31:Te4f,certificateTemplate = (uid, code) => ` viewof endpoint_certificate = { const value = { uid: '${uid}', code: '${code}' }; let ui; // If we are accessing this from another notebook we can return a value immediately if (window["request_certificate"]) { ui = html\`\` ui.value = value; yield ui; return ui; }; // If the user has jsut pasted this into a notebook we want to wait until the notebook is published let author = null; // Mootari's getPinnedSlug https://observablehq.com/@mootari // https://observablehq.com/d/691ae3b95f02db79#getPinnedSlug async function getPinnedSlug({name = null, parseVersion = 'v1'} = {}) { const getLines = async (route, rtVersion, lines) => { return fetch(\`https://api.observablehq.com/\${route}.js?v=\${rtVersion}\`) .then(response => response.text()) .catch(e => null) .then(t => t == null ? [] : t.split('\\n', lines + 1).slice(0, lines)); } const parsers = { v1: route => getLines(route, 1, 4).then(ln => { const name = ln[0].slice('// URL: https://observablehq.com/'.length).replace(/^d\\//, ''); const version = ln[3].slice('// Version: '.length); author = /\$@([^)]*)\$/.exec(ln[2])[1]; return \`\\${name}@\${version}\`; }), v3: route => getLines(route, 3, 1).then(ln => { return ln[0].slice('// https://observablehq.com/'.length).replace(/^d\\//, ''); }), }; try { const route = name != null ? name.replace(/^(?!@)/, 'd/') : html\`\`.pathname.match(/^\\/(d\\/[a-f0-9]{16}|@[^\\/]+\\/[^@].*?)(?:$|\\/)/)[1]; return parsers[parseVersion](route).catch(e => null); } catch(e) { return null; } } const key = "published-e084898a9d18a9a2"; await getPinnedSlug(); // Wait loop while (author === null) { console.log("poll for published") const ui = html\`Publish/link share notebook\` yield ui; await getPinnedSlug(); await new Promise(r => setTimeout(r, 5000)); // 5 second poll loop } // Once the notebook is published, offer a link to verify ui = html\`

\`; ui.addEventListener("click", async () => { const ui = document.getElementById("cert-ui") ui.innerHTML = "Validating..." const response = await fetch("https://endpointservice.web.app/notebooks/@endpointservices/certify-subdomain-ownership/deployments/validation_implementation/secrets/endpointservices_secretadmin_service_account_key/cells/validation_implementation", { method: "POST", body: html\`\`.href }); if (response.status == 200) { ui.innerHTML = "Thanks! " + await response.text() } else { ui.innerHTML = "Error: " + await response.text() } }); ui.value = value yield ui; } `32:T88e,validation_implementation = deploy("validation_implementation", async (req, res, context) => { // Use a secret Google Service Account Key (JSON) const access_token = await getAccessTokenFromServiceAccount(context.secrets["endpointservices_secretadmin_service_account_key"]) // Mint a JWT from it, exchange for access_token and signin as a public user await signinWithAccessToken(firebase, access_token); // The caller supplies the challenge context const url = req.body; console.log("url", url); const { uid, code } = await fetchCode(url); console.log("uid", uid, "code", code); const metadataPromise = fetchMeta(url) // Lookup a matching challenge record try { const matches = await firebase.firestore() .collection("/services/ownership/challenges") .where("challenge", '==', code) .where("uid", '==', uid) .orderBy("time", "desc").limit(1).get(); console.log("matches", matches); if (matches.empty) { res.status(404).send("No matching challenge code found") return; } const match = matches.docs[0].data(); // Check challenge is recent function timestamp2date(timestamp) { const date = new Date(0) date.setUTCSeconds(timestamp.seconds) return date; } const age_millis = new Date() - timestamp2date(match.time) if (age_millis > 60 * 60 * 1000) { // > 1 hour res.status(400).send("Challenge stale") return; } const subdomain = (await metadataPromise).login; console.log("subdomain", subdomain); // OK