add sth.

1 files changed, 242 insertions, 27 deletions

diff --git a/internal/adminapi/api.go b/internal/adminapi/api.go
index 7f5f8bd..adbaea8 100644
--- a/internal/adminapi/api.go
+++ b/internal/adminapi/api.go
@@ -3,6 +3,7 @@ package adminapi
 import (
 	"context"
 	"crypto/rand"
+	"crypto/sha256"
 	"crypto/subtle"
 	"encoding/hex"
 	"encoding/json"
@@ -22,12 +23,15 @@ import (
 )
 
 type API struct {
-	store   *controlplane.Store
-	manager *controlplane.Manager
-	billing *billing.Service
-	token   []byte
-	logger  *slog.Logger
-	prefix  string
+	store               *controlplane.Store
+	manager             *controlplane.Manager
+	billing             *billing.Service
+	token               []byte
+	logger              *slog.Logger
+	prefix              string
+	registrationEnabled bool
+	sessionTTL          time.Duration
+	currency            string
 }
 
 type actorKey struct{}
@@ -48,12 +52,15 @@ func (w *auditWriter) Write(body []byte) (int, error) {
 }
 
 type Options struct {
-	Store   *controlplane.Store
-	Manager *controlplane.Manager
-	Billing *billing.Service
-	Token   string
-	Logger  *slog.Logger
-	Prefix  string
+	Store               *controlplane.Store
+	Manager             *controlplane.Manager
+	Billing             *billing.Service
+	Token               string
+	Logger              *slog.Logger
+	Prefix              string
+	RegistrationEnabled bool
+	SessionTTL          time.Duration
+	Currency            string
 }
 
 func New(options Options) *API {
@@ -61,7 +68,18 @@ func New(options Options) *API {
 	if prefix == "" {
 		prefix = "/admin"
 	}
-	return &API{store: options.Store, manager: options.Manager, billing: options.Billing, token: []byte(options.Token), logger: options.Logger, prefix: prefix}
+	if options.Logger == nil {
+		options.Logger = slog.Default()
+	}
+	if options.SessionTTL <= 0 {
+		options.SessionTTL = 12 * time.Hour
+	}
+	if options.Currency == "" {
+		options.Currency = "usd"
+	}
+	return &API{store: options.Store, manager: options.Manager, billing: options.Billing, token: []byte(options.Token),
+		logger: options.Logger, prefix: prefix, registrationEnabled: options.RegistrationEnabled,
+		sessionTTL: options.SessionTTL, currency: options.Currency}
 }
 
 func (a *API) Handler() http.Handler {
@@ -71,6 +89,12 @@ func (a *API) Handler() http.Handler {
 		http.Redirect(w, r, a.prefix+"/", http.StatusTemporaryRedirect)
 	})
 	mux.Handle(a.prefix+"/", http.StripPrefix(a.prefix, adminui.Handler()))
+	mux.HandleFunc("GET "+apiPrefix+"/auth/config", a.public(a.authConfig))
+	mux.HandleFunc("GET "+apiPrefix+"/auth/session", a.public(a.authSession))
+	mux.HandleFunc("POST "+apiPrefix+"/auth/register", a.public(a.register))
+	mux.HandleFunc("POST "+apiPrefix+"/auth/login", a.public(a.login))
+	mux.HandleFunc("POST "+apiPrefix+"/auth/logout", a.withAuth("overview.read", a.logout))
+	mux.HandleFunc("POST "+apiPrefix+"/auth/password", a.withAuth("overview.read", a.changePassword))
 
 	mux.HandleFunc("GET "+apiPrefix+"/overview", a.withAuth("overview.read", a.overview))
 	mux.HandleFunc("GET "+apiPrefix+"/tenants", a.withAuth("tenants.read", a.listTenants))
@@ -102,34 +126,67 @@ func (a *API) Handler() http.Handler {
 	mux.HandleFunc("POST "+apiPrefix+"/users/{id}/revoke", a.withAuth("users.write", a.revokeUser))
 	mux.HandleFunc("GET "+apiPrefix+"/audit", a.withAuth("audit.read", a.listAudit))
 	mux.HandleFunc("GET "+apiPrefix+"/me", a.withAuth("overview.read", a.me))
-	return mux
+	return a.securityHeaders(mux)
 }
 
