glitch-university/glitch_automata_lab
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Adding temporarty keycard escape

Browse Source
This commit is contained in:
gitprov
2026-07-07 12:08:20 +02:00
parent f93bcfb8d4
commit 3fbde80bf5
7 changed files with 348 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/dist/caStudioApi.js
Vendored
+1
View File
@@ -47,6 +47,7 @@ export function createCaStudioApi(db) {
const labAccess = requireLabAccess(); const labAccess = requireLabAccess();
app.use(cookieParser()); app.use(cookieParser());
app.use(express.json({ limit: '1mb' })); app.use(express.json({ limit: '1mb' }));
app.use(express.urlencoded({ extended: false }));
app.use('/admin', labAccess); app.use('/admin', labAccess);
app.use('/view', labAccess); app.use('/view', labAccess);
app.use('/api/ca', labAccess); app.use('/api/ca', labAccess);
backend/dist/caStudioApi.js.map
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
backend/dist/labAuth.js
Vendored
+140 -1
View File
@@ -17,6 +17,7 @@ export function labAuthConfig() {
keycardMeritSlug: process.env.LAB_KEYCARD_MERIT_SLUG ?? 'lab-keycard', keycardMeritSlug: process.env.LAB_KEYCARD_MERIT_SLUG ?? 'lab-keycard',
keycardRequired: envFlag('LAB_KEYCARD_REQUIRED', true), keycardRequired: envFlag('LAB_KEYCARD_REQUIRED', true),
signInUrl: process.env.LAB_SIGN_IN_URL ?? `${gnommowebUrl}/auth/google`, signInUrl: process.env.LAB_SIGN_IN_URL ?? `${gnommowebUrl}/auth/google`,
temporarySecretKey: process.env.LAB_TEMP_SECRET_KEY ?? 'supersecret',
userProfileUrl: process.env.LAB_USER_PROFILE_URL ?? `${gnommowebUrl}/api/user/profile` userProfileUrl: process.env.LAB_USER_PROFILE_URL ?? `${gnommowebUrl}/api/user/profile`
}; };
} }
@@ -38,6 +39,112 @@ function loginUrl(request, config) {
url.searchParams.set('returnTo', returnTo); url.searchParams.set('returnTo', returnTo);
return url.toString(); return url.toString();
} }
function temporaryCookieOptions(request) {
const secure = request.secure || request.get('x-forwarded-proto') === 'https';
return {
httpOnly: true,
maxAge: 1000 * 60 * 60 * 12,
sameSite: 'lax',
secure
};
}
function hasTemporaryAccess(request, config) {
return Boolean(config.temporarySecretKey && request.cookies?.lab_temp_key === config.temporarySecretKey);
}
function isLocalLoginPath(request) {
return request.path === '/lab-login' || request.path === '/admin/lab-login';
}
function localLoginPage(config, error = '') {
return `<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>CA Lab Login</title>
<style>
body {
margin: 0;
min-height: 100vh;
display: grid;
place-items: center;
background: #008080;
color: #000;
font-family: "MS Sans Serif", Tahoma, Arial, sans-serif;
}
main {
width: min(560px, calc(100vw - 32px));
border: 2px solid;
border-color: #fff #404040 #404040 #fff;
background: #c0c0c0;
box-shadow: 4px 4px 0 rgb(0 0 0 / 0.35);
}
header {
padding: 6px 8px;
background: linear-gradient(90deg, #000080, #1084d0);
color: #fff;
font-weight: 700;
}
section { padding: 18px; }
h1 { margin: 0 0 10px; font-size: 1.2rem; }
p { line-height: 1.45; }
label { display: block; margin-top: 12px; font-weight: 700; }
input {
width: 100%;
min-height: 34px;
margin-top: 6px;
border: 2px solid;
border-color: #404040 #fff #fff #404040;
background: #fff;
color: #000;
padding: 6px 8px;
box-sizing: border-box;
font: inherit;
}
button, a {
display: inline-flex;
align-items: center;
justify-content: center;
min-height: 34px;
margin-top: 14px;
padding: 0 14px;