ITS A FACT. Now we can record this in the ownership table await firebase.firestore().collection("/services/ownership/owners").doc(`${subdomain}|${match.uid}`).set({ uid: match.uid, time: firebase.firebase_.firestore.FieldValue.serverTimestamp(), subdomain: subdomain }) // Tell the user the key res.send(`${match.uid} owns ${subdomain} proved in ${url}`); } catch(err) { console.log(err.message); res.status(500).send(err.message); } }, { secrets: ["endpointservices_secretadmin_service_account_key"], cell: "validation_implementation" })33:[{"id":"cf69b517437593b34a97ecf99c6a0677045fe92bf69bdbeb6a03e1087223074c642396c2b0815e1377da42b0aa022e99bd8f0f64d6c603f1b0cff4540fa2ac11","href":"https://static.observableusercontent.com/files/cf69b517437593b34a97ecf99c6a0677045fe92bf69bdbeb6a03e1087223074c642396c2b0815e1377da42b0aa022e99bd8f0f64d6c603f1b0cff4540fa2ac11","name":"image.png","type":"image/png","lastModified":1613304706558.902,"size":7594}] 2f:{"title":"Certify Subdomain Ownership","cells":[{"id":0,"value":"md`\n# Certify Subdomain Ownership \n\n⚠️ DEPRECATED\n\n We have simpler secure authentication mechnisms now, such as [Login with comment](/@endpointservices/login-with-comment). So this complex notebook is no required to use [secrets](/@endpointservices/secrets)!\n\nBefore you can set [serverside secrets](https://observablehq.com/@tomlarkworthy/secret-manager), access [logs](https://observablehq.com/@endpointservices/logs), or personalize your Open Cloud using [federated login](https://observablehq.com/@endpointservices/login), we need to figure out *securely* which _Observable_ domain you own, so we can grant you access to private data relating to that domain. \n\nWe implement a challange based protocol inspired by [DNS-01 verification](https://letsencrypt.org/docs/challenge-types/#dns-01-challenge). You prove control of a subdomain by writing a unique code into it, thus tangibly demonstrating you have write access.\n`","pinned":false,"hidden":false,"mode":"ojs"},{"id":1372,"value":"certified_domains = JSON.stringify(subdomain_certificates.reduce(\n (acc, cert) => {\n if (!acc.includes(cert.subdomain)) acc.push(cert.subdomain)\n return acc\n },\n []\n))","pinned":false,"hidden":false,"mode":"ojs"},{"id":44,"value":"md`## Step 1: Login to Endpointservices\n`","pinned":false,"hidden":false,"mode":"ojs"},{"id":55,"value":"viewof user","pinned":false,"hidden":false,"mode":"ojs"},{"id":125,"value":"md`After logging in you have a uid, we will generate a secret code for you`","pinned":false,"hidden":false,"mode":"ojs"},{"id":121,"value":"endpoint_uid = user.uid","pinned":false,"hidden":false,"mode":"ojs"},{"id":83,"value":"challenge_code = {\n const response = await fetch(challenge_implementation.href, {\n method: \"POST\",\n body: JSON.stringify(relation)\n });\n if (response.status !== 200) throw new Error(response.status + \": \" + await response.text())\n return await response.text()\n}","pinned":false,"hidden":false,"mode":"ojs"},{"id":16,"value":"md`## Step 2: Create a new notebook\n\n(very top right of page)\n![](${await FileAttachment(\"image.png\").url()})\n`","pinned":false,"hidden":false,"mode":"ojs"},{"id":72,"value":"md`## Step 3: Copy this certificate and paste it into a new notebook\n\nRun it and follow its instruction.\n`","pinned":false,"hidden":false,"mode":"ojs"},{"id":1496,"value":"$31","pinned":false,"hidden":false,"mode":"ojs"},{"id":1495,"value":"{\n const click = () => {\n copy(certificateTemplate(user.uid, challenge_code))\n document.getElementById(\"copyCert\").outerHTML = \"Copied\"\n }\n const ui = html`\n\n`\n return ui;\n}","pinned":false,"hidden":false,"mode":"ojs"},{"id":772,"value":"md`## Step 4: Trigger validation\n\nThe certificate will serve a button in your new notebook. Pressing that button tells out validator to check for the secret challenge code. \n\n---\n\n`","pinned":false,"hidden":false,"mode":"ojs"},{"id":1407,"value":"md`# Implementation\nCertification is implementated using [serverside cells](https://observablehq.com/@tomlarkworthy/serverside-cells) containing a [secret](https://observablehq.com/@tomlarkworthy/secret-manager) Google Identity. It's plain Observable code you can inspect for transparency.