Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Kristian WindandClaude Opus 5
|
cbe66d75a5 | ||
|
Kristian WindandClaude Opus 5
|
a38a79e9b6 | ||
|
Kristian WindandClaude Opus 5
|
aabbbac583 |
@@ -17,6 +17,7 @@ import (
|
||||
"github.com/kristianwind/verdande/internal/config"
|
||||
"github.com/kristianwind/verdande/internal/httpapi"
|
||||
"github.com/kristianwind/verdande/internal/jobs"
|
||||
"github.com/kristianwind/verdande/internal/secret"
|
||||
"github.com/kristianwind/verdande/internal/store"
|
||||
)
|
||||
|
||||
@@ -54,6 +55,15 @@ func run() error {
|
||||
defer db.Close()
|
||||
log.Info("database ready", "path", db.Path())
|
||||
|
||||
// Before anything reads a setting. The key lives outside the database on
|
||||
// purpose: backups can be downloaded through the interface, so a token stored
|
||||
// in the clear leaves with every copy anyone takes.
|
||||
box, err := secret.Open(cfg.SecretKey, cfg.DataDir)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
db.UseSecrets(box)
|
||||
|
||||
httpapi.Version = version
|
||||
api := httpapi.New(cfg, db, log, webAssets(log))
|
||||
|
||||
|
||||
@@ -4,6 +4,7 @@ go 1.26.3
|
||||
|
||||
require (
|
||||
github.com/coder/websocket v1.8.15
|
||||
github.com/emersion/go-imap/v2 v2.0.0-beta.8
|
||||
github.com/go-chi/chi/v5 v5.3.1
|
||||
github.com/go-webauthn/webauthn v0.17.4
|
||||
github.com/pquerna/otp v1.5.0
|
||||
@@ -15,6 +16,8 @@ require (
|
||||
require (
|
||||
github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
|
||||
github.com/dustin/go-humanize v1.0.1 // indirect
|
||||
github.com/emersion/go-message v0.18.2 // indirect
|
||||
github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 // indirect
|
||||
github.com/fxamacker/cbor/v2 v2.9.2 // indirect
|
||||
github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
|
||||
github.com/go-webauthn/x v0.2.6 // indirect
|
||||
|
||||
@@ -7,6 +7,12 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
|
||||
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
|
||||
github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
|
||||
github.com/emersion/go-imap/v2 v2.0.0-beta.8 h1:5IXZK1E33DyeP526320J3RS7eFlCYGFgtbrfapqDPug=
|
||||
github.com/emersion/go-imap/v2 v2.0.0-beta.8/go.mod h1:dhoFe2Q0PwLrMD7oZw8ODuaD0vLYPe5uj2wcOMnvh48=
|
||||
github.com/emersion/go-message v0.18.2 h1:rl55SQdjd9oJcIoQNhubD2Acs1E6IzlZISRTK7x/Lpg=
|
||||
github.com/emersion/go-message v0.18.2/go.mod h1:XpJyL70LwRvq2a8rVbHXikPgKj8+aI0kGdHlg16ibYA=
|
||||
github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 h1:oP4q0fw+fOSWn3DfFi4EXdT+B+gTtzx8GC9xsc26Znk=
|
||||
github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6/go.mod h1:iL2twTeMvZnrg54ZoPDNfJaJaqy0xIQFuBdrLsmspwQ=
|
||||
github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh78=
|
||||
github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
|
||||
github.com/go-chi/chi/v5 v5.3.1 h1:3j4HZLGZQ3JpMCrPJF/Jl3mYJfWLKBfNJ6quurUGCf8=
|
||||
@@ -51,18 +57,49 @@ github.com/tinylib/msgp v1.6.4 h1:mOwYbyYDLPj35mkA2BjjYejgJk9BuHxDdvRnb6v2ZcQ=
|
||||
github.com/tinylib/msgp v1.6.4/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
|
||||
github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
|
||||
github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
|
||||
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
|
||||
go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
|
||||
go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
|
||||
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
|
||||
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
|
||||
golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
|
||||
golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
|
||||
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
|
||||
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
|
||||
golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
|
||||
golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
|
||||
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
|
||||
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
|
||||
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
|
||||
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
|
||||
golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
|
||||
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
|
||||
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
|
||||
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
|
||||
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
|
||||
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
|
||||
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
|
||||
golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
|
||||
golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
|
||||
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
||||
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
modernc.org/cc/v4 v4.29.1 h1:MKgdCV3WykTSPqpVrnxdEDS0HEd2FHpKZDzxzU5LyeI=
|
||||
|
||||
@@ -33,6 +33,10 @@ type Config struct {
|
||||
GmailClientID string
|
||||
GmailClientSecret string
|
||||
|
||||
// SecretKey seals the tokens and passwords in the database, 32 bytes of base64.
|
||||
// Empty means a key file beside the data — see internal/secret.
|
||||
SecretKey string
|
||||
|
||||
// UpdateCheck asks GitHub whether a newer release exists. Off unless asked
|
||||
// for: a self-hosted app that reaches out without being told to has broken
|
||||
// the deal its operator made by self-hosting.
|
||||
@@ -100,6 +104,7 @@ func Load() (*Config, error) {
|
||||
PanelToken: env("VERDANDE_PANEL_TOKEN", ""),
|
||||
PanelServerID: env("VERDANDE_PANEL_SERVER_ID", ""),
|
||||
GmailClientSecret: env("VERDANDE_GMAIL_CLIENT_SECRET", ""),
|
||||
SecretKey: env("VERDANDE_SECRET_KEY", ""),
|
||||
UpdateCheck: envBool("VERDANDE_UPDATE_CHECK", false),
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,187 @@
|
||||
// Package imap reads a mailbox over IMAP and hands back the messages that should
|
||||
// become tasks.
|
||||
//
|
||||
// This exists next to internal/gmail rather than inside it because the two agree
|
||||
// on almost nothing. Gmail is an HTTP API with OAuth, labels and stars; IMAP is a
|
||||
// connection with a password, folders and flags. What they do share is the shape
|
||||
// of the answer — a handful of messages, each with a sender, a subject and enough
|
||||
// of a body to read — and that shape is Message here, deliberately identical to
|
||||
// what the Gmail client returns, so the caller can be told where to look and not
|
||||
// how to look.
|
||||
//
|
||||
// iCloud, Fastmail and any ordinary host speak this. Office 365 no longer accepts
|
||||
// a password here at all — it wants OAuth of its own — so it is not a host you can
|
||||
// reach with this package, and pretending otherwise would only fail later and
|
||||
// less clearly.
|
||||
package imap
|
||||
|
||||
import (
|
||||
"crypto/tls"
|
||||
"fmt"
|
||||
"net"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/emersion/go-imap/v2"
|
||||
"github.com/emersion/go-imap/v2/imapclient"
|
||||
)
|
||||
|
||||
// Message is one mail, reduced to what a task needs.