border: 2px solid;
border-color: #fff #404040 #404040 #fff;
background: #c0c0c0;
color: #000;
text-decoration: none;
font: inherit;
cursor: pointer;
}
.error { color: #800000; font-weight: 700; }
.actions { display: flex; flex-wrap: wrap; gap: 10px; }
</style>
</head>
<body>
<main>
<header>CA Lab Computer</header>
<section>
<h1>Insert lab keycard</h1>
<p>Sign in with your Glitch University JWT, or use the temporary lab key while access is being repaired.</p>
${error ? `<p class="error">${escapeHtml(error)}</p>` : ''}
<form method="post" action="/admin/lab-login">
<label>
JWT token
<input name="jwt_token" autocomplete="off" spellcheck="false">
</label>
<label>
Temporary secret key
<input name="secret_key" type="password" autocomplete="current-password">
</label>
<div class="actions">
<button type="submit">Unlock lab</button>
<a href="${escapeHtml(config.signInUrl)}">Glitch University sign in</a>
</div>
</form>
</section>
</main>
</body>
</html>`;
}
function lockedPage(access, config) { function lockedPage(access, config) {
const unlockUrl = access.unlockUrl ?? `${config.gnommowebUrl}/tech-tree`; const unlockUrl = access.unlockUrl ?? `${config.gnommowebUrl}/tech-tree`;
const reason = access.reason ?? 'Your Glitch University account does not have the CA Lab Keycard yet.'; const reason = access.reason ?? 'Your Glitch University account does not have the CA Lab Keycard yet.';
@@ -95,6 +202,13 @@ function lockedPage(access, config) {
<p>${escapeHtml(reason)}</p> <p>${escapeHtml(reason)}</p>
<p>Earn the Cellular Automata lab merit on glitch.university, then return here.</p> <p>Earn the Cellular Automata lab merit on glitch.university, then return here.</p>
<a href="${escapeHtml(unlockUrl)}">Go to Glitch University</a> <a href="${escapeHtml(unlockUrl)}">Go to Glitch University</a>
<form method="post" action="/admin/lab-login">
<label>
Temporary secret key
<input name="secret_key" type="password" autocomplete="current-password">
</label>
<button type="submit">Unlock temporarily</button>
</form>
</section> </section>
</main> </main>
</body> </body>
@@ -171,6 +285,31 @@ export function requireLabAccess(config = labAuthConfig()) {
next(); next();
return; return;
} }
if (request.method === 'GET' && isLocalLoginPath(request)) {
response.type('html').send(localLoginPage(config));
return;
}
if (request.method === 'POST' && isLocalLoginPath(request)) {
const jwtToken = typeof request.body?.jwt_token === 'string' ? request.body.jwt_token.trim() : '';
const secretKey = typeof request.body?.secret_key === 'string' ? request.body.secret_key.trim() : '';
if (config.temporarySecretKey && secretKey === config.temporarySecretKey) {
response.cookie('lab_temp_key', config.temporarySecretKey, temporaryCookieOptions(request));
response.redirect('/admin');
return;
}
if (jwtToken) {
response.cookie('auth_token', jwtToken, temporaryCookieOptions(request));
response.redirect('/admin');
return;
}
response.status(401).type('html').send(localLoginPage(config, 'Enter a JWT token or the temporary secret key.'));
return;
}
if (hasTemporaryAccess(request, config)) {
request.labAccess = { allowed: true, reason: 'Temporary CA Lab secret key accepted.' };
next();
return;
}
if (!config.jwtSecret) { if (!config.jwtSecret) {
response.status(500).json({ error: 'Lab authentication is enabled but JWT_SECRET is not configured' }); response.status(500).json({ error: 'Lab authentication is enabled but JWT_SECRET is not configured' });
return; return;
