flyemoji
af14f02f38
Add username+password login for Owner/Operator staff accounts on op.console, the primary web login when Zero Trust is not in front of the API. Three handlers form the whole surface: login mints a server-side session cookie, logout revokes it idempotently, and change-password re-verifies the current password before rotating the hash and clearing must_change_password. - Session cookies are HttpOnly+Secure+SameSite=Lax, host-only, stored server-side as a SHA-256 hash with a 12h TTL. - Login is anti-enumeration: every failure runs a uniform bcrypt compare against a dummy hash and returns the same vague error. - Credential-bearing writes require Content-Type: application/json, returning 415 otherwise, to close the cross-site form-POST forgery vector as a belt to the SameSite cookie. - Local auth fails closed: login is rejected unless local_auth_enabled is set, so a Zero-Trust-only deployment never accepts a local password. - Extend the users table with a nullable password_hash and must_change_password; staff are role=admin rows with a hash, players are role=user rows with hash NULL. - /me now reports must_change_password so the panel can force a first-login change. Covered by Go unit tests (handlers, content-type guard, anti-enumeration, forced-change lockdown) and the OpenAPI route-parity gate.
45 lines
1.9 KiB
Go
45 lines
1.9 KiB
Go
package api
|
|
|
|
import (
|
|
"encoding/json"
|
|
"mime"
|
|
"net/http"
|
|
"strings"
|
|
)
|
|
|
|
// maxBodyBytes caps request bodies; the API only accepts small JSON documents.
|
|
const maxBodyBytes = 1 << 20 // 1 MiB
|
|
|
|
// requireJSONContentType rejects a request whose body is not declared
|
|
// application/json, returning 415 before any decode. It guards the credential-bearing
|
|
// auth writes (login, change-password) against a cross-site forgery: an HTML form can
|
|
// only POST as application/x-www-form-urlencoded, multipart/form-data, or text/plain
|
|
// — never JSON — and a cross-site fetch that forces application/json triggers a CORS
|
|
// preflight this API never answers, so neither form can be forged off-origin. The
|
|
// session cookie's SameSite=Lax already blocks the bearing of credentials cross-site;
|
|
// this is the belt to that suspenders, and it costs a legitimate same-origin caller
|
|
// nothing (the panel always sends application/json on a bodied request). Media-type
|
|
// parameters (e.g. "; charset=utf-8") are ignored — only the type/subtype must match.
|
|
func requireJSONContentType(r *http.Request) error {
|
|
mt, _, err := mime.ParseMediaType(r.Header.Get("Content-Type"))
|
|
if err != nil || !strings.EqualFold(mt, "application/json") {
|
|
return newError(http.StatusUnsupportedMediaType, "unsupported_media_type",
|
|
"Content-Type must be application/json")
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// decodeJSON strictly decodes a small request body into v, rejecting unknown
|
|
// fields and trailing data so malformed callers fail fast with 400.
|
|
func decodeJSON(w http.ResponseWriter, r *http.Request, v any) error {
|
|
dec := json.NewDecoder(http.MaxBytesReader(w, r.Body, maxBodyBytes))
|
|
dec.DisallowUnknownFields()
|
|
if err := dec.Decode(v); err != nil {
|
|
return newError(http.StatusBadRequest, "bad_request", "invalid request body: %v", err)
|
|
}
|
|
if dec.More() {
|
|
return newError(http.StatusBadRequest, "bad_request", "unexpected trailing data in body")
|
|
}
|
|
return nil
|
|
}
|