Files
meshcore-analyzer/cmd/server/proposal_channels_test.go
T
efitenandClaude Opus 5.5 b2cda21a27 feat(server): companion linking routes, device tokens and bearer auth (#2175)
Part 2 of 3 for #2173 (companion linking): the server routes, bearer
auth and the link handshake. Builds on #2174 (merged); `upstream/master`
is merged in, so the diff shows only this part. Everything here is
behind `userManagement.enabled` and answers 404 with it off.

## Changes in this PR

**Device tokens and bearer auth**
- `POST /api/auth/device-token`: email + password returns a bearer
token, stored as a `kind = 'device'` session with a label. Same failure
answers and the same rate limit as login.
- Server-enforced scope for a bearer token: `/api/auth/me`,
`/api/auth/logout`, `/api/account/companions*`, `/api/account/settings`.
Everything else answers 403.
- A bearer header only counts when there is no session cookie, so an
auth proxy that adds its own `Authorization` header does not hide a
logged-in browser. Cookies never accept a device token.
- The sessions list on the account API carries `kind` and `label`;
logout with a bearer token revokes that device.

**Linking a companion**
- `POST /api/account/companions/challenge` `{pubkey}` returns
`{challenge, expiresAt, host}`: 32 random bytes, single use, 5 minutes,
bound to the caller and the pubkey.
- `POST /api/account/companions` `{pubkey, challenge, signature, name}`:
the signature is the companion's Ed25519 signature over
`corescope-link:<host>:<challenge>`
(`internal/sigvalidate.VerifyMessage`). The challenge is consumed in
every case.
- A companion linked to another account moves to the caller (the newest
proof wins). Both users get a `companion.transfer` audit row and the
previous owner a mail. That mail is a security notice: it is sent
whatever the node notification settings are.
- `GET /api/account/companions` (with `lastSeenAt` from
`client_receptions`) and `DELETE /api/account/companions/{pubkey}`.
- Linking does not touch the synced `meshcore-my-nodes`: a companion is
not a node to monitor.
- Admin user detail lists linked companions; the account data export
includes companions and device sessions.

**Coverage and config**
- `GET /api/rx-coverage?mine=1`: only coverage of the caller's linked
companions (401 when logged out, 403 for a device token). With `gaps=1`
(#2172) the reply carries no `gaps` member under `mine=1`, because the
track query takes one companion and cannot narrow to a set yet
(`TestRxCoverageMineOmitsGaps`).
- `clientRxCoverage.requireLinkedCompanion` (default off) is read and
reported in `/api/config/client`, which also announces
`userManagement.companionLinking`, so CoreDrive RX shows its login only
where linking exists. The ingestor side is part 3.
- CORS: for origins in `corsAllowedOrigins`, the device-token routes
alone also allow POST/PUT/DELETE and the `Authorization` and
`Content-Type` headers. No credentialed CORS. Documented in
`config.example.json`.
- OpenAPI and `docs/api-spec.md` cover the new routes.

## Verification

- 26 new tests in `cmd/server` and `internal/sigvalidate`, among them:
`TestCompanionLinkFlow`, `TestCompanionLinkRejections` (signature by
another key, malformed signature, challenge bound to another pubkey,
unknown challenge; reuse and expiry are covered by the store tests in
#2174), `TestCompanionTransfer`,
`TestCompanionTransferMailIgnoresNotificationSettings`,
`TestBearerScopedRoutes`, `TestBearerIgnoredWithCookie`,
`TestDeviceTokenSharesLoginRateLimit`, `TestCORSBearerRoutes`,
`TestCompanionRoutesAbsentWhenOff`, `TestRxCoverageMine`,
`TestRxCoverageMineOmitsGaps` (fails without the `mine == nil` guard),
`TestVerifyMessage`.
- `cmd/server`, `internal/sigvalidate` and `internal/users`: `go vet`
and `go test ./...` green, `gofmt` clean.
- The linking flow runs on analyzer.on8ar.eu since 9 October 2026 with
CoreDrive RX v1.19.0 (a real companion linked through the signed
challenge).

## Not in this PR

- The ingestor's linked-only filter, the account page (Devices,
Companions), the "My coverage" toggle and the user docs: part 3.
- Per-user broker credentials and per-user API keys (non-goals in the
spec).

