From d87e9322b50938cbbd104c7078cff03804347b5d Mon Sep 17 00:00:00 2001 From: Dani Date: Fri, 22 Aug 2025 22:59:05 -0400 Subject: [PATCH] Added example/dropin replacements for .env.example Fixed the issue with PlainText (Complete Anon) posting Need to fix device sign on issues. Need to make it so that the non-signed in devices can only see their equalivant level of posts. (i.e. plaintext, public-encrypted, private-encrypted) --- .env.example | 7 + client/app.js | 771 ++++++++++++++++++++----------- client/index.html | 57 ++- client/styles.css | 24 + cmd/shard/main.go | 338 ++++++++------ configs/shard.test.yaml | 43 +- docker-compose.test.yml | 12 +- internal/api/http.go | 993 +++++++++++----------------------------- internal/api/static.go | 83 +++- internal/storage/fs.go | 321 +++++-------- 10 files changed, 1239 insertions(+), 1410 deletions(-) diff --git a/.env.example b/.env.example index e69de29..f657fa1 100644 --- a/.env.example +++ b/.env.example @@ -0,0 +1,7 @@ +CF_TUNNEL_TOKEN=YOUR_CF_TUNNEL_TOKEN_HERE +GC_DISCORD_CLIENT_ID=YOUR_DISCORD_CLIENT_ID_HERE +GC_DISCORD_CLIENT_SECRET=YOUR_DISCORD_CLIENT_SECRET_HERE +GC_DISCORD_REDIRECT_URI=YOUR_DISCORD_REDIRECT_URI_HERE +GC_SIGNING_SECRET_HEX=YOUR_SIGNING_SECRET_HEXKEY_HERE +GC_ALLOW_ANON_PLAINTEXT=true # Enable PlainText +GC_DEV_ALLOW_UNAUTH=true # False when public \ No newline at end of file diff --git a/client/app.js b/client/app.js index 18a6302..7742df1 100644 --- a/client/app.js +++ b/client/app.js @@ -1,117 +1,18 @@ -import { encryptString, decryptToString, toBlob } from "./crypto.js"; +// GreenCoast client — Trusted-Types safe, 3 visibility modes, PoP auth, x-post, +// plaintext publishes are anonymous (no Authorization / PoP) when enabled server-side. const els = {}; function $(id){ return document.getElementById(id); } - -// ---- Trusted Types policy & safe HTML setter ---- -const ttPolicy = (() => { - try { - if (window.trustedTypes) { - // Allow only our sanitized HTML chunks (legal pages). Strip scripts & inline handlers. - return window.trustedTypes.createPolicy("gc", { - createHTML: (s) => - s - .replace(//gi, "") - .replace(/\son\w+=/gi, "") // remove inline event handlers - }); - } - } catch {} - return null; -})(); -function setHTML(el, html) { - if (!el) return; - if (ttPolicy) { - el.innerHTML = ttPolicy.createHTML(html); - } else { - // Very defensive fallback if TT creation is blocked: render as plain text. - el.textContent = html.replace(/<[^>]*>/g, ""); - } -} - -// ---- Hash routes map (SPA) ---- -const routes = { - "/": "feed", - "/privacy": "privacy.html", - "/gdpr": "gdpr.html", - "/terms": "terms.html" -}; - -window.addEventListener("DOMContentLoaded", () => { - Object.assign(els, { - shardUrl: $("shardUrl"), bearer: $("bearer"), passphrase: $("passphrase"), - saveConn: $("saveConn"), health: $("health"), visibility: $("visibility"), - title: $("title"), body: $("body"), publish: $("publish"), publishStatus: $("publishStatus"), - posts: $("posts"), discordStart: $("discordStart"), signIn: $("signIn"), panic: $("panic"), - avatar: $("avatar"), fp: $("fp"), flash: $("flash"), banner: $("banner"), - feed: $("feed"), page: $("page"), pageContent: $("pageContent"), - }); - - // Buttons - on(els.saveConn, "click", onSaveConn); - on(els.publish, "click", publish); - on(els.discordStart, "click", discordStart); - on(els.signIn, "click", deviceKeySignIn); - on(els.panic, "click", panicWipe); - - // Route navigation (hash-based) - document.querySelectorAll('a[data-route]').forEach(a=>{ - a.addEventListener('click', (e)=>{ - if (e.metaKey || e.ctrlKey || e.shiftKey || e.altKey) return; // allow new tab etc. - // hash change will trigger render - }); - }); - window.addEventListener('hashchange', ()=>renderRoute(currentPath())); - - applyConfig(); - updateLimitedModeUI(); - init(); - renderRoute(currentPath()); - flash("GC client loaded"); -}); - -// ---------- init ---------- -async function init(){ - await checkHealth(); await syncIndex(); sse(); await renderAvatar(); -} - -// ---------- helpers ---------- function on(el, ev, fn){ if (el) el.addEventListener(ev, fn, false); } -function flash(msg, ms=1800){ if(!els.flash) return; els.flash.textContent=msg; els.flash.style.display="block"; setTimeout(()=>els.flash.style.display="none", ms); } function norm(u){ return (u||"").replace(/\/+$/,""); } -function currentPath(){ - const h = location.hash || "#/"; - const p = h.replace(/^#/, ""); - return p || "/"; -} +function flash(msg, ms=1800){ if(!els.flash) return; els.flash.textContent=msg; els.flash.style.display="block"; setTimeout(()=>els.flash.style.display="none", ms); } +function setText(el, s){ if(el) el.textContent = s; } +function currentPath(){ const h=location.hash||"#/"; const p=h.replace(/^#/, ""); return p||"/"; } -function defaultApiBase() { - try { const qs = new URLSearchParams(window.location.search); const qApi = qs.get("api"); if (qApi) return qApi.replace(/\/+$/,""); } catch {} - const m = document.querySelector('meta[name="gc-api-base"]'); if (m && m.content) return m.content.replace(/\/+$/,""); - try { - const u = new URL(window.location.href); const proto = u.protocol; const host = u.hostname; const portStr = u.port; const bracketHost = host.includes(":") ? `[${host}]` : host; - const port = portStr ? parseInt(portStr,10) : null; let apiPort = port; - if (port === 8082) apiPort = 8080; else if (port === 9082) apiPort = 9080; else if (port) apiPort = Math.max(1, port-2); - return apiPort ? `${proto}//${bracketHost}:${apiPort}` : `${proto}//${bracketHost}`; - } catch { return window.location.origin.replace(/\/+$/,""); } -} - -const LS_KEY = "gc_client_config_v6"; -const POSTS_KEY = "gc_posts_index_v6"; -const KEY_PKCS8 = "gc_key_pkcs8"; -const KEY_PUB_RAW = "gc_key_pub_raw"; - -function loadConfig(){ try { return JSON.parse(localStorage.getItem(LS_KEY)) ?? {}; } catch { return {}; } } -const cfg = loadConfig(); - -function saveConfig(c){ localStorage.setItem(LS_KEY, JSON.stringify(Object.assign(cfg,c))); } -function applyConfig(){ - if (!els.shardUrl) return; - els.shardUrl.value = cfg.url ?? defaultApiBase(); - els.bearer.value = cfg.bearer ?? ""; - els.passphrase.value = cfg.passphrase ?? ""; -} -function isAuthorized(){ return !!cfg.bearer; } +const HAS_SUBTLE = !!(window.isSecureContext && window.crypto && crypto.subtle && crypto.subtle.generateKey); +const routes = { "/":"feed", "/privacy":"privacy.html", "/gdpr":"gdpr.html", "/terms":"terms.html" }; +// ---------- Router (Trusted-Types safe text-only render of legal pages) ---------- function setActiveTab(path){ const cur = path in routes ? path : "/"; document.querySelectorAll(".tabs a").forEach(a=>{ @@ -119,154 +20,69 @@ function setActiveTab(path){ a.classList.toggle("active", href===cur); }); } -function updateLimitedModeUI(){ - const limited = !isAuthorized(); - if (els.banner) els.banner.hidden = !limited; - if (els.visibility){ - const priv = [...els.visibility.options].find(o => o.value === "private"); - if (priv) { priv.disabled = limited; if (limited && els.visibility.value === "private") els.visibility.value = "public"; } - } -} - -// ---------- router (hash-based) ---------- async function renderRoute(path){ setActiveTab(path); const target = routes[path] ?? "feed"; - if (target === "feed"){ - els.page.hidden = true; - els.feed.hidden = false; - return; - } - // Load static page into #pageContent (Trusted Types aware) - els.feed.hidden = true; - els.page.hidden = false; - setHTML(els.pageContent, "Loading…"); + if (target === "feed"){ els.page.hidden=true; els.feed.hidden=false; return; } + els.feed.hidden=true; els.page.hidden=false; + setText(els.pageContent, "Loading…"); try{ const res = await fetch("./"+target, { cache:"no-store" }); const html = await res.text(); - const m = html.match(/]*>([\s\S]*?)<\/body>/i); - setHTML(els.pageContent, m ? m[1] : html); - }catch{ - setHTML(els.pageContent, `

Failed to load page.

`); - } + const body = (html.match(/]*>([\s\S]*?)<\/body>/i)?.[1] || html).replace(/<[^>]*>/g,""); + setText(els.pageContent, body); + }catch{ setText(els.pageContent, "Failed to load page."); } } -// ---------- health / posts / SSE ---------- -async function checkHealth(){ - const base = cfg.url || defaultApiBase(); - if (!base) { if (els.health) els.health.textContent="Set URL"; return; } - els.health.textContent="Checking…"; - try { const r = await fetch(base + "/healthz"); els.health.textContent = r.ok ? "Connected ✔" : `Error: ${r.status}`; } - catch { els.health.textContent = "Not reachable"; } -} -function getPosts(){ try { return JSON.parse(localStorage.getItem(POSTS_KEY)) ?? []; } catch { return []; } } -function setPosts(v){ localStorage.setItem(POSTS_KEY, JSON.stringify(v)); renderPosts(); } +// ---------- Config ---------- +const LS_KEY="gc_client_config_v10", POSTS_KEY="gc_posts_index_v10", KEY_PKCS8="gc_key_pkcs8", KEY_PUB_RAW="gc_key_pub_raw"; -async function syncIndex(){ - const base = cfg.url || defaultApiBase(); - if (!base) return; +function defaultApiBase() { + try { const qs = new URLSearchParams(window.location.search); const qApi = qs.get("api"); if (qApi) return qApi.replace(/\/+$/,""); } catch {} + const m=document.querySelector('meta[name="gc-api-base"]'); if(m&&m.content) return m.content.replace(/\/+$/,""); try{ - const r = await fetch(base + "/v1/index"); - if (!r.ok) throw new Error("index fetch failed"); - const entries = await r.json(); - setPosts(entries.map(e=>({hash:e.hash, title:"(title unknown — fetch)", bytes:e.bytes, ts:e.stored_at, enc:e.private, author:e.author||null, tz:e.creator_tz||null}))); - }catch(e){ console.warn("index sync failed", e); } + const u=new URL(window.location.href); const proto=u.protocol, host=u.hostname, portStr=u.port; const bracketHost=host.includes(":")?