Unverified Commit af14f02f authored by Minseong Choi's avatar Minseong Choi 💬
Browse files

feat(api): local-password authentication backend 

Add username+password login for Owner/Operator staff accounts on
op.console, the primary web login when Zero Trust is not in front of the
API. Three handlers form the whole surface: login mints a server-side
session cookie, logout revokes it idempotently, and change-password
re-verifies the current password before rotating the hash and clearing
must_change_password.

- Session cookies are HttpOnly+Secure+SameSite=Lax, host-only, stored
  server-side as a SHA-256 hash with a 12h TTL.
- Login is anti-enumeration: every failure runs a uniform bcrypt compare
  against a dummy hash and returns the same vague error.
- Credential-bearing writes require Content-Type: application/json,
  returning 415 otherwise, to close the cross-site form-POST forgery
  vector as a belt to the SameSite cookie.
- Local auth fails closed: login is rejected unless local_auth_enabled
  is set, so a Zero-Trust-only deployment never accepts a local password.
- Extend the users table with a nullable password_hash and
  must_change_password; staff are role=admin rows with a hash, players
  are role=user rows with hash NULL.
- /me now reports must_change_password so the panel can force a
  first-login change.

Covered by Go unit tests (handlers, content-type guard, anti-enumeration,
forced-change lockdown) and the OpenAPI route-parity gate.
parent 58fa4b0a

cmd/felis/api.go

+18 −4
Changes for cmd/felis/api.go: 18 added lines, 4 removed lines.
Original line number Diff line number Diff line
@@ -122,8 +122,14 @@ func cmdAPI(args []string, stdout, stderr io.Writer) int { 
		fmt.Fprintln(stderr, "felis api: restore executor disabled (needs FELIS_IMAGE and FELIS_BACKUP_PVC) — restore endpoint returns 503")

	}



	// One PGRepo instance backs both the handlers and the session verifier: the

	// SessionAuth that fronts the external face reads sessions/users/settings from

	// the same store the auth handlers write to, so a login and the next request

	// agree on what local auth knows.

	repo := api.NewPGRepo(drv.DB())



	a := &api.API{

		Repo:    api.NewPGRepo(drv.DB()),

		Repo:    repo,

		Cluster: api.NewK8sCluster(cl, cfg.K8s.Namespace),

		Console: api.NewK8sConsole(cl, cfg.K8s.Namespace),

		Logs:    api.NewK8sLogStreamer(clientset, cfg.K8s.Namespace),
@@ -134,9 +140,17 @@ func cmdAPI(args []string, stdout, stderr io.Writer) int { 
		Builder:     builder,

		Restorer:    restorer,

		Submissions: submissions,

		// Keyfunc is intentionally nil: the external face fails closed until a

		// JWKS-backed key function is wired (deployment integration point).

		External:     api.AccessVerifier{Audience: cfg.Auth.AccessJWTAud},

		// The external face is fronted by SessionAuth: it prefers a local-password

		// session cookie and otherwise delegates to the Cloudflare-Access JWT verifier,

		// so both auth models coexist on one face. The delegate's Keyfunc is

		// intentionally nil — the JWT path fails closed until a JWKS-backed key function

		// is wired (deployment integration point) — while the local-password path is

		// live the moment `felis breakGlass` flips local_auth_enabled on.

		External: api.SessionAuth{

			Repo:       repo,

			Delegate:   api.AccessVerifier{Audience: cfg.Auth.AccessJWTAud},

			RootDomain: cfg.Server.RootDomain,

		},

		RootDomain:   cfg.Server.RootDomain,

		WakeCooldown: 30 * time.Second,

	}

docs/openapi.yaml

+152 −1
Changes for docs/openapi.yaml: 152 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -83,6 +83,17 @@ components: 
        Cloudflare Access JWT (external face). Admin-tier operations require the

        token to have traversed the admin Access path; the handler additionally

        asserts Principal.IsAdmin().

    sessionCookie:

      type: apiKey

      in: cookie

      name: felis_session

      description: >-

        Opaque local-password session cookie (external face). Minted by

        POST /api/v1/auth/login when local auth is enabled, HttpOnly+Secure+

        SameSite=Lax and host-only, so an op.console session never reaches the

        player console. Only its sha-256 is persisted. SessionAuth prefers this

        cookie and otherwise delegates to accessJWT, so the two models coexist on

        one face.



  responses:

    NoContent:
@@ -1066,6 +1077,137 @@ paths: 
        '404':

          $ref: '#/components/responses/NotFound'



  # -------------------------------------------------- external: local auth ---

  /api/v1/auth/login:

    post:

      tags: [auth]

      operationId: login

      summary: Log in with a local username + password (op.console).

      description: >-

        Verifies a username+password against the users row and, on success, mints

        a host-only session cookie (spec §B). Mounted Public — there is no prior

        principal — but local auth must be enabled (local_auth_enabled), so a

        deployment fronted entirely by Zero Trust never accepts a local password.

