From c7229e23ffe44d20a29119a6175faf549e7c4fbb Mon Sep 17 00:00:00 2001 From: Claus Lohmar Date: Thu, 15 Oct 2026 06:47:33 +0000 Subject: [PATCH] feat(setup): gate setup with the config toggle and an optional code MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit D-045 — the setup gate is now `config.setup`, not the peer/SSH tunnel: - setup: true -> /setup serves the wizard (the code form first when `setup_code` is set, via the existing D-044 gate); GET / points at the wizard; every other route -> 404. - setup: false + no admin -> LOCKED: GET / and /setup render an "enable setup" boilerplate; every other route -> 404; the wizard is not claimable. - completion -> writes `setup: false` and creates the admin. `setup_code` is now OPTIONAL: blank => Gate.Required() false => the toggle alone admits; set => required (reusing the unlock cookie/fingerprint/ redaction/rate-limit). The peer/tunnel gate is retired: `httpx. SetupRequestAllowed` and `httpx.IsLoopbackIP` are deleted; the XFF/XFP handling is kept for the client IP and the Secure/__Host- cookies + HSTS (A6/A11/D-043). The !bootstrapped() fail-safe becomes the locked predicate, latched at startup. New door seams: Deps.LockedMode and SetupGate.{Required,CodeForm,Landing, Locked}; the Gate renders three first-run pages. The startup banner states the mode and prints the code only when required. Tests cover the three states, the boilerplate, the code optionality and the unlock mechanics; live-smoked end to end (locked / wizard / code form / full bootstrap -> setup: false). --- cmd/myday/main.go | 131 ++++++++------ config.example.yaml | 27 +-- internal/core/config/config.go | 21 +-- internal/core/httpx/httpx_test.go | 56 ------ internal/core/httpx/loopback.go | 33 +--- internal/core/httpx/scheme.go | 2 +- internal/core/server/server.go | 198 +++++++++++++-------- internal/core/server/server_test.go | 150 ++++++++-------- internal/core/server/setup_code_test.go | 202 +++++++++++----------- internal/core/server/setup_wizard_test.go | 192 +++++++++++--------- internal/core/server/setupflow.go | 7 +- internal/core/setup/gate.go | 140 ++++++++------- internal/core/setup/render.go | 32 +++- internal/core/setup/setup.go | 68 +++++--- 14 files changed, 669 insertions(+), 590 deletions(-) diff --git a/cmd/myday/main.go b/cmd/myday/main.go index 29db5ec..3eb3e0c 100644 --- a/cmd/myday/main.go +++ b/cmd/myday/main.go @@ -1,9 +1,8 @@ // Command myday is the MyDay entrypoint. // // It assembles config → core services → the registry → the door and serves -// (SPEC-003 §3). Any address may be bound (D-025 revised / D-043): the -// bootstrap is protected per request — in setup mode the door serves only the -// direct SSH tunnel — not by refusing a non-loopback bind. +// (SPEC-003 §3). Any address may be bound (D-043): the bootstrap is gated by +// the `setup` config toggle (D-045), not by refusing a non-loopback bind. // // Spec: docs/specs/spec-003-core-door.md, docs/specs/spec-006-enroll-login.md. package main @@ -120,25 +119,23 @@ func run() error { ids := core.Identities() sessions := core.Sessions() - // Setup mode (SPEC-005 §3): `config.setup` OR the instance is not yet - // bootstrapped (no user, or no ACTIVE admin). It is LATCHED at startup, so - // the wizard can run to completion in this process — mid-wizard the admin - // exists but is still pending, and a live "no user" check would end setup - // mode too early. The wizard clears it via Done(); `config.Setup` is the - // startup flag and is never mutated (so the door reads it race-free). + // D-045: three states, decided by the `setup` toggle and whether the + // instance has any user at all. + // + // * `setup: true` → the WIZARD (the operator's switch); + // * `setup: false`, no user → LOCKED (an "enable setup" boilerplate; + // deliberately not publicly claimable); + // * `setup: false`, a user exists → PRODUCTIVE. + // + // `bootstrapped` is LATCHED at startup: a live per-request count would be a + // needless DB hit, and no user can appear while the instance is locked (the + // wizard is off). An unreadable count fails closed to "no user" → locked, + // which asks the operator to act rather than exposing the bootstrap. bootstrapped := func() bool { - ctx := context.Background() - n, err := us.Count(ctx) - if err != nil || n == 0 { - return false // fail-safe: an unreadable count means "not bootstrapped" - } - idn, err := ids.ByUserID(ctx, 1) - if err != nil { - return false - } - return idn.Status == auth.StatusActive - } - inSetup := cfg.Setup || !bootstrapped() + n, err := us.Count(context.Background()) + return err == nil && n > 0 + }() + inSetup := cfg.Setup // Adopt a generated TOTP key only where it is legitimate: a first boot // (setup mode). Outside setup mode a placeholder is a configuration fault @@ -180,12 +177,17 @@ func run() error { } var setupFlow *setup.Actions + // setupMode (D-045) reports whether the WIZARD is enabled: the `setup` + // toggle is on and the wizard has not completed in this process. setupMode := func() bool { if setupFlow != nil && setupFlow.Done() { return false } return inSetup } + // locked (D-045) reports the non-claimable dead end: `setup: false` and no + // user exists. Latched at startup (see `bootstrapped`). + locked := func() bool { return !cfg.Setup && !bootstrapped } // SPEC-006: the enroll/login flow (WebAuthn + TOTP). The passkey nudge // (SPEC-006 §8) is suppressed in setup mode — a loopback passkey is @@ -325,9 +327,11 @@ func run() error { CSRF: csrf, PreSession: preSession, SetupMode: setupMode, - // D-044: the first-run gate — the setup code + the signed unlock - // cookie, and the boilerplate `/` and `/setup` serve before the code is - // entered (never a bare 404). + // D-045: the non-claimable locked state — `setup: false` and no admin. + LockedMode: locked, + // D-044/D-045: the first-run gate — the OPTIONAL setup code + the + // signed unlock cookie, and the first-run pages (the code form, the + // `GET /` landing, and the locked boilerplate). SetupGate: setupFlow.Gate(), // SPEC-007: the tiered role gate (D-034). The floor admits any // authenticated user; role-ABOVE rules live in the services. @@ -346,9 +350,13 @@ func run() error { return err } - if setupMode() { + switch { + case setupMode(): slog.Warn("myday: SETUP MODE — the instance is not configured yet") - fmt.Fprint(os.Stderr, setupBanner(cfg, setupFlow.Code())) + fmt.Fprint(os.Stderr, setupBanner(cfg, setupFlow.Code(), setupFlow.CodeRequired())) + case locked(): + slog.Warn("myday: LOCKED — no admin exists and setup is disabled") + fmt.Fprint(os.Stderr, lockedBanner()) } if err := srv.Serve(cfg.Server.Listen); err != nil { @@ -471,52 +479,75 @@ func configTarget(cfg *config.Config) string { // copy-pasteable from the Proxmox host. const setupContainerID = "11020" -// setupBanner is the unmistakable first-run notice (D-044): that the instance is -// in setup mode, the wizard URL, the printed setup CODE, where to read the code -// again, and the restart that adopts the persisted secrets. It is printed to -// stderr, so it lands in the same journal as the structured logs. -func setupBanner(cfg *config.Config, code string) string { +// setupBanner is the unmistakable first-run notice (D-044/D-045): that the +// instance is in setup mode, the wizard URL, and — only when `setup_code` is +// set (`codeRequired`) — the printed setup CODE. It is printed to stderr, so it +// lands in the same journal as the structured logs. +func setupBanner(cfg *config.Config, code string, codeRequired bool) string { public := strings.TrimRight(strings.TrimSpace(cfg.Server.BaseURL), "/") setupURL := public + "/setup" if public == "" { setupURL = "http://" + strings.TrimSpace(cfg.Server.Listen) + "/setup" } - line := strings.Repeat("=", 70) - return fmt.Sprintf(` -%s - MyDay is NOT set up yet — no admin exists. -%s - - Open the setup wizard at: - - %s - - and enter the one-time SETUP CODE below. (A direct SSH tunnel to the - app's loopback port also opens the wizard without a code.) + codeBlock := "" + if codeRequired { + codeBlock = fmt.Sprintf(` + The wizard is protected by a one-time SETUP CODE: SETUP CODE: %s Read the code again: journalctl -u myday (in the container) pct exec %s -- journalctl -u myday (from the Proxmox host) +`, code, setupContainerID) + } + line := strings.Repeat("=", 70) + return fmt.Sprintf(` +%s + MyDay is in SETUP MODE — no admin exists yet. +%s + Open the setup wizard at: + + %s +%s Until setup is complete: - - GET / and GET /setup show a friendly first-run page (never a bare 404); - - every other route answers 404; - - the code is single-use and the entry form is rate-limited. + - GET / points at the wizard; + - every other route answers 404. - Finishing the wizard writes config.yaml. RESTART MyDay to adopt the - persisted secrets: + Finishing the wizard writes config.yaml with setup: false and creates the + admin. RESTART MyDay to adopt the persisted secrets: systemctl restart myday %s -`, line, line, setupURL, code, setupContainerID, line) +`, line, line, setupURL, codeBlock, line) +} + +// lockedBanner is the notice for the non-claimable locked state (D-045): +// `setup: false` and no admin. The operator must flip the toggle and restart. +func lockedBanner() string { + line := strings.Repeat("=", 70) + return fmt.Sprintf(` +%s + MyDay is LOCKED — no admin exists and setup is disabled. +%s + + To bring this instance to life, set + + setup: true + + in config.yaml and restart MyDay, then open /setup: + + systemctl restart myday + +%s +`, line, line, line) } // webauthnConfig derives the Relying Party configuration from server.base_url. // An empty/unparseable base URL falls back to loopback, which keeps setup mode -// (the setup gate, D-025/D-044) working before the domain is configured. +// (the `setup` toggle, D-045) working before the domain is configured. func webauthnConfig(baseURL string) webauthn.Config { defaultCfg := webauthn.Config{ RPID: "localhost", diff --git a/config.example.yaml b/config.example.yaml index 3867e88..c376f5b 100644 --- a/config.example.yaml +++ b/config.example.yaml @@ -4,20 +4,21 @@ # Settings live HERE, not in the database (D-035). # ── setup & recovery ───────────────────────────────────────────────────────── -setup: true # D-015 / D-026 — while true the app serves ONLY the - # setup wizard. D-025 (2026-10-15b) / D-044: the wizard - # is reachable EITHER over a direct SSH tunnel OR by - # entering the printed setup code — never - # first-visitor-wins. Until it is unlocked, `GET /` and - # `GET /setup` show a friendly first-run page (no bare - # 404) and every other route is 404. +setup: true # D-045 — the setup gate. While true the app serves the + # /setup wizard at the public domain: completing it writes + # `setup: false` and creates the admin. While FALSE with no + # admin yet, the app is LOCKED (a boilerplate at / and + # /setup; every other route 404) — deliberately