|
||||
type Message struct {
|
||||
UID uint32
|
||||
From string
|
||||
Subject string
|
||||
Snippet string
|
||||
Date time.Time
|
||||
}
|
||||
|
||||
// Account is one mailbox to read.
|
||||
type Account struct {
|
||||
Host string // "imap.mail.me.com:993"
|
||||
Username string
|
||||
Password string // an app-specific password on every host worth naming
|
||||
Folder string // "INBOX" when empty
|
||||
}
|
||||
|
||||
// Dial opens a TLS connection and logs in. The caller closes it.
|
||||
//
|
||||
// TLS is not optional and there is no flag to make it so: this carries a password
|
||||
// that unlocks a person's whole mailbox, and a switch for turning that protection
|
||||
// off is a switch that will one day be found already flipped.
|
||||
func Dial(a Account) (*Client, error) {
|
||||
host, _, err := net.SplitHostPort(a.Host)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("host must include a port, like imap.mail.me.com:993: %w", err)
|
||||
}
|
||||
|
||||
c, err := imapclient.DialTLS(a.Host, &imapclient.Options{
|
||||
TLSConfig: &tls.Config{ServerName: host, MinVersion: tls.VersionTLS12},
|
||||
})
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("connect to %s: %w", a.Host, err)
|
||||
}
|
||||
|
||||
if err := c.Login(a.Username, a.Password).Wait(); err != nil {
|
||||
c.Close()
|
||||
// Deliberately not repeating the server's own words here. A bad password is
|
||||
// the overwhelmingly likely cause, and hosts answer it with everything from
|
||||
// "AUTHENTICATIONFAILED" to a sentence about web login being required.
|
||||
return nil, fmt.Errorf("%s refused the login for %s: %w", a.Host, a.Username, err)
|
||||
}
|
||||
|
||||
folder := a.Folder
|
||||
if folder == "" {
|
||||
folder = "INBOX"
|
||||
}
|
||||
return &Client{c: c, folder: folder}, nil
|
||||
}
|
||||
|
||||
// Client is a logged-in connection to one mailbox.
|
||||
type Client struct {
|
||||
c *imapclient.Client
|
||||
folder string
|
||||
}
|
||||
|
||||
// Close ends the session politely, then hangs up regardless.
|
||||
func (c *Client) Close() error {
|
||||
if err := c.c.Logout().Wait(); err != nil {
|
||||
return c.c.Close()
|
||||
}
|
||||
return c.c.Close()
|
||||
}
|
||||
|
||||
// Since returns the flagged messages in the folder newer than uid.
|
||||
//
|
||||
// Flagged, not unread: unread is a state the person is still using, and a sync
|
||||
// that consumed it would be taking something away. Flagging a mail is a deliberate
|
||||
// act with no other meaning, which is exactly what is wanted — the same reason the
|
||||
// Gmail side reads stars.
|
||||
func (c *Client) Since(uid uint32, limit int) ([]Message, error) {
|
||||
if _, err := c.c.Select(c.folder, &imap.SelectOptions{ReadOnly: true}).Wait(); err != nil {
|
||||
return nil, fmt.Errorf("open %s: %w", c.folder, err)
|
||||
}
|
||||
|
||||
// From uid+1 to the end. A mailbox with nothing new answers with no uids
|
||||
// rather than an error, and that is not a failure worth reporting upwards.
|
||||
set := imap.UIDSetNum()
|
||||
set.AddRange(imap.UID(uid+1), 0)
|
||||
|
||||
criteria := &imap.SearchCriteria{
|
||||
UID: []imap.UIDSet{set},
|
||||
Flag: []imap.Flag{imap.FlagFlagged},
|
||||
}
|
||||
found, err := c.c.UIDSearch(criteria, nil).Wait()
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("search %s: %w", c.folder, err)
|
||||
}
|
||||
|
||||
uids := found.AllUIDs()
|
||||
if len(uids) == 0 {
|
||||
return nil, nil
|
||||
}
|
||||
if limit > 0 && len(uids) > limit {
|
||||
// The newest ones. A mailbox flagged over years would otherwise make the
|
||||
// first sync the largest one, which is the run most likely to be watched.
|
||||
uids = uids[len(uids)-limit:]
|
||||
}
|
||||
|
||||
want := imap.UIDSetNum(uids...)
|
||||
fetch := &imap.FetchOptions{
|
||||
Envelope: true,
|
||||
UID: true,
|
||||
BodySection: []*imap.FetchItemBodySection{{Specifier: imap.PartSpecifierText, Peek: true}},
|
||||
}
|
||||
msgs, err := c.c.Fetch(want, fetch).Collect()
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("fetch from %s: %w", c.folder, err)
|
||||
}
|
||||
|
||||
out := make([]Message, 0, len(msgs))
|
||||
for _, m := range msgs {
|
||||
if m.Envelope == nil {
|
||||
continue
|
||||
}
|
||||
out = append(out, Message{
|
||||
UID: uint32(m.UID),
|
||||
From: address(m.Envelope.From),
|
||||
Subject: strings.TrimSpace(m.Envelope.Subject),
|
||||
Snippet: snippet(m),
|
||||
Date: m.Envelope.Date,
|
||||
})
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
// address renders the first sender as "Name <addr>", or just the address.
|
||||
func address(list []imap.Address) string {
|
||||
if len(list) == 0 {
|
||||
return ""
|
||||
}
|
||||
a := list[0]
|
||||
addr := a.Addr()
|
||||
if a.Name == "" {
|
||||
return addr
|
||||
}
|
||||
return a.Name + " <" + addr + ">"
|
||||
}
|
||||
|
||||
// snippet is the first readable line or so of the body.
|
||||
//
|
||||
// No MIME walk and no HTML stripping yet: this is what shows under a task's title,
|
||||
// and a wrong-but-short line is a smaller problem than a parser that has to be
|
||||
// right about every mail ever sent. The full mail stays where it is.
|
||||
const snippetLimit = 400
|
||||
|
||||
func snippet(m *imapclient.FetchMessageBuffer) string {
|
||||
for _, body := range m.BodySection {
|
||||
text := strings.TrimSpace(string(body.Bytes))
|
||||
if text == "" {
|
||||
continue
|
||||
}
|
||||
if len(text) > snippetLimit {
|
||||
text = text[:snippetLimit] + "…"
|
||||
}
|
||||
return text
|
||||
}
|
||||
return ""
|
||||
}
|
||||
@@ -0,0 +1,77 @@
|
||||
package imap
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/emersion/go-imap/v2"
|
||||
"github.com/emersion/go-imap/v2/imapclient"
|
||||
)
|
||||
|
||||
// A host without a port is the mistake everyone makes once, and the error a TLS
|
||||
// dial gives for it says nothing useful about which of the two fields is wrong.