        Every failure returns the same vague invalid_credentials after a uniform

        bcrypt compare, so usernames cannot be enumerated by response or timing.

      x-felis-face: [external]

      x-felis-tier: public

      security: []

      requestBody:

        required: true

        content:

          application/json:

            schema:

              type: object

              required: [username, password]

              properties:

                username: { type: string }

                password: { type: string, format: password }

      responses:

        '200':

          description: Session established; the cookie is set on the response.

          content:

            application/json:

              schema:

                type: object

                required: [user_id, role, must_change_password]

                properties:

                  user_id: { type: string }

                  role:

                    type: string

                    enum: [user, admin]

                  must_change_password:

                    type: boolean

                    description: >-

                      True when this account still owes its first-login password

                      change; the panel routes straight to the change-password card.

        '400':

          $ref: '#/components/responses/BadRequest'

        '401':

          description: Invalid username or password (vague by design).

          content:

            application/json:

              schema: { $ref: '#/components/schemas/Error' }

        '403':

          description: Local password login is disabled on this deployment.

          content:

            application/json:

              schema: { $ref: '#/components/schemas/Error' }



  /api/v1/auth/logout:

    post:

      tags: [auth]

      operationId: logout

      summary: Revoke the current local session and clear the cookie.

      description: >-

        Revokes the presented session and clears the cookie (spec §B). Mounted

        Public and idempotent: it reads the cookie directly, so it works even when

        the session has already expired and never errors on a missing one.

      x-felis-face: [external]

      x-felis-tier: public

      security: []

      responses:

        '200':

          description: Logged out (idempotent).

          content:

            application/json:

              schema:

                type: object

                required: [ok]

                properties:

                  ok: { type: boolean, const: true }



  /api/v1/auth/change-password:

    post:

      tags: [auth]

      operationId: changePassword

      summary: Change the caller's local password (forced first-login or rotation).

      description: >-

        Re-verifies the caller's current password, stores a new bcrypt hash, clears

        must_change_password, and revokes the account's OTHER sessions while keeping

        the current one (spec §B). Reachable while must_change_password is set, so a

        forced first-login change can complete — the rest of the API is fenced off

        until it does. The session authenticates the caller; re-asking the current

        password additionally blocks a hijacked session from silently rotating the

        credential.

      x-felis-face: [external]

      x-felis-tier: app

      security: [{ sessionCookie: [] }]

      requestBody:

        required: true

        content:

          application/json:

            schema:

              type: object

              required: [current_password, new_password]

              properties:

                current_password: { type: string, format: password }

                new_password:

                  type: string

                  format: password

                  minLength: 8

                  maxLength: 72

                  description: 8–72 bytes; 72 is bcrypt's hard input limit.

      responses:

        '200':

          description: Password changed; other sessions revoked.

          content:

            application/json:

              schema:

                type: object

                required: [ok]

                properties:

                  ok: { type: boolean, const: true }

        '400':

          description: Weak password, or the new password equals the current one.

          content:

            application/json:

              schema: { $ref: '#/components/schemas/Error' }

        '401':

          $ref: '#/components/responses/Unauthorized'

        '403':

          $ref: '#/components/responses/Forbidden'



  /api/v1/me:

    get:

      tags: [servers]
@@ -1088,7 +1230,7 @@ paths: 
            application/json:

              schema:

                type: object

                required: [user_id, email, role, is_admin]

                required: [user_id, email, role, is_admin, must_change_password]

                properties:

                  user_id: { type: string }

                  email: { type: string, format: email }
@@ -1101,6 +1243,15 @@ paths: 
                    description: >-

                      True only when role is admin AND the request arrived via the

                      admin Access path (Principal.IsAdmin()).

                  must_change_password:

                    type: boolean

                    description: >-

                      True when a local-password staff account still owes its

                      first-login password change. Meaningful only on the

                      local-password path (false on the JWT path). The panel routes

                      such an account straight to the change-password card. Reachable

                      while set, alongside change-password and logout, because the

                      rest of the API is fenced off until the change completes.

