land: %+v", merged) + } +} + +// ---------- link expiry ---------- + +func TestShareExpiryIsWhateverWasAskedFor(t *testing.T) { + a := testAuth(t) + ownerID := testOwner(t, a) + want := hoursAhead(53) // an odd span no fixed duration would produce + link, err := a.createShare(ownerID, "Anna", want) + if err != nil { + t.Fatalf("create share: %v", err) + } + if link.Expires != want { + t.Errorf("link expires at %d, want the requested %d", link.Expires, want) + } +} + +func TestCreateShareRejectsBadDates(t *testing.T) { + a := testAuth(t) + ownerID := testOwner(t, a) + owner, err := a.startSession(ownerID, "", time.Now().Add(sessionValidity).UnixMilli()) + if err != nil { + t.Fatalf("start session: %v", err) + } + + for _, tc := range []struct { + name string + expires int64 + }{ + {"in the past", time.Now().Add(-time.Hour).UnixMilli()}, + {"missing", 0}, + {"absurdly far off", time.Now().Add(5 * 365 * 24 * time.Hour).UnixMilli()}, + } { + body := `{"label":"Anna","expires":` + strconv.FormatInt(tc.expires, 10) + `}` + w := httptest.NewRecorder() + a.requireOwner(a.handleShares)(w, request(http.MethodPost, "/api/shares", owner, body)) + if w.Code != http.StatusBadRequest { + t.Errorf("%s: got %d, want %d", tc.name, w.Code, http.StatusBadRequest) + } + } +} diff --git a/server/main.go b/server/main.go index 16e441d..0465d67 100644 --- a/server/main.go +++ b/server/main.go @@ -34,6 +34,15 @@ type Event struct { ExerciseID string `json:"exerciseId,omitempty"` // for "training" events UpdatedAt int64 `json:"updatedAt"` Deleted bool `json:"deleted,omitempty"` + // LoggedBy names the guest link an event was logged through, empty for the + // owner's own. It is stamped by the server from the session (see Store.sync) + // and never read off the wire, so a client can neither forge nor rewrite it. + LoggedBy string `json:"loggedBy,omitempty"` + // LoggedByShare is that link's id. LoggedBy is a label the owner typed and + // two links may well share one ("Sitter"), so the id — not the label — is + // what decides whether a guest may change this event. Sent to the client so + // it can grey out what it isn't allowed to touch; opaque and harmless. + LoggedByShare string `json:"loggedByShare,omitempty"` } // Exercise is a user-defined training exercise (e.g. "Sit", "Leash walking"): @@ -131,8 +140,11 @@ func newStore(db *sql.DB) *Store { // sync merges one user's client events into the store using last-write-wins by // UpdatedAt, then returns that user's full merged set (tombstones included, as -// they must propagate). -func (s *Store) sync(userID string, client []Event) ([]Event, error) { +// they must propagate). loggedBy/shareID describe the caller's session — the +// guest link's label and id, both empty for the owner. They are stamped onto +// events this call inserts, and shareID additionally decides which existing +// events the caller is allowed to change. +func (s *Store) sync(userID, loggedBy, shareID string, client []Event) ([]Event, error) { tx, err := s.db.Begin() if err != nil { return nil, err @@ -141,19 +153,34 @@ func (s *Store) sync(userID string, client []Event) ([]Event, error) { // The WHERE clause on the upsert is the last-write-wins rule: an incoming // event only overwrites the stored one when its updatedAt is strictly newer. - // The `events.user_id = excluded.user_id` guard means one user can never - // clobber another's row even if a client forges a colliding event ID — - // the row stays put and, because reads are scoped, stays invisible to them. + // Two further guards ride on it: + // + // - events.user_id = excluded.user_id — one user can never clobber + // another's row even if a client forges a colliding event ID; the row + // stays put and, because reads are scoped, stays invisible to them. + // - the logged_by_share clause — an owner (excluded.logged_by_share = '') + // may change anything; a guest may only change events logged through + // their own link. So a sitter can fix up their own entries, and cannot + // edit or delete a single one of the owner's. A rejected row simply + // stays as it was, and the caller gets the stored version back. + // + // The two attribution columns are deliberately absent from the DO UPDATE SET + // list: attribution is decided once, by whoever first inserted the event, and + // a later edit by anyone leaves it alone. That is also what makes it + // unspoofable — a guest re-POSTs the owner's whole event list on every sync, + // but those rows already exist and so keep their stored values. stmt, err := tx.Prepare(` - INSERT INTO events (id, type, at, note, photo_id, weight, grams, exercise_id, updated, deleted, user_id) - VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) + INSERT INTO events (id, type, at, note, photo_id, weight, grams, exercise_id, updated, deleted, user_id, logged_by, logged_by_share) + VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(id) DO