mirror of
https://github.com/Kpa-clawbot/meshcore-analyzer.git
synced 2026-10-12 19:37:23 +00:00
Part 2 of 3 for #2173 (companion linking): the server routes, bearer auth and the link handshake. Builds on #2174 (merged); `upstream/master` is merged in, so the diff shows only this part. Everything here is behind `userManagement.enabled` and answers 404 with it off. ## Changes in this PR **Device tokens and bearer auth** - `POST /api/auth/device-token`: email + password returns a bearer token, stored as a `kind = 'device'` session with a label. Same failure answers and the same rate limit as login. - Server-enforced scope for a bearer token: `/api/auth/me`, `/api/auth/logout`, `/api/account/companions*`, `/api/account/settings`. Everything else answers 403. - A bearer header only counts when there is no session cookie, so an auth proxy that adds its own `Authorization` header does not hide a logged-in browser. Cookies never accept a device token. - The sessions list on the account API carries `kind` and `label`; logout with a bearer token revokes that device. **Linking a companion** - `POST /api/account/companions/challenge` `{pubkey}` returns `{challenge, expiresAt, host}`: 32 random bytes, single use, 5 minutes, bound to the caller and the pubkey. - `POST /api/account/companions` `{pubkey, challenge, signature, name}`: the signature is the companion's Ed25519 signature over `corescope-link:<host>:<challenge>` (`internal/sigvalidate.VerifyMessage`). The challenge is consumed in every case. - A companion linked to another account moves to the caller (the newest proof wins). Both users get a `companion.transfer` audit row and the previous owner a mail. That mail is a security notice: it is sent whatever the node notification settings are. - `GET /api/account/companions` (with `lastSeenAt` from `client_receptions`) and `DELETE /api/account/companions/{pubkey}`. - Linking does not touch the synced `meshcore-my-nodes`: a companion is not a node to monitor. - Admin user detail lists linked companions; the account data export includes companions and device sessions. **Coverage and config** - `GET /api/rx-coverage?mine=1`: only coverage of the caller's linked companions (401 when logged out, 403 for a device token). With `gaps=1` (#2172) the reply carries no `gaps` member under `mine=1`, because the track query takes one companion and cannot narrow to a set yet (`TestRxCoverageMineOmitsGaps`). - `clientRxCoverage.requireLinkedCompanion` (default off) is read and reported in `/api/config/client`, which also announces `userManagement.companionLinking`, so CoreDrive RX shows its login only where linking exists. The ingestor side is part 3. - CORS: for origins in `corsAllowedOrigins`, the device-token routes alone also allow POST/PUT/DELETE and the `Authorization` and `Content-Type` headers. No credentialed CORS. Documented in `config.example.json`. - OpenAPI and `docs/api-spec.md` cover the new routes. ## Verification - 26 new tests in `cmd/server` and `internal/sigvalidate`, among them: `TestCompanionLinkFlow`, `TestCompanionLinkRejections` (signature by another key, malformed signature, challenge bound to another pubkey, unknown challenge; reuse and expiry are covered by the store tests in #2174), `TestCompanionTransfer`, `TestCompanionTransferMailIgnoresNotificationSettings`, `TestBearerScopedRoutes`, `TestBearerIgnoredWithCookie`, `TestDeviceTokenSharesLoginRateLimit`, `TestCORSBearerRoutes`, `TestCompanionRoutesAbsentWhenOff`, `TestRxCoverageMine`, `TestRxCoverageMineOmitsGaps` (fails without the `mine == nil` guard), `TestVerifyMessage`. - `cmd/server`, `internal/sigvalidate` and `internal/users`: `go vet` and `go test ./...` green, `gofmt` clean. - The linking flow runs on analyzer.on8ar.eu since 9 October 2026 with CoreDrive RX v1.19.0 (a real companion linked through the signed challenge). ## Not in this PR - The ingestor's linked-only filter, the account page (Devices, Companions), the "My coverage" toggle and the user docs: part 3. - Per-user broker credentials and per-user API keys (non-goals in the spec). --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
70 lines
2.3 KiB
Go
70 lines
2.3 KiB
Go
package main
|
|
|
|
import (
|
|
"bytes"
|
|
"log"
|
|
"net/http/httptest"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestClientConfigRequireLinkedCompanion(t *testing.T) {
|
|
srv, router := setupTestServer(t)
|
|
get := func() string {
|
|
w := httptest.NewRecorder()
|
|
router.ServeHTTP(w, httptest.NewRequest("GET", "/api/config/client", nil))
|
|
return w.Body.String()
|
|
}
|
|
if strings.Contains(get(), "clientRxRequireLinkedCompanion") {
|
|
t.Fatal("field present by default")
|
|
}
|
|
srv.cfg.ClientRxCoverage = &ClientRxCoverageConfig{Enabled: true, RequireLinkedCompanion: true}
|
|
if strings.Contains(get(), "clientRxRequireLinkedCompanion") {
|
|
t.Fatal("field present without user management")
|
|
}
|
|
a, _ := newTestAuthService(t)
|
|
srv.auth = a
|
|
if !strings.Contains(get(), `"clientRxRequireLinkedCompanion":true`) {
|
|
t.Fatalf("field missing with user management on: %s", get())
|
|
}
|
|
srv.cfg.ClientRxCoverage.RequireLinkedCompanion = false
|
|
if strings.Contains(get(), "clientRxRequireLinkedCompanion") {
|
|
t.Fatal("field present with the setting off")
|
|
}
|
|
}
|
|
|
|
func TestRequireLinkedCompanionWarnsWithoutUserManagement(t *testing.T) {
|
|
var buf bytes.Buffer
|
|
log.SetOutput(&buf)
|
|
t.Cleanup(func() { log.SetOutput(os.Stderr) })
|
|
srv := &Server{cfg: &Config{ClientRxCoverage: &ClientRxCoverageConfig{Enabled: true, RequireLinkedCompanion: true}}}
|
|
if err := srv.initUserManagement(filepath.Join(t.TempDir(), "meshcore.db")); err != nil || srv.auth != nil {
|
|
t.Fatalf("initUserManagement: auth=%v err=%v", srv.auth, err)
|
|
}
|
|
if !strings.Contains(buf.String(), "requireLinkedCompanion") {
|
|
t.Fatalf("no startup warning, log: %q", buf.String())
|
|
}
|
|
}
|
|
|
|
// CoreDrive RX shows its login only when the server says it supports companion
|
|
// linking: a CoreScope with user management but without these routes answers the
|
|
// device-token POST with the SPA page.
|
|
func TestClientConfigAnnouncesCompanionLinking(t *testing.T) {
|
|
srv, router := setupTestServer(t)
|
|
get := func() string {
|
|
w := httptest.NewRecorder()
|
|
router.ServeHTTP(w, httptest.NewRequest("GET", "/api/config/client", nil))
|
|
return w.Body.String()
|
|
}
|
|
if strings.Contains(get(), "companionLinking") {
|
|
t.Fatal("companionLinking present with user management off")
|
|
}
|
|
a, _ := newTestAuthService(t)
|
|
srv.auth = a
|
|
if !strings.Contains(get(), `"companionLinking":true`) {
|
|
t.Fatalf("companionLinking missing with user management on: %s", get())
|
|
}
|
|
}
|