alice.pds.demo.boltless.dev
This repository has no description
1package signup
2
3import (
4 "bufio"
5 "context"
6 "encoding/json"
7 "errors"
8 "fmt"
9 "log/slog"
10 "net/http"
11 "net/url"
12 "os"
13 "strings"
14
15 "github.com/go-chi/chi/v5"
16 "github.com/posthog/posthog-go"
17 "tangled.org/core/appview/cloudflare"
18 "tangled.org/core/appview/config"
19 "tangled.org/core/appview/db"
20 "tangled.org/core/appview/email"
21 "tangled.org/core/appview/models"
22 "tangled.org/core/appview/pages"
23 "tangled.org/core/appview/state/userutil"
24 "tangled.org/core/idresolver"
25)
26
27type Signup struct {
28 config *config.Config
29 db *db.DB
30 cf *cloudflare.Client
31 posthog posthog.Client
32 idResolver *idresolver.Resolver
33 pages *pages.Pages
34 l *slog.Logger
35 disallowedNicknames map[string]bool
36}
37
38func New(cfg *config.Config, database *db.DB, pc posthog.Client, idResolver *idresolver.Resolver, pages *pages.Pages, l *slog.Logger) *Signup {
39 var cf *cloudflare.Client
40 if cfg.Cloudflare.ApiToken != "" {
41 var err error
42 cf, err = cloudflare.New(cfg)
43 if err != nil {
44 l.Warn("failed to create cloudflare client, signup will be disabled", "error", err)
45 }
46 }
47
48 disallowedNicknames := loadDisallowedNicknames(cfg.Core.DisallowedNicknamesFile, l)
49
50 return &Signup{
51 config: cfg,
52 db: database,
53 posthog: pc,
54 idResolver: idResolver,
55 cf: cf,
56 pages: pages,
57 l: l,
58 disallowedNicknames: disallowedNicknames,
59 }
60}
61
62func loadDisallowedNicknames(filepath string, logger *slog.Logger) map[string]bool {
63 disallowed := make(map[string]bool)
64
65 if filepath == "" {
66 logger.Warn("no disallowed nicknames file configured")
67 return disallowed
68 }
69
70 file, err := os.Open(filepath)
71 if err != nil {
72 logger.Warn("failed to open disallowed nicknames file", "file", filepath, "error", err)
73 return disallowed
74 }
75 defer file.Close()
76
77 scanner := bufio.NewScanner(file)
78 lineNum := 0
79 for scanner.Scan() {
80 lineNum++
81 line := strings.TrimSpace(scanner.Text())
82 if line == "" || strings.HasPrefix(line, "#") {
83 continue // skip empty lines and comments
84 }
85
86 nickname := strings.ToLower(line)
87 if userutil.IsValidSubdomain(nickname) {
88 disallowed[nickname] = true
89 } else {
90 logger.Warn("invalid nickname format in disallowed nicknames file",
91 "file", filepath, "line", lineNum, "nickname", nickname)
92 }
93 }
94
95 if err := scanner.Err(); err != nil {
96 logger.Error("error reading disallowed nicknames file", "file", filepath, "error", err)
97 }
98
99 logger.Info("loaded disallowed nicknames", "count", len(disallowed), "file", filepath)
100 return disallowed
101}
102
103// isNicknameAllowed checks if a nickname is allowed (not in the disallowed list)
104func (s *Signup) isNicknameAllowed(nickname string) bool {
105 return !s.disallowedNicknames[strings.ToLower(nickname)]
106}
107
108func (s *Signup) Router() http.Handler {
109 r := chi.NewRouter()
110 r.Get("/", s.signup)
111 r.Post("/", s.signup)
112 r.Get("/complete", s.complete)
113 r.Post("/complete", s.complete)
114
115 return r
116}
117
118func (s *Signup) signup(w http.ResponseWriter, r *http.Request) {
119 switch r.Method {
120 case http.MethodGet:
121 emailId := r.URL.Query().Get("id")
122 s.pages.Signup(w, pages.SignupParams{
123 BaseParams: pages.BaseParamsFromContext(r.Context()),
124 CloudflareSiteKey: s.config.Cloudflare.Turnstile.SiteKey,
125 EmailId: emailId,
126 })
127 case http.MethodPost:
128 if s.cf == nil {
129 http.Error(w, "signup is disabled", http.StatusFailedDependency)
130 return
131 }
132 emailId := r.FormValue("email")
133 cfToken := r.FormValue("cf-turnstile-response")
134
135 noticeId := "signup-msg"
136
137 if err := s.validateCaptcha(cfToken, r); err != nil {
138 s.l.Warn("turnstile validation failed", "error", err, "email", emailId)
139 s.pages.Notice(w, noticeId, "Captcha validation failed.")