not + # publicly claimable, so a fresh instance never exposes + # the bootstrap by accident. admin_recovery: false # D-033 — set true + restart to email user 1 an enrolment link -# D-044 — the first-run SETUP CODE. Leave blank and MyDay generates a 128-bit -# code at startup and prints it in a banner (read it with `journalctl -u myday` -# in the container, or `pct exec 11020 -- journalctl -u myday` from Proxmox). -# Set it here to pin your own value instead (then protect this file). Only -# consulted in setup mode. +# D-044/D-045 — the OPTIONAL first-run SETUP CODE (a second factor for /setup). +# Leave it EMPTY ("") and the `setup: true` toggle alone admits — the wizard is +# served directly. Set it and the code form comes first; the code is single-use, +# rate-limited and redacted from the logs (A8). If you expose MyDay publicly, +# SET THIS: while `setup: true` whoever reaches /setup first could otherwise +# claim the admin. setup_code: "" # ── server ─────────────────────────────────────────────────────────────────── @@ -28,7 +29,7 @@ server: listen: "0.0.0.0:8080" # D-043 — any bind is allowed (no setup-mode refusal) base_url: "https://myday.sechpoint.app" # the PUBLIC origin: invite / recovery links # Zoraxy's address — the ONLY peer whose forwarding headers are honoured (A6/D-043). - # Zoraxy MUST set `X-Forwarded-For` (the setup gate's "no XFF" test relies on it) + # Zoraxy MUST set `X-Forwarded-For` (so the audit log records the real client) # and `X-Forwarded-Proto`. A WRONG VALUE HERE FAILS SILENTLY: `X-Forwarded-Proto` # is then ignored, the session cookie loses `Secure` (and with it the `__Host-` # prefix and HSTS), and the audit log records the proxy — not the user — as the diff --git a/internal/core/config/config.go b/internal/core/config/config.go index c7be1a3..7fae05e 100644 --- a/internal/core/config/config.go +++ b/internal/core/config/config.go @@ -4,12 +4,13 @@ // Settings live in the config file, not the database (D-035): infra · secrets · // domain · mail · locale. The real `config.yaml` is gitignored (D-010); the // committed `config.example.yaml` is used as a development fallback so a fresh -// checkout can still start (in setup mode, reachable only over the tunnel). +// checkout can still start (in setup mode — the `setup` toggle, D-045). // // Fail-closed rule (SPEC-003 §1): in PRODUCTIVE mode (`setup: false`) the // process refuses to start if a required secret is missing or weak. Setup mode // tolerates the placeholder values in the example, because the operator has not -// provisioned the instance yet — and setup mode is tunnel-only (D-025). +// provisioned the instance yet — and setup mode is gated by the `setup` toggle +// (D-045). // // Spec: docs/specs/spec-003-core-door.md §1, §7. package config @@ -45,18 +46,18 @@ const ( // Config is the typed shape of `config.yaml` / `config.example.yaml`. type Config struct { - // Setup forces setup mode (D-026). Together with "no user exists" it makes - // the instance serve only /setup, tunnel-only (D-025, SPEC-005 §3). + // Setup is the setup gate (D-045). While true the app serves the /setup + // wizard; when false with no admin it is LOCKED (a boilerplate telling the + // operator to enable setup). Completion writes `setup: false`. Setup bool `yaml:"setup"` // AdminRecovery is the config approval flag for admin recovery (D-033). // Without it nothing happens (dual control). AdminRecovery bool `yaml:"admin_recovery"` - // SetupCode pins the first-run SETUP CODE (D-044). When blank MyDay - // generates a 128-bit code at first run and prints it in the startup - // banner; setting it here overrides that (the value is then the operator's - // to protect). It is only consulted in setup mode. + // SetupCode is the OPTIONAL first-run setup code (D-044 · D-045). When set, + // the wizard requires it (a second factor); when blank the `setup` toggle + // alone admits. It is only consulted while setup is enabled. SetupCode string `yaml:"setup_code"` Server Server `yaml:"server"` @@ -227,8 +228,8 @@ func (c *Config) Validate() error { } // Setup mode may run with placeholder secrets: the operator has not yet - // provisioned the instance, and it is tunnel-only (D-025). Productive - // mode is strict. + // provisioned the instance, and it is gated by the `setup` toggle (D-045). + // Productive mode is strict. if c.Setup { return nil } diff --git a/internal/core/httpx/httpx_test.go b/internal/core/httpx/httpx_test.go index f98aadc..a786c46 100644 --- a/internal/core/httpx/httpx_test.go +++ b/internal/core/httpx/httpx_test.go @@ -117,37 +117,6 @@ func TestSecureFromRequestDefaultsFalse(t *testing.T) { } } -// TestSetupRequestAllowed pins D-025 (revised): only a loopback TCP peer with -// NO X-Forwarded-For is the direct tunnel; everything else — including a -// loopback peer carrying XFF, or an unparseable peer — fails closed. -func TestSetupRequestAllowed(t *testing.T) { - cases := []struct { - name string - peer string - xff string - want bool - }{ - {"loopback peer, no XFF", "127.0.0.1:52345", "", true}, - {"loopback peer with XFF", "127.0.0.1:52345", "203.0.113.9", false}, - {"remote peer", "203.0.113.9:4444", "", false}, - {"remote peer with XFF", "203.0.113.9:4444", "198.51.100.7", false}, - {"empty peer", "", "", false}, - {"unparseable peer", "not-an-address", "", false}, - } - for _, tc := range cases { - t.Run(tc.name, func(t *testing.T) { - r := httptest.NewRequest("GET", "/setup", nil) - r.RemoteAddr = tc.peer - if tc.xff != "" { - r.Header.Set("X-Forwarded-For", tc.xff) - } - if got := httpx.SetupRequestAllowed(r); got != tc.want { - t.Errorf("SetupRequestAllowed = %v, want %v", got, tc.want) - } - }) - } -} - func TestClientIPUntrustedPeerIgnoresXFF(t *testing.T) { tp, _ := httpx.ParseTrustedProxies([]string{"127.0.0.1"}) r := httptest.NewRequest("GET", "/", nil) @@ -232,31 +201,6 @@ func TestIsLoopbackHost(t *testing.T) { } } -// TestIsLoopbackIPFailsClosed pins the setup-mode gate's predicate (H2): an -// empty or unparseable resolved client IP must NOT count as loopback. -func TestIsLoopbackIPFailsClosed(t *testing.T) { - cases := []struct { - ip string - want bool - }{ - {"127.0.0.1", true}, - {"127.0.0.5", true}, - {"::1", true}, - {"localhost", true}, - {"[::1]", true}, - {"203.0.113.9", false}, - {"10.0.0.5", false}, - {"", false}, // unparseable: fail closed - {"not-an-ip", false}, - {"0.0.0.0", false}, - } - for _, tc := range cases { - if got := httpx.IsLoopbackIP(tc.ip); got != tc.want { - t.Errorf("IsLoopbackIP(%q) = %v, want %v", tc.ip, got, tc.want) - } - } -} - // TestSessionCookieNameForPrefix pins L1s: the `__Host-` prefix is used exactly // when the cookie is Secure (a browser rejects a `__Host-` cookie over http). func TestSessionCookieNameForPrefix(t *testing.T) { diff --git a/internal/core/httpx/loopback.go b/internal/core/httpx/loopback.go index 185a06a..4e32c9b 100644 --- a/internal/core/httpx/loopback.go +++ b/internal/core/httpx/loopback.go @@ -2,7 +2,6 @@ package httpx import ( "net" - "net/http" "strings" ) @@ -19,38 +18,8 @@ func IsLoopbackHost(hostport string) bool { return !known || loopback } -// IsLoopbackIP reports whether a RESOLVED client IP (or a raw TCP peer address) -// is loopback. It gates the setup-mode check (SPEC-003 §7, D-025) and therefore -// FAILS CLOSED in the other direction: an empty or unparseable value is NOT -// loopback. -func IsLoopbackIP(ip string) bool { - loopback, known := classifyHost(ip) - return known && loopback -} - -// SetupRequestAllowed reports whether a request may be served while the -// instance is in setup mode (SPEC-003 §7, D-025 revised 2026-10-15): the TCP -// PEER (the connection's RemoteAddr) must be loopback AND the request must -// carry NO `X-Forwarded-For` — i.e. the direct SSH tunnel. Anything else, -// including a request relayed by a trusted proxy, is refused (the door answers -// 404 before dispatch). -// -// Both tests are required: a proxy on the same host presents a loopback peer, -// so the peer alone is not enough — the ABSENCE of `X-Forwarded-For` is what -// proves the request did not traverse a proxy. An empty/unparseable peer fails -// closed. NB: this must be evaluated on the RAW request, before ClientIP() SETS -// the header (A6). -func SetupRequestAllowed(r *http.Request) bool { - if strings.TrimSpace(r.Header.Get("X-Forwarded-For")) != "" { - return false - } - return IsLoopbackIP(r.RemoteAddr) -} - // classifyHost reports whether hostport ("host", "host:port", or a bare IP) is -// loopback, and whether it could be classified at all. The two callers above -// resolve "unknown" in opposite directions on purpose: each is fail-closed for -// its own decision. +// loopback, and whether it could be classified at all. // // "Unknown" is only an empty/blank value: a NAME that is not `localhost` is // known — and it is not loopback. diff --git a/internal/core/httpx/scheme.go b/internal/core/httpx/scheme.go index d9362b7..037e010 100644 --- a/internal/core/httpx/scheme.go +++ b/internal/core/httpx/scheme.go @@ -21,7 +21,7 @@ func WithSecure(ctx context.Context, secure bool) context.Context { // SecureFromRequest reports whether the request is served over https, as // resolved by the door (D-043). The zero value is false — plain http — which is -// what keeps the loopback bootstrap (the SSH tunnel) working. +// what keeps a plain-http bootstrap working. func SecureFromRequest(r *http.Request) bool { v, _ := r.Context().Value(secureKey{}).