diff --git a/.air.toml b/.air.toml new file mode 100644 index 0000000..a7ef3a2 --- /dev/null +++ b/.air.toml @@ -0,0 +1,32 @@ +# Air watches this tree and rebuilds into ./dist on every change. +# Used by `make compose-dev-up` (docker-compose.dev.yaml + Dockerfile.dev). +# Docs: https://github.com/air-verse/air/blob/master/air_example.toml + +root = "/src" +tmp_dir = "/tmp/air" +log_file = "/tmp/air/build-errors.log" +delay = 300 +stop_on_error = true +stop_on_root_dir = true +send_interrupt = true +kill_delay = "2s" +log_level = "info" + +[build] + # Output lands in ./dist on the host through the bind mount. + bin = "dist/go-loose" + cmd = "go build -trimpath -o ./dist/go-loose ./cmd/go-loose" + args_bin = [] + # web/ is embedded with go:embed, so asset edits need a rebuild too. + include_ext = ["go", "html", "js", "css", "sql", "json", "yaml", "yml", "toml"] + include_dir = ["cmd", "internal", "client", "web"] + # data/db is the PostgreSQL volume and would otherwise trigger rebuilds. + exclude_dir = [".git", "dist", "data", "docs", "node_modules", "tmp"] + exclude_regex = ["_test\\.go$"] + exclude_unchanged = true + follow_symlink = true + +# Bind mounts do not deliver inotify events on Docker Desktop, so poll there. +[misc] + poll = false + poll_interval = 300 diff --git a/.dockerignore b/.dockerignore index cc30164..a453382 100644 --- a/.dockerignore +++ b/.dockerignore @@ -4,4 +4,6 @@ bin coverage.out google_secrets.json data - +_data-old-bind-mount +dist +tmp diff --git a/.gitignore b/.gitignore index afa1b75..5a960dc 100644 --- a/.gitignore +++ b/.gitignore @@ -5,4 +5,6 @@ bin/ coverage.out google_secrets.json -data/ \ No newline at end of file +data/ +_data-old-bind-mount/ +dist/ diff --git a/Dockerfile.dev b/Dockerfile.dev new file mode 100644 index 0000000..169b9b5 --- /dev/null +++ b/Dockerfile.dev @@ -0,0 +1,21 @@ +ARG GO_VERSION=1.27.1 +ARG AIR_VERSION=v1.67.4 + +FROM golang:${GO_VERSION}-alpine + +ARG AIR_VERSION + +RUN apk add --no-cache ca-certificates git \ + && go install github.com/air-verse/air@${AIR_VERSION} + +ENV AIR_VERSION=${AIR_VERSION} +ENV CGO_ENABLED=0 +ENV GOCACHE=/tmp/go-build +ENV GOMODCACHE=/go/pkg/mod +ENV GOFLAGS=-buildvcs=false + +WORKDIR /src + +EXPOSE 8080 + +CMD ["air", "-c", ".air.toml"] diff --git a/Makefile b/Makefile index 7b36763..1abb030 100644 --- a/Makefile +++ b/Makefile @@ -10,10 +10,11 @@ GO_LOOSE_DEV_USER ?= admin@local.test GO_LOOSE_BOOTSTRAP_TENANT ?= nmbs GO_LOOSE_BOOTSTRAP_APP ?= guess GO_LOOSE_ALLOW_PRIVATE_CONTRACT_URLS ?= true +GO_LOOSE_DEV_PORT ?= 8080 export -.PHONY: build test integration-test run compose-up compose-down fmt vet +.PHONY: build test integration-db integration-test run compose-up compose-down compose-dev-up compose-dev-down compose-dev-logs fmt vet build: go build ./... @@ -21,11 +22,25 @@ build: test: go test -race ./... -# Integration tests truncate every table in the target database, so point them at -# a scratch database rather than one holding real data. +# Integration tests drop every table they touch, so they only run against scratch +# databases. Both test helpers refuse any database whose name lacks "test", and +# `make integration-db` creates the two they expect. Override the check with +# GO_LOOSE_TEST_DATABASE_DESTRUCTIVE=1 only when you mean it. +# +# The store-backed tests in internal/server need a database of their own: Go runs +# package tests in parallel and both packages drop every table, so sharing one +# database makes them fight over the schema. +GO_LOOSE_TEST_DATABASE_URL ?= postgres://goloose:goloose@localhost:5433/goloose_test?sslmode=disable +GO_LOOSE_TEST_SERVER_DATABASE_URL ?= postgres://goloose:goloose@localhost:5433/goloose_server_test?sslmode=disable + +# createdb is not idempotent, so ignore a database that is already there. +integration-db: + -docker compose exec -T postgres createdb -U goloose goloose_test + -docker compose exec -T postgres createdb -U goloose goloose_server_test + integration-test: @test -n "$(GO_LOOSE_TEST_DATABASE_URL)" || { echo "set GO_LOOSE_TEST_DATABASE_URL to a scratch database"; exit 1; } - go test -race ./internal/store/ -count=1 + go test -race ./internal/store/ ./internal/server/ -count=1 run: go run ./cmd/go-loose @@ -40,8 +55,25 @@ compose-up: compose-down: docker compose down +# Air rebuilds into ./dist on every change. +compose-dev-up: + mkdir -p dist + docker compose -f docker-compose.dev.yaml up --build + +compose-dev-down: + docker compose -f docker-compose.dev.yaml down --remove-orphans + # Air writes dist/go-loose as root inside the container, so the host user + # cannot delete it directly. Empty the directory through a container instead. + -docker run --rm -v "$(CURDIR)/dist:/dist" alpine sh -c 'rm -rf /dist/*' 2>/dev/null || true + +compose-dev-logs: + docker compose -f docker-compose.dev.yaml logs -f go-loose + fmt: - gofmt -w $$(find . -name '*.go' -not -path './vendor/*') + # Prune directories that are not source and may be unreadable: vendored + # code, build output, the PostgreSQL volume, and anything hidden or + # underscore prefixed, which is how Go itself skips package trees. + gofmt -w $$(find . -mindepth 1 -type d \( -name vendor -o -name dist -o -name '.*' -o -name '_*' \) -prune -o -name '*.go' -print) vet: go vet ./... diff --git a/README.md b/README.md index c38b365..cfe85ad 100644 --- a/README.md +++ b/README.md @@ -83,5 +83,28 @@ Development requires Go 1.27.1 or newer. Migrations run transactionally at startup and are tracked in `schema_migrations`. See the operations guide before creating one. -`make integration-test` runs the store integration tests against `GO_LOOSE_TEST_DATABASE_URL`. Those tests drop every table in the target database, so point them at a scratch database. +`make integration-db` creates the two scratch databases the database-backed tests use, and `make integration-test` runs them. Those tests drop every table they touch, so they refuse to run against a database whose name does not contain `test`. That guard exists because pointing them at a development database destroys it. + +### Hot reload + +`make compose-dev-up` starts a development stack that runs Go Loose under [Air](https://air-verse.github.io/). Air watches `cmd`, `internal`, `client`, and `web`, rebuilds on every change, and writes the binary to `./dist`. Changes to `web/` are embedded at build time, so editing a template, stylesheet, or script triggers a rebuild too. The server restarts in place and `/healthz` confirms it came back. + +```bash +make compose-dev-up # build the image, start postgres and Air +make compose-dev-logs # follow the rebuild and request logs +make compose-dev-down # stop and remove the stack +``` + +| Variable | Default | Purpose | +| --- | --- | --- | +| `GO_LOOSE_DEV_PORT` | `8080` | Host port for the dev server | +| `GO_LOOSE_POSTGRES_PORT` | `5433` | Host port for PostgreSQL | + +The dev stack binds mounts the source tree, so Air writes `dist/go-loose` as `root` inside the container. On Linux, delete it with `sudo rm dist/go-loose` if the file ownership gets in the way. + +`docker-compose.yaml` remains the stack that matches production: a distroless image, no dev login, and the `local-dev-edge` network. `docker-compose.dev.yaml` and `Dockerfile.dev` are development-only. + +The database is not bind mounted into the source tree: PostgreSQL stores its files as `0700` owned by its own user, which would make `go build ./...` fail to walk the directory. `docker-compose.yaml` uses the `db-data` volume and `docker-compose.dev.yaml` uses a separate `db-data-dev`, so `docker compose -f docker-compose.dev.yaml down -v` cannot reach the real database. Reach a database through the published `5433` port or `docker compose exec postgres psql -U goloose -d goloose`. + +The dev database starts empty and migrations rebuild it on boot. `make compose-dev-down` also empties `./dist`, because Air writes that binary as `root` inside the container. diff --git a/docker-compose.dev.yaml b/docker-compose.dev.yaml new file mode 100644 index 0000000..3d6f157 --- /dev/null +++ b/docker-compose.dev.yaml @@ -0,0 +1,87 @@ +# Developer stack: docker compose -f docker-compose.dev.yaml up --build +# +# Runs Go Loose with Air for hot reload. Air rebuilds on every source change and +# writes the binary to ./dist, which is bind mounted so you can inspect or run it +# from the host. Only postgres is published; Go Loose is reached through the +# proxy or with `docker compose ... exec`. +# +# The production-shaped compose file stays at docker-compose.yaml. +services: + postgres: + image: postgres:17-alpine + ports: + - "${GO_LOOSE_POSTGRES_PORT:-5433}:5432" + environment: + POSTGRES_DB: goloose + POSTGRES_USER: goloose + POSTGRES_PASSWORD: goloose + volumes: + # Deliberately not the volume docker-compose.yaml uses: `down -v` on this + # file would otherwise delete the real database. The dev database is + # expendable and starts empty. + - db-data-dev:/var/lib/postgresql/data + healthcheck: + test: ["CMD-SHELL", "pg_isready -U goloose -d goloose"] + interval: 5s + timeout: 3s + retries: 10 + networks: + - go_loose_dev_network + + go-loose: + build: + context: . + dockerfile: Dockerfile.dev + depends_on: + postgres: + condition: service_healthy + environment: + GO_LOOSE_ADDR: ":8080" + GO_LOOSE_BASE_URL: "${GO_LOOSE_BASE_URL:-http://localhost:8080}" + GO_LOOSE_AUTH_DOMAIN: "${GO_LOOSE_AUTH_DOMAIN:-localhost}" + GO_LOOSE_DATABASE_URL: "postgres://goloose:goloose@postgres:5432/goloose?sslmode=disable" + GO_LOOSE_SESSION_SECRET: "${GO_LOOSE_SESSION_SECRET:-local-development-secret-change-me-now}" + # Dev login skips OIDC so you can work without Google credentials. + GO_LOOSE_DEV_LOGIN: "${GO_LOOSE_DEV_LOGIN:-true}" + GO_LOOSE_DEV_USER: "${GO_LOOSE_DEV_USER:-admin@local.test}" + GO_LOOSE_LOCAL_LOGIN: "${GO_LOOSE_LOCAL_LOGIN:-true}" + GO_LOOSE_LOCAL_ADMIN_EMAIL: "${GO_LOOSE_LOCAL_ADMIN_EMAIL:-admin@goloose.local}" + GO_LOOSE_LOCAL_ADMIN_PASSWORD: "${GO_LOOSE_LOCAL_ADMIN_PASSWORD:-}" + GO_LOOSE_ALLOWED_EMAIL_DOMAINS: "${GO_LOOSE_ALLOWED_EMAIL_DOMAINS:-}" + GO_LOOSE_ALLOW_PRIVATE_CONTRACT_URLS: "${GO_LOOSE_ALLOW_PRIVATE_CONTRACT_URLS:-true}" + GO_LOOSE_BOOTSTRAP_TENANT: "${GO_LOOSE_BOOTSTRAP_TENANT:-nmbs}" + GO_LOOSE_BOOTSTRAP_APP: "${GO_LOOSE_BOOTSTRAP_APP:-guess}" + GO_LOOSE_OIDC_ISSUER: "${GO_LOOSE_OIDC_ISSUER:-}" + GO_LOOSE_OIDC_CLIENT_ID: "${GO_LOOSE_OIDC_CLIENT_ID:-}" + GO_LOOSE_OIDC_CLIENT_SECRET: "${GO_LOOSE_OIDC_CLIENT_SECRET:-}" + GO_LOOSE_OIDC_REDIRECT_URL: "${GO_LOOSE_OIDC_REDIRECT_URL:-}" + volumes: + # Source is mounted read-write so Air can write ./dist. Use + # :ro here if you only want the host copy of dist to be authoritative. + - ./:/src:cached + # The build output, per the Air config above. + - ./dist:/src/dist + # Keep build artifacts and the module cache out of the image layer. + - air-tmp:/tmp/air + - go-build-cache:/tmp/go-build + - go-mod-cache:/go/pkg/mod + ports: + - "${GO_LOOSE_DEV_PORT:-8080}:8080" + healthcheck: + test: ["CMD", "/src/dist/go-loose", "-healthcheck"] + interval: 10s + timeout: 3s + retries: 5 + start_period: 20s + init: true + networks: + - go_loose_dev_network + +networks: + go_loose_dev_network: + +volumes: + db-data-dev: + air-tmp: + go-build-cache: + go-mod-cache: diff --git a/docker-compose.yaml b/docker-compose.yaml index 9a1ad53..eabdc54 100644 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -8,7 +8,9 @@ services: POSTGRES_USER: goloose POSTGRES_PASSWORD: goloose volumes: - - ./data/db:/var/lib/postgresql/data + # A named volume keeps PostgreSQL's 0700 permissions away from the source + # tree; a host bind mount here makes `go build ./...` fail to walk data/. + - db-data:/var/lib/postgresql/data healthcheck: test: ["CMD-SHELL", "pg_isready -U goloose -d goloose"] interval: 5s @@ -48,6 +50,9 @@ services: aliases: - go-loose +volumes: + db-data: + networks: go_loose_network: local_dev_edge: diff --git a/docs/client-login.md b/docs/client-login.md index e31b466..55d6826 100644 --- a/docs/client-login.md +++ b/docs/client-login.md @@ -126,19 +126,38 @@ Both `/connect/token` and `/connect/userinfo` return the caller's `role`, `permi ```json { - "sub": "9f0f...", + "id": "9f0f...", "email": "ada@example.com", "display_name": "Ada Lovelace", "avatar_url": "https://loose.example.com/api/v1/avatars/kZ3...", + "tenant_id": "2b41...", + "tenant_slug": "nmbs", + "application_id": "7c02...", + "application": "guess", "role": "developer", - "permissions": ["console.read", "profile.edit", "applications.manage", "keys.manage", "contracts.manage"], - "can": {"contracts.manage": true, "users.manage": false} + "permissions": [ + "console.read", + "users.read", + "applications.manage", + "keys.manage", + "contracts.manage", + "users.manage", + "profile.edit" + ] } ``` -`avatar_url` is public by design, so it can be embedded directly with a plain image tag. It is an empty string when the user has not uploaded a picture. Read `can` rather than checking `role` by name; the client package builds it from the same matrix the console uses. See [roles and capabilities](roles.md). +There is no `can` object on the wire. `avatar_url` is public by design, so it can be embedded directly with a plain image tag; it is an empty string when the user has not uploaded a picture. -A user with no membership in the application's tenant still authenticates, but the role falls back to `user` with only `profile.edit`. +Read `permissions` rather than testing `role` by name, because a tenant may define its own roles. The client package exposes the same check as a method: + +```go +if user.Can("contracts.manage") { + // the role behind this session grants it +} +``` + +A user with no membership in the application's tenant still authenticates, but falls back to the built-in `user` role, whose only permission is `profile.edit`. See [roles, permissions, and profiles](roles.md). ## Security and availability @@ -147,8 +166,43 @@ A user with no membership in the application's tenant still authenticates, but t - Do not replace the middleware's fail-closed behavior with an allow-on-error fallback. - Apply CSRF protection to state-changing routes in the client application; the package handles login `state`, not your application forms. - The middleware checks Go Loose on every request for immediate revocation. Deploy Go Loose highly available and use a bounded HTTP timeout. +- Signing out in Go Loose revokes every hosted-login session the user holds here, so + the client applications stop accepting their tokens on the next request. See + [Signing out across the family](#signing-out-across-the-family). - API-key authentication and browser-user authentication are independent. Use `client.Middleware` for service/API keys and `BrowserAuth.Middleware` for logged-in users. +## Signing out across the family + +Applications in this family share one identity, so signing out has to mean more than +clearing one cookie. `POST /auth/logout` does three things, in this order: + +1. **Revokes every hosted-login session the user holds.** Go Loose issues the bearer + tokens these applications authenticate with, so this is what actually signs them + out: their tokens stop resolving immediately, without the application being told + or having to ask. This step reads the session first, which is why it happens before + the cookie is cleared. +2. **Clears the local management cookies** on the identity domain. +3. **Sends the browser to the identity provider's logout endpoint**, when the provider + advertises one in its discovery document, so the single sign-on session ends too. + +Two consequences worth designing around: + +- **A client application is signed out on its next request, not by being notified.** + Its own session cookie still exists; the bearer token inside it has been revoked. An + application that only checks the session locally will appear signed in until its + next call to Go Loose, at which point it should treat the rejection as a sign-out and + return the browser to `/login`. +- **Applications that authenticate against a different provider are not covered.** + The provider endpoint is read from the issuer Go Loose itself is configured with, so + this covers the applications that sign in through Go Loose. One pointed at a separate + identity provider needs its own end-session redirect. + +A provider that does not advertise `end_session_endpoint` is not an error: step 3 is +skipped and the user lands back on the sign-in page, having still been signed out +locally and revoked. Go Loose sends `client_id` and `post_logout_redirect_uri` rather +than an `id_token_hint`, because a hint would mean keeping a live credential in the +browser cookie between login and logout. + ## Applications on the local platform The local platform signs in two client applications, both with the wildcard diff --git a/docs/coding-standards.md b/docs/coding-standards.md index 87a9a03..b25dc7f 100644 --- a/docs/coding-standards.md +++ b/docs/coding-standards.md @@ -8,7 +8,7 @@ - Wrap errors with the operation; never log secrets, cookies, authorization headers, or full API keys. - Return explicit errors. Runtime authorization must fail closed. - Keep SQL tenant-aware: management queries must join through membership, and writes must enforce role in the query or transaction. -- Derive authorization from the matrix in `internal/role` instead of hardcoding role names. Pass `role.Grants(...)` into SQL, use `role.Allows` in handlers, and render controls from the capability lists the server returns. +- Derive authorization from the database role and permission tables instead of hardcoding role names. Resolve a member's capabilities by joining `role_permissions`, render controls from the capability lists the server returns, and keep `internal/role` limited to the permission vocabulary shared with the migrations. - Use cryptographically secure randomness for credentials and constant-time comparison for signatures. - Format with `gofmt`; run `go test -race ./...`, `go vet ./...`, and `go build ./...