slowly getting to something

atproto-notifications/src/components/SecretPassword.jsx

···
+import { useCallback, useState } from 'react';
+import { PostJson } from './Fetch';
+
+export function SecretPassword({ did, role }) {
+  const [begun, setBegun] = useState(false);
+  const [pw, setPw] = useState('');
+  const [submitting, setSubmitting] = useState(false);
+
+  const handleSubmit = useCallback(e => {
+    e.preventDefault();
+    setSubmitting(true);
+  })
+
+  return (
+    <form method="post" onSubmit={handleSubmit}>
+      <h2>Secret password required</h2>
+      <p>This demo is not ready for public yet, but you can get early access as a <a href="https://github.com/sponsors/uniphil/" target="_blank">github sponsor</a> or <a href="https://ko-fi.com/bad_example" target="_blank">ko-fi supporter</a>.</p>
+
+      {submitting ? (
+        <PostJson
+          endpoint="/super-top-secret-access"
+          data={{ secret_password: pw }}
+          credentials
+          loading={() => (<>Checking&hellip;</>)}
+          error={e => {
+            console.log('err', e);
+            return (
+              <>
+                <p>whateverrrr</p>
+                <p>
+                  <button onClick={() => setSubmitting(false)}>retry</button>
+                </p>
+              </>
+            );
+          }}
+          ok={() => (
+            <>
+              <p>That will do.</p>
+              <p>
+                <button onClick={() => window.location.reload()}>
+                  Enter
+                </button>
+              </p>
+            </>
+          )}
+        />
+      ) : (
+        <p>
+          <label>
+            Password:
+            {' '}
+            <input
+              type="text"
+              value={pw}
+              onFocus={() => setBegun(true)}
+              onChange={e => setPw(e.target.value)}
+            />
+          </label>
+          {' '}
+          {begun && (
+            <button type="submit" className="subtle">
+              open sesame
+            </button>
+          )}
+        </p>
+      )}
+    </form>
+  );
+}

atproto-notifications/src/components/setup/WithServerHello.tsx

···
 import { useCallback, useEffect, useState } from 'react';
-import { PushServerContext } from '../../context';
+import { UserContext, PushServerContext } from '../../context';
 import { WhoAmI } from '../WhoAmI';
+import { SecretPassword } from '../SecretPassword';
 import { GetJson, PostJson } from '../Fetch';
 import { Chrome } from './Chrome';
 
···
 export function WithServerHello({ children }) {
   const [whoamiInfo, setWhoamiInfo] = useState(null);
 
+  const childrenFor = useCallback((did, role) => {
+    if (role === 'public') {
+      return <SecretPassword did={did} role={role} />;
+    }
+    return 'hiiiiiiii ' + role;
+  })
+
   return (
     <GetJson
       /* todo: key on login state */
···
                 ok={({ did, role, webPushPublicKey }) => (
                   <Chrome user={{ did, role }}>
                     <PushServerContext.Provider value={webPushPublicKey}>
-                      {children}
+                      {childrenFor(did, role)}
                     </PushServerContext.Provider>
                   </Chrome>
                 )}
···
           return (
             <Chrome user={{ did, role }}>
               <PushServerContext.Provider value={webPushPublicKey}>
-                {children}
+                {childrenFor(did, role)}
               </PushServerContext.Provider>
             </Chrome>
           );

server/db.js

···
   #stmt_update_push_sub;
   #stmt_delete_push_sub;
   #stmt_get_push_info;
+  #stmt_set_role;
   #transactionally;
   #db;
 
···
 
     this.#stmt_get_account = db.prepare(
       `select a.first_seen,
+              a.role,
               count(*) as total_subs
          from accounts a
          left outer join push_subs p on (p.account_did = a.did)
···
          from push_subs
         where account_did = ?`);
 
+    this.#stmt_set_role = db.prepare(
+      `update accounts
+          set role = ?,
+              secret_password = ?
+        where did = ?`);
+
     this.#transactionally = t => db.transaction(t).immediate();
   }
 
···
     this.#stmt_insert_account.run(did);
   }
 
+  getAccount(did) {
+    return this.#stmt_get_account.get(did);
+  }
+
   addPushSub(did, session, sub) {
     this.#transactionally(() => {
       const res = this.#stmt_get_account.get(did);
···
 
   deleteSub(session) {
     this.#stmt_delete_push_sub.run(session);
+  }
+
+  setRole(did, role, secret_password) {
+    let res = this.#stmt_set_role.run(role, secret_password, did);
+    if (res.changes === 0) {
+      throw new Error('no changes');
+    }
   }
 }

server/index.js

···
   '',
   { ...COOKIE_BASE, expires: new Date(0) },
 ));
+
 const getAccountCookie = (req, res, appSecret, adminDid, noDidCheck = false) => {
   const cookies = cookie.parse(req.headers.cookie ?? '');
   const untrusted = cookies['verified-account'] ?? '';
···
 const handleHello = async (db, req, res, secrets, whoamiHost, adminDid) => {
   const resBase = { webPushPublicKey: secrets.pushKeys.publicKey, whoamiHost };
   res.setHeader('Content-Type', 'application/json');
-  let info = getAccountCookie(req, res, secrets.appSecret, adminDid);
+  let info = getAccountCookie(req, res, secrets.appSecret, adminDid, true);
   if (info) {
     const [did, _session, isAdmin] = info;
-    const role = isAdmin ? 'admin' : 'public';
+    let { role } = db.getAccount(did);
+    role = isAdmin ? 'admin' : (role ?? 'public');
     res
       .setHeader('Content-Type', 'application/json')
       .writeHead(200)
···
   res.setHeader('Content-Type', 'application/json');
   res.writeHead(201);
   res.end(JSON.stringify({ sup: 'bye' }));
+}
 
+const handleOpenSesame = async (db, req, res, appSecret) => {
+  let info = getAccountCookie(req, res, appSecret, null, true);
+  if (!info) return res.writeHead(400).end(JSON.stringify({ reason: 'failed to verify cookie signature' }));
+  const [did, _session, _isAdmin] = info;
+  const body = await getRequesBody(req);
+  const { secret_password } = JSON.parse(body);
+  console.log({ secret_password });
+  const role = 'early';
+  db.setRole(did, role, secret_password);
+  res.setHeader('Content-Type', 'application/json')
+    .writeHead(200)
+    .end('"heyyy"');
 }
 
 const attempt = listener => async (req, res) => {
···
   if (req.method === 'POST' && req.url === '/logout') {
     res.setHeaders(new Headers(CORS_PERMISSIVE(req)));
     return handleLogout(db, req, res, secrets.appSecret);
+  }
+
+  if (req.method === 'OPTIONS' && req.url === '/super-top-secret-access') {
+    // TODO: probably restrict the origin
+    return res.writeHead(204, CORS_PERMISSIVE(req)).end();
+  }
+  if (req.method === 'POST' && req.url === '/super-top-secret-access') {
+    res.setHeaders(new Headers(CORS_PERMISSIVE(req)));
+    return handleOpenSesame(db, req, res, secrets.appSecret);
   }
 
   res

server/schema.sql

···
 create table accounts (
-  did        text primary key,
-  first_seen text not null default CURRENT_TIMESTAMP,
+  did             text primary key,
+  first_seen      text not null default CURRENT_TIMESTAMP,
+  role            text null,
+  secret_password text null,
 
   check(did like 'did:%')
 ) strict;