(bool) return v diff --git a/internal/core/server/server.go b/internal/core/server/server.go index 95d724d..97080dc 100644 --- a/internal/core/server/server.go +++ b/internal/core/server/server.go @@ -61,14 +61,19 @@ type Deps struct { PreSession *httpx.PreSessionCSRF // TrustedProxies overrides the set parsed from Config.Server.TrustedProxies. TrustedProxies httpx.TrustedProxies - // SetupMode reports whether the instance is in setup mode (D-025). When nil - // it defaults to Config.Setup; the entrypoint widens it to "or no user - // exists" (SPEC-005 §3). + // SetupMode reports whether the WIZARD is enabled — the config toggle + // `setup` (D-045). When nil it defaults to Config.Setup; the entrypoint + // also clears it in-process once the wizard completes. SetupMode func() bool - // SetupGate is the D-044 first-run gate: the setup code + the signed unlock - // cookie, and the first-run boilerplate. When nil, setup mode keeps the - // strict behaviour (only the tunnel served; everything else 404) — the - // entrypoint always wires it. + // LockedMode reports whether the instance is LOCKED: `setup: false` and no + // admin exists yet (D-045). In that state `GET /` and `GET /setup` render + // the "enable setup" boilerplate and every other route is 404 — the state + // is deliberately not publicly claimable. When nil it is never locked. + LockedMode func() bool + // SetupGate is the first-run gate: the OPTIONAL setup code + the signed + // unlock cookie, and the first-run pages (D-044/D-045). When nil, setup + // mode keeps the strict behaviour (only `/setup` served, everything else + // 404) — the entrypoint always wires it. SetupGate SetupGate // RoleGate enforces per-function authorisation. Defaults to // AllowAuthenticated. @@ -95,6 +100,7 @@ type Server struct { precsrf *httpx.PreSessionCSRF trusted httpx.TrustedProxies setup func() bool + locked func() bool gate SetupGate roles RoleGate log *slog.Logger @@ -102,18 +108,25 @@ type Server struct { limiter *middleware.RateLimiter } -// SetupGate is the D-044 first-run gate the door consults while in setup mode. -// It answers "does this request carry a granted setup-code unlock?" and renders -// the friendly first-run BOILERPLATE that replaces the bare 404. It is -// implemented by *setup.Gate; declaring the seam here keeps the door free of the -// setup package's internals. +// SetupGate is the first-run gate the door consults. It reports whether a +// required setup code has been unlocked and renders the first-run pages that +// replace a bare 404 (D-044/D-045). It is implemented by *setup.Gate; +// declaring the seam here keeps the door free of the setup package's internals. type SetupGate interface { + // Required reports whether a setup code is required to reach the wizard + // (D-045: `setup_code` is set). When false the `setup` toggle alone admits. + Required() bool // Unlocked reports whether the request carries a valid setup-code unlock - // (gate b, SPEC-003 §7). - Unlocked(r *http.Request) bool - // Boilerplate renders the first-run page with the setup-code entry form // (D-044). - Boilerplate(w http.ResponseWriter, r *http.Request) error + Unlocked(r *http.Request) bool + // CodeForm renders the setup-code entry page (setup_code set, not yet + // unlocked). + CodeForm(w http.ResponseWriter, r *http.Request) error + // Landing renders the page `GET /` shows while setup is enabled. + Landing(w http.ResponseWriter, r *http.Request) error + // Locked renders the "enable setup and restart" page (setup: false, no + // admin). + Locked(w http.ResponseWriter, r *http.Request) error } // New validates the dependencies and builds the door. @@ -154,6 +167,10 @@ func New(d Deps) (*Server, error) { cfg := d.Config setup = func() bool { return cfg.Setup } } + locked := d.LockedMode + if locked == nil { + locked = func() bool { return false } + } logger := d.Logger if logger == nil { logger = slog.Default() @@ -179,6 +196,7 @@ func New(d Deps) (*Server, error) { precsrf: d.PreSession, trusted: trusted, setup: setup, + locked: locked, gate: d.SetupGate, roles: roles, log: logger, @@ -191,9 +209,9 @@ func New(d Deps) (*Server, error) { func (s *Server) Handler() http.Handler { return middleware.CorrelationID(s) } // Serve binds listen and serves the door until it fails. Any address may be -// bound — including `0.0.0.0:8080` behind a reverse proxy (D-025 revised, -// D-043); the bootstrap is protected per request by the setup gate, not by a -// bind check. +// bound — including `0.0.0.0:8080` behind a reverse proxy (D-043); the +// bootstrap is gated per request by the `setup` toggle (D-045), not by a bind +// check. func (s *Server) Serve(listen string) error { s.log.Info("myday: listening", "addr", listen, "setup_mode", s.setup()) srv := &http.Server{ @@ -208,10 +226,6 @@ func (s *Server) Serve(listen string) error { func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) { start := s.now() - // D-025 (revised): the setup gate must see the RAW X-Forwarded-For, before - // step 2 below SETS it (A6). Capture the tunnel verdict now. - setupTunnel := httpx.SetupRequestAllowed(r) - ctx := r.Context() cid := middleware.CorrelationFrom(ctx) if cid == "" { @@ -269,47 +283,63 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) { res = s.disp.Dispatch(r.URL.Path, r.FormValue("do"), r.FormValue("action")) // 6. the Kind switch. - s.dispatch(sw, r, res, cid, ip, setupTunnel) + s.dispatch(sw, r, res, cid, ip) } // dispatch is the Kind switch (SPEC-003 §4 step 5). -func (s *Server) dispatch(w http.ResponseWriter, r *http.Request, res routing.Resolution, cid, ip string, setupTunnel bool) { - // SPEC-003 §7 / D-025 (2026-10-15b) / D-044 / A13: setup mode is gated PER - // REQUEST by EITHER (a) the direct SSH tunnel — a loopback TCP peer carrying - // no X-Forwarded-For (a same-host proxy presents a loopback peer, so the - // ABSENCE of XFF is the proof it did not traverse one; an empty/unparseable - // peer fails closed) — OR (b) a valid setup-code unlock (D-044). The RAW - // tunnel verdict was captured before ClientIP SET the header. +func (s *Server) dispatch(w http.ResponseWriter, r *http.Request, res routing.Resolution, cid, ip string) { + // SPEC-005 §3 / D-045: the setup gate is the config toggle `setup`, + // evaluated per request. + // + // * wizard mode (`setup: true`) — `GET /setup` serves the wizard. If a + // `setup_code` is set it must be unlocked first (D-044); `GET /` points + // at the wizard; every other route is 404. + // * locked mode (`setup: false`, no admin) — `GET /` and `GET /setup` + // render the "enable setup" boilerplate; every other route is 404. + // Deliberately not claimable: the operator must flip the toggle. if s.setup() { - unlocked := s.gate != nil && s.gate.Unlocked(r) - allowed := setupTunnel || unlocked + admitted := s.setupAdmitted(r) + // Static assets are the first-run pages' stylesheet — served in every + // first-run state (SPEC-005 §3). + static := res.Kind == routing.KindRoute && res.Workflow == "static" - // The boilerplate's code form is the ONE request reachable without the - // tunnel or an unlock — it is what GRANTS the unlock (D-044). It is - // rate-limited with the rest of /setup (A3) and CSRF-protected (A15). - if !s.isSetupUnlock(res) { - switch { - case res.Kind == routing.KindRedirect && res.Redirect == "/home": - // `GET /` — the friendly first-run page, ALWAYS in setup mode - // (never a bare 404: the domain must not look "down", D-044). - s.serveBoilerplate(w, r, cid, ip) - return - case res.Kind == routing.KindSetup && !allowed: - // `GET /setup` without the tunnel or a code — the same page, - // with the setup-code form. - s.serveBoilerplate(w, r, cid, ip) - return - case !allowed || !setupAllowed(res): - // SPEC-005 §3: once allowed, the app serves ONLY /setup (+ - // static assets); every other route is 404 (delete, don't - // redirect). Without the tunnel or a code, every route but `/` - // and `/setup` above is 404 too. - s.log.Warn("setup request refused: not the direct tunnel and not unlocked", - "correlation_id", cid, "client_ip", ip, - "path", httpx.RedactPath(r.URL.Path)) - s.writeError(w, http.StatusNotFound, "not found") - return - } + switch { + case res.Kind == routing.KindRedirect && res.Redirect == "/home": + // `GET /` — point at the wizard (never the app, D-045). + s.serveLanding(w, r, cid, ip) + return + case res.Kind == routing.KindSetup && !admitted: + // `GET /setup` with a required code not yet entered. + s.serveCodeForm(w, r, cid, ip) + return + case static: + // fall through — the wizard's stylesheet. + case !s.isSetupUnlock(res) && (!admitted || !setupAllowed(res)): + // SPEC-005 §3: once admitted, the app serves ONLY /setup; every + // other route is 404 (delete, don't redirect). The unlock action is + // the one exception — it is what grants the unlock (D-044). + s.log.Warn("setup request refused: the wizard is not admitted", + "correlation_id", cid, "client_ip", ip, + "path", httpx.RedactPath(r.URL.Path)) + s.writeError(w, http.StatusNotFound, "not found") + return + } + } else if s.locked() { + // D-045: `setup: false` and no admin — a friendly, non-claimable + // boilerplate at `/` and `/setup`; 404 elsewhere (static assets are the + // one exception, so the boilerplate renders inside the shell). + switch { + case res.Kind == routing.KindRedirect && res.Redirect == "/home": + s.serveLocked(w, r, cid, ip) + return + case res.Kind == routing.KindSetup: + s.serveLocked(w, r, cid, ip) + return + case res.Kind == routing.KindRoute && res.Workflow == "static": + // fall through — the boilerplate's stylesheet (SPEC-005 §3). + default: + s.writeError(w, http.StatusNotFound, "not found") + return } } @@ -392,24 +422,32 @@ func (s *Server) dispatch(w http.ResponseWriter, r *http.Request, res routing.Re } } -// setupAllowed reports whether a Resolution is one of the only routes served -// while in setup mode: the wizard itself (`/setup`, path or action) and static -// assets (SPEC-005 §3). Everything else — including the canonical redirect and -// every GUID branch — is 404. +// setupAllowed reports whether a Resolution is the wizard itself — the +// reserved `setup` workflow, path or action (SPEC-005 §3). Used while the +// wizard is enabled: everything else is 404. Static assets are handled +// separately (they are served in every first-run state). func setupAllowed(res routing.Resolution) bool { switch res.Kind { case routing.KindSetup: return true case routing.KindAction: return res.Workflow == "setup" - case routing.KindRoute: - return res.Workflow == "static" } return false } +// setupAdmitted reports whether the request may reach the wizard while +// `setup: true` (D-045): always when no `setup_code` is required, otherwise +// only with a valid code unlock (D-044). +func (s *Server) setupAdmitted(r *http.Request) bool { + if s.gate == nil || !s.gate.Required() { + return true + } + return s.gate.Unlocked(r) +} + // isSetupUnlock reports whether res is the D-044 unlock action — the ONE request -// served in setup mode without the tunnel or an unlock, because it is what +// served while the wizard is enabled without an unlock, because it is what // grants the unlock. The door still pins it to the `setup` module // (serveSetupAction), so a `do=core` under /setup cannot ride this carve-out. func (s *Server) isSetupUnlock(res routing.Resolution) bool { @@ -419,17 +457,33 @@ func (s *Server) isSetupUnlock(res routing.Resolution) bool { res.Function == "unlock" } -// serveBoilerplate renders the D-044 first-run page. It is the hand-off target -// for `GET /` and for `GET /setup` before the wizard is unlocked, so the domain -// never answers a bare 404. A nil gate (not wired) keeps the strict 404 — the +// serveCodeForm renders the setup-code entry page — `GET /setup` with a required +// code not yet entered. A nil gate (not wired) keeps the strict 404; the // entrypoint always wires it. -func (s *Server) serveBoilerplate(w http.ResponseWriter, r *http.Request, cid, ip string) { +func (s *Server) serveCodeForm(w http.ResponseWriter, r *http.Request, cid, ip string) { + s.serveGatePage(w, r, cid, ip, "code form", func(g SetupGate) error { return g.CodeForm(w, r) }) +} + +// serveLanding renders the page `GET /` shows while `setup: true` (D-045). +func (s *Server) serveLanding(w http.ResponseWriter, r *http.Request, cid, ip