|
||||
func TestAHostWithoutAPortSaysSo(t *testing.T) {
|
||||
_, err := Dial(Account{Host: "imap.mail.me.com", Username: "kw", Password: "x"})
|
||||
if err == nil {
|
||||
t.Fatal("a host with no port was accepted")
|
||||
}
|
||||
if !strings.Contains(err.Error(), "port") {
|
||||
t.Errorf("the error does not mention the port: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestASenderIsRenderedForReading(t *testing.T) {
|
||||
for _, c := range []struct {
|
||||
name string
|
||||
in []imap.Address
|
||||
want string
|
||||
}{
|
||||
{"nobody", nil, ""},
|
||||
{"bare address", []imap.Address{{Mailbox: "kw", Host: "nolimit.dk"}}, "kw@nolimit.dk"},
|
||||
{"with a name", []imap.Address{{Name: "Kristian Wind", Mailbox: "kw", Host: "nolimit.dk"}},
|
||||
"Kristian Wind <kw@nolimit.dk>"},
|
||||
// The first sender wins. A mail from two people is rare enough that naming
|
||||
// one is better than a task titled with a list.
|
||||
{"two senders", []imap.Address{
|
||||
{Mailbox: "first", Host: "example.dk"},
|
||||
{Mailbox: "second", Host: "example.dk"},
|
||||
}, "first@example.dk"},
|
||||
} {
|
||||
t.Run(c.name, func(t *testing.T) {
|
||||
if got := address(c.in); got != c.want {
|
||||
t.Errorf("got %q, want %q", got, c.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// The snippet is what shows under a task's title, so its only real duty is to end.
|
||||
func TestASnippetIsTrimmedAndBounded(t *testing.T) {
|
||||
long := strings.Repeat("a", snippetLimit*2)
|
||||
m := &imapclient.FetchMessageBuffer{
|
||||
BodySection: []imapclient.FetchBodySectionBuffer{
|
||||
{Bytes: []byte(" ")},
|
||||
{Bytes: []byte(" " + long + " ")},
|
||||
},
|
||||
}
|
||||
got := snippet(m)
|
||||
if strings.HasPrefix(got, " ") || strings.HasSuffix(got, " ") {
|
||||
t.Errorf("the snippet is not trimmed: %q", got[:20])
|
||||
}
|
||||
// An empty part must not win over the one that has the text.
|
||||
if !strings.HasPrefix(got, "aaa") {
|
||||
t.Errorf("an empty body part was preferred: %q", got)
|
||||
}
|
||||
if len([]rune(got)) > snippetLimit+1 {
|
||||
t.Errorf("the snippet runs to %d characters", len([]rune(got)))
|
||||
}
|
||||
if !strings.HasSuffix(got, "…") {
|
||||
t.Error("a cut snippet does not say that it was cut")
|
||||
}
|
||||
}
|
||||
|
||||
func TestAnEmptyMailboxIsNotAnError(t *testing.T) {
|
||||
if got := snippet(&imapclient.FetchMessageBuffer{}); got != "" {
|
||||
t.Errorf("a mail with no body parts gave %q", got)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,141 @@
|
||||
// Package secret seals the values that must not travel with a backup.
|
||||
//
|
||||
// The reason this exists is not the database on the server — it is the copies of
|
||||
// it. Backups can be downloaded through the web interface, and every one taken so
|
||||
// far carried a live Gmail refresh token in plain text. Anyone who ends up with a
|
||||
// copy ends up with the mailbox.
|
||||
//
|
||||
// So the key must not live in the database. That rules out the pattern used for
|
||||
// the VAPID pair, which the instance generates and stores in the same file it
|
||||
// protects: a key kept beside what it locks is not a lock. It comes from the
|
||||
// environment, or from a file next to the data that the backup does not include.
|
||||
package secret
|
||||
|
||||
import (
|
||||
"crypto/aes"
|
||||
"crypto/cipher"
|
||||
"crypto/rand"
|
||||
"encoding/base64"
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// prefix marks a sealed value, so a mixed column can be read without guessing and
|
||||
// so the scheme can be replaced later without having to.
|
||||
const prefix = "v1:"
|
||||
|
||||
// KeyFile is where the key lands when the environment does not carry one. It sits
|
||||
// beside the database rather than inside it, and the backup routine must never
|
||||
// learn to include it.
|
||||
const KeyFile = "secret.key"
|
||||
|
||||
// Box seals and opens values.
|
||||
type Box struct {
|
||||
aead cipher.AEAD
|
||||
}
|
||||
|
||||
// Open loads the key, generating and saving one on first use.
|
||||
//
|
||||
// A key given in the environment wins: that is how a host keeps the secret out of
|
||||
// its disks altogether. Otherwise a file, created 0600, and read back with its
|
||||
// permissions checked — a key that anybody on the box can read is a key that is
|
||||
// only ceremonially secret.
|
||||
func Open(env, dataDir string) (*Box, error) {
|
||||
if env != "" {
|
||||
key, err := base64.StdEncoding.DecodeString(strings.TrimSpace(env))
|
||||
if err != nil || len(key) != 32 {
|
||||
return nil, errors.New("VERDANDE_SECRET_KEY must be 32 bytes of base64 — " +
|
||||
"generate one with: openssl rand -base64 32")
|
||||
}
|
||||
return newBox(key)
|
||||
}
|
||||
|
||||
path := filepath.Join(dataDir, KeyFile)
|
||||
raw, err := os.ReadFile(path)
|
||||
switch {
|
||||
case err == nil:
|
||||
key, decErr := base64.StdEncoding.DecodeString(strings.TrimSpace(string(raw)))
|
||||
if decErr != nil || len(key) != 32 {
|
||||
// Deliberately not regenerating. A new key here would not fix anything —
|
||||
// it would silently make every stored token unreadable, which looks
|
||||
// exactly like the mailbox having disconnected itself overnight.
|
||||
return nil, fmt.Errorf("%s is not a 32-byte base64 key; move it aside only "+
|
||||
"if you accept that every connected mailbox must be reconnected", path)
|
||||
}
|
||||
if info, statErr := os.Stat(path); statErr == nil && info.Mode().Perm()&0o077 != 0 {
|
||||
return nil, fmt.Errorf("%s is readable by others (%04o); chmod 600 it", path, info.Mode().Perm())
|
||||
}
|
||||
return newBox(key)
|
||||
|
||||
case errors.Is(err, os.ErrNotExist):
|
||||
key := make([]byte, 32)
|
||||
if _, randErr := rand.Read(key); randErr != nil {
|
||||
return nil, randErr
|
||||
}
|
||||
encoded := base64.StdEncoding.EncodeToString(key)
|
||||
if writeErr := os.WriteFile(path, []byte(encoded+"\n"), 0o600); writeErr != nil {
|
||||
return nil, fmt.Errorf("write %s: %w", path, writeErr)
|
||||
}
|
||||
return newBox(key)
|
||||
|
||||
default:
|
||||
return nil, fmt.Errorf("read %s: %w", path, err)
|
||||
}
|
||||
}
|
||||
|
||||
func newBox(key []byte) (*Box, error) {
|
||||
block, err := aes.NewCipher(key)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
aead, err := cipher.NewGCM(block)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &Box{aead: aead}, nil
|
||||
}
|
||||
|
||||
// Seal returns the sealed form of v. An empty string stays empty: there is nothing
|
||||
// to hide, and a row full of ciphertext for "" only makes the column harder to read.
