mirror of
https://github.com/Kpa-clawbot/meshcore-analyzer.git
synced 2026-11-11 21:18:04 +00:00
efitenandClaude Opus 5.5
e149568c6c
Observers publish to the broker with one shared MQTT login. Anyone who
has that login can publish under any observer's topic, and the ingestor
takes the observer id from the topic (`cmd/ingestor/main.go:1009`), so
the data in the analyzer DB is only as trustworthy as the shared
password. This PR gives each user a personal MQTT login, generated and
mailed by CoreScope, and lets the broker ask CoreScope whether a login
may connect and publish.
Closes #2319.
The feature is optional and off by default
(`userManagement.observerLogins.enabled`). It needs
`userManagement.enabled`. With it off, nothing changes.
## Changes in this PR
**Broker hooks.** `POST /api/mqtt-hook/emqx/authn` and `/authz`, for the
EMQX HTTP authenticator and authorizer.
- They check a shared secret header, `X-CoreScope-Hook-Secret`, in
constant time.
- A username CoreScope does not know gets `ignore`, so EMQX falls
through to its built-in database and existing users keep working.
- A personal login may only publish `meshcore/<iata>/<pubkey>/<type>`,
with a 64-hex pubkey that is unbound or bound to the same user.
- The first publish for an unbound pubkey binds that observer to the
user (first come wins), until the user owns 20 observers (admin
assignments count too).
- An admin can rebind any observer.
**Credentials.**
- Username `obs_` + 12 random `[a-z0-9]`, password 32 random
`[A-Za-z0-9]`, both from `crypto/rand`.
- The password is stored twice: SHA-256 for the auth check, and sealed
with AES-256-GCM (key from config or `CORESCOPE_OBSERVER_KEY`) so the
user can ask for the same credentials again.
- The UI and the API never show the password. It leaves the server only
in the mail.
**Mail.** One mail with four formats:
- the meshcoretomqtt TOML;
- the observer firmware CLI commands (Gessaman or Dutch-MeshCore, same
`mqttN` CLI), on slot 4: slots 1-2 (Gessaman, Let's Mesh US/EU) and 1-3
(Dutch-MeshCore, `MQTTDefaults.h:19-34`) hold default broker presets on
a fresh install, slot 4 is empty on both. `set mqtt4.server` gets the
bare host: the firmware picks the scheme from the port
(`MQTTBridge.cpp:2094-2145`), and builds before merge 32dd8ad
(2026-10-19) do not accept a scheme there (read from the source, not
tested on a device). A scheme is written only when the port would pick
the wrong one, for example TLS on 8884;
- the Home Assistant meshcore-ha broker form fields;
- the plain values.
Each block starts with a numbered title and one line on where it goes.
The account page can resend the mail, at most 3 times per 24 h.
**Account and admin UI.**
- The account page gets an "Observer MQTT login" section
(`#/account?section=observers`) with the username, the bound observers
and the resend button.
- The admin page gets an "Observer logins" tab
(`#/admin?tab=observer-logins`) that lists logins with revoke and
reissue, and every observer with its owner, "not migrated" or
"orphaned", with a reassign control.
**Notifications.** Creating a login adds `observer.offline.own` ("My
observers go offline") to the owner's notification events; mails go out
once the user has notifications switched on, and the user can untick it.
**Storage.** users.db schema v7 adds `mqtt_logins` and
`observer_bindings`. The server still writes only users.db through
`internal/users`, and the analyzer DB stays read-only.
**Docs.** `docs/observer-mqtt-logins.md` covers the EMQX setup (authn
and authz chains, the hook body templates, the closing `^obs_` deny rule
and why it is needed), how to enable it on a running EMQX through the
REST API step by step, with a check and a rollback per step, and how to
migrate observers off a shared login. `config.example.json` has the
block with placeholder values.