@@ -178,7 +317,7 @@ export function requireLabAccess(config = labAuthConfig()) {
const token = request.cookies?.auth_token; const token = request.cookies?.auth_token;
if (!token) { if (!token) {
if (wantsHtml(request)) { if (wantsHtml(request)) {
response.redirect(loginUrl(request, config)); response.status(401).type('html').send(localLoginPage(config));
return; return;
} }
response.status(401).json({ response.status(401).json({
backend/dist/labAuth.js.map
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
backend/src/caStudioApi.ts
+1
View File
@@ -89,6 +89,7 @@ export function createCaStudioApi(db: Queryable) {
const labAccess = requireLabAccess() const labAccess = requireLabAccess()
app.use(cookieParser()) app.use(cookieParser())
app.use(express.json({ limit: '1mb' })) app.use(express.json({ limit: '1mb' }))
app.use(express.urlencoded({ extended: false }))
app.use('/admin', labAccess) app.use('/admin', labAccess)
app.use('/view', labAccess) app.use('/view', labAccess)
app.use('/api/ca', labAccess) app.use('/api/ca', labAccess)
backend/src/labAuth.ts
+151 -1
View File
@@ -26,6 +26,7 @@ interface LabAuthConfig {
keycardMeritSlug: string keycardMeritSlug: string
keycardRequired: boolean keycardRequired: boolean
signInUrl: string signInUrl: string
temporarySecretKey?: string
userProfileUrl: string userProfileUrl: string
} }
@@ -57,6 +58,7 @@ export function labAuthConfig(): LabAuthConfig {
keycardMeritSlug: process.env.LAB_KEYCARD_MERIT_SLUG ?? 'lab-keycard', keycardMeritSlug: process.env.LAB_KEYCARD_MERIT_SLUG ?? 'lab-keycard',
keycardRequired: envFlag('LAB_KEYCARD_REQUIRED', true), keycardRequired: envFlag('LAB_KEYCARD_REQUIRED', true),
signInUrl: process.env.LAB_SIGN_IN_URL ?? `${gnommowebUrl}/auth/google`, signInUrl: process.env.LAB_SIGN_IN_URL ?? `${gnommowebUrl}/auth/google`,
temporarySecretKey: process.env.LAB_TEMP_SECRET_KEY ?? 'supersecret',
userProfileUrl: process.env.LAB_USER_PROFILE_URL ?? `${gnommowebUrl}/api/user/profile` userProfileUrl: process.env.LAB_USER_PROFILE_URL ?? `${gnommowebUrl}/api/user/profile`
} }
} }
@@ -83,6 +85,116 @@ function loginUrl(request: Request, config: LabAuthConfig) {
return url.toString() return url.toString()
} }
function temporaryCookieOptions(request: Request) {
const secure = request.secure || request.get('x-forwarded-proto') === 'https'
return {
httpOnly: true,
maxAge: 1000 * 60 * 60 * 12,
sameSite: 'lax' as const,
secure
}
}
function hasTemporaryAccess(request: Request, config: LabAuthConfig) {
return Boolean(config.temporarySecretKey && request.cookies?.lab_temp_key === config.temporarySecretKey)
}
function isLocalLoginPath(request: Request) {
return request.path === '/lab-login' || request.path === '/admin/lab-login'
}
function localLoginPage(config: LabAuthConfig, error = '') {
return `<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>CA Lab Login</title>
<style>
body {
margin: 0;
min-height: 100vh;
display: grid;
place-items: center;
background: #008080;
color: #000;
font-family: "MS Sans Serif", Tahoma, Arial, sans-serif;
}
main {
width: min(560px, calc(100vw - 32px));
border: 2px solid;
border-color: #fff #404040 #404040 #fff;
background: #c0c0c0;
box-shadow: 4px 4px 0 rgb(0 0 0 / 0.35);
}
header {
padding: 6px 8px;
background: linear-gradient(90deg, #000080, #1084d0);
color: #fff;
font-weight: 700;
}
section { padding: 18px; }
h1 { margin: 0 0 10px; font-size: 1.2rem; }
p { line-height: 1.45; }
label { display: block; margin-top: 12px; font-weight: 700; }
