bit of api refactor

server/api.js

···
 import cookieSig from 'cookie-signature';
 import { v4 as uuidv4 } from 'uuid';
 
+const replyJson = (res, code) => res.setHeader('Content-Type', 'application/json').writeHead(code);
+const errJson = (code, reason) => res => replyJson(res, code).end(JSON.stringify({ reason }));
+
+const badRequest = (res, reason) => errJson(400, reason)(res);
+const forbidden = errJson(401, 'forbidden');
+const unauthorized = errJson(403, 'unauthorized');
+const notFound = errJson(404, 'not found');
+const serverError = errJson(500, 'internal server error');
+const okBye = res => res.writeHead(204).end();
+const ok = (res, data) => replyJson(res, 200).end(JSON.stringify(data));
+
 const getRequesBody = async req => new Promise((resolve, reject) => {
   let body = '';
   req.on('data', chunk => body += chunk);
···
   { ...COOKIE_BASE, expires: new Date(0) },
 ));
 
-const getAccountCookie = (req, res, appSecret, adminDid, noDidCheck = false) => {
+const getUser = (req, res, db, appSecret, adminDid) => {
   const cookies = cookie.parse(req.headers.cookie ?? '');
   const untrusted = cookies['verified-account'] ?? '';
   const json = cookieSig.unsign(untrusted, appSecret);
···
     clearAccountCookie(res);
     return null;
   }
-
-  // not yet public!!
-  if (!did || (did !== adminDid && !noDidCheck)) {
-    console.log('no, clearing you', did, did === adminDid, noDidCheck);
-    clearAccountCookie(res)
-      .setHeader('Content-Type', 'application/json')
-      .writeHead(403)
-      .end(JSON.stringify({
-        reason: 'the spacedust notifications demo isn\'t public yet!',
-      }));
-    throw new Error('unauthorized');
+  let role;
+  if (did === adminDid) {
+    role = 'admin';
+  } else {
+    const account = db.getAccount(did);
+    if (!account) {
+      console.warn('valid account cookie but could not find in db');
+      clearAccountCookie(res);
+      return null;
+    }
+    role = account.role ?? 'public';
   }
+  return { did, session, role };
+};
 
-  return [did, session, did && (did === adminDid)];
-};
 
 // never EVER allow user-controllable input into fname (or just fix the path joining)
 const handleFile = (fname, ftype) => async (req, res, replace = {}) => {
···
     content = content.toString();
   } catch (err) {
     console.error(err);
-    res.writeHead(500);
-    res.end('Internal server error');
-    return;
+    return serverError(res);
   }
   res.setHeader('Content-Type', ftype);
   res.writeHead(200);
···
   res.end(content);
 }
 const handleIndex = handleFile('index.html', 'text/html');
-const handleServiceWorker = handleFile('service-worker.js', 'application/javascript');
 
-const handleHello = async (db, req, res, secrets, whoamiHost, adminDid) => {
-  const resBase = { webPushPublicKey: secrets.pushKeys.publicKey, whoamiHost };
-  res.setHeader('Content-Type', 'application/json');
-  let info = getAccountCookie(req, res, secrets.appSecret, adminDid, true);
-  if (info) {
-    const [did, _session, isAdmin] = info;
-    let role = db.getAccount(did)?.role;
-    role = isAdmin ? 'admin' : (role ?? 'public');
-    res
-      .setHeader('Content-Type', 'application/json')
-      .writeHead(200)
-      .end(JSON.stringify({ ...resBase, role, did }));
-  } else {
-    res
-      .setHeader('Content-Type', 'application/json')
-      .writeHead(200)
-      .end(JSON.stringify({ ...resBase, role: 'anonymous' }));
-  }
-};
-
-const handleVerify = async (db, req, res, secrets, whoamiHost, adminDid, jwks) => {
+const handleVerify = async (db, req, res, secrets, jwks, adminDid) => {
   const body = await getRequesBody(req);
   const { token } = JSON.parse(body);
   let did;
···
     did = verified.payload.sub;
   } catch (e) {
     console.warn('jwks verification failed', e);
-    return clearAccountCookie(res).writeHead(400).end(JSON.stringify({ reason: 'verification failed' }));
+    return badRequest(res, 'token verification failed');
   }
   const isAdmin = did && did === adminDid;
   db.addAccount(did);
   const session = uuidv4();
   setAccountCookie(res, did, session, secrets.appSecret);
-  return res
-    .setHeader('Content-Type', 'application/json')
-    .writeHead(200)
-    .end(JSON.stringify({
-      did,
+  return ok(res, {
+      webPushPublicKey: secrets.pushKeys.publicKey,
       role: isAdmin ? 'admin' : 'public',
-      webPushPublicKey: secrets.pushKeys.publicKey,
-    }));
+      did,
+  });
 };
 