## Enabling it on an instance
Full steps in `docs/observer-mqtt-logins.md`. In short:
1. **CoreScope:** add `userManagement.observerLogins` to `config.json`
with `enabled: true`, a `hookSecret` (`openssl rand -hex 32`), an
`encryptionKey` (`openssl rand -base64 32`) and the `broker` host, port,
transport and TLS that observers should use. Restart. Keep the key safe:
without it, mails cannot be resent and logins must be reissued.
2. **EMQX, authorization:** add a file source with `{deny, {username,
{re, "^obs_"}}, all, ["#"]}.` and move it to the end, then add the HTTP
authorizer pointing at `/api/mqtt-hook/emqx/authz` (it lands at the
front).
3. **EMQX, authentication:** add the HTTP authenticator pointing at
`/api/mqtt-hook/emqx/authn` and move it to the front, before the
built-in database.
4. **Check:** the shared login still connects, an unknown `obs_` login
is refused, and `metrics.deny` on the authorizer stays 0 for existing
clients.
5. **Owners:** they request a login on their account page and paste the
block for their uploader. Each observer binds to them on its first
publish. An uploader that was refused before step 3 may need a restart.
6. **Later:** remove the shared login from the broker once enough
observers moved.
## Who can claim an observer
Any active account can request a login, and its first publish under an
unbound pubkey binds that observer, also when CoreScope already knew it
from the shared login (first come wins, a deliberate choice: owners
migrate without waiting for an admin). Observer pubkeys are public, and
registration cannot be closed, so with this feature on anyone with a
mail address can claim up to 20 unbound observers per account. Before,
publishing needed the shared password.
What limits it: each claim of a known observer mails the admins, an
admin can unbind or reassign it and revoke the login, and a bound
observer cannot be claimed by another login. The doc spells this out and
suggests assigning known observers to their owners before announcing the
feature. A stricter mode (admin approval of logins, or no auto-bind for
known observers) is not in this PR.
## Performance
`authorize()` runs for every publish that misses the EMQX authz cache.
It takes two short read locks, does map lookups and one topic split.
`BenchmarkAuthorizeBound` (2000 observers, 500 logins): 533.5 ns/op, 96
B/op, 2 allocs/op. The admin observers table renders once per load and
updates single rows after a change.
## Verification
- All 16 Go modules: `bash scripts/allmod.sh test ./...` green.
- Skipped `TestSaveGeoFilterPreservesFileMode` and
`TestWriteStatsAtomic_SymlinkAtDestIsReplaced`: both fail on Windows on
a clean master too.
- `sh test-all.sh` green.
- `tests/e2e/test-user-management-e2e.js` 36/36 locally. It covers:
request, mail, resend, revoke, reissue, reassign, no password in the
page or API body, and axe. The CI job for this suite gets the
`observerLogins` block with fake values in `deploy.yml`.
- Local EMQX 5.8.6 in Docker against a local CoreScope:
- a personal login connects and publishes, which binds the observer; a
second personal login is denied on that observer's topic, and subscribe
is denied;
- with CoreScope stopped, the built-in users still connect and publish,
and new personal-login connects are refused;
- the `^obs_` deny rule blocks an already-connected personal login while
CoreScope is down; without the rule, the same publish was delivered.
- Production: running on an EMQX 5.8.9 broker with about 50 clients
since 2026-10-25, set up through the REST API as in the doc. After the
hooks went in, the authorizer answered `ignore` for every existing login
(0 denies, 0 dropped messages), and 4 observers were bound to their
owners through personal logins on the same evening, with the shared
login still in use by the rest.
## Known behaviour
EMQX's HTTP client can mark the hook resource down for one health-check
interval (15 s measured) when CoreScope closes an idle keep-alive
connection just as a health check runs. During that window new
personal-login connects are refused and the uploader reconnects. I saw
it 3 times in about 25 minutes of runs with a forced 1-5 s idle timeout,
and could not trigger it on demand. EMQX 5.8.6 has no setting for it,
and 5.10.5 ships the same client code. The doc describes it and the
alarm to watch for.
