Federated via graft
11 kB
276 lines
1// Package admin serves graft's self-service dashboard actions: a one-time
2// secret-sharing page (so a token never has to travel through chat or
3// email in the clear), and two onboarding forms ("add a peer to an
4// existing federation" and "start a new repo from scratch") gated by a
5// single shared admin password rather than a config.yaml edit and a
6// restart.
7//
8// None of this requires a session or a cookie: every state-changing
9// action re-submits the password on its own form, checked with a
10// constant-time comparison and backed by a rate limiter — the password is
11// short and shared, so the limiter (not the comparison's timing safety
12// alone) is the thing actually standing between an attacker and a brute
13// force of it.
14package admin
15
16import (
17 "crypto/subtle"
18 "html/template"
19 "net/http"
20 "strings"
21 "sync"
22 "time"
23
24 "graft/internal/state"
25)
26
27// SeriesInfo is one federation an "add a peer" submission can join,
28// carrying the Radicle side every existing pair in it already shares —
29// so a newly-added Forgejo peer never has to (and never gets to) pick its
30// own RID or seed.
31type SeriesInfo struct {
32 Name string
33 RadicleRID string
34 RadicleHTTPBaseURL string
35 RadicleExplorerURL string
36}
37
38// Config wires the admin package to the rest of graft without importing
39// cmd/sync or internal/sync — it only ever reads/writes through Store and
40// the callbacks below.
41type Config struct {
42 Store *state.Store
43
44 // AdminPassword gates every state-changing action here: claiming a
45 // share needs its own 6-digit passcode instead, but creating a share,
46 // and submitting or approving an add-peer/new-repo form, all check
47 // this. Never logged, never echoed back on error.
48 AdminPassword string
49
50 // PublicHost is used to build the share link shown after creation
51 // (https://<PublicHost>/share/<id>). Required for the share feature;
52 // the onboarding forms work without it.
53 PublicHost string
54
55 // TokenDir is the directory a submitted token gets written into as
56 // its own chmod-600 file, following the same convention as every
57 // config.yaml-declared pair (e.g. /etc/graft).
58 TokenDir string
59
60 // DefaultRadHome is graft's own local Radicle identity — the same
61 // one every pair, static or dynamic, pushes as. Never user-supplied.
62 DefaultRadHome string
63
64 // Series returns every federation an "add a peer" submission can
65 // join, freshly computed per request (cheap: it's just config.Repos
66 // plus whatever dynamic_repo rows exist already).
67 Series func() []SeriesInfo
68}
69
70// Handler serves every admin-facing route. Two independent rate limiters:
71// a wrong admin password and a wrong share passcode are different secrets
72// with different scopes, so a lockout on one never blocks the other.
73type Handler struct {
74 cfg Config
75 passwordLimiter *rateLimiter
76 shareLimiter *rateLimiter
77}
78
79func NewHandler(cfg Config) *Handler {
80 return &Handler{cfg: cfg, passwordLimiter: newRateLimiter(), shareLimiter: newRateLimiter()}
81}
82
83func (h *Handler) Register(mux *http.ServeMux) {
84 mux.HandleFunc("/share/new", h.shareNew)
85 mux.HandleFunc("/share/", h.shareClaim) // also serves /share/<id>/qr.png
86 mux.HandleFunc("/add-peer", h.addPeer)
87 mux.HandleFunc("/new-repo", h.newRepo)
88}
89
90// checkPassword compares in constant time, so a wrong guess never takes
91// measurably longer or shorter based on which character differs.
92func checkPassword(cfg Config, submitted string) bool {
93 want := []byte(cfg.AdminPassword)
94 got := []byte(submitted)
95 if len(want) != len(got) {
96 return false
97 }
98 return subtle.ConstantTimeCompare(want, got) == 1
99}
100
101// clientIP prefers the first hop of X-Forwarded-For (set by graft's own
102// nginx reverse proxy in front of it) and falls back to the raw remote
103// address — imperfect if a future proxy change stops setting that header
104// faithfully, which is exactly why the rate limiter also enforces a
105// global cap independent of IP attribution (see rateLimiter).
