Adding temporarty keycard escape

2026-07-07 12:08:20 +02:00
parent f93bcfb8d4
commit 3fbde80bf5
7 changed files with 348 additions and 7 deletions
@@ -47,6 +47,7 @@ export function createCaStudioApi(db) {
    const labAccess = requireLabAccess();
    app.use(cookieParser());
    app.use(express.json({ limit: '1mb' }));
+    app.use(express.urlencoded({ extended: false }));
    app.use('/admin', labAccess);
    app.use('/view', labAccess);
    app.use('/api/ca', labAccess);
@@ -17,6 +17,7 @@ export function labAuthConfig() {
        keycardMeritSlug: process.env.LAB_KEYCARD_MERIT_SLUG ?? 'lab-keycard',
        keycardRequired: envFlag('LAB_KEYCARD_REQUIRED', true),
        signInUrl: process.env.LAB_SIGN_IN_URL ?? `${gnommowebUrl}/auth/google`,
+        temporarySecretKey: process.env.LAB_TEMP_SECRET_KEY ?? 'supersecret',
        userProfileUrl: process.env.LAB_USER_PROFILE_URL ?? `${gnommowebUrl}/api/user/profile`
    };
 }
@@ -38,6 +39,112 @@ function loginUrl(request, config) {
    url.searchParams.set('returnTo', returnTo);
    return url.toString();
 }
+function temporaryCookieOptions(request) {
+    const secure = request.secure || request.get('x-forwarded-proto') === 'https';
+    return {
+        httpOnly: true,
+        maxAge: 1000 * 60 * 60 * 12,
+        sameSite: 'lax',
+        secure
+    };
+}
+function hasTemporaryAccess(request, config) {
+    return Boolean(config.temporarySecretKey && request.cookies?.lab_temp_key === config.temporarySecretKey);
+}
+function isLocalLoginPath(request) {
+    return request.path === '/lab-login' || request.path === '/admin/lab-login';
+}
+function localLoginPage(config, error = '') {
+    return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>CA Lab Login</title>
+    <style>
+      body {
+        margin: 0;
+        min-height: 100vh;
+        display: grid;
+        place-items: center;
+        background: #008080;
+        color: #000;
+        font-family: "MS Sans Serif", Tahoma, Arial, sans-serif;
+      }
+      main {
+        width: min(560px, calc(100vw - 32px));
+        border: 2px solid;
+        border-color: #fff #404040 #404040 #fff;
+        background: #c0c0c0;
+        box-shadow: 4px 4px 0 rgb(0 0 0 / 0.35);
+      }
+      header {
+        padding: 6px 8px;
+        background: linear-gradient(90deg, #000080, #1084d0);
+        color: #fff;
+        font-weight: 700;
+      }
+      section { padding: 18px; }
+      h1 { margin: 0 0 10px; font-size: 1.2rem; }
+      p { line-height: 1.45; }
+      label { display: block; margin-top: 12px; font-weight: 700; }
+      input {
+        width: 100%;
+        min-height: 34px;
+        margin-top: 6px;
+        border: 2px solid;
+        border-color: #404040 #fff #fff #404040;
+        background: #fff;
+        color: #000;
+        padding: 6px 8px;
+        box-sizing: border-box;
+        font: inherit;
+      }
+      button, a {
+        display: inline-flex;
+        align-items: center;
+        justify-content: center;
+        min-height: 34px;
+        margin-top: 14px;
+        padding: 0 14px;
+        border: 2px solid;
+        border-color: #fff #404040 #404040 #fff;
+        background: #c0c0c0;
+        color: #000;
+        text-decoration: none;
+        font: inherit;
+        cursor: pointer;
+      }
+      .error { color: #800000; font-weight: 700; }
+      .actions { display: flex; flex-wrap: wrap; gap: 10px; }
+    </style>
+  </head>
+  <body>
+    <main>
+      <header>CA Lab Computer</header>
+      <section>
+        <h1>Insert lab keycard</h1>
+        <p>Sign in with your Glitch University JWT, or use the temporary lab key while access is being repaired.</p>
+        ${error ? `<p class="error">${escapeHtml(error)}</p>` : ''}
+        <form method="post" action="/admin/lab-login">
+          <label>
+            JWT token
+            <input name="jwt_token" autocomplete="off" spellcheck="false">
+          </label>
+          <label>
+            Temporary secret key
+            <input name="secret_key" type="password" autocomplete="current-password">
+          </label>
+          <div class="actions">
+            <button type="submit">Unlock lab</button>
+            <a href="${escapeHtml(config.signInUrl)}">Glitch University sign in</a>
+          </div>
+        </form>
+      </section>
+    </main>
+  </body>
+</html>`;
+}
 function lockedPage(access, config) {
    const unlockUrl = access.unlockUrl ?? `${config.gnommowebUrl}/tech-tree`;
    const reason = access.reason ?? 'Your Glitch University account does not have the CA Lab Keycard yet.';
@@ -95,6 +202,13 @@ function lockedPage(access, config) {
        <p>${escapeHtml(reason)}</p>
        <p>Earn the Cellular Automata lab merit on glitch.university, then return here.</p>
        <a href="${escapeHtml(unlockUrl)}">Go to Glitch University</a>
+        <form method="post" action="/admin/lab-login">
+          <label>
+            Temporary secret key
+            <input name="secret_key" type="password" autocomplete="current-password">
+          </label>
+          <button type="submit">Unlock temporarily</button>
+        </form>
      </section>
    </main>
  </body>
@@ -171,6 +285,31 @@ export function requireLabAccess(config = labAuthConfig()) {
            next();
            return;
        }
+        if (request.method === 'GET' && isLocalLoginPath(request)) {
+            response.type('html').send(localLoginPage(config));
+            return;
+        }
+        if (request.method === 'POST' && isLocalLoginPath(request)) {
+            const jwtToken = typeof request.body?.jwt_token === 'string' ? request.body.jwt_token.trim() : '';
+            const secretKey = typeof request.body?.secret_key === 'string' ? request.body.secret_key.trim() : '';
+            if (config.temporarySecretKey && secretKey === config.temporarySecretKey) {
+                response.cookie('lab_temp_key', config.temporarySecretKey, temporaryCookieOptions(request));
+                response.redirect('/admin');
+                return;
+            }
+            if (jwtToken) {
+                response.cookie('auth_token', jwtToken, temporaryCookieOptions(request));
+                response.redirect('/admin');
+                return;
+            }
+            response.status(401).type('html').send(localLoginPage(config, 'Enter a JWT token or the temporary secret key.'));
+            return;
+        }
+        if (hasTemporaryAccess(request, config)) {
+            request.labAccess = { allowed: true, reason: 'Temporary CA Lab secret key accepted.' };
+            next();
+            return;
+        }
        if (!config.jwtSecret) {
            response.status(500).json({ error: 'Lab authentication is enabled but JWT_SECRET is not configured' });
            return;
@@ -178,7 +317,7 @@ export function requireLabAccess(config = labAuthConfig()) {
        const token = request.cookies?.auth_token;
        if (!token) {
            if (wantsHtml(request)) {
-                response.redirect(loginUrl(request, config));
+                response.status(401).type('html').send(localLoginPage(config));
                return;
            }
            response.status(401).json({