`. diff --git a/docs/roles.md b/docs/roles.md index 3016b7a..7b85820 100644 --- a/docs/roles.md +++ b/docs/roles.md @@ -1,88 +1,91 @@ -# Roles and capabilities +# Roles, permissions, and profiles -A role is a named bundle of permissions. Roles are rows: six built-in ones seeded by migration `0006_database_roles.sql`, plus whatever each tenant defines for itself. `internal/role` no longer holds a matrix — it holds the closed vocabulary of permissions a role may be granted, and the database resolves what a membership actually grants. +Authorization is database-driven. Permissions and roles are rows, not Go constants, so a tenant can define its own vocabulary without a code change or a migration. -``` -roles one row per role. tenant_id NULL means built-in. -role_permissions (role_id, permission) — what the role grants. -memberships.role_id → roles.id, NOT NULL, ON DELETE RESTRICT -``` +## Data model -## Built-in capability matrix +- `permissions` is the closed vocabulary. Every row carries a `name`, a `label`, a `description`, and an `is_system` flag. System permissions cannot be edited or deleted. +- `roles` holds the roles. A `NULL tenant_id` marks a built-in role that every tenant sees and nobody may modify. A custom role belongs to exactly one tenant. +- `role_permissions` joins roles to permissions. +- `memberships.role_id` points at a role row. The older `memberships.role` text column was dropped in `0006_database_roles.sql`. -This is what the migration seeds. It is data, not code: change it with a new migration, not by editing Go. +Nine permissions ship as system rows: + +| Permission | Label | +| --- | --- | +| `tenants.manage` | Manage tenants | +| `roles.manage` | Manage roles | +| `users.manage` | Manage members | +| `applications.manage` | Manage applications | +| `keys.manage` | Manage API keys | +| `contracts.manage` | Manage contracts | +| `users.read` | Read members | +| `console.read` | Read console | +| `profile.edit` | Edit own profile | + +A tenant may add further permission names. They are grantable and reported through `/connect/userinfo`, but the console does not enforce them. + +## Built-in roles + +`0006_database_roles.sql` seeds these six roles. Note that `developer` and `operator` hold `users.manage`: any tenant member who runs the console can maintain their own tenant's members. Minting roles stays with `owner` and `admin` through `roles.manage`, because defining privilege is the operation that actually escalates it. | Permission | owner | admin | developer | operator | viewer | user | | --- | --- | --- | --- | --- | --- | --- | -| `tenants.manage` | yes | no | no | no | no | no | -| `roles.manage` | yes | yes | no | no | no | no | -| `users.manage` | yes | yes | yes | yes | no | no | +| `console.read` | yes | yes | yes | yes | yes | no | +| `users.read` | yes | yes | yes | yes | yes | no | | `applications.manage` | yes | yes | yes | no | no | no | | `keys.manage` | yes | yes | yes | yes | no | no | | `contracts.manage` | yes | yes | yes | yes | no | no | -| `users.read` | yes | yes | yes | yes | yes | no | -| `console.read` | yes | yes | yes | yes | yes | no | +| `users.manage` | yes | yes | yes | yes | no | no | +| `roles.manage` | yes | yes | no | no | no | no | +| `tenants.manage` | yes | no | no | no | no | no | | `profile.edit` | yes | yes | yes | yes | yes | yes | -Intended use: +`user` members have no `console.read`, so a session that lands on `/` is redirected to `/profile`. A `user` with no membership at all still sees the waiting room. -- **owner** — full control of the tenant, including defining roles and handing them out. -- **admin** — manages applications, keys, contracts, members, and roles. -- **developer** — ships applications, keys, and contracts, and maintains the tenant's members. -- **operator** — runs existing applications and maintains the tenant's members. -- **viewer** — read-only console access. -- **user** — self-service only. No console access; the session lands on `/profile`. +## Managing roles -`developer` and `operator` hold `users.manage` so that anyone who runs the console can maintain their own tenant's members. `roles.manage` deliberately stays narrow: defining roles is what defines privilege, so it is not something a member administrator can grant themselves. +`/roles` is the console page. The API is: -`user` members without any tenant membership still see the waiting room. Those with a membership are redirected from `/` to `/profile`, because the dashboard requires `console.read`. +| Route | Purpose | +| --- | --- | +| `GET /api/v1/roles` | List roles with their permissions and member counts | +| `POST /api/v1/roles` | Create a custom role for one tenant | +| `PUT /api/v1/roles/{id}` | Rename a role or change its permissions | +| `DELETE /api/v1/roles/{id}` | Delete a custom role | +| `GET /api/v1/permissions` | List the permission catalog | +| `POST /api/v1/permissions` | Add a permission to the catalog | +| `DELETE /api/v1/permissions/{name}` | Remove an unused permission | -## Tenant-defined roles +Two rules keep this from becoming a privilege-escalation hole: -`POST /api/v1/roles` creates a role for one tenant. It is visible only in that tenant, and the `/roles` screen lists it beside the built-ins with its permission chips. +- **Assignability is a subset rule.** A role is offered as `assignable` only when every permission it grants is one the requesting administrator already holds. `ListRoles` computes this per caller, so managing members can never hand out more authority than the administrator has. +- **Roles in use cannot be deleted.** `memberships.role_id` is `ON DELETE RESTRICT` and `DeleteRole` returns `ErrRoleInUse`, so a role cannot be pulled out from under somebody. Built-in roles are likewise undeletable. -Three rules keep this from becoming a privilege-escalation hole: +`role_permissions.permission` is a foreign key onto `permissions.name`, so a role cannot reference a capability that is not in the catalog. -1. **Roles are scoped.** `roles.tenant_id` is set, and every query that resolves a role filters on the caller's own tenant, so a role id cannot be probed across tenants. -2. **You cannot mint what you do not hold.** Creating or editing a role requires `roles.manage` *and* requires every permission in the role to be one the caller already has. Assigning a role enforces the same subset rule. -3. **A role in use cannot be deleted.** `memberships.role_id` is `ON DELETE RESTRICT`, and `DELETE /api/v1/roles/{id}` reports 409 until the members are moved. Built-in roles are immutable and report 404. +## Go side -Built-in roles are read only: the store refuses to edit or delete a row with `is_system` set. +`internal/role` holds only the permission vocabulary used to build the seed data and to keep the Go and SQL spellings in step. It intentionally has no role-to-permission matrix: that mapping lives in the database, so queries resolve a member's real capabilities with a join on `role_permissions` rather than against a hardcoded list. -## Where the checks live - -Tenant-scoped statements resolve the grant through `role_permissions` using one shared predicate, `permissionPredicate` in `internal/store/roles.go`: - -```sql -EXISTS ( - SELECT 1 - FROM memberships scoped - JOIN role_permissions granted ON granted.role_id = scoped.role_id - WHERE scoped.tenant_id = $1 AND scoped.user_id = $2 - AND granted.permission = $3 -) -``` - -Because the check asks for a permission rather than a role name, a tenant's own role works everywhere a built-in one does without any Go change. The server never decides authorization: `handleStoreError` maps `store.ErrNotFound` to a 404 so a denied write and a missing row are indistinguishable. - -`role.Permission` names are also constrained by a check constraint on `role_permissions.permission`, so an unknown capability cannot be stored even if a caller bypasses the Go layer. **Adding a permission therefore needs three edits**: the constant in `internal/role/role.go`, the check constraint and seed in a new migration, and the expected grants in `internal/store/roles_integration_test.go`. +Store methods enforce capabilities in SQL inside the same transaction as the write, so a request cannot pass a handler check and then fail, or the reverse. ## Display names and profile pictures -Every management session can open `/profile` and set a display name and a profile picture, independent of tenant role. +Every management session can open `/profile` and set a display name and a picture, independent of tenant role. -Setting the display name flags the user as `name_customized`, which stops the identity provider from overwriting it on the next login. The row is still matched by email on every login, so customization never breaks sign-in. +Setting the display name sets `name_customized`, which stops the identity provider from overwriting it on the next login. The row is still matched by email on every login, so customization never breaks sign-in. -Pictures are stored as bytes in PostgreSQL with a random 256-bit key and served from the public `GET /api/v1/avatars/{key}` route. The URL is unguessable and carries no user identity, so applications can embed it directly: +Pictures are stored as bytes in PostgreSQL under a random 256-bit key and served from the public `GET /api/v1/avatars/{key}` route. The URL is unguessable and carries no user identity, so applications can embed it directly: ```html Ada Lovelace ``` -Accepted formats are JPEG, PNG, and GIF up to 2 MiB and 4096 by 4096 pixels. Replacing a picture issues a new key and retires the old one, so cached images never go stale and revoked URLs stop resolving. +Accepted formats are JPEG, PNG, and GIF, up to 2 MiB and 4096 by 4096 pixels. Replacing a picture issues a new key and retires the old one, so cached images never go stale and revoked URLs stop resolving. -## Clients and permissions +## Clients -`/connect/token` and `/connect/userinfo` return the caller's `role`, `permissions`, and absolute `avatar_url`, resolved against the tenant that owns the application. `client.User.Can` exposes the same checks to Go code, so a client can adapt its UI without duplicating the matrix. +`/connect/token` and `/connect/userinfo` return the caller's `role`, `permissions`, and absolute `avatar_url`, resolved against the tenant that owns the application. `client.User.Can` exposes the same checks to Go code, so a client can adapt its UI without duplicating the vocabulary. -A user with no membership in the application's tenant still authenticates, but the role falls back to the built-in `user` role with only `profile.edit`. \ No newline at end of file +`avatar_url` is public by design and is an empty string when no picture is set. A user with no membership in the application's tenant still authenticates and falls back to the built-in `user` role, whose only permission is `profile.edit`. \ No newline at end of file diff --git a/internal/config/config.go b/internal/config/config.go index 9b570e4..c4bc04c 100644 --- a/internal/config/config.go +++ b/internal/config/config.go @@ -29,24 +29,33 @@ type Config struct { BootstrapTenant string BootstrapApp string HTTPTimeout time.Duration + + // ThemeBaseURL is the go-bananas runtime origin supplying the shared styling + // contract. Empty means this application keeps its own hand-written theme + // blocks, which is the safe default: a missing contract must degrade to the + // application's existing look, not to an unstyled page. + ThemeBaseURL string } func Load() (Config, error) { baseURL := strings.TrimRight(env("GO_LOOSE_BASE_URL", "http://localhost:8080"), "/") cfg := Config{ - Addr: env("GO_LOOSE_ADDR", ":8080"), - BaseURL: baseURL, - AuthDomain: strings.TrimPrefix(strings.ToLower(env("GO_LOOSE_AUTH_DOMAIN", "auth.dev")), "."), - DatabaseURL: env("GO_LOOSE_DATABASE_URL", "postgres://goloose:goloose@localhost:5432/goloose?sslmode=disable"), - SessionSecret: os.Getenv("GO_LOOSE_SESSION_SECRET"), - DevLogin: envBool("GO_LOOSE_DEV_LOGIN", false), - DevUser: env("GO_LOOSE_DEV_USER", "admin@local.test"), - LocalLogin: envBool("GO_LOOSE_LOCAL_LOGIN", false), - LocalAdminEmail: strings.ToLower(env("GO_LOOSE_LOCAL_ADMIN_EMAIL", "admin@goloose.local")), - LocalAdminPassword: os.Getenv("GO_LOOSE_LOCAL_ADMIN_PASSWORD"), - OIDCIssuer: strings.TrimRight(os.Getenv("GO_LOOSE_OIDC_ISSUER"), "/"), - OIDCClientID: os.Getenv("GO_LOOSE_OIDC_CLIENT_ID"), - OIDCClientSecret: os.Getenv("GO_LOOSE_OIDC_CLIENT_SECRET"), + Addr: env("GO_LOOSE_ADDR", ":8080"), + BaseURL: baseURL, + AuthDomain: strings.TrimPrefix(strings.ToLower(env("GO_LOOSE_AUTH_DOMAIN", "auth.dev")), "."), + DatabaseURL: env("GO_LOOSE_DATABASE_URL", "postgres://goloose:goloose@localhost:5432/goloose?sslmode=disable"), + SessionSecret: os.Getenv("GO_LOOSE_SESSION_SECRET"), + DevLogin: envBool("GO_LOOSE_DEV_LOGIN", false), + DevUser: env("GO_LOOSE_DEV_USER", "admin@local.test"), + LocalLogin: envBool("GO_LOOSE_LOCAL_LOGIN", false), + LocalAdminEmail: strings.ToLower(env("GO_LOOSE_LOCAL_ADMIN_EMAIL", "admin@goloose.local")), + LocalAdminPassword: os.Getenv("GO_LOOSE_LOCAL_ADMIN_PASSWORD"), + OIDCIssuer: strings.TrimRight(os.Getenv("GO_LOOSE_OIDC_ISSUER"), "/"), + OIDCClientID: os.Getenv("GO_LOOSE_OIDC_CLIENT_ID"), + OIDCClientSecret: os.Getenv("GO_LOOSE_OIDC_CLIENT_SECRET"), + // Trailing slashes are trimmed because every use is path concatenation, and a + // double slash would produce a URL the service answers 404 for. + ThemeBaseURL: strings.TrimRight(os.Getenv("GO_LOOSE_THEME_BASE_URL"), "/"), OIDCRedirectURL: env("GO_LOOSE_OIDC_REDIRECT_URL", baseURL+"/auth/callback"), AllowedEmailDomains: csv(os.Getenv("GO_LOOSE_ALLOWED_EMAIL_DOMAINS")), AllowPrivateContractURL: envBool("GO_LOOSE_ALLOW_PRIVATE_CONTRACT_URLS", false), diff --git a/internal/database/migrations/0007_permission_catalog.sql b/internal/database/migrations/0007_permission_catalog.sql new file mode 100644 index 0000000..ef57cb9 --- /dev/null +++ b/internal/database/migrations/0007_permission_catalog.sql @@ -0,0 +1,47 @@ +-- +goose Up +-- Permissions become rows so the catalog can be extended without a migration. +-- The nine names the application enforces in SQL are seeded here; a tenant may +-- add further names, which are grantable and reported through /connect/userinfo +-- but are not checked by the console itself. +CREATE TABLE permissions ( + name text PRIMARY KEY CHECK (name ~ '^[a-z0-9][a-z0-9]*(?:[.-][a-z0-9]+)*$'), + label text NOT NULL CHECK (length(btrim(label)) BETWEEN 1 AND 100), + description text NOT NULL DEFAULT '', + is_system boolean NOT NULL DEFAULT false, + created_at timestamptz NOT NULL DEFAULT now(), + updated_at timestamptz NOT NULL DEFAULT now() +); + +INSERT INTO permissions (name, label, description, is_system) VALUES + ('tenants.manage', 'Manage tenants', 'Create tenants and administer the installation.', true), + ('roles.manage', 'Manage roles', 'Create and edit the roles of this tenant.', true), + ('users.manage', 'Manage members', 'Invite members and change their roles and application grants.', true), + ('applications.manage', 'Manage applications', 'Register applications and configure client credentials.', true), + ('keys.manage', 'Manage API keys', 'Issue and revoke API keys.', true), + ('contracts.manage', 'Manage contracts', 'Import OpenAPI contracts and their endpoints.', true), + ('users.read', 'Read members', 'List the members of a tenant and the roles they hold.', true), + ('console.read', 'Read console', 'Open the management console and pick tenants.', true), + ('profile.edit', 'Edit own profile', 'Change one''s own display name and picture.', true); + +-- The closed list becomes a foreign key, so a role can no longer be granted a +-- capability that is not in the catalog. Granting one is now a matter of +-- inserting the permission first rather than editing a check constraint. +ALTER TABLE role_permissions DROP CONSTRAINT role_permissions_permission_check; +ALTER TABLE role_permissions + ADD CONSTRAINT role_permissions_permission_fkey + FOREIGN KEY (permission) REFERENCES permissions(name) ON DELETE RESTRICT; + +-- +goose Down +DELETE FROM role_permissions WHERE permission NOT IN ( + 'tenants.manage', 'roles.manage', 'users.manage', 'applications.manage', + 'keys.manage', 'contracts.manage', 'users.read', 'console.read', 'profile.edit' +); + +ALTER TABLE role_permissions DROP CONSTRAINT role_permissions_permission_fkey; +ALTER TABLE role_permissions + ADD CONSTRAINT role_permissions_permission_check CHECK (permission IN ( + 'tenants.manage', 'roles.manage', 'users.manage', 'applications.manage', + 'keys.manage', 'contracts.manage', 'users.read', 'console.read', 'profile.edit' + )); + +DROP TABLE permissions; \ No newline at end of file diff --git a/internal/database/migrations/0008_oidc_redirect_url.sql b/internal/database/migrations/0008_oidc_redirect_url.sql new file mode 100644 index 0000000..f2c2193 --- /dev/null +++ b/internal/database/migrations/0008_oidc_redirect_url.sql @@ -0,0 +1,5 @@ +-- +goose Up +ALTER TABLE installation_settings ADD COLUMN oidc_redirect_url text NOT NULL DEFAULT ''; + +-- +goose Down +ALTER TABLE installation_settings DROP COLUMN IF EXISTS oidc_redirect_url; \ No newline at end of file diff --git a/internal/server/account_test.go b/internal/server/account_test.go new file mode 100644 index 0000000..4cd338d --- /dev/null +++ b/internal/server/account_test.go @@ -0,0 +1,366 @@ +package server + +import ( + "context" + "database/sql" + "errors" + "io" + "log/slog" + "net/http" + "net/http/httptest" + neturl "net/url" + "os" + "strings" + "testing" + + "golang.org/x/oauth2" + + "github.com/danyel/go-loose/internal/config" + "github.com/danyel/go-loose/internal/database" + "github.com/danyel/go-loose/internal/session" + "github.com/danyel/go-loose/internal/store" + "github.com/danyel/go-loose/web" +) + +// logoutServer builds a server with a session manager so logout can be exercised +// end to end. The store is nil, so the client-session revocation is expected to +// panic-free no-op only where it is guarded; these tests therefore exercise the +// redirect behaviour, which is what a person sees. +func logoutServer(t *testing.T) *Server { + t.Helper() + secret := strings.Repeat("s", 32) + return &Server{ + cfg: config.Config{BaseURL: "https://auth.example.test", AuthDomain: "auth.example.test"}, + sessions: session.New(secret, false), + logger: slog.New(slog.NewTextHandler(io.Discard, nil)), + } +} + +// TestLogoutClearsTheSessionAndReturnsToSignIn is the baseline: with no identity +// provider logout endpoint configured, signing out lands back on the sign-in page. +func TestLogoutClearsTheSessionAndReturnsToSignIn(t *testing.T) { + server := logoutServer(t) + response := httptest.NewRecorder() + server.authLogout(response, httptest.NewRequest(http.MethodPost, "https://auth.example.test/auth/logout", nil)) + + if response.Code != http.StatusSeeOther { + t.Fatalf("status = %d, want %d", response.Code, http.StatusSeeOther) + } + if location := response.Header().Get("Location"); location != "/login" { + t.Fatalf("location = %q, want /login", location) + } + var cleared bool + for _, cookie := range response.Result().Cookies() { + if cookie.MaxAge < 0 { + cleared = true + } + } + if !cleared { + t.Error("logout did not clear the session cookie") + } +} + +// TestLogoutEndsTheProviderSessionWhenAdvertised covers the cross-application half: +// when the provider publishes an end_session_endpoint the browser is sent there, so +// the single sign-on session the other applications share is ended too. +func TestLogoutEndsTheProviderSessionWhenAdvertised(t *testing.T) { + server := logoutServer(t) + server.endSession = "https://idp.example.test/protocol/openid-connect/logout" + server.oauth = &oauth2ConfigStub + + response := httptest.NewRecorder() + server.authLogout(response, httptest.NewRequest(http.MethodPost, "https://auth.example.test/auth/logout", nil)) + + location := response.Header().Get("Location") + if !strings.HasPrefix(location, server.endSession) { + t.Fatalf("location = %q, want the provider logout endpoint", location) + } + for _, want := range []string{ + "client_id=go-loose", + "post_logout_redirect_uri=https%3A%2F%2Fauth.example.test%2Flogin", + } { + if !strings.Contains(location, want) { + t.Errorf("location = %q, want it to contain %q", location, want) + } + } +} + +// TestLogoutSkipsTheProviderWhenItIsUnconfigured documents the fallback: a +// deployment whose provider does not advertise a logout endpoint still signs the +// user out locally rather than erroring. +func TestLogoutSkipsTheProviderWhenItIsUnconfigured(t *testing.T) { + for name, configure := range map[string]func(*Server){ + "no endpoint": func(s *Server) {}, + "no client id": func(s *Server) { s.endSession = "https://idp.example.test/logout" }, + "unparseable": func(s *Server) { s.endSession = "://nope"; s.oauth = &oauth2ConfigStub }, + "nothing set up": func(s *Server) { s.endSession = "" }, + } { + t.Run(name, func(t *testing.T) { + server := logoutServer(t) + configure(server) + response := httptest.NewRecorder() + server.authLogout(response, httptest.NewRequest(http.MethodPost, "https://auth.example.test/auth/logout", nil)) + + if location := response.Header().Get("Location"); location != "/login" { + t.Fatalf("location = %q, want the local fallback /login", location) + } + }) + } +} + +// TestAccountMenuIsEmbedded guards the component: it is mounted by every page, so a +// page that forgets the placeholder loses the whole control. +func TestAccountMenuIsEmbedded(t *testing.T) { + for _, page := range []string{"index.html", "profile.html", "roles.html"} { + t.Run(page, func(t *testing.T) { + content, err := web.Files.ReadFile(page) + if err != nil { + t.Fatalf("%s must be embedded: %v", page, err) + } + text := string(content) + for _, marker := range []string{"data-account-menu", "/assets/account.js"} { + if !strings.Contains(text, marker) { + t.Errorf("%s is missing %q", page, marker) + } + } + // The account control replaces the separate sign-out button, so the + // page must not still carry one or the header shows two of each. + if strings.Contains(text, `