string) { + s.serveGatePage(w, r, cid, ip, "setup landing", func(g SetupGate) error { return g.Landing(w, r) }) +} + +// serveLocked renders the "enable setup" boilerplate (D-045). +func (s *Server) serveLocked(w http.ResponseWriter, r *http.Request, cid, ip string) { + s.serveGatePage(w, r, cid, ip, "locked boilerplate", func(g SetupGate) error { return g.Locked(w, r) }) +} + +// serveGatePage hands off to a first-run page rendered by the gate, mapping a +// render fault to a logged 500. A nil gate keeps the strict 404 — the +// entrypoint always wires it. +func (s *Server) serveGatePage(w http.ResponseWriter, r *http.Request, cid, ip, label string, render func(SetupGate) error) { if s.gate == nil { s.writeError(w, http.StatusNotFound, "not found") return } - if err := s.gate.Boilerplate(w, r); err != nil { - s.log.Error("setup: render boilerplate", "correlation_id", cid, "client_ip", ip, "error", err) + if err := render(s.gate); err != nil { + s.log.Error("setup: render "+label, "correlation_id", cid, "client_ip", ip, "error", err) s.writeError(w, http.StatusInternalServerError, "internal error") } } diff --git a/internal/core/server/server_test.go b/internal/core/server/server_test.go index aca3977..d8d1153 100644 --- a/internal/core/server/server_test.go +++ b/internal/core/server/server_test.go @@ -185,8 +185,10 @@ func newHarness(t *testing.T, opts ...func(*server.Deps)) *harness { t.Fatalf("NewPreSessionCSRF: %v", err) } - // D-044: the first-run gate. It is only consulted in setup mode; wiring it - // here lets a setup-mode test exercise the code + the boilerplate. + // The first-run gate (D-044/D-045). It is only consulted while the wizard is + // enabled; a REQUIRED code is wired here so a setup-mode test exercises the + // code form + the unlock. A test that wants the code-less wizard overrides + // SetupGate. gate, err := setup.NewGate("test-setup-code", pre, nil) if err != nil { t.Fatalf("setup.NewGate: %v", err) @@ -275,16 +277,14 @@ func (h *harness) cookie() *http.Cookie { return &http.Cookie{Name: httpx.SessionCookieName, Value: h.session.ID} } -// loopbackPeer is the RemoteAddr the test door speaks from. Setup mode is -// tunnel-only PER REQUEST (SPEC-003 §7, D-025): a loopback peer with no XFF. -// Tests must explicitly opt in to a different peer (or add XFF) to exercise -// the rejection. +// loopbackPeer is the RemoteAddr the test door speaks from. It is a plain +// same-host peer: the setup gate is the `setup` toggle (D-045), not the peer. const loopbackPeer = "127.0.0.1:52345" // request issues a request directly against the door (no network). func request(h http.Handler, method, target string, cookies ...*http.Cookie) *httptest.ResponseRecorder { req := httptest.NewRequest(method, target, nil) - req.RemoteAddr = loopbackPeer // the operator reaches /setup over a tunnel + req.RemoteAddr = loopbackPeer for _, c := range cookies { req.AddCookie(c) } @@ -468,26 +468,35 @@ func TestAC6_ActionRequiresCSRF(t *testing.T) { // ── AC-7 · AC-10 ───────────────────────────────────────────────────────────── -// TestAC7_SetupGateIsTunnelOnly pins D-025 (2026-10-15b) + D-044: in setup mode -// the WIZARD is served only to the direct SSH tunnel — a loopback TCP peer with -// NO X-Forwarded-For. Anyone else gets the friendly first-run page (never a bare -// 404, D-044), and never the wizard. The bind is not checked: any address may be -// bound (D-043). -func TestAC7_SetupGateIsTunnelOnly(t *testing.T) { - h := newHarness(t, func(d *server.Deps) { d.SetupMode = func() bool { return true } }) +// TestAC7_SetupGateIsTheConfigToggle covers D-045 + D-044 at the door: while the +// wizard is enabled with a required setup code, the code is the gate — no peer +// (loopback or proxied) reaches the wizard without the unlock, and every visitor +// sees the code form. The peer/tunnel rule of D-025 is retired. The unlock +// action itself is the ONE request admitted without an unlock. +func TestAC7_SetupGateIsTheConfigToggle(t *testing.T) { + unlocked := func(w http.ResponseWriter, r *http.Request, _ *server.RequestContext) error { + http.SetCookie(w, &http.Cookie{Name: setup.SetupUnlockCookieName, Value: "granted", Path: "/"}) + http.Redirect(w, r, "/setup", http.StatusSeeOther) + return nil + } + h := newHarness(t, func(d *server.Deps) { + d.SetupMode = func() bool { return true } + reg := testRegistry(nil) + reg.RegisterModule(server.NewModule("setup"). + AddAction("unlock", "unlock", unlocked). + AddAction("domain.save", "domain.save", unlocked)) + d.Registry = reg + }) cases := []struct { - name string - peer string - xff string - wizard bool - comment string + name string + peer string + xff string }{ - {"the direct tunnel", loopbackPeer, "", true, "loopback peer, no XFF → the wizard (gate a)"}, - {"relayed by a same-host proxy", "127.0.0.1:9999", "203.0.113.9", false, "loopback peer WITH XFF → the boilerplate (AC-7)"}, - {"a remote peer", "203.0.113.9:4444", "", false, "non-loopback peer → the boilerplate (AC-10)"}, - {"a remote peer behind a proxy", "203.0.113.9:4444", "198.51.100.7", false, "non-loopback peer + XFF → the boilerplate (AC-10)"}, - {"an unparseable peer", "", "", false, "fail closed → the boilerplate"}, + {"a loopback peer", loopbackPeer, ""}, + {"a same-host proxy", "127.0.0.1:9999", "203.0.113.9"}, + {"a remote peer", "203.0.113.9:4444", ""}, + {"a remote peer behind a proxy", "203.0.113.9:4444", "198.51.100.7"}, } for _, tc := range cases { t.Run(tc.name, func(t *testing.T) { @@ -499,23 +508,42 @@ func TestAC7_SetupGateIsTunnelOnly(t *testing.T) { rec := httptest.NewRecorder() h.srv.ServeHTTP(rec, req) if rec.Code != http.StatusOK { - t.Fatalf("GET /setup (%s) = %d, want 200 — never a bare 404 (D-044)", tc.comment, rec.Code) + t.Fatalf("GET /setup (%s) = %d, want 200 (the code form)", tc.name, rec.Code) } body := rec.Body.String() - if tc.wizard { - if !strings.Contains(body, "Bootstrap wizard") { - t.Errorf("GET /setup (%s) did not serve the wizard", tc.comment) - } - return - } - if !strings.Contains(body, "not set up yet") { - t.Errorf("GET /setup (%s) did not serve the first-run boilerplate (D-044)", tc.comment) - } if strings.Contains(body, "Bootstrap wizard") { - t.Errorf("GET /setup (%s) reached the wizard without the tunnel (D-025/D-044)", tc.comment) + t.Errorf("GET /setup (%s) reached the wizard without the code (D-045)", tc.name) + } + if !strings.Contains(body, `name="code"`) { + t.Errorf("GET /setup (%s) did not show the code form (D-044)", tc.name) } }) } + + // A non-unlock wizard step is refused before dispatch while not admitted. + if rec := request(h.srv, "POST", "/setup?do=setup&action=domain.save"); rec.Code != http.StatusNotFound { + t.Errorf("domain.save without the unlock = %d, want 404 (D-045)", rec.Code) + } + + // The unlock action is the ONE carve-out: admitted without an unlock (it is + // what grants it), and it needs the pre-session CSRF token (A15). + cookie, token := h.preCSRF() + form := url.Values{"csrf": {token}, "code": {"whatever"}} + req := httptest.NewRequest("POST", "/setup?do=setup&action=unlock", strings.NewReader(form.Encode())) + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + req.RemoteAddr = loopbackPeer + req.AddCookie(cookie) + rec := httptest.NewRecorder() + h.srv.ServeHTTP(rec, req) + if rec.Code != http.StatusSeeOther { + t.Errorf("POST unlock (the carve-out) = %d, want 303 (D-044)", rec.Code) + } + + // Without the CSRF token it is refused (A15). + rec = request(h.srv, "POST", "/setup?do=setup&action=unlock") + if rec.Code != http.StatusForbidden { + t.Errorf("POST unlock without CSRF = %d, want 403 (A15)", rec.Code) + } } // ── AC-8 ───────────────────────────────────────────────────────────────────── @@ -679,7 +707,8 @@ func TestRequestContextHandover(t *testing.T) { } } -// TestSetupModeRouting: /setup is served only in setup mode (SPEC-003 §4). +// TestSetupModeRouting: /setup is served only while the wizard is enabled +// (SPEC-003 §4, D-045). func TestSetupModeRouting(t *testing.T) { productive := newHarness(t) if rec := request(productive.srv, "GET", "/setup"); rec.Code != http.StatusNotFound { @@ -690,37 +719,39 @@ func TestSetupModeRouting(t *testing.T) { t.Errorf("POST /setup?do=setup in productive mode = %d, want 404", rec.Code) } + // Setup mode: /setup is served — the harness gate requires a code, so this + // is the code form (200), never a bare 404 (D-045). inSetup := newHarness(t, func(d *server.Deps) { d.SetupMode = func() bool { return true } }) if rec := request(inSetup.srv, "GET", "/setup"); rec.Code != http.StatusOK { t.Errorf("GET /setup in setup mode = %d, want 200", rec.Code) } } -// TestSpec003SetupIsLoopbackOnlyPerRequest covers AC-10/D-025 + D-044: the setup -// gate is per request — a loopback TCP peer AND no X-Forwarded-For (the direct -// SSH tunnel) serves the wizard. A proxy on 127.0.0.1 relaying a remote client -// presents a loopback peer but carries XFF, so it gets the first-run boilerplate -// (never the wizard), and every other route is 404. -func TestSpec003SetupIsLoopbackOnlyPerRequest(t *testing.T) { +// TestSpec003SetupGateIsPerRequest covers AC-10 under D-045: while the wizard +// is enabled with a required code, `GET /setup` is the code form from EVERY +// peer — the wizard needs the unlock, which is not a peer property (the D-025 +// tunnel rule is retired). Every non-wizard route is 404. +func TestSpec003SetupGateIsPerRequest(t *testing.T) { h := newHarness(t, func(d *server.Deps) { d.SetupMode = func() bool { return true } }) - // A remote client → the boilerplate at /setup, and 404 for everything else - // (including the wizard's own steps, which need the unlock). + // A remote client: the code form, never the wizard. req := httptest.NewRequest("GET", "/setup", nil) req.RemoteAddr = "203.0.113.9:4444" rec := httptest.NewRecorder() h.srv.ServeHTTP(rec, req) - if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), "not set up yet") { - t.Errorf("GET /setup from a remote client = %d, want the first-run page (D-044)", rec.Code) + if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), `name="code"`) { + t.Errorf("GET /setup from a remote client = %d, want the code form (D-045)", rec.Code) } if strings.Contains(rec.Body.String(), "Bootstrap wizard") { - t.Error("GET /setup from a remote client reached the wizard (D-025)") + t.Error("GET /setup from a remote client reached the wizard without the code (D-045)") } + // Every other route is 404. (Static assets are the first-run stylesheet, so + // they are served — see TestSpec009_StaticIsServedInSetupMode.) for _, tc := range []struct{ method, target string }{ {"POST", "/setup?do=setup&action=domain.save"}, - {"GET", "/static/app.css"}, {"GET", "/home"}, + {"GET", "/" + h.guid}, } { req := httptest.NewRequest(tc.method, tc.target, nil) req.RemoteAddr = "203.0.113.9:4444" // a remote peer through the proxy @@ -730,29 +761,6 @@ func TestSpec003SetupIsLoopbackOnlyPerRequest(t *testing.T) { t.Errorf("%s %s from a non-loopback client = %d, want 404 (AC-10)", tc.method, tc.target, rec.Code) } } - - // The tunnel (a loopback peer, no XFF) still works. - if rec := request(h.srv, "GET", "/setup"); rec.Code != http.StatusOK { - t.Errorf("GET /setup from loopback = %d, want 200 (the tunnel must work)", rec.Code) - } - - // A TRUSTED proxy forwarding X-Forwarded-For gets the boilerplate, never the - // wizard: the absence of XFF is what proves the direct tunnel. - h2 := newHarness(t, func(d *server.Deps) { - d.SetupMode = func() bool { return true } - d.Config.Server.TrustedProxies = []string{"127.0.0.1"} - }) - req = httptest.NewRequest("GET", "/setup", nil) - req.RemoteAddr = "127.0.0.1:9999" // the proxy itself is local... - req.Header.Set("X-Forwarded-For", "203.0.113.9") - rec = httptest.NewRecorder() - h2.srv.ServeHTTP(rec, req) - if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), "not set up yet") { - t.Errorf("GET /setup relayed by a trusted proxy = %d, want the boilerplate (AC-7)", rec.Code) - } - if strings.Contains(rec.Body.String(), "Bootstrap wizard") { - t.Error("GET /setup relayed by a trusted proxy reached the wizard (AC-7: tunnel-only)") - } } // TestSpec003SetupModulePinnedAtTheDoor covers M1c/L3s: the wizard's module is diff --git a/internal/core/server/setup_code_test.go b/internal/core/server/setup_code_test.go index 0dd4200..06e68c7 100644 --- a/internal/core/server/setup_code_test.go +++ b/internal/core/server/setup_code_test.go @@ -1,10 +1,17 @@ package server_test -// D-044 — the first-run SETUP CODE and the boilerplate (SPEC-005 §3/§4, -// SPEC-003 §7 / AC-14). These tests drive the real `/setup` gate end to end: -// `GET /` and `GET /setup` must never be a bare 404, the correct code unlocks -// the wizard, a wrong code is a generic (rate-limited) answer, and every other -// route stays 404 until setup completes. +// D-045 — the setup gate is the config toggle `setup` (SPEC-005 §3/§4, +// SPEC-003 §7). These tests drive the real `/setup` gate end to end: +// +// * `setup: false`, no admin → LOCKED: `/` and `/setup` render an "enable +// setup" boilerplate (never a bare 404), every other route 404, and the +// wizard is not claimable; +// * `setup: true`, no code → the wizard is served directly; +// * `setup: true`, code set → the code form comes first (D-044), and the +// correct code unlocks the wizard. +// +// The D-044 code mechanics (single-use · rate-limited · CSRF · redacted) are +// exercised here too. import ( "log/slog" @@ -20,13 +27,14 @@ import ( ) // proxyPeer / proxyXFF are a same-host reverse proxy relaying a remote client: -// a loopback TCP peer that carries X-Forwarded-For — i.e. NOT the tunnel. +// a loopback TCP peer that carries X-Forwarded-For. Under D-045 the peer no +// longer decides setup access, but the proxy path is still the realistic one. const ( proxyPeer = "127.0.0.1:9999" proxyXFF = "203.0.113.9" ) -// proxyGet issues a GET from behind the proxy (gate a does not apply). +// proxyGet issues a GET from behind the proxy. func (h *setupHarness) proxyGet(target string, cookies ...*http.Cookie) *httptest.ResponseRecorder { h.t.Helper() req := httptest.NewRequest("GET", target, nil) @@ -74,67 +82,68 @@ func unlockCookie(t *testing.T, rec *httptest.ResponseRecorder) *http.Cookie { return nil } -// ── the boilerplate (never a bare 404) ─────────────────────────────────────── +// ── state 2 · `setup: true` without a code (D-045) ─────────────────────────── -// TestD044_BoilerplateAtRootAndSetup: in setup mode, without the tunnel, `GET /` -// and `GET /setup` render the friendly first-run page with the setup-code form. -func TestD044_BoilerplateAtRootAndSetup(t *testing.T) { - h := newSetupHarness(t) +// TestD045_NoCodeServesTheWizardDirectly: with `setup: true` and no +// `setup_code`, `GET /setup` is the wizard for every visitor — no form, no +// unlock. `GET /` points at it. +func TestD045_NoCodeServesTheWizardDirectly(t *testing.T) { + h := newSetupHarness(t) // default: no code required - for _, target := range []string{"/", "/setup"} { - t.Run(target, func(t *testing.T) { - rec := h.proxyGet(target) - if rec.Code != http.StatusOK { - t.Fatalf("GET %s = %d, want 200 — never a bare 404 (D-044)", target, rec.Code) - } - body := rec.Body.String() - for _, want := range []string{ - "MyDay is not set up yet", - `action="/setup?do=setup&action=unlock"`, - `name="code"`, - "journalctl -u myday", - "pct exec 11020", - } { - if !strings.Contains(body, want) { - t.Errorf("GET %s boilerplate is missing %q", target, want) - } - } - // It must not be the wizard, and it must not be a bare 404 body. - if strings.Contains(body, "domain.save") { - t.Errorf("GET %s served the WIZARD without the code/tunnel (D-044)", target) - } - // The anonymous form carries the pre-session CSRF cookie (A15). - if !hasCookie(rec, httpx.PreSessionCookieName) { - t.Errorf("GET %s issued no pre-session CSRF cookie (A15)", target) - } - }) - } -} - -// TestD044_OtherRoutesStillNotFound: in setup mode, before the unlock, every -// route other than `/` and `/setup` is 404 — the bootstrap has no app yet. -func TestD044_OtherRoutesStillNotFound(t *testing.T) { - h := newSetupHarness(t) - - // A GUID branch: the resolver does not even know this name. - for _, target := range []string{"/home", "/access", "/some-guid", "/some-guid/home"} { - if rec := h.proxyGet(target); rec.Code != http.StatusNotFound { - t.Errorf("GET %s in setup mode = %d, want 404 (SPEC-005 §3)", target, rec.Code) + for name, rec := range map[string]*httptest.ResponseRecorder{ + "loopback": request(h.srv, "GET", "/setup"), + "proxied": h.proxyGet("/setup"), + } { + if rec.Code != http.StatusOK { + t.Fatalf("GET /setup (%s) = %d, want 200 (the wizard)", name, rec.Code) + } + body := rec.Body.String() + if !strings.Contains(body, "domain.save") { + t.Errorf("GET /setup (%s) did not render the wizard (D-045)", name) + } + if strings.Contains(body, `action="/setup?do=setup&action=unlock"`) { + t.Errorf("GET /setup (%s) showed the code form though no code is required (D-045)", name) } } - // The wizard's own steps are NOT steppable without the unlock. - if rec := h.proxyPost("domain.save", url.Values{"base_url": {"https://example.com"}}); rec.Code != http.StatusNotFound { - t.Errorf("POST domain.save before unlock = %d, want 404 (D-044)", rec.Code) + + // `GET /` is a landing pointing at the wizard — never a bare 404, never the + // wizard itself. + root := h.proxyGet("/") + if root.Code != http.StatusOK { + t.Fatalf("GET / = %d, want 200 (D-045)", root.Code) + } + if !strings.Contains(root.Body.String(), "/setup") { + t.Error("GET / did not point at the wizard (D-045)") } } -// ── unlock ─────────────────────────────────────────────────────────────────── +// ── state 2 · `setup: true` with a code (D-044) ────────────────────────────── -// TestD044_CorrectCodeUnlocksTheWizard: the correct code unlocks the wizard for -// that browser (a signed flag cookie, not a session), and `GET /setup` then -// renders the wizard. -func TestD044_CorrectCodeUnlocksTheWizard(t *testing.T) { - h := newSetupHarness(t) +// TestD045_CodeFormAndUnlock: with `setup_code` set, `GET /setup` shows the code +// form; the correct code unlocks the wizard for that browser. +func TestD045_CodeFormAndUnlock(t *testing.T) { + h := newSetupHarness(t, withSetupCode("t3st-c0de-9999")) + + form := h.proxyGet("/setup") + if form.Code != http.StatusOK { + t.Fatalf("GET /setup with a code set = %d, want 200 (the form)", form.Code) + } + for _, want := range []string{ + `action="/setup?do=setup&action=unlock"`, + `name="code"`, + "not set up yet", + } { + if !strings.Contains(form.Body.String(), want) { + t.Errorf("the code form is missing %q", want) + } + } + if strings.Contains(form.Body.String(), "domain.save") { + t.Error("GET /setup served the wizard before the code (D-044)") + } + // The anonymous form carries the pre-session CSRF cookie (A15). + if !hasCookie(form, httpx.PreSessionCookieName) { + t.Error("the code form issued no pre-session CSRF cookie (A15)") + } rec := h.proxyPost("unlock", url.Values{"code": {h.code}}) if rec.Code != http.StatusSeeOther { @@ -151,47 +160,30 @@ func TestD044_CorrectCodeUnlocksTheWizard(t *testing.T) { t.Error("the unlock cookie is not HttpOnly") } - // The wizard is now served to this browser over the proxy. got := h.proxyGet("/setup", c) if got.Code != http.StatusOK { t.Fatalf("GET /setup after unlock = %d, want 200 (the wizard)", got.Code) } - body := got.Body.String() - if !strings.Contains(body, "MyDay setup") || !strings.Contains(body, "domain.save") { - t.Errorf("GET /setup after unlock did not render the wizard (D-044)") + if !strings.Contains(got.Body.String(), "domain.save") { + t.Error("GET /setup after unlock did not render the wizard (D-044)") } - // A different browser (no unlock cookie) still gets the boilerplate. + // A different browser (no unlock cookie) still gets the form. if other := h.proxyGet("/setup"); strings.Contains(other.Body.String(), "domain.save") { t.Error("an unlocked browser leaked the wizard to another visitor (D-044)") } } -// TestD044_TunnelNeedsNoCode: the direct SSH tunnel (gate a) still opens the -// wizard without any code (D-025). -func TestD044_TunnelNeedsNoCode(t *testing.T) { - h := newSetupHarness(t) - - rec := request(h.srv, "GET", "/setup") // loopback peer, no XFF — the tunnel - if rec.Code != http.StatusOK { - t.Fatalf("GET /setup over the tunnel = %d, want 200 (D-025 gate a)", rec.Code) - } - if !strings.Contains(rec.Body.String(), "domain.save") { - t.Error("the tunnel did not reach the wizard without a code (D-025)") - } -} - // ── a wrong/absent code is generic and rate-limited ────────────────────────── // TestD044_WrongOrAbsentCodeIsGeneric: neither a wrong nor an absent code // unlocks, and both get the SAME generic answer (no oracle, A3). func TestD044_WrongOrAbsentCodeIsGeneric(t *testing.T) { - h := newSetupHarness(t) + h := newSetupHarness(t, withSetupCode("t3st-c0de-9999")) wrong := h.proxyPost("unlock", url.Values{"code": {"nope-not-the-code"}}) absent := h.proxyPost("unlock", nil) - // Both get the SAME generic answer — no oracle (A3). for name, rec := range map[string]*httptest.ResponseRecorder{"wrong": wrong, "absent": absent} { if rec.Code != http.StatusForbidden { t.Errorf("%s code = %d, want 403 (generic, D-044)", name, rec.Code) @@ -221,7 +213,7 @@ func TestD044_WrongOrAbsentCodeIsGeneric(t *testing.T) { // TestD044_UnlockIsRateLimited: the setup route is rate-limited (A3/AC-9) — a // burst of attempts is answered 429, not a free oracle. func TestD044_UnlockIsRateLimited(t *testing.T) { - h := newSetupHarness(t, func(h *setupHarness) { + h := newSetupHarness(t, withSetupCode("t3st-c0de-9999"), func(h *setupHarness) { h.rateLimit = 2 h.rateWindow = time.Minute }) @@ -243,7 +235,7 @@ func TestD044_UnlockIsRateLimited(t *testing.T) { // TestD044_UnlockRequiresCSRF: the unlock is an anonymous form, so it carries // the pre-session double-submit token (A15) — a POST without it is refused. func TestD044_UnlockRequiresCSRF(t *testing.T) { - h := newSetupHarness(t) + h := newSetupHarness(t, withSetupCode("t3st-c0de-9999")) req := httptest.NewRequest("POST", "/setup?do=setup&action=unlock", strings.NewReader(url.Values{"code": {h.code}}.Encode())) @@ -264,7 +256,7 @@ func TestD044_UnlockRequiresCSRF(t *testing.T) { // TestD044_CodeIsSingleUse: the code retires the moment it works — a second // browser cannot re-use the printed value. func TestD044_CodeIsSingleUse(t *testing.T) { - h := newSetupHarness(t) + h := newSetupHarness(t, withSetupCode("t3st-c0de-9999")) if rec := h.proxyPost("unlock", url.Values{"code": {h.code}}); rec.Code != http.StatusSeeOther { t.Fatalf("first unlock = %d, want 303", rec.Code) @@ -285,7 +277,7 @@ func TestD044_CodeIsSingleUse(t *testing.T) { // the QUERY (a hand-typed URL, say) must never leak it into the access log. func TestD044_CodeIsRedactedFromTheAccessLog(t *testing.T) { var logs strings.Builder - h := newSetupHarness(t, func(h *setupHarness) { + h := newSetupHarness(t, withSetupCode("t3st-c0de-9999"), func(h *setupHarness) { h.logger = slog.New(slog.NewTextHandler(&logs, nil)) }) @@ -306,42 +298,42 @@ func TestD044_CodeIsRedactedFromTheAccessLog(t *testing.T) { // ── the gate, unit-level ───────────────────────────────────────────────────── -// TestD044_GateGeneratesA128BitCode: a blank code generates 128 bits of -// entropy, and the generated value is what the banner prints. -func TestD044_GateGeneratesA128BitCode(t *testing.T) { +// TestD045_BlankCodeIsNotRequired: a blank `setup_code` means no code is +// required, nothing is printed, and no unlock is possible. +func TestD045_BlankCodeIsNotRequired(t *testing.T) { pre := mustPreSessionCSRF(t) gate, err := setup.NewGate("", pre, nil) if err != nil { t.Fatalf("NewGate: %v", err) } - code := gate.Code() - if code == "" { - t.Fatal("NewGate generated no code") + if gate.Required() { + t.Error("a blank code must not be required (D-045)") } - // 16 bytes → 32 hex chars, plus the visual grouping dashes. - plain := strings.ReplaceAll(code, "-", "") - if len(plain) != setup.CodeBytes*2 { - t.Errorf("generated code %q has %d hex chars, want %d (128 bits)", code, len(plain), setup.CodeBytes*2) + if gate.Code() != "" { + t.Errorf("a blank code printed %q, want nothing (D-045)", gate.Code()) } - - // A second gate generates a DIFFERENT code (fresh entropy each boot). - other, err := setup.NewGate("", pre, nil) - if err != nil { - t.Fatalf("NewGate: %v", err) + if gate.Accept("anything") { + t.Error("a non-required gate accepted a code") } - if other.Code() == code { - t.Error("two gates generated the same code") + if gate.Grant() != "" { + t.Error("a non-required gate granted an unlock cookie") } } -// TestD044_GateAcceptsFormattingAndRetires: the comparison ignores case and -// separators, and the accepted code is spent. -func TestD044_GateAcceptsFormattingAndRetires(t *testing.T) { +// TestD044_SetCodeIsRequiredAndRetires: a set `setup_code` is required, is +// printed verbatim, ignores formatting, and is single-use. +func TestD044_SetCodeIsRequiredAndRetires(t *testing.T) { pre := mustPreSessionCSRF(t) gate, err := setup.NewGate("9F3A-1B2C", pre, nil) if err != nil { t.Fatalf("NewGate: %v", err) } + if !gate.Required() { + t.Fatal("a set code must be required (D-045)") + } + if gate.Code() != "9F3A-1B2C" { + t.Errorf("Code() = %q, want the configured value", gate.Code()) + } if gate.Accept("nope") { t.Error("a wrong code was accepted") diff --git a/internal/core/server/setup_wizard_test.go b/internal/core/server/setup_wizard_test.go index c035ce3..ac2ce2f 100644 --- a/internal/core/server/setup_wizard_test.go +++ b/internal/core/server/setup_wizard_test.go @@ -45,7 +45,9 @@ type setupHarness struct { cfg *config.Config cfgPath string prints *bytes.Buffer - // code is the D-044 setup code the harness pins (so tests know it). + // code is the OPTIONAL setup code (D-045). Empty (the default) means no + // code is required and the wizard is served directly; a test that exercises + // the code path sets it via withSetupCode. code string // writeFile overrides the persister (a failing writer exercises the // "print the values" fallback, SPEC-005 §4). @@ -109,32 +111,26 @@ func newSetupHarness(t *testing.T, opts ...func(*setupHarness)) *setupHarness { t: t, ctx: ctx, db: db, users: us, ids: ids, sessions: sessions, csrf: csrf, pre: pre, wa: &fakeWebAuthn{}, totpSvc: totp.New("MyDay", ids), cfg: cfg, cfgPath: filepath.Join(dir, config.FileName), prints: &bytes.Buffer{}, - code: "test-setup-code-1234", } for _, o := range opts { o(h) } - // Setup mode (SPEC-005 §3), latched: config.setup OR not yet bootstrapped. - // Latched at startup so the wizard can finish in-process; cleared by Done(). + // D-045: the three states. `setupMode` is the `setup` toggle, cleared by + // Done(); `locked` is `setup: false` and no user. `bootstrapped` is latched + // at startup (the DB is empty here). bootstrapped := func() bool { n, err := us.Count(context.Background()) - if err != nil || n == 0 { - return false - } - idn, err := ids.ByUserID(context.Background(), 1) - if err != nil { - return false - } - return idn.Status == auth.StatusActive - } - inSetup := cfg.Setup || !bootstrapped() + return err == nil && n > 0 + }() + inSetup := cfg.Setup setupMode := func() bool { if h.setupFlow != nil && h.setupFlow.Done() { return false } return inSetup } + locked := func() bool { return !cfg.Setup && !bootstrapped } // The SPEC-006 flow, reused by the wizard. TOTPOnlyEnroll is the wizard's // D-041 mode (setup enrolls TOTP only); SuccessPath keeps the operator on @@ -178,7 +174,9 @@ func newSetupHarness(t *testing.T, opts ...func(*setupHarness)) *setupHarness { Config: cfg, Resolver: ids, Registry: reg, Sessions: sessions, Identities: ids, Users: us, Audit: aud, CSRF: csrf, PreSession: pre, SetupMode: setupMode, - // D-044: the first-run gate (the setup code + the boilerplate). + // D-045: the non-claimable locked state. + LockedMode: locked, + // D-044/D-045: the optional-code gate + the first-run pages. SetupGate: setupFlow.Gate(), RateLimit: h.rateLimit, RateWindow: h.rateWindow, Logger: h.logger, }) @@ -189,6 +187,11 @@ func newSetupHarness(t *testing.T, opts ...func(*setupHarness)) *setupHarness { return h } +// withSetupCode pins a required setup code for a harness (D-044/D-045). +func withSetupCode(code string) func(*setupHarness) { + return func(h *setupHarness) { h.code = code } +} + // preCSRF mints a signed pre-session token plus its cookie (A15). func (h *setupHarness) preCSRF() (*http.Cookie, string) { h.t.Helper() @@ -211,8 +214,8 @@ func (h *setupHarness) post(action string, form url.Values, cookies ...*http.Coo req := httptest.NewRequest("POST", "/setup?do=setup&action="+url.QueryEscape(action), strings.NewReader(form.Encode())) req.Header.Set("Content-Type", "application/x-www-form-urlencoded") - // The wizard is tunnel-only per request (SPEC-003 §7, D-025): the operator - // reaches it over an SSH tunnel, so the tests speak from loopback with no XFF. + // The peer no longer decides setup access (D-045); the request is a plain + // wizard step over loopback. req.RemoteAddr = loopbackPeer req.AddCookie(cookie) for _, c := range cookies { @@ -266,10 +269,14 @@ func (h *setupHarness) enrollAdmin(t *testing.T) string { // ── AC-1 ───────────────────────────────────────────────────────────────────── +// TestSpec005AC1_SetupModeServesOnlySetup covers D-045 state 2 (`setup: true`): +// `GET /setup` serves the wizard (no code is required by default), `GET /` +// points at it, and every other route is 404. func TestSpec005AC1_SetupModeServesOnlySetup(t *testing.T) { h := newSetupHarness(t) - // Over the direct tunnel (gate a) `GET /setup` is the wizard. + // `setup: true` → `GET /setup` is the wizard, from any peer (there is no + // tunnel privilege any more, D-045). rec := request(h.srv, "GET", "/setup") if rec.Code != http.StatusOK { t.Fatalf("GET /setup on a fresh instance = %d, want 200 (AC-1)", rec.Code) @@ -282,29 +289,20 @@ func TestSpec005AC1_SetupModeServesOnlySetup(t *testing.T) { t.Error("the wizard issued no pre-session CSRF cookie (A15)") } - // D-044: without the tunnel, `GET /` and `GET /setup` show the friendly - // first-run boilerplate — NEVER a bare 404. (AC-14; see setup_code_test.go - // for the gate itself.) - proxyGET := func(target string) *httptest.ResponseRecorder { - req := httptest.NewRequest("GET", target, nil) - req.RemoteAddr = "127.0.0.1:9999" - req.Header.Set("X-Forwarded-For", "203.0.113.9") - out := httptest.NewRecorder() - h.srv.ServeHTTP(out, req) - return out + // `GET /` is a friendly page pointing at the wizard — never the app. + root := request(h.srv, "GET", "/") + if root.Code != http.StatusOK { + t.Errorf("GET / while setup is enabled = %d, want 200 (D-045)", root.Code) } - for _, p := range []string{"/", "/setup"} { - got := proxyGET(p) - if got.Code != http.StatusOK { - t.Errorf("GET %s before unlock = %d, want 200 (the first-run page, not a 404/D-044)", p, got.Code) - } - if !strings.Contains(got.Body.String(), "not set up yet") { - t.Errorf("GET %s did not render the first-run boilerplate (D-044)", p) - } + if !strings.Contains(root.Body.String(), "/setup") { + t.Error("GET / did not point at the wizard (D-045)") + } + if strings.Contains(root.Body.String(), "domain.save") { + t.Error("GET / served the wizard itself; it should point at /setup (D-045)") } // EVERY other route is 404 — including the app the productive instance - // would serve (/home, /access, GUID branches) and the canonical redirect. + // would serve (/home, /access, GUID branches). for _, p := range []string{"/home", "/access", "/holy-shit", "/some-guid", "/home/extra"} { if rec := request(h.srv, "GET", p); rec.Code != http.StatusNotFound { t.Errorf("GET %s in setup mode = %d, want 404 (AC-1)", p, rec.Code) @@ -364,37 +362,52 @@ func TestR6_WizardGeneratesStrongSecrets(t *testing.T) { // ── AC-2 ───────────────────────────────────────────────────────────────────── -// TestSpec005AC2_ServedOnlyOverTheTunnel covers D-025 (2026-10-15b) + D-044: -// there is no bind refusal (any address may be bound, D-043) — the WIZARD is -// protected per request by EITHER the direct SSH tunnel (a loopback TCP peer -// with no X-Forwarded-For) OR the setup code. A remote peer, and a same-host -// proxy relaying a client, get the first-run boilerplate — never the wizard. -func TestSpec005AC2_ServedOnlyOverTheTunnel(t *testing.T) { - h := newSetupHarness(t) +// TestSpec005AC2_WizardRequiresTheCodeWhenSet covers D-044 + D-045: with +// `setup_code` SET, `GET /setup` shows the code form from ANY peer (the tunnel +// gate is retired); only an unlocked browser reaches the wizard, and a wrong +// code does not unlock. +func