-func (a *API) withAuth(permission string, next http.HandlerFunc) http.HandlerFunc {
+func (a *API) public(next http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		if r.Header.Get("X-AIGW-Request-ID") == "" {
-			r.Header.Set("X-AIGW-Request-ID", adminRequestID(r))
+		a.prepareRequest(w, r)
+		next(w, r)
+	}
+}
+
+func (a *API) prepareRequest(w http.ResponseWriter, r *http.Request) {
+	if r.Header.Get("X-AIGW-Request-ID") == "" {
+		r.Header.Set("X-AIGW-Request-ID", adminRequestID(r))
+	}
+	w.Header().Set("X-AIGW-Request-ID", r.Header.Get("X-AIGW-Request-ID"))
+}
+
+func (a *API) securityHeaders(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Security-Policy", "default-src 'self'; base-uri 'none'; connect-src 'self'; frame-ancestors 'none'; img-src 'self' data:; object-src 'none'; script-src 'self'; style-src 'self'")
+		w.Header().Set("Referrer-Policy", "no-referrer")
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("X-Frame-Options", "DENY")
+		w.Header().Set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=()")
+		if strings.Contains(r.URL.Path, "/api/") {
+			w.Header().Set("Cache-Control", "no-store")
 		}
-		w.Header().Set("X-AIGW-Request-ID", r.Header.Get("X-AIGW-Request-ID"))
+		next.ServeHTTP(w, r)
+	})
+}
+
+func (a *API) withAuth(permission string, next http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		a.prepareRequest(w, r)
 		provided := strings.TrimSpace(r.Header.Get("X-Admin-Token"))
 		if provided == "" {
 			provided = bearerToken(r.Header.Get("Authorization"))
 		}
 		actor := controlplane.ConsoleActor{}
+		var authErr error
 		if len(provided) > 0 && len(a.token) > 0 && subtle.ConstantTimeCompare([]byte(provided), a.token) == 1 {
 			actor = controlplane.ConsoleActor{Role: controlplane.RolePlatformAdmin, DisplayName: "Bootstrap administrator", Bootstrap: true}
 		} else if provided != "" && a.store != nil {
-			var err error
-			actor, err = a.store.AuthenticateConsoleToken(r.Context(), provided)
-			if err != nil && !errors.Is(err, controlplane.ErrConsoleUnauthorized) {
-				a.logger.Error("console_authentication_failed", "error", err)
-				apierror.Write(w, apierror.Error{Status: http.StatusServiceUnavailable, Type: "control_plane_unavailable", Message: "Control plane authentication is temporarily unavailable"}, requestID(r))
-				return
-			}
-			if err != nil {
-				actor = controlplane.ConsoleActor{}
+			actor, authErr = a.store.AuthenticateConsoleToken(r.Context(), provided)
+		} else if cookie, err := r.Cookie("aigw_session"); err == nil && a.store != nil {
+			var csrfHash []byte
+			actor, csrfHash, authErr = a.store.AuthenticateConsoleSession(r.Context(), cookie.Value)
+			if authErr == nil && isUnsafeMethod(r.Method) {
+				providedCSRF := strings.TrimSpace(r.Header.Get("X-CSRF-Token"))
+				actualCSRF := sha256.Sum256([]byte(providedCSRF))
+				if providedCSRF == "" || subtle.ConstantTimeCompare(actualCSRF[:], csrfHash) != 1 {
+					apierror.Write(w, apierror.Error{Status: http.StatusForbidden, Type: "csrf_failed", Message: "Request verification failed; reload and try again"}, requestID(r))
+					return
+				}
 			}
 		}
+		if authErr != nil && !errors.Is(authErr, controlplane.ErrConsoleUnauthorized) {
+			a.logger.Error("console_authentication_failed", "error", authErr)
+			apierror.Write(w, apierror.Error{Status: http.StatusServiceUnavailable, Type: "control_plane_unavailable", Message: "Control plane authentication is temporarily unavailable"}, requestID(r))
+			return
+		}
 		if actor.Role == "" {
 			apierror.Write(w, apierror.Error{Status: http.StatusUnauthorized, Type: "admin_unauthorized", Message: "Administrator authentication required"}, requestID(r))
 			return
@@ -181,6 +238,164 @@ func adminRequestID(r *http.Request) string {
 	return "adm_unknown"
 }
 
