mirror of
https://github.com/Kpa-clawbot/meshcore-analyzer.git
synced 2026-10-12 11:17:19 +00:00
efitenandClaude Opus 5.5
b2cda21a27
Part 2 of 3 for #2173 (companion linking): the server routes, bearer auth and the link handshake. Builds on #2174 (merged); `upstream/master` is merged in, so the diff shows only this part. Everything here is behind `userManagement.enabled` and answers 404 with it off. ## Changes in this PR **Device tokens and bearer auth** - `POST /api/auth/device-token`: email + password returns a bearer token, stored as a `kind = 'device'` session with a label. Same failure answers and the same rate limit as login. - Server-enforced scope for a bearer token: `/api/auth/me`, `/api/auth/logout`, `/api/account/companions*`, `/api/account/settings`. Everything else answers 403. - A bearer header only counts when there is no session cookie, so an auth proxy that adds its own `Authorization` header does not hide a logged-in browser. Cookies never accept a device token. - The sessions list on the account API carries `kind` and `label`; logout with a bearer token revokes that device. **Linking a companion** - `POST /api/account/companions/challenge` `{pubkey}` returns `{challenge, expiresAt, host}`: 32 random bytes, single use, 5 minutes, bound to the caller and the pubkey. - `POST /api/account/companions` `{pubkey, challenge, signature, name}`: the signature is the companion's Ed25519 signature over `corescope-link:<host>:<challenge>` (`internal/sigvalidate.VerifyMessage`). The challenge is consumed in every case. - A companion linked to another account moves to the caller (the newest proof wins). Both users get a `companion.transfer` audit row and the previous owner a mail. That mail is a security notice: it is sent whatever the node notification settings are. - `GET /api/account/companions` (with `lastSeenAt` from `client_receptions`) and `DELETE /api/account/companions/{pubkey}`. - Linking does not touch the synced `meshcore-my-nodes`: a companion is not a node to monitor. - Admin user detail lists linked companions; the account data export includes companions and device sessions. **Coverage and config** - `GET /api/rx-coverage?mine=1`: only coverage of the caller's linked companions (401 when logged out, 403 for a device token). With `gaps=1` (#2172) the reply carries no `gaps` member under `mine=1`, because the track query takes one companion and cannot narrow to a set yet (`TestRxCoverageMineOmitsGaps`). - `clientRxCoverage.requireLinkedCompanion` (default off) is read and reported in `/api/config/client`, which also announces `userManagement.companionLinking`, so CoreDrive RX shows its login only where linking exists. The ingestor side is part 3. - CORS: for origins in `corsAllowedOrigins`, the device-token routes alone also allow POST/PUT/DELETE and the `Authorization` and `Content-Type` headers. No credentialed CORS. Documented in `config.example.json`. - OpenAPI and `docs/api-spec.md` cover the new routes. ## Verification - 26 new tests in `cmd/server` and `internal/sigvalidate`, among them: `TestCompanionLinkFlow`, `TestCompanionLinkRejections` (signature by another key, malformed signature, challenge bound to another pubkey, unknown challenge; reuse and expiry are covered by the store tests in #2174), `TestCompanionTransfer`, `TestCompanionTransferMailIgnoresNotificationSettings`, `TestBearerScopedRoutes`, `TestBearerIgnoredWithCookie`, `TestDeviceTokenSharesLoginRateLimit`, `TestCORSBearerRoutes`, `TestCompanionRoutesAbsentWhenOff`, `TestRxCoverageMine`, `TestRxCoverageMineOmitsGaps` (fails without the `mine == nil` guard), `TestVerifyMessage`. - `cmd/server`, `internal/sigvalidate` and `internal/users`: `go vet` and `go test ./...` green, `gofmt` clean. - The linking flow runs on analyzer.on8ar.eu since 9 October 2026 with CoreDrive RX v1.19.0 (a real companion linked through the signed challenge). ## Not in this PR - The ingestor's linked-only filter, the account page (Devices, Companions), the "My coverage" toggle and the user docs: part 3. - Per-user broker credentials and per-user API keys (non-goals in the spec). --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
73 lines
4.4 KiB
Go
73 lines
4.4 KiB
Go
package main
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/gorilla/mux"
|
|
)
|
|
|
|
// e2eRoutes is set only by the e2etest build (auth_e2e.go).
|
|
var e2eRoutes func(s *Server, r *mux.Router)
|
|
|
|
// registerAuthRoutes adds every user-management route. Called by
|
|
// RegisterRoutes only when s.auth != nil, so with the feature off these
|
|
// paths are not registered and fall through to the SPA handler like any
|
|
// unknown path.
|
|
func (s *Server) registerAuthRoutes(r *mux.Router) {
|
|
// CORS preflight for the bearer routes. gorilla/mux does not run
|
|
// middleware on a method mismatch, so without this route an OPTIONS on
|
|
// a POST-only path would answer 405 before corsMiddleware could. A
|
|
// matcher, not a path: it is no API route of its own (not in the spec).