`[${host}]`:host; + const port = portStr ? parseInt(portStr,10) : null; let apiPort=port; + if (port===8082) apiPort=8080; else if (port===9082) apiPort=9080; else if (port) apiPort=Math.max(1,port-2); + return apiPort ? `${proto}//${bracketHost}:${apiPort}` : `${proto}//${bracketHost}`; + } catch { return window.location.origin.replace(/\/+$/,""); } } - -let sseCtrl; -function sse(reset=false){ - const base = cfg.url || defaultApiBase(); - if (!base) return; - if (sseCtrl){ sseCtrl.abort(); sseCtrl=undefined; if(!reset) return; } - sseCtrl = new AbortController(); - fetch(base + "/v1/index/stream", { signal:sseCtrl.signal }).then(async resp=>{ - if (!resp.ok) return; - const reader = resp.body.getReader(); const dec = new TextDecoder(); let buf=""; - while(true){ const {value,done}=await reader.read(); if(done) break; - buf += dec.decode(value,{stream:true}); - let i; while((i=buf.indexOf("\n\n"))>=0){ - const chunk=buf.slice(0,i); buf=buf.slice(i+2); - if (chunk.startsWith("data: ")){ - try{ - const ev = JSON.parse(chunk.slice(6)); - if (ev.event==="put"){ - const e=ev.data; const posts=getPosts(); - if (!posts.find(p=>p.hash===e.hash)){ - posts.unshift({hash:e.hash,title:"(title unknown — fetch)",bytes:e.bytes,ts:e.stored_at,enc:e.private,author:e.author||null,tz:e.creator_tz||null}); - setPosts(posts); - } - } else if (ev.event==="delete"){ - const h=ev.data.hash; setPosts(getPosts().filter(x=>x.hash!==h)); - } - }catch{} - } - } - } - }).catch(()=>{}); +function loadCfg(){ try { return JSON.parse(localStorage.getItem(LS_KEY)) ?? {}; } catch { return {}; } } +const cfg = loadCfg(); +function saveCfg(c){ localStorage.setItem(LS_KEY, JSON.stringify(Object.assign(cfg,c))); } +function applyCfg(){ + els.shardUrl.value = cfg.url ?? defaultApiBase(); + els.bearer.value = cfg.bearer ?? ""; + els.passphrase.value = cfg.passphrase ?? ""; } - -// ---------- avatar (canvas PNG) ---------- -function b64uEncode(buf){ const bin = Array.from(new Uint8Array(buf)).map(b=>String.fromCharCode(b)).join(""); return btoa(bin).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,""); } -function b64uDecodeToBytes(s){ s=s.replace(/-/g,"+").replace(/_/g,"/"); while(s.length%4) s+="="; const bin=atob(s); const out=new Uint8Array(bin.length); for(let i=0;ib.toString(16).padStart(2,"0")).join(""); } -function hexBytes(hex){ const u=new Uint8Array(hex.length/2); for(let i=0;i>i)&1); - const c=document.createElement("canvas"); c.width=c.height=size; const g=c.getContext("2d"); - g.fillStyle=bg; g.fillRect(0,0,size,size); - let k=0; - for(let y=0;y o.value===val); + if (opt) opt.disabled = limited; } + if (limited && (sel.value==="members" || sel.value==="private")) sel.value="plaintext"; } - return c.toDataURL("image/png"); -} -async function renderAvatar(){ - if (!els.avatar) return; - let seed=null, label="(pseudonymous)"; - if (cfg.bearer){ const p=parseGC2(cfg.bearer); seed=p.cnf||p.sub||null; if(p.sub) label=p.sub; } - if (!seed){ els.avatar.removeAttribute("src"); if (els.fp) els.fp.textContent="(pseudonymous)"; return; } - const hex=await sha256Hex(seed); - els.avatar.onerror = ()=>{ els.avatar.removeAttribute("src"); if (els.fp) els.fp.textContent="(pseudonymous)"; }; - els.avatar.src=identiconPNG(hex, 64); - if (els.fp) els.fp.textContent=label+" (pseudonymous)"; } -// ---------- security / PoP ---------- -async function onSaveConn(){ - const c = { url: norm(els.shardUrl.value || defaultApiBase()), bearer: els.bearer.value.trim(), passphrase: els.passphrase.value }; - saveConfig(c); flash("Saved"); - updateLimitedModeUI(); await checkHealth(); await syncIndex(); sse(true); await renderAvatar(); -} -async function panicWipe(){ - flash("Wiping local state…"); - try { const base = cfg.url || defaultApiBase(); if (base) await fetch(base + "/v1/session/clear", { method:"POST" }); } catch {} - localStorage.clear(); sessionStorage.clear(); caches?.keys?.().then(keys => keys.forEach(k => caches.delete(k))); - flash("Cleared — reloading"); setTimeout(()=>location.reload(), 300); -} -async function discordStart(){ - const base = cfg.url || defaultApiBase(); if (!base){ alert("Set shard URL first."); return; } - const r = await fetch(base + "/v1/auth/discord/start", { headers: { "X-GC-3P-Assent":"1" }}); - if (!r.ok){ alert("Discord SSO not available"); return; } - const j = await r.json(); location.href = j.url; -} +// ---------- Crypto helpers ---------- +function b64uEncode(buf){ const bin=Array.from(new Uint8Array(buf)).map(b=>String.fromCharCode(b)).join(""); return btoa(bin).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,""); } +function b64uDecodeToBytes(s){ s=s.replace(/-/g,"+").replace(/_/g,"/"); while(s.length%4) s+="="; const bin=atob(s); const out=new Uint8Array(bin.length); for(let i=0;ib.toString(16).padStart(2,"0")).join(""); } + async function getOrCreateKeyPair(){ + if (!HAS_SUBTLE) throw new Error("WebCrypto not available"); const pkcs8 = sessionStorage.getItem(KEY_PKCS8); const pubRaw = sessionStorage.getItem(KEY_PUB_RAW); if (pkcs8 && pubRaw){ try{ const priv = await crypto.subtle.importKey("pkcs8", b64uDecodeToBytes(pkcs8), {name:"ECDSA", namedCurve:"P-256"}, true, ["sign"]); - const pub = await crypto.subtle.importKey("raw", b64uDecodeToBytes(pubRaw), {name:"ECDSA", namedCurve:"P-256"}, true, ["verify"]); - return { priv, pub, pubRawB64u: pubRaw }; + const pub = await crypto.subtle.importKey("raw", b64uDecodeToBytes(pubRaw), {name:"ECDSA", namedCurve:"P-256"}, true, ["verify"]); + return { priv, pub, pkcs8B64u: pkcs8, pubRawB64u: pubRaw }; }catch{} } const kp = await crypto.subtle.generateKey({name:"ECDSA", namedCurve:"P-256"}, true, ["sign","verify"]); @@ -274,10 +90,86 @@ async function getOrCreateKeyPair(){ const pubRawBytes = await crypto.subtle.exportKey("raw", kp.publicKey); const pkcs8B64 = b64uEncode(pkcs8New); const pubRawB64 = b64uEncode(pubRawBytes); sessionStorage.setItem(KEY_PKCS8, pkcs8B64); sessionStorage.setItem(KEY_PUB_RAW, pubRawB64); - return { priv: kp.privateKey, pub: kp.publicKey, pubRawB64u: pubRawB64 }; + return { priv: kp.privateKey, pub: kp.publicKey, pkcs8B64u: pkcs8B64, pubRawB64u: pubRawB64 }; } +async function deriveMembersPassphrase(saltBytes){ + const kp = await getOrCreateKeyPair(); + const seed = await sha256(b64uDecodeToBytes(kp.pkcs8B64u)); + const cat = new Uint8Array(seed.length + 1 + saltBytes.length); + cat.set(seed,0); cat.set(new Uint8Array([1]), seed.length); cat.set(saltBytes, seed.length+1); + const out = await sha256(cat); + return b64uEncode(out); +} +async function deriveAesKey(passphraseB64u, saltBytes){ + const raw = b64uDecodeToBytes(passphraseB64u); + const keyMat = await crypto.subtle.importKey("raw", raw, "PBKDF2", false, ["deriveKey"]); + return crypto.subtle.deriveKey( + { name:"PBKDF2", salt:saltBytes, iterations:120000, hash:"SHA-256" }, + keyMat, { name:"AES-GCM", length:256 }, false, ["encrypt","decrypt"] + ); +} +async function aesEncryptString(str, passphraseB64u){ + const salt = crypto.getRandomValues(new Uint8Array(16)); + const key = await deriveAesKey(passphraseB64u, salt); + const iv = crypto.getRandomValues(new Uint8Array(12)); + const ct = new Uint8Array(await crypto.subtle.encrypt({name:"AES-GCM", iv}, key, new TextEncoder().encode(str))); + return { alg:"aes-256-gcm", iv:b64uEncode(iv), salt:b64uEncode(salt), ct:b64uEncode(ct) }; +} +async function aesDecryptToString(obj, passphraseB64u){ + const key = await deriveAesKey(passphraseB64u, b64uDecodeToBytes(obj.salt)); + const pt = await crypto.subtle.decrypt({name:"AES-GCM", iv:b64uDecodeToBytes(obj.iv)}, key, b64uDecodeToBytes(obj.ct)); + return new TextDecoder().decode(pt); +} +function makeEnvelope(mode, encObj, meta){ return JSON.stringify({ gc:"2", mode, enc:encObj, meta }); } +function tryParseJSON(t){ try{ return JSON.parse(t); }catch{ return null; } } + +// ---------- Avatar ---------- +function parseGC2(tok){ try{ const p=tok.split("."); if(p.length!==3) return {}; const pl=JSON.parse(atob(p[1].replace(/-/g,"+").replace(/_/g,"/"))); return {sub:pl.sub||"", cnf:pl.cnf||""}; }catch{ return {}; } } +function identiconPNGFromHex(hex, size=64){ + const cells=5, cell=Math.floor(size/cells), pad=Math.floor((size-cell*cells)/2); + const hexBytes=(h)=>{const u=new Uint8Array(h.length/2); for(let i=0;i>i)&1); + const c=document.createElement("canvas"); c.width=c.height=size; const g=c.getContext("2d"); + g.fillStyle=bg; g.fillRect(0,0,size,size); let k=0; + for(let y=0;y{ els.avatar.removeAttribute("src"); setText(els.fp,"(pseudonymous)"); }; + els.avatar.src=identiconPNGFromHex(hex, 64); + setText(els.fp, label+" (pseudonymous)"); +} + +// ---------- Auth / PoP ---------- +async function requireChallengeAlive(base) { + try { + const r = await fetch(base + "/v1/auth/key/challenge", { method: "POST" }); + if (r.status === 404) { + alert( + "Shard URL looks wrong: /v1/auth/key/challenge not found.\n\n" + + "Current base:\n" + base + "\n\n" + + "Set it to your API host (e.g. https://api-gc.fullmooncyberworks.com) and Save." + ); + return false; + } + return r.ok; + } catch { + alert("Cannot reach shard at: " + base); + return false; + } +} + async function deviceKeySignIn(){ + if (!HAS_SUBTLE) { alert("Device keys not supported. Use Discord or a modern browser."); return; } const base = cfg.url || defaultApiBase(); if (!base){ alert("Set shard URL first."); return; } + if (!(await requireChallengeAlive(base))) return; flash("Signing in…"); try{ const { priv, pubRawB64u } = await getOrCreateKeyPair(); @@ -290,16 +182,18 @@ async function deviceKeySignIn(){ const rv = await fetch(base + "/v1/auth/key/verify", { method:"POST", headers:{"Content-Type":"application/json"}, body }); if (!rv.ok) throw new Error("verify "+rv.status); const vj = await rv.json(); - saveConfig({ bearer: vj.bearer }); applyConfig(); updateLimitedModeUI(); + saveCfg({ bearer: vj.bearer }); applyCfg(); updateLimitedUI(); await renderAvatar(); await checkHealth(); await syncIndex(); sse(true); flash("Signed in"); }catch(e){ console.error(e); alert("Sign-in error: "+(e?.message||e)); } } + async function signPoPHeaders(method, pathOnly, bodyBytes){ + if (!HAS_SUBTLE) return {}; const pubRaw = sessionStorage.getItem(KEY_PUB_RAW); const pkcs8 = sessionStorage.getItem(KEY_PKCS8); if (!pubRaw || !pkcs8) return {}; const priv = await crypto.subtle.importKey("pkcs8", b64uDecodeToBytes(pkcs8), {name:"ECDSA", namedCurve:"P-256"}, false, ["sign"]); - const bodyHash = await crypto.subtle.digest("SHA-256", bodyBytes || new Uint8Array()); - const hex = Array.from(new Uint8Array(bodyHash)).map(b=>b.toString(16).padStart(2,"0")).join(""); + const bodyHash = new Uint8Array(await crypto.subtle.digest("SHA-256", bodyBytes || new Uint8Array())); + const hex = Array.from(bodyHash).map(b=>b.toString(16).padStart(2,"0")).join(""); const ts = Math.floor(Date.now()/1000).toString(); const msg = new TextEncoder().encode(method.toUpperCase()+"\n"+pathOnly+"\n"+ts+"\n"+hex); const sig = await crypto.subtle.sign({name:"ECDSA", hash:"SHA-256"}, priv, msg); @@ -315,67 +209,206 @@ async function fetchWithPoP(url, opts){ for (const [k,v] of Object.entries(pop)) headers.set(k,v); return fetch(url, { ...