input {
width: 100%;
min-height: 34px;
margin-top: 6px;
border: 2px solid;
border-color: #404040 #fff #fff #404040;
background: #fff;
color: #000;
padding: 6px 8px;
box-sizing: border-box;
font: inherit;
}
button, a {
display: inline-flex;
align-items: center;
justify-content: center;
min-height: 34px;
margin-top: 14px;
padding: 0 14px;
border: 2px solid;
border-color: #fff #404040 #404040 #fff;
background: #c0c0c0;
color: #000;
text-decoration: none;
font: inherit;
cursor: pointer;
}
.error { color: #800000; font-weight: 700; }
.actions { display: flex; flex-wrap: wrap; gap: 10px; }
</style>
</head>
<body>
<main>
<header>CA Lab Computer</header>
<section>
<h1>Insert lab keycard</h1>
<p>Sign in with your Glitch University JWT, or use the temporary lab key while access is being repaired.</p>
${error ? `<p class="error">${escapeHtml(error)}</p>` : ''}
<form method="post" action="/admin/lab-login">
<label>
JWT token
<input name="jwt_token" autocomplete="off" spellcheck="false">
</label>
<label>
Temporary secret key
<input name="secret_key" type="password" autocomplete="current-password">
</label>
<div class="actions">
<button type="submit">Unlock lab</button>
<a href="${escapeHtml(config.signInUrl)}">Glitch University sign in</a>
</div>
</form>
</section>
</main>
</body>
</html>`
}
function lockedPage(access: LabAccessResponse, config: LabAuthConfig) { function lockedPage(access: LabAccessResponse, config: LabAuthConfig) {
const unlockUrl = access.unlockUrl ?? `${config.gnommowebUrl}/tech-tree` const unlockUrl = access.unlockUrl ?? `${config.gnommowebUrl}/tech-tree`
const reason = access.reason ?? 'Your Glitch University account does not have the CA Lab Keycard yet.' const reason = access.reason ?? 'Your Glitch University account does not have the CA Lab Keycard yet.'
@@ -140,6 +252,13 @@ function lockedPage(access: LabAccessResponse, config: LabAuthConfig) {
<p>${escapeHtml(reason)}</p> <p>${escapeHtml(reason)}</p>
<p>Earn the Cellular Automata lab merit on glitch.university, then return here.</p> <p>Earn the Cellular Automata lab merit on glitch.university, then return here.</p>
<a href="${escapeHtml(unlockUrl)}">Go to Glitch University</a> <a href="${escapeHtml(unlockUrl)}">Go to Glitch University</a>
<form method="post" action="/admin/lab-login">
<label>
Temporary secret key
<input name="secret_key" type="password" autocomplete="current-password">
</label>
<button type="submit">Unlock temporarily</button>
</form>
</section> </section>
</main> </main>
</body> </body>
@@ -227,6 +346,37 @@ export function requireLabAccess(config: LabAuthConfig = labAuthConfig()): Reque
return return
} }
if (request.method === 'GET' && isLocalLoginPath(request)) {
response.type('html').send(localLoginPage(config))
return
}
if (request.method === 'POST' && isLocalLoginPath(request)) {
const jwtToken = typeof request.body?.jwt_token === 'string' ? request.body.jwt_token.trim() : ''
const secretKey = typeof request.body?.secret_key === 'string' ? request.body.secret_key.trim() : ''
if (config.temporarySecretKey && secretKey === config.temporarySecretKey) {
response.cookie('lab_temp_key', config.temporarySecretKey, temporaryCookieOptions(request))
response.redirect('/admin')
return
}
if (jwtToken) {
response.cookie('auth_token', jwtToken, temporaryCookieOptions(request))
response.redirect('/admin')
return
}
response.status(401).type('html').send(localLoginPage(config, 'Enter a JWT token or the temporary secret key.'))