+func (a *API) authConfig(w http.ResponseWriter, _ *http.Request) {
+	writeJSON(w, map[string]any{"registration_enabled": a.registrationEnabled})
+}
+
+func (a *API) authSession(w http.ResponseWriter, r *http.Request) {
+	cookie, err := r.Cookie("aigw_session")
+	if err != nil {
+		writeJSON(w, map[string]any{"authenticated": false})
+		return
+	}
+	actor, _, err := a.store.AuthenticateConsoleSession(r.Context(), cookie.Value)
+	if errors.Is(err, controlplane.ErrConsoleUnauthorized) {
+		a.clearSessionCookie(w, r)
+		writeJSON(w, map[string]any{"authenticated": false})
+		return
+	}
+	if err != nil {
+		a.databaseError(w, r, err)
+		return
+	}
+	writeJSON(w, map[string]any{"authenticated": true, "actor": actor, "permissions": actor.Permissions()})
+}
+
+func (a *API) register(w http.ResponseWriter, r *http.Request) {
+	if !a.registrationEnabled {
+		apierror.Write(w, apierror.Error{Status: http.StatusForbidden, Type: "registration_disabled", Message: "New account registration is disabled"}, requestID(r))
+		return
+	}
+	var input controlplane.RegisterInput
+	if !decodeBody(w, r, &input) {
+		return
+	}
+	actor, generation, err := a.store.RegisterTenant(r.Context(), input, a.currency)
+	if err != nil {
+		a.writeAudit(r, controlplane.ConsoleActor{}, "auth.register", http.StatusBadRequest)
+		a.mutationError(w, r, err)
+		return
+	}
+	if a.manager != nil {
+		if err := a.manager.AfterMutation(r.Context(), generation, "tenant", actor.TenantID); err != nil {
+			a.logger.Warn("registration_snapshot_reload_failed", "tenant_id", actor.TenantID, "error", err)
+		}
+	}
+	session, err := a.store.CreateConsoleSession(r.Context(), actor, a.sessionTTL, remoteIP(r), r.UserAgent())
+	if err != nil {
+		a.databaseError(w, r, err)
+		return
+	}
+	a.setSessionCookie(w, r, session)
+	a.writeAudit(r, actor, "auth.register", http.StatusCreated)
+	writeStatusJSON(w, http.StatusCreated, sessionPayload(session))
+}
+
+func (a *API) login(w http.ResponseWriter, r *http.Request) {
+	var input controlplane.PasswordLoginInput
+	if !decodeBody(w, r, &input) {
+		return
+	}
+	actor, err := a.store.AuthenticateConsolePassword(r.Context(), input, remoteIP(r))
+	if err != nil {
+		status := http.StatusUnauthorized
+		typeName := "invalid_credentials"
+		message := "Email or password is incorrect"
+		if errors.Is(err, controlplane.ErrConsoleRateLimited) {
+			status = http.StatusTooManyRequests
+			typeName = "login_rate_limited"
+			message = "Too many login attempts; try again in 15 minutes"
+			w.Header().Set("Retry-After", "900")
+		} else if !errors.Is(err, controlplane.ErrConsoleUnauthorized) {
+			status = http.StatusServiceUnavailable
+			typeName = "control_plane_unavailable"
+			message = "Login is temporarily unavailable"
+			a.logger.Error("console_password_login_failed", "error", err)
+		}
+		a.writeAudit(r, controlplane.ConsoleActor{}, "auth.login", status)
+		apierror.Write(w, apierror.Error{Status: status, Type: typeName, Message: message}, requestID(r))
+		return
+	}
+	session, err := a.store.CreateConsoleSession(r.Context(), actor, a.sessionTTL, remoteIP(r), r.UserAgent())
+	if err != nil {
+		a.databaseError(w, r, err)
+		return
+	}
+	a.setSessionCookie(w, r, session)