TestSpec005AC2_WizardRequiresTheCodeWhenSet(t *testing.T) { + h := newSetupHarness(t, withSetupCode("t3st-c0de-9999")) - // The tunnel reaches the wizard. - if rec := request(h.srv, "GET", "/setup"); rec.Code != http.StatusOK || - !strings.Contains(rec.Body.String(), "domain.save") { - t.Errorf("GET /setup over the tunnel did not reach the wizard (AC-2)") + for name, peer := range map[string]string{ + "loopback peer": loopbackPeer, + "remote peer": "203.0.113.9:4444", + } { + req := httptest.NewRequest("GET", "/setup", nil) + req.RemoteAddr = peer + rec := httptest.NewRecorder() + h.srv.ServeHTTP(rec, req) + if rec.Code != http.StatusOK { + t.Errorf("GET /setup (%s) = %d, want 200 (the code form)", name, rec.Code) + } + if strings.Contains(rec.Body.String(), "domain.save") { + t.Errorf("GET /setup (%s) reached the wizard without the code (D-045)", name) + } + if !strings.Contains(rec.Body.String(), "name=\"code\"") { + t.Errorf("GET /setup (%s) did not show the code form (D-044)", name) + } } - // A remote peer, and a same-host proxy relaying a client, are both refused - // the wizard — they get the friendly first-run page (D-044). - remote := httptest.NewRequest("GET", "/setup", nil) - remote.RemoteAddr = "203.0.113.9:4444" - rec := httptest.NewRecorder() - h.srv.ServeHTTP(rec, remote) - if rec.Code != http.StatusOK || strings.Contains(rec.Body.String(), "domain.save") { - t.Errorf("GET /setup from a remote peer = %d, want the boilerplate, never the wizard (AC-2)", rec.Code) + // Unlock per browser → the wizard; another browser still gets the form. + rec := h.proxyPost("unlock", url.Values{"code": {h.code}}) + if rec.Code != http.StatusSeeOther { + t.Fatalf("unlock = %d, want 303 (D-044)", rec.Code) + } + unlock := unlockCookie(t, rec) + if unlock == nil { + t.Fatal("the correct code set no unlock cookie (D-044)") + } + got := h.proxyGet("/setup", unlock) + if got.Code != http.StatusOK || !strings.Contains(got.Body.String(), "domain.save") { + t.Errorf("GET /setup after unlock = %d, want the wizard", got.Code) + } + if other := h.proxyGet("/setup"); strings.Contains(other.Body.String(), "domain.save") { + t.Error("an unlocked browser leaked the wizard to another visitor (D-044)") } - proxied := httptest.NewRequest("GET", "/setup", nil) - proxied.RemoteAddr = "127.0.0.1:9999" - proxied.Header.Set("X-Forwarded-For", "203.0.113.9") - rec = httptest.NewRecorder() - h.srv.ServeHTTP(rec, proxied) - if rec.Code != http.StatusOK || strings.Contains(rec.Body.String(), "domain.save") { - t.Errorf("GET /setup relayed by a same-host proxy = %d, want the boilerplate, never the wizard (AC-2)", rec.Code) + // A wrong code does not unlock. + if wrong := h.proxyPost("unlock", url.Values{"code": {"nope"}}); wrong.Code != http.StatusForbidden { + t.Errorf("a wrong code = %d, want 403 (D-044)", wrong.Code) } } @@ -611,23 +624,45 @@ func TestSpec005AdminCreateRepairsMissingIdentity(t *testing.T) { } } -// TestSpec005FailSafeSetupMode: with `config.setup: false` and an empty -// database the instance is STILL in setup mode (fail-safe) — and it stays there -// until the wizard finishes, even though creating the admin makes a live -// "no user exists" check false. -func TestSpec005FailSafeSetupMode(t *testing.T) { +// TestSpec005LockedState: `setup: false` with no admin is the LOCKED state +// (D-045): `/` and `/setup` render the "enable setup" boilerplate (never a bare +// 404), every other route is 404, and the wizard is unreachable — the state is +// deliberately not claimable. +func TestSpec005LockedState(t *testing.T) { h := newSetupHarness(t, func(h *setupHarness) { h.cfg.Setup = false }) - // Fresh: setup mode via the fail-safe clause. - if rec := request(h.srv, "GET", "/setup"); rec.Code != http.StatusOK { - t.Fatalf("GET /setup (fail-safe) = %d, want 200", rec.Code) + for _, p := range []string{"/", "/setup"} { + rec := request(h.srv, "GET", p) + if rec.Code != http.StatusOK { + t.Fatalf("GET %s locked = %d, want 200 (the boilerplate, never a bare 404)", p, rec.Code) + } + body := rec.Body.String() + if !strings.Contains(body, "setup: true") || !strings.Contains(body, "config.yaml") { + t.Errorf("GET %s did not render the locked boilerplate (D-045)", p) + } + if strings.Contains(body, "domain.save") || strings.Contains(body, `action="/setup?do=setup`) { + t.Errorf("GET %s exposed the wizard or the code form while locked (D-045)", p) + } } - if rec := request(h.srv, "GET", "/home"); rec.Code != http.StatusNotFound { - t.Fatalf("GET /home (fail-safe) = %d, want 404", rec.Code) + for _, p := range []string{"/home", "/access", "/some-guid", "/some-guid/home"} { + if rec := request(h.srv, "GET", p); rec.Code != http.StatusNotFound { + t.Errorf("GET %s locked = %d, want 404 (D-045)", p, rec.Code) + } } + // Not claimable: the wizard's own action 404s while locked. + if rec := h.post("unlock", url.Values{"code": {"anything"}}); rec.Code != http.StatusNotFound { + t.Errorf("POST unlock while locked = %d, want 404 (not claimable, D-045)", rec.Code) + } +} + +// TestSpec005SetupHoldsMidWizard: once the admin row exists the wizard must stay +// reachable until `finish`. The door must not fall out of setup mode on a live +// "a user exists" check (D-045: setup mode is the toggle; completion is the +// in-process Done signal). +func TestSpec005SetupHoldsMidWizard(t *testing.T) { + h := newSetupHarness(t) + h.beginAdmin(t) // creates user 1 (pending enrollment) - // Create the admin (now a user exists) and enroll — setup mode must HOLD. - h.beginAdmin(t) if rec := request(h.srv, "GET", "/setup"); rec.Code != http.StatusOK { t.Fatalf("GET /setup after admin.create = %d, want 200 (setup must hold mid-wizard)", rec.Code) } @@ -636,11 +671,14 @@ func TestSpec005FailSafeSetupMode(t *testing.T) { } h.enrollAdmin(t) - // Finish ends setup mode. + // Finish ends setup mode: /setup 404s and the app serves normally. if rec := h.post("finish", url.Values{"app.locale": {"en-GB"}}); rec.Code != http.StatusSeeOther { t.Fatalf("finish = %d, want 303", rec.Code) } + if !h.setupFlow.Done() { + t.Error("the wizard did not signal completion") + } if rec := request(h.srv, "GET", "/setup"); rec.Code != http.StatusNotFound { - t.Errorf("GET /setup after finish = %d, want 404", rec.Code) + t.Errorf("GET /setup after finish = %d, want 404 (D-045)", rec.Code) } } diff --git a/internal/core/server/setupflow.go b/internal/core/server/setupflow.go index d28eb13..b56ad8c 100644 --- a/internal/core/server/setupflow.go +++ b/internal/core/server/setupflow.go @@ -13,10 +13,11 @@ const setupModule = "setup" // RegisterSetupFlow registers the SPEC-005 `/setup` wizard: the page (the core // `setup` workflow) and the action module (unlock · domain.save · admin.create · // admin.enroll.* · admin.totp.* · finish). The door gates them to setup mode -// and verifies the pre-session CSRF token (A15) before dispatch. +// (`config.setup`, D-045) and verifies the pre-session CSRF token (A15) before +// dispatch. // -// `unlock` is the D-044 code gate: the door lets it through without the tunnel -// or an existing unlock, because it is what grants the unlock. +// `unlock` is the D-044 code gate: when a `setup_code` is set the door lets it +// through without an existing unlock, because it is what grants the unlock. func RegisterSetupFlow(reg *MapRegistry, a *setup.Actions) { reg.RegisterCore("setup", adaptSetup(a.Page)) diff --git a/internal/core/setup/gate.go b/internal/core/setup/gate.go index 8b1b3c3..2a7ee14 100644 --- a/internal/core/setup/gate.go +++ b/internal/core/setup/gate.go @@ -1,11 +1,8 @@ package setup import ( - "crypto/rand" "crypto/subtle" - "encoding/hex" "errors" - "fmt" "log/slog" "net/http" "strings" @@ -21,42 +18,46 @@ import ( // when setup completes. const SetupUnlockCookieName = "myday_setup" -// CodeBytes is the setup code's entropy: 16 bytes == 128 bits (D-044). -const CodeBytes = 16 - // ErrNoGateCSRF is returned when the gate is built without the pre-session CSRF -// helper — the code needs a signing key to bind the unlock cookie, so this -// fails closed. +// helper — a required code needs a signing key to bind the unlock cookie, so +// this fails closed. var ErrNoGateCSRF = errors.New("setup: the gate needs the pre-session CSRF signer") -// Gate is the D-044 first-run gate: the SETUP CODE plus the signed unlock -// cookie the boilerplate mints when the correct code is entered. +// Gate is the first-run access gate. Under D-045 the gate is the **config +// toggle `setup`**: while `setup: true` the wizard is enabled. The setup CODE +// (`setup_code`) is an OPTIONAL second factor — when set, the wizard requires +// it; when empty, the toggle alone admits. // -// It closes first-visitor-wins (D-025) where a tunnel cannot reach — the -// LXC/Proxmox + Zoraxy topology. `Unlocked` answers the door's "may this -// request see the wizard?" question (gate b); the direct tunnel (gate a) is -// decided by the door itself (SPEC-003 §7). +// When a code IS set the gate is the D-044 mechanism: a **signed unlock cookie** +// (`myday_setup`) that carries a keyed, one-way FINGERPRINT of the code (never +// the code itself). The code is SINGLE-USE — the first successful unlock retires +// it — while the browser keeps its unlock cookie, so the operator can keep +// working and a second visitor cannot re-use the printed value. // -// The code is SINGLE-USE: the first successful unlock retires it. The unlock -// survives the retirement because the cookie carries a KEYED, ONE-WAY -// FINGERPRINT of the code (`Signer.Fingerprint`), not the code — so an operator -// who unlocked the wizard can keep working in that browser while a second -// visitor cannot re-use the printed code. +// The gate also renders the three first-run pages so the door stays free of the +// setup package's HTML: +// +// - CodeForm — `setup: true` + a required code, not yet unlocked; +// - Landing — `setup: true`, `GET /` points at the wizard; +// - Locked — `setup: false` and no admin: enable setup and restart. // // Spec: docs/specs/spec-005-setup-wizard.md §3/§4. type Gate struct { csrf *httpx.PreSessionCSRF logger *slog.Logger + // required is immutable after construction: true when `setup_code` is set. + required bool + mu sync.Mutex - display string // the code as shown in the banner (grouped for readability) + display string // the code as shown in the banner (the configured value) norm string // the normalised form compared on entry ("" once consumed) fp string // the keyed fingerprint; stable across consumption } -// NewGate builds the gate from the configured code (D-044). An empty/blank code -// generates a fresh 128-bit one. It returns the gate, whose Display/Code -// the caller prints in the startup banner. +// NewGate builds the gate from the configured code (D-044/D-045). An +// empty/blank code means NO code is required — the `setup` toggle alone admits +// and the wizard is served directly. A non-empty code is