## Not in this PR
- mosquitto (mosquitto-go-auth). EMQX only.
- A websocket path field: the mail does not carry one, the doc tells
operators to match the listener path.
- Disabling the shared login. That is an operator step after migration,
described in the doc.
- Tested on EMQX 5.8.6 (Docker) and 5.8.9 (production) only.
Note on cb9f4ff3: its message says the scheme problem was reported by an
operator. That report turned out to come from before the broker used the
hook, so it does not show this cause; the change rests on the firmware
source only.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
116 lines
9.1 KiB
CSS
116 lines
9.1 KiB
CSS
/* Optional user management: header control, account pages, admin table. */
|
|
.nav-account-wrap { position: relative; }
|
|
.nav-account-btn { display: inline-flex; align-items: center; justify-content: center; gap: 6px; min-height: 48px; min-width: 48px; padding: 6px 12px;
|
|
background: none; border: 1px solid var(--border); border-radius: 6px; color: var(--nav-text-muted); font: inherit; font-size: 14px;
|
|
text-decoration: none; cursor: pointer; touch-action: manipulation; transition: background .15s, color .15s; }
|
|
.nav-account-btn:hover { background: var(--nav-bg2); color: var(--nav-text); }
|
|
.nav-account-label { max-width: 12ch; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-size: var(--fs-sm); }
|
|
.nav-account-menu { position: fixed; right: 0; top: 100%; min-width: 160px; z-index: 1200;
|
|
background: var(--card-bg); border: 1px solid var(--border); border-radius: 8px; padding: 4px 0; }
|
|
.nav-account-menu[hidden] { display: none; }
|
|
.nav-account-menu a, .nav-account-menu button { display: flex; align-items: center; width: 100%; text-align: left; padding: 8px 14px; min-height: 48px;
|
|
color: var(--text); background: none; border: 0; font: inherit; text-decoration: none; cursor: pointer; box-sizing: border-box; }
|
|
.nav-account-menu a:hover, .nav-account-menu button:hover { background: var(--row-hover); }
|
|
|
|
.account-page { display: flex; justify-content: center; padding: var(--space-md); }
|
|
.account-card { width: 100%; max-width: 520px; background: var(--card-bg); border: 1px solid var(--border); border-radius: 10px; padding: 20px; }
|
|
.account-card h2 { margin-top: 0; }
|
|
.account-card h3 { margin: 24px 0 8px; font-size: 1rem; }
|
|
.account-form { display: flex; flex-direction: column; gap: 12px; }
|
|
.account-field { display: flex; flex-direction: column; gap: 4px; font-size: var(--fs-sm); color: var(--text-muted); }
|
|
.account-field input { padding: 8px 10px; min-height: 48px; border: 1px solid var(--border); border-radius: 6px;
|
|
background: var(--input-bg); color: var(--text); font: inherit; box-sizing: border-box; }
|
|
/* The global .btn-primary is white on --accent (2.75:1), so account forms use
|
|
their own buttons: --text-on-accent on --accent-strong, as .tab-btn.active does. */
|
|
.account-btn { align-self: flex-start; min-height: 48px; padding: 8px 20px; border-radius: 6px; font: inherit; cursor: pointer; touch-action: manipulation; }
|
|
.account-btn-primary { background: var(--accent-strong); color: var(--text-on-accent); border: 1px solid var(--accent-strong); }
|
|
.account-btn-primary:hover { background: var(--palette-blue-700); }
|
|
.account-btn-secondary { background: var(--surface-1); color: var(--text); border: 1px solid var(--border); }
|
|
.account-btn-secondary:hover { background: var(--row-hover); }
