Unverified Commit c20b12c6 authored by Minseong Choi's avatar Minseong Choi 💬
Browse files

refactor(api): drop dead password-era ResetMailer, reconcile passkey-unbind docs 

The passwordless migration left ResetMailer (SendPasswordReset) and its API field with zero callers and no wiring; the web console authenticates via email-OTP and passkey only. Remove both, plus the now-orphaned context import that the interface was the last user of in handlers_users.go.

Reconcile the DeleteAllPasskeyCredentialsForUser docs in repo.go and pgrepo.go: they claimed there was no production caller, but 2f22027 wired the owner-tier DELETE /users/{id}/passkeys. Both now note that a complete authenticator remediation pairs the unbind with a session revoke (unbinding alone leaves the live hijacked session; revoking alone leaves a re-enrollable credential), and the OpenAPI operation carries the same guidance in a new description. Reword the stale local-password test-fake header, since the passwordless fakes carry no must_change_password field.

No behavior change. gofmt, build, and the full test tree are green; OpenAPI parity and passkey-unbind tests pass; a grep confirms ResetMailer/SendPasswordReset are gone from the Go tree.
parent 4f59d512

docs/openapi.yaml

+8 −0
Changes for docs/openapi.yaml: 8 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -2720,6 +2720,14 @@ paths: 
      tags: [users]

      operationId: unbindUserPasskeys

      summary: Unbind every passkey of a user (owner only) — authenticator remediation.

      description: >-

        Severs a compromised or planted authenticator that would otherwise outlive a

        session revoke. A complete remediation pairs this with revoking the user's

        sessions (DELETE /users/{id}/sessions/{hash}): unbinding the credential alone

        leaves the live hijacked session, and revoking sessions alone leaves a

        re-enrollable credential. It is not a lockout — the account re-enters via the

        email-OTP door or op-login and re-enrolls. Removing zero passkeys is a 200

        no-op, not a 404.

      x-felis-face: [external]

      x-felis-tier: owner

      security: [{ accessJWT: [] }]

internal/api/api.go

+0 −5
Changes for internal/api/api.go: 0 added lines, 5 removed lines.
Original line number Diff line number Diff line
@@ -73,11 +73,6 @@ type API struct { 
	// sender. The code is never returned to the client on either path.

	Mailer OTPMailer



	// ResetMailer delivers admin-generated password-reset passwords to the user's

	// verified email address. Same nil→server-side-log pattern as Mailer; the

	// password is never returned to the admin caller. Production wires a real sender.

	ResetMailer ResetMailer



	// Passkey verifies WebAuthn credential-creation ceremonies (spec §14 / Phase 6

	// passkey bind). It is optional: when nil the passkey register routes report 503

	// rather than panic, so the authenticated enrollment boundary is exercised before

internal/api/api_test.go

+2 −2
Changes for internal/api/api_test.go: 2 added lines, 2 removed lines.
Original line number Diff line number Diff line
@@ -605,10 +605,10 @@ func (f *fakeRepo) BackupByID(_ context.Context, id string) (*BackupRecord, erro 
	return nil, ErrNotFound

}



// ---- local-password auth fakes (spec §B) ----

// ---- staff / session auth fakes (spec §B, passwordless) ----

// Each method mirrors the PGRepo contract: a returned StaffUser is copied so a

// test cannot mutate the stored row by reference, SessionUser re-reads the

// CURRENT staff flags (so a password change clears must_change_password for live

// CURRENT staff row (so a role change or a deleted account takes effect on live

// sessions just as the PG JOIN does), and the settings/sessions semantics match.



func (f *fakeRepo) UserByUsername(_ context.Context, username string) (*StaffUser, error) {

internal/api/handlers_users.go

+0 −9
Changes for internal/api/handlers_users.go: 0 added lines, 9 removed lines.
Original line number Diff line number Diff line 
package api



import (

	"context"

	"errors"

	"net/http"

	"strconv"

	"strings"

)



// ResetMailer delivers a freshly-generated admin-reset password to the user's

// verified email address. nil means the password is logged server-side (the

// KNOWN-LIMITATION pattern from OTPMailer — production wires a real sender).

// The password is never returned to the admin caller.

type ResetMailer interface {

	SendPasswordReset(ctx context.Context, email, password string) error

}



// ---- user CRUD ----



// handleListUsers is the admin-tier user list (GET /users). It gates on

internal/api/pgrepo.go

+3 −3
Changes for internal/api/pgrepo.go: 3 added lines, 3 removed lines.
Original line number Diff line number Diff line
@@ -1020,9 +1020,9 @@ func (p *PGRepo) DeletePasskeyCredential(ctx context.Context, userID, id string) 
// single-credential delete this does NOT report ErrNotFound on zero rows: removing all of

// a user's passkeys when they have none is a successful no-op, since "the user holds no

// passkeys" is exactly the intended post-condition. It is the remediation that stops a

// passkey planted through a transiently-hijacked session from surviving; its original

// caller (the change-password flow) was removed in the passwordless migration, so it is

// currently uncalled, retained for the account-remediation/reset path (P5, #78).

// passkey planted through a transiently-hijacked session from surviving; its production

// caller is the owner-tier DELETE /users/{id}/passkeys, which a complete remediation

// pairs with a session revoke (unbinding alone leaves the live hijacked session).

func (p *PGRepo) DeleteAllPasskeyCredentialsForUser(ctx context.Context, userID string) error {

	_, err := p.db.ExecContext(ctx,

		`DELETE FROM webauthn_credentials WHERE user_id = $1`, userID)