        '401':

          $ref: '#/components/responses/Unauthorized'

go.mod

+26 −4
Changes for go.mod: 26 added lines, 4 removed lines.
Original line number Diff line number Diff line
@@ -4,7 +4,12 @@ go 1.26 


require (

	github.com/BurntSushi/toml v1.4.0

	github.com/charmbracelet/bubbles v1.0.0

	github.com/charmbracelet/bubbletea v1.3.10

	github.com/charmbracelet/lipgloss v1.1.0

	github.com/golang-jwt/jwt/v5 v5.2.1

	github.com/jackc/pgx/v5 v5.7.1

	golang.org/x/crypto v0.27.0

	k8s.io/api v0.31.3

	k8s.io/apimachinery v0.31.3

	k8s.io/client-go v0.31.0
@@ -13,10 +18,20 @@ require ( 
)



require (

	github.com/atotto/clipboard v0.1.4 // indirect

	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect

	github.com/beorn7/perks v1.0.1 // indirect

	github.com/cespare/xxhash/v2 v2.3.0 // indirect

	github.com/charmbracelet/colorprofile v0.4.1 // indirect

	github.com/charmbracelet/x/ansi v0.11.6 // indirect

	github.com/charmbracelet/x/cellbuf v0.0.15 // indirect

	github.com/charmbracelet/x/term v0.2.2 // indirect

	github.com/clipperhouse/displaywidth v0.9.0 // indirect

	github.com/clipperhouse/stringish v0.1.1 // indirect

	github.com/clipperhouse/uax29/v2 v2.5.0 // indirect

	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect

	github.com/emicklei/go-restful/v3 v3.11.0 // indirect

	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect

	github.com/evanphx/json-patch/v5 v5.9.0 // indirect

	github.com/fxamacker/cbor/v2 v2.7.0 // indirect

	github.com/go-logr/logr v1.4.2 // indirect
@@ -24,7 +39,6 @@ require ( 
	github.com/go-openapi/jsonreference v0.20.2 // indirect

	github.com/go-openapi/swag v0.22.4 // indirect

	github.com/gogo/protobuf v1.3.2 // indirect

	github.com/golang-jwt/jwt/v5 v5.2.1 // indirect

	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect

	github.com/golang/protobuf v1.5.4 // indirect

	github.com/google/gnostic-models v0.6.8 // indirect
@@ -37,23 +51,31 @@ require ( 
	github.com/jackc/puddle/v2 v2.2.2 // indirect

	github.com/josharian/intern v1.0.0 // indirect

	github.com/json-iterator/go v1.1.12 // indirect

	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect

	github.com/mailru/easyjson v0.7.7 // indirect

	github.com/mattn/go-isatty v0.0.20 // indirect

	github.com/mattn/go-localereader v0.0.1 // indirect

	github.com/mattn/go-runewidth v0.0.19 // indirect

	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect

	github.com/modern-go/reflect2 v1.0.2 // indirect

	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect

	github.com/muesli/cancelreader v0.2.2 // indirect

	github.com/muesli/termenv v0.16.0 // indirect

	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect

	github.com/pkg/errors v0.9.1 // indirect

	github.com/prometheus/client_golang v1.19.1 // indirect

	github.com/prometheus/client_model v0.6.1 // indirect

	github.com/prometheus/common v0.55.0 // indirect

	github.com/prometheus/procfs v0.15.1 // indirect

	github.com/rivo/uniseg v0.4.7 // indirect

	github.com/spf13/pflag v1.0.5 // indirect

	github.com/x448/float16 v0.8.4 // indirect

	golang.org/x/crypto v0.27.0 // indirect

	golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc // indirect

	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect

	golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect

	golang.org/x/net v0.26.0 // indirect

	golang.org/x/oauth2 v0.21.0 // indirect

	golang.org/x/sync v0.8.0 // indirect

	golang.org/x/sys v0.25.0 // indirect

	golang.org/x/sys v0.38.0 // indirect

	golang.org/x/term v0.24.0 // indirect

	golang.org/x/text v0.18.0 // indirect

	golang.org/x/time v0.3.0 // indirect

go.sum

+50 −4
Changes for go.sum: 50 added lines, 4 removed lines.
Original line number Diff line number Diff line 
github.com/BurntSushi/toml v1.4.0 h1:kuoIxZQy2WRRk1pttg9asf+WVv6tWQuBNVmK8+nqPr0=

github.com/BurntSushi/toml v1.4.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=

