Optional password protection for the web server

src/types.d.ts

@@ -29,7 +29,8 @@ export type AppServiceRegistrationConfig = {
 		include_user_id_in_mxid: boolean
 		invite: string[]
 		discord_origin?: string
-		discord_cdn_origin?: string
+		discord_cdn_origin?: string,
+		web_password: string
 	}
 	old_bridge?: {
 		as_token: string

src/web/auth.js

@@ -23,7 +23,7 @@ async function getManagedGuilds(event) {
 
 /**
  * @param {h3.H3Event} event
- * @returns {ReturnType<typeof h3.useSession<{userID?: string, mxid?: string, managedGuilds?: string[], state?: string, selfService?: boolean}>>}
+ * @returns {ReturnType<typeof h3.useSession<{userID?: string, mxid?: string, managedGuilds?: string[], state?: string, selfService?: boolean, password?: string}>>}
  */
 function useSession(event) {
 	return h3.useSession(event, {password: reg.as_token})

src/web/pug/home.pug

@@ -1,24 +1,56 @@
 extends includes/template.pug
 
 block body
-  .s-page-title.mb24
-    h1.s-page-title--header Bridge a Discord server
+  - let locked = reg.ooye.web_password && reg.ooye.web_password !== session.data.password
 
-  .d-grid.g24.grid__2(class="sm:grid__1")
-    .s-card.bs-md.d-flex.fd-column
-      h2 Easy mode
-      p Add the bot to your Discord server.
-      p It will automatically create new Matrix rooms for you.
-      .fl-grow1
-      a.s-btn.s-btn__filled.s-btn__icon(href=rel("/oauth?action=add"))
-        != icons.Icons.IconPlus
-        = ` Add to server`
-    .s-card.bs-md.d-flex.fd-column
-      h2 Self-service
-      p OOYE will link an existing Discord server and Matrix space together.
-      p Choose this option if you already have a community set up on Matrix.
-      p Or, choose this if you're migrating from a different bridge.
-      .fl-grow1
-      a.s-btn.s-btn__outlined.s-btn__icon(href=rel("/oauth?action=add-self-service"))
-        != icons.Icons.IconUnorderedList
-        = ` Set up self-service`
+  if locked
+    aside.s-notice.s-notice__warning.p8
+      .d-flex.flex__center.jc-space-between.s-banner--container.g8(class="md:fw-wrap")
+        .d-flex.ai-center.g8
+          .flex--item!= icons.Icons.IconLock
+          p.m0 <strong>Private instance.</strong> You need the password to use this instance of Out Of Your Element.
+        form(method="post" action="/api/password")
+          input.s-input(placeholder="Enter password" name="password")
+
+    .h32
+
+    .s-page-title.mb24
+      h1.s-page-title--header Out Of Your Element
+
+  else
+    .s-page-title.mb24
+      h1.s-page-title--header Bridge a Discord server
+
+    .d-grid.g24.grid__2.mb24(class="sm:grid__1")
+      .s-card.bs-md.d-flex.fd-column
+        h2 Easy mode
+        p Add the bot to your Discord server.
+        p It will automatically create new Matrix rooms for you.
+        .fl-grow1
+        a.s-btn.s-btn__filled.s-btn__icon(href=rel("/oauth?action=add"))
+          != icons.Icons.IconPlus
+          = ` Add to server`
+      .s-card.bs-md.d-flex.fd-column
+        h2 Self-service
+        p OOYE will link an existing Discord server and Matrix space together.
+        p Choose this option if you already have a community set up on Matrix.
+        p Or, choose this if you're migrating from a different bridge.
+        .fl-grow1
+        a.s-btn.s-btn__outlined.s-btn__icon(href=rel("/oauth?action=add-self-service"))
+          != icons.Icons.IconUnorderedList
+          = ` Set up self-service`
+
+  .s-prose
+    h2 What is this?
+    p #[a(href="https://gitdab.com/cadence/out-of-your-element") Out Of Your Element] is a bridge between the Discord and Matrix chat apps. It lets people on both platforms chat with each other without needing to get everyone on the same app.
+    p Just chat like usual, and the bridge will forward messages back and forth between the two platforms, so everyone sees the whole conversation.
+    p All kinds of content are supported, including pictures, threads, emojis, and @mentions.
+    p It's really easy to set up, even if you only have Discord. Just add the bot to your server, and it'll make everything available on Matrix automatically.
+
+    if locked
+      h2 This is a private instance
+      p Anybody can run their own instance of the Out Of Your Element software. The person running this instance has made it private, so you can't add it to your server just yet. If you know the people in charge of #{reg.ooye.server_name}, ask them for the password.
+
+      h2 Run your own instance
+      p You can still use Out Of Your Element by running your own copy of the software, but this requires some technical skill.
+      p To get started, #[a(href="https://gitdab.com/cadence/out-of-your-element/src/branch/main/docs/get-started.md") check the installation instructions.]

src/web/pug/includes/template.pug

@@ -61,6 +61,9 @@ html(lang="en")
     <link rel="icon" href="data:image/svg+xml,<svg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 100 80%22><text y=%22.83em%22 font-size=%2283%22>💬</text></svg>">
     meta(name="htmx-config" content='{"requestClass":"is-loading"}')
     style.
+      .s-prose a {
+        text-decoration: underline;
+      }
       .themed {
         --theme-base-primary-color-h: 266;
         --theme-base-primary-color-s: 53%;

src/web/routes/oauth.js

@@ -37,13 +37,15 @@ as.router.get("/oauth", defineEventHandler(async event => {
 	const session = await auth.useSession(event)
 	let scope = "guilds"
 
-	const parsedFirstQuery = await getValidatedQuery(event, schema.first.safeParse)
-	if (parsedFirstQuery.data?.action === "add") {
-		scope = "bot+guilds"
-		await session.update({selfService: false})
-	} else if (parsedFirstQuery.data?.action === "add-self-service") {
-		scope = "bot+guilds"
-		await session.update({selfService: true})
+	if (!reg.ooye.web_password || reg.ooye.web_password === session.data.password) {
+		const parsedFirstQuery = await getValidatedQuery(event, schema.first.safeParse)
+		if (parsedFirstQuery.data?.action === "add") {
+			scope = "bot+guilds"
+			await session.update({selfService: false})
+		} else if (parsedFirstQuery.data?.action === "add-self-service") {
+			scope = "bot+guilds"
+			await session.update({selfService: true})
+		}
 	}
 
 	async function tryAgain() {

src/web/routes/password.js

@@ -0,0 +1,21 @@
+// @ts-check
+
+const {z} = require("zod")
+const {defineEventHandler, readValidatedBody, sendRedirect} = require("h3")
+const {as, sync} = require("../../passthrough")
+
+/** @type {import("../auth")} */
+const auth = sync.require("../auth")
+
+const schema = {
+	password: z.object({
+		password: z.string()
+	})
+}
+
+as.router.post("/api/password", defineEventHandler(async event => {
+	const {password} = await readValidatedBody(event, schema.password.parse)
+	const session = await auth.useSession(event)
+	await session.update({password})
+	return sendRedirect(event, "../")
+}))

src/web/server.js

@@ -30,8 +30,9 @@ sync.require("./routes/download-discord")
 sync.require("./routes/guild-settings")
 sync.require("./routes/guild")
 sync.require("./routes/link")
-sync.require("./routes/oauth")
 sync.require("./routes/log-in-with-matrix")
+sync.require("./routes/oauth")
+sync.require("./routes/password")
 
 // Files