(opts||{}), headers }); } +// Anonymous fetch: strip any auth/PoP headers completely (for plaintext writes) +function stripAuthHeaders(h){ h.delete("Authorization"); h.delete("X-GC-Key"); h.delete("X-GC-TS"); h.delete("X-GC-Proof"); return h; } +async function fetchAnon(url, opts){ + const headers = new Headers(opts?.headers || {}); + return fetch(url, { ...(opts||{}), headers: stripAuthHeaders(headers) }); +} + +// ---------- Leak detection ---------- +const SECRET_PATTERNS = [ + /\b(passphrase|password|secret|gc[-_ ]?pass|shared[-_ ]?key)\s*[:=]\s*[^\s]{8,}/i, + /\b(ASIA|AKIA|AIza)[0-9A-Za-z_\-]{10,}/, + /\b[A-Za-z0-9+/_-]{32,}={0,2}\b/, + /\b[0-9a-f]{64,}\b/i, + /-----BEGIN [A-Z ]{5,}-----[\s\S]+?-----END [A-Z ]{5,}-----/ +]; +function containsSecret(text, passphrase){ + if (!text) return false; + if (passphrase && passphrase.length>=6 && text.includes(passphrase)) return true; + return SECRET_PATTERNS.some(rx => rx.test(text)); +} + +// ---------- X-post helpers ---------- +const TRACKING_PARAMS = [/^utm_/i,/^gclid$/i,/^fbclid$/i,/^msclkid$/i,/^mc_(eid|cid)$/i,/^vero_id$/i,/^oly_(anon|enc)_id$/i,/^_hs(enc|mi|mi)/i,/^s?cid$/i,/^igshid$/i,/^ttclid$/i,/^spm$/i,/^ref$/i,/^ref_src$/i,/^ref_url$/i]; +function sanitizeUrl(input){ + try{ + const u = new URL(input.trim()); + for (const [k] of u.searchParams){ if (TRACKING_PARAMS.some(rx=>rx.test(k))) u.searchParams.delete(k); } + u.hash = ""; + return u.toString(); + }catch{ return ""; } +} +function shortHost(h){ try{ const p=h.split("."); return p.length>2 ? p.slice(-2).join(".") : h; }catch{ return h; } } +function renderXCard(container, cleanUrl, note){ + container.replaceChildren(); + if (!cleanUrl){ const m=document.createElement("div"); m.className="xmeta"; m.textContent="Enter a valid URL."; container.appendChild(m); return; } + const u = new URL(cleanUrl); + const row = document.createElement("div"); row.className="xrow"; + const pill = document.createElement("span"); pill.className="xpill"; pill.textContent=shortHost(u.hostname); + const title = document.createElement("span"); title.className="xtitle"; title.textContent=note || `${shortHost(u.hostname)} link`; + row.appendChild(pill); row.appendChild(title); + + const meta = document.createElement("div"); meta.className="xmeta"; meta.textContent=(u.pathname||"/")+(u.search||""); + + const btn = document.createElement("div"); btn.className="xbtn"; + const a = document.createElement("a"); a.href=cleanUrl; a.target="_blank"; a.rel="noreferrer noopener"; a.referrerPolicy="no-referrer"; a.textContent="Open privately ↗"; + btn.appendChild(a); + + container.appendChild(row); container.appendChild(meta); container.appendChild(btn); +} + +// ---------- Compose / Publish ---------- +function msg(t, err=false){ setText(els.publishStatus, t); els.publishStatus.style.color = err ? "#ff6b6b" : "#8b949e"; } -// ---------- compose / posts ---------- -function msg(t, err=false){ els.publishStatus.textContent=t; els.publishStatus.style.color = err ? "#ff6b6b" : "#8b949e"; } async function publish(){ const base = cfg.url || defaultApiBase(); if (!base) return msg("Set shard URL first.", true); - const title = els.title.value.trim(); const body = els.body.value; const vis = els.visibility.value; - if (!isAuthorized() && vis === "private"){ msg("Private posts require authorizing this device. Publishing as public.", true); els.visibility.value = "public"; } + + const mode = els.visibility.value; // plaintext | members | private + const title = els.title.value.trim(); + const body = els.body.value; + + if ((mode==="members"||mode==="private") && !isAuthorized()){ msg("Authorize your device to publish encrypted posts.", true); return; } + + const currentPass = els.passphrase.value.trim(); + if (containsSecret(body, currentPass)){ msg("Blocked: content appears to include a passkey/secret.", true); return; } + try{ - let blob, enc=false; - if (els.visibility.value==="private"){ - if (!els.passphrase.value) return msg("Set a passphrase for private posts.", true); - const payload = await encryptString(JSON.stringify({title,body}), els.passphrase.value); - blob = toBlob(payload); enc=true; - } else { blob = toBlob(JSON.stringify({title,body})); } - const headers = {"Content-Type":"application/octet-stream"}; - if (enc) headers["X-GC-Private"]="1"; + let blob, headers={"Content-Type":"application/octet-stream"}, enc=false; + + if (mode==="plaintext"){ + blob = new Blob([JSON.stringify({ title, body, type:"plaintext" })], {type:"application/json"}); + } else if (mode==="members"){ + const salt = crypto.getRandomValues(new Uint8Array(16)); + const pp = await deriveMembersPassphrase(salt); + const encObj = await aesEncryptString(JSON.stringify({ title, body, type:"members" }), pp); + const env = makeEnvelope("members", encObj, { tz: Intl.DateTimeFormat().resolvedOptions().timeZone || "" }); + blob = new Blob([env], {type:"application/json"}); headers["X-GC-Private"]="1"; enc=true; + } else