maxPermissionLabel { + writeError(w, http.StatusBadRequest, "label must be between 1 and 100 characters") + return + } + description := strings.TrimSpace(request.Description) + if len(description) > 500 { + writeError(w, http.StatusBadRequest, "description must be 500 characters or fewer") + return + } + created, err := s.store.CreatePermission( + r.Context(), claimsFrom(r).UserID, name, label, description) + if err != nil { + switch { + case errors.Is(err, store.ErrPermissionTaken): + writeError(w, http.StatusConflict, "this permission already exists") + case errors.Is(err, store.ErrUnknownPermission): + writeError(w, http.StatusBadRequest, err.Error()) + default: + s.handleStoreError(w, "create permission", err) + } + return + } + writeJSON(w, http.StatusCreated, created) +} + +// deletePermission removes a catalog entry that no role grants. +func (s *Server) deletePermission(w http.ResponseWriter, r *http.Request) { + name := r.PathValue("name") + if !store.ValidPermissionName(name) { + writeError(w, http.StatusBadRequest, "unknown permission name") + return + } + if err := s.store.DeletePermission(r.Context(), claimsFrom(r).UserID, name); err != nil { + switch { + case errors.Is(err, store.ErrPermissionInUse): + writeError(w, http.StatusConflict, "remove this permission from every role before deleting it") + case errors.Is(err, store.ErrPermissionSystem): + writeError(w, http.StatusConflict, "built-in permissions cannot be deleted") + default: + s.handleStoreError(w, "delete permission", err) + } + return + } + w.WriteHeader(http.StatusNoContent) +} diff --git a/internal/server/profile.go b/internal/server/profile.go index c1fa148..9fb19a6 100644 --- a/internal/server/profile.go +++ b/internal/server/profile.go @@ -128,16 +128,36 @@ func (s *Server) avatar(w http.ResponseWriter, r *http.Request) { func (s *Server) profileResponse(profile store.Profile) profileResponse { return profileResponse{ ID: profile.ID, Email: profile.Email, DisplayName: profile.DisplayName, - AvatarURL: s.avatarURL(profile.AvatarKey), Memberships: profile.Memberships, + AvatarURL: s.avatarPath(profile.AvatarKey), Memberships: profile.Memberships, IsSystemAdministrator: profile.IsSystemAdministrator, NameCustomized: profile.NameCustomized, CreatedAt: profile.CreatedAt, LastLoginAt: profile.LastLoginAt, ProfileUpdatedAt: profile.ProfileUpdatedAt, AvatarUpdatedAt: profile.AvatarUpdatedAt, } } -func (s *Server) avatarURL(key *string) string { +// avatarPath returns the same-origin path of a stored profile picture. +// +// The picture is served by this application, so a page of this application must +// reference it by a root-relative path. An absolute URL has to be built from +// cfg.BaseURL, and that value is routinely absent, stale, or aimed at a canonical +// address the browser is not using: it defaults to http://localhost:8080, which a +// browser asked to load it from any other origin refuses, and this application's +// own Content-Security-Policy allows images from 'self' only. A relative path is +// correct by construction in every deployment. +func (s *Server) avatarPath(key *string) string { if key == nil || *key == "" { return "" } - return s.cfg.BaseURL + "/api/v1/avatars/" + *key + return "/api/v1/avatars/" + *key +} + +// avatarURL is the absolute form, for the clients that read a picture from another +// origin: /connect/userinfo is consumed by applications such as go-tell, which +// cannot resolve a relative path against their own host. +func (s *Server) avatarURL(r *http.Request, key *string) string { + path := s.avatarPath(key) + if path == "" { + return "" + } + return s.absoluteURL(r, path) } diff --git a/internal/server/profile_test.go b/internal/server/profile_test.go index 87e2869..5a5f820 100644 --- a/internal/server/profile_test.go +++ b/internal/server/profile_test.go @@ -9,7 +9,6 @@ import ( "image/png" "net/http" "net/http/httptest" - "net/url" "slices" "strings" "testing" @@ -32,23 +31,44 @@ func profileRequest(t *testing.T, body string) *http.Request { return request.WithContext(context.WithValue(request.Context(), claimsKey, claims)) } -func TestAvatarURLIsAbsoluteAndOmittedWithoutKey(t *testing.T) { +// The console reads its own picture through avatarPath, so it must be a relative +// path: the configured base URL is absent or stale often enough that building an +// absolute link from it yields an address the browser refuses to load. +func TestAvatarPathIsRelativeAndOmittedWithoutKey(t *testing.T) { server := profileTestServer() - if got := server.avatarURL(nil); got != "" { - t.Fatalf("avatarURL(nil) = %q, want empty", got) + if got := server.avatarPath(nil); got != "" { + t.Fatalf("avatarPath(nil) = %q, want empty", got) } empty := "" - if got := server.avatarURL(&empty); got != "" { - t.Fatalf("avatarURL(empty) = %q, want empty", got) + if got := server.avatarPath(&empty); got != "" { + t.Fatalf("avatarPath(empty) = %q, want empty", got) } key := "k" - got := server.avatarURL(&key) - if want := "https://auth.example.test/api/v1/avatars/k"; got != want { + if got, want := server.avatarPath(&key), "/api/v1/avatars/k"; got != want { + t.Fatalf("avatarPath() = %q, want %q", got, want) + } + // A base URL left at its default must not leak into a page's markup. + server.cfg.BaseURL = "http://localhost:8080" + if got := server.avatarPath(&key); got != "/api/v1/avatars/k" { + t.Fatalf("avatarPath() with default base URL = %q", got) + } +} + +// Another origin, such as go-tell reading /connect/userinfo, cannot resolve a +// relative path, so that form follows the request rather than the configuration. +func TestAvatarURLFollowsTheRequestNotTheConfiguredBase(t *testing.T) { + server := profileTestServer() + key := "k" + request := httptest.NewRequest(http.MethodGet, "https://nmbs.auth.example.test/connect/userinfo", nil) + if got, want := server.avatarURL(request, &key), "https://nmbs.auth.example.test/api/v1/avatars/k"; got != want { t.Fatalf("avatarURL() = %q, want %q", got, want) } - parsed, err := url.Parse(got) - if err != nil || parsed.Path != "/api/v1/avatars/k" { - t.Fatalf("avatar url = %q, err = %v", got, err) + if got := server.avatarURL(request, nil); got != "" { + t.Fatalf("avatarURL(nil) = %q, want empty", got) + } + // Without a host to follow, the configured base is the only thing left. + if got, want := server.avatarURL(&http.Request{}, &key), "https://auth.example.test/api/v1/avatars/k"; got != want { + t.Fatalf("avatarURL() without a request host = %q, want %q", got, want) } } @@ -58,7 +78,8 @@ func TestAvatarURLIsAbsoluteAndOmittedWithoutKey(t *testing.T) { func TestClientUserExposesRoleCapabilitiesAndPicture(t *testing.T) { server := profileTestServer() key := "avatar-key" - payload := server.clientUser(store.ClientUser{ + request := httptest.NewRequest(http.MethodGet, "https://auth.example.test/connect/userinfo", nil) + payload := server.clientUser(request, store.ClientUser{ ID: "user-1", Email: "operator@example.test", DisplayName: "Operator", TenantSlug: "nmbs", Application: "guess", Role: "operator", Permissions: []string{string(role.ManageKeys), string(role.EditProfile)}, @@ -84,7 +105,7 @@ func TestClientUserExposesRoleCapabilitiesAndPicture(t *testing.T) { // rather than an error. func TestClientUserWithoutMembershipIsLeastPrivileged(t *testing.T) { server := profileTestServer() - payload := server.clientUser(store.ClientUser{Role: "user", Permissions: []string{string(role.EditProfile)}}) + payload := server.clientUser(nil, store.ClientUser{Role: "user", Permissions: []string{string(role.EditProfile)}}) if payload.AvatarURL != "" { t.Fatalf("avatar url = %q, want empty", payload.AvatarURL) } diff --git a/internal/server/roles_test.go b/internal/server/roles_test.go index fc8eb7d..237773a 100644 --- a/internal/server/roles_test.go +++ b/internal/server/roles_test.go @@ -103,8 +103,10 @@ func TestCreateRoleRejectsMalformedInputBeforeTouchingTheStore(t *testing.T) { {"uppercase slug", `{"slug":"Release Manager","name":"Role","permissions":[]}`}, {"slug starting with a dash", `{"slug":"-role","name":"Role","permissions":[]}`}, {"empty name", `{"slug":"role","name":" ","permissions":[]}`}, - {"unknown permission", `{"slug":"role","name":"Role","permissions":["superpower"]}`}, } + // Permission names are not checked here: the catalog is a table, so an unknown + // name can only be caught by the store, which reports it as a bad request. + // See TestARoleCannotGrantAPermissionThatIsNotInTheCatalog. for _, testCase := range cases { t.Run(testCase.name, func(t *testing.T) { server := profileTestServer() diff --git a/internal/server/server.go b/internal/server/server.go index b18be28..88b6c21 100644 --- a/internal/server/server.go +++ b/internal/server/server.go @@ -1,6 +1,7 @@ package server import ( + "bytes" "context" "database/sql" "encoding/json" @@ -22,7 +23,6 @@ import ( "github.com/danyel/go-loose/internal/config" "github.com/danyel/go-loose/internal/contract" "github.com/danyel/go-loose/internal/key" - "github.com/danyel/go-loose/internal/role" "github.com/danyel/go-loose/internal/secretbox" "github.com/danyel/go-loose/internal/session" "github.com/danyel/go-loose/internal/store" @@ -31,12 +31,16 @@ import ( ) type Server struct { - cfg config.Config - store *store.Store - db *sql.DB - sessions *session.Manager - oauth *oauth2.Config - verifier *oidc.IDTokenVerifier + cfg config.Config + store *store.Store + db *sql.DB + sessions *session.Manager + oauth *oauth2.Config + verifier *oidc.IDTokenVerifier + // endSession is the identity provider's logout endpoint, empty when the + // provider does not advertise one. It is what lets a sign-out here also end + // the provider session the other applications in the family share. + endSession string authMu sync.RWMutex installed atomic.Bool httpClient *http.Client @@ -70,7 +74,7 @@ func New(ctx context.Context, cfg config.Config, db *sql.DB, logger *slog.Logger if decryptErr != nil { return nil, fmt.Errorf("decrypt installed OIDC secret: %w", decryptErr) } - if err := server.configureOIDC(ctx, installation.OIDCIssuer, installation.OIDCClientID, secret); err != nil { + if err := server.configureOIDC(ctx, installation.OIDCIssuer, installation.OIDCClientID, secret, installation.OIDCRedirectURL); err != nil { return nil, err } server.installed.Store(true) @@ -80,7 +84,7 @@ func New(ctx context.Context, cfg config.Config, db *sql.DB, logger *slog.Logger } else if !errors.Is(err, store.ErrNotFound) { return nil, fmt.Errorf("load installation: %w", err) } else if cfg.OIDCIssuer != "" && cfg.OIDCClientID != "" && cfg.OIDCClientSecret != "" { - if err := server.configureOIDC(ctx, cfg.OIDCIssuer, cfg.OIDCClientID, cfg.OIDCClientSecret); err != nil { + if err := server.configureOIDC(ctx, cfg.OIDCIssuer, cfg.OIDCClientID, cfg.OIDCClientSecret, cfg.OIDCRedirectURL); err != nil { return nil, err } server.installed.Store(true) @@ -139,6 +143,9 @@ func (s *Server) Handler() http.Handler { mux.Handle("POST /api/v1/roles", s.requireSession(s.requireSameOrigin(http.HandlerFunc(s.createRole)))) mux.Handle("PUT /api/v1/roles/{id}", s.requireSession(s.requireSameOrigin(http.HandlerFunc(s.updateRole)))) mux.Handle("DELETE /api/v1/roles/{id}", s.requireSession(s.requireSameOrigin(http.HandlerFunc(s.deleteRole)))) + mux.Handle("GET /api/v1/permissions", s.requireSession(http.HandlerFunc(s.listPermissions))) + mux.Handle("POST /api/v1/permissions", s.requireSession(s.requireSameOrigin(http.HandlerFunc(s.createPermission)))) + mux.Handle("DELETE /api/v1/permissions/{name}", s.requireSession(s.requireSameOrigin(http.HandlerFunc(s.deletePermission)))) return s.recover(s.logRequests(s.securityHeaders(mux))) } @@ -197,7 +204,8 @@ func (s *Server) openapi(w http.ResponseWriter, _ *http.Request) { func (s *Server) asset(w http.ResponseWriter, r *http.Request) { name := path.Base(r.PathValue("name")) - if name != "style.css" && name != "app.js" && name != "profile.js" && name != "roles.js" { + if name != "style.css" && name != "app.js" && name != "profile.js" && name != "roles.js" && + name != "account.js" { http.NotFound(w, r) return } @@ -210,10 +218,62 @@ func (s *Server) serveEmbedded(w http.ResponseWriter, name string) { http.Error(w, "asset unavailable", http.StatusInternalServerError) return } + + body := content + // HTML pages get the theme origin substituted in. It is a placeholder rather than + // a literal because the origin is deployment configuration, not build-time. + // + // With no origin configured the two theme lines are removed outright rather than + // emitted with an empty href. An empty href is a same-origin request to this + // application, which 404s: a broken stylesheet request in the console, and a + // styling bug report that points at the wrong service entirely. + if path.Ext(name) == ".html" { + body = applyThemeOrigin(content, s.cfg.ThemeBaseURL) + } + w.Header().Set("Content-Type", mime.TypeByExtension(path.Ext(name))) - w.Write(content) + w.Write(body) } +// themeOriginPlaceholder is substituted into every HTML page. It is deliberately not +// valid markup, so an unsubstituted page is obviously wrong rather than subtly so. +const themeOriginPlaceholder = "__GO_LOOSE_THEME_ORIGIN__" + +// applyThemeOrigin substitutes the theme origin into an HTML page, or removes the +// theme lines entirely when none is configured. +func applyThemeOrigin(content []byte, base string) []byte { + // TrimSpace as well as the trailing slash: an environment variable set to spaces + // is a plausible accident, and it would otherwise produce a relative URL that + // resolves against this application and 404s. + origin := strings.TrimRight(strings.TrimSpace(base), "/") + if origin == "" { + return dropThemeLines(content) + } + return bytes.ReplaceAll(content, []byte(themeOriginPlaceholder), []byte(origin)) +} + +// dropThemeLines removes every line carrying a theme marker attribute. Markers are +// used rather than the placeholder itself so that the and the + +` + +func TestThemeOriginIsSubstituted(t *testing.T) { + got := string(applyThemeOrigin([]byte(pageWithThemeLines), "https://themes.example.com")) + + if strings.Contains(got, themeOriginPlaceholder) { + t.Error("the placeholder survived substitution") + } + if !strings.Contains(got, `href="https://themes.example.com/rt/v1/contract.css"`) { + t.Errorf("the contract stylesheet was not rewritten:\n%s", got) + } + if !strings.Contains(got, `src="https://themes.example.com/rt/v1/components.js"`) { + t.Errorf("the component module was not rewritten:\n%s", got) + } + // The application's own stylesheet must be untouched. + if !strings.Contains(got, `href="/assets/style.css"`) { + t.Error("the local stylesheet was rewritten") + } +} + +func TestThemeOriginTrailingSlashIsTrimmed(t *testing.T) { + // A trailing slash would produce a double slash, and the service answers 404 for + // "//rt/v1/contract.css" because the route is matched on the clean path. + for _, base := range []string{ + "https://themes.example.com/", + "https://themes.example.com///", + } { + got := string(applyThemeOrigin([]byte(pageWithThemeLines), base)) + if strings.Contains(got, "com//") { + t.Errorf("base %q produced a doubled slash:\n%s", base, got) + } + } +} + +func TestThemeLinesAreDroppedWhenNoOriginIsConfigured(t *testing.T) { + for _, base := range []string{"", " ", "/"} { + got := string(applyThemeOrigin([]byte(pageWithThemeLines), base)) + + if strings.Contains(got, themeOriginPlaceholder) { + t.Errorf("base %q left the placeholder in place:\n%s", base, got) + } + // An empty href would be a same-origin request to this application, which 404s + // and looks like a styling bug in the wrong service. + if strings.Contains(got, `href="/rt/v1/contract.css"`) { + t.Errorf("base %q emitted an empty contract href:\n%s", base, got) + } + if strings.Contains(got, themeMarkerContract) || strings.Contains(got, themeMarkerScript) { + t.Errorf("base %q left a theme line behind:\n%s", base, got) + } + // The rest of the page must survive. + if !strings.Contains(got, `href="/assets/style.css"`) { + t.Errorf("base %q removed the local stylesheet:\n%s", base, got) + } + if !strings.Contains(got, "") || !strings.Contains(got, "") { + t.Errorf("base %q damaged the page structure:\n%s", base, got) + } + } +} + +func TestThemeOriginLeavesNonThemePagesAlone(t *testing.T) { + // A page with no theme lines must come back byte-identical, so that a deployment + // without the contract serving its login and install pages is a no-op. + plain := []byte("\n\nno theme here\n\n") + if got := applyThemeOrigin(plain, "https://themes.example.com"); string(got) != string(plain) { + t.Errorf("a page without theme lines was modified:\n%s", got) + } + if got := applyThemeOrigin(plain, ""); string(got) != string(plain) { + t.Errorf("a page without theme lines was modified:\n%s", got) + } +} diff --git a/internal/server/useradmin.go b/internal/server/useradmin.go index 2e6bf5a..94cea56 100644 --- a/internal/server/useradmin.go +++ b/internal/server/useradmin.go @@ -89,7 +89,7 @@ func (s *Server) inviteUser(w http.ResponseWriter, r *http.Request) { s.handleStoreError(w, "invite user", err) return } - user.AvatarURL = s.avatarURL(user.AvatarKey) + user.AvatarURL = s.avatarPath(user.AvatarKey) writeJSON(w, http.StatusCreated, user) } diff --git a/internal/store/clientauth.go b/internal/store/clientauth.go index 60d00ee..cd3e3c8 100644 --- a/internal/store/clientauth.go +++ b/internal/store/clientauth.go @@ -108,14 +108,18 @@ func (s *Store) InviteUser(ctx context.Context, administratorID, tenantID, email return ManagedUser{}, err } defer tx.Rollback() - held, err := heldPermissions(ctx, tx, administratorID, tenantID) + permitted, err := hasPermission(ctx, tx, administratorID, tenantID, role.ManageUsers) if err != nil { return ManagedUser{}, err } - if !within([]string{string(role.ManageUsers)}, held) { + if !permitted { return ManagedUser{}, ErrNotFound } - resolved, err := resolveRoleID(ctx, tx, tenantID, roleID, held) + grantable, err := grantablePermissions(ctx, tx, administratorID, tenantID) + if err != nil { + return ManagedUser{}, err + } + resolved, err := resolveRoleID(ctx, tx, tenantID, roleID, grantable) if err != nil { return ManagedUser{}, err } @@ -161,14 +165,18 @@ func (s *Store) SetUserAccess(ctx context.Context, administratorID, tenantID, us return err } defer tx.Rollback() - held, err := heldPermissions(ctx, tx, administratorID, tenantID) + permitted, err := hasPermission(ctx, tx, administratorID, tenantID, role.ManageUsers) if err != nil { return err } - if !within([]string{string(role.ManageUsers)}, held) { + if !permitted { return ErrNotFound } - resolved, err := resolveRoleID(ctx, tx, tenantID, roleID, held) + grantable, err := grantablePermissions(ctx, tx, administratorID, tenantID) + if err != nil { + return err + } + resolved, err := resolveRoleID(ctx, tx, tenantID, roleID, grantable) if err != nil { return err } @@ -410,3 +418,48 @@ func (s *Store) RevokeClientSession(ctx context.Context, tokenHash []byte) error } return nil } + +// RevokeUserClientSessions ends every hosted-login session belonging to a user and +// reports how many were live. +// +// Go Loose issues the bearer tokens that tenant applications