UPDATE SET type = excluded.type, at = excluded.at, note = excluded.note, photo_id = excluded.photo_id, weight = excluded.weight, grams = excluded.grams, exercise_id = excluded.exercise_id, updated = excluded.updated, deleted = excluded.deleted WHERE excluded.updated > events.updated - AND events.user_id = excluded.user_id`) + AND events.user_id = excluded.user_id + AND (excluded.logged_by_share = '' + OR events.logged_by_share = excluded.logged_by_share)`) if err != nil { return nil, err } @@ -164,7 +191,7 @@ func (s *Store) sync(userID string, client []Event) ([]Event, error) { continue } if _, err := stmt.Exec( - ce.ID, ce.Type, ce.At, ce.Note, ce.PhotoID, ce.Weight, ce.Grams, ce.ExerciseID, ce.UpdatedAt, ce.Deleted, userID, + ce.ID, ce.Type, ce.At, ce.Note, ce.PhotoID, ce.Weight, ce.Grams, ce.ExerciseID, ce.UpdatedAt, ce.Deleted, userID, loggedBy, shareID, ); err != nil { return nil, err } @@ -178,7 +205,7 @@ func (s *Store) sync(userID string, client []Event) ([]Event, error) { // all returns one user's events, tombstones included. func (s *Store) all(userID string) ([]Event, error) { rows, err := s.db.Query( - `SELECT id, type, at, note, photo_id, weight, grams, exercise_id, updated, deleted + `SELECT id, type, at, note, photo_id, weight, grams, exercise_id, updated, deleted, logged_by, logged_by_share FROM events WHERE user_id = ?`, userID) if err != nil { return nil, err @@ -188,7 +215,7 @@ func (s *Store) all(userID string) ([]Event, error) { for rows.Next() { var e Event if err := rows.Scan( - &e.ID, &e.Type, &e.At, &e.Note, &e.PhotoID, &e.Weight, &e.Grams, &e.ExerciseID, &e.UpdatedAt, &e.Deleted, + &e.ID, &e.Type, &e.At, &e.Note, &e.PhotoID, &e.Weight, &e.Grams, &e.ExerciseID, &e.UpdatedAt, &e.Deleted, &e.LoggedBy, &e.LoggedByShare, ); err != nil { return nil, err } @@ -289,17 +316,19 @@ func openDB(path string) (*sql.DB, error) { // the first account adopts it (see Auth.adopt). schema := ` CREATE TABLE IF NOT EXISTS events ( - id TEXT PRIMARY KEY, - type TEXT NOT NULL DEFAULT '', - at INTEGER NOT NULL DEFAULT 0, - note TEXT NOT NULL DEFAULT '', - photo_id TEXT NOT NULL DEFAULT '', - weight REAL NOT NULL DEFAULT 0, - grams REAL NOT NULL DEFAULT 0, - exercise_id TEXT NOT NULL DEFAULT '', - updated INTEGER NOT NULL DEFAULT 0, - deleted INTEGER NOT NULL DEFAULT 0, - user_id TEXT NOT NULL DEFAULT '' + id TEXT PRIMARY KEY, + type TEXT NOT NULL DEFAULT '', + at INTEGER NOT NULL DEFAULT 0, + note TEXT NOT NULL DEFAULT '', + photo_id TEXT NOT NULL DEFAULT '', + weight REAL NOT NULL DEFAULT 0, + grams REAL NOT NULL DEFAULT 0, + exercise_id TEXT NOT NULL DEFAULT '', + updated INTEGER NOT NULL DEFAULT 0, + deleted INTEGER NOT NULL DEFAULT 0, + user_id TEXT NOT NULL DEFAULT '', + logged_by TEXT NOT NULL DEFAULT '', + logged_by_share TEXT NOT NULL DEFAULT '' ); CREATE INDEX IF NOT EXISTS idx_events_user ON events(user_id); CREATE TABLE IF NOT EXISTS exercises ( @@ -325,11 +354,23 @@ func openDB(path string) (*sql.DB, error) { created INTEGER NOT NULL ); CREATE TABLE IF NOT EXISTS sessions ( - token TEXT PRIMARY KEY, - user_id TEXT NOT NULL, - created INTEGER NOT NULL, - expires INTEGER NOT NULL + token TEXT PRIMARY KEY, + user_id TEXT NOT NULL, + created INTEGER NOT NULL, + expires INTEGER NOT NULL, + share_id TEXT NOT NULL DEFAULT '' ); + CREATE TABLE IF NOT EXISTS share_links ( + id TEXT PRIMARY KEY, + user_id TEXT NOT NULL, + token TEXT NOT NULL UNIQUE, + label TEXT NOT NULL DEFAULT '', + created INTEGER NOT NULL, + expires INTEGER NOT NULL, + last_used INTEGER NOT NULL DEFAULT 0, + revoked INTEGER NOT NULL DEFAULT 0 + ); + CREATE INDEX IF NOT EXISTS idx_share_links_user ON share_links(user_id); CREATE TABLE IF NOT EXISTS pedigree_cache ( hundid TEXT PRIMARY KEY, subject TEXT NOT NULL DEFAULT '', @@ -401,6 +442,36 @@ func migrateSchema(db *sql.DB) error { return err } } + // Guest links (see Auth.createShare). Every column defaults to the empty + // string, which is exactly what pre-guest-link rows mean: an event nobody + // but the owner logged, and a session that isn't a guest's. + hasLoggedBy, err := columnExists(db, "events", "logged_by") + if err != nil { + return err + } + if !hasLoggedBy { + if _, err := db.Exec(`ALTER TABLE events ADD COLUMN logged_by TEXT NOT NULL DEFAULT ''`); err != nil { + return err + } + } + hasLoggedByShare, err := columnExists(db, "events", "logged_by_share") + if err != nil { + return err + } + if !hasLoggedByShare { + if _, err := db.Exec(`ALTER TABLE events ADD COLUMN logged_by_share TEXT NOT NULL DEFAULT ''`); err != nil { + return err + } + } + hasShareID, err := columnExists(db, "sessions", "share_id") + if err != nil { + return err + } + if !hasShareID { + if _, err := db.Exec(`ALTER TABLE sessions ADD COLUMN share_id TEXT NOT NULL DEFAULT ''`); err != nil { + return err + } + } oldConfig, err := columnExists(db, "config", "id") if err != nil { return err @@ -494,7 +565,7 @@ func importEvents(db *sql.DB, path string) error { // Imported as ownerless (user_id = ""); the first account to register adopts // them. Mirrors how in-place schema migration parks legacy rows. store := newStore(db) - if _, err := store.sync("", evs); err != nil { + if _, err := store.sync("", "", "", evs); err != nil { return err } log.Printf("migrated %d events from %s", len(evs), path) @@ -686,12 +757,24 @@ func main() { case http.MethodGet: auth.handleMe(w, r) case http.MethodDelete: + // Deleting the account is the owner's alone, so this arm — and only + // this arm — is gated; a guest still needs the GET to learn its role. + if isGuest(r) { + http.Error(w, "guest links cannot do this", http.StatusForbidden) + return + } auth.handleDeleteAccount(w, r) default: http.Error(w, "method not allowed", http.StatusMethodNotAllowed) } })) + // Guest links: minting, listing and revoking are the owner's, redeeming is + // the unauthenticated entry point the link itself points at. + mux.HandleFunc("/api/shares", auth.requireOwner(auth.handleShares)) + mux.HandleFunc("/api/shares/", auth.requireOwner(auth.handleShare)) + mux.HandleFunc("/guest/", auth.handleRedeem) + mux.HandleFunc("/api/events/sync", auth.requireUser(func(w http.ResponseWriter, r *http.Request) { if r.Method != http.MethodPost { http.Error(w, "method not allowed", http.StatusMethodNotAllowed) @@ -702,7 +785,7 @@ func main() { http.Error(w, "bad json: "+err.Error(), http.StatusBadRequest) return } - merged, err := store.sync(userID(r), req.Events) + merged, err := store.sync(userID(r), guestLabel(r), sessionOf(r).shareID, req.Events) if err != nil { log.Printf("sync: %v", err) http.Error(w, "server error", http.StatusInternalServerError) @@ -728,7 +811,16 @@ func main() { http.Error(w, "bad json: "+err.Error(), http.StatusBadRequest) return } - merged, err := exerciseStore.sync(userID(r), req.Exercises) + // Exercises are the owner's library, not a log: a guest logs training + // sessions against them (ordinary events) but does not get to rename or + // delete them. Dropping the incoming list makes this direction-only — + // the guest still receives the full set back. The client hides the + // editing UI to match; this is the part that enforces it. + incoming := req.Exercises + if isGuest(r) { + incoming = nil + } + merged, err := exerciseStore.sync(userID(r), incoming) if err != nil { log.Printf("exercises sync: %v", err) http.Error(w, "server error", http.StatusInternalServerError) @@ -751,6 +843,13 @@ func main() { case http.MethodGet: writeConfig(configStore.get(userID(r))) case http.MethodPut, http.MethodPost: + // The profile (name, birthday, pedigree id) is the owner's to set. + // The GET above stays open — a guest needs the name and birthday to + // render the header at all. + if isGuest(r) { + http.Error(w, "guest links cannot do this", http.StatusForbidden) + return + } var in Config if err := json.NewDecoder(io.LimitReader(r.Body, 1<<16)).Decode(&in); err != nil { http.Error(w, "bad json: "+err.Error(), http.StatusBadRequest) @@ -800,13 +899,15 @@ func main() { // Push reminders. Registered only when the scheduler came up, so a server // without a usable VAPID key 404s these rather than half-working — which is - // also what tells the client to hide the reminder UI entirely. + // also what tells the client to hide the reminder UI entirely. Owner-only: + // the reminders are the owner's own, and a guest device subscribing would + // route them to the sitter's lock screen. if scheduler != nil { - mux.HandleFunc("/api/push/key", auth.requireUser(scheduler.handleKey)) - mux.HandleFunc("/api/push/subscribe", auth.requireUser(scheduler.handleSubscribe)) - mux.HandleFunc("/api/push/unsubscribe", auth.requireUser(scheduler.handleUnsubscribe)) - mux.HandleFunc("/api/push/test", auth.requireUser(scheduler.handleTest)) - mux.HandleFunc("/api/reminders", auth.requireUser(scheduler.handleReminders)) + mux.HandleFunc("/api/push/key", auth.requireOwner(scheduler.handleKey)) + mux.HandleFunc("/api/push/subscribe", auth.requireOwner(scheduler.handleSubscribe)) + mux.HandleFunc("/api/push/unsubscribe", auth.requireOwner(scheduler.handleUnsubscribe)) + mux.HandleFunc("/api/push/test", auth.requireOwner(scheduler.handleTest)) + mux.HandleFunc("/api/reminders", auth.requireOwner(scheduler.handleReminders)) } mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) { diff --git a/src/app.js b/src/app.js index 87b702f..d12eecc 100644 --- a/src/app.js +++ b/src/app.js @@ -6,6 +6,21 @@ // cached events/profile. currentUser is set by the auth gate before the app // boots, so these are only ever called once a user is known. let currentUser = null; + // A guest is someone here on a share link (see "guest links" in the README): + // the same data as the owner, minus everything under Settings that is the + // owner's to decide. currentUser.id is the owner's either way, which is what + // keeps the cache