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-10-10 18:20:49 +02:00

120 lines
4.0 KiB
Go

package main
import (
"encoding/json"
"fmt"
"net/http/httptest"
"strings"
"testing"
"github.com/gorilla/mux"
"github.com/meshcore-analyzer/mailer"
"github.com/meshcore-analyzer/users"
)
func getBody(router *mux.Router, path string) string {
w := httptest.NewRecorder()
router.ServeHTTP(w, httptest.NewRequest("GET", path, nil))
return w.Body.String()
}
func TestChannelsResponseUnchangedWithoutProposals(t *testing.T) {
srv, router := setupTestServer(t)
base := getBody(router, "/api/channels")
if strings.Contains(base, "approvedChannels") {
t.Fatalf("approvedChannels without user management: %s", base)
}
a, _ := newTestAuthService(t) // user management on, proposals off
srv.auth = a
if got := getBody(router, "/api/channels"); got != base {
t.Fatalf("/api/channels changed with proposals off:\n%s\nvs\n%s", got, base)
}
}
func TestChannelsResponseListsApprovedChannels(t *testing.T) {
srv, router := setupTestServer(t)
a, _ := newTestAuthService(t)
a.set.proposals = defaultProposalSettings()
srv.auth = a
var resp ChannelListResponse
if err := json.Unmarshal([]byte(getBody(router, "/api/channels")), &resp); err != nil {
t.Fatal(err)
}
if resp.ApprovedChannels == nil || len(*resp.ApprovedChannels) != 0 {
t.Fatalf("approvedChannels with none approved = %v; want present and empty", resp.ApprovedChannels)
}
u, err := a.st.CreatePending("pat@example.org", "Pat", "x")
if err != nil {
t.Fatal(err)
}
p, err := a.st.Propose(users.KindHashtagChannel, "#mycity", u.ID, users.ProposalLimits{})
if err != nil {
t.Fatal(err)
}
if _, err := a.st.Decide(p.ID, users.ProposalApprove, u.ID, "", 0); err != nil {
t.Fatal(err)
}
a.refreshApproved()
resp = ChannelListResponse{}
if err := json.Unmarshal([]byte(getBody(router, "/api/channels")), &resp); err != nil {
t.Fatal(err)
}
if resp.ApprovedChannels == nil || strings.Join(*resp.ApprovedChannels, ",") != "#mycity" {
t.Fatalf("approvedChannels = %v; want [#mycity]", resp.ApprovedChannels)
}
}
func TestDecideRefreshesApprovedChannels(t *testing.T) {
f := newProposalFixture(t, defaultProposalSettings())
admin, user := proposalPeople(t, f)
p := decode[proposalJSON](t, postProposal(t, f, user, "#a"))
expectStatus(t, f.do("POST", fmt.Sprintf("/api/admin/proposals/%d/approve", p.ID), decideRequest{}, as(admin)), 200)
if got := f.srv.auth.approvedChannels(); strings.Join(got, ",") != "#a" {
t.Fatalf("after approve = %v", got)
}
expectStatus(t, f.do("POST", fmt.Sprintf("/api/admin/proposals/%d/revoke", p.ID), decideRequest{}, as(admin)), 200)
if got := f.srv.auth.approvedChannels(); got == nil || len(got) != 0 {
t.Fatalf("after revoke = %#v; want empty", got)
}
}
// The snapshot is filled at construction and capped at maxApproved, oldest
// approval first: the ingestor applies the same cap and order.
func TestNewAuthServiceLoadsApprovedChannelsCapped(t *testing.T) {
a, _ := newTestAuthService(t)
u, err := a.st.CreatePending("pat@example.org", "Pat", "x")
if err != nil {
t.Fatal(err)
}
for _, s := range []string{"#a", "#b"} {
p, err := a.st.Propose(users.KindHashtagChannel, s, u.ID, users.ProposalLimits{})
if err != nil {
t.Fatal(err)
}
if _, err := a.st.Decide(p.ID, users.ProposalApprove, u.ID, "", 0); err != nil {
t.Fatal(err)
}
}
set := *a.set
set.proposals = defaultProposalSettings()
set.proposals.maxApproved = 1
b := newAuthService(&set, a.st, &mailer.Fake{})
if got := b.approvedChannels(); strings.Join(got, ",") != "#a" {
t.Fatalf("approvedChannels = %v; want [#a]", got)
}
off := newAuthService(a.set, a.st, &mailer.Fake{})
if got := off.approvedChannels(); got == nil || len(got) != 0 {
t.Fatalf("proposals off = %#v; want empty", got)
}
}
func TestClientConfigAdvertisesChannelProposals(t *testing.T) {
srv, router := setupTestServer(t)
a, _ := newTestAuthService(t)
a.set.proposals = defaultProposalSettings()
srv.auth = a
if body := getBody(router, "/api/config/client"); !strings.Contains(body, `"userManagement":{"enabled":true,"channelProposals":true,"companionLinking":true}`) {
t.Fatalf("client config = %s", body)
}
}