mirror of
https://github.com/Kpa-clawbot/meshcore-analyzer.git
synced 2026-10-08 22:17:39 +00:00
efitenandClaude Opus 5.5
d232072f85
Part A of #2128: optional, off-by-default user accounts. With the feature off nothing changes; with it on, visitors can register and log in, and admins manage users and use the operator actions without the API key. PR #2130 (settings sync) builds on this one. The two are meant to be merged together. ## The situation - Operator actions (geofilter save and prune, backup, perf reset) need the shared `apiKey`. There is no per-person right. - Nothing in CoreScope knows who a visitor is, so the requests in #2128 that need that (#1835, #2092, #1508, #730) have nothing to build on. ## What this PR adds **Two new Go modules** - `internal/users`: a separate `users.db` (SQLite through `modernc.org/sqlite`) with users, sessions, single-use tokens, an audit log and a mail log. Passwords use argon2id. - `internal/mailer`: a `Mailer` interface with a Brevo client (send, delivery events, webhook parsing) and an in-memory fake for tests. **Server (`cmd/server`)**, active only with `userManagement.enabled` - 24 routes, all documented in OpenAPI under the `users` tag ([`auth_routes.go`](https://github.com/efiten/CoreScope/blob/feat/user-management/cmd/server/auth_routes.go)): - auth: register, activate, login, logout, me, forgot, reset; - account: profile, password, email change with confirmation, sessions, self-delete; - admin: list, detail, disable, enable, delete, role, resend activation, manual activation, mail status refresh; - a Brevo webhook, registered only when `mail.webhookSecret` is set. - `requireAdmin` replaces `requireAPIKey` at the 7 operator call sites: the API key **or** an admin session. With the feature off it is the old API-key gate (`TestRequireAdminWithoutUserManagementIsAPIKeyGate`). - `/api/config/client` gets `userManagement: {enabled: true}` only when the service started; with the feature off the response is byte-identical. **Frontend** - `auth.js` (header account control, request helper that adds the CSRF header), `account.js` (login, register, activate, forgot, reset, confirm email, my account), `admin-users.js` (`#/admin/users`, deep-linked filters), `account.css` (theme tokens only). - On phones the top-bar control is hidden, so a conditional entry goes into the bottom-nav "More" sheet and the nav drawer. - The customizer geofilter tab and the Perf "Reset stats" button use the admin session when there is one. **Config.** A `userManagement` block (`config.example.json`, [`docs/user-guide/accounts.md`](https://github.com/efiten/CoreScope/blob/feat/user-management/docs/user-guide/accounts.md)). The Brevo key can come from `CORESCOPE_BREVO_API_KEY`. The server refuses to start when the block is enabled but incomplete. ## Security choices - Session cookie `cs_session`: HttpOnly, SameSite=Lax, Secure when `publicBaseUrl` is https. Every cookie-authenticated state change needs the `X-CS-CSRF` header and a matching Origin. - Activation needs the token **and** the account password. Without the password, an attacker who keeps re-registering a known address could get the owner to activate an account that carries the attacker's password. - Register, forgot and email change answer identically for known and unknown addresses. A password reset ends all sessions, a password change ends all other sessions, and both end outstanding email-change links. - Rate limits: login 10 per 15 minutes, register and forgot 5 per hour, per IP and per address. The bucket count is capped. `trustedProxies` makes the per-IP limits see real client IPs behind a proxy. - Server logs carry `#<user id>`, never addresses, tokens or passwords; mail-provider error texts are redacted before logging. ## Performance No change to an existing hot path with the feature off. With it on: - One `users.db` lookup per authenticated request (session by token hash). - The admin user table rebuilds its `tbody` on each filter change. `users.List` caps the result at 1000 rows (`internal/users/users.go`), which bounds the rebuild. - `map[string]interface{}` in `openapi.go`: 79 before, 78 after. ## Verification - `internal/users`, `internal/mailer` and `cmd/server`: `go vet` and `go test -race` pass locally. 