|
|
.account-hint { font-size: var(--fs-sm); color: var(--text-muted); margin: 0; }
|
|
.account-msg { margin: 0; min-height: 1.2em; font-size: var(--fs-sm); }
|
|
.account-msg.ok { color: var(--status-green-text); }
|
|
.account-msg.err { color: var(--status-red-text); }
|
|
.account-links { font-size: var(--fs-sm); }
|
|
.account-links a { color: var(--link-color); }
|
|
.account-mail { text-align: center; padding: 32px 20px; }
|
|
.account-card.account-mail .account-mail-icon { display: block; width: 4.5rem; height: 4.5rem; font-size: 4.5rem; margin: 0 auto 12px; color: var(--accent-strong); }
|
|
.account-mail-title { margin: 0 0 12px; font-size: var(--fs-2xl); }
|
|
.account-mail-title:focus { outline: none; }
|
|
.account-mail-intro { font-size: var(--fs-lg); margin: 0 0 12px; }
|
|
.account-mail .account-links { font-size: var(--fs-md); }
|
|
.account-sessions { list-style: none; padding: 0; margin: 0; }
|
|
.account-sessions li { display: flex; justify-content: space-between; align-items: center; gap: 8px; padding: 6px 0; border-bottom: 1px solid var(--border); font-size: var(--fs-sm); }
|
|
.um-chip-device { margin-left: 4px; font-size: var(--fs-xs, 11px); color: var(--text-muted); }
|
|
.account-sessions li.account-empty { color: var(--text-muted); }
|
|
|
|
.cs-auth-toast { position: fixed; left: 50%; bottom: 24px; transform: translateX(-50%); z-index: 2000; opacity: 0; pointer-events: none;
|
|
background: var(--card-bg); color: var(--text); border: 1px solid var(--border); border-radius: 8px; padding: 10px 16px; transition: opacity .2s; }
|
|
.cs-auth-toast.visible { opacity: 1; }
|
|
|
|
.um-page { padding: var(--space-md); }
|
|
.um-filters { display: flex; flex-wrap: wrap; gap: 8px; margin-bottom: 12px; }
|
|
.um-filters input, .um-filters select { padding: 6px 8px; min-height: 48px; border: 1px solid var(--border); border-radius: 6px; background: var(--input-bg); color: var(--text); box-sizing: border-box; }
|
|
.um-table-wrap { overflow-x: auto; }
|
|
.um-table { width: 100%; border-collapse: collapse; font-size: var(--fs-sm); }
|
|
.um-table th, .um-table td { text-align: left; padding: 6px 8px; border-bottom: 1px solid var(--border); vertical-align: top; }
|
|
.um-table tr:hover td { background: var(--row-hover); }
|
|
.um-actions { display: flex; flex-wrap: wrap; gap: 4px; }
|
|
.um-actions button { min-height: 48px; padding: 4px 12px; border: 1px solid var(--border); border-radius: 6px; background: var(--surface-1); color: var(--text); cursor: pointer; touch-action: manipulation; }
|
|
.um-status, .um-chip { display: inline-block; padding: 1px 8px; border-radius: 10px; border: 1px solid var(--border); white-space: nowrap; }
|
|
.um-status-active, .um-chip-delivered, .um-chip-opened, .um-chip-clicked { color: var(--status-green-tint-text); }
|
|
.um-status-pending, .um-chip-sent, .um-chip-deferred, .um-chip-soft_bounce { color: var(--status-yellow-text); }
|
|
.um-status-disabled, .um-chip-hard_bounce, .um-chip-invalid_email, .um-chip-blocked, .um-chip-spam, .um-chip-error, .um-chip-bouncing { color: var(--status-red-text); }
|
|
.um-chip-unsubscribed { color: var(--text-muted); }
|
|
.um-status-approved { color: var(--status-green-tint-text); }
|
|
.um-status-rejected, .um-status-revoked { color: var(--status-red-text); }
|
|
.account-proposals { list-style: none; padding: 0; margin: 0; }
|
|