authenticate with, so +// this is what makes signing out here sign you out there: the tokens stop resolving +// immediately, without the other application having to be told or even to ask. It is +// the part of single logout that is enforced here rather than at the identity +// provider. +// +// A user with no sessions is not an error, so the count is returned rather than +// ErrNotFound: logging out twice, or from a session that never used a client +// application, must still succeed. +func (s *Store) RevokeUserClientSessions(ctx context.Context, userID string) (int, error) { + if userID == "" { + return 0, nil + } + result, err := s.db.ExecContext(ctx, ` + UPDATE client_user_sessions SET revoked_at = now() + WHERE user_id = $1 AND revoked_at IS NULL`, userID) + if err != nil { + return 0, err + } + count, err := result.RowsAffected() + if err != nil { + return 0, err + } + return int(count), nil +} + +// CountActiveClientSessions reports how many hosted-login sessions a user holds. +// The account menu uses it to say whether signing out will reach other applications. +func (s *Store) CountActiveClientSessions(ctx context.Context, userID string) (int, error) { + if userID == "" { + return 0, nil + } + var count int + err := s.db.QueryRowContext(ctx, ` + SELECT count(*) FROM client_user_sessions + WHERE user_id = $1 AND revoked_at IS NULL AND expires_at > now()`, userID).Scan(&count) + if err != nil { + return 0, err + } + return count, nil +} diff --git a/internal/store/installation.go b/internal/store/installation.go index 87b693c..5fc903f 100644 --- a/internal/store/installation.go +++ b/internal/store/installation.go @@ -12,6 +12,7 @@ type Installation struct { OIDCIssuer string OIDCClientID string OIDCSecretCiphertext []byte + OIDCRedirectURL string SeededDemo bool } @@ -25,9 +26,9 @@ type DemoUser struct { func (s *Store) Installation(ctx context.Context) (Installation, error) { var installation Installation err := s.db.QueryRowContext(ctx, ` - SELECT oidc_issuer, oidc_client_id, oidc_client_secret_ciphertext, seeded_demo + SELECT oidc_issuer, oidc_client_id, oidc_client_secret_ciphertext, oidc_redirect_url, seeded_demo FROM installation_settings WHERE singleton = true`). - Scan(&installation.OIDCIssuer, &installation.OIDCClientID, &installation.OIDCSecretCiphertext, &installation.SeededDemo) + Scan(&installation.OIDCIssuer, &installation.OIDCClientID, &installation.OIDCSecretCiphertext, &installation.OIDCRedirectURL, &installation.SeededDemo) if errors.Is(err, sql.ErrNoRows) { return Installation{}, ErrNotFound } @@ -41,9 +42,9 @@ func (s *Store) Install(ctx context.Context, installation Installation, demoUser } defer tx.Rollback() if _, err := tx.ExecContext(ctx, ` - INSERT INTO installation_settings(singleton, oidc_issuer, oidc_client_id, oidc_client_secret_ciphertext, seeded_demo) - VALUES (true, $1, $2, $3, $4)`, - installation.OIDCIssuer, installation.OIDCClientID, installation.OIDCSecretCiphertext, installation.SeededDemo); err != nil { + INSERT INTO installation_settings(singleton, oidc_issuer, oidc_client_id, oidc_client_secret_ciphertext, oidc_redirect_url, seeded_demo) + VALUES (true, $1, $2, $3, $4, $5)`, + installation.OIDCIssuer, installation.OIDCClientID, installation.OIDCSecretCiphertext, installation.OIDCRedirectURL, installation.SeededDemo); err != nil { return err } if len(demoUsers) == 0 { @@ -118,14 +119,14 @@ func (s *Store) ClaimFirstSystemAdministrator(ctx context.Context, userID string } if _, err := tx.ExecContext(ctx, ` INSERT INTO memberships(tenant_id, user_id, role_id) - SELECT id, $1, r.id FROM tenants, roles r + SELECT t.id, $1, r.id FROM tenants t, roles r WHERE r.slug = 'owner' AND r.tenant_id IS NULL ON CONFLICT DO NOTHING`, userID); err != nil { return false, err } if _, err := tx.ExecContext(ctx, ` INSERT INTO user_application_access(application_id, user_id, granted_by) - SELECT id, $1, $1 FROM applications ON CONFLICT DO NOTHING`, userID); err != nil { + SELECT a.id, $1, $1 FROM applications a ON CONFLICT DO NOTHING`, userID); err != nil { return false, err } return true, tx.Commit() diff --git a/internal/store/integration_test.go b/internal/store/integration_test.go index ce80ece..13c1c2a 100644 --- a/internal/store/integration_test.go +++ b/internal/store/integration_test.go @@ -4,6 +4,7 @@ import ( "context" "database/sql" "errors" + "net/url" "os" "strings" "testing" @@ -24,6 +25,7 @@ func integrationStore(t *testing.T) (*store.Store, *sql.DB, context.Context) { if url == "" { t.Skip("set GO_LOOSE_TEST_DATABASE_URL to run PostgreSQL integration tests") } + requireScratchDatabase(t, url) ctx := context.Background() db, err := database.Open(ctx, url) if err != nil { @@ -39,6 +41,27 @@ func integrationStore(t *testing.T) (*store.Store, *sql.DB, context.Context) { return store.New(db), db, ctx } +// requireScratchDatabase refuses to run against anything that looks like a real +// database. resetSchema drops every table in the public schema, so pointing +// these tests at a development database destroys it. The database name must +// contain "test" unless the operator opts out explicitly. +func requireScratchDatabase(t *testing.T, rawURL string) { + t.Helper() + if os.Getenv("GO_LOOSE_TEST_DATABASE_DESTRUCTIVE") == "1" { + return + } + parsed, err := url.Parse(rawURL) + if err != nil { + t.Fatalf("parse GO_LOOSE_TEST_DATABASE_URL: %v", err) + } + name := strings.TrimPrefix(parsed.Path, "/") + if !strings.Contains(strings.ToLower(name), "test") { + t.Fatalf("refusing to run integration tests against database %q: resetSchema drops every table. "+ + "Point GO_LOOSE_TEST_DATABASE_URL at a scratch database whose name contains \"test\" "+ + "(run `make integration-db` to create one), or set GO_LOOSE_TEST_DATABASE_DESTRUCTIVE=1 to override.", name) + } +} + // grantApplicationAccess inserts an application grant directly so that tests can // build states the management API intentionally refuses to create, such as a // grant for a user with no membership. diff --git a/internal/store/passwordauth.go b/internal/store/passwordauth.go index 9727ab8..f2f0132 100644 --- a/internal/store/passwordauth.go +++ b/internal/store/passwordauth.go @@ -6,6 +6,16 @@ import ( "errors" ) +// EnsurePasswordUser creates or updates the local account behind +// GO_LOOSE_LOCAL_ADMIN_PASSWORD and bootstraps it into the installation. +// +// The local administrator is operator-supplied rather than created by a visitor, +// so when the installation has no system administrator yet it claims the role. +// Without that, a database-only deployment would have nobody able to create +// tenants or approve waiting-room users, because both require the role that only +// a first OIDC sign-in otherwise grants. The claim is a no-op once any system +// administrator exists, so an installation already owned by a Google account is +// left alone. func (s *Store) EnsurePasswordUser(ctx context.Context, email, displayName, passwordHash, tenantSlug, appSlug string) error { user, err := s.UpsertUser(ctx, "local:"+email, email, displayName) if err != nil { @@ -17,6 +27,9 @@ func (s *Store) EnsurePasswordUser(ctx context.Context, email, displayName, pass WHERE id = $1 AND password_hash IS NULL`, user.ID, passwordHash); err != nil { return err } + if _, err := s.ClaimFirstSystemAdministrator(ctx, user.ID); err != nil { + return err + } return s.Bootstrap(ctx, user.ID, tenantSlug, appSlug) } diff --git a/internal/store/permissions.go b/internal/store/permissions.go new file mode 100644 index 0000000..f2738ad --- /dev/null +++ b/internal/store/permissions.go @@ -0,0 +1,224 @@ +package store + +import ( + "context" + "database/sql" + "errors" + "fmt" + "regexp" + "slices" + "strings" + + "github.com/danyel/go-loose/internal/role" +) + +// Permission is one entry in the installation-wide catalog. The nine seeded by +// migration 0007 are the capabilities the console enforces; anything added later +// is grantable and reported to client applications but is not checked here, +// because nothing in the request path tests for it. +type Permission struct { + Name string `json:"name"` + Label string `json:"label"` + Description string `json:"description"` + System bool `json:"system"` + // RoleCount is how many roles currently grant it. A permission that no role + // grants can be removed again. + RoleCount int `json:"role_count"` + // Enforced reports whether the application itself checks for this + // permission. The console surfaces this so an operator is not misled into + // believing a custom capability is enforced. + Enforced bool `json:"enforced"` +} + +var ( + // ErrPermissionInUse is returned when a permission a role still grants is + // deleted. + ErrPermissionInUse = errors.New("permission is still granted by a role") + // ErrPermissionTaken is returned when a permission name already exists. + ErrPermissionTaken = errors.New("permission name is already in use") + // ErrPermissionSystem is returned when a built-in permission would be edited + // or deleted. + ErrPermissionSystem = errors.New("built-in permissions cannot be changed") +) + +// permissionName constrains a name to lowercase dotted words such as +// "reports.export". The database enforces the same shape. +var permissionName = regexp.MustCompile(`^[a-z0-9][a-z0-9]*(?:[.-][a-z0-9]+)*$`) + +// ValidPermissionName reports whether a name is well formed. +func ValidPermissionName(name string) bool { + return len(name) >= 3 && len(name) <= 100 && permissionName.MatchString(name) +} + +// ListPermissions returns the whole catalog, most sensitive first for the +// built-ins and alphabetically after them. +func (s *Store) ListPermissions(ctx context.Context) ([]Permission, error) { + rows, err := s.db.QueryContext(ctx, ` + SELECT p.name, p.label, p.description, p.is_system, + (SELECT count(*) FROM role_permissions rp WHERE rp.permission = p.name) + FROM permissions p + ORDER BY array_position(`+permissionOrder+`, p.name) NULLS LAST, p.name`) + if err != nil { + return nil, err + } + defer rows.Close() + result := make([]Permission, 0) + for rows.Next() { + var item Permission + if err := rows.Scan(&item.Name, &item.Label, &item.Description, &item.System, &item.RoleCount); err != nil { + return nil, err + } + item.Enforced = role.Permission(item.Name).Valid() + result = append(result, item) + } + return result, rows.Err() +} + +// CreatePermission adds a name to the catalog so that roles can grant it. +// Requires either a system administrator or tenants.manage, because the catalog +// is shared by every tenant rather than scoped to one. +func (s *Store) CreatePermission(ctx context.Context, actorID, name, label, description string) (Permission, error) { + name = strings.TrimSpace(name) + label = strings.TrimSpace(label) + description = strings.TrimSpace(description) + if !ValidPermissionName(name) { + return Permission{}, fmt.Errorf("%w: use lowercase words separated by dots", ErrUnknownPermission) + } + if label == "" || len(label) > 100 { + return Permission{}, fmt.Errorf("%w: label must be between 1 and 100 characters", ErrUnknownPermission) + } + if len(description) > 500 { + return Permission{}, fmt.Errorf("%w: description must be 500 characters or fewer", ErrUnknownPermission) + } + if role.Permission(name).Valid() { + // The name is one the application enforces; it is already seeded, so this + // can only be a duplicate. + return Permission{}, ErrPermissionTaken + } + permitted, err := s.mayAdministerCatalog(ctx, actorID) + if err != nil { + return Permission{}, err + } + if !permitted { + return Permission{}, ErrNotFound + } + item := Permission{Name: name, Label: label, Description: description, Enforced: false} + err = s.db.QueryRowContext(ctx, ` + INSERT INTO permissions(name, label, description) + VALUES ($1, $2, $3) + RETURNING name, label, description, is_system, + (SELECT count(*) FROM role_permissions rp WHERE rp.permission = permissions.name)`, + name, label, description). + Scan(&item.Name, &item.Label, &item.Description, &item.System, &item.RoleCount) + if isUniqueViolation(err) { + return Permission{}, ErrPermissionTaken + } + if err != nil { + return Permission{}, err + } + return item, nil +} + +// DeletePermission removes a catalog entry that no role grants. Built-in +// permissions are kept: the console enforces them and dropping one would leave a +// membership holding a capability nothing recognizes. +func (s *Store) DeletePermission(ctx context.Context, actorID, name string) error { + permitted, err := s.mayAdministerCatalog(ctx, actorID) + if err != nil { + return err + } + if !permitted { + return ErrNotFound + } + tx, err := s.db.BeginTx(ctx, nil) + if err != nil { + return err + } + defer tx.Rollback() + + var ( + label string + system bool + grants int + ) + err = tx.QueryRowContext(ctx, ` + SELECT label, is_system, + (SELECT count(*) FROM role_permissions rp WHERE rp.permission = permissions.name) + FROM permissions WHERE name = $1 FOR UPDATE`, name). + Scan(&label, &system, &grants) + if errors.Is(err, sql.ErrNoRows) { + return ErrNotFound + } + if err != nil { + return err + } + if system { + return ErrPermissionSystem + } + if grants > 0 { + return ErrPermissionInUse + } + if _, err := tx.ExecContext(ctx, `DELETE FROM permissions WHERE name = $1`, name); err != nil { + return err + } + return tx.Commit() +} + +// mayAdministerCatalog reports whether the actor may change the shared catalog. +// The catalog is installation-wide, so this is a system administrator or an owner +// of some tenant, which is the permission that already means "administer the +// installation". +func (s *Store) mayAdministerCatalog(ctx context.Context, actorID string) (bool, error) { + return mayAdministerCatalog(ctx, s.db, actorID) +} + +func mayAdministerCatalog(ctx context.Context, q querier, actorID string) (bool, error) { + var permitted bool + err := q.QueryRowContext(ctx, ` + SELECT EXISTS(SELECT 1 FROM system_administrators WHERE user_id = $1) + OR `+permissionPredicate("scoped.tenant_id", "$1", "$2"), + actorID, string(role.ManageTenants)).Scan(&permitted) + return permitted, err +} + +// grantablePermissions returns what an actor may hand to somebody: the +// permissions they hold, plus -- for whoever administers the shared catalog -- +// every custom permission. +// +// The second half is what makes the catalog usable. A permission nobody holds +// yet could not otherwise be granted, because the escalation guard refuses to +// hand out a capability the granter does not have. Letting the author of a +// permission pass it on resolves that without weakening the guard for enforced +// permissions, which are never in the custom set. +func grantablePermissions(ctx context.Context, q querier, actorID, tenantID string) ([]string, error) { + held, err := heldPermissions(ctx, q, actorID, tenantID) + if err != nil { + return nil, err + } + administers, err := mayAdministerCatalog(ctx, q, actorID) + if err != nil || !administers { + return held, err + } + rows, err := q.QueryContext(ctx, `SELECT name FROM permissions WHERE NOT is_system`) + if err != nil { + return nil, err + } + defer rows.Close() + for rows.Next() { + var name string + if err := rows.Scan(&name); err != nil { + return nil, err + } + if !slices.Contains(held, name) { + held = append(held, name) + } + } + return held, rows.Err() +} + +// permissionOrder lists the enforced capabilities so the catalog keeps the same +// most-sensitive-first order the role editor used before it was a table. +var permissionOrder = `ARRAY[ + 'tenants.manage', 'roles.manage', 'users.manage', 'applications.manage', + 'keys.manage', 'contracts.manage', 'users.read', 'console.read', 'profile.edit' +]` diff --git a/internal/store/permissions_integration_test.go b/internal/store/permissions_integration_test.go new file mode 100644 index 0000000..58679f7 --- /dev/null +++ b/internal/store/permissions_integration_test.go @@ -0,0 +1,224 @@ +package store_test + +import ( + "context" + "errors" + "testing" + + "github.com/danyel/go-loose/internal/role" + "github.com/danyel/go-loose/internal/store" +) + +func TestCatalogSeedsTheEnforcedPermissions(t *testing.T) { + s, _, ctx := integrationStore(t) + catalog, err := s.ListPermissions(ctx) + if err != nil { + t.Fatalf("list permissions: %v", err) + } + if len(catalog) != len(role.Permissions()) { + t.Fatalf("catalog has %d entries, want the %d seeded permissions", len(catalog), len(role.Permissions())) + } + for _, item := range catalog { + if !item.System { + t.Errorf("%q was not marked built in", item.Name) + } + if !item.Enforced { + t.Errorf("%q is seeded but not reported as enforced", item.Name) + } + if item.Label == "" { + t.Errorf("%q has no label", item.Name) + } + } + // The order the role editor renders is most sensitive first. + if catalog[0].Name != string(role.ManageTenants) { + t.Errorf("catalog starts with %q, want %q", catalog[0].Name, role.ManageTenants) + } +} + +func TestTenantCanAddAPermissionAndGrantIt(t *testing.T) { + s, _, ctx := integrationStore(t) + owner := newUser(t, s, ctx, "owner@example.test") + tenant := newTenant(t, s, ctx, owner, "nmbs").ID + + created, err := s.CreatePermission(ctx, owner, "reports.export", "Export reports", "Lets an app export reports.") + if err != nil { + t.Fatalf("create permission: %v", err) + } + if created.System { + t.Error("a permission added through the API must not be marked built in") + } + if created.Enforced { + t.Error("a custom permission cannot be enforced by the console") + } + + // It is immediately grantable, exactly like a built-in one. + if _, err := s.CreateRole(ctx, owner, tenant, "reporter", "Reporter", "", + []string{string(role.ReadConsole), "reports.export"}); err != nil { + t.Fatalf("grant a custom permission: %v", err) + } + + catalog, err := s.ListPermissions(ctx) + if err != nil { + t.Fatalf("list permissions: %v", err) + } + found := false + for _, item := range catalog { + if item.Name == "reports.export" { + found = true + if item.RoleCount != 1 { + t.Errorf("role_count = %d, want 1", item.RoleCount) + } + } + } + if !found { + t.Fatal("the new permission is missing from the catalog") + } +} + +func TestDeletingAPermissionInUseIsRefused(t *testing.T) { + s, _, ctx := integrationStore(t) + owner := newUser(t, s, ctx, "owner@example.test") + tenant := newTenant(t, s, ctx, owner, "nmbs").ID + + if _, err := s.CreatePermission(ctx, owner, "reports.export", "Export reports", ""); err != nil { + t.Fatalf("create permission: %v", err) + } + reporter, err := s.CreateRole(ctx, owner, tenant, "reporter", "Reporter", "", + []string{string(role.ReadConsole), "reports.export"}) + if err != nil { + t.Fatalf("create role: %v", err) + } + if err := s.DeletePermission(ctx, owner, "reports.export"); !errors.Is(err, store.ErrPermissionInUse) { + t.Fatalf("delete a granted permission = %v, want ErrPermissionInUse", err) + } + + // Once no role grants it, the delete goes through. + if _, err := s.UpdateRole(ctx, owner, reporter.ID, "Reporter", "", + []string{string(role.ReadConsole)}); err != nil { + t.Fatalf("drop the custom permission: %v", err) + } + if err := s.DeletePermission(ctx, owner, "reports.export"); err != nil { + t.Fatalf("delete an unused permission: %v", err) + } +} + +func TestBuiltInPermissionsCannotBeDeleted(t *testing.T) { + s, _, ctx := integrationStore(t) + owner := newUser(t, s, ctx, "owner@example.test") + newTenant(t, s, ctx, owner, "nmbs") + if err := s.DeletePermission(ctx, owner, string(role.ManageUsers)); !errors.Is(err, store.ErrPermissionSystem) { + t.Fatalf("delete a built-in permission = %v, want ErrPermissionSystem", err) + } +} + +func TestDuplicateAndMalformedPermissionsAreRejected(t *testing.T) { + s, _, ctx := integrationStore(t) + owner := newUser(t, s, ctx, "owner@example.test") + newTenant(t, s, ctx, owner, "nmbs") + + if _, err := s.CreatePermission(ctx, owner, "reports.export", "Export", ""); err != nil { + t.Fatalf("create permission: %v", err) + } + if _, err := s.CreatePermission(ctx, owner, "reports.export", "Export again", ""); !errors.Is(err, store.ErrPermissionTaken) { + t.Fatalf("duplicate permission = %v, want ErrPermissionTaken", err) + } + // A name the console already enforces cannot be redefined. + if _, err := s.CreatePermission(ctx, owner, string(role.ManageUsers), "Manage", ""); !errors.Is(err, store.ErrPermissionTaken) { + t.Fatalf("redefining a built-in = %v, want ErrPermissionTaken", err) + } + for _, name := range []string{"Reports.Export", "reports export", ".reports", "reports.", "", "ab"} { + if _, err := s.CreatePermission(ctx, owner, name, "Label", ""); err == nil { + t.Errorf("CreatePermission(%q) was accepted", name) + } + } +} + +// TestOnlyOwnersMayChangeTheSharedCatalog guards the fact that the catalog is +// installation-wide: a developer who may maintain their own tenant's members +// must not be able to add a capability every tenant can then grant. +func TestOnlyOwnersMayChangeTheSharedCatalog(t *testing.T) { + s, ctx, _, developer, _ := rolesFixture(t) + if _, err := s.CreatePermission(ctx, developer, "reports.export", "Export reports", ""); !errors.Is(err, store.ErrNotFound) { + t.Fatalf("developer adding a permission = %v, want ErrNotFound", err) + } + if err := s.DeletePermission(ctx, developer, string(role.ReadConsole)); !errors.Is(err, store.ErrNotFound) { + t.Fatalf("developer deleting a permission = %v, want ErrNotFound", err) + } +} + +func TestARoleCannotGrantAPermissionThatIsNotInTheCatalog(t *testing.T) { + s, ctx, owner, _, tenantID := rolesFixture(t) + _, err := s.CreateRole(ctx, owner, tenantID, "sneaky", "Sneaky", "", + []string{string(role.ReadConsole), "not.in.the.catalog"}) + if !errors.Is(err, store.ErrUnknownPermission) { + t.Fatalf("granting an unknown permission = %v, want ErrUnknownPermission", err) + } + // Nor can an existing role be edited to hold one. + if _, err := s.UpdateRole(ctx, owner, mustSystemRole(t, s, ctx, "viewer"), "Viewer", "", + []string{string(role.ReadConsole), "not.in.the.catalog"}); !errors.Is(err, store.ErrUnknownPermission) { + t.Fatalf("editing in an unknown permission = %v, want ErrUnknownPermission", err) + } +} + +// TestGrantingACustomPermissionNeedsTheRightAuthor documents the rule that makes +// the catalog usable without weakening the escalation guard. Whoever administers +// the catalog authored the permission, so they may pass it on even though nobody +// holds it yet; anybody else still needs to hold it first. +func TestGrantingACustomPermissionNeedsTheRightAuthor(t *testing.T) { + s, ctx, owner, developer, tenantID := rolesFixture(t) + if _, err := s.CreatePermission(ctx, owner, "reports.export", "Export reports", ""); err != nil { + t.Fatalf("create permission: %v", err) + } + + // The owner administers the catalog, so they can define a role granting it. + // The role also carries users.manage so that whoever ends up holding it is + // actually able to assign roles to somebody else. + created, err := s.CreateRole(ctx, owner, tenantID, "reporter", "Reporter", "", + []string{string(role.ReadConsole), string(role.ManageUsers), "reports.export"}) + if err != nil { + t.Fatalf("owner granting a custom permission: %v", err) + } + + // A developer administers members but not the catalog, and does not hold the + // permission, so they may not hand the role out. + member := addMember(t, s, ctx, owner, tenantID, "victim@example.test", "viewer") + if err := s.SetUserAccess(ctx, developer, tenantID, member, created.ID, nil); !errors.Is(err, store.ErrNotFound) { + t.Fatalf("developer assigning a role carrying an unheld custom permission = %v, want ErrNotFound", err) + } + // Nor may they mint an equivalent role of their own. + if _, err := s.CreateRole(ctx, developer, tenantID, "rogue", "Rogue", "", + []string{string(role.ReadConsole), string(role.ManageUsers), "reports.export"}); !errors.Is(err, store.ErrNotFound) { + t.Fatalf("developer minting a custom permission = %v, want ErrNotFound", err) + } + // A member who does hold it, and may manage members, may pass it on. + reporter := addMember(t, s, ctx, owner, tenantID, "reporter@example.test", "viewer") + if err := s.SetUserAccess(ctx, owner, tenantID, reporter, created.ID, nil); err != nil { + t.Fatalf("owner assigning the role: %v", err) + } + if err := s.SetUserAccess(ctx, reporter, tenantID, member, created.ID, nil); err != nil { + t.Fatalf("holder passing the permission on: %v", err) + } + + // Holding the permission is not enough on its own: a role without + // users.manage cannot assign anything. + readonly, err := s.CreateRole(ctx, owner, tenantID, "readonly-reporter", "Read only reporter", "", + []string{string(role.ReadConsole), "reports.export"}) + if err != nil { + t.Fatalf("create read-only role: %v", err) + } + if err := s.SetUserAccess(ctx, owner, tenantID, reporter, mustSystemRole(t, s, ctx, "viewer"), nil); err != nil { + t.Fatalf("move the reporter aside: %v", err) + } + if err := s.SetUserAccess(ctx, reporter, tenantID, member, readonly.ID, nil); !errors.Is(err, store.ErrNotFound) { + t.Fatalf("assigning without users.manage = %v, want ErrNotFound", err) + } +} + +func mustSystemRole(t *testing.T, s *store.Store, ctx context.Context, slug string) string { + t.Helper() + id, err := s.SystemRoleID(ctx, slug) + if err != nil { + t.Fatalf("look up %q: %v", slug, err) + } + return id +} diff --git a/internal/store/roles.go b/internal/store/roles.go index d317f5b..e10bbfa 100644 --- a/internal/store/roles.go +++ b/internal/store/roles.go @@ -36,9 +36,9 @@ var ( ErrRoleInUse = errors.New("role is still assigned to members") // ErrRoleSlugTaken is returned when a tenant already uses the requested slug. ErrRoleSlugTaken = errors.New("role slug is already in use") - // ErrUnknownPermission is returned when a role is defined with a permission - // outside the vocabulary. It is a caller mistake rather than a server fault, - // so callers report it as a bad request. + // ErrUnknownPermission is returned when a role or catalog entry names a + // permission that is not in the catalog. It is a caller mistake rather than a + // server fault, so callers report it as a bad request. ErrUnknownPermission = errors.New("unknown permission") ) @@ -143,25 +143,54 @@ func within(granted, held []string) bool { return true } -// normalizePermissions validates submitted permission names and returns them -// deduplicated in vocabulary order, so a role cannot be stored with an invented -// capability or an unstable order. -func normalizePermissions(permissions []string) ([]string, error) { +// normalizePermissions checks that every submitted name is in the catalog and +// returns them deduplicated in a stable order. Validation moved from the Go +// vocabulary to the database when permissions became rows, so a tenant-defined +// permission can be granted like any other while an invented one still cannot be +// stored. +func normalizePermissions(ctx context.Context, q querier, permissions []string) ([]string, error) { requested := make(map[string]bool, len(permissions)) for _, value := range permissions { - parsed, ok := role.Parse(value) - if !ok { - return nil, fmt.Errorf("%w: %q", ErrUnknownPermission, value) + name := strings.TrimSpace(value) + if name == "" { + continue } - requested[string(parsed)] = true + var known bool + if err := q.QueryRowContext(ctx, + `SELECT EXISTS(SELECT 1 FROM permissions WHERE name = $1)`, name).Scan(&known); err != nil { + return nil, err + } + if !known { + return nil, fmt.Errorf("%w: %q", ErrUnknownPermission, name) + } + requested[name] = true } + rows, err := q.QueryContext(ctx, ` + SELECT name FROM permissions + WHERE name = ANY($1) + ORDER BY array_position(`+permissionOrder+`, name) NULLS LAST, name`, keys(requested)) + if err != nil { + return nil, err + } + defer rows.Close() result := make([]string, 0, len(requested)) - for _, permission := range role.Permissions() { - if requested[string(permission)] { - result = append(result, string(permission)) + for rows.Next() { + var name string + if err := rows.Scan(&name); err != nil { + return nil, err } + result = append(result, name) } - return result, nil + return result, rows.Err() +} + +// keys returns the members of a set as a slice, for use as a SQL array parameter. +func keys(set map[string]bool) []string { + result := make([]string, 0, len(set)) + for name := range set { + result = append(result, name) + } + return result } // roleGrants reads a role's permissions. @@ -280,21 +309,28 @@ func roleByID(ctx context.Context, q querier, roleID string) (Role, error) { // CreateRole adds a tenant's own role. The caller must hold roles.manage and may // not mint a role more powerful than one they already hold. func (s *Store) CreateRole(ctx context.Context, actorID, tenantID, slug, name, description string, permissions []string) (Role, error) { - granted, err := normalizePermissions(permissions) - if err != nil { - return Role{}, err - } tx, err := s.db.BeginTx(ctx, nil) if err != nil { return Role{}, err } defer tx.Rollback() - - held, err := heldPermissions(ctx, tx, actorID, tenantID) + granted, err := normalizePermissions(ctx, tx, permissions) if err != nil { return Role{}, err } - if !within([]string{string(role.ManageRoles)}, held) || !within(granted, held) { + + permitted, err := hasPermission(ctx, tx, actorID, tenantID, role.ManageRoles) + if err != nil { + return Role{}, err + } + if !permitted { + return Role{}, ErrNotFound + } + grantable, err := grantablePermissions(ctx, tx, actorID, tenantID) + if err != nil { + return Role{}, err + } + if !within(granted, grantable) { return Role{}, ErrNotFound } created, err := insertRole(ctx, tx, tenantID, slug, name, description) @@ -316,15 +352,15 @@ func (s *Store) CreateRole(ctx context.Context, actorID, tenantID, slug, name, d // UpdateRole renames a role and replaces its permissions. Built-in roles are // immutable and a tenant may only edit a role it owns. func (s *Store) UpdateRole(ctx context.Context, actorID, roleID, name, description string, permissions []string) (Role, error) { - granted, err := normalizePermissions(permissions) - if err != nil { - return Role{}, err - } tx, err := s.db.BeginTx(ctx, nil) if err != nil { return Role{}, err } defer tx.Rollback() + granted, err := normalizePermissions(ctx, tx, permissions) + if err != nil { + return Role{}, err + } existing, err := lockRole(ctx, tx, roleID) if err != nil { @@ -333,11 +369,18 @@ func (s *Store) UpdateRole(ctx context.Context, actorID, roleID, name, descripti if existing.System || existing.TenantID == nil { return Role{}, ErrNotFound } - held, err := heldPermissions(ctx, tx, actorID, *existing.TenantID) + permitted, err := hasPermission(ctx, tx, actorID, *existing.TenantID, role.ManageRoles) if err != nil { return Role{}, err } - if !within([]string{string(role.ManageRoles)}, held) || !within(granted, held) { + if !permitted { + return Role{}, ErrNotFound + } + grantable, err := grantablePermissions(ctx, tx, actorID, *existing.TenantID) + if err != nil { + return Role{}, err + } + if !within(granted, grantable) { return Role{}, ErrNotFound } if _, err := tx.ExecContext(ctx, ` @@ -379,11 +422,18 @@ func (s *Store) DeleteRole(ctx context.Context, actorID, roleID string) error { if err != nil { return err } - held, err := heldPermissions(ctx, tx, actorID, *existing.TenantID) + permitted, err := hasPermission(ctx, tx, actorID, *existing.TenantID, role.ManageRoles) if err != nil { return err } - if !within([]string{string(role.ManageRoles)}, held) || !within(permissions, held) { + if !permitted { + return ErrNotFound + } + grantable, err := grantablePermissions(ctx, tx, actorID, *existing.TenantID) + if err != nil { + return err + } + if !within(permissions, grantable) { return ErrNotFound } if existing.MemberCount > 0 { diff --git a/internal/store/store.go b/internal/store/store.go index dd55116..dfd194a 100644 --- a/internal/store/store.go +++ b/internal/store/store.go @@ -15,6 +15,9 @@ import ( var ErrNotFound = errors.New("not found") +// ErrTenantSlugTaken is returned when a tenant already uses the requested slug. +var ErrTenantSlugTaken = errors.New("tenant slug is already in use") + type Store struct { db *sql.DB } @@ -129,13 +132,21 @@ func (s *Store) Bootstrap(ctx context.Context, userID, tenantSlug, appSlug strin if err != nil { return err } + // Ownership is granted only while the tenant still has none. The condition is + // about owners rather than about members: the installer's demonstration seed + // creates tenants that already hold administrators, and refusing ownership + // there would leave a local administrator bootstrapped afterwards with an + // account that can never reach the console. A tenant that already has an owner + // is still never taken over by a later bootstrap. if _, err = tx.ExecContext(ctx, ` INSERT INTO memberships(tenant_id, user_id, role_id) SELECT $1, $2, r.id FROM roles r WHERE r.slug = $3 AND r.tenant_id IS NULL - AND (NOT EXISTS (SELECT 1 FROM memberships WHERE tenant_id = $1) - OR EXISTS (SELECT 1 FROM memberships WHERE tenant_id = $1 AND user_id = $2)) + AND NOT EXISTS ( + SELECT 1 FROM memberships m + JOIN roles held ON held.id = m.role_id + WHERE m.tenant_id = $1 AND held.slug = 'owner') ON CONFLICT DO NOTHING`, tenantID, userID, "owner"); err != nil { return err } @@ -198,6 +209,11 @@ func (s *Store) CreateTenant(ctx context.Context, userID, slug, name string) (Te var tenant Tenant err = tx.QueryRowContext(ctx, `INSERT INTO tenants(slug, name) VALUES ($1, $2) RETURNING id, slug, name`, slug, name). Scan(&tenant.ID, &tenant.Slug, &tenant.Name) + if isUniqueViolation(err) { + // Reporting this as a generic failure would surface a 500 for what is an + // ordinary mistake, and the console has no way to explain it. + return Tenant{}, ErrTenantSlugTaken + } if err != nil { return Tenant{}, err } diff --git a/web/account.js b/web/account.js new file mode 100644 index 0000000..9e65a94 --- /dev/null +++ b/web/account.js @@ -0,0 +1,132 @@ +// The header account control. +// +// One component, mounted into every page by the placeholder below it, so the +// identity and the two things a person can do about their own account live +// together. It replaced a separate sign-out button, which meant the header showed +// two controls describing one fact. +// +// The menu is rendered here rather than duplicated into each page's markup so that +// the keyboard handling, the outside-click behaviour and the sign-out form exist +// once. The trade is one small request for the profile, which the pages that show a +// tenant context were making anyway. +// +// The sign-out item is a real form posting to /auth/logout rather than a fetch, so +// signing out works without JavaScript and cannot be triggered by a stray +// cross-site request: the endpoint only accepts POST. +// +// Everything is wrapped in an IIFE and exposed only as window.mountAccountMenu. +// These are classic scripts sharing one global scope, so a top-level const here +// would collide with the escapeHTML and initials that each page already declares, +// and the collision is a SyntaxError that stops the whole script before it runs. + +(function () { + const escapeHTML = value => String(value ?? '').replace(/[&<>"']/g, character => ({ + '&': '&', + '<': '<', + '>': '>', + '"': '"', + "'": ''' + }[character])); + + const initials = name => String(name || '?') + .split(/[\s@._-]+/) + .filter(Boolean) + .slice(0, 2) + .map(part => part[0].toUpperCase()) + .join('') || '?'; + + async function loadProfile() { + const response = await fetch('/api/v1/profile', { + credentials: 'same-origin', + headers: {accept: 'application/json'} + }); + if (response.status === 401) { + // Signed out: the page itself will redirect, so there is nothing to show. + return null + } + if (!response.ok) return null; + return response.json() + } + + // Mounts the control into a placeholder element. Exported on window because the + // pages load their own script and there is no module loader here; the alternative + // would be repeating this markup and this wiring in every page. + function mount(host) { + if (!host || host.dataset.mounted === 'true') return; + host.dataset.mounted = 'true'; + host.classList.add('account'); + host.innerHTML = ` + +
`; + + const trigger = host.querySelector('.account-trigger'); + const menu = host.querySelector('.account-menu'); + const note = host.querySelector('.account-note'); + + const setOpen = open => { + menu.hidden = !open; + trigger.setAttribute('aria-expanded', String(open)); + }; + + trigger.addEventListener('click', event => { + event.stopPropagation(); + setOpen(menu.hidden) + }); + + // Escape closes and returns focus, which is the one keyboard path a menu has to + // get right: without it the menu is a trap for anyone not using a mouse. + document.addEventListener('keydown', event => { + if (event.key !== 'Escape' || menu.hidden) return; + setOpen(false); + trigger.focus() + }); + + // A click anywhere else dismisses it. Capture phase, so a click that also + // dismisses a dialog underneath does not race this. + document.addEventListener('click', () => setOpen(false), true); + + loadProfile().then(profile => { + if (!profile) { + // No session: leave the control hidden rather than showing an empty name. + return + } + const name = profile.display_name || profile.email || ''; + // The trigger and the menu both carry the name. Filling only the menu + // leaves the header showing a picture and a caret with no name beside + // them, which is the one thing the control exists to say. + host.querySelector('.account-name').textContent = name; + host.querySelector('.account-display-name').textContent = name; + host.querySelector('.account-email').textContent = profile.email || ''; + const slot = host.querySelector('.account-avatar-slot'); + slot.innerHTML = profile.avatar_url + ? `` + : `${escapeHTML(initials(name))}`; + trigger.hidden = false; + + // Only explain the cross-application effect when it is true. A person with + // no hosted-login sessions has nothing to sign out of elsewhere. + const usesHostedLogin = (profile.memberships || []).length > 0; + note.hidden = !usesHostedLogin + }) + }; + + window.mountAccountMenu = mount + + document.addEventListener('DOMContentLoaded', () => { + document.querySelectorAll('[data-account-menu]').forEach(mount) + }) +})() \ No newline at end of file diff --git a/web/app.js b/web/app.js index 462ba3e..41619c2 100644 --- a/web/app.js +++ b/web/app.js @@ -46,7 +46,6 @@ async function load() { Object.assign(state, data); if (!state.tenants.some(tenant => tenant.id === state.selectedTenant)) state.selectedTenant = state.tenants[0]?.id || ''; await loadRoles(); - renderIdentity(); render(); } @@ -67,18 +66,6 @@ async function loadRoles() { } } -function renderIdentity() { - const profile = state.profile || {}; - $('#identity-name').textContent = profile.display_name || profile.email || ''; - const image = $('#identity-avatar'); - if (profile.avatar_url) { - image.src = profile.avatar_url; - image.hidden = false - } else { - image.hidden = true; - image.removeAttribute('src') - } -} // assignableRoles is what the invite and access dialogs may offer: the server // refuses to hand out a role more powerful than the caller's own, so offering @@ -111,12 +98,12 @@ function render() { $('#user-count').textContent = tenantUsers.length + state.pending_users.length; $('#tenant-context').innerHTML = state.tenants.map(item => ``).join(''); $('#new-tenant').hidden = !state.is_system_administrator; - $('#tenant-list').innerHTML = state.tenants.map(item => `
${escapeHTML(item.role)}