121 new Go tests. - `cmd/server` with `-tags e2etest`: vet and the e2e hook tests pass. - `sh test-all.sh` exits 0. `tests/unit/test-user-management-ui.js`: 67 passing (vm, real modules). - `tests/e2e/test-user-management-e2e.js` (6 steps) passed locally against an `e2etest` build with the fake mailer and against a feature-off build. CI builds the `e2etest` binary and runs the suite on a second server (`deploy.yml`). - On a staging instance with a real Brevo key: register, activation mail delivered, activate, admin table, "Refresh status" showing sent, deferred, delivered, opened and clicked. ## Not in this PR - Settings sync (#2130), the admin dashboard, approval flows and notifications (parts B to E of #2128). - A `requireReadAuth` mode (#1835). Sessions from this PR are what such a mode would accept. - Binary size and build time with `modernc.org/sqlite` linked next to `mattn/go-sqlite3` were not measured. Their driver names do not collide. #1992 discusses the driver choice. - No Brevo webhook was configured on staging; delivery status there came from "Refresh status". --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
137 lines
7.0 KiB
JSON
137 lines
7.0 KiB
JSON
{
|
|
"browser": {
|
|
"reason": "Requires Playwright and Chromium; most suites also require a running local fixture server via BASE_URL. Existing E2E workflow steps retain their separate setup and selection. Never point these tests at production.",
|
|
"files": [
|
|
"tests/e2e/test-1110-live-filter.js",
|
|
"tests/e2e/test-a11y-axe-1668.js",
|
|
"tests/e2e/test-analytics-fluid-charts.js",
|
|
"tests/e2e/test-audio-lab-1297-e2e.js",
|
|
"tests/e2e/test-audio-live-1297-e2e.js",
|
|
"tests/e2e/test-bottom-nav-1061-e2e.js",
|
|
"tests/e2e/test-channel-color-picker-e2e.js",
|
|
"tests/e2e/test-channel-decrypt-e2e.js",
|
|
"tests/e2e/test-channel-fluid-e2e.js",
|
|
"tests/e2e/test-channel-issue-1087-e2e.js",
|
|
"tests/e2e/test-channel-issue-1111-e2e.js",
|
|
"tests/e2e/test-channel-modal-e2e.js",
|
|
"tests/e2e/test-channel-qr-e2e.js",
|
|
"tests/e2e/test-channels-add-modal-e2e.js",
|
|
"tests/e2e/test-channels-list-render-e2e.js",
|
|
"tests/e2e/test-channels-selection-flow-e2e.js",
|
|
"tests/e2e/test-channels-share-color-e2e.js",
|
|
"tests/e2e/test-channels-ws-batch-e2e.js",
|
|
"tests/e2e/test-channels-ws-race-1498-e2e.js",
|
|
"tests/e2e/test-charts-fluid-1058-e2e.js",
|
|
"tests/e2e/test-customize-branding-e2e.js",
|
|
"tests/e2e/test-customize-display-e2e.js",
|
|
"tests/e2e/test-customize-export-e2e.js",
|
|
"tests/e2e/test-customize-theme-e2e.js",
|
|
"tests/e2e/test-drag-manager-e2e.js",
|
|
"tests/e2e/test-e2e-1267-mobile-vcr.js",
|
|
"tests/e2e/test-e2e-playwright.js",
|
|
"tests/e2e/test-filter-ux-e2e.js",
|
|
"tests/e2e/test-gesture-hints-1065-e2e.js",
|
|
"tests/e2e/test-gestures-1062-e2e.js",
|
|
"tests/e2e/test-gestures-1185-scroll-discriminator-e2e.js",
|
|
"tests/e2e/test-home-coverage-e2e.js",
|
|
"tests/e2e/test-issue-1109-hamburger-dropdown-visible-e2e.js",
|
|
"tests/e2e/test-issue-1122-packets-filter-ux-e2e.js",
|
|
"tests/e2e/test-issue-1128-multi-viewport-e2e.js",
|
|
"tests/e2e/test-issue-1128-packets-layout-e2e.js",
|
|
"tests/e2e/test-issue-1136-live-region-e2e.js",
|
|
"tests/e2e/test-issue-1146-path-link-contrast-e2e.js",
|
|
"tests/e2e/test-issue-1147-section-order-e2e.js",
|
|
"tests/e2e/test-issue-1150-404-state-e2e.js",
|
|
"tests/e2e/test-issue-1151-orphan-separators-e2e.js",
|
|
"tests/e2e/test-issue-1204-live-panel-structure-e2e.js",
|
|
"tests/e2e/test-issue-1205-live-controls-anchor-e2e.js",
|
|
"tests/e2e/test-issue-1206-resize-observer-leak-e2e.js",
|
|
"tests/e2e/test-issue-1206-vcr-overlap-e2e.js",
|
|
"tests/e2e/test-issue-1224-channels-mobile-ux-e2e.js",
|
|
"tests/e2e/test-issue-1234-live-chrome-pass2-e2e.js",
|
|
"tests/e2e/test-issue-1236-map-mobile-e2e.js",
|
|
"tests/e2e/test-issue-1244-live-vcr-row-hints-e2e.js",
|
|
"tests/e2e/test-issue-1273-qr-overlay-height-e2e.js",
|
|
