peter
47d968eeea
Deep-review round 4, targeted at round 3's changes (f569b19c..e7f38396). Accounts - Switching, adding or signing out an account moved the tab's pin before the page unloaded, so the players' resume beacons fired on the way out under the NEW account: one account's playback position saved into the other. The pin is now handed to the next page (pinOnNextPage) and taken over at import; clearActiveAccount is gone. - Switching to a suspended account was refused but left it in the switcher, refused on every click; a deactivated one was not refused at all, and made the default it signed every account in the browser out on the next request. Every account _session_user would refuse — gone, deactivated, suspended, revoked — is refused and dropped from the list. Share page (/watch) - An IPv6 client is limited by its /64 (client_ip becomes client_key, for every limiter): keyed on the full address, one subscriber could rotate through endless identities. The comments now state what the per-link ceiling costs: guessing from five networks can keep a link shut for its window, and guesses already running when it fills are still checked. - The link is looked up before the limiter records the attempt, so made-up tokens no longer grow it by an entry each. Forms - Failing the same way twice is announced again: the sign-in, passphrase and setup errors are keyed on the attempt (a clear and a set in one handler left the alert node untouched). - The install wizard's own validation showed the generic error — it threw plain objects its catch did not read. It sets the step's message. Tests: a re-pin leaving the previous account's notices behind; the pin hand-over; switching to an ended account; the /64 viewer; made-up tokens; the repeated alerts. Each mutation-checked RED for its own reason.
79 lines
3.2 KiB
TypeScript
79 lines
3.2 KiB
TypeScript
// The account a browser TAB is acting as (per-tab, in sessionStorage — see api.ts). Its OWN module
|
|
// (imports nothing internal) so it can be shared by `storage.ts`, which keys per-account localStorage
|
|
// on it, without a circular import — the account id is a lower-level primitive than the storage
|
|
// helpers that consume it.
|
|
//
|
|
// Deliberately NOT reactive: BootGate pins the account before any provider mounts, and a switch reloads
|
|
// the page (handing the new pin over through `pinOnNextPage`), so nothing mounted ever sees the id change
|
|
// underneath it. The one exception is state read at
|
|
// module import (the notification and hints stores), which in a new tab runs before the pin: it reads
|
|
// again through `onAccountPinned`.
|
|
//
|
|
// ACTIVE_ACCOUNT_KEY is duplicated here rather than imported from api.ts so this stays dependency-free.
|
|
export const ACTIVE_ACCOUNT_KEY = "siftlode.activeAccount";
|
|
|
|
// Re-readers for module-level per-account state, run each time the tab is pinned.
|
|
const pinListeners = new Set<() => void>();
|
|
|
|
export function onAccountPinned(reload: () => void): void {
|
|
pinListeners.add(reload);
|
|
}
|
|
|
|
export function pinActiveAccount(id: number): void {
|
|
try {
|
|
sessionStorage.setItem(ACTIVE_ACCOUNT_KEY, String(id));
|
|
} catch {
|
|
/* ignore */
|
|
}
|
|
pinListeners.forEach((reload) => reload());
|
|
}
|
|
|
|
// The account the tab's NEXT page is pinned to, handed over by a switch or sign-out that is about to leave.
|
|
// The pin itself stays until the page is gone: the unload still runs as the account the page was built for
|
|
// (the players' resume beacons read the pin as they fire), and with the pin already moved it would save one
|
|
// account's position into the other.
|
|
const NEXT_ACCOUNT_KEY = "siftlode.nextAccount";
|
|
|
|
/** Pin the tab's next page to `id` — or to none, so it adopts the session's default account. */
|
|
export function pinOnNextPage(id: number | null): void {
|
|
try {
|
|
sessionStorage.setItem(NEXT_ACCOUNT_KEY, id == null ? "" : String(id));
|
|
} catch {
|
|
/* ignore */
|
|
}
|
|
}
|
|
|
|
// Taken over at import, before anything reads the pin.
|
|
try {
|
|
const next = sessionStorage.getItem(NEXT_ACCOUNT_KEY);
|
|
if (next != null) {
|
|
sessionStorage.removeItem(NEXT_ACCOUNT_KEY);
|
|
if (next) sessionStorage.setItem(ACTIVE_ACCOUNT_KEY, next);
|
|
else sessionStorage.removeItem(ACTIVE_ACCOUNT_KEY);
|
|
}
|
|
} catch {
|
|
/* ignore */
|
|
}
|
|
|
|
export function activeAccountId(): number | null {
|
|
try {
|
|
const raw = sessionStorage.getItem(ACTIVE_ACCOUNT_KEY);
|
|
if (!raw) return null;
|
|
const n = Number(raw);
|
|
return Number.isFinite(n) ? n : null;
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
// Append `?account=<active>` to a top-level navigation URL (SEC-11). XHRs carry the active account in
|
|
// the X-Siftlode-Account header, but a full-page navigation (window.location) can't, so the OAuth
|
|
// link/upgrade GETs would resolve to the SESSION DEFAULT account instead of the tab's active one — the
|
|
// identity/token would then land on the wrong account. This threads the active account through the URL
|
|
// so resolved_user_id picks it. No-op when there's no distinct active account pinned yet.
|
|
export function withActiveAccount(path: string): string {
|
|
const id = activeAccountId();
|
|
if (id == null) return path;
|
|
return `${path}${path.includes("?") ? "&" : "?"}account=${id}`;
|
|
}
|