agentfootprint
Version:
The explainable agent framework — backtrack a wrong answer to the exact context that caused it (evidence, not guesses). Built on footprintjs.
86 lines • 4.52 kB
JavaScript
;
/**
* strategies/localChoice — the `local-password` strategy, built from config.
*
* Development, tests and a demo box only: it is REFUSED in production (Q3). A
* password list in an environment variable is not a production identity
* store, and a company that has a directory should sign people in through it.
*
* What it builds: the password list (`localPasswords` — hashed entries only),
* a bounded in-memory sign-in store, and the sign-in door around them. The
* door's guard is built from the host's own lists (`boot.crossSite`), and the
* public URL must pass them — one source for allowed hosts and origins.
*/
Object.defineProperty(exports, "__esModule", { value: true });
exports.localPasswordChoice = void 0;
const memorySignIns_js_1 = require("../../../hosting/signin/memorySignIns.js");
const door_js_1 = require("../../../hosting/signin/door.js");
const localPassword_js_1 = require("../localPassword.js");
const config_js_1 = require("./config.js");
const doorError_js_1 = require("./doorError.js");
const vocabulary_js_1 = require("./vocabulary.js");
/** Build the `local-password` choice, or refuse to boot naming the key. */
function localPasswordChoice(config, boot, production) {
if (production) {
throw new config_js_1.IdentityConfigError(`IDENTITY_STRATEGY is 'local-password', and this is production. A password list in the ` +
`environment is not a production identity store: sign people in through your identity ` +
`provider (oidc-token). local-password is for development, tests and demos.`, 'IDENTITY_STRATEGY');
}
const users = required(config.localUsers, 'localUsers', `'name:scrypt$…' entries, comma separated`);
const publicUrl = required(config.publicUrl, 'publicUrl', `the URL people open the app at — it decides the sign-in cookie (http only on localhost)`);
let passwords;
try {
passwords = (0, localPassword_js_1.localPasswords)(users);
}
catch (err) {
if (err instanceof localPassword_js_1.LocalPasswordConfigError) {
throw new config_js_1.IdentityConfigError(`${(0, vocabulary_js_1.keyLabel)('localUsers')}: ${err.message.replace(/^\[identity\] /, '')}`, 'IDENTITY_LOCAL_USERS');
}
throw err;
}
const door = buildDoor(config, boot, publicUrl, passwords);
return {
strategy: 'local-password',
mode: 'password',
identity: door.identity,
signInDoor: door,
hostSignIn: door.hostSignIn,
banner: [
`identity: strategy local-password — ${passwords.names.length} configured name(s); DEVELOPMENT ONLY (production refuses it)`,
'identity: user ids are the configured names, matched exactly; renaming someone orphans their conversations',
...door.banner,
],
};
}
exports.localPasswordChoice = localPasswordChoice;
function buildDoor(config, boot, publicUrl, passwords) {
const addressRefusal = (0, doorError_js_1.addressRefusalLimits)(config.signInAddressRefuseAfter);
try {
return (0, door_js_1.signInDoor)({
passwords,
store: (0, memorySignIns_js_1.memorySignIns)({
...(config.signInMax !== undefined && { max: config.signInMax }),
idleMinutes: config.signInIdleMinutes ?? door_js_1.DEFAULT_IDLE_MINUTES.password,
}),
publicUrl,
production: false,
...(boot.crossSite !== undefined && { guard: boot.crossSite }),
...(config.signInHours !== undefined && { hours: config.signInHours }),
...(config.signInIdleMinutes !== undefined && { idleMinutes: config.signInIdleMinutes }),
...(config.trustedProxies !== undefined && { trustedProxies: config.trustedProxies }),
...(addressRefusal !== undefined && { limits: addressRefusal }),
...(boot.onSignInAudit !== undefined && { onAudit: boot.onSignInAudit }),
...(boot.signInLog !== undefined && { log: boot.signInLog }),
});
}
catch (err) {
throw (0, doorError_js_1.doorRefusal)('local-password', err);
}
}
function required(value, field, what) {
if (typeof value !== 'string' || value.trim().length === 0) {
throw new config_js_1.IdentityConfigError(`local-password needs ${(0, vocabulary_js_1.keyLabel)(field)}: ${what}.`, field === 'localUsers' ? 'IDENTITY_LOCAL_USERS' : 'IDENTITY_PUBLIC_URL');
}
return value;
}
//# sourceMappingURL=localChoice.js.map