v0.280.0: the setup gate (decision 46); R-710 'I changed it' + absent-record window; R-709 password fields off the page; password:N:special generator

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-09-29 08:51:46 +02:00
parent 2548b4c924
commit 7fa8768cfd
37 changed files with 4015 additions and 107 deletions
@@ -0,0 +1,328 @@
+package web
+
+import (
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/stacks"
+)
+
+// ── The setup gate's answerer (v0.280.0, `09` §3 decision 46) ─────────────────────────────────────────
+//
+// traefik asks GET /__felhom_gate/auth (forwardAuth) for every request to an app whose gate is closed
+// (internal/stacks/setup_gate.go writes that route). The answer:
+//
+//   - a valid GATE COOKIE for that app host → 200, the request goes to the app;
+//   - /__felhom_gate/cb?t=<token> → the token (minted below, 60 s, one use, bound to the host) is swapped for a
+//     host-only gate cookie, and the browser goes back where it was going;
+//   - a browser GET without one → 302 to https://felhom.<domain>/__gate/start?rd=<where it was going>;
+//   - anything else → 401 {"error": …}: a script or a phone app gets a plain refusal.
+//
+// GET /__gate/start is on the DASHBOARD host, where the household's own session cookie already is. With a
+// valid session: a token and a 302 to the app's callback. Without: a page that says the app is waiting for its
+// first setup, with a sign-in link that comes straight back here after the sign-in.
+//
+// The dashboard cookie is NEVER widened to the app hosts (it is host-only, auth.go) — the spike measured that
+// widening it would send the household's session to every app's backend. The gate cookie reaches only its
+// own app host and opens only that app's gate (HMAC over the host). The key is persisted, so a controller
+// restart does not re-gate a browser that already passed.
+// Pinned by internal/web/setup_gate_test.go.
+
+const (
+	gateCookieName  = "felhom_gate"
+	gateCookieLife  = 7 * 24 * time.Hour
+	gateTokenLife   = 60 * time.Second
+	gateAuthPath    = "/__felhom_gate/auth"
+	gateCallbackURI = "/__felhom_gate/cb"
+	gateStartPath   = "/__gate/start"
+)
+
+type gateState struct {
+	once sync.Once
+	key  []byte
+	mu   sync.Mutex
+	used map[string]time.Time // token nonces already swapped, until they expire
+}
+
+// gateKey loads the gate's HMAC key from the data dir, or makes one. No data dir → a key for this run only.
+func (s *Server) gateKey() []byte {
+	s.gate.once.Do(func() {
+		s.gate.used = map[string]time.Time{}
+		p := ""
+		if s.cfg != nil && s.cfg.Paths.DataDir != "" {
+			p = filepath.Join(s.cfg.Paths.DataDir, "setup-gate.key")
+			if b, err := os.ReadFile(p); err == nil {
+				if k, err := hex.DecodeString(strings.TrimSpace(string(b))); err == nil && len(k) == 32 {
+					s.gate.key = k
+					return
+				}
+			}
+		}
+		k := make([]byte, 32)
+		_, _ = rand.Read(k)
+		s.gate.key = k
+		if p != "" {
+			if err := os.WriteFile(p, []byte(hex.EncodeToString(k)), 0o600); err != nil {
+				s.logger.Printf("[WARN] [web] setup gate: the key could not be saved (%v) — a restart will ask browsers to sign in again", err)
+			}
+		}
+	})
+	return s.gate.key
+}
+
+func (s *Server) gateMAC(parts ...string) string {
+	m := hmac.New(sha256.New, s.gateKey())
+	m.Write([]byte(strings.Join(parts, "\x00")))
+	return hex.EncodeToString(m.Sum(nil))
+}
+
+func (s *Server) gateNow() time.Time {
+	if s.gateClock != nil {
+		return s.gateClock()
+	}
+	return time.Now()
+}
+
+// gateCookieValid: "<unix expiry>.<mac over host+expiry>".
+func (s *Server) gateCookieValid(r *http.Request, host string) bool {
+	c, err := r.Cookie(gateCookieName)
+	if err != nil {
+		return false
+	}
+	exp, mac, ok := strings.Cut(c.Value, ".")
+	n, err := strconv.ParseInt(exp, 10, 64)
+	if !ok || err != nil || s.gateNow().Unix() > n {
+		return false
+	}
+	return hmac.Equal([]byte(mac), []byte(s.gateMAC("cookie", host, exp)))
+}
+
+type gateToken struct {
+	Host  string `json:"h"`
+	Exp   int64  `json:"e"`
+	Nonce string `json:"n"`
+	RD    string `json:"r"`
+	MAC   string `json:"m"`
+}
+
+func (s *Server) mintGateToken(host, rd string) string {
+	nb := make([]byte, 12)
+	_, _ = rand.Read(nb)
+	t := gateToken{Host: host, Exp: s.gateNow().Add(gateTokenLife).Unix(), Nonce: hex.EncodeToString(nb), RD: rd}
+	t.MAC = s.gateMAC("token", t.Host, strconv.FormatInt(t.Exp, 10), t.Nonce, t.RD)
+	b, _ := json.Marshal(t)
+	return base64.RawURLEncoding.EncodeToString(b)
+}
+
+// takeGateToken checks a token for host and uses it up. Returns where the browser was going.