+	a.writeAudit(r, actor, "auth.login", http.StatusOK)
+	writeJSON(w, sessionPayload(session))
+}
+
+func (a *API) logout(w http.ResponseWriter, r *http.Request) {
+	if cookie, err := r.Cookie("aigw_session"); err == nil {
+		if err := a.store.RevokeConsoleSession(r.Context(), cookie.Value); err != nil {
+			a.databaseError(w, r, err)
+			return
+		}
+	}
+	a.clearSessionCookie(w, r)
+	writeJSON(w, map[string]any{"status": "signed_out"})
+}
+
+func (a *API) changePassword(w http.ResponseWriter, r *http.Request) {
+	actor := a.actor(r)
+	if actor.ID == "" {
+		apierror.Write(w, apierror.Error{Status: http.StatusBadRequest, Type: "bootstrap_account", Message: "Bootstrap access does not have a password"}, requestID(r))
+		return
+	}
+	var input controlplane.PasswordChangeInput
+	if !decodeBody(w, r, &input) {
+		return
+	}
+	if err := a.store.ChangeConsolePassword(r.Context(), actor.ID, input); err != nil {
+		if errors.Is(err, controlplane.ErrConsoleUnauthorized) {
+			apierror.Write(w, apierror.Error{Status: http.StatusUnauthorized, Type: "invalid_credentials", Message: "Current password is incorrect"}, requestID(r))
+			return
+		}
+		a.mutationError(w, r, err)
+		return
+	}
+	a.clearSessionCookie(w, r)
+	writeJSON(w, map[string]any{"status": "password_changed", "reauthentication_required": true})
+}
+
+func sessionPayload(session controlplane.ConsoleSession) map[string]any {
+	return map[string]any{
+		"actor": session.Actor, "permissions": session.Actor.Permissions(),
+		"csrf_token": session.CSRFToken, "expires_at": session.ExpiresAt,
+	}
+}
+
+func (a *API) setSessionCookie(w http.ResponseWriter, r *http.Request, session controlplane.ConsoleSession) {
+	maxAge := int(time.Until(session.ExpiresAt).Seconds())
+	http.SetCookie(w, &http.Cookie{Name: "aigw_session", Value: session.Token, Path: a.prefix + "/", MaxAge: maxAge,
+		Expires: session.ExpiresAt, HttpOnly: true, Secure: requestIsHTTPS(r), SameSite: http.SameSiteStrictMode})
+	http.SetCookie(w, &http.Cookie{Name: "aigw_csrf", Value: session.CSRFToken, Path: a.prefix + "/", MaxAge: maxAge,
+		Expires: session.ExpiresAt, HttpOnly: false, Secure: requestIsHTTPS(r), SameSite: http.SameSiteStrictMode})
+}
+
+func (a *API) clearSessionCookie(w http.ResponseWriter, r *http.Request) {
+	http.SetCookie(w, &http.Cookie{Name: "aigw_session", Value: "", Path: a.prefix + "/", MaxAge: -1,
+		Expires: time.Unix(1, 0), HttpOnly: true, Secure: requestIsHTTPS(r), SameSite: http.SameSiteStrictMode})
+	http.SetCookie(w, &http.Cookie{Name: "aigw_csrf", Value: "", Path: a.prefix + "/", MaxAge: -1,
+		Expires: time.Unix(1, 0), HttpOnly: false, Secure: requestIsHTTPS(r), SameSite: http.SameSiteStrictMode})
+}
+
+func requestIsHTTPS(r *http.Request) bool {
+	return r.TLS != nil || strings.EqualFold(strings.TrimSpace(r.Header.Get("X-Forwarded-Proto")), "https")
+}
+
+func isUnsafeMethod(method string) bool {
+	return method != http.MethodGet && method != http.MethodHead && method != http.MethodOptions
+}
+
+func remoteIP(r *http.Request) string {
+	if host, _, err := net.SplitHostPort(r.RemoteAddr); err == nil {
+		return host
+	}
+	return r.RemoteAddr
+}
+
 func (a *API) overview(w http.ResponseWriter, r *http.Request) {
 	actor := a.actor(r)
 	tenantID := actor.TenantID