|
||||
func (b *Box) Seal(v string) (string, error) {
|
||||
if v == "" || IsSealed(v) {
|
||||
return v, nil
|
||||
}
|
||||
nonce := make([]byte, b.aead.NonceSize())
|
||||
if _, err := rand.Read(nonce); err != nil {
|
||||
return "", err
|
||||
}
|
||||
out := b.aead.Seal(nonce, nonce, []byte(v), nil)
|
||||
return prefix + base64.StdEncoding.EncodeToString(out), nil
|
||||
}
|
||||
|
||||
// Unseal returns the plain value. Anything without the marker is returned as it
|
||||
// is — the column holds values written before there was a key, and they are read
|
||||
// as themselves until something writes them back sealed.
|
||||
func (b *Box) Unseal(v string) (string, error) {
|
||||
if !IsSealed(v) {
|
||||
return v, nil
|
||||
}
|
||||
raw, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(v, prefix))
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("sealed value is not base64: %w", err)
|
||||
}
|
||||
if len(raw) < b.aead.NonceSize() {
|
||||
return "", errors.New("sealed value is too short to contain a nonce")
|
||||
}
|
||||
nonce, body := raw[:b.aead.NonceSize()], raw[b.aead.NonceSize():]
|
||||
out, err := b.aead.Open(nil, nonce, body, nil)
|
||||
if err != nil {
|
||||
// The overwhelmingly likely cause, and worth saying rather than "message
|
||||
// authentication failed", which sends people looking for a corrupt row.
|
||||
return "", errors.New("cannot read a stored secret: this is a different key " +
|
||||
"than the one it was written with")
|
||||
}
|
||||
return string(out), nil
|
||||
}
|
||||
|
||||
// IsSealed reports whether v has already been through Seal.
|
||||
func IsSealed(v string) bool { return strings.HasPrefix(v, prefix) }
|
||||
@@ -0,0 +1,149 @@
|
||||
package secret
|
||||
|
||||
import (
|
||||
"encoding/base64"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestAValueSurvivesTheRoundTrip(t *testing.T) {
|
||||
b := mustBox(t)
|
||||
for _, in := range []string{"1//0abc-refresh", "kodeord med æøå", strings.Repeat("x", 5000)} {
|
||||
sealed, err := b.Seal(in)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if strings.Contains(sealed, in) {
|
||||
t.Fatal("the sealed form still contains the value")
|
||||
}
|
||||
out, err := b.Unseal(sealed)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if out != in {
|
||||
t.Errorf("got %q, want %q", out, in)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Two seals of the same value must not look alike, or the column tells anyone
|
||||
// reading it which accounts share a password.
|
||||
func TestSealingTwiceGivesDifferentText(t *testing.T) {
|
||||
b := mustBox(t)
|
||||
first, _ := b.Seal("same")
|
||||
second, _ := b.Seal("same")
|
||||
if first == second {
|
||||
t.Error("the same value sealed to the same text twice")
|
||||
}
|
||||
}
|
||||
|
||||
// The column holds values written before there was a key. Reading must not fail
|
||||
// on them, and sealing must not wrap an already-sealed value a second time.
|
||||
func TestPlainTextIsReadAsItself(t *testing.T) {
|
||||
b := mustBox(t)
|
||||
out, err := b.Unseal("1//0abc-written-before-there-was-a-key")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if out != "1//0abc-written-before-there-was-a-key" {
|
||||
t.Errorf("an unsealed value came back as %q", out)
|
||||
}
|
||||
|
||||
sealed, _ := b.Seal("x")
|
||||
again, _ := b.Seal(sealed)
|
||||
if again != sealed {
|
||||
t.Error("an already-sealed value was sealed a second time")
|
||||
}
|
||||
}
|
||||
|
||||
func TestNothingIsStillNothing(t *testing.T) {
|
||||
b := mustBox(t)
|
||||
if out, _ := b.Seal(""); out != "" {
|
||||
t.Errorf("an empty value sealed to %q", out)
|
||||
}
|
||||
}
|
||||
|
||||
// The message somebody gets after restoring a database without its key file. It
|
||||
// has to point at the key, because every other symptom points at the mailbox.
|
||||
func TestTheWrongKeySaysItIsTheWrongKey(t *testing.T) {
|
||||
sealed, err := mustBox(t).Seal("hemmelig")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
_, err = mustBox(t).Unseal(sealed)
|
||||
if err == nil {
|
||||
t.Fatal("another key opened it")
|
||||
}
|
||||
if !strings.Contains(err.Error(), "different key") {
|
||||
t.Errorf("the error does not name the cause: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestTheKeyFileIsMadeOnceAndKeptPrivate(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
if _, err := Open("", dir); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
path := filepath.Join(dir, KeyFile)
|
||||
info, err := os.Stat(path)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if perm := info.Mode().Perm(); perm != 0o600 {
|
||||
t.Errorf("the key file is %04o, not 0600", perm)
|
||||
}
|
||||
|
||||
// Opening again must reuse it. A second key here would quietly make every
|
||||
// stored token unreadable, and it would look like the mailboxes disconnecting
|
||||
// themselves overnight.
|
||||
first, _ := os.ReadFile(path)
|
||||
if _, err := Open("", dir); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
second, _ := os.ReadFile(path)
|
||||
if string(first) != string(second) {
|
||||
t.Error("opening a second time replaced the key")
|
||||
}
|
||||
}
|
||||
|
||||
func TestAKeyOthersCanReadIsRefused(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
if _, err := Open("", dir); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
path := filepath.Join(dir, KeyFile)
|
||||
if err := os.Chmod(path, 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := Open("", dir); err == nil {
|
||||
t.Error("a world-readable key was accepted")
|
||||
}
|
||||
}
|
||||
|
||||
// The environment wins, so a host can keep the key off its disks altogether.
|
||||
func TestTheEnvironmentBeatsTheFile(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
key := base64.StdEncoding.EncodeToString([]byte(strings.Repeat("k", 32)))
|
||||
if _, err := Open(key, dir); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := os.Stat(filepath.Join(dir, KeyFile)); !os.IsNotExist(err) {
|
||||
t.Error("a key file was written even though the environment carried one")
|
||||
}
|
||||
|
||||
if _, err := Open("too-short", dir); err == nil {
|
||||
t.Error("a key that is not 32 bytes was accepted")
|
||||
}
|
||||
}
|
||||
|
||||
func mustBox(t *testing.T) *Box {
|
||||
t.Helper()
|
||||
b, err := Open("", t.TempDir())
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return b
|
||||
}
|
||||
@@ -5,6 +5,7 @@ import (
|
||||
"database/sql"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"time"
|
||||
|
||||
"github.com/kristianwind/verdande/internal/auth"
|
||||
@@ -313,6 +314,65 @@ func (db *DB) UsersWithGmail(ctx context.Context) ([]User, error) {
|
||||
|
||||
// UserSettings reads one scope of a person's integration settings. A missing row is
|
||||
// an empty map, not an error: nobody has settings until they set some.