|
|
r.MatcherFunc(func(req *http.Request, _ *mux.RouteMatch) bool {
|
|
return req.Method == http.MethodOptions && bearerCORSPath(req.URL.Path)
|
|
}).HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(http.StatusNoContent) })
|
|
r.HandleFunc("/api/auth/register", s.requireOrigin(s.handleRegister)).Methods("POST")
|
|
r.HandleFunc("/api/auth/activate", s.requireOrigin(s.handleActivate)).Methods("POST")
|
|
r.HandleFunc("/api/auth/login", s.requireOrigin(s.handleLogin)).Methods("POST")
|
|
r.HandleFunc("/api/auth/device-token", s.handleDeviceToken).Methods("POST")
|
|
r.HandleFunc("/api/auth/logout", s.handleLogout).Methods("POST") // origin check inside (cookie path only)
|
|
r.HandleFunc("/api/auth/me", s.withUser(s.handleMe)).Methods("GET")
|
|
r.HandleFunc("/api/auth/forgot", s.requireOrigin(s.handleForgot)).Methods("POST")
|
|
r.HandleFunc("/api/auth/reset", s.requireOrigin(s.handleReset)).Methods("POST")
|
|
r.HandleFunc("/api/account", s.withUser(s.handleAccountPatch)).Methods("PATCH")
|
|
r.HandleFunc("/api/account", s.withUser(s.handleAccountDelete)).Methods("DELETE")
|
|
r.HandleFunc("/api/account/password", s.withUser(s.handleAccountPassword)).Methods("POST")
|
|
r.HandleFunc("/api/account/email", s.withUser(s.handleAccountEmail)).Methods("POST")
|
|
r.HandleFunc("/api/account/confirm-email", s.requireOrigin(s.handleConfirmEmail)).Methods("POST")
|
|
r.HandleFunc("/api/account/sessions", s.withUser(s.handleAccountSessions)).Methods("GET")
|
|
r.HandleFunc("/api/account/sessions/{id}", s.withUser(s.handleAccountSessionDelete)).Methods("DELETE")
|
|
r.HandleFunc("/api/account/settings", s.withUser(s.handleSettingsGet)).Methods("GET")
|
|
r.HandleFunc("/api/account/settings", s.withUser(s.handleSettingsPut)).Methods("PUT")
|
|
r.HandleFunc("/api/account/settings", s.withUser(s.handleSettingsDelete)).Methods("DELETE")
|
|
r.HandleFunc("/api/account/companions/challenge", s.withUser(s.handleCompanionChallenge)).Methods("POST")
|
|
r.HandleFunc("/api/account/companions", s.withUser(s.handleCompanionList)).Methods("GET")
|
|
r.HandleFunc("/api/account/companions", s.withUser(s.handleCompanionLink)).Methods("POST")
|
|
r.HandleFunc("/api/account/companions/{pubkey}", s.withUser(s.handleCompanionDelete)).Methods("DELETE")
|
|
r.HandleFunc("/api/account/export", s.withUser(s.handleAccountExport)).Methods("GET")
|
|
r.HandleFunc("/api/admin/users", s.withAdmin(s.handleAdminUsers)).Methods("GET")
|
|
r.HandleFunc("/api/admin/users/{id}", s.withAdmin(s.handleAdminUserDetail)).Methods("GET")
|
|
r.HandleFunc("/api/admin/users/{id}", s.withAdmin(s.handleAdminDelete)).Methods("DELETE")
|
|
r.HandleFunc("/api/admin/users/{id}/disable", s.withAdmin(s.handleAdminDisable)).Methods("POST")
|
|
r.HandleFunc("/api/admin/users/{id}/enable", s.withAdmin(s.handleAdminEnable)).Methods("POST")
|
|
r.HandleFunc("/api/admin/users/{id}/role", s.withAdmin(s.handleAdminRole)).Methods("POST")
|
|
r.HandleFunc("/api/admin/users/{id}/resend-activation", s.withAdmin(s.handleAdminResendActivation)).Methods("POST")
|
|
r.HandleFunc("/api/admin/users/{id}/activate", s.withAdmin(s.handleAdminActivate)).Methods("POST")
|
|
r.HandleFunc("/api/admin/users/{id}/mail/{mailId}/refresh", s.withAdmin(s.handleAdminMailRefresh)).Methods("POST")
|
|
r.HandleFunc("/api/admin/audit", s.withAdmin(s.handleAdminAudit)).Methods("GET")
|
|
r.HandleFunc("/api/admin/stats", s.withAdmin(s.handleAdminStats)).Methods("GET")
|
|
r.HandleFunc("/api/admin/users-backup", s.withAdmin(s.handleAdminUsersBackup)).Methods("GET")
|
|
if s.auth.set.proposals.enabled {
|
|
s.registerProposalRoutes(r)
|
|
}
|
|
if s.auth.notify != nil {
|
|
s.registerNotifyRoutes(r)
|
|
}
|
|
// The webhook exists only when a secret is configured.
|
|
if s.auth.set.webhookSecret != "" {
|
|
r.HandleFunc("/api/mail/brevo/webhook", s.handleBrevoWebhook).Methods("POST")
|
|
}
|
|
if e2eRoutes != nil {
|
|
e2eRoutes(s, r)
|
|
}
|
|
}
|