github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=

github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=

github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=

github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=

github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=

github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=

github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=

github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=

github.com/charmbracelet/bubbles v1.0.0 h1:12J8/ak/uCZEMQ6KU7pcfwceyjLlWsDLAxB5fXonfvc=

github.com/charmbracelet/bubbles v1.0.0/go.mod h1:9d/Zd5GdnauMI5ivUIVisuEm3ave1XwXtD1ckyV6r3E=

github.com/charmbracelet/bubbletea v1.3.10 h1:otUDHWMMzQSB0Pkc87rm691KZ3SWa4KUlvF9nRvCICw=

github.com/charmbracelet/bubbletea v1.3.10/go.mod h1:ORQfo0fk8U+po9VaNvnV95UPWA1BitP1E0N6xJPlHr4=

github.com/charmbracelet/colorprofile v0.4.1 h1:a1lO03qTrSIRaK8c3JRxJDZOvhvIeSco3ej+ngLk1kk=

github.com/charmbracelet/colorprofile v0.4.1/go.mod h1:U1d9Dljmdf9DLegaJ0nGZNJvoXAhayhmidOdcBwAvKk=

github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=

github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=

github.com/charmbracelet/x/ansi v0.11.6 h1:GhV21SiDz/45W9AnV2R61xZMRri5NlLnl6CVF7ihZW8=

github.com/charmbracelet/x/ansi v0.11.6/go.mod h1:2JNYLgQUsyqaiLovhU2Rv/pb8r6ydXKS3NIttu3VGZQ=

github.com/charmbracelet/x/cellbuf v0.0.15 h1:ur3pZy0o6z/R7EylET877CBxaiE1Sp1GMxoFPAIztPI=

github.com/charmbracelet/x/cellbuf v0.0.15/go.mod h1:J1YVbR7MUuEGIFPCaaZ96KDl5NoS0DAWkskup+mOY+Q=

github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=

github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI=

github.com/clipperhouse/displaywidth v0.9.0 h1:Qb4KOhYwRiN3viMv1v/3cTBlz3AcAZX3+y9OLhMtAtA=

github.com/clipperhouse/displaywidth v0.9.0/go.mod h1:aCAAqTlh4GIVkhQnJpbL0T/WfcrJXHcj8C0yjYcjOZA=

github.com/clipperhouse/stringish v0.1.1 h1:+NSqMOr3GR6k1FdRhhnXrLfztGzuG+VuFDfatpWHKCs=

github.com/clipperhouse/stringish v0.1.1/go.mod h1:v/WhFtE1q0ovMta2+m+UbpZ+2/HEXNWYXQgCt4hdOzA=

github.com/clipperhouse/uax29/v2 v2.5.0 h1:x7T0T4eTHDONxFJsL94uKNKPHrclyFI0lm7+w94cO8U=

github.com/clipperhouse/uax29/v2 v2.5.0/go.mod h1:Wn1g7MK6OoeDT0vL+Q0SQLDz/KpfsVRgg6W7ihQeh4g=

github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=

github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -11,6 +35,8 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1 
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=

github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=

github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=

github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=

github.com/evanphx/json-patch v0.5.2 h1:xVCHIVMUu1wtM/VkR9jVZ45N3FhZfYMMYGorLCR8P3k=

github.com/evanphx/json-patch v0.5.2/go.mod h1:ZWS5hhDbVDyob71nXKNL0+PWn6ToqBHMikGIFbs31qQ=

github.com/evanphx/json-patch/v5 v5.9.0 h1:kcBlZQbplgElYIlo/n1hJbls2z/1awpXxpRi0/FOJfg=
@@ -73,13 +99,27 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= 
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=

github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=

github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=

github.com/lucasb-eyer/go-colorful v1.3.0 h1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag=

github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=

github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=

github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=

github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=

github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=

github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=

github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=

github.com/mattn/go-runewidth v0.0.19 h1:v++JhqYnZuu5jSKrk9RbgF5v4CGUjqRfBm05byFGLdw=

github.com/mattn/go-runewidth v0.0.19/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=

github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=

github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=

github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=

github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=

github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=

github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=

github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=

github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=

github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=

github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=

github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=

github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=

github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=

github.com/onsi/ginkgo/v2 v2.19.0 h1:9Cnnf7UHo57Hy3k6/m5k3dRfGTMXGvxhHFvkDTCTpvA=
@@ -99,6 +139,8 @@ github.com/prometheus/common v0.55.0 h1:KEi6DK7lXW/m7Ig5i47x0vRzuBsHuvJdi5ee6Y3G 
github.com/prometheus/common v0.55.0/go.mod h1:2SECS4xJG1kd8XF9IcM1gMX6510RAEL65zxzNImwdc8=

