set Kepr up in the browser on first run with a one-time code from the terminal, then hand over without a restart (v3.0.158)

@@ -0,0 +1,150 @@1+import { timingSafeEqual } from "node:crypto";2+import { join } from "node:path";3+import { type Context, Hono } from "hono";4+import { bodyLimit } from "hono/body-limit";5+import { checkS3Access } from "../bucket/reader.ts";6+import { isSafePath } from "../bucket/repo.ts";7+import { html } from "../pages/html.ts";8+import { page } from "../pages/layout.ts";9+import { PUBLIC_DIR, securityHeaders } from "../server/app.ts";10+import { type Config, isDomain, saveConfig } from "../server/config.ts";11+import { typedCode } from "../server/connect.ts";12+import { openKeprDb } from "../server/db.ts";13+import { MIN_PASSWORD } from "./account.ts";14+import { folderCandidate, s3Candidate } from "./bucket.ts";15+16+const MAX_WRONG_CODES = 10;17+18+type SetupOptions = {19+	/** The one-time code printed in the terminal, as `oneTimeCode` makes it. */20+	code: string;21+	configPath: string;22+	dataDir: string;23+	/** Called once with the saved config, so the caller can start the real app. */24+	done: (config: Config) => void;25+};26+27+/**28+ * First-run setup (June, 2026-09-30): with no kepr.toml, Kepr serves only this. Whoever holds the29+ * code from the terminal sets the admin password, the domain and the bucket; Kepr checks them, writes30+ * kepr.toml itself, and hands over. Ten wrong codes lock it until a restart makes a new code.31+ */32+export function createSetupApp(options: SetupOptions): Hono {33+	const kepr = openKeprDb(options.dataDir);34+	const app = new Hono();35+	let wrong = 0;36+	let finished = false;37+	app.use(securityHeaders());38+	app.use(bodyLimit({ maxSize: 64 * 1024 }));39+	app.get("/static/:path{.+}", async (c) => {40+		const path = c.req.param("path");41+		const file = Bun.file(join(PUBLIC_DIR, path));42+		if (!isSafePath(path) || path.startsWith("assets/") || !(await file.exists())) {43+			return c.notFound();44+		}45+		return c.body(await file.bytes(), 200, { "Content-Type": file.type });46+	});47+	app.get("/setup", (c) => c.html(setupPage(c, kepr, "")));48+	app.post("/setup", async (c) => {49+		if (finished) return c.notFound();50+		const refuse = (status: 400 | 403 | 429, error: string) =>51+			c.html(setupPage(c, kepr, error, fields), status);52+		const fields: Record<string, string> = {};53+		// No session yet to tie a form token to: the code is the credential, and the origin must54+		// be this host, so another site can't post a guess on the operator's behalf.55+		const host = c.req.header("host") ?? "";56+		const origin = c.req.header("origin") ?? "";57+		if (origin !== `http://${host}` && origin !== `https://${host}`) {58+			return refuse(403, "Refused: wrong origin.");59+		}60+		for (const [name, value] of Object.entries(await c.req.parseBody())) {61+			if (typeof value === "string") fields[name] = value;62+		}63+		if (wrong >= MAX_WRONG_CODES)64+			return refuse(429, "Too many wrong codes. Restart Kepr for a new code.");65+		const code = typedCode(fields.code ?? "") ?? "";66+		const right = Buffer.from(options.code);67+		if (code.length !== right.length || !timingSafeEqual(Buffer.from(code), right)) {68+			wrong++;69+			return refuse(403, "That setup code is not right.");70+		}71+		const password = fields.password ?? "";72+		if (password.length < MIN_PASSWORD) {73+			return refuse(400, `The password needs at least ${MIN_PASSWORD} characters.`);74+		}75+		if (password !