mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
feat(auth): revocable API tokens, introspect MCP server, and a Go 1.26 idiom pass (#1266)
* feat(auth): add revocable API tokens (bot/service auth) Add long-lived, revocable API tokens so headless clients (the introspection MCP tool, bots, CI) can authenticate without a password. Presented as "Authorization: Bearer <token>", a token authenticates as a specific user, inheriting that user's role and permissions. - migration 018 + dedicated api_tokens table (kept separate from sessions so bulk logout and the per-user session cap never touch these); only the SHA-256 hash is stored, raw token shown once at creation - auth.ResolveTokenHash: one shared bearer resolver that both AuthMiddleware and adminAuthMiddleware now call. Sessions are matched first so existing login behavior is unchanged; API tokens are a fallback only on session miss. A DB outage is returned wrapped, never mistaken for a bad token. - `server token create|list|revoke` CLI: mints directly against the DB with no HTTP and no login — the password-free bootstrap path - tests: resolver (8 cases incl. outage-not-fallthrough), db queries (6), api middleware integration (valid + revoked token) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(tools): add owncord-introspect MCP server A local MCP dev tool that lets Claude Code introspect a running OwnCord instance: read its logs, query any REST endpoint, and tail the desktop client's log file. It is a thin wrapper over the existing API plus the client log — no new product surface. - tools/mcp-introspect/index.mjs (Node/ESM, one dep: @modelcontextprotocol/sdk) exposes api_request (full read-write passthrough), server_logs (admin SSE ring-buffer stream), client_logs (reads the desktop log file) - authenticates with an API token (OWNCORD_API_TOKEN); pins the self-signed cert and skips hostname checks (the cert has no SAN) - registered in .mcp.json (secret-free ${OWNCORD_API_TOKEN}) - un-ignore tools/mcp-introspect/ so this shared dev tool is committed, while tools/livekit-server.exe and node_modules stay ignored - docs/mcp-introspect.md: how it works, tool reference, setup, troubleshooting Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(dependencies): update and add various crate versions in Cargo.lock * feat(admin): manage API tokens from the admin panel Add Owner-gated HTTP endpoints and a UI card to create, list, and revoke API tokens from the web admin panel. Previously only the `server token` CLI could manage them, which requires shell access to the host. - POST|GET|DELETE /admin/api/tokens in admin/handlers_tokens.go, wired in admin/api.go. All three are Owner-only (ownerOnlyMiddleware, like backups/updates): an HTTP token-mint endpoint is a network-reachable credential-minting surface, and API tokens deliberately survive password change + bulk logout, so a hijacked admin session must not mint one. - Reuses the same db.*APIToken calls as the CLI; create sources the actor from request context (audits who clicked, not the bound user); the raw token is returned once in the 201 body, never stored. - Add json tags to db.APITokenListItem for snake_case wire consistency. - Admin panel: "API Tokens" nav item + create modal, show-once reveal, revoke confirm in admin/static/index.html. - Tests: 7 in admin/api_test.go (+api_tokens table in the in-memory schema). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor: modernize to Go 1.26 idioms + enable modernize linter Apply `golangci-lint modernize` autofixes across the server and enable the linter in .golangci.yml so these stop re-accumulating (they built up only because modernize was never in the config). Production code: slices.Contains for hand-rolled membership loops (api router, ws origin, db/account, plugin manifest); strings.SplitSeq for allocation-free line/segment iteration (db/migrate, updater, livekit_proxy); strings.Cut (config); fmt.Appendf (dm_handler); min() (event_pruner); any (ws client). Tests: range-over-int, t.Context(), WaitGroup.Go, slices.Sort, maps.Copy, new(expr), interface{}->any. - plugin/manifest.go parent-traversal check applied by hand: modernize skipped it (two conflicting rewrites); used the slices.Contains form. - Removed the now-dead ptr() test helper after newexpr inlined its callers. - Dropped dangling sort imports left by the sort.Slice->slices.Sort rewrite. No behavior change. All four tag variants build, full test suite is green, and golangci-lint (with modernize enabled) reports 0 issues. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
J3vb
committed by
GitHub
GitHub
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
77ae0d21a8
commit
58005c9c6f
@@ -0,0 +1,205 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"flag"
|
||||
"fmt"
|
||||
"os"
|
||||
"strconv"
|
||||
"text/tabwriter"
|
||||
"time"
|
||||
|
||||
"github.com/owncord/server/auth"
|
||||
"github.com/owncord/server/config"
|
||||
"github.com/owncord/server/db"
|
||||
)
|
||||
|
||||
// runTokenCLI implements `server token <create|list|revoke>`. It operates
|
||||
// directly against the database — no HTTP, no login — so an operator can mint
|
||||
// the first API token without any existing credential (the bootstrap path).