github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=

github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=

github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=

github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=

github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=

github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=

github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
@@ -115,6 +157,8 @@ github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsT 
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=

github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=

github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=

github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=

github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=

github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=

github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=

go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
@@ -128,8 +172,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U 
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=

golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=

golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=

golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc h1:mCRnTeVUjcrhlRmO0VK8a6k6Rrf6TF9htwo2pJVSjIU=

golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc/go.mod h1:V1LtkGg67GoY2N1AnLN78QLrzxkLyJw7RJb1gzOOz9w=

golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=

golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=

golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=

golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=

golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -148,8 +192,10 @@ golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= 
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=

golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=

golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=

golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34=

golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=

golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=

golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=

golang.org/x/term v0.24.0 h1:Mh5cbb+Zk2hqqXNO7S1iTjEphVL+jb8ZWaqh/g+JWkM=

golang.org/x/term v0.24.0/go.mod h1:lOBK/LVxemqiMij05LGJ0tzNr8xlmwBRJ81PX6wVLH8=

golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=

internal/api/api.go

+26 −1
Changes for internal/api/api.go: 26 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -126,6 +126,14 @@ type apiRoute struct { 
	// handler). Internal-face routes never set it.

	Admin bool



	// AllowDuringPasswordChange opts a route OUT of the must_change_password

	// lockdown (spec §B). The lockdown is default-deny: every authenticated route is

	// fenced off for a staff principal that still owes a first-login password change

	// EXCEPT the few that let it escape the state — change-password, logout, and the

	// self-identity read /me. A new authenticated route is locked down unless it

	// sets this, so forgetting the flag fails safe (closed), never open.

	AllowDuringPasswordChange bool



	h http.HandlerFunc

}
@@ -168,6 +176,15 @@ func (a *API) externalAPIRoutes() []apiRoute { 
	return []apiRoute{

		{Method: "GET", Pattern: "/healthz", Public: true, h: a.handleHealthz},



		// Local-password auth (spec §B), the op.console login surface. login/logout

		// are Public (pre-session: a caller has no principal yet, and logout reads the

		// cookie directly so it works even after expiry). change-password requires a

		// live session and stays reachable while must_change_password is set

		// (AllowDuringPasswordChange) so a forced first-login change can complete.

		{Method: "POST", Pattern: "/api/v1/auth/login", Public: true, h: a.handleLogin},

		{Method: "POST", Pattern: "/api/v1/auth/logout", Public: true, h: a.handleLogout},

		{Method: "POST", Pattern: "/api/v1/auth/change-password", AllowDuringPasswordChange: true, h: a.handleChangePassword},



		// App-auth tier: operations on your own servers (spec §14).

		{Method: "POST", Pattern: "/api/v1/servers/{name}/wake", h: a.handleWake},

		{Method: "POST", Pattern: "/api/v1/servers/{name}/stop", h: a.handleStop},
@@ -195,7 +212,9 @@ func (a *API) externalAPIRoutes() []apiRoute { 
		// every authenticated principal may read its OWN identity. is_admin is the

		// server-computed Principal.IsAdmin() (Role + admin Access path), so the client

		// never re-derives the graded-ZT rule; it remains UX truth, not enforcement.

		{Method: "GET", Pattern: "/api/v1/me", h: a.handleMe},

		// /me is exempt from the first-login lockdown so the panel can read its own

		// identity (including must_change_password) to render the change-password card.

		{Method: "GET", Pattern: "/api/v1/me", AllowDuringPasswordChange: true, h: a.handleMe},

		{Method: "GET", Pattern: "/api/v1/me/servers", h: a.handleMyServers},

		// World backups (spec §7, §466). Both are app-tier: GET /backups is scoped

		// inside the handler (admin sees all; a user sees only worlds they formerly
@@ -279,6 +298,12 @@ func (a *API) buildFace(routes []apiRoute, guard func(http.Handler) http.Handler 
		if rt.Admin {

			h = a.adminOnly(rt.h)

		}

		// Default-deny first-login lockdown (spec §B): wrap every authenticated route

		// unless it explicitly opts out. The wrapper is nil-principal safe, so it is

		// inert on the internal face (service-token callers carry no Principal).

		if !rt.AllowDuringPasswordChange {

			h = a.lockdownDuringPasswordChange(h)

		}

		auth.HandleFunc(pattern, h)

	}

	mux.Handle("/api/v1/", guard(auth))