mirror of
https://github.com/Kpa-clawbot/meshcore-analyzer.git
synced 2026-10-10 22:18:35 +00:00
efitenandClaude Opus 5.5
d232072f85
Part A of #2128: optional, off-by-default user accounts. With the feature off nothing changes; with it on, visitors can register and log in, and admins manage users and use the operator actions without the API key. PR #2130 (settings sync) builds on this one. The two are meant to be merged together. ## The situation - Operator actions (geofilter save and prune, backup, perf reset) need the shared `apiKey`. There is no per-person right. - Nothing in CoreScope knows who a visitor is, so the requests in #2128 that need that (#1835, #2092, #1508, #730) have nothing to build on. ## What this PR adds **Two new Go modules** - `internal/users`: a separate `users.db` (SQLite through `modernc.org/sqlite`) with users, sessions, single-use tokens, an audit log and a mail log. Passwords use argon2id. - `internal/mailer`: a `Mailer` interface with a Brevo client (send, delivery events, webhook parsing) and an in-memory fake for tests. **Server (`cmd/server`)**, active only with `userManagement.enabled` - 24 routes, all documented in OpenAPI under the `users` tag ([`auth_routes.go`](https://github.com/efiten/CoreScope/blob/feat/user-management/cmd/server/auth_routes.go)): - auth: register, activate, login, logout, me, forgot, reset; - account: profile, password, email change with confirmation, sessions, self-delete; - admin: list, detail, disable, enable, delete, role, resend activation, manual activation, mail status refresh; - a Brevo webhook, registered only when `mail.webhookSecret` is set. - `requireAdmin` replaces `requireAPIKey` at the 7 operator call sites: the API key **or** an admin session. With the feature off it is the old API-key gate (`TestRequireAdminWithoutUserManagementIsAPIKeyGate`). - `/api/config/client` gets `userManagement: {enabled: true}` only when the service started; with the feature off the response is byte-identical. **Frontend** - `auth.js` (header account control, request helper that adds the CSRF header), `account.js` (login, register, activate, forgot, reset, confirm email, my account), `admin-users.js` (`#/admin/users`, deep-linked filters), `account.css` (theme tokens only). - On phones the top-bar control is hidden, so a conditional entry goes into the bottom-nav "More" sheet and the nav drawer. - The customizer geofilter tab and the Perf "Reset stats" button use the admin session when there is one. **Config.** A `userManagement` block (`config.example.json`, [`docs/user-guide/accounts.md`](https://github.com/efiten/CoreScope/blob/feat/user-management/docs/user-guide/accounts.md)). The Brevo key can come from `CORESCOPE_BREVO_API_KEY`. The server refuses to start when the block is enabled but incomplete. ## Security choices - Session cookie `cs_session`: HttpOnly, SameSite=Lax, Secure when `publicBaseUrl` is https. Every cookie-authenticated state change needs the `X-CS-CSRF` header and a matching Origin. - Activation needs the token **and** the account password. Without the password, an attacker who keeps re-registering a known address could get the owner to activate an account that carries the attacker's password. - Register, forgot and email change answer identically for known and unknown addresses. A password reset ends all sessions, a password change ends all other sessions, and both end outstanding email-change links. - Rate limits: login 10 per 15 minutes, register and forgot 5 per hour, per IP and per address. The bucket count is capped. `trustedProxies` makes the per-IP limits see real client IPs behind a proxy. - Server logs carry `#<user id>`, never addresses, tokens or passwords; mail-provider error texts are redacted before logging. ## Performance No change to an existing hot path with the feature off. With it on: - One `users.db` lookup per authenticated request (session by token hash). - The admin user table rebuilds its `tbody` on each filter change. `users.List` caps the result at 1000 rows (`internal/users/users.go`), which bounds the rebuild. - `map[string]interface{}` in `openapi.go`: 79 before, 78 after. ## Verification - `internal/users`, `internal/mailer` and `cmd/server`: `go vet` and `go test -race` pass locally. 