return
}
if (hasTemporaryAccess(request, config)) {
request.labAccess = { allowed: true, reason: 'Temporary CA Lab secret key accepted.' }
next()
return
}
if (!config.jwtSecret) { if (!config.jwtSecret) {
response.status(500).json({ error: 'Lab authentication is enabled but JWT_SECRET is not configured' }) response.status(500).json({ error: 'Lab authentication is enabled but JWT_SECRET is not configured' })
return return
@@ -235,7 +385,7 @@ export function requireLabAccess(config: LabAuthConfig = labAuthConfig()): Reque
const token = request.cookies?.auth_token const token = request.cookies?.auth_token
if (!token) { if (!token) {
if (wantsHtml(request)) { if (wantsHtml(request)) {
response.redirect(loginUrl(request, config)) response.status(401).type('html').send(localLoginPage(config))
return return
} }
response.status(401).json({ response.status(401).json({
backend/test/labAuth.test.ts
+53 -3
View File
@@ -10,6 +10,7 @@ const secret = 'test-lab-secret'
function testApp(config: Parameters<typeof requireLabAccess>[0]) { function testApp(config: Parameters<typeof requireLabAccess>[0]) {
const app = express() const app = express()
app.use(cookieParser()) app.use(cookieParser())
app.use(express.urlencoded({ extended: false }))
app.use(requireLabAccess(config)) app.use(requireLabAccess(config))
app.get('/admin', (_request, response) => response.send('ok')) app.get('/admin', (_request, response) => response.send('ok'))
app.get('/api/ca/decks', (_request, response) => response.json([{ id: 'deck' }])) app.get('/api/ca/decks', (_request, response) => response.json([{ id: 'deck' }]))
@@ -39,7 +40,7 @@ describe('lab auth middleware', () => {
await request(app).get('/admin').expect(200, 'ok') await request(app).get('/admin').expect(200, 'ok')
}) })
it('redirects browser requests without a shared auth cookie', async () => { it('shows the local lab login form for browser requests without a shared auth cookie', async () => {
const app = testApp({ const app = testApp({
enabled: true, enabled: true,
gnommowebUrl: 'https://glitch.university', gnommowebUrl: 'https://glitch.university',
@@ -55,10 +56,59 @@ describe('lab auth middleware', () => {
.set('accept', 'text/html') .set('accept', 'text/html')
.set('host', 'lab.glitch.university') .set('host', 'lab.glitch.university')
.set('x-forwarded-proto', 'https') .set('x-forwarded-proto', 'https')
.expect(401)
expect(response.text).toContain('Insert lab keycard')
expect(response.text).toContain('Temporary secret key')
})
it('allows browser requests with the temporary lab secret key', async () => {
const app = testApp({
enabled: true,
gnommowebUrl: 'https://glitch.university',
jwtSecret: '',
keycardMeritSlug: 'lab-keycard',
keycardRequired: true,
signInUrl: 'https://glitch.university/auth/google',
temporarySecretKey: 'supersecret',
userProfileUrl: 'https://glitch.university/api/user/profile'
})
const unlock = await request(app)
.post('/admin/lab-login')
.type('form')
.send({ secret_key: 'supersecret' })
.expect(302) .expect(302)
expect(response.headers.location).toContain('https://glitch.university/auth/google?returnTo=') const cookie = unlock.headers['set-cookie']
expect(decodeURIComponent(response.headers.location)).toContain('https://lab.glitch.university/admin') expect(String(cookie)).toContain('lab_temp_key=supersecret')
await request(app)
.get('/admin')
.set('cookie', cookie)
.expect(200, 'ok')
})
it('rejects the temporary lab secret key when it is wrong', async () => {
const app = testApp({
enabled: true,
gnommowebUrl: 'https://glitch.university',
jwtSecret: secret,
keycardMeritSlug: 'lab-keycard',
keycardRequired: true,
signInUrl: 'https://glitch.university/auth/google',
temporarySecretKey: 'supersecret',
userProfileUrl: 'https://glitch.university/api/user/profile'
})
await request(app)
.post('/admin/lab-login')
.type('form')
.send({ secret_key: 'not-it' })
.expect(401)
.expect((response) => {
expect(response.text).toContain('Enter a JWT token or the temporary secret key')
})
}) })
it('rejects API requests with an invalid shared auth cookie', async () => { it('rejects API requests with an invalid shared auth cookie', async () => {