if (mode==="private"){ + if (!currentPass) return msg("Set a passphrase for Private-Encrypted posts.", true); + const pp = b64uEncode(new TextEncoder().encode(currentPass)); + const encObj = await aesEncryptString(JSON.stringify({ title, body, type:"private" }), pp); + const env = makeEnvelope("private", encObj, { tz: Intl.DateTimeFormat().resolvedOptions().timeZone || "" }); + blob = new Blob([env], {type:"application/json"}); headers["X-GC-Private"]="1"; enc=true; + } + const tz = Intl.DateTimeFormat().resolvedOptions().timeZone; if (tz) headers["X-GC-TZ"]=tz; - const r = await fetchWithPoP(base + "/v1/object", { method:"PUT", headers, body: blob }); + + const url = base + "/v1/object"; + let r; + if (mode === "plaintext") { + // truly anonymous write (requires allow_anon_plaintext on shard) + r = await fetchAnon(url, { method:"PUT", headers, body: blob }); + } else { + r = await fetchWithPoP(url, { method:"PUT", headers, body: blob }); + } if (!r.ok) throw new Error(await r.text()); const j = await r.json(); + const posts = getPosts(); - posts.unshift({ hash:j.hash, title: title || "(untitled)", bytes:j.bytes, ts:j.stored_at, enc, author:j.author||null, tz:j.creator_tz||null }); + posts.unshift({ hash:j.hash, title: title || (enc?"(encrypted)":"(untitled)"), bytes:j.bytes, ts:j.stored_at, enc, mode, author:j.author||null, tz:j.creator_tz||null }); setPosts(posts); - els.body.value=""; msg(`Published ${enc?"private":"public"} post. Hash: ${j.hash}`); + els.body.value=""; + msg(`Published ${mode}. Hash: ${j.hash}`); }catch(e){ msg("Publish failed: "+(e?.message||e), true); } } -function renderPosts(){ - const posts = getPosts(); if (!els.posts) return; els.posts.innerHTML=""; - for (const p of posts){ - const div = document.createElement("div"); div.className="post"; - const badge = p.enc?`private`:`public`; - const tz = p.tz?` · tz:${p.tz}`:""; const who = p.author?` · by ${p.author.slice(0,8)}…`:""; - div.innerHTML = ` -
${p.hash.slice(0,10)}… · ${p.bytes} bytes · ${p.ts}${tz}${who} ${badge}
-
- - - - -
- 
`;
-    const pre = div.querySelector(".content");
-    div.querySelector('[data-act="view"]').onclick = ()=>viewPost(p, pre);
-    div.querySelector('[data-act="save"]').onclick = ()=>saveBlob(p);
-    div.querySelector('[data-act="delete"]').onclick = ()=>delServer(p);
-    div.querySelector('[data-act="remove"]').onclick = ()=>{ setPosts(getPosts().filter(x=>x.hash!==p.hash)); };
-    els.posts.appendChild(div);
-  }
+
+async function publishShare(){
+  const base = cfg.url || defaultApiBase(); if (!base) return alert("Set shard URL first.");
+  const clean = sanitizeUrl(els.shareUrl.value); if (!clean) return alert("Enter a valid URL.");
+
+  const mode = els.shareVis.value;
+  const note = els.shareNote.value || "";
+
+  if ((mode==="members"||mode==="private") && !isAuthorized()){ alert("Authorize your device to publish encrypted links."); return; }
+  if (containsSecret(note, els.passphrase.value.trim())){ alert("Blocked: content appears to include a passkey/secret."); return; }
+
+  try{
+    let blob, headers={"Content-Type":"application/octet-stream"}, enc=false;
+
+    if (mode==="plaintext"){
+      blob = new Blob([JSON.stringify({ type:"xpost", url: clean, note, created_at:new Date().toISOString() })], {type:"application/json"});
+    } else if (mode==="members"){
+      const salt = crypto.getRandomValues(new Uint8Array(16));
+      const pp = await deriveMembersPassphrase(salt);
+      const encObj = await aesEncryptString(JSON.stringify({ type:"xpost", url: clean, note, created_at:new Date().toISOString() }), pp);
+      const env = makeEnvelope("members", encObj, { tz: Intl.DateTimeFormat().resolvedOptions().timeZone || "" });
+      blob = new Blob([env], {type:"application/json"}); headers["X-GC-Private"]="1"; enc=true;
+    } else {
+      const pass = els.passphrase.value.trim(); if (!pass) return alert("Set a passphrase for Private-Encrypted links.");
+      const pp = b64uEncode(new TextEncoder().encode(pass));
+      const encObj = await aesEncryptString(JSON.stringify({ type:"xpost", url: clean, note, created_at:new Date().toISOString() }), pp);
+      const env = makeEnvelope("private", encObj, { tz: Intl.DateTimeFormat().resolvedOptions().timeZone || "" });
+      blob = new Blob([env], {type:"application/json"}); headers["X-GC-Private"]="1"; enc=true;
+    }
+
+    const tz = Intl.DateTimeFormat().resolvedOptions().timeZone; if (tz) headers["X-GC-TZ"]=tz;
+
+    const url = base + "/v1/object";
+    let r;
+    if (mode === "plaintext") {
+      r = await fetchAnon(url, { method:"PUT", headers, body: blob });
+    } else {
+      r = await fetchWithPoP(url, { method:"PUT", headers, body: blob });
+    }
+    if (!r.ok) throw new Error(await r.text());
+    const j = await r.json();
+
+    const posts = getPosts();
+    posts.unshift({ hash:j.hash, title:"(link)", bytes:j.bytes, ts:j.stored_at, enc, mode, author:j.author||null, tz:j.creator_tz||null });
+    setPosts(posts);
+    els.shareUrl.value=""; els.shareNote.value="";
+    renderXCard(els.shareCard, "", "");
+    flash("Link published");