121 new Go tests. - `cmd/server` with `-tags e2etest`: vet and the e2e hook tests pass. - `sh test-all.sh` exits 0. `tests/unit/test-user-management-ui.js`: 67 passing (vm, real modules). - `tests/e2e/test-user-management-e2e.js` (6 steps) passed locally against an `e2etest` build with the fake mailer and against a feature-off build. CI builds the `e2etest` binary and runs the suite on a second server (`deploy.yml`). - On a staging instance with a real Brevo key: register, activation mail delivered, activate, admin table, "Refresh status" showing sent, deferred, delivered, opened and clicked. ## Not in this PR - Settings sync (#2130), the admin dashboard, approval flows and notifications (parts B to E of #2128). - A `requireReadAuth` mode (#1835). Sessions from this PR are what such a mode would accept. - Binary size and build time with `modernc.org/sqlite` linked next to `mattn/go-sqlite3` were not measured. Their driver names do not collide. #1992 discusses the driver choice. - No Brevo webhook was configured on staging; delivery status there came from "Refresh status". --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
70 lines
2.0 KiB
Go
70 lines
2.0 KiB
Go
package main
|
|
|
|
import (
|
|
"bytes"
|
|
"fmt"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/gorilla/mux"
|
|
)
|
|
|
|
func TestBrevoWebhookAuthAndIngest(t *testing.T) {
|
|
f, _, uma := adminFixture(t)
|
|
mails, _ := f.st.MailForUser(uma.me.ID, 10)
|
|
m := mails[0]
|
|
body := fmt.Sprintf(`{"event":"hard_bounce","email":"uma@example.org","message-id":%q,"ts_event":%d,"reason":"mailbox unavailable"}`,
|
|
m.ProviderMessageID, m.SentAt.Unix()+30)
|
|
post := func(auth, b string) int {
|
|
req := httptest.NewRequest("POST", "/api/mail/brevo/webhook", bytes.NewBufferString(b))
|
|
req.RemoteAddr = "203.0.113.50:443"
|
|
if auth != "" {
|
|
req.Header.Set("Authorization", auth)
|
|
}
|
|
w := httptest.NewRecorder()
|
|
f.router.ServeHTTP(w, req)
|
|
return w.Code
|
|
}
|
|
if c := post("", body); c != 401 {
|
|
t.Fatalf("no auth = %d", c)
|
|
}
|
|
if c := post("Bearer wrong-secret-xxxxxxxx", body); c != 401 {
|
|
t.Fatalf("wrong auth = %d", c)
|
|
}
|
|
if c := post("Bearer "+testHook, "garbage"); c != 200 { // authenticated junk: 200 so Brevo stops retrying
|
|
t.Fatalf("garbage = %d", c)
|
|
}
|
|
if c := post("Bearer "+testHook, body); c != 200 {
|
|
t.Fatalf("valid = %d", c)
|
|
}
|
|
rec, _ := f.st.MailByID(m.ID)
|
|
if rec.LastEvent != "hard_bounce" || rec.LastReason != "mailbox unavailable" {
|
|
t.Fatalf("mail record = %+v", rec)
|
|
}
|
|
if u, _ := f.st.GetByID(uma.me.ID); !u.EmailBouncing {
|
|
t.Fatal("bounce flag not set")
|
|
}
|
|
unknown := `{"event":"delivered","message-id":"<nope@x>","ts_event":1}`
|
|
if c := post("Bearer "+testHook, unknown); c != 200 {
|
|
t.Fatalf("unknown id = %d (must be 200 so Brevo stops retrying)", c)
|
|
}
|
|
}
|
|
|
|
func TestBrevoWebhookAbsentWithoutSecret(t *testing.T) {
|
|
f, _, _ := adminFixture(t)
|
|
f.srv.auth.set.webhookSecret = ""
|
|
r := newAuthFixtureRouterOnly(f)
|
|
req := httptest.NewRequest("POST", "/api/mail/brevo/webhook", bytes.NewBufferString("{}"))
|
|
w := httptest.NewRecorder()
|
|
r.ServeHTTP(w, req)
|
|
if w.Code != 404 {
|
|
t.Fatalf("no secret configured = %d, want 404", w.Code)
|
|
}
|
|
}
|
|
|
|
func newAuthFixtureRouterOnly(f *authFixture) *mux.Router {
|
|
r := mux.NewRouter()
|
|
f.srv.registerAuthRoutes(r)
|
|
return r
|
|
}
|