keys below pointing at the right data. + const isGuest = () => currentUser?.role === "guest"; + const guestLabel = () => (isGuest() ? (currentUser.label || "") : ""); + const guestShareId = () => (isGuest() ? (currentUser.shareId || "") : ""); + + // Who may change an already-logged event. The owner may change anything on + // their own account; a guest may only touch what they logged themselves, so a + // sitter can fix up their own entries and cannot rewrite or delete a single + // one of the owner's. Keyed on the link id rather than its label, because two + // links can easily carry the same label ("Sitter"). The server enforces the + // same rule in Store.sync — this is what keeps the UI honest about it. + const canEditEvent = (ev) => !isGuest() || ev.loggedByShare === guestShareId(); const eventsKey = () => `puppy-tracker:${currentUser.id}:events:v1`; const configKey = () => `puppy-tracker:${currentUser.id}:config:v1`; const exercisesKey = () => `puppy-tracker:${currentUser.id}:exercises:v1`; @@ -338,6 +353,14 @@ grams: Number.isFinite(grams) ? grams : undefined, exerciseId: exerciseId || "", updatedAt: now, + // Only set when logging through a guest link, and only so the badge and + // the "you may edit this" check work before the first sync: the server + // stamps both authoritatively on insert, and mergeSynced keeps our copy + // when updatedAt ties, so without a local stamp neither would settle + // until some later edit. Both sides compute the same values, so the two + // never disagree. + loggedBy: guestLabel(), + loggedByShare: guestShareId(), }; events.push(ev); saveAll(events); @@ -1113,6 +1136,15 @@ ${escapeText(label)} `; + // Logged through a guest link: say whose, so a row you don't remember + // making has an explanation attached to it. + if (ev.loggedBy) { + const by = document.createElement("span"); + by.className = "by"; + by.textContent = ev.loggedBy; + by.title = `Logged by ${ev.loggedBy} on a guest link`; // the badge is truncated + li.querySelector(".label").after(by); + } const noteEl = li.querySelector(".note"); if (ev.type === "weight" && Number.isFinite(ev.weight)) { noteEl.textContent = ev.note ? `${formatWeight(ev.weight)} · ${ev.note}` : formatWeight(ev.weight); @@ -2422,6 +2454,8 @@ const exercises = liveExercises(); list.innerHTML = ""; empty.hidden = exercises.length > 0; + // Adding to the library is the owner's, like editing it. + document.getElementById("exercise-add").hidden = isGuest(); for (const ex of exercises) { const times = events @@ -2477,17 +2511,24 @@ detail.className = "ex-detail"; const noteEl = document.createElement("p"); noteEl.className = "ex-note"; - noteEl.textContent = ex.note || "No instructions yet — tap Edit to add how to train this."; - const editBtn = document.createElement("button"); - editBtn.type = "button"; - editBtn.className = "ghost ex-edit"; - editBtn.textContent = "Edit"; - editBtn.addEventListener("click", (e) => { - e.stopPropagation(); - openExerciseDialog(ex); - }); + noteEl.textContent = ex.note + || (isGuest() ? "No instructions for this one yet." + : "No instructions yet — tap Edit to add how to train this."); detail.appendChild(noteEl); - detail.appendChild(editBtn); + // The exercise library is the owner's, not a log: a guest trains against + // it and reads the instructions, but doesn't get to rename or delete + // anything in it. The server drops guest-sent exercises to match. + if (!isGuest()) { + const editBtn = document.createElement("button"); + editBtn.type = "button"; + editBtn.className = "ghost ex-edit"; + editBtn.textContent = "Edit"; + editBtn.addEventListener("click", (e) => { + e.stopPropagation(); + openExerciseDialog(ex); + }); + detail.appendChild(editBtn); + } li.appendChild(row); li.appendChild(detail); @@ -2529,6 +2570,8 @@ if (sleepTitle) sleepTitle.textContent = cfg.name ? `When ${cfg.name} sleeps` : "When sleeping"; const walkTitle = document.getElementById("walk-timeline-title"); if (walkTitle) walkTitle.textContent = cfg.name ? `When ${cfg.name} walks` : "When walking"; + // The guest banner names the dog too, so it follows the profile in. + renderGuestBanner(); } // Dim the quick actions that don't fit the current state — a nudge @@ -2635,7 +2678,12 @@ // newer updatedAt than the server's copy wins — that covers items the user // added/edited during the in-flight sync request. Shared by the events and // exercises collections, which follow the same LWW contract. - function mergeSynced(serverItems, load, save) { + // + // serverWins overrides that for items we are not allowed to change: the + // server will have refused the write, so keeping our newer local copy would + // leave the screen showing an edit that never happened and re-posting it + // forever. Taking the server's version instead makes the client heal itself. + function mergeSynced(serverItems, load, save, serverWins = () => false) { const localById = new