+  }catch(e){ alert("Publish failed: "+(e?.message||e)); }
 }
+
+// ---------- View / Decrypt ----------
 async function viewPost(p, pre){
   const base = cfg.url || defaultApiBase(); pre.textContent="Loading…";
   try{
     const r = await fetch(base + "/v1/object/"+p.hash);
     if (!r.ok) throw new Error("fetch failed "+r.status);
     const buf = new Uint8Array(await r.arrayBuffer());
-    let text;
-    if (p.enc){ if (!els.passphrase.value) throw new Error("passphrase required"); text = await decryptToString(buf, els.passphrase.value); }
-    else { text = new TextDecoder().decode(buf); }
-    try{ const j=JSON.parse(text); pre.textContent=(j.title?`# ${j.title}\n\n`:"")+(j.body??text); } catch{ pre.textContent=text; }
+    const text = new TextDecoder().decode(buf);
+
+    const env = tryParseJSON(text);
+    if (env && env.gc==="2" && env.enc && env.mode){
+      const enc = env.enc; let pt;
+      if (env.mode==="members"){
+        if (!HAS_SUBTLE) throw new Error("Cannot decrypt on this browser.");
+        const pp = await deriveMembersPassphrase(b64uDecodeToBytes(enc.salt));
+        pt = await aesDecryptToString(enc, pp);
+      } else if (env.mode==="private"){
+        const pass = els.passphrase.value.trim(); if (!pass) throw new Error("Passphrase required");
+        const pp = b64uEncode(new TextEncoder().encode(pass));
+        pt = await aesDecryptToString(enc, pp);
+      } else { throw new Error("Unknown mode"); }
+
+      const j = tryParseJSON(pt);
+      if (j && j.type==="xpost" && j.url){
+        const wrap = pre.parentElement; const card = document.createElement("div"); card.className="xcard";
+        renderXCard(card, sanitizeUrl(j.url), j.note||""); wrap.replaceChild(card, pre); return;
+      }
+      pre.textContent = (j?.title?`# ${j.title}\n\n`:"") + (j?.body ?? pt);
+      return;
+    }
+
+    const j = tryParseJSON(text);
+    if (j){
+      if (j.type==="xpost" && j.url){
+        const wrap = pre.parentElement; const card = document.createElement("div"); card.className="xcard";
+        renderXCard(card, sanitizeUrl(j.url), j.note||""); wrap.replaceChild(card, pre); return;
+      }
+      pre.textContent = (j.title?`# ${j.title}\n\n`:"") + (j.body ?? text);
+      return;
+    }
+
+    pre.textContent = text;
   }catch(e){ pre.textContent="Error: "+(e?.message||e); }
 }
+
 async function saveBlob(p){
   const base = cfg.url || defaultApiBase();
   const r = await fetch(base + "/v1/object/"+p.hash);
@@ -390,3 +423,183 @@ async function delServer(p){
   if (!r.ok) return alert("delete failed "+r.status);
   setPosts(getPosts().filter(x=>x.hash!==p.hash));
 }
+
+// ---------- Index / SSE / Health ----------
+function getPosts(){ try { return JSON.parse(localStorage.getItem(POSTS_KEY)) ?? []; } catch { return []; } }
+function setPosts(v){ localStorage.setItem(POSTS_KEY, JSON.stringify(v)); renderPosts(); }
+async function syncIndex(){
+  const base = cfg.url || defaultApiBase(); if (!base) return;
+  try{
+    const r = await fetch(base + "/v1/index");
+    if (!r.ok) throw new Error("index fetch failed");
+    const entries = await r.json();
+    setPosts(entries.map(e=>({
+      hash:e.hash, title:"(title unknown — fetch)", bytes:e.bytes, ts:e.stored_at,
+      enc:e.private, mode: e.private ? "encrypted" : "plaintext",
+      author:e.author||null, tz:e.creator_tz||null
+    })));
+  }catch(e){ console.warn("index sync failed", e); }
+}
+let sseCtrl;
+function sse(reset=false){
+  const base = cfg.url || defaultApiBase(); if (!base) return;
+  if (sseCtrl){ sseCtrl.abort(); sseCtrl=undefined; if(!reset) return; }
+  sseCtrl = new AbortController();
+  fetch(base + "/v1/index/stream", { signal:sseCtrl.signal }).then(async resp=>{
+    if (!resp.ok) return;
+    const reader = resp.body.getReader(); const dec = new TextDecoder(); let buf="";
+    while(true){ const {value,done}=await reader.read(); if(done) break;
+      buf += dec.decode(value,{stream:true});
+      let i; while((i=buf.indexOf("\n\n"))>=0){
+        const chunk=buf.slice(0,i); buf=buf.slice(i+2);
+        if (chunk.startsWith("data: ")){
+          try{
+            const ev = JSON.parse(chunk.slice(6));
+            if (ev.event==="put"){
+              const e=ev.data; const posts=getPosts();
+              if (!posts.find(p=>p.hash===e.hash)){
+                posts.unshift({hash:e.hash,title:"(title unknown — fetch)",bytes:e.bytes,ts:e.stored_at,enc:e.private,mode:e.private?"encrypted":"plaintext",author:e.author||null,tz:e.creator_tz||null});
+                setPosts(posts);
+              }
+            } else if (ev.event==="delete"){
+              const h=ev.data.hash; setPosts(getPosts().filter(x=>x.hash!==h));
+            }
+          }catch{}
+        }
+      }
+    }
+  }).catch(()=>{});
+}
+async function checkHealth(){
+  const base = cfg.url || defaultApiBase();
+  if (!base) { setText(els.health,"Set URL"); return; }
+  setText(els.health,"Checking…");
+  try { const r = await fetch(base + "/healthz"); setText(els.health, r.ok ? "Connected ✔" : `Error: ${r.status}`); }
+  catch { setText(els.health,"Not reachable"); }
+}
+
+// ---------- Render posts (no innerHTML) ----------