106func clientIP(r *http.Request) string {
107 if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
108 if i := strings.Index(xff, ","); i >= 0 {
109 return strings.TrimSpace(xff[:i])
110 }
111 return strings.TrimSpace(xff)
112 }
113 if i := strings.LastIndex(r.RemoteAddr, ":"); i >= 0 {
114 return r.RemoteAddr[:i]
115 }
116 return r.RemoteAddr
117}
118
119const (
120 rateLimitWindow = 15 * time.Minute
121 maxFailuresPerIP = 5
122 maxFailuresGlobal = 20
123)
124
125// rateLimiter is a simple in-memory sliding-window counter over password
126// failures — not persisted (a restart resets it), which is an acceptable
127// trade for a password meant to be short-lived and low-stakes rather than
128// a real credential; see TUTORIAL.md's "Future: built-in token exchange"
129// for the actually-strong alternative (delegated token minting) this
130// password model is a deliberately lightweight stand-in for.
131type rateLimiter struct {
132 mu sync.Mutex
133 byIP map[string][]time.Time
134 global []time.Time
135}
136
137func newRateLimiter() *rateLimiter {
138 return &rateLimiter{byIP: map[string][]time.Time{}}
139}
140
141func prune(times []time.Time, now time.Time) []time.Time {
142 out := times[:0]
143 for _, t := range times {
144 if now.Sub(t) < rateLimitWindow {
145 out = append(out, t)
146 }
147 }
148 return out
149}
150
151// allowed reports whether ip may attempt a password check right now.
152func (rl *rateLimiter) allowed(ip string) bool {
153 rl.mu.Lock()
154 defer rl.mu.Unlock()
155 now := time.Now()
156 rl.global = prune(rl.global, now)
157 if len(rl.global) >= maxFailuresGlobal {
158 return false
159 }
160 rl.byIP[ip] = prune(rl.byIP[ip], now)
161 return len(rl.byIP[ip]) < maxFailuresPerIP
162}
163
164// recordFailure counts one wrong password attempt against both the
165// per-IP and global windows.
166func (rl *rateLimiter) recordFailure(ip string) {
167 rl.mu.Lock()
168 defer rl.mu.Unlock()
169 now := time.Now()
170 rl.byIP[ip] = append(rl.byIP[ip], now)
171 rl.global = append(rl.global, now)
172}
173
174// pageTmpl is the shared chrome every admin page renders inside —
175// visually related to the main dashboard (same palette) but with a
176// distinct amber accent so a self-service action page is never
177// mistaken for the read-only status page.
178var pageTmpl = template.Must(template.New("admin").Parse(`<!doctype html>
179<html lang="en">
180<head>
181<meta charset="utf-8">
182<meta name="viewport" content="width=device-width, initial-scale=1">
183<title>graft — {{.Title}}</title>
184<style>
185 :root {
186 color-scheme: light;
187 --surface: #ffffff; --surface-sunk: #f4f5f7; --text: #172b4d; --text-muted: #6b778c;
188 --border: #dfe1e6; --brand: #0052cc; --accent: #ae6b00; --accent-soft: #fff4e0;
189 --bad: #de350b; --good: #36b37e;
190 }
191 * { box-sizing: border-box; }
192 body { margin: 0; background: var(--surface-sunk); color: var(--text);
193 font: 14px/1.55 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif; }
194 main { max-width: 640px; margin: 0 auto; padding: 2.5rem 1.5rem 3rem; }
195 .top { display: flex; align-items: baseline; justify-content: space-between; margin-bottom: 1.5rem; }
196 h1 { font-size: 1.15rem; margin: 0; font-weight: 600; }
197 .eyebrow { display: inline-block; font-size: .7rem; text-transform: uppercase; letter-spacing: .06em;
198 color: var(--accent); background: var(--accent-soft); padding: .15rem .5rem; border-radius: 3px; margin-bottom: .5rem; }
199 .nav-link { color: var(--brand); font-size: .82rem; text-decoration: none; font-weight: 500; }
200 .nav-link:hover { text-decoration: underline; }
201 .card { background: var(--surface); border: 1px solid var(--border); border-radius: 6px; padding: 1.5rem; margin-bottom: 1.25rem; }
202 p.lead { color: var(--text-muted); font-size: .88rem; margin: 0 0 1.25rem; }