|
||||
// Returns a process exit code.
|
||||
func runTokenCLI(args []string) int {
|
||||
if len(args) == 0 {
|
||||
tokenUsage()
|
||||
return 2
|
||||
}
|
||||
|
||||
cfg, err := config.Load("config.yaml")
|
||||
if err != nil {
|
||||
fmt.Fprintf(os.Stderr, "error: load config: %v\n", err)
|
||||
return 1
|
||||
}
|
||||
database, err := db.Open(cfg.Database.Path)
|
||||
if err != nil {
|
||||
fmt.Fprintf(os.Stderr, "error: open database: %v\n", err)
|
||||
return 1
|
||||
}
|
||||
defer database.Close() //nolint:errcheck
|
||||
// Idempotent: ensures the api_tokens table exists even if the server has
|
||||
// never started against this database.
|
||||
if err := db.Migrate(database); err != nil {
|
||||
fmt.Fprintf(os.Stderr, "error: migrate: %v\n", err)
|
||||
return 1
|
||||
}
|
||||
|
||||
ctx := context.Background()
|
||||
switch args[0] {
|
||||
case "create":
|
||||
return tokenCreate(ctx, database, args[1:])
|
||||
case "list":
|
||||
return tokenList(ctx, database, args[1:])
|
||||
case "revoke":
|
||||
return tokenRevoke(ctx, database, args[1:])
|
||||
default:
|
||||
fmt.Fprintf(os.Stderr, "unknown token subcommand %q\n", args[0])
|
||||
tokenUsage()
|
||||
return 2
|
||||
}
|
||||
}
|
||||
|
||||
func tokenUsage() {
|
||||
fmt.Fprint(os.Stderr, `usage: server token <command>
|
||||
|
||||
Commands:
|
||||
create --label <name> [--user <username>] [--expires <dur>]
|
||||
Mint a new API token. Prints the raw token once to stdout — store it
|
||||
now, it is never recoverable. Defaults to the owner account and no
|
||||
expiry. --expires accepts a Go duration, e.g. 720h.
|
||||
list
|
||||
List API tokens (never prints raw tokens).
|
||||
revoke <id|label>
|
||||
Revoke a token by numeric id or by label.
|
||||
`)
|
||||
}
|
||||
|
||||
func tokenCreate(ctx context.Context, database *db.DB, args []string) int {
|
||||
fs := flag.NewFlagSet("token create", flag.ContinueOnError)
|
||||
label := fs.String("label", "", "human-readable label (required)")
|
||||
username := fs.String("user", "", "username to bind the token to (default: owner)")
|
||||
expires := fs.Duration("expires", 0, "validity duration, e.g. 720h (default: never)")
|
||||
if err := fs.Parse(args); err != nil {
|
||||
return 2
|
||||
}
|
||||
if *label == "" {
|
||||
fmt.Fprintln(os.Stderr, "error: --label is required")
|
||||
return 2
|
||||
}
|
||||
|
||||
var user *db.User
|
||||
var err error
|
||||
if *username != "" {
|
||||
user, err = database.GetUserByUsername(ctx, *username)
|
||||
} else {
|
||||
user, err = database.GetOwnerUser(ctx)
|
||||
}
|
||||
if err != nil {
|
||||
fmt.Fprintf(os.Stderr, "error: look up user: %v\n", err)
|
||||
return 1
|
||||
}
|
||||
if user == nil {
|
||||
if *username != "" {
|
||||
fmt.Fprintf(os.Stderr, "error: no user named %q\n", *username)
|
||||
} else {
|
||||
fmt.Fprintln(os.Stderr, "error: no users exist yet — create the owner account first")
|
||||
}
|
||||
return 1
|
||||
}
|
||||
|
||||
raw, err := auth.GenerateToken()
|
||||
if err != nil {
|
||||
fmt.Fprintf(os.Stderr, "error: generate token: %v\n", err)
|
||||
return 1
|
||||
}
|
||||
var expiresAt *time.Time
|
||||
if *expires > 0 {
|
||||
t := time.Now().Add(*expires)
|
||||
expiresAt = &t
|
||||
}
|
||||
id, err := database.CreateAPIToken(ctx, user.ID, auth.HashToken(raw), *label, expiresAt)
|
||||
if err != nil {
|
||||
fmt.Fprintf(os.Stderr, "error: create token: %v\n", err)
|
||||
return 1
|
||||
}
|
||||
db.WriteAudit(ctx, database, user.ID, "api_token_create", "api_token", id, *label)
|
||||
|
||||
// Metadata to stderr, raw token alone to stdout — so `... | tail -1` or a
|
||||
// capture pipe gets exactly the token.