${escapeHTML(item.name)}

${escapeHTML(item.slug)}

Tenant${escapeHTML(item.id.slice(0, 8))}
`).join('') || empty('No tenants yet'); - $('#app-list').innerHTML = tenantApps.map(item => `
${escapeHTML(item.tenant_slug)}

${escapeHTML(item.name)}

${escapeHTML(item.description || 'No description')}

${item.client_ready ? 'Client login ready' : 'Client login not configured'}${escapeHTML(item.client_id)}
${canManageApplications ? `` : ''}
`).join('') || empty('No applications yet'); - $('#key-list').innerHTML = tenantKeys.map(item => `${escapeHTML(item.name)}${escapeHTML(apps.get(item.application_id)?.name || '—')}${escapeHTML(item.prefix)}…${escapeHTML(item.status)}${date(item.last_used_at)}${canManageKeys && item.status === 'active' ? `` : ''}`).join('') || rowEmpty(6, 'No keys issued'); + $('#tenant-list').innerHTML = state.tenants.map(item => `
${escapeHTML(item.role)}

${escapeHTML(item.name)}

${metaRow('Slug', item.slug)}${metaRow('Identifier', item.id.slice(0, 8), item.id)}
`).join('') || empty('No tenants yet'); + $('#app-list').innerHTML = tenantApps.map(item => `
${escapeHTML(item.tenant_slug)}

${escapeHTML(item.name)}

${escapeHTML(item.description || 'No description')}

${metaRow('Client login', item.client_ready ? 'Ready' : 'Not configured')}${item.client_id ? metaRow('Client ID', item.client_id, item.client_id) : ''}
${canManageApplications ? `` : ''}
`).join('') || empty('No applications yet'); + $('#key-list').innerHTML = tenantKeys.map(item => `${escapeHTML(item.name)}${escapeHTML(apps.get(item.application_id)?.name || '—')}${escapeHTML(item.prefix)}…${escapeHTML(item.status)}${date(item.last_used_at)}
${canManageKeys && item.status === 'active' ? `` : ''}
`).join('') || rowEmpty(6, 'No keys issued'); $('#contract-list').innerHTML = tenantContracts.map(item => `${escapeHTML(apps.get(item.application_id)?.name || '—')}${escapeHTML(item.version)}${item.endpoint_count}${item.source_url ? `source` : 'Pasted'}${date(item.created_at)}`).join('') || rowEmpty(5, 'No contracts imported'); - const pending = state.is_system_administrator ? state.pending_users.map(item => `${escapeHTML(item.display_name)}
${escapeHTML(item.email)}Waiting room—pending0`).join('') : ''; - $('#user-list').innerHTML = tenantUsers.map(item => `${avatarCell(item)}${escapeHTML(item.display_name)}
${escapeHTML(item.email)}${escapeHTML(state.tenants.find(t => t.id === item.tenant_id)?.name || '—')}${escapeHTML(roleLabel(item.role_id) || item.role)}${escapeHTML(item.status)}${item.application_ids.length}${canManageUsers ? `` : ''}`).join('') + pending || rowEmpty(6, 'No users'); + const pending = state.is_system_administrator ? state.pending_users.map(item => `${escapeHTML(item.display_name)}
${escapeHTML(item.email)}Waiting room—pending0
`).join('') : ''; + $('#user-list').innerHTML = tenantUsers.map(item => `${avatarCell(item)}${escapeHTML(item.display_name)}
${escapeHTML(item.email)}${escapeHTML(state.tenants.find(t => t.id === item.tenant_id)?.name || '—')}${escapeHTML(roleLabel(item.role_id) || item.role)}${escapeHTML(item.status)}${item.application_ids.length}
${canManageUsers ? `` : ''}
`).join('') + pending || rowEmpty(6, 'No users'); renderRoleOptions(); $$('[data-tenant-application-action]').forEach(element => element.hidden = !canManageApplications); $$('[data-tenant-key-action]').forEach(element => element.hidden = !canManageKeys); @@ -144,6 +131,12 @@ function renderRoleOptions() { } const empty = text => `

${text}

`; +// One labelled pair in a card's footer. The value is the half that can be long -- +// a client identifier runs to forty-odd characters -- so it is the half allowed to +// shrink and be truncated, with the whole value kept in the title for anyone who +// needs to copy it. +const metaRow = (label, value, title = value) => + `
${escapeHTML(label)}${escapeHTML(value)}
`; const initials = name => String(name || '?').split(/[\s@._-]+/).filter(Boolean).slice(0, 2).map(part => part[0].toUpperCase()).join('') || '?'; const avatarCell = item => item.avatar_url ? `` @@ -292,19 +285,16 @@ function showSecret(title, description, secret) { $('#secret-dialog').showModal() } -const theme = $('#theme'), mode = $('#mode'); -theme.value = localStorage.getItem('gl-theme') || 'tokyo'; -document.documentElement.dataset.theme = theme.value; -document.documentElement.dataset.mode = localStorage.getItem('gl-mode') || 'dark'; -theme.addEventListener('change', () => { - document.documentElement.dataset.theme = theme.value; - localStorage.setItem('gl-theme', theme.value) -}); -mode.addEventListener('click', () => { - const next = document.documentElement.dataset.mode === 'dark' ? 'light' : 'dark'; - document.documentElement.dataset.mode = next; - localStorage.setItem('gl-mode', next) -}); +// The palette and appearance controls are the components shipped by the theme +// service, which own data-theme and data-mode on . This file used to drive a +// - - - -
+ + + +
@@ -92,6 +99,12 @@

Manage user access

Applications

Secret issued

This secret is shown once. Copy it now.