203 label { display: block; font-size: .78rem; font-weight: 600; color: var(--text-muted); margin: 1rem 0 .3rem; }
204 label:first-of-type { margin-top: 0; }
205 input[type=text], input[type=password], input[type=url], select, textarea {
206 width: 100%; padding: .55rem .65rem; border: 1px solid var(--border); border-radius: 4px;
207 font: inherit; background: var(--surface-sunk); color: var(--text);
208 }
209 textarea { resize: vertical; min-height: 4.5rem; font-family: ui-monospace, monospace; font-size: .82rem; }
210 .hint { font-size: .74rem; color: var(--text-muted); margin-top: .3rem; }
211 .row { display: flex; gap: 1rem; }
212 .row > div { flex: 1; }
213 .checks { display: flex; gap: 1.25rem; margin-top: .5rem; }
214 .checks label { display: flex; align-items: center; gap: .4rem; font-weight: 500; margin: 0; }
215 .checks input { width: auto; }
216 button {
217 margin-top: 1.5rem; background: var(--brand); color: #fff; border: none; border-radius: 4px;
218 padding: .65rem 1.1rem; font: inherit; font-weight: 600; cursor: pointer;
219 }
220 button:hover { background: #0747a6; }
221 .steps { counter-reset: step; list-style: none; padding: 0; margin: 0 0 1.5rem; }
222 .steps li { counter-increment: step; position: relative; padding: 0 0 1rem 2.2rem; font-size: .86rem; }
223 .steps li::before {
224 content: counter(step); position: absolute; left: 0; top: 0; width: 1.5rem; height: 1.5rem;
225 border-radius: 50%; background: var(--accent-soft); color: var(--accent); font-weight: 700;
226 font-size: .76rem; display: flex; align-items: center; justify-content: center;
227 }
228 .steps code { background: var(--surface-sunk); padding: .1rem .35rem; border-radius: 3px; font-size: .82em; }
229 .notice { border-radius: 6px; padding: .9rem 1.1rem; font-size: .86rem; margin-bottom: 1.25rem; }
230 .notice.good { background: #e3fcef; color: #006644; border: 1px solid #abf5d1; }
231 .notice.bad { background: #ffebe6; color: #bf2600; border: 1px solid #ffbdad; }
232 .secret-box {
233 font-family: ui-monospace, monospace; font-size: .95rem; background: var(--surface-sunk);
234 border: 1px dashed var(--border); border-radius: 4px; padding: .9rem; word-break: break-all; margin: .5rem 0;
235 }
236 .passcode { font-size: 1.6rem; font-weight: 700; letter-spacing: .1em; text-align: center;
237 background: var(--accent-soft); color: var(--accent); border-radius: 6px; padding: .7rem; margin: .5rem 0; }
238 footer { max-width: 640px; margin: 0 auto; padding: 1rem 1.5rem 2.5rem; color: var(--text-muted); font-size: .78rem; }
239</style>
240</head>
241<body>
242<main>
243 <div class="top">
244 <h1>graft</h1>
245 <a class="nav-link" href="/">← Dashboard</a>
246 </div>
247 {{if .Eyebrow}}<span class="eyebrow">{{.Eyebrow}}</span>{{end}}
248 {{.Body}}
249</main>
250</body>
251</html>
252`))
253
254type pageData struct {
255 Title string
256 Eyebrow string
257 Body template.HTML
258}
259
260// render wraps body (already-escaped HTML built from a sub-template) in
261// the shared page chrome. body is template.HTML deliberately — every
262// caller builds it via html/template itself, so this isn't an escaping
263// bypass, just composition of two already-safe fragments.
264func render(w http.ResponseWriter, title, eyebrow string, body template.HTML) {
265 w.Header().Set("Content-Type", "text/html; charset=utf-8")
266 w.Header().Set("Cache-Control", "no-store")
267 _ = pageTmpl.Execute(w, pageData{Title: title, Eyebrow: eyebrow, Body: body})
268}
269
270func renderFragment(tmpl *template.Template, data any) template.HTML {
271 var b strings.Builder
272 if err := tmpl.Execute(&b, data); err != nil {
273 return template.HTML("<p class=\"notice bad\">" + template.HTMLEscapeString(err.Error()) + "</p>")
274 }
275 return template.HTML(b.String())
276}