-const handleSubscribe = async (db, req, res, appSecret, updateSubs, adminDid) => {
-  let info = getAccountCookie(req, res, appSecret, adminDid, true);
-  if (!info) return res.writeHead(400).end(JSON.stringify({ reason: 'failed to verify cookie signature' }));
-  const [did, session, _isAdmin] = info;
+const handleHello = async (user, req, res, webPushPublicKey, whoamiHost) =>
+  ok(res, {
+    whoamiHost,
+    webPushPublicKey,
+    role: user?.role ?? 'anonymous',
+    did: user?.did,
+  });
+
+const handleSubscribe = async (db, user, req, res, updateSubs) => {
   const body = await getRequesBody(req);
   const { sub } = JSON.parse(body);
-  // addSub('did:plc:z72i7hdynmk6r22z27h6tvur', sub); // DELETEME @bsky.app (DEBUG)
   try {
-    db.addPushSub(did, session, JSON.stringify(sub));
+    db.addPushSub(user.did, user.session, JSON.stringify(sub));
   } catch (e) {
     console.warn('failed to add sub', e);
-    return res
-      .setHeader('Content-Type', 'application/json')
-      .writeHead(500)
-      .end(JSON.stringify({ reason: 'failed to register subscription' }));
+    return serverError(res);
   }
   updateSubs(db);
-  res.setHeader('Content-Type', 'application/json');
-  res.writeHead(201);
-  res.end(JSON.stringify({ sup: 'hi' }));
+  return okBye(res);
 };
 
-const handleLogout = async (db, req, res, appSecret, updateSubs) => {
-  let info = getAccountCookie(req, res, appSecret, null, true);
-  if (!info) return res.writeHead(400).end(JSON.stringify({ reason: 'failed to verify cookie signature' }));
-  const [_did, session, _isAdmin] = info;
+const handleLogout = async (db, user, req, res, appSecret, updateSubs) => {
   try {
-    db.deleteSub(session);
+    db.deleteSub(user.session);
   } catch (e) {
     console.warn('failed to remove sub', e);
-    return res
-      .setHeader('Content-Type', 'application/json')
-      .writeHead(500)
-      .end(JSON.stringify({ reason: 'failed to register subscription' }));
+    return serverError(res);
   }
   updateSubs(db);
   clearAccountCookie(res);
-  res.setHeader('Content-Type', 'application/json');
-  res.writeHead(201);
-  res.end(JSON.stringify({ sup: 'bye' }));
+  return okBye(res);
 }
 
-const handleTopSecret = async (db, req, res, appSecret) => {
-  let info = getAccountCookie(req, res, appSecret, null, true);
-  if (!info) return res.writeHead(400).end(JSON.stringify({ reason: 'failed to verify cookie signature' }));
-  const [did, _session, _isAdmin] = info;
+const handleTopSecret = async (db, user, req, res) => {
   const body = await getRequesBody(req);
   const { secret_password } = JSON.parse(body);
   console.log({ secret_password });
   const role = 'early';
-  db.setRole(did, role, secret_password);
-  res.setHeader('Content-Type', 'application/json')
-    .writeHead(200)
-    .end('"heyyy"');
+  db.setRole(user.did, role, secret_password);
+  return okBye(res);
 }
 
 const attempt = listener => async (req, res) => {
···
     return await listener(req, res);
   } catch (e) {
     console.error('listener errored:', e);
+    return serverError(res);
   }
 };
 
···
   return (req, res) => {
     res.setHeaders(corsHeaders);
     if (req.method === 'OPTIONS') {
-      return res.writeHead(204).end();
+      return okBye(res);
     }
     return listener(req, res);
   }
···
 
 export const server = (secrets, jwks, allowedOrigin, whoamiHost, db, updateSubs, adminDid) => {
   const handler = (req, res) => {
+    // public (we're doing fall-through auth, what could go wrong)
     if (req.method === 'GET' && req.url === '/') {
-      return handleIndex(req, res, { PUBKEY: secrets.pushKeys.publicKey });
-    }
-    if (req.method === 'GET' && req.url === '/hello') {
-      return handleHello(db, req, res, secrets, whoamiHost, adminDid);
+      return handleIndex(req, res, {});
     }
     if (req.method === 'POST' && req.url === '/verify') {
-      return handleVerify(db, req, res, secrets, whoamiHost, adminDid, jwks);
+      return handleVerify(db, req, res, secrets, jwks, adminDid);
     }
-    if (req.method === 'POST' && req.url === '/subscribe') {
-      return handleSubscribe(db, req, res, secrets.appSecret, updateSubs, adminDid);
+
+    // semi-public
+    const user = getUser(req, res, db, secrets.appSecret, adminDid);
+    if (req.method === 'GET' && req.url === '/hello') {
+      return handleHello(user, req, res, secrets.pushKeys.publicKey, whoamiHost);
     }
+
+    // login required
     if (req.method === 'POST' && req.url === '/logout') {
-      return handleLogout(db, req, res, secrets.appSecret, updateSubs);
+      if (!user) return unauthorized(res);
+      return handleLogout(db, user, req, res, secrets.appSecret, updateSubs);
     }
     if (req.method === 'POST' && req.url === '/super-top-secret-access') {
+      if (!user) return unauthorized(res);
       return handleTopSecret(db, req, res, secrets.appSecret);
     }
 
-    res.writeHead(404).end('not found (sorry)');
+    // non-public access required
+    if (req.method === 'POST' && req.url === '/subscribe') {
+      if (!user || user.role === 'public') return forbidden(res);
+      return handleSubscribe(db, user, req, res, updateSubs);
+    }
+
+    // admin required
+
+    // sigh
+    return notFound(res);
   };
 
   return http.createServer(attempt(withCors(allowedOrigin, handler)));