\n\n`","pinned":false,"hidden":false,"mode":"ojs"},{"id":1493,"value":"md`#### The challenge generates and records a secret code for a UID `","pinned":false,"hidden":false,"mode":"ojs"},{"id":102,"value":"challenge_implementation = deploy(\"challenge_implementation\", async (req, res, context) => {\n const access_token = await getAccessTokenFromServiceAccount(context.secrets[\"endpointservices_secretadmin_service_account_key\"])\n \n // Signin as a public user\n await signinWithAccessToken(firebase, access_token);\n \n // Generate an unguessable challenge key using Crypto \n const challenge = jsrsasign.KJUR.crypto.Util.getRandomHexOfNbytes(16); \n const challangeContext = JSON.parse(req.body);\n \n // Record we made a challenge (the admin user is allowlisted to make the write, other users cannot)\n await firebase.firestore().collection(\"/services/ownership/challenges\").add({\n uid: challangeContext.uid,\n time: firebase.firebase_.firestore.FieldValue.serverTimestamp(),\n challenge: challenge\n })\n \n // Tell the user the key\n res.send(challenge);\n}, {\n secrets: [\"endpointservices_secretadmin_service_account_key\"],\n cell: \"challenge_implementation\"\n})","pinned":false,"hidden":false,"mode":"ojs"},{"id":1530,"value":"firestore = firebase.firestore()","pinned":true,"hidden":false,"mode":"ojs"},{"id":737,"value":"function fetchCode(url) {\n const match = url.match(regIdentifier)\n \n const {id, user, slug, version} = match.groups,\n path = id ? `d/${id}` : `@${user}/${slug}`,\n suffix = version ? `@${version}` : '';\n \n window[\"request_certificate\"] = true;\n return peekFirst({\n notebook: path,\n cell: \"endpoint_certificate\"\n });\n}","pinned":false,"hidden":false,"mode":"ojs"},{"id":566,"value":"$32","pinned":false,"hidden":false,"mode":"ojs"},{"id":1369,"value":"subdomain_certificates = listen(firebase.firestore().collection(\"/services/ownership/owners\").where(\"uid\", \"==\", user.uid))","pinned":false,"hidden":false,"mode":"ojs"},{"id":84,"value":"relation = ({\n \"uid\": user.uid\n})","pinned":false,"hidden":false,"mode":"ojs"},{"id":582,"value":"import {peekFirst} from '@tomlarkworthy/metaprogramming'","pinned":false,"hidden":false,"mode":"ojs"},{"id":1518,"value":"import {signinWithAccessToken, getAccessTokenFromServiceAccount, jsrsasign} from '@tomlarkworthy/firebase-admin'","pinned":false,"hidden":false,"mode":"ojs"},{"id":51,"value":"import {viewof user, firebase, listen, subdomain, isOwner} from '@endpointservices/utils'","pinned":false,"hidden":false,"mode":"ojs"},{"id":1484,"value":"import {regIdentifier, fetchMeta} from '@mootari/notebook-input@223'","pinned":false,"hidden":false,"mode":"ojs"},{"id":1362,"value":"import {deploy} from '@tomlarkworthy/serverside-cells'","pinned":false,"hidden":false,"mode":"ojs"},{"id":475,"value":"import {html} from \"@observablehq/htl\"","pinned":false,"hidden":false,"mode":"ojs"},{"id":860,"value":"import {viewof suite, expect} from '@tomlarkworthy/testing'","pinned":false,"hidden":false,"mode":"ojs"},{"id":1109,"value":"import {encode, decode} from '@mbostock/base64'","pinned":false,"hidden":false,"mode":"ojs"},{"id":1483,"value":"import {copy} from '@mbostock/copy-to-clipboard'","pinned":false,"hidden":false,"mode":"ojs"},{"id":1585,"value":"import { footer } from \"@endpointservices/footer-with-backups\"","pinned":false,"hidden":false,"mode":"ojs"},{"id":1589,"value":"footer","pinned":false,"hidden":false,"mode":"ojs"}],"files":"$W33","stdlib":"1","titling":"auto"}