140 return
141 }
142
143 if !email.IsValidEmail(emailId) {
144 s.pages.Notice(w, noticeId, "Invalid email address.")
145 return
146 }
147
148 exists, err := db.CheckEmailExistsAtAll(s.db, emailId)
149 if err != nil {
150 s.l.Error("failed to check email existence", "error", err)
151 s.pages.Notice(w, noticeId, "Failed to complete signup. Try again later.")
152 return
153 }
154 if exists {
155 s.pages.Notice(w, noticeId, "Email already exists.")
156 return
157 }
158
159 code, err := s.inviteCodeRequest()
160 if err != nil {
161 s.l.Error("failed to create invite code", "error", err)
162 s.pages.Notice(w, noticeId, "Failed to create invite code.")
163 return
164 }
165
166 em := email.Email{
167 APIKey: s.config.Resend.ApiKey,
168 From: s.config.Resend.SentFrom,
169 To: emailId,
170 Subject: "Verify your Tangled account",
171 Text: `Copy and paste this code below to verify your account on Tangled.
172 ` + code,
173 Html: `<p>Copy and paste this code below to verify your account on Tangled.</p>
174<p><code>` + code + `</code></p>`,
175 }
176
177 err = email.SendEmail(em)
178 if err != nil {
179 s.l.Error("failed to send email", "error", err)
180 s.pages.Notice(w, noticeId, "Failed to send email.")
181 return
182 }
183 err = db.AddInflightSignup(s.db, models.InflightSignup{
184 Email: emailId,
185 InviteCode: code,
186 })
187 if err != nil {
188 s.l.Error("failed to add inflight signup", "error", err)
189 s.pages.Notice(w, noticeId, "Failed to complete sign up. Try again later.")
190 return
191 }
192
193 s.pages.HxRedirect(w, "/signup/complete")
194 }
195}
196
197func (s *Signup) complete(w http.ResponseWriter, r *http.Request) {
198 switch r.Method {
199 case http.MethodGet:
200 s.pages.CompleteSignup(w)
201 case http.MethodPost:
202 username := r.FormValue("username")
203 password := r.FormValue("password")
204 code := r.FormValue("code")
205
206 if !userutil.IsValidSubdomain(username) {
207 s.pages.Notice(w, "signup-error", "Invalid username. Username must be 4–63 characters, lowercase letters, digits, or hyphens, and can't start or end with a hyphen.")
208 return
209 }
210
211 if !s.isNicknameAllowed(username) {
212 s.pages.Notice(w, "signup-error", "This username is not available. Please choose a different one.")
213 return
214 }
215
216 email, err := db.GetEmailForCode(s.db, code)
217 if err != nil {
218 s.l.Error("failed to get email for code", "error", err)
219 s.pages.Notice(w, "signup-error", "Failed to complete sign up. Try again later.")
220 return
221 }
222
223 if s.cf == nil {
224 s.l.Error("cloudflare client is nil", "error", "Cloudflare integration is not enabled in configuration")
225 s.pages.Notice(w, "signup-error", "Account signup is currently disabled. DNS record creation is not available. Please contact support.")
226 return
227 }
228
229 // Execute signup transactionally with rollback capability
230 err = s.executeSignupTransaction(r.Context(), username, password, email, code, w)
231 if err != nil {
232 // Error already logged and notice already sent
233 return
234 }
235 }
236}
237
238// executeSignupTransaction performs the signup process transactionally with rollback
239func (s *Signup) executeSignupTransaction(ctx context.Context, username, password, email, code string, w http.ResponseWriter) error {
240 // var recordID string
241 var did string
242 var emailAdded bool
243
244 success := false
245 defer func() {
246 if !success {
247 s.l.Info("rolling back signup transaction", "username", username, "did", did)
248
249 // Rollback DNS record
250 // if recordID != "" {
251 // if err := s.cf.DeleteDNSRecord(ctx, recordID); err != nil {
252 // s.l.Error("failed to rollback DNS record", "error", err, "recordID", recordID)
253 // } else {
254 // s.l.Info("successfully rolled back DNS record", "recordID", recordID)
255 // }
256 // }
257
258 // Rollback PDS account
259 if did != "" {
260 if err := s.deleteAccountRequest(did); err != nil {
261 s.l.Error("failed to rollback PDS account", "error", err, "did", did)
262 } else {
263 s.l.Info("successfully rolled back PDS account", "did", did)
264 }
265 }
266
267 // Rollback email from database
268 if emailAdded {
269 if err := db.DeleteEmail(s.db, did, email); err != nil {
270 s.l.Error("failed to rollback email from database", "error", err, "email", email)
271 } else {
272 s.l.Info("successfully rolled back email from database", "email", email)
273 }
274 }
275 }
276 }()
277
278 // step 1: create account in PDS
279 did, err := s.createAccountRequest(username, password, email, code)
280 if err != nil {
281 s.l.Error("failed to create account", "error", err)
282 s.pages.Notice(w, "signup-error", err.Error())
283 return err
284 }
285
286 // XXX: we have a wildcard *.tngl.sh record now
287 // step 2: create DNS record with actual DID
288 // recordID, err = s.cf.CreateDNSRecord(ctx, cloudflare.DNSRecord{
289 // Type: "TXT",
290 // Name: "_atproto." + username,
291 // Content: fmt.Sprintf(`"did=%s"`, did),
292 // TTL: 6400,
293 // Proxied: false,
294 // })
295 // if err != nil {
296 // s.l.Error("failed to create DNS record", "error", err)
297 // s.pages.Notice(w, "signup-error", "Failed to create DNS record for your handle. Please contact support.")