|
||||
// --- sealed values ----------------------------------------------------------------
|
||||
|
||||
// secretFields are the keys whose values never leave this process in the clear.
|
||||
//
|
||||
// A named set rather than "seal everything": the rest of a settings blob is what
|
||||
// somebody reads when a mailbox misbehaves — which folder, which label, which
|
||||
// address — and turning all of it into ciphertext would buy nothing and cost the
|
||||
// ability to look.
|
||||
var secretFields = map[string]bool{
|
||||
"refresh_token": true,
|
||||
"access_token": true,
|
||||
"password": true,
|
||||
"client_secret": true,
|
||||
}
|
||||
|
||||
// seal returns a copy of values with the secret fields sealed. Without a key it
|
||||
// returns them untouched, which is what the tests that never set one expect.
|
||||
func (db *DB) seal(values map[string]any) (map[string]any, error) {
|
||||
if db.box == nil {
|
||||
return values, nil
|
||||
}
|
||||
out := make(map[string]any, len(values))
|
||||
for k, v := range values {
|
||||
s, ok := v.(string)
|
||||
if !secretFields[k] || !ok {
|
||||
out[k] = v
|
||||
continue
|
||||
}
|
||||
sealed, err := db.box.Seal(s)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("seal %s: %w", k, err)
|
||||
}
|
||||
out[k] = sealed
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
// unseal is seal's other direction. Values written before there was a key come
|
||||
// back as themselves; the next write puts them away properly, so the column
|
||||
// converts itself as it is used rather than in one migration that has to be right
|
||||
// about every row at once.
|
||||
func (db *DB) unseal(values map[string]any) (map[string]any, error) {
|
||||
if db.box == nil {
|
||||
return values, nil
|
||||
}
|
||||
for k, v := range values {
|
||||
s, ok := v.(string)
|
||||
if !secretFields[k] || !ok {
|
||||
continue
|
||||
}
|
||||
plain, err := db.box.Unseal(s)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("read %s: %w", k, err)
|
||||
}
|
||||
values[k] = plain
|
||||
}
|
||||
return values, nil
|
||||
}
|
||||
|
||||
func (db *DB) UserSettings(ctx context.Context, userID, scope string) (map[string]any, error) {
|
||||
var raw string
|
||||
err := db.QueryRowContext(ctx,
|
||||
@@ -329,10 +389,14 @@ func (db *DB) UserSettings(ctx context.Context, userID, scope string) (map[strin
|
||||
if err := json.Unmarshal([]byte(raw), &values); err != nil {
|
||||
return map[string]any{}, nil
|
||||
}
|
||||
return values, nil
|
||||
return db.unseal(values)
|
||||
}
|
||||
|
||||
func (db *DB) SetUserSettings(ctx context.Context, userID, scope string, values map[string]any) error {
|
||||
values, err := db.seal(values)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
raw, err := json.Marshal(values)
|
||||
if err != nil {
|
||||
return err
|
||||
@@ -370,10 +434,14 @@ func (db *DB) InstanceSettings(ctx context.Context, scope string) (map[string]an
|
||||
if err := json.Unmarshal([]byte(raw), &values); err != nil {
|
||||
return map[string]any{}, nil
|
||||
}
|
||||
return values, nil
|
||||
return db.unseal(values)
|
||||
}
|
||||
|
||||
func (db *DB) SetInstanceSettings(ctx context.Context, scope string, values map[string]any) error {
|
||||
values, err := db.seal(values)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
raw, err := json.Marshal(values)
|
||||
if err != nil {
|
||||
return err
|
||||
|
||||
@@ -0,0 +1,125 @@
|
||||
package store
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/kristianwind/verdande/internal/secret"
|
||||
)
|
||||
|
||||
// The whole point of the exercise: what is written must not be readable in the
|
||||
// file that a backup copies.
|
||||
func TestATokenIsNotStoredInTheClear(t *testing.T) {
|
||||
db, userID := sealedStore(t)
|
||||
ctx := context.Background()
|
||||
|
||||
const token = "1//0-a-real-looking-refresh-token"
|
||||
if err := db.SetUserSettings(ctx, userID, "gmail", map[string]any{
|
||||
"refresh_token": token,
|
||||
"label": "Verdande",
|
||||
}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
var raw string
|
||||
if err := db.QueryRowContext(ctx,
|
||||
`SELECT values_json FROM user_settings WHERE user_id = ?`, userID).Scan(&raw); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if strings.Contains(raw, token) {
|
||||
t.Fatalf("the token is in the row as written: %s", raw)
|
||||
}
|
||||
// The rest stays readable, which is the reason for naming the secret fields
|
||||
// rather than sealing the whole blob.
|
||||
if !strings.Contains(raw, "Verdande") {
|
||||
t.Errorf("the label was sealed too: %s", raw)
|
||||
}
|
||||
|
||||
back, err := db.UserSettings(ctx, userID, "gmail")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if back["refresh_token"] != token {
|
||||
t.Errorf("got %q back", back["refresh_token"])
|
||||
}
|
||||
}
|
||||
|
||||
// The migration that matters. A row written before there was a key must still be
|
||||
// readable, and must put itself away sealed the next time it is written — nobody
|
||||
// should have to reconnect a mailbox because the server learned to encrypt.
|
||||
func TestATokenWrittenBeforeTheKeyStillWorks(t *testing.T) {
|
||||
db, userID := sealedStore(t)
|
||||
ctx := context.Background()
|
||||
|
||||
const token = "1//0-written-when-there-was-no-key"
|
||||
plain, _ := json.Marshal(map[string]any{"refresh_token": token})
|
||||
if _, err := db.ExecContext(ctx, `
|
||||
INSERT INTO user_settings (user_id, scope, values_json, updated_at)
|
||||
VALUES (?, 'gmail', ?, 0)`, userID, string(plain)); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
values, err := db.UserSettings(ctx, userID, "gmail")
|
||||
if err != nil {
|
||||
t.Fatalf("a row from before the key could not be read: %v", err)
|
||||
}
|
||||
if values["refresh_token"] != token {
|
||||
t.Fatalf("got %q, want the plain token back", values["refresh_token"])
|
||||
}
|
||||
|
||||
// Written back — and now sealed, without anything having asked for it.