+function renderPosts() {
+  const posts = getPosts();
+  const root = els.posts;
+  if (!root) return;
+  while (root.firstChild) root.removeChild(root.firstChild);
+
+  for (const p of posts) {
+    const wrap = document.createElement("div");
+    wrap.className = "post";
+
+    const meta = document.createElement("div");
+    meta.className = "meta";
+
+    const codeEl = document.createElement("code");
+    codeEl.textContent = `${p.hash.slice(0, 10)}…`;
+    meta.appendChild(codeEl);
+
+    const metaText = [
+      ` · ${p.bytes} bytes`,
+      ` · ${p.ts}`,
+      p.tz ? ` · tz:${p.tz}` : "",
+      p.author ? ` · by ${p.author.slice(0, 8)}…` : "",
+      " "
+    ].join("");
+    meta.appendChild(document.createTextNode(metaText));
+
+    const badge = document.createElement("span");
+    badge.className = "badge";
+    badge.textContent = p.enc ? (p.mode==="private"?"private":"encrypted") : "plaintext";
+    meta.appendChild(badge);
+
+    wrap.appendChild(meta);
+
+    const actions = document.createElement("div");
+    actions.className = "actions";
+
+    const mkBtn = (label, onClick) => {
+      const b = document.createElement("button");
+      b.type = "button";
+      b.textContent = label;
+      b.addEventListener("click", onClick);
+      return b;
+    };
+
+    const pre = document.createElement("pre");
+    pre.className = "content";
+    pre.style.whiteSpace = "pre-wrap";
+    pre.style.marginTop = ".5rem";
+
+    actions.appendChild(mkBtn("View", () => viewPost(p, pre)));
+    actions.appendChild(mkBtn("Save blob", () => saveBlob(p)));
+    actions.appendChild(mkBtn("Delete (server)", () => delServer(p)));
+    actions.appendChild(mkBtn("Remove (local)", () => {
+      setPosts(getPosts().filter((x) => x.hash !== p.hash));
+    }));
+
+    wrap.appendChild(actions);
+
+    const contentWrap = document.createElement("div");
+    contentWrap.className = "content-wrap";
+    contentWrap.appendChild(pre);
+    wrap.appendChild(contentWrap);
+
+    root.appendChild(wrap);
+  }
+}
+
+// ---------- Save/Init ----------
+async function onSaveConn(){
+  const c = { url: norm(els.shardUrl.value || defaultApiBase()), bearer: els.bearer.value.trim(), passphrase: els.passphrase.value };
+  saveCfg(c); flash("Saved");
+  updateLimitedUI(); await checkHealth(); await syncIndex(); sse(true); await renderAvatar();
+}
+async function panicWipe(){
+  flash("Wiping local state…");
+  try { const base = cfg.url || defaultApiBase(); if (base) await fetch(base + "/v1/session/clear", { method:"POST" }); } catch {}
+  localStorage.clear(); sessionStorage.clear(); caches?.keys?.().then(keys => keys.forEach(k => caches.delete(k)));
+  flash("Cleared — reloading"); setTimeout(()=>location.reload(), 300);
+}
+async function discordStart(){
+  const base = cfg.url || defaultApiBase(); if (!base){ alert("Set shard URL first."); return; }
+  const r = await fetch(base + "/v1/auth/discord/start", { headers: { "X-GC-3P-Assent":"1" }});
+  if (!r.ok){ alert("Discord SSO not available"); return; }
+  const j = await r.json(); location.href = j.url;
+}
+
+// ---------- Boot ----------
+window.addEventListener("DOMContentLoaded", () => {
+  Object.assign(els, {
+    shardUrl:$("shardUrl"), bearer:$("bearer"), passphrase:$("passphrase"),
+    saveConn:$("saveConn"), health:$("health"), visibility:$("visibility"),
+    title:$("title"), body:$("body"), publish:$("publish"), publishStatus:$("publishStatus"),
+    posts:$("posts"), discordStart:$("discordStart"), signIn:$("signIn"), panic:$("panic"),
+    avatar:$("avatar"), fp:$("fp"), flash:$("flash"), banner:$("banner"),
+    feed:$("feed"), page:$("page"), pageContent:$("pageContent"),
+    shareUrl:$("shareUrl"), shareNote:$("shareNote"), shareVis:$("shareVis"),
+    sharePreview:$("sharePreview"), sharePublish:$("sharePublish"), shareCard:$("shareCard")
+  });
+
+  on(els.saveConn, "click", onSaveConn);
+  on(els.publish, "click", publish);
+  on(els.discordStart, "click", discordStart);
+  on(els.signIn, "click", deviceKeySignIn);
+  on(els.panic, "click", panicWipe);
+
+  on(els.sharePreview, "click", ()=>renderXCard(els.shareCard, sanitizeUrl(els.shareUrl.value), els.shareNote.value));
+  on(els.sharePublish, "click", publishShare);
+
+  window.addEventListener('hashchange', ()=>renderRoute(currentPath()));
+
+  if (!HAS_SUBTLE) {
+    const cap = $("capWarn");
+    if (cap){
+      cap.hidden=false;
+      cap.textContent = "This browser lacks secure WebCrypto. Device-key and members-encrypted posts require a modern browser over HTTPS. Discord sign-in remains available.";
+    }
+    if (els.signIn){ els.signIn.disabled = true; els.signIn.textContent = "Device key not supported"; }
+  }
+
+  applyCfg(); updateLimitedUI();
+  (async () => { await checkHealth(); await syncIndex(); sse(); await renderAvatar(); })();
+  renderRoute(currentPath());
+  flash("GC client loaded");
+});
diff --git a/client/index.html b/client/index.html
index 7e662bf..617550a 100644
--- a/client/index.html
+++ b/client/index.html
@@ -4,13 +4,9 @@
   
   GreenCoast — Client
   
+  
+  
   
-  
-  
-  
 
 
   

@@ -28,11 +24,12 @@
     
   

 
-