+func (s *Server) takeGateToken(raw, host string) (string, error) {
+	b, err := base64.RawURLEncoding.DecodeString(raw)
+	if err != nil {
+		return "", errors.New("malformed")
+	}
+	var t gateToken
+	if json.Unmarshal(b, &t) != nil {
+		return "", errors.New("malformed")
+	}
+	if !hmac.Equal([]byte(t.MAC), []byte(s.gateMAC("token", t.Host, strconv.FormatInt(t.Exp, 10), t.Nonce, t.RD))) {
+		return "", errors.New("bad signature")
+	}
+	if t.Host != host {
+		return "", errors.New("for another app")
+	}
+	now := s.gateNow()
+	if now.Unix() > t.Exp {
+		return "", errors.New("expired")
+	}
+	s.gateKey()
+	s.gate.mu.Lock()
+	defer s.gate.mu.Unlock()
+	for n, until := range s.gate.used {
+		if now.After(until) {
+			delete(s.gate.used, n)
+		}
+	}
+	if _, seen := s.gate.used[t.Nonce]; seen {
+		return "", errors.New("already used")
+	}
+	s.gate.used[t.Nonce] = time.Unix(t.Exp, 0).Add(time.Second)
+	return t.RD, nil
+}
+
+// gateRDHost: the host of a return address that may be used — https, on this household's domain, and an
+// app whose gate is closed. Anything else is refused (no open redirect through the dashboard).
+func (s *Server) gateRDHost(rd string) (string, bool) {
+	u, err := url.Parse(rd)
+	if err != nil || u.Scheme != "https" || u.User != nil || u.Host == "" || s.stackMgr == nil {
+		return "", false
+	}
+	host := strings.ToLower(u.Hostname())
+	if u.Port() != "" || !strings.HasSuffix(host, "."+strings.ToLower(s.cfg.Customer.Domain)) {
+		return "", false
+	}
+	if _, closed, found := s.stackMgr.SetupGateHost(host); !found || !closed {
+		return "", false
+	}
+	return host, true
+}
+
+func gateRefuse(w http.ResponseWriter, code int) {
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Cache-Control", "no-store")
+	w.WriteHeader(code)
+	_, _ = w.Write([]byte(`{"error":"this app is waiting for its first setup"}`))
+}
+
+// ServeGateAuth is traefik's forwardAuth answer. It trusts X-Forwarded-Host/-Uri/-Method, which traefik sets
+// from the request it is forwarding (the entrypoints trust no client's own X-Forwarded-* headers). Anyone who
+// calls it directly on the docker network learns only yes or no about a cookie they already hold.
+func (s *Server) ServeGateAuth(w http.ResponseWriter, r *http.Request) {
+	host := strings.ToLower(r.Header.Get("X-Forwarded-Host"))
+	if i := strings.LastIndex(host, ":"); i != -1 {
+		host = host[:i]
+	}
+	uri := r.Header.Get("X-Forwarded-Uri")
+	if uri == "" {
+		uri = "/"
+	}
+	method := r.Header.Get("X-Forwarded-Method")
+	if s.stackMgr == nil {
+		gateRefuse(w, http.StatusForbidden)
+		return
+	}
+	app, closed, found := s.stackMgr.SetupGateHost(host)
+	if !found {
+		// A host no app claims: fail closed. traefik only asks for hosts a gate file names.
+		s.logger.Printf("[WARN] [web] setup gate: asked about %q, which no gated app owns — refused", host)
+		gateRefuse(w, http.StatusForbidden)
+		return
+	}
+	if !closed {
+		// Opened; traefik has not dropped the file yet (it is removed right after the record is written).