|
||||
if err := db.SetUserSettings(ctx, userID, "gmail", values); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
var raw string
|
||||
if err := db.QueryRowContext(ctx,
|
||||
`SELECT values_json FROM user_settings WHERE user_id = ?`, userID).Scan(&raw); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if strings.Contains(raw, token) {
|
||||
t.Error("the row is still in the clear after being written back")
|
||||
}
|
||||
}
|
||||
|
||||
// UsersWithGmail finds people by the presence of the key, not its value, so it
|
||||
// must keep working now that the value is ciphertext.
|
||||
func TestTheSweepStillFindsAConnectedMailbox(t *testing.T) {
|
||||
db, userID := sealedStore(t)
|
||||
ctx := context.Background()
|
||||
|
||||
if err := db.SetUserSettings(ctx, userID, "gmail",
|
||||
map[string]any{"refresh_token": "1//0-token"}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
users, err := db.UsersWithGmail(ctx)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if len(users) != 1 {
|
||||
t.Fatalf("the sweep found %d connected mailboxes, want 1", len(users))
|
||||
}
|
||||
}
|
||||
|
||||
func sealedStore(t *testing.T) (*DB, string) {
|
||||
t.Helper()
|
||||
db, err := Open(filepath.Join(t.TempDir(), "test.db"))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
t.Cleanup(func() { db.Close() })
|
||||
|
||||
box, err := secret.Open("", t.TempDir())
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
db.UseSecrets(box)
|
||||
|
||||
user := &User{Email: "kristian@example.dk", Name: "Kristian"}
|
||||
if err := db.CreateUser(context.Background(), user, "Indbakke"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return db, user.ID
|
||||
}
|
||||
@@ -7,6 +7,7 @@ import (
|
||||
"database/sql"
|
||||
"embed"
|
||||
"fmt"
|
||||
"github.com/kristianwind/verdande/internal/secret"
|
||||
"io/fs"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
@@ -23,8 +24,20 @@ var migrationFS embed.FS
|
||||
type DB struct {
|
||||
*sql.DB
|
||||
path string
|
||||
|
||||
// box seals the values that must not travel with a backup. Nil in the tests
|
||||
// that do not care, where a secret is stored as itself — see Seal.
|
||||
box *secret.Box
|
||||
}
|
||||
|
||||
// UseSecrets gives the store the key it seals with. Called once at startup, before
|
||||
// anything reads or writes settings.
|
||||
//
|
||||
// Separate from Open because the key comes from the environment or from a file
|
||||
// beside the data, and a database that cannot be opened without it would make a
|
||||
// misplaced key look like a corrupt disk.
|
||||
func (db *DB) UseSecrets(box *secret.Box) { db.box = box }
|
||||
|
||||
// dsn is the connection string.
|
||||
//
|
||||
// SQLite is a single file, but it is being driven by an HTTP server with concurrent
|
||||
|
||||
+6
-1
@@ -15,7 +15,7 @@ gameskill:
|
||||
# this: a manifest with new fields and an unchanged version is a manifest the
|
||||
# panel has no reason to re-read, so the fields never appear and the failure is
|
||||
# silent — the server's settings page simply does not offer them.
|
||||
version: 3
|
||||
version: 4
|
||||
icon: "app"
|
||||
|
||||
# The image is distroless — no shell — so keep_entrypoint runs the binary the
|
||||
@@ -99,6 +99,11 @@ gameskill:
|
||||
name: "This server's id in the panel (the one in its URL)"
|
||||
type: string
|
||||
default: ""
|
||||
- key: VERDANDE_SECRET_KEY
|
||||
name: "Key for the tokens and mailbox passwords in the database — 32 bytes of base64, from: openssl rand -base64 32. Leave empty to keep one in a file beside the data. Change it and every mailbox must be connected again."
|
||||
type: string
|
||||
secret: true
|
||||
default: ""
|
||||
|
||||
install:
|
||||
# The image has no shell, so the install step borrows one. It only has to make
|
||||
|
||||
@@ -1768,3 +1768,49 @@ test('MCP-adressen svarer JSON, ikke app-skallen', async ({ request }) => {
|
||||
expect(response.headers()['content-type']).toContain('application/json');
|
||||
expect((await response.json()).code).toBe('unauthorized');
|
||||
});
|
||||
|
||||
test('man kan skrive hvor som helst, og feltet fortæller hvad det forstår', async ({ page }) => {
|
||||
const trouble = watchForTrouble(page);
|
||||
await page.goto('/');
|
||||
|
||||
// Nothing focused, nothing clicked: just type. The thought does not have to
|
||||
// survive a journey to find somewhere to put it.
|
||||
await page.locator('body').click({ position: { x: 5, y: 5 } });
|
||||
// "i dag" because this is the Today view: a task parsed onto no date at all is
|
||||
// correctly absent from it, which would read as the capture having failed.
|
||||
await page.keyboard.type('ring til Anders i dag');
|
||||
|
||||
const field = page.locator('[data-quickadd]');
|
||||
await expect(field).toBeFocused();
|
||||
// Every letter arrives, including the first — which is the one a naive
|
||||
// implementation drops while it is busy moving focus.
|
||||
await expect(field).toHaveValue('ring til Anders i dag');
|
||||
|
||||
// And the legend appears with the field, saying what the parser can read. It
|
||||
// used to live in the placeholder, which vanishes at the first keystroke —
|
||||
// exactly when the help starts being useful.
|
||||
await expect(page.getByText('projekt', { exact: false }).first()).toBeVisible();
|
||||
|
||||
await page.keyboard.press('Enter');
|
||||
await expect(page.getByText('ring til Anders', { exact: true })).toBeVisible();
|
||||
|
||||
// In English too. The shortcut used to find the field by its Danish label, so
|
||||
// it silently did nothing for anybody running the interface in English.
|
||||
await page.goto('/indstillinger');
|
||||
await page.getByLabel('Sprog').selectOption('en');
|
||||
await page.getByRole('button', { name: 'Gem' }).first().click();
|
||||
await page.goto('/');
|
||||
await page.locator('body').click({ position: { x: 5, y: 5 } });
|
||||
await page.keyboard.type('call Anders');
|
||||
await expect(page.locator('[data-quickadd]')).toHaveValue('call Anders');
|
||||
|
||||
// Back to Danish. The account is shared with every test after this one, and
|
||||
// leaving it in English made three of them hunt for buttons by names that no
|
||||
// longer existed — a failure that looks like the feature under test and is not.
|
||||
await page.goto('/indstillinger');
|
||||
await page.getByLabel('Language').selectOption('da');
|
||||
await page.getByRole('button', { name: 'Save' }).first().click();
|
||||
await expect(page.getByRole('button', { name: 'Gem' }).first()).toBeVisible();
|
||||
|
||||
expect(trouble).toEqual([]);
|
||||
});
|
||||
|
||||
@@ -21,6 +21,19 @@
|
||||
let spans = $state([]);
|
||||
let submitting = $state(false);
|
||||
let input;
|
||||
let focused = $state(false);
|
||||
|
||||
// Kept beside the parser's own vocabulary on purpose: a legend that promises
|
||||
// something internal/quickadd cannot read is worse than no legend. These four
|
||||
// are what Parse recognises as marks; dates it reads as prose, which is why the
|
||||
// last entry is an example rather than a symbol.