== fields.confirm) return refuse(400, "The two passwords differ.");76+		const domain = (fields.domain ?? "").trim().toLowerCase();77+		if (!isDomain(domain)) {78+			return refuse(79+				400,80+				"The domain is a bare hostname, such as code.example.com, with an optional :port.",81+			);82+		}83+		const bucket =84+			fields.source === "s3"85+				? s3Candidate(fields, null)86+				: await folderCandidate(fields.folder ?? "");87+		if (typeof bucket === "string") return refuse(400, bucket);88+		const unreachable = bucket.kind === "s3" ? await checkS3Access(bucket) : null;89+		if (unreachable) return refuse(400, unreachable);90+		const config: Config = {91+			domain,92+			dataDir: options.dataDir,93+			adminPasswordHash: await Bun.password.hash(password, "argon2id"),94+			bucket,95+		};96+		await saveConfig(options.configPath, config);97+		finished = true;98+		kepr.close();99+		options.done(config);100+		return c.redirect("/sign-in", 303);101+	});102+	app.all("*", (c) => (finished ? c.notFound() : c.redirect("/setup", 302)));103+	return app;104+}105+106+function setupPage(107+	c: Context,108+	kepr: ReturnType<typeof openKeprDb>,109+	error: string,110+	fields: Record<string, string> = {},111+): string {112+	const host = c.req.header("host") ?? "localhost";113+	const value = (name: string, fallback = "") => fields[name] ?? fallback;114+	const input = (name: string, label: string, fallback = "", type = "text") =>115+		html`<label class="issues-label" for="setup-${name}">${label}</label>116+<input class="issues-input mono" id="setup-${name}" name="${name}" type="${type}"117+value="${type === "password" ? "" : value(name, fallback)}" autocomplete="off" spellcheck="false">`;118+	const s3 = fields.source === "s3";119+	const body = html`<div class="admin-content">120+<header class="admin-heading"><span class="section-label mono">first run</span>121+<h1>Set up Kepr</h1></header>122+${error && html`<p class="issues-error mono" role="alert">${error}</p>`}123+<p class="admin-intro">Kepr printed a setup code in the terminal it was started from. Enter it here124+with the rest; Kepr checks everything, saves it, and takes you to sign in. Every setting can be125+changed later in the console.</p>126+<form class="issues-form" method="post" action="/setup">127+${input("code", "setup code")}128+${input("domain", "domain", host)}129+${input("password", `admin password (at least ${MIN_PASSWORD} characters)`, "", "password")}130+${input("confirm", "admin password again", "", "password")}131+<fieldset class="issues-form"><legend class="issues-label">where your repos are</legend>132+<label class="issues-label"><input type="radio" name="source" value="s3"${s3 ? html` checked` : ""}>133+an S3 bucket Koh offers to</label>134+${input("endpoint", "endpoint", "https://s3.fr-par.scw.cloud")}135+${input("name", "bucket name")}136+${input("region", "region")}137+${input("access_key_id", "read access key ID")}138+${input("secret_access_key", "read secret key", "", "password")}139+<p class="muted">A write key, a backup bucket and email can be added in the console afterwards.</p>140+<label class="issues-label"><input type="radio" name="source" value="folder"${s3 ? "" : html` checked`}>141+a Koh folder remote on this server</label>142+${input("folder", "folder", "", "text")}143+</fieldset>144+<button class="issues-submit" type="submit">save and continue</button>145+</form></div>`;146+	return page(147+		{ domain: host, kepr, mirrorDir: "" },148+		{ title: "setup", description: "", path: "/setup", body },149+	);150+}

@@ -0,0 +1,107 @@1+// Covers first-run setup (June, 2026-09-30): with no kepr.toml, Kepr serves only /setup, which takes2+// the one-time code printed in the terminal, then the password, domain and bucket, writes kepr.toml3+// itself, and hands over to the real app.4+5+import { beforeAll, describe, expect, test } from "bun:test";6+import { mkdtemp } from "node:fs/promises";7+import { tmpdir } from "node:os";8+import { join } from "node:path";9+import { createSetupApp } from "../src/admin/setup.ts";10+import { type Config, loadConfig } from "../src/server/config.ts";11+import { makeRepos } from "./fixture.ts";12+13+const CODE = "ABCD2345";14+const PASSWORD = "a long enough first password";15+const ORIGIN = "http://localhost";16+17+async function setup() {18+	const dir = await mkdtemp(join(tmpdir(), "kepr-setup-"));19+	const configPath = join(dir, "kepr.toml");20+	const done: Config[] = [];21+	const app = createSetupApp({22+		code: CODE,23+		configPath,24+		dataDir: join(dir, "data"),25+		done: (config) => done.push(config),26+	});27+	const post = (fields: Record<string, string>, origin = ORIGIN) =>28+		app.request("/setup", {29+			method: "POST",30+			headers: { origin, host: "localhost" },31+			body: new URLSearchParams(fields),32+		});33+	return { app, configPath, done, post };34+}35+36+describe("first-run setup", () => {37+	let bucketDir: string;38+	const form = (fields: Record<string, string> = {}) => ({39+		code: "abcd-2345",40+		domain: "localhost:3000",41+		password: PASSWORD,42+		confirm: PASSWORD,43+		source: "folder",44+		folder: bucketDir,45+		...fields,46+	});47+48+	beforeAll(async () => {49+		bucketDir = (await makeRepos(["app"])).bucketDir;50+	});51+52+	test("every other path leads to /setup, which never shows the code", async () => {53+		const { app } = await setup();54+		const home = await app.request("/");55+		expect(home.status).toBe(302);56+		expect(home.headers.get("location")).toBe("/setup");57+		const page = await app.request("/setup", { headers: { host: "localhost:3000" } });58+		expect(page.status).toBe(200);59+		const text = await page.text();60+		expect(text).toContain('name="code"');61+		expect(text).toContain('value="localhost:3000"');62+		expect(text).not.toContain(CODE);63+		expect(page.headers.get("content-security-policy")).toContain("script-src 'self'");64+	});65+66+	test("refuses a wrong code, a foreign origin, and bad settings, writing nothing", async () => {67+		const { configPath, done, post } = await setup();68+		const cases: [Record<string, string>, string][] = [69+			[{ code: "ZZZZ-ZZZZ" }, "That setup code is not right."],70+			[{ password: "short", confirm: "short" }, "at least 12 characters"],71+			[{ confirm: "something else" }, "The two passwords differ."],72+			[{ domain: "https://nope" }, "The domain is a bare hostname"],73+			[{ folder: "/no/such/folder" }, "is not a folder Kepr can read"],74+			[{ source: "s3", folder: "" }, "The endpoint is required."],75+		];76+		for (const [fields, error] of cases) {77+			const response = await post(form(fields));78+			expect(response.status).toBeGreaterThanOrEqual(400);79+			expect(await response.text()).toContain(error);80+		}81+		expect((await post(form(), "https://evil.example")).status).toBe(403);82+		expect(await Bun.file(configPath).exists()).toBe(false);83+		expect(done).toEqual([]);84+	});85+86+	test("ten wrong codes lock setup until Kepr restarts", async () => {87+		const { post } = await setup();88+		for (let i = 0; i < 10; i++) await post(form({ code: "ZZZZZZZZ" }));89+		const locked = await post(form());90+		expect(locked.status).toBe(429);91+		expect(await locked.text()).toContain("Restart Kepr for a new code.");92+	});93+94+	test("the right code writes kepr.toml, hands over, and closes setup", async () => {95+		const { configPath, done, post } = await setup();96+		const response = await post(form());97+		expect(response.status).toBe(303);98+		expect(response.headers.get("location")).toBe("/sign-in");99+		const config = await loadConfig(configPath);100+		expect(config.domain).toBe("localhost:3000");101+		expect(config.bucket).toEqual({ kind: "folder", path: bucketDir });102+		expect(await Bun.password.verify(PASSWORD, config.adminPasswordHash)).toBe(true);103+		expect(done).toHaveLength(1);104+		expect(done[0]?.domain).toBe("localhost:3000");105+		expect((await post(form())).status).toBe(404);106+	});107+});