 + + + diff --git a/web/install.html b/web/install.html index 45a29e1..af29746 100644 --- a/web/install.html +++ b/web/install.html @@ -8,16 +8,17 @@

FIRST-RUN INSTALLER

Initialize
Go Loose.

-

Configure Google identity and optionally create the Guess demonstration tenants. The client secret is encrypted before it reaches PostgreSQL.

+

Configure OIDC identity provider and optionally create the Guess demonstration tenants. The client secret is encrypted before it reaches PostgreSQL.

- - - + + + +
-

In Google Cloud Console, add the callback URL above under Authorized redirect URIs. After installation you will continue to Google, then return to Go Loose with a secure signed session.

+

In your identity provider console, add the redirect URL above under Authorized redirect URIs. After installation you will continue to the provider, then return to Go Loose with a secure signed session.

diff --git a/web/openapi.json b/web/openapi.json index 2689a8f..1b4655d 100644 --- a/web/openapi.json +++ b/web/openapi.json @@ -94,16 +94,30 @@ }, "PermissionValue": { "type": "string", - "description": "The closed vocabulary of capabilities a role may grant. Mirrors internal/role and the role_permissions check constraint.", - "enum": ["tenants.manage", "roles.manage", "users.manage", "applications.manage", "keys.manage", "contracts.manage", "users.read", "console.read", "profile.edit"] + "description": "The name of a catalog entry, such as users.manage or reports.export. Names are rows in the permission catalog, so an installation may add its own; the nine seeded ones are the capabilities the console enforces.", + "pattern": "^[a-z0-9][a-z0-9]*(\\.[a-z0-9]+)*$", + "maxLength": 100 }, - "PermissionEntry": { + "Permission": { "type": "object", - "description": "A permission with the label and description the console renders.", + "description": "An entry in the installation-wide permission catalog.", + "required": ["name", "label", "enforced"], "properties": { - "value": {"$ref": "#/components/schemas/PermissionValue"}, - "label": {"type": "string"}, - "description": {"type": "string"} + "name": {"$ref": "#/components/schemas/PermissionValue"}, + "label": {"type": "string", "maxLength": 100}, + "description": {"type": "string", "maxLength": 500}, + "system": {"type": "boolean", "description": "True for the seeded capabilities, which cannot be deleted or renamed."}, + "enforced": {"type": "boolean", "description": "True when the console itself checks for this permission, so granting it changes what the console allows. False for a permission added through the API: it is reported to client applications but nothing here tests for it."}, + "role_count": {"type": "integer", "description": "Roles currently granting it. A permission that a role still grants cannot be deleted."} + } + }, + "PermissionRequest": { + "type": "object", + "required": ["name", "label"], + "properties": { + "name": {"$ref": "#/components/schemas/PermissionValue"}, + "label": {"type": "string", "minLength": 1, "maxLength": 100}, + "description": {"type": "string", "maxLength": 500} } }, "RoleRequest": { @@ -114,7 +128,8 @@ "slug": {"type": "string", "pattern": "^[a-z0-9][a-z0-9-]{0,62}$", "description": "Required when creating, and fixed for the life of the role."}, "name": {"type": "string", "minLength": 1, "maxLength": 100}, "description": {"type": "string", "maxLength": 500}, - "permissions": {"type": "array", "items": {"$ref": "#/components/schemas/PermissionValue"}} + "permissions": {"type": "array", "items": {"$ref": "#/components/schemas/PermissionValue"}, + "description": "Names from the permission catalog. An unknown name is rejected with 400."} } } } @@ -364,7 +379,7 @@ "post": { "tags": ["Role Management"], "summary": "Define a role for a tenant", - "description": "Requires roles.manage in the tenant. The role may not grant a permission the caller does not already hold, so an administrator cannot mint their way above their own authority.", + "description": "Requires roles.manage in the tenant. The role may not grant an enforced permission the caller does not already hold, so an administrator cannot mint their way above their own authority. Whoever administers the catalog may also grant the custom permissions they added, since nobody holds those yet.", "security": [{"session": []}], "requestBody": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/RoleRequest"}}}}, "responses": {"201": {"description": "Role created", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Role"}}}}, "400": {"description": "Malformed slug or name, or an unknown permission"}, "404": {"description": "The caller does not hold roles.manage, or the role would exceed their authority"}, "409": {"description": "The slug is already used in this tenant"}} @@ -388,6 +403,32 @@ "responses": {"204": {"description": "Role deleted"}, "404": {"description": "Unknown role, a built-in role, or a role belonging to another tenant"}, "409": {"description": "The role still has members"}} } }, + "/api/v1/permissions": { + "get": { + "tags": ["Role Management"], + "summary": "List the permission catalog", + "description": "Every management session may read it, because the role editor renders its checkboxes from this list.", + "security": [{"session": []}], + "responses": {"200": {"description": "Catalog", "content": {"application/json": {"schema": {"type": "object", "properties": {"permissions": {"type": "array", "items": {"$ref": "#/components/schemas/Permission"}}}}}}}} + }, + "post": { + "tags": ["Role Management"], + "summary": "Add a permission to the catalog", + "description": "Requires a system administrator or tenants.manage, because the catalog is shared by every tenant. The new name becomes grantable in any role and is reported through /connect/userinfo, but nothing in the console checks for it, so it cannot unlock console behaviour.", + "security": [{"session": []}], + "requestBody": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/PermissionRequest"}}}}, + "responses": {"201": {"description": "Permission added", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Permission"}}}}, "400": {"description": "Malformed name or label"}, "404": {"description": "The caller may not administer the catalog"}, "409": {"description": "The name is already in the catalog, including a seeded one"}} + } + }, + "/api/v1/permissions/{name}": { + "delete": { + "tags": ["Role Management"], + "summary": "Delete a permission that no role grants", + "security": [{"session": []}], + "parameters": [{"in": "path", "name": "name", "required": true, "schema": {"$ref": "#/components/schemas/PermissionValue"}}], + "responses": {"204": {"description": "Permission deleted"}, "400": {"description": "Malformed name"}, "404": {"description": "Unknown permission or the caller may not administer the catalog"}, "409": {"description": "A role still grants it, or it is one of the seeded capabilities"}} + } + }, "/roles": { "get": { "tags": ["Role Management"], diff --git a/web/profile.html b/web/profile.html index f8821cd..bce81dc 100644 --- a/web/profile.html +++ b/web/profile.html @@ -6,6 +6,7 @@ Go Loose · Profile +
@@ -15,11 +16,9 @@ Console API docs Roles - - -
+ + +
@@ -75,6 +74,8 @@ + + \ No newline at end of file diff --git a/web/profile.js b/web/profile.js index f90accf..60a253c 100644 --- a/web/profile.js +++ b/web/profile.js @@ -149,18 +149,7 @@ function readAsDataURL(file) { }) } -const theme = $('#theme'); -theme.value = localStorage.getItem('gl-theme') || 'tokyo'; -document.documentElement.dataset.theme = theme.value; -document.documentElement.dataset.mode = localStorage.getItem('gl-mode') || 'dark'; -theme.addEventListener('change', () => { - document.documentElement.dataset.theme = theme.value; - localStorage.setItem('gl-theme', theme.value) -}); -$('#mode').addEventListener('click', () => { - const next = document.documentElement.dataset.mode === 'dark' ? 'light' : 'dark'; - document.documentElement.dataset.mode = next; - localStorage.setItem('gl-mode', next) -}); +// The palette and appearance controls are the components shipped by the theme +// service. See the note in app.js for why this file no longer drives them. load().catch(error => notice(error.message, true)); \ No newline at end of file diff --git a/web/roles.html b/web/roles.html index 7ec70c2..8cee3c5 100644 --- a/web/roles.html +++ b/web/roles.html @@ -6,6 +6,7 @@ Go Loose · Roles +
@@ -15,12 +16,9 @@ Console API docs - - - -
+ + +
@@ -47,6 +45,20 @@
Assignable to you—
+
+
+

CATALOG

Permissions

+ +
+
+ + + +
PermissionNameWhat it allowsEnforcedRoles
+
+

Every role can grant any name on this list. The nine marked enforced are the ones this application checks before it acts, so granting one changes what the console lets you do. A permission you add here is reported to client applications through /connect/userinfo, which can then enforce it themselves, but no part of this console tests for it.

+
+

PERMISSION CATALOG

Roles

@@ -62,12 +74,9 @@
-

VOCABULARY

Permissions

-
- - - -
PermissionWhat it allows
+

HOW THEY ARE USED

Reading a permission

+
+

A membership resolves to exactly one role, and that role resolves to a set of permissions. Every tenant-scoped statement asks the database whether the caller holds the permission it needs, so a tenant-defined role is enforced the same way a built-in one is. Assigning a role only succeeds when every permission it grants is one you already hold, which is what stops handing out a role from becoming a way to gain authority.

@@ -85,6 +94,19 @@ + +
+

Add permission

+ + + +

This becomes selectable in every role. Nothing in this console checks for it; it is reported to client applications, which can enforce it themselves.