|
||||
let syntax = $derived([
|
||||
{ mark: '#', what: t('task.syntaxProject') },
|
||||
{ mark: '/', what: t('task.syntaxSection') },
|
||||
{ mark: '@', what: t('task.syntaxLabel') },
|
||||
{ mark: 'p1', what: t('task.syntaxPriority') },
|
||||
{ mark: t('task.syntaxDateMark'), what: t('task.syntaxDate') }
|
||||
]);
|
||||
|
||||
let previewController = null;
|
||||
let previewTimer = null;
|
||||
@@ -143,7 +156,10 @@
|
||||
bind:this={input}
|
||||
bind:value={text}
|
||||
{onkeydown}
|
||||
onfocus={() => (focused = true)}
|
||||
onblur={() => (focused = false)}
|
||||
type="text"
|
||||
data-quickadd
|
||||
placeholder={t('task.placeholder')}
|
||||
aria-label={t('task.new')}
|
||||
autocomplete="off"
|
||||
@@ -154,10 +170,52 @@
|
||||
{#if text.trim()}
|
||||
<button type="submit" class="submit" disabled={submitting}>{t('task.add')}</button>
|
||||
{/if}
|
||||
|
||||
<!-- What the parser understands, spelled out while somebody is typing into it.
|
||||
It was in the placeholder before, which is the one place a hint cannot be:
|
||||
the placeholder disappears at the first keystroke, so the help was gone
|
||||
exactly when it started being useful.
|
||||
|
||||
Floated rather than in the flow. In the flow it pushed the whole list down
|
||||
the moment the field took focus, and a click aimed at the first task landed
|
||||
on the second — twelve tests caught it, which is twelve more than the eye
|
||||
would have. -->
|
||||
{#if focused}
|
||||
<p class="syntax">
|
||||
{#each syntax as item}
|
||||
<span><kbd>{item.mark}</kbd> {item.what}</span>
|
||||
{/each}
|
||||
</p>
|
||||
{/if}
|
||||
</form>
|
||||
|
||||
<style>
|
||||
/* Sits under the field it explains, in the same rhythm as a hint anywhere else. */
|
||||
.syntax {
|
||||
/* Nothing to click, and it floats over the first task in the list — which it
|
||||
promptly swallowed the clicks of. Legends are for reading. */
|
||||
pointer-events: none;
|
||||
position: absolute;
|
||||
top: 100%;
|
||||
left: 0;
|
||||
right: 0;
|
||||
z-index: 2;
|
||||
background: var(--surface);
|
||||
display: flex;
|
||||
flex-wrap: wrap;
|
||||
gap: var(--s1) var(--s3);
|
||||
padding: var(--s1) 0 0 var(--s4);
|
||||
font-size: var(--text-xs);
|
||||
color: var(--ink-faint);
|
||||
}
|
||||
|
||||
.syntax kbd {
|
||||
font-family: var(--mono, ui-monospace, monospace);
|
||||
color: var(--ink-muted);
|
||||
}
|
||||
|
||||
.quickadd {
|
||||
position: relative;
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: var(--s3);
|
||||
|
||||
@@ -57,6 +57,12 @@ export const da = {
|
||||
// --- a task in a list ----------------------------------------------------------
|
||||
'task.add': 'Tilføj',
|
||||
'task.new': 'Ny opgave',
|
||||
'task.syntaxProject': 'projekt',
|
||||
'task.syntaxSection': 'sektion',
|
||||
'task.syntaxLabel': 'etiket',
|
||||
'task.syntaxPriority': 'prioritet',
|
||||
'task.syntaxDateMark': 'i morgen kl 10',
|
||||
'task.syntaxDate': 'forfalder',
|
||||
'task.placeholder': 'Tilføj en opgave — prøv “betal moms i morgen kl 10 p1 #Firma”',
|
||||
'task.complete': 'Markér som færdig',
|
||||
'task.reopen': 'Genåbn opgave',
|
||||
@@ -360,6 +366,8 @@ export const da = {
|
||||
'Slettede projekter, med deres opgaver. De bliver hentet tilbage præcis som de var — bortset fra opgaver, du havde slettet hver for sig først; dem var der en grund til.',
|
||||
'data.backupsHint':
|
||||
'Databasen kopieres hver nat og de seneste fjorten gemmes. Kopierne er talt, ikke dateret: en container, der har stået slukket en måned, må ikke komme tilbage og slette dem alle for at være for gamle.',
|
||||
'data.backupsSecrets':
|
||||
'Tokens og kodeord til postkasser ligger krypteret i kopien, og nøglen gør ikke: den ligger i en fil ved siden af databasen. Det er meningen — en kopi, der kommer på afveje, åbner ikke din mail. Men gendanner du en kopi et sted uden den fil, skal postkasserne forbindes forfra.',
|
||||
'data.backupsAttachments':
|
||||
'Vedhæftede filer er ikke med. De er indholdsadresserede og bliver kun lagt til, så fjorten ens kopier af dem ville fylde det drev op, de skulle beskytte — tag hele /data, hvis du vil have det hele.',
|
||||
'data.restoreHint':
|
||||
@@ -369,6 +377,8 @@ export const da = {
|
||||
'data.templatesHint':
|
||||
'Et projekt gemt som en form, der kan bruges igen. Datoerne i skabelonen er relative, så de bliver regnet ud fra den startdato, du vælger.',
|
||||
|
||||
'keys.anyLetter': 'et bogstav',
|
||||
'keys.typeToCapture': 'begynder en opgave, med bogstavet i feltet',
|
||||
'keys.navigation': 'Navigation',
|
||||
'keys.jumpToQuickAdd': 'Hop til feltet “tilføj opgave”',
|
||||
'keys.thisPage': 'Denne side',
|
||||
|
||||
@@ -53,6 +53,12 @@ export const en = {
|
||||
// --- a task in a list ----------------------------------------------------------
|
||||
'task.add': 'Add',
|
||||
'task.new': 'New task',
|
||||
'task.syntaxProject': 'project',
|
||||
'task.syntaxSection': 'section',
|
||||
'task.syntaxLabel': 'label',
|
||||
'task.syntaxPriority': 'priority',
|
||||
'task.syntaxDateMark': 'tomorrow at 10',
|
||||
'task.syntaxDate': 'due',
|
||||
'task.placeholder': 'Add a task — try “pay VAT tomorrow at 10 p1 #Company”',
|
||||
'task.complete': 'Mark as done',
|
||||
'task.reopen': 'Reopen task',
|
||||
@@ -355,6 +361,8 @@ export const en = {
|
||||
'Deleted projects, with their tasks. They come back exactly as they were — except for tasks you had deleted individually first; there was a reason for those.',
|
||||
'data.backupsHint':
|
||||
'The database is copied every night and the most recent fourteen are kept. Counted, not dated: a container that has been off for a month must not come back and delete all of them for being too old.',
|
||||
'data.backupsSecrets':
|
||||
'Tokens and mailbox passwords are encrypted inside the copy, and the key is not: it sits in a file beside the database. That is the point — a copy that goes astray does not open your mail. But restore a copy somewhere without that file and the mailboxes must be connected again.',
|
||||
'data.backupsAttachments':
|
||||
'Attachments are not included. They are content-addressed and only ever added to, so fourteen identical copies would fill the volume they were meant to protect — take the whole of /data if you want everything.',
|
||||
'data.restoreHint':
|
||||
@@ -364,6 +372,8 @@ export const en = {
|
||||
'data.templatesHint':
|
||||
'A project saved as a shape you can use again. The dates in a template are relative, so they are worked out from the start date you pick.',
|
||||
|
||||
'keys.anyLetter': 'any letter',
|
||||
'keys.typeToCapture': 'starts a task, with the letter already in the field',
|
||||
'keys.navigation': 'Navigation',
|
||||
'keys.jumpToQuickAdd': 'Jump to the “add a task” field',
|
||||
'keys.thisPage': 'This page',
|
||||
|
||||
@@ -29,16 +29,31 @@
|
||||
});
|
||||
|
||||
/**
|
||||
* Global shortcuts, mapped the way Todoist maps them so muscle memory carries
|
||||
* over. They are ignored while a text field has focus — otherwise typing "t"
|
||||
* in a task title would navigate away mid-sentence.