Map(load().map(e => [e.id, e])); const merged = new Map(); for (const se of serverItems) { @@ -2643,6 +2691,7 @@ } for (const [id, le] of localById) { const se = merged.get(id); + if (se && serverWins(se)) continue; if (!se || (le.updatedAt || 0) > (se.updatedAt || 0)) { merged.set(id, le); } @@ -2673,17 +2722,21 @@ const exRes = await fetch("api/exercises/sync", { method: "POST", headers: { "Content-Type": "application/json" }, - body: JSON.stringify({ exercises: loadExercises() }), + // A guest receives the exercise library but never writes to it, so it + // sends nothing rather than posting a list the server would discard. + body: JSON.stringify({ exercises: isGuest() ? [] : loadExercises() }), }); if (exRes.status === 401) { handleLoggedOut(); return; } if (!exRes.ok) throw new Error(`HTTP ${exRes.status}`); const exBody = await exRes.json(); if (Array.isArray(exBody.exercises)) { - mergeSynced(exBody.exercises, loadExercises, saveExercises); + // Same reasoning as the events below: a guest's local exercise edits + // can never land, so the server's copy is always the truth. + mergeSynced(exBody.exercises, loadExercises, saveExercises, isGuest); } if (Array.isArray(body.events)) { - mergeSynced(body.events, loadAll, saveAll); + mergeSynced(body.events, loadAll, saveAll, (ev) => !canEditEvent(ev)); } lastSynced = Date.now(); lastError = null; @@ -2925,7 +2978,12 @@ const editDate = document.getElementById("edit-date"); const editTime = document.getElementById("edit-time"); const editNote = document.getElementById("edit-note"); + const editLoggedBy = document.getElementById("edit-logged-by"); + const editReadOnly = document.getElementById("edit-readonly"); + const editTitle = document.getElementById("edit-title"); const editDelete = document.getElementById("edit-delete"); + const editSave = document.querySelector('#edit-form button[value="save"]'); + const editCancel = document.querySelector('#edit-form button[value="cancel"]'); const editPhotoInput = document.getElementById("edit-photo-input"); const editPhotoBtn = document.getElementById("edit-photo-btn"); const editPhotoPreview = document.getElementById("edit-photo-preview"); @@ -2957,8 +3015,26 @@ editPhotoInput.value = ""; } + // Turns the edit dialog into a viewer: every field disabled, Save and Delete + // gone, only Cancel left. Used when a guest opens an entry that isn't theirs + // — the server would refuse the change anyway (Store.sync), and a form that + // silently discards what you typed is worse than one that says it is closed. + function setEditReadOnly(on) { + editReadOnly.hidden = !on; + editTitle.textContent = on ? "Event" : "Edit event"; + for (const el of [editDate, editTime, editNote, editWeight, editGrams, editPhotoBtn]) { + el.disabled = on; + } + editDelete.hidden = on; + editSave.hidden = on; + editCancel.textContent = on ? "Close" : "Cancel"; + } + async function openEditDialog(ev) { editingId = ev.id; + editLoggedBy.hidden = !ev.loggedBy; + if (ev.loggedBy) editLoggedBy.textContent = `Logged by ${ev.loggedBy} on a guest link.`; + setEditReadOnly(!canEditEvent(ev)); editDate.value = toDateInput(ev.at); editTime.value = toTimeInput(ev.at); editNote.value = ev.note || ""; @@ -3075,6 +3151,8 @@ const settingsPedigree = document.getElementById("settings-pedigree"); const settingsTheme = document.getElementById("settings-theme"); const settingsConfetti = document.getElementById("settings-confetti"); + const settingsProfile = document.getElementById("settings-profile"); + const settingsDanger = document.getElementById("settings-danger"); // Apply live so the toggle previews immediately (independent of Save/Cancel). settingsTheme.addEventListener("change", () => { @@ -3088,15 +3166,34 @@ settingsPedigree.value = cfg.pedigreeId; settingsTheme.checked = effectiveTheme() === "dark"; settingsConfetti.checked = confettiEnabled(); + // A guest keeps the two device-local preferences and loses everything that + // belongs to the account — profile, reminders, guest links, deletion. + const guest = isGuest(); + settingsProfile.hidden = guest; + settingsDanger.hidden = guest; + guestAccess.hidden = guest; settingsDialog.showModal(); refreshRemindersUI(); - setTimeout(() => settingsName.focus(), 50); + if (!guest) { + // Re-defaulted per open: the app can sit on screen for days, and a date + // that was "tomorrow" when it launched may be in the past by now. + resetGuestExpiry(); + refreshGuestLinks(); + } + setTimeout(() => (guest ? settingsTheme : settingsName).focus(), 50); } document.getElementById("settings-btn").addEventListener("click", openSettingsDialog); settingsForm.querySelector('button[value="save"]').addEventListener("click", async (e) => { e.preventDefault(); + // A guest only ever had the two device-local toggles on screen. Saving the + // profile from here would push the blanked-out fields over the owner's. + if (isGuest()) { + setConfettiEnabled(settingsConfetti.checked); + settingsDialog.close(); + return; + } const cfg = { name: settingsName.value.trim(), birthday: settingsBirthday.value, @@ -3129,6 +3226,173 @@ settingsDialog.close(); }); + // ---------- guest links ---------- + // Hand someone a URL that logs events on this account without giving them the + // password. The server holds only a hash of the token (server/auth.go), so the + // URL is shown once, right after it is minted, and never again. + + const guestAccess = document.getElementById("guest-access"); + const guestLabelIn = document.getElementById("guest-label"); + const guestCreate = document.getElementById("guest-create"); + const guestError = document.getElementById("guest-error"); + const guestNew = document.getElementById("guest-new"); + const guestNewURL = document.getElementById("guest-new-url"); + const guestCopy = document.getElementById("guest-copy"); + const guestListEl = document.getElementById("guest-list"); + const guestEmpty = document.getElementById("guest-empty"); + const guestExpires = document.getElementById("guest-expires"); + const guestExpHint = document.getElementById("guest-expires-hint"); + + // The owner picks a date; the link dies at the end of it. Working in whole + // days is what people actually mean ("she has him until Sunday"), and doing + // the conversion here is the only place the guest's timezone is known — the + // server just stores the instant it is handed. + function guestExpiryMs() { + const [y, m, d] = (guestExpires.value || "").split("-").map(Number); + if (!y || !m || !d) return 0; + return endOfDay(new Date(y, m - 1, d)).getTime(); + } + + function renderGuestExpiryHint() { + const ms = guestExpiryMs(); + if (!ms) { guestExpHint.textContent = "Pick the last day the link should work."; return; } + if (ms <= Date.now()) { guestExpHint.textContent = "That date has already passed."; return; } + guestExpHint.textContent = `Stops working ${formatWhen(ms)}.`; + } + + // Default to tomorrow: the common case is a sitter for the day, and a link + // that dies at midnight tonight is rarely what anyone wants. + function resetGuestExpiry() { + guestExpires.min = toDateInput(Date.now()); + guestExpires.value = toDateInput(Date.now() + 86_400_000); + renderGuestExpiryHint(); + } + guestExpires.addEventListener("change", renderGuestExpiryHint); + resetGuestExpiry(); + + // The server never sees its own public origin (it may sit behind any proxy), + // so the URL is composed here, against wherever this page is actually served. + function guestURL(token) { + return new URL(`guest/${token}`, location.href).href; + } + + // Day and month as well as the weekday: a 7-day link expires on the same + // weekday it was made, which "Sun 09:00" alone wouldn't tell apart. + function formatWhen(ms) { + return new Date(ms).toLocaleString(undefined, { + weekday: "short", day: "numeric", month: "short", + hour: "2-digit", minute: "2-digit", + }); + } + + function renderGuestLinks(links) { + guestListEl.innerHTML = ""; + guestEmpty.textContent = "No active links."; // may hold a stale error + guestEmpty.hidden = links.length > 0; + for (const l of links) { + const li = document.createElement("li"); + li.className = "guest-item"; + const used = l.lastUsed + ? `last used ${formatRelative(l.lastUsed)}` + : "never used"; + li.innerHTML = ` + + + + + `; + li.querySelector(".guest-item-label").textContent = l.label; + li.querySelector(".guest-item-sub").textContent = `expires ${formatWhen(l.expires)} · ${used}`; + const revoke = document.createElement("button"); + revoke.type = "button"; + revoke.className = "linklike guest-revoke"; + revoke.textContent = "Revoke"; + revoke.addEventListener("click", () => revokeGuestLink(l.id, l.label)); + li.appendChild(revoke); + guestListEl.appendChild(li); + } + } + + async function refreshGuestLinks() { + guestNew.hidden = true; + guestError.hidden = true; + try { + const res = await fetch("api/shares"); + if (!res.ok) throw new Error(`HTTP ${res.status}`); + const body = await res.json(); + renderGuestLinks(Array.isArray(body.links) ? body.links : []); + } catch (err) { + // Offline is the common case here and not worth an error: the list is + // server state, so it simply isn't knowable right now. + guestListEl.innerHTML = ""; + guestEmpty.hidden = false; + guestEmpty.textContent = navigator.onLine + ? "Couldn't load your links." + : "Offline — guest links need a connection."; + } + } + + guestCreate.addEventListener("click", async () => { + guestError.hidden = true; + const expires = guestExpiryMs(); + if (!expires || expires <= Date.now()) { + guestError.textContent = "Pick a date in the future for the link to stop working."; + guestError.hidden = false; + return; + } + guestCreate.disabled = true; + try { + const res = await fetch("api/shares", { + method: "POST", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ label: guestLabelIn.value.trim(), expires }), + }); + if (!res.ok) throw new Error((await res.text()).trim() || `HTTP ${res.status}`); + const link = await res.json(); + guestLabelIn.value = ""; + resetGuestExpiry(); + // The refresh clears any previously shown URL, so reveal this one after + // it, not before. + await refreshGuestLinks(); + guestNewURL.textContent = guestURL(link.token); + guestCopy.textContent = "Copy link"; + guestNew.hidden = false; + } catch (err) { + guestError.textContent = err.message || "Couldn't create a link"; + guestError.hidden = false; + } finally { + guestCreate.disabled = false; + } + }); + + guestCopy.addEventListener("click", async () => { + try { + await navigator.clipboard.writeText(guestNewURL.textContent); + guestCopy.textContent = "Copied"; + setTimeout(() => { guestCopy.textContent = "Copy link"; }, 1500); + } catch { + // Clipboard needs a secure context and can be refused; the URL is on + // screen either way, so select it and let them copy by hand. + const range = document.createRange(); + range.selectNodeContents(guestNewURL); + const sel = getSelection(); + sel.removeAllRanges(); + sel.addRange(range); + } + }); + + async function revokeGuestLink(id, label) { + if (!confirm(`Turn off the link for “${label}”? Whoever has it loses access straight away.`)) return; + try { + const res = await fetch(`api/shares/${encodeURIComponent(id)}`, { method: "DELETE" }); + if (!res.ok && res.status !== 404) throw new Error(`HTTP ${res.status}`); + await refreshGuestLinks(); + } catch (err) { + guestError.textContent = err.message || "Couldn't revoke that link"; + guestError.hidden = false; + } + } + // ---------- reminders ---------- // The server decides when a reminder is due and pushes it (server/reminders.go); // this side only manages the browser's push subscription and the rule settings. @@ -3308,6 +3572,11 @@ // available at all (the server may have no VAPID key, the browser may have no // push support) and refreshes an existing subscription. async function initReminders() { + // Reminders belong to the account, not the device: a guest subscribing here + // would route the owner's reminders to the sitter's lock screen. The server + // refuses these routes for a guest anyway; bailing early keeps the section + // from flashing up on iOS, where it appears before any request is made. + if (isGuest()) return; if (!pushSupported()) { // On iOS this is the Home Screen requirement rather than a missing feature, // and it's worth saying so — the toggle is otherwise just absent. @@ -4064,11 +4333,7 @@ } // Account is gone server-side. Wipe this user's local cache before the // reload drops us back on the login screen. - try { - localStorage.removeItem(eventsKey()); - localStorage.removeItem(configKey()); - localStorage.removeItem(exercisesKey()); - } catch { /* ignore */ } + clearLocalCache(); clearUser(); deleteAccountDialog.close(); location.reload(); @@ -4419,6 +4684,9 @@ const authSub = document.getElementById("auth-sub"); const authToggleBtn= document.getElementById("auth-toggle-btn"); const authToggleTxt= document.getElementById("auth-toggle-text"); + const authCard = document.getElementById("auth-card"); + const guestEnded = document.getElementById("guest-ended"); + const guestBanner = document.getElementById("guest-banner"); let authMode = "login"; // or "register" let appStarted = false; @@ -4477,23 +4745,56 @@ initReminders(); } - function showAuth() { + // ended: show the "guest link has run out" card instead of the sign-in form, + // which a guest has no credentials to fill in anyway. + function showAuth({ ended = false } = {}) { appEl.hidden = true; + authCard.hidden = ended; + guestEnded.hidden = !ended; authScreen.hidden = false; } function showApp() { authScreen.hidden = true; appEl.hidden = false; + renderGuestBanner(); + } + + // Says whose account this is, under which name the guest's entries will + // appear, and when the link runs out. Owners never see it. + function renderGuestBanner() { + if (!isGuest()) { guestBanner.hidden = true; return; } + const name = loadConfig().name; + const until = currentUser.expires + ? ` · access ends ${formatWhen(currentUser.expires)}` + : ""; + guestBanner.textContent = + `Guest access${name ? ` to ${name}` : ""} as ${currentUser.label}` + + `${until} — anything you log is tagged with your name.