Unverified Commit 8fe255e3 authored by Minseong Choi's avatar Minseong Choi 💬
Browse files

fix(api): relay Mojang logins when no auth source is configured 

felis api wired the hasJoined multiplexer only when felis.toml had at
least one [[auth_source]]. With none, the source list stayed nil and
every hasJoined answer was a 204. That was harmless while nothing
pointed at the route, but the installer now starts Velocity with
-Dmojang.sessionserver aimed at felis-api unconditionally, and the
generated felis.toml tells the operator to delete the LittleSkin block
for a Mojang-only server. Doing exactly that turned every login away,
premium accounts included, and felis-api logged nothing about it.

Always build the list through authSourcesFromConfig, which prepends
Mojang in code, so an empty config is a Mojang-only relay. felis nano
already behaves this way with the same file.

The new test pins authSourcesFromConfig itself: Mojang first, the only
Identity source, and still present when nothing is configured. Marking
a configured source Identity makes it fail. The call site in cmdAPI is
now a single unconditional assignment and has no unit test of its own.
parent 800a9042

cmd/felis/api.go

+6 −7
Changes for cmd/felis/api.go: 6 added lines, 7 removed lines.
Original line number Diff line number Diff line
@@ -286,15 +286,14 @@ func cmdAPI(args []string, stdout, stderr io.Writer) int { 
	}

	fmt.Fprintln(stderr, "felis api: external face fails closed (Access JWKS key function not configured)")



	// Felis-nano: wire the multi-source hasJoined multiplexer only when third-party auth

	// sources are configured. Mojang leads as the code-owned identity anchor (正版优先);

	// config can only append namespace-rewritten third-party sources, never a trusted one,

	// so a misconfig cannot reopen the impersonation hole. No sources = a.AuthSources stays

	// nil = the endpoint 204s every login (ships off).

	if len(cfg.AuthSources) > 0 {

	// Felis-nano: the multi-source hasJoined multiplexer. Mojang leads as the code-owned

	// identity anchor (正版优先); config can only append namespace-rewritten third-party

	// sources, never a trusted one, so a misconfig cannot reopen the impersonation hole.

	// Wired unconditionally: the installer points Velocity at this route whether or not any

	// [[auth_source]] is configured, so an empty list has to mean a Mojang-only relay, the

	// same as under `felis nano`. A nil list would 204 every login, premium ones included.

	a.AuthSources = authSourcesFromConfig(cfg.AuthSources)

	fmt.Fprintf(stderr, "felis api: hasJoined multiplexer active — Mojang + %d third-party source(s)\n", len(cfg.AuthSources))

	}



	// Passkey (WebAuthn) verifier (spec §14, Phase 6). One relying party spans BOTH

	// web faces: the RP id is the panel hostname (console.<root>), and because that is

cmd/felis/api_test.go

+39 −0
Changes for cmd/felis/api_test.go: 39 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -3,8 +3,47 @@ package main 
import (

	"net/http"

	"testing"



	"felis.lolicon.best/internal/config"

)



// TestAuthSourcesFromConfig pins the one place the hasJoined identity anchor is decided:

// Mojang is prepended in code, first, and is the only source whose UUIDs are trusted as-is.

// The empty case matters on its own — both `felis api` and `felis nano` call this with a

// config that has no [[auth_source]] at all, and that has to be a Mojang-only relay rather

// than an empty list that rejects every login.

func TestAuthSourcesFromConfig(t *testing.T) {

	for _, tc := range []struct {

		name       string

		configured []config.AuthSourceConfig

	}{

		{"no configured sources", nil},

		{"configured sources", []config.AuthSourceConfig{

			{Tag: "littleskin", Prefix: "LS", URL: "https://littleskin.example/hasJoined"},

			{Tag: "guild", Prefix: "GD", URL: "https://guild.example/hasJoined"},

		}},

	} {

		t.Run(tc.name, func(t *testing.T) {

			got := authSourcesFromConfig(tc.configured)

			if len(got) != len(tc.configured)+1 {

				t.Fatalf("got %d sources, want Mojang + %d configured", len(got), len(tc.configured))

			}

			if got[0].Tag != "mojang" || got[0].URL != mojangSessionServer || !got[0].Identity {

				t.Errorf("first source = %+v, want the Mojang identity anchor", got[0])

			}

			for i, c := range tc.configured {

				s := got[i+1]

				if s.Identity {

					t.Errorf("configured source %q is marked Identity; only Mojang may be", c.Tag)

				}

				if s.Tag != c.Tag || s.Prefix != c.Prefix || s.URL != c.URL {

					t.Errorf("source %d = %+v, want %+v in config order", i+1, s, c)

				}

			}

		})

	}

}



// TestNewAPIServerSetsHardenedTimeouts pins the gosec-G112 hardening on every

// felis-api listener: the shared factory must bound the header and idle phases

// (Slowloris + idle-connection exhaustion) while leaving WriteTimeout UNSET, because

internal/api/api.go

+3 −3
Changes for internal/api/api.go: 3 added lines, 3 removed lines.
Original line number Diff line number Diff line
@@ -139,9 +139,9 @@ type API struct { 


	// AuthSources is the Felis-nano multi-source hasJoined multiplexer's upstream

	// Yggdrasil list, in priority order (config order; the Mojang Identity source

	// first for 正版优先). Nil — the default — makes the session verifier reject every

	// login (204), so the endpoint ships inert until cmd/felis wires configured

	// sources. Consumed by handleHasJoined (handlers_hasjoined.go).

	// first for 正版优先). Nil makes the session verifier reject every login (204);

	// cmd/felis always wires at least the Mojang source through authSourcesFromConfig.

	// Consumed by handleHasJoined (handlers_hasjoined.go).

	AuthSources []AuthSource



	// Now is the clock, injectable for tests. Defaults to time.Now.