|
||||
* Global keys.
|
||||
*
|
||||
* Typing anywhere starts a task, with the letter already in the field. That is
|
||||
* the whole gesture: no button to hit first, no shortcut to remember, and the
|
||||
* thought you had while looking at a list does not have to survive a journey to
|
||||
* find somewhere to put it.
|
||||
*
|
||||
* It costs the single-letter navigation. "t" for today and "u" for upcoming
|
||||
* cannot also be the first letter of "tal med Anders" — one keyboard cannot
|
||||
* serve both, and capturing is the thing done fifty times a day. Navigation
|
||||
* lives in the palette, which does more and is one keystroke away.
|
||||
*
|
||||
* Ignored while a field already has focus, while a task is open — the drawer is
|
||||
* a place you are, not one you pass through — and for anything held with a
|
||||
* modifier, which belongs to the browser and the system.
|
||||
*/
|
||||
function onkeydown(event) {
|
||||
const el = event.target;
|
||||
const typing =
|
||||
el instanceof HTMLInputElement ||
|
||||
el instanceof HTMLTextAreaElement ||
|
||||
el?.isContentEditable;
|
||||
// Only when nothing has focus. The first version asked the narrower question
|
||||
// — "is this a text field?" — and so captured a letter typed at a focused
|
||||
// select, button or link, which is where that letter belongs. A key pressed
|
||||
// at something is meant for it; only a key pressed at the page itself is
|
||||
// spare.
|
||||
const idle = el === document.body || el === document.documentElement;
|
||||
const typing = !idle;
|
||||
|
||||
if ((event.metaKey || event.ctrlKey) && event.key === 'k') {
|
||||
event.preventDefault();
|
||||
@@ -46,25 +61,24 @@
|
||||
return;
|
||||
}
|
||||
if (typing || event.metaKey || event.ctrlKey || event.altKey) return;
|
||||
// The navigation shortcuts are for the list. With a task open, "t" means the
|
||||
// letter t — the drawer is a place you are, not a place you pass through.
|
||||
if (app.detailId) return;
|
||||
|
||||
switch (event.key) {
|
||||
case 'q':
|
||||
event.preventDefault();
|
||||
document.querySelector('input[aria-label="Ny opgave"]')?.focus();
|
||||
break;
|
||||
case 't':
|
||||
goto('/');
|
||||
break;
|
||||
case 'u':
|
||||
goto('/upcoming');
|
||||
break;
|
||||
case '?':
|
||||
goto('/genveje');
|
||||
break;
|
||||
}
|
||||
// One character, so Tab, Escape, the arrows and the function keys stay
|
||||
// themselves. Space is excluded too: a task that begins with a space begins
|
||||
// with a mis-hit, and space is what people press to scroll a long list.
|
||||
if (event.key.length !== 1 || event.key === ' ') return;
|
||||
|
||||
// Found by a marker rather than by its label. This used to look the field up
|
||||
// by aria-label="Ny opgave", which meant the shortcut quietly did nothing for
|
||||
// anybody running the interface in English.
|
||||
const field = document.querySelector('[data-quickadd]');
|
||||
if (!field) return;
|
||||
|
||||
event.preventDefault();
|
||||
field.focus();
|
||||
field.value += event.key;
|
||||
// Svelte binds on input, and setting .value in script does not raise one.
|
||||
field.dispatchEvent(new Event('input', { bubbles: true }));
|
||||
}
|
||||
</script>
|
||||
|
||||
|
||||
@@ -1,16 +1,20 @@
|
||||
<script>
|
||||
/** The shortcuts, listed. Mapped to Todoist's so muscle memory carries over. */
|
||||
/**
|
||||
* The shortcuts, listed.
|
||||
*
|
||||
* The single-letter navigation this page used to carry — q, t, u — is gone.
|
||||
* Typing anywhere now starts a task, and one keyboard cannot both spell "tal
|
||||
* med Anders" and jump to Today on the same "t". Navigation moved into the
|
||||
* palette, which does more and costs one keystroke.
|
||||
*/
|
||||
import { t } from '$lib/i18n.svelte.js';
|
||||
|
||||
const groups = $derived([
|
||||
{
|
||||
title: t('keys.navigation'),
|
||||
keys: [
|
||||
['q', t('keys.jumpToQuickAdd')],
|
||||
['t', t('nav.today')],
|
||||
['u', t('nav.upcoming')],
|
||||
['⌘K / Ctrl+K', t('nav.search')],
|
||||
['?', t('keys.thisPage')]
|
||||
[t('keys.anyLetter'), t('keys.typeToCapture')],
|
||||
['⌘K / Ctrl+K', t('nav.search')]
|
||||
]
|
||||
},
|
||||
{
|
||||
|
||||
@@ -267,6 +267,13 @@
|
||||
<p class="hint">
|
||||
{t('data.backupsAttachments')}
|
||||
</p>
|
||||
<!-- Said here rather than only in the documentation: this is the page where
|
||||
somebody downloads the file, and the day the key matters is the day
|
||||
they are restoring it somewhere else and wondering why the mailbox is
|
||||
silent. -->
|
||||
<p class="hint">
|
||||
{t('data.backupsSecrets')}
|
||||
</p>
|
||||
</header>
|
||||
|
||||
<div class="row">
|
||||
|
||||
Reference in New Issue
Block a user