`; + guestBanner.hidden = false; } // Called when the server reports we're no longer authenticated (expired or - // revoked session). Drop back to the login screen without wiping the local - // cache — logging back in as the same user picks it straight back up. + // revoked session). An owner just drops back to the login screen with their + // cache intact — signing back in picks it straight back up. A guest's link + // has ended for good, so their copy of someone else's history should not stay + // sitting in their browser: wipe it, and say what happened. function handleLoggedOut() { + const wasGuest = isGuest(); + if (wasGuest) clearLocalCache(); clearUser(); setStatus("offline"); - showAuth(); + showAuth({ ended: wasGuest }); + } + + // Drops this account's cached data from localStorage. currentUser must still + // be set, since the keys are namespaced by its id. + function clearLocalCache() { + try { + localStorage.removeItem(eventsKey()); + localStorage.removeItem(configKey()); + localStorage.removeItem(exercisesKey()); + } catch { /* ignore */ } } function renderAuthMode() { @@ -4542,6 +4843,9 @@ }); document.getElementById("logout-btn").addEventListener("click", async () => { + // Leaving as a guest ends this session but not the link — they can tap it + // again. Their cache goes either way; it is someone else's record. + if (isGuest()) clearLocalCache(); try { await fetch("api/logout", { method: "POST" }); } catch { /* ignore */ } clearUser(); // Full reload is the simplest way to clear in-memory app state and timers. @@ -4553,10 +4857,19 @@ // last cached session so offline data stays reachable — a later sync will // 401 and bounce to login if that session has actually gone stale. (async function bootstrap() { + // /guest/ bounces here with this marker when the link was already + // expired or revoked, so we can say so rather than show a sign-in form. + const params = new URLSearchParams(location.search); + const deadLink = params.get("guest") === "expired"; + if (params.has("guest")) { + history.replaceState(null, "", location.pathname); + } + try { const res = await fetch("api/me"); if (res.ok) { setUser(await res.json()); + applyRole(); showApp(); startApp(); return; @@ -4566,12 +4879,22 @@ const cached = cachedUser(); if (cached) { currentUser = cached; + applyRole(); showApp(); startApp(); return; } } renderAuthMode(); - showAuth(); + showAuth({ ended: deadLink }); })(); + + // One-time, role-dependent chrome. Everything else a guest sees or doesn't is + // decided when the relevant dialog opens. + function applyRole() { + if (!isGuest()) return; + const leave = document.getElementById("logout-btn"); + leave.setAttribute("aria-label", "Leave"); + leave.title = "Leave"; + } })(); diff --git a/src/changelog.json b/src/changelog.json index 70fb1df..72ef0e2 100644 --- a/src/changelog.json +++ b/src/changelog.json @@ -1,4 +1,5 @@ [ + { "date": "2026-09-06", "text": "You can hand someone temporary access without giving them your login. Settings → “Guest access” creates a link — say who it's for and pick the last day it should work — and whoever opens it lands straight in the app on your dog, able to log events and read all the history and charts. They can't change your entries: a guest may fix up or delete what they logged themselves, but everything you logged is read-only to them, and so is the puppy profile, the pedigree ID, your reminders, the exercise list, other guest links and deleting the account. You can still edit anything on your own account, theirs included. The link is shown once when you make it, so copy it then; every live link is listed in Settings with when it expires and when it was last used, and Revoke cuts access off immediately, mid-session. Anything logged on a link is tagged with that link's name in the History log — “💧 Pee · Anna” — and the tag sticks even if you edit the entry afterwards" }, { "date": "2026-09-04", "text": "The three day-long charts — “By hour of day”, “When sleeping” and “When walking” — now mark the current time with a small vertical line and caret. On the sleeping and walking rows it also shows where today's row stops, and it lines the same clock position up across every day above it" }, { "date": "2026-09-01", "text": "Removed the walking goal from the Walk trend — the dashed target line, its legend chip and the ✓ that marked a day as met. It came from the “five-minute rule” (five minutes per month of age, twice a day), which is a widely repeated rule of thumb rather than veterinary guidance, and the app was stating it more confidently than it deserved. The chart is now just a record of what you walked, against yesterday and the average" }, { "date": "2026-09-01", "text": "The 7d / 14d / 30d buttons have moved out of the Sleep panel onto their own “Charts cover” row, just under the Log event buttons. They always set the window for every chart on the page — training, timing, sleep, walks, pees/poos/meals — but sitting inside the Sleep panel made them look like a sleep setting" }, diff --git a/src/index.html b/src/index.html index 9927d24..d9be028 100644 --- a/src/index.html +++ b/src/index.html @@ -40,7 +40,7 @@ + + +
+
+

Guest access

+

+ A link that lets someone log events on this account — no password, + no account of their own. It stops working on its own, and you can + turn it off at any time. +

+ + +

+ + + + + + +
    +

    No active links.

    +
    + -
    - +
    +
    + +
    @@ -524,7 +581,14 @@
    -

    Edit event

    +

    Edit event

    + + +