298 // return err
299 // }
300
301 // step 3: add email to database
302 err = db.AddEmail(s.db, models.Email{
303 Did: did,
304 Address: email,
305 Verified: true,
306 Primary: true,
307 })
308 if err != nil {
309 s.l.Error("failed to add email", "error", err)
310 s.pages.Notice(w, "signup-error", "Failed to complete sign up. Try again later.")
311 return err
312 }
313 emailAdded = true
314
315 // step 4: auto-claim <username>.<pds-domain> for this user.
316 // All signups through this flow receive a <username>.tngl.sh handle
317 // (or whatever the configured PDS host is), so we claim the matching
318 // sites subdomain on their behalf. This is the only way to obtain a
319 // *.tngl.sh sites domain; it cannot be claimed manually via settings.
320 pdsDomain := strings.TrimPrefix(s.config.Pds.Host, "https://")
321 pdsDomain = strings.TrimPrefix(pdsDomain, "http://")
322 autoClaimDomain := username + "." + pdsDomain
323 if err := db.ClaimDomain(s.db, did, autoClaimDomain); err != nil {
324 s.l.Warn("failed to auto-claim sites domain at signup",
325 "domain", autoClaimDomain,
326 "did", did,
327 "error", err,
328 )
329 } else {
330 s.l.Info("auto-claimed sites domain at signup", "domain", autoClaimDomain, "did", did)
331 }
332
333 // if we get here, we've successfully created the account and added the email
334 success = true
335
336 s.pages.SignupSuccess(w, pages.SignupSuccessParams{Handle: autoClaimDomain})
337
338 // clean up inflight signup asynchronously
339 go func() {
340 if err := db.DeleteInflightSignup(s.db, email); err != nil {
341 s.l.Error("failed to delete inflight signup", "error", err)
342 }
343 }()
344
345 return nil
346}
347
348type turnstileResponse struct {
349 Success bool `json:"success"`
350 ErrorCodes []string `json:"error-codes,omitempty"`
351 ChallengeTs string `json:"challenge_ts,omitempty"`
352 Hostname string `json:"hostname,omitempty"`
353}
354
355func (s *Signup) validateCaptcha(cfToken string, r *http.Request) error {
356 if cfToken == "" {
357 return errors.New("captcha token is empty")
358 }
359
360 if s.config.Cloudflare.Turnstile.SecretKey == "" {
361 return errors.New("turnstile secret key not configured")
362 }
363
364 data := url.Values{}
365 data.Set("secret", s.config.Cloudflare.Turnstile.SecretKey)
366 data.Set("response", cfToken)
367
368 // include the client IP if we have it
369 if remoteIP := r.Header.Get("CF-Connecting-IP"); remoteIP != "" {
370 data.Set("remoteip", remoteIP)
371 } else if remoteIP := r.Header.Get("X-Forwarded-For"); remoteIP != "" {
372 if ips := strings.Split(remoteIP, ","); len(ips) > 0 {
373 data.Set("remoteip", strings.TrimSpace(ips[0]))
374 }
375 } else {
376 data.Set("remoteip", r.RemoteAddr)
377 }
378
379 resp, err := http.PostForm("https://challenges.cloudflare.com/turnstile/v0/siteverify", data)
380 if err != nil {
381 return fmt.Errorf("failed to verify turnstile token: %w", err)
382 }
383 defer resp.Body.Close()
384
385 var turnstileResp turnstileResponse
386 if err := json.NewDecoder(resp.Body).Decode(&turnstileResp); err != nil {
387 return fmt.Errorf("failed to decode turnstile response: %w", err)
388 }
389
390 if !turnstileResp.Success {
391 s.l.Warn("turnstile validation failed", "error_codes", turnstileResp.ErrorCodes)
392 return errors.New("turnstile validation failed")
393 }
394
395 return nil
396}