"tests/e2e/test-issue-1274-legend-coverage-e2e.js",
|
|
"tests/e2e/test-issue-1279-legend-p2-e2e.js",
|
|
"tests/e2e/test-issue-1281-location-row-e2e.js",
|
|
"tests/e2e/test-issue-1306-collisions-terminology-e2e.js",
|
|
"tests/e2e/test-issue-1329-map-controls-accordion-e2e.js",
|
|
"tests/e2e/test-issue-1367-channels-chat-app-e2e.js",
|
|
"tests/e2e/test-issue-1374-route-map-a11y-e2e.js",
|
|
"tests/e2e/test-issue-1400-nav-vertical-clip.js",
|
|
"tests/e2e/test-issue-1413-nav-overlap-e2e.js",
|
|
"tests/e2e/test-issue-1486-collapse-reopens-detail-e2e.js",
|
|
"tests/e2e/test-issue-1487-byop-modal-layout-e2e.js",
|
|
"tests/e2e/test-issue-1510-live-nav-pin-e2e.js",
|
|
"tests/e2e/test-issue-1567-corner-clears-drag-e2e.js",
|
|
"tests/e2e/test-issue-1599-replay-freeze-e2e.js",
|
|
"tests/e2e/test-issue-1630-reach-mobile-e2e.js",
|
|
"tests/e2e/test-issue-1639-observers-sort-e2e.js",
|
|
"tests/e2e/test-issue-1640-compare-discovery-e2e.js",
|
|
"tests/e2e/test-issue-1648-m1-icons-e2e.js",
|
|
"tests/e2e/test-issue-1648-m2-icons-e2e.js",
|
|
"tests/e2e/test-issue-1648-m3-icons-e2e.js",
|
|
"tests/e2e/test-issue-1648-m4-icons-e2e.js",
|
|
"tests/e2e/test-issue-1648-m5-icons-e2e.js",
|
|
"tests/e2e/test-issue-1657-analytics-channels-group-sprites-e2e.js",
|
|
"tests/e2e/test-issue-1692-packets-init-parallel-e2e.js",
|
|
"tests/e2e/test-issue-1705-subpath-contrast-e2e.js",
|
|
"tests/e2e/test-issue-1758-ng-filter-rerenders-e2e.js",
|
|
"tests/e2e/test-issue-1799-label-vocab-e2e.js",
|
|
"tests/e2e/test-issue-1833-legend-toggle-clickable-e2e.js",
|
|
"tests/e2e/test-issue-1997-distance-building-e2e.js",
|
|
"tests/e2e/test-live-dedup.js",
|
|
"tests/e2e/test-live-fullscreen-1572-e2e.js",
|
|
"tests/e2e/test-live-layout-1178-1179-e2e.js",
|
|
"tests/e2e/test-live-mql-leak-1180-e2e.js",
|
|
"tests/e2e/test-live-multibyte-only-e2e.js",
|
|
"tests/e2e/test-logo-default-sage-teal-e2e.js",
|
|
"tests/e2e/test-logo-pulse-1173-e2e.js",
|
|
"tests/e2e/test-logo-rebrand-e2e.js",
|
|
"tests/e2e/test-logo-theme-e2e.js",
|
|
"tests/e2e/test-map-modal-fluid-e2e.js",
|
|
"tests/e2e/test-map-nodes-pagination-e2e.js",
|
|
"tests/e2e/test-nav-drawer-1064-e2e.js",
|
|
"tests/e2e/test-nav-fluid-1055-e2e.js",
|
|
"tests/e2e/test-nav-more-floor-1139-e2e.js",
|
|
"tests/e2e/test-nav-priority-1102-e2e.js",
|
|
"tests/e2e/test-nav-priority-1311-e2e.js",
|
|
"tests/e2e/test-nav-priority-1391-e2e.js",
|
|
"tests/e2e/test-neighbor-map-btn-clip-e2e.js",
|
|
"tests/e2e/test-node-reach-coverage-e2e.js",
|
|
"tests/e2e/test-node-reach-e2e.js",
|
|
"tests/e2e/test-nodes-export-e2e.js",
|
|
"tests/e2e/test-observer-iata-1188-e2e.js",
|
|
"tests/e2e/test-packets-compact-columns-e2e.js",
|
|
"tests/e2e/test-packets-scope-column.js",
|
|
"tests/e2e/test-path-inspector-coverage-e2e.js",
|
|
"tests/e2e/test-rx-coverage-mobile-nav-e2e.js",
|
|
"tests/e2e/test-rx-coverage-noise-e2e.js",
|
|
"tests/e2e/test-rx-coverage-viewport-e2e.js",
|
|
"tests/e2e/test-show-neighbors.js",
|
|
"tests/e2e/test-slideover-1056-e2e.js",
|
|
"tests/e2e/test-slideover-1168-munger-e2e.js",
|
|
"tests/e2e/test-table-fluid-e2e.js",
|
|
"tests/e2e/test-touch-gestures-coverage-e2e.js",
|
|
"tests/e2e/test-touch-targets.js",
|
|
"tests/e2e/test-user-management-e2e.js"
|
|
]
|
|
},
|
|
"domIntegration": {
|
|
"reason": "Requires jsdom. The JS unit gate runs with no node_modules at all (its job has no npm install), so a suite needing a third-party module cannot live in test-all.sh. It runs in the E2E job, which does npm ci, and is invoked by its own deploy.yml line.",
|
|
"files": [
|
|
"tests/e2e/test-table-sort.js"
|
|
]
|
|
},
|
|
"playwrightRunner": {
|
|
"reason": "Requires the @playwright/test runner (not plain node), its configuration, Chromium, and a local server. @playwright/test is not currently declared in package.json; these suites are inventoried but not part of the standalone unit gate.",
|
|
"files": [
|
|
"tests/e2e/test-issue-1522-trace-url-sync-e2e.js",
|
|
"tests/e2e/test-marker-outline-weight.js",
|
|
"tests/e2e/test-path-inspector-e2e.js",
|
|
"tests/e2e/test-pr-1490-live-map-gpu-animations-e2e.js"
|
|
]
|
|
}
|
|
}
|