+ +
+ + + + diff --git a/web/roles.js b/web/roles.js index ecc40e0..2c2b6dd 100644 --- a/web/roles.js +++ b/web/roles.js @@ -31,28 +31,24 @@ async function api(path, options = {}) { return body } +async function loadPermissions() { + try { + state.permissions = (await api('/api/v1/permissions')).permissions + } catch (error) { + notice('You do not have permission to read the permission catalog.', true) + } +} + async function load() { const dashboard = await api('/api/v1/dashboard'); state.tenants = dashboard.tenants; - state.permissions = dashboard.permissions || []; if (!state.tenants.some(tenant => tenant.id === state.selectedTenant)) state.selectedTenant = state.tenants[0]?.id || ''; - renderIdentity(dashboard.profile); - await loadRoles(); + // Roles and the permission catalog are fetched from their own endpoints so + // that changing either does not need the whole dashboard reloaded. + await Promise.all([loadRoles(), loadPermissions()]); render() } -function renderIdentity(profile) { - profile = profile || {}; - $('#identity-name').textContent = profile.display_name || profile.email || ''; - const image = $('#identity-avatar'); - if (profile.avatar_url) { - image.src = profile.avatar_url; - image.hidden = false - } else { - image.hidden = true; - image.removeAttribute('src') - } -} async function loadRoles() { if (!state.selectedTenant) { @@ -72,6 +68,9 @@ function selectedTenant() { } const canManageRoles = () => Boolean(selectedTenant()?.permissions?.includes('roles.manage')); +// The catalog is shared by every tenant, so changing it needs tenants.manage +// rather than roles.manage. +const canAdministerCatalog = () => Boolean(state.tenants.some(tenant => tenant.permissions?.includes('tenants.manage'))); function render() { const tenant = selectedTenant(); @@ -86,6 +85,7 @@ function render() { $('#stat-custom').textContent = custom.length; $('#stat-assignable').textContent = state.roles.filter(item => item.assignable).length; $('#new-role').hidden = !canManageRoles(); + $('#new-permission').hidden = !canAdministerCatalog(); $('#role-list').innerHTML = state.roles.map(item => ` ${escapeHTML(item.name)}${item.system ? ' built-in' : ''}
${escapeHTML(item.description || 'No description')} @@ -93,20 +93,24 @@ function render() { ${item.permissions.map(permission => `${escapeHTML(permission)}`).join('') || 'None'} ${item.member_count} ${item.assignable ? 'Yes' : 'No'} - ${item.system ? '' : canManageRoles() ? `` : ''} +
${item.system ? '' : canManageRoles() ? `` : ''}
`).join('') || 'No roles available for this tenant.'; $('#permission-list').innerHTML = state.permissions.map(item => ` - ${escapeHTML(item.value)} - ${escapeHTML(item.description)} - `).join('') + ${escapeHTML(item.label)}${item.system ? ' built-in' : ''} + ${escapeHTML(item.name)} + ${escapeHTML(item.description || 'No description')} + ${item.enforced ? 'Yes' : 'No'} + ${item.role_count} +
${item.system || !canAdministerCatalog() ? '' : ``}
+ `).join('') || 'No permissions in the catalog.' } function permissionCheckboxes(selected) { const held = new Set(selected || []); $('#role-permissions').innerHTML = state.permissions.map(item => ``).join('') } @@ -130,6 +134,29 @@ function openDialog(item) { } $('#new-role').addEventListener('click', () => openDialog(null)); +$('#new-permission').addEventListener('click', () => $('#permission-dialog').showModal()); + +$('#permission-form').addEventListener('submit', async event => { + event.preventDefault(); + const form = event.target; + try { + await api('/api/v1/permissions', { + method: 'POST', + body: JSON.stringify({ + name: form.name.value.trim(), + label: form.label.value.trim(), + description: form.description.value.trim() + }) + }); + form.closest('dialog').close(); + form.reset(); + notice('Permission added to the catalog'); + await loadPermissions(); + render() + } catch (error) { + notice(error.message, true) + } +}); $$('.close').forEach(button => button.addEventListener('click', () => button.closest('dialog').close())); $('#role-form').addEventListener('submit', async event => { @@ -160,6 +187,19 @@ document.addEventListener('click', async event => { openDialog(state.roles.find(item => item.id === edit)); return } + const removePermission = event.target.dataset.deletePermission; + if (removePermission) { + if (!confirm(`Delete the permission "${removePermission}"?`)) return; + try { + await api(`/api/v1/permissions/${encodeURIComponent(removePermission)}`, {method: 'DELETE'}); + notice('Permission deleted'); + await loadPermissions(); + render() + } catch (error) { + notice(error.message, true) + } + return + } const remove = event.target.dataset.delete; if (remove) { const item = state.roles.find(role => role.id === remove); @@ -175,19 +215,8 @@ document.addEventListener('click', async event => { } }); -const theme = $('#theme'); -theme.value = localStorage.getItem('gl-theme') || 'tokyo'; -document.documentElement.dataset.theme = theme.value; -document.documentElement.dataset.mode = localStorage.getItem('gl-mode') || 'dark'; -theme.addEventListener('change', () => { - document.documentElement.dataset.theme = theme.value; - localStorage.setItem('gl-theme', theme.value) -}); -$('#mode').addEventListener('click', () => { - const next = document.documentElement.dataset.mode === 'dark' ? 'light' : 'dark'; - document.documentElement.dataset.mode = next; - localStorage.setItem('gl-mode', next) -}); +// The palette and appearance controls are the components shipped by the theme +// service. See the note in app.js for why this file no longer drives them. $('#tenant-context').addEventListener('change', async event => { state.selectedTenant = event.target.value; await loadRoles(); diff --git a/web/style.css b/web/style.css index f1d6351..a21a772 100644 --- a/web/style.css +++ b/web/style.css @@ -9,7 +9,7 @@ *{box-sizing:border-box}html{background:var(--bg);color:var(--text);font-family:Inter,ui-sans-serif,system-ui,sans-serif}body{margin:0;min-height:100vh;background:radial-gradient(circle at 70% -10%,color-mix(in srgb,var(--accent2) 13%,transparent),transparent 35%),var(--bg)}button,input,textarea,select{font:inherit}.noise{position:fixed;inset:0;pointer-events:none;opacity:.025;background-image:url("data:image/svg+xml,%3Csvg viewBox='0 0 180 180' xmlns='http://www.w3.org/2000/svg'%3E%3Cfilter id='n'%3E%3CfeTurbulence type='fractalNoise' baseFrequency='.9' numOctaves='3'/%3E%3C/filter%3E%3Crect width='100%25' height='100%25' filter='url(%23n)'/%3E%3C/svg%3E")} .docs-page{background-color: white}header{height:72px;border-bottom:1px solid var(--border);display:flex;align-items:center;justify-content:space-between;padding:0 max(24px,5vw);background:color-mix(in srgb,var(--bg) 85%,transparent);backdrop-filter:blur(16px);position:sticky;top:0;z-index:20}.brand{display:flex;align-items:center;gap:12px;color:var(--text);font-weight:750;text-decoration:none;letter-spacing:-.02em}.brand-mark{display:grid;place-items:center;width:34px;height:34px;border:1px solid var(--accent);color:var(--accent);font:700 12px ui-monospace,monospace;clip-path:polygon(10% 0,100% 0,100% 75%,75% 100%,0 100%,0 10%)}nav{display:flex;align-items:center;gap:18px}nav a{color:var(--muted);text-decoration:none;font-size:14px}nav form{margin:0}.compact{display:flex;align-items:center;gap:7px;font-size:12px;color:var(--muted)}select,input,textarea{color:var(--text);background:var(--surface2);border:1px solid var(--border);border-radius:7px;padding:10px 12px;outline:none}select:focus,input:focus,textarea:focus{border-color:var(--accent);box-shadow:0 0 0 3px color-mix(in srgb,var(--accent) 15%,transparent)}.compact select{padding:6px}.icon-button,.ghost{padding:7px 10px;background:transparent;border:1px solid var(--border);color:var(--text);border-radius:7px}.identity{font-size:13px;color:var(--accent)} main{width:min(1400px,92vw);margin:0 auto 80px}.hero{min-height:330px;display:flex;align-items:center;justify-content:space-between;gap:60px;border-bottom:1px solid var(--border)}.eyebrow{font:700 11px ui-monospace,monospace;letter-spacing:.16em;color:var(--accent);margin:0 0 12px}.hero h1{font-size:clamp(44px,5vw,74px);line-height:.94;letter-spacing:-.055em;margin:0}.hero h1 span{color:var(--accent2)}.lede{max-width:680px;color:color-mix(in srgb,var(--text) 70%,transparent);font-size:17px;line-height:1.7}.status-card{min-width:320px;background:linear-gradient(145deg,var(--surface),var(--surface2));border:1px solid var(--border);border-radius:14px;padding:22px;box-shadow:0 20px 60px var(--shadow);display:grid;grid-template-columns:auto 1fr;gap:12px;align-items:center}.status-card span{display:block;color:var(--good);font-size:12px;margin-top:4px}.status-card code{grid-column:1/-1;background:var(--bg);padding:12px;border-radius:7px;color:var(--muted)}.pulse{width:10px;height:10px;border-radius:50%;background:var(--good);box-shadow:0 0 0 6px color-mix(in srgb,var(--good) 14%,transparent)} -.stats{display:grid;grid-template-columns:repeat(5,1fr);gap:1px;background:var(--border);border:1px solid var(--border);margin:34px 0;overflow:hidden;border-radius:12px}.stats article{background:var(--surface);padding:20px 24px}.stats span{display:block;color:var(--muted);font-size:12px;text-transform:uppercase;letter-spacing:.1em}.stats strong{display:block;font-size:30px;margin-top:6px}.workspace{display:grid;grid-template-columns:190px 1fr;gap:28px}.workspace aside{display:flex;flex-direction:column;gap:6px}.tab{border:0;border-left:2px solid transparent;background:transparent;color:var(--muted);padding:13px;text-align:left;font:600 12px ui-monospace,monospace}.tab span{font-family:Inter,system-ui;margin-left:9px}.tab.active{color:var(--accent);border-color:var(--accent);background:color-mix(in srgb,var(--accent) 8%,transparent)}.panel{display:none}.panel.active{display:block}.panel-head{display:flex;align-items:end;justify-content:space-between;margin-bottom:20px}.panel h2{font-size:32px;letter-spacing:-.035em;margin:0}.panel-head button,dialog button[type=submit],.terminal-login,.card-action{background:var(--accent);color:var(--bg);font-weight:750;border:0;padding:11px 16px;border-radius:7px;cursor:pointer}.card-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(280px,1fr));gap:14px}.card{background:var(--surface);border:1px solid var(--border);border-radius:10px;padding:20px}.card h3{margin:0 0 5px}.card p{color:color-mix(in srgb,var(--text) 62%,transparent);min-height:24px}.card-action{margin-top:16px;width:100%;background:color-mix(in srgb,var(--accent) 14%,var(--surface));color:var(--accent);border:1px solid color-mix(in srgb,var(--accent) 45%,var(--border))}.badge{font:700 10px ui-monospace,monospace;text-transform:uppercase;color:var(--accent);background:color-mix(in srgb,var(--accent) 10%,transparent);padding:5px 7px;border-radius:5px}.meta{display:flex;justify-content:space-between;margin-top:18px;color:var(--muted);font-size:12px}.table-wrap{overflow-x:auto;background:var(--surface);border:1px solid var(--border);border-radius:10px}table{border-collapse:collapse;width:100%;font-size:13px}th,td{text-align:left;padding:15px;border-bottom:1px solid var(--border)}th{color:var(--muted);font:700 10px ui-monospace,monospace;letter-spacing:.08em;text-transform:uppercase}tr:last-child td{border-bottom:0}td code{color:var(--accent)}.danger{color:var(--danger);background:transparent;border:0;cursor:pointer}.notice{margin:20px 0;padding:13px 16px;border:1px solid var(--accent);background:color-mix(in srgb,var(--accent) 10%,transparent);border-radius:8px} +.stats{display:grid;grid-template-columns:repeat(5,1fr);gap:1px;background:var(--border);border:1px solid var(--border);margin:34px 0;overflow:hidden;border-radius:12px}.stats article{background:var(--surface);padding:20px 24px}.stats span{display:block;color:var(--muted);font-size:12px;text-transform:uppercase;letter-spacing:.1em}.stats strong{display:block;font-size:30px;margin-top:6px}.workspace{display:grid;grid-template-columns:190px 1fr;gap:28px}.workspace aside{display:flex;flex-direction:column;gap:6px}.tab{border:0;border-left:2px solid transparent;background:transparent;color:var(--muted);padding:13px;text-align:left;font:600 12px ui-monospace,monospace}.tab span{font-family:Inter,system-ui;margin-left:9px}.tab.active{color:var(--accent);border-color:var(--accent);background:color-mix(in srgb,var(--accent) 8%,transparent)}.panel{display:none}.panel.active{display:block}.panel-head{display:flex;align-items:end;justify-content:space-between;margin-bottom:20px}.panel h2{font-size:32px;letter-spacing:-.035em;margin:0}.panel-head button,dialog button[type=submit],.terminal-login,.card-action{background:var(--accent);color:var(--bg);font-weight:750;border:0;padding:11px 16px;border-radius:7px;cursor:pointer}.card-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(300px,1fr));gap:14px;align-items:stretch}.card{background:var(--surface);border:1px solid var(--border);border-radius:10px;padding:20px;display:flex;flex-direction:column;align-items:flex-start}.card h3{margin:6px 0 5px;width:100%}.card p{color:color-mix(in srgb,var(--text) 62%,transparent);margin:0;width:100%;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical;overflow:hidden}.card-action{margin-top:14px;align-self:flex-start;background:color-mix(in srgb,var(--accent) 14%,var(--surface));color:var(--accent);border:1px solid color-mix(in srgb,var(--accent) 45%,var(--border))}.badge{font:700 10px ui-monospace,monospace;text-transform:uppercase;color:var(--accent);background:color-mix(in srgb,var(--accent) 10%,transparent);padding:5px 7px;border-radius:5px}.meta{display:grid;gap:7px;width:100%;margin-top:auto;padding-top:16px;border-top:1px solid var(--border);color:var(--muted);font-size:12px}.meta>div{display:flex;align-items:baseline;gap:14px;min-width:0}.meta span{flex:none;text-transform:uppercase;letter-spacing:.09em;font-size:10px}.meta b{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font:600 12px ui-monospace,monospace;color:var(--text)}.table-wrap{overflow-x:auto;background:var(--surface);border:1px solid var(--border);border-radius:10px}table{border-collapse:collapse;width:100%;font-size:13px}th,td{text-align:left;padding:15px;border-bottom:1px solid var(--border)}th{color:var(--muted);font:700 10px ui-monospace,monospace;letter-spacing:.08em;text-transform:uppercase}tr:last-child td{border-bottom:0}td code{color:var(--accent)}.danger{color:var(--danger);background:transparent;border:0;cursor:pointer}.notice{margin:20px 0;padding:13px 16px;border:1px solid var(--accent);background:color-mix(in srgb,var(--accent) 10%,transparent);border-radius:8px} dialog{color:var(--text);background:var(--surface);border:1px solid var(--border);border-radius:12px;box-shadow:0 30px 100px rgba(0,0,0,.6);width:min(520px,92vw);padding:24px}dialog::backdrop{background:rgba(8,8,15,.74);backdrop-filter:blur(4px)}dialog form{display:grid;gap:16px}.dialog-head{display:flex;align-items:center;justify-content:space-between}.dialog-head h3{margin:0;font-size:22px}.close{border:0;background:transparent;color:var(--muted);font-size:28px;cursor:pointer}dialog label{display:grid;gap:7px;font-size:13px;color:var(--muted)}textarea{resize:vertical}.segmented{display:flex;gap:20px}.segmented label{display:flex;align-items:center;grid-template-columns:auto auto}.secret{display:flex;gap:8px;align-items:center;background:var(--bg);padding:12px;border-radius:8px}.secret code{overflow-wrap:anywhere;color:var(--good);flex:1} .check-list{display:grid;gap:8px}.check-list label{display:flex;grid-template-columns:auto 1fr;align-items:center}.client-terminal h1{font-size:clamp(38px,6vw,64px);line-height:1;margin:10px 0 32px;letter-spacing:-.05em}.client-terminal h1 span{color:var(--accent2)} .login-page{display:grid;place-items:center;min-height:100vh;overflow:hidden}.login-glow{position:fixed;width:600px;height:600px;border-radius:50%;background:var(--accent2);filter:blur(180px);opacity:.13}.terminal{width:min(920px,92vw);margin:40px;position:relative;background:color-mix(in srgb,var(--surface) 94%,black);border:1px solid var(--border);border-radius:10px;box-shadow:0 40px 120px rgba(0,0,0,.55);overflow:hidden;font-family:ui-monospace,SFMono-Regular,monospace}.terminal-bar{height:44px;background:var(--surface2);display:flex;align-items:center;gap:8px;padding:0 15px}.terminal-bar span{width:11px;height:11px;border-radius:50%;background:var(--danger)}.terminal-bar span:nth-child(2){background:#e0af68}.terminal-bar span:nth-child(3){background:var(--good)}.terminal-bar strong{position:absolute;left:50%;transform:translateX(-50%);color:var(--muted);font-size:12px}.terminal-body{padding:35px}.ascii{color:var(--accent);font-size:clamp(6px,1vw,12px);line-height:1.2;overflow:hidden}.prompt{color:var(--good)}.muted{color:var(--muted);max-width:650px;line-height:1.6}.terminal-login{display:inline-flex;gap:10px;text-decoration:none;margin:20px 0 10px}.dev-login{display:block;color:var(--muted);font-size:11px}.cursor{color:var(--accent);animation:blink 1s steps(1) infinite}@keyframes blink{50%{opacity:0}}.docs-page #swagger-ui{max-width:1200px;margin:30px auto}.docs-page .swagger-ui{filter:none} @@ -17,3 +17,40 @@ dialog{color:var(--text);background:var(--surface);border:1px solid var(--border .installer-form{display:grid;gap:14px;margin-top:24px}.installer-form label{display:grid;gap:6px;color:var(--muted);font-size:12px}.installer-form button{height:44px;border:0;border-radius:7px;background:var(--accent);color:var(--bg);font-weight:800}.installer-form .seed-option{display:flex;grid-template-columns:auto 1fr;align-items:center}.installer h1{font-size:clamp(40px,6vw,68px);line-height:1;margin:10px 0;letter-spacing:-.05em}.installer h1 span{color:var(--accent2)} @media(max-width:800px){header{padding:0 16px}nav .compact,.identity{display:none}.hero{padding:55px 0;display:block}.status-card{margin-top:35px;min-width:0}.stats{grid-template-columns:1fr 1fr}.workspace{grid-template-columns:1fr}.workspace aside{flex-direction:row;overflow:auto}.tab{white-space:nowrap;border-left:0;border-bottom:2px solid transparent}.card-grid{grid-template-columns:1fr}.ascii{font-size:5.3px}.terminal-body{padding:22px}.password-login{grid-template-columns:1fr}.password-login button{width:100%}} .identity{display:inline-flex;align-items:center;gap:8px;text-decoration:none}.identity img,.avatar{border-radius:50%;object-fit:cover;display:block;flex:none}.profile-hero{min-height:0;padding:56px 0 34px}.profile-hero h1{font-size:clamp(40px,5vw,64px)}.profile-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(320px,1fr));gap:18px;margin-top:34px}.profile-card{display:grid;gap:16px;align-content:start}.profile-card h2{margin:0;font-size:20px;letter-spacing:-.02em}.profile-wide{grid-column:1/-1}.profile-card form{display:grid;gap:14px}.profile-card label{display:grid;gap:7px;font-size:13px;color:var(--muted)}.profile-actions{display:flex;gap:10px;flex-wrap:wrap}.profile-actions button{background:var(--accent);color:var(--bg);font-weight:750;border:0;padding:11px 16px;border-radius:7px;cursor:pointer}.profile-actions button:disabled{opacity:.45;cursor:not-allowed}.profile-actions .ghost{background:transparent;border:1px solid var(--border);color:var(--text)}.profile-card button[type=submit]{background:var(--accent);color:var(--bg);font-weight:750;border:0;padding:11px 16px;border-radius:7px;cursor:pointer;justify-self:start}.avatar-preview{display:grid;place-items:center;width:112px;height:112px;border-radius:50%;overflow:hidden;background:var(--surface2);border:1px solid var(--border)}.avatar-preview img{width:100%;height:100%;object-fit:cover}.avatar-initials{font:750 34px ui-monospace,monospace;color:var(--accent)}.avatar-empty{display:inline-grid;place-items:center;width:28px;height:28px;vertical-align:middle;background:var(--surface2);border:1px solid var(--border);color:var(--accent);font:700 11px ui-monospace,monospace}.facts{display:grid;gap:10px;margin:4px 0 0}.facts div{display:flex;justify-content:space-between;gap:14px;border-bottom:1px solid var(--border);padding-bottom:8px;font-size:13px}.facts dt{color:var(--muted)}.facts dd{margin:0;text-align:right}.capabilities{display:flex;flex-wrap:wrap;gap:6px}.chip{font:600 11px ui-monospace,monospace;color:var(--muted);background:var(--surface2);border:1px solid var(--border);border-radius:5px;padding:3px 6px} + +/* ---------------------------------------------------------- account menu -- + The header account control: a trigger showing who is signed in, opening a + small menu with the two things a person can do about their own account. It + replaces the separate sign-out button, so the identity and the action live in + one place instead of two controls that mean the same thing. */ +.account{position:relative;margin-left:2px} +.account-trigger{display:inline-flex;align-items:center;gap:8px;padding:5px 9px 5px 6px;background:transparent;border:1px solid var(--border);border-radius:8px;color:var(--text);cursor:pointer;font:inherit;font-size:13px} +.account-trigger:hover{border-color:color-mix(in srgb,var(--accent) 45%,var(--border))} +.account-trigger:focus-visible{outline:2px solid var(--accent);outline-offset:2px} +.account-trigger .avatar{width:24px;height:24px} +.account-name{font-weight:650;max-width:11rem;overflow:hidden;text-overflow:ellipsis;white-space:nowrap} +.account-caret{color:var(--muted);font-size:10px} +.account-menu{position:absolute;right:0;top:calc(100% + 8px);z-index:40;min-width:15rem;padding:6px;background:var(--surface);border:1px solid var(--border);border-radius:10px;box-shadow:0 14px 34px rgba(0,0,0,.28)} +.account-menu[hidden]{display:none} +.account-identity{padding:9px 10px 11px;border-bottom:1px solid var(--border);margin-bottom:6px} +.account-identity strong{display:block;font-size:13px} +.account-identity span{display:block;color:var(--muted);font-size:11.5px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap} +.account-menu form{margin:0} +.account-menu a,.account-menu button{display:flex;width:100%;align-items:center;gap:9px;padding:8px 10px;background:transparent;border:0;border-radius:7px;color:var(--text);font:inherit;font-size:13px;text-align:left;text-decoration:none;cursor:pointer} +.account-menu a:hover,.account-menu button:hover{background:var(--surface2)} +.account-menu a:focus-visible,.account-menu button:focus-visible{outline:2px solid var(--accent);outline-offset:-2px} +.account-note{padding:7px 10px 4px;color:var(--muted);font-size:11px;line-height:1.45} + +/* Row actions inside a table. The existing .card-action is a full-width block + button meant for the foot of a card, which stacked two of them in a narrow + cell and made the row taller than its content. These are inline and sit on the + text baseline. */ +.table-actions{display:flex;gap:6px;justify-content:flex-end;white-space:nowrap} +.table-action{padding:5px 10px;background:transparent;border:1px solid var(--border);border-radius:7px;color:var(--text);font:inherit;font-size:12px;cursor:pointer} +.table-action:hover{border-color:color-mix(in srgb,var(--accent) 55%,var(--border));color:var(--accent)} +.table-action:focus-visible{outline:2px solid var(--accent);outline-offset:2px} +.table-action.danger{color:var(--danger);border-color:color-mix(in srgb,var(--danger) 40%,var(--border))} +.table-action.danger:hover{background:color-mix(in srgb,var(--danger) 12%,transparent)} +/* A slug, prefix or permission name is an identifier: wrapping it across two lines + makes one row taller than its neighbours for no benefit. */ +.table-wrap td code{white-space:nowrap}