|
||||
fmt.Fprintf(os.Stderr, "Created API token #%d for user %q (label %q).\n", id, user.Username, *label)
|
||||
fmt.Fprintln(os.Stderr, "Store this token now — it is shown only once:")
|
||||
fmt.Println(raw)
|
||||
return 0
|
||||
}
|
||||
|
||||
func tokenList(ctx context.Context, database *db.DB, args []string) int {
|
||||
fs := flag.NewFlagSet("token list", flag.ContinueOnError)
|
||||
if err := fs.Parse(args); err != nil {
|
||||
return 2
|
||||
}
|
||||
tokens, err := database.ListAPITokens(ctx)
|
||||
if err != nil {
|
||||
fmt.Fprintf(os.Stderr, "error: list tokens: %v\n", err)
|
||||
return 1
|
||||
}
|
||||
if len(tokens) == 0 {
|
||||
fmt.Println("no API tokens")
|
||||
return 0
|
||||
}
|
||||
tw := tabwriter.NewWriter(os.Stdout, 0, 2, 2, ' ', 0)
|
||||
// Buffer-write errors surface via tw.Flush() below, which is checked.
|
||||
_, _ = fmt.Fprintln(tw, "ID\tUSER\tLABEL\tCREATED\tLAST USED\tEXPIRES\tREVOKED")
|
||||
for _, t := range tokens {
|
||||
_, _ = fmt.Fprintf(tw, "%d\t%s\t%s\t%s\t%s\t%s\t%s\n",
|
||||
t.ID, t.Username, t.Label, t.CreatedAt,
|
||||
orDash(t.LastUsed), orDash(t.ExpiresAt), orDash(t.RevokedAt))
|
||||
}
|
||||
if err := tw.Flush(); err != nil {
|
||||
fmt.Fprintf(os.Stderr, "error: %v\n", err)
|
||||
return 1
|
||||
}
|
||||
return 0
|
||||
}
|
||||
|
||||
func tokenRevoke(ctx context.Context, database *db.DB, args []string) int {
|
||||
fs := flag.NewFlagSet("token revoke", flag.ContinueOnError)
|
||||
if err := fs.Parse(args); err != nil {
|
||||
return 2
|
||||
}
|
||||
rest := fs.Args()
|
||||
if len(rest) != 1 {
|
||||
fmt.Fprintln(os.Stderr, "error: revoke takes exactly one argument (id or label)")
|
||||
return 2
|
||||
}
|
||||
arg := rest[0]
|
||||
|
||||
var affected int64
|
||||
var err error
|
||||
if id, perr := strconv.ParseInt(arg, 10, 64); perr == nil {
|
||||
affected, err = database.RevokeAPIToken(ctx, id)
|
||||
if err == nil && affected > 0 {
|
||||
db.WriteAudit(ctx, database, 0, "api_token_revoke", "api_token", id, arg)
|
||||
}
|
||||
} else {
|
||||
affected, err = database.RevokeAPITokenByLabel(ctx, arg)
|
||||
if err == nil && affected > 0 {
|
||||
db.WriteAudit(ctx, database, 0, "api_token_revoke", "api_token", 0, arg)
|
||||
}
|
||||
}
|
||||
if err != nil {
|
||||
fmt.Fprintf(os.Stderr, "error: revoke token: %v\n", err)
|
||||
return 1
|
||||
}
|
||||
if affected == 0 {
|
||||
fmt.Fprintf(os.Stderr, "no active token matched %q\n", arg)
|
||||
return 1
|
||||
}
|
||||
fmt.Printf("revoked %d token(s)\n", affected)
|
||||
return 0
|
||||
}
|
||||
|
||||
// orDash renders a nullable timestamp column for the list table.
|
||||
func orDash(s *string) string {
|
||||
if s == nil || *s == "" {
|
||||
return "-"
|
||||
}
|
||||
return *s
|
||||
}
|
||||
Reference in New Issue
Block a user