.account-proposals li { display: flex; flex-wrap: wrap; justify-content: space-between; align-items: center; gap: 8px; padding: 6px 0; border-bottom: 1px solid var(--border); font-size: var(--fs-sm); }
|
|
.account-proposals li .account-hint { flex-basis: 100%; margin: 0; }
|
|
.um-detail { margin-top: 16px; background: var(--card-bg); border: 1px solid var(--border); border-radius: 10px; padding: 16px; }
|
|
.um-detail ol { padding-left: 18px; }
|
|
@media (max-width: 760px) { .um-col-optional { display: none; } }
|
|
.account-actions { display: flex; flex-wrap: wrap; gap: 8px; margin: 12px 0 4px; }
|
|
a.account-btn { display: inline-flex; align-items: center; text-decoration: none; box-sizing: border-box; }
|
|
.um-detail-close { float: right; }
|
|
|
|
/* Compact controls on precise pointers; touch keeps the 48px targets above. */
|
|
@media (pointer: fine) {
|
|
.nav-account-btn { min-height: 36px; min-width: 36px; padding: 3px 10px; }
|
|
.nav-account-menu a, .nav-account-menu button { min-height: 36px; padding: 4px 14px; }
|
|
.account-field input { min-height: 36px; padding: 4px 10px; }
|
|
.account-btn { min-height: 36px; padding: 4px 16px; }
|
|
.um-filters input, .um-filters select { min-height: 36px; padding: 3px 8px; }
|
|
.um-actions button { min-height: 36px; padding: 2px 12px; }
|
|
}
|
|
|
|
/* Settings sync dialogs (settings-sync.js) on the shared .modal. */
|
|
.cs-dialog { display: flex; flex-direction: column; gap: 8px; color: var(--text); }
|
|
.cs-dialog h3 { margin: 0; }
|
|
.cs-dialog-actions { display: flex; flex-wrap: wrap; gap: 8px; margin-top: 8px; }
|
|
|
|
/* Node notifications toggle (notifications.js) on the node side pane and full page. */
|
|
.node-notify-slot { display: inline-flex; flex-wrap: wrap; align-items: center; gap: 6px; margin-left: 4px; }
|
|
.node-notify-slot:empty { display: none; }
|
|
.node-notify-btn { white-space: nowrap; }
|
|
/* Sized like the neighbouring buttons, which carry inline sizes in nodes.js
|
|
(side pane: Details/Analytics/Reach; full page: Copy URL/Reach). */
|
|
#nodeNotifySlot .node-notify-btn { font-size: 11px; padding: 2px 8px; }
|
|
#nodeNotifySlotFull { margin-left: 0; } /* the full page row spaces its buttons with gap */
|
|
#nodeNotifySlotFull .node-notify-btn { font-size: 12px; padding: 4px 10px; }
|
|
.node-notify-btn[aria-pressed="true"] { box-shadow: inset 0 0 0 2px var(--status-green-text); }
|
|
.node-notify-hint { color: var(--text-muted); font-size: var(--fs-sm); }
|
|
.node-notify-hint:empty { display: none; }
|
|
|
|
/* Notifications section (notifications.js) on the account page. */
|
|
.account-check { display: flex; align-items: center; gap: 8px; font-size: var(--fs-sm); }
|
|
.account-fieldset { display: flex; flex-direction: column; gap: 6px; margin: 0; padding: 8px 12px; border: 1px solid var(--border); border-radius: 6px; }
|
|
#notifyForm + h4 { margin-top: var(--space-lg); }
|
|
.account-watches { list-style: none; padding: 0; margin: 0 0 8px; }
|
|
.account-watches li { display: flex; flex-wrap: wrap; justify-content: space-between; align-items: center; gap: 8px; padding: 6px 0; border-bottom: 1px solid var(--border); font-size: var(--fs-sm); }
|
|
|
|
/* Observer MQTT login section (account.js). */
|
|
.account-obs-login { display: grid; grid-template-columns: max-content 1fr; gap: 4px 12px; margin: 0 0 8px; font-size: var(--fs-sm); }
|
|
.account-obs-login dt { color: var(--text-muted); }
|
|
.account-obs-login dd { margin: 0; overflow-wrap: anywhere; }
|