diff --git a/config.json b/config.json index 772b61c3..0ebdf7c3 100644 --- a/config.json +++ b/config.json @@ -1,6 +1,13 @@ { - "defaultHomeserver": 1, - "homeserverList": ["converser.eu", "matrix.org", "mozilla.org", "unredacted.org", "xmr.se"], + "defaultHomeserver": 0, + "homeserverList": [ + "gamecult.org", + "converser.eu", + "matrix.org", + "mozilla.org", + "unredacted.org", + "xmr.se" + ], "allowCustomHomeservers": true, "featuredCommunities": { "openAsDefault": false, diff --git a/src/app/hooks/useClientConfig.test.ts b/src/app/hooks/useClientConfig.test.ts new file mode 100644 index 00000000..440ba15c --- /dev/null +++ b/src/app/hooks/useClientConfig.test.ts @@ -0,0 +1,20 @@ +import { describe, expect, it } from 'vitest'; +import { ClientConfig, clientDefaultServer } from './useClientConfig'; +import config from '../../../config.json'; + +describe('default homeserver', () => { + it('is gamecult.org when the config names none', () => { + expect(clientDefaultServer({})).toBe('gamecult.org'); + expect(clientDefaultServer({ homeserverList: [] })).toBe('gamecult.org'); + }); + + it('is the listed server the config points at', () => { + expect( + clientDefaultServer({ homeserverList: ['chat.gamecult.org'], defaultHomeserver: 0 }) + ).toBe('chat.gamecult.org'); + }); + + it('is gamecult.org in the repo config.json too', () => { + expect(clientDefaultServer(config as ClientConfig)).toBe('gamecult.org'); + }); +}); diff --git a/src/app/hooks/useClientConfig.ts b/src/app/hooks/useClientConfig.ts index ab3d67b7..feb38e0a 100644 --- a/src/app/hooks/useClientConfig.ts +++ b/src/app/hooks/useClientConfig.ts @@ -53,7 +53,7 @@ export function useClientConfig(): ClientConfig { } export const clientDefaultServer = (clientConfig: ClientConfig): string => - clientConfig.homeserverList?.[clientConfig.defaultHomeserver ?? 0] ?? 'matrix.org'; + clientConfig.homeserverList?.[clientConfig.defaultHomeserver ?? 0] ?? 'gamecult.org'; export const clientAllowedServer = (clientConfig: ClientConfig, server: string): boolean => { const { homeserverList, allowCustomHomeservers } = clientConfig; diff --git a/src/app/pages/auth/registrationEntry.test.ts b/src/app/pages/auth/registrationEntry.test.ts index 3af32faa..53b15fb7 100644 --- a/src/app/pages/auth/registrationEntry.test.ts +++ b/src/app/pages/auth/registrationEntry.test.ts @@ -1,5 +1,6 @@ import { describe, expect, it } from 'vitest'; import { registrationEntry } from './registrationEntry'; +import type { ClientConfig } from '../../hooks/useClientConfig'; import { PREVIEW_NOTICE_TEXT, TRAINING_NOTICE_TEXT, @@ -17,7 +18,7 @@ describe('registration entry', () => { }); it('ships off in config.json', () => { - expect(registrationEntry(config)).toBeUndefined(); + expect(registrationEntry(config as ClientConfig)).toBeUndefined(); expect(config.registration.enabled).toBe(false); }); @@ -44,4 +45,13 @@ describe('registration entry', () => { const entry = registrationEntry({ previewDemo: true, registration: { enabled: true, url } }); expect(entry?.notice).toBe(PREVIEW_NOTICE_TEXT); }); + + it('accepts http only for a local development host', () => { + const on = (u: string) => registrationEntry({ registration: { enabled: true, url: u } }); + expect(on('http://localhost:8080/register')?.url).toBe('http://localhost:8080/register'); + expect(on('http://127.0.0.1:8080/register')).toBeDefined(); + expect(on('http://accounts.example/register')).toBeUndefined(); + expect(on('http://localhost.evil.example/register')).toBeUndefined(); + expect(on('https://accounts.example/register')).toBeDefined(); + }); }); diff --git a/src/app/pages/auth/registrationEntry.ts b/src/app/pages/auth/registrationEntry.ts index 3049403e..6c65732e 100644 --- a/src/app/pages/auth/registrationEntry.ts +++ b/src/app/pages/auth/registrationEntry.ts @@ -3,17 +3,24 @@ import { TRAINING_NOTICE_VERSION, trainingNoticeText } from '../../utils/trainin export type RegistrationEntry = { url: string; notice: string; noticeVersion: number }; +// Plain http is for a developer's own machine only; a stranger's sign-up page is https. +const isLocalHost = (hostname: string): boolean => + hostname === 'localhost' || + hostname.endsWith('.localhost') || + hostname === '127.0.0.1' || + hostname === '[::1]'; + /** * The sign-up entry the sign-in page may show: the account service's registration page, when the - * switch is on and the configured url is a plain http(s) address. Anything else is no entry. The + * switch is on and the configured url is an https address (http only for localhost). Anything else is no entry. The * consent sentence and its version are trainingNotice.ts's, the ones a room shows. */ export const registrationEntry = (config: ClientConfig): RegistrationEntry | undefined => { const { enabled, url } = config.registration ?? {}; if (enabled !== true || typeof url !== 'string') return undefined; try { - const { protocol } = new URL(url); - if (protocol !== 'https:' && protocol !== 'http:') return undefined; + const { protocol, hostname } = new URL(url); + if (protocol !== 'https:' && !(protocol === 'http:' && isLocalHost(hostname))) return undefined; } catch { return undefined; }