+		w.WriteHeader(http.StatusOK)
+		return
+	}
+	if u, err := url.Parse(uri); err == nil && u.Path == gateCallbackURI {
+		rd, err := s.takeGateToken(u.Query().Get("t"), host)
+		if err != nil {
+			s.logger.Printf("[WARN] [web] setup gate %s: a sign-in token was refused (%v)", app, err)
+			gateRefuse(w, http.StatusForbidden)
+			return
+		}
+		exp := strconv.FormatInt(s.gateNow().Add(gateCookieLife).Unix(), 10)
+		http.SetCookie(w, &http.Cookie{
+			Name: gateCookieName, Value: exp + "." + s.gateMAC("cookie", host, exp), Path: "/",
+			MaxAge: int(gateCookieLife.Seconds()), HttpOnly: true, Secure: true, SameSite: http.SameSiteLaxMode,
+		})
+		s.logger.Printf("[INFO] [web] setup gate %s: the household passed (a dashboard session vouched for this browser)", app)
+		w.Header().Set("Cache-Control", "no-store")
+		http.Redirect(w, r, rd, http.StatusFound)
+		return
+	}
+	if s.gateCookieValid(r, host) {
+		w.WriteHeader(http.StatusOK)
+		return
+	}
+	if (method == "" || method == http.MethodGet) && strings.Contains(r.Header.Get("Accept"), "text/html") {
+		rd := "https://" + host + uri
+		w.Header().Set("Cache-Control", "no-store")
+		http.Redirect(w, r, "https://felhom."+s.cfg.Customer.Domain+gateStartPath+"?"+url.Values{"rd": {rd}}.Encode(), http.StatusFound)
+		return
+	}
+	if s.isDebug() {
+		s.logger.Printf("[DEBUG] [web] setup gate %s: %s %s without a pass — 401", app, method, uri)
+	}
+	gateRefuse(w, http.StatusUnauthorized)
+}
+
+// ServeGateStart is /__gate/start on the dashboard host.
+func (s *Server) ServeGateStart(w http.ResponseWriter, r *http.Request) {
+	rd := r.URL.Query().Get("rd")
+	host, ok := s.gateRDHost(rd)
+	if !ok {
+		http.Redirect(w, r, "/", http.StatusFound)
+		return
+	}
+	w.Header().Set("Cache-Control", "no-store")
+	if s.hasSession(r) {
+		http.Redirect(w, r, "https://"+host+gateCallbackURI+"?"+url.Values{"t": {s.mintGateToken(host, rd)}}.Encode(), http.StatusFound)
+		return
+	}
+	next := gateStartPath + "?" + url.Values{"rd": {rd}}.Encode()
+	data := map[string]interface{}{
+		"LoginURL": "/login?" + url.Values{"next": {next}}.Encode(),
+		"Host":     host,
+	}
+	if app, _, found := s.stackMgr.SetupGateHost(host); found {
+		if st, ok := s.stackMgr.GetStack(app); ok {
+			data["AppName"] = st.Meta.DisplayName
+		}
+	}
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	if err := s.executeTemplateLang(w, r, "setupgate", data); err != nil {
+		s.logger.Printf("[ERROR] [web] setup gate page: %v", err)
+		http.Error(w, "Internal error", http.StatusInternalServerError)
+	}
+}
+
+// appSetupGateOpenHandler is the household's "Done, I set it up" (POST /apps/<slug>/setup-gate/open).
+func (s *Server) appSetupGateOpenHandler(w http.ResponseWriter, r *http.Request, slug string) {
+	found := s.stackBySlug(slug)
+	if found == nil {
+		escrowJSON(w, http.StatusNotFound, nil, s.msg(r, "escrow.unknown_app"))
+		return
+	}
+	if err := s.stackMgr.OpenSetupGate(found.Name, stacks.SetupGateByHousehold); err != nil {
+		if errors.Is(err, stacks.ErrSetupGateNotClosed) {
+			escrowJSON(w, http.StatusConflict, nil, s.msg(r, "err.setup_gate.not_closed"))
+			return
+		}
+		s.logger.Printf("[ERROR] [web] setup gate %s: the household's open failed: %v", found.Name, err)
+		escrowJSON(w, http.StatusInternalServerError, nil, s.msg(r, "err.setup_gate.open_failed"))
+		return
+	}
+	escrowJSON(w, http.StatusOK, map[string]any{"opened": true}, "")
+}
+
+// appDefaultLoginChangedHandler is the household's "I changed it" under a known default login
+// (POST /apps/<slug>/default-login/changed, R-710).
+func (s *Server) appDefaultLoginChangedHandler(w http.ResponseWriter, r *http.Request, slug string) {
+	found := s.stackBySlug(slug)
+	if found == nil || !found.Deployed {
+		escrowJSON(w, http.StatusNotFound, nil, s.msg(r, "escrow.unknown_app"))
+		return
+	}
+	if err := s.stackMgr.MarkDefaultLoginChanged(found.Name, "household"); err != nil {
+		s.logger.Printf("[ERROR] [web] default login %s: %v", found.Name, err)
+		escrowJSON(w, http.StatusInternalServerError, nil, s.msg(r, "err.setup_gate.open_failed"))
+		return
+	}
+	escrowJSON(w, http.StatusOK, map[string]any{"recorded": true}, "")
+}
+
+// stackBySlug resolves a page slug exactly as appDetailHandler does.
+func (s *Server) stackBySlug(slug string) *stacks.Stack {
+	if s.stackMgr == nil {
+		return nil
+	}
+	for _, st := range s.stackMgr.GetStacks() {
+		if st.Meta.Slug == slug {
+			st := st
+			return &st
+		}
+	}
+	return nil
+}