Merge pull request 'Release candidate: dev into main' (#88) from dev into main

config.json

@@ -1,6 +1,13 @@
 {
-  "defaultHomeserver": 1,
-  "homeserverList": ["converser.eu", "matrix.org", "mozilla.org", "unredacted.org", "xmr.se"],
+  "defaultHomeserver": 0,
+  "homeserverList": [
+    "gamecult.org",
+    "converser.eu",
+    "matrix.org",
+    "mozilla.org",
+    "unredacted.org",
+    "xmr.se"
+  ],
   "allowCustomHomeservers": true,
   "featuredCommunities": {
     "openAsDefault": false,

src/app/hooks/useClientConfig.test.ts

@@ -0,0 +1,20 @@
+import { describe, expect, it } from 'vitest';
+import { ClientConfig, clientDefaultServer } from './useClientConfig';
+import config from '../../../config.json';
+
+describe('default homeserver', () => {
+  it('is gamecult.org when the config names none', () => {
+    expect(clientDefaultServer({})).toBe('gamecult.org');
+    expect(clientDefaultServer({ homeserverList: [] })).toBe('gamecult.org');
+  });
+
+  it('is the listed server the config points at', () => {
+    expect(
+      clientDefaultServer({ homeserverList: ['chat.gamecult.org'], defaultHomeserver: 0 })
+    ).toBe('chat.gamecult.org');
+  });
+
+  it('is gamecult.org in the repo config.json too', () => {
+    expect(clientDefaultServer(config as ClientConfig)).toBe('gamecult.org');
+  });
+});

src/app/hooks/useClientConfig.ts

@@ -53,7 +53,7 @@ export function useClientConfig(): ClientConfig {
 }
 
 export const clientDefaultServer = (clientConfig: ClientConfig): string =>
-  clientConfig.homeserverList?.[clientConfig.defaultHomeserver ?? 0] ?? 'matrix.org';
+  clientConfig.homeserverList?.[clientConfig.defaultHomeserver ?? 0] ?? 'gamecult.org';
 
 export const clientAllowedServer = (clientConfig: ClientConfig, server: string): boolean => {
   const { homeserverList, allowCustomHomeservers } = clientConfig;

src/app/pages/auth/registrationEntry.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest';
 import { registrationEntry } from './registrationEntry';
+import type { ClientConfig } from '../../hooks/useClientConfig';
 import {
   PREVIEW_NOTICE_TEXT,
   TRAINING_NOTICE_TEXT,
@@ -17,7 +18,7 @@ describe('registration entry', () => {
   });
 
   it('ships off in config.json', () => {
-    expect(registrationEntry(config)).toBeUndefined();
+    expect(registrationEntry(config as ClientConfig)).toBeUndefined();
     expect(config.registration.enabled).toBe(false);
   });
 
@@ -44,4 +45,13 @@ describe('registration entry', () => {
     const entry = registrationEntry({ previewDemo: true, registration: { enabled: true, url } });
     expect(entry?.notice).toBe(PREVIEW_NOTICE_TEXT);
   });
+
+  it('accepts http only for a local development host', () => {
+    const on = (u: string) => registrationEntry({ registration: { enabled: true, url: u } });
+    expect(on('http://localhost:8080/register')?.url).toBe('http://localhost:8080/register');
+    expect(on('http://127.0.0.1:8080/register')).toBeDefined();
+    expect(on('http://accounts.example/register')).toBeUndefined();
+    expect(on('http://localhost.evil.example/register')).toBeUndefined();
+    expect(on('https://accounts.example/register')).toBeDefined();
+  });
 });

src/app/pages/auth/registrationEntry.ts

@@ -3,17 +3,24 @@ import { TRAINING_NOTICE_VERSION, trainingNoticeText } from '../../utils/trainin
 
 export type RegistrationEntry = { url: string; notice: string; noticeVersion: number };
 
+// Plain http is for a developer's own machine only; a stranger's sign-up page is https.
+const isLocalHost = (hostname: string): boolean =>
+  hostname === 'localhost' ||
+  hostname.endsWith('.localhost') ||
+  hostname === '127.0.0.1' ||
+  hostname === '[::1]';
+
 /**
  * The sign-up entry the sign-in page may show: the account service's registration page, when the
- * switch is on and the configured url is a plain http(s) address. Anything else is no entry. The
+ * switch is on and the configured url is an https address (http only for localhost). Anything else is no entry. The
  * consent sentence and its version are trainingNotice.ts's, the ones a room shows.
  */
 export const registrationEntry = (config: ClientConfig): RegistrationEntry | undefined => {
   const { enabled, url } = config.registration ?? {};
   if (enabled !== true || typeof url !== 'string') return undefined;
   try {
-    const { protocol } = new URL(url);
-    if (protocol !== 'https:' && protocol !== 'http:') return undefined;
+    const { protocol, hostname } = new URL(url);
+    if (protocol !== 'https:' && !(protocol === 'http:' && isLocalHost(hostname))) return undefined;
   } catch {
     return undefined;
   }