required. func NewGate(code string, csrf *httpx.PreSessionCSRF, logger *slog.Logger) (*Gate, error) { if csrf == nil { return nil, ErrNoGateCSRF @@ -68,19 +69,17 @@ func NewGate(code string, csrf *httpx.PreSessionCSRF, logger *slog.Logger) (*Gat display := strings.TrimSpace(code) norm := normalizeCode(display) if norm == "" { - generated, err := generateCode() - if err != nil { - return nil, err - } - display, norm = generated, normalizeCode(generated) + // D-045: no code — the config toggle is the gate. + return &Gate{csrf: csrf, logger: logger}, nil } return &Gate{ - csrf: csrf, - logger: logger, - display: display, - norm: norm, - fp: csrf.Signer().Fingerprint(fingerprintDomain + norm), + csrf: csrf, + logger: logger, + required: true, + display: display, + norm: norm, + fp: csrf.Signer().Fingerprint(fingerprintDomain + norm), }, nil } @@ -88,8 +87,12 @@ func NewGate(code string, csrf *httpx.PreSessionCSRF, logger *slog.Logger) (*Gat // of the signer's key (the pre-session CSRF, the ceremony state). const fingerprintDomain = "myday.setup.unlock.v1:" -// Code returns the setup code to PRINT in the startup banner (D-044). It is the -// configured code verbatim, or the generated grouped form. +// Required reports whether a setup code is required to reach the wizard +// (D-045: `setup_code` is set). When false the `setup` toggle alone admits. +func (g *Gate) Required() bool { return g.required } + +// Code returns the setup code to PRINT in the startup banner, or "" when no +// code is required (D-045) — there is nothing to print in that case. func (g *Gate) Code() string { g.mu.Lock() defer g.mu.Unlock() @@ -98,12 +101,13 @@ func (g *Gate) Code() string { // Accept reports whether a submitted code is the live setup code and, when it // is, RETIRES it (single-use). The comparison is constant-time and ignores -// formatting (case, spaces, dashes), so a hand-typed value works. +// formatting (case, spaces, dashes), so a hand-typed value works. It always +// returns false when no code is required. func (g *Gate) Accept(code string) bool { g.mu.Lock() defer g.mu.Unlock() if g.norm == "" { - return false // already consumed (or cleared) — never re-usable + return false // not required, already consumed, or cleared — never re-usable } if subtle.ConstantTimeCompare([]byte(normalizeCode(code)), []byte(g.norm)) != 1 { return false @@ -124,8 +128,9 @@ func (g *Gate) Grant() string { return g.csrf.Signer().Sign(g.fp) } -// Unlocked reports whether the request carries a valid unlock grant (D-044, -// gate b). It is independent of the tunnel — the door ORs the two (SPEC-003 §7). +// Unlocked reports whether the request carries a valid unlock grant (D-044). +// It is always false when no code is required — that case is admitted by the +// toggle alone, which the door decides (SPEC-003 §7). func (g *Gate) Unlocked(r *http.Request) bool { g.mu.Lock() fp := g.fp @@ -162,52 +167,45 @@ func (g *Gate) Clear() { g.mu.Unlock() } -// ── the first-run boilerplate (D-044) ─────────────────────────────────────── +// ── the first-run pages (D-044 · D-045) ───────────────────────────────────── -// Boilerplate renders the friendly first-run page — "MyDay is not set up yet" — -// with the setup-code entry form. It is what `GET /` and `GET /setup` show in -// setup mode instead of a bare 404, so the domain never looks "down". -// -// The form is anonymous, so it carries the signed pre-session double-submit -// token (A15) exactly like every other pre-session form (SPEC-003 §6). -func (g *Gate) Boilerplate(w http.ResponseWriter, r *http.Request) error { - return g.boilerplate(w, r, http.StatusOK, "") +// CodeForm renders the setup-code entry page — `setup: true` with a required +// `setup_code`, before the code is entered. The form is anonymous, so it +// carries the signed pre-session double-submit token (A15) exactly like every +// other pre-session form (SPEC-003 §6). +func (g *Gate) CodeForm(w http.ResponseWriter, r *http.Request) error { + return g.codeForm(w, r, http.StatusOK, "") } -// boilerplateError re-renders the page with a generic notice. The message is +// codeFormError re-renders the page with a generic notice. The message is // deliberately the same for a wrong and an absent code (no oracle, A3). -func (g *Gate) boilerplateError(w http.ResponseWriter, r *http.Request) error { - return g.boilerplate(w, r, http.StatusForbidden, "That setup code is not correct.") +func (g *Gate) codeFormError(w http.ResponseWriter, r *http.Request) error { + return g.codeForm(w, r, http.StatusForbidden, "That setup code is not correct.") } -func (g *Gate) boilerplate(w http.ResponseWriter, r *http.Request, status int, flash string) error { +func (g *Gate) codeForm(w http.ResponseWriter, r *http.Request, status int, flash string) error { token, err := g.csrf.Ensure(w, r) if err != nil { return err } - return renderHTML(w, status, boilerplatePage(token, flash)) + return renderHTML(w, status, codeFormPage(token, flash)) } -// ── code generation & normalisation ───────────────────────────────────────── - -// generateCode returns a fresh 128-bit code, formatted as groups of four hex -// characters (e.g. `9f3a-…`) so it is easy to read from the log and to type. -func generateCode() (string, error) { - b := make([]byte, CodeBytes) - if _, err := rand.Read(b); err != nil { - return "", fmt.Errorf("setup: setup code entropy: %w", err) - } - raw := hex.EncodeToString(b) - var sb strings.Builder - for i := 0; i < len(raw); i += 4 { - if i > 0 { - sb.WriteByte('-') - } - sb.WriteString(raw[i : i+4]) - } - return sb.String(), nil +// Landing renders the friendly page `GET /` shows while `setup: true` (D-045): +// a pointer to the wizard at `/setup`. +func (g *Gate) Landing(w http.ResponseWriter, r *http.Request) error { + return renderHTML(w, http.StatusOK, landingPage()) } +// Locked renders the page `GET /` and `GET /setup` show when `setup: false` and +// no admin exists (D-045): the operator must enable the toggle and restart. +// There is no form — this state is deliberately not claimable. +func (g *Gate) Locked(w http.ResponseWriter, r *http.Request) error { + return renderHTML(w, http.StatusOK, lockedPage()) +} + +// ── code normalisation ────────────────────────────────────────────────────── + // normalizeCode lowercases a code and drops every non-alphanumeric character, // so `9F3A-1B2C` and `9f3a1b2c` are the same code on entry. func normalizeCode(code string) string { diff --git a/internal/core/setup/render.go b/internal/core/setup/render.go index e7e525e..21021ca 100644 --- a/internal/core/setup/render.go +++ b/internal/core/setup/render.go @@ -45,14 +45,14 @@ func wizardPage(st step, token, domain string) web.Page { } } -// boilerplatePage renders the D-044 first-run page — what `GET /` and -// `GET /setup` show in setup mode when the wizard has not been unlocked. It is +// codeFormPage renders the D-044 first-run page — what `GET /setup` shows while +// `setup: true` and a required `setup_code` has not yet been entered. It is // deliberately friendly: the point is that the domain must NOT look "down". // // It is a GUEST screen (no identity, no nav) with the setup-code entry form. // The form submits over POST, so the code never rides the URL (and is never // access-logged — the `code` parameter is redacted even if it ever did, A8). -func boilerplatePage(token, flash string) web.Page { +func codeFormPage(token, flash string) web.Page { c := html.EscapeString(token) kind := "" if flash != "" { @@ -84,6 +84,32 @@ setup code that MyDay printed to its log when it started.

} } +// landingPage is the friendly page `GET /` shows while `setup: true` (D-045) — +// a pointer to the wizard. It carries no form and no code. +func landingPage() web.Page { + return web.Page{ + Title: "MyDay setup", + Guest: true, + Content: web.Markup(`

MyDay is ready for setup

+

The setup wizard is enabled on this instance.

+

Open the setup wizard

`), + } +} + +// lockedPage is what `GET /` and `GET /setup` show when `setup: false` and no +// admin exists yet (D-045): the instance is deliberately locked, not claimable. +// It is a GUEST screen with no form. +func lockedPage() web.Page { + return web.Page{ + Title: "MyDay is not set up", + Guest: true, + Content: web.Markup(`

MyDay is not set up

+

This instance has no administrator yet, and setup is disabled.

+

To run the first-run setup, set setup: true in config.yaml and +restart MyDay. Then open /setup.

`), + } +} + // stepBody renders the section for one step. func stepBody(st step, c, domain string) string { switch st { diff --git a/internal/core/setup/setup.go b/internal/core/setup/setup.go index 81da875..cf80869 100644 --- a/internal/core/setup/setup.go +++ b/internal/core/setup/setup.go @@ -1,12 +1,16 @@ -// Package setup implements SPEC-005: the `/setup` wizard, reachable over the -// direct SSH tunnel OR by unlocking it with the printed setup code (D-044), -// that brings a fresh instance to life. +// Package setup implements SPEC-005: the `/setup` wizard that brings a fresh +// instance to life. The gate is the **config toggle `setup`** (D-045): // -// While in setup mode and NOT unlocked, `GET /` and `GET /setup` render a -// friendly first-run BOILERPLATE ("MyDay is not set up yet") with the setup-code -// entry form — never a bare 404, so the domain does not look "down" (D-044). -// `POST /setup?do=setup&action=unlock` with the correct code grants the unlock -// (a signed cookie, not a session — no user exists yet). +// - `setup: true` → `/setup` serves the wizard at the public domain; +// - `setup: false` + no admin → the instance is LOCKED: `GET /` and +// `GET /setup` render a boilerplate telling the operator to enable setup, +// and every other route is 404 (this state is not publicly claimable); +// - completion → the wizard writes `setup: false` and creates the admin. +// +// The setup CODE (`setup_code`) is an OPTIONAL second factor (D-044 · D-045): +// when set, `GET /setup` first shows the code form and `POST /setup?do=setup& +// action=unlock` with the correct code grants the unlock (a signed cookie, not +// a session — no user exists yet); when empty, the toggle alone admits. // // The wizard walks three steps — (1) the domain / base URL, (2) the top admin // with TOTP enrollment, (3) mail · locale · timezone — and finishes by @@ -21,8 +25,8 @@ // no duplication. // // The wizard holds no routing of its own — the door (SPEC-003/005) gates it to -// setup mode and the tunnel, and verifies the pre-session CSRF token (A15) -// before invoking any action here. +// setup mode and verifies the pre-session CSRF token (A15) before invoking any +// action here. // // Spec: docs/specs/spec-005-setup-wizard.md. package setup @@ -78,9 +82,10 @@ type Deps struct { // ConfigPath is where the settings are persisted to (usually config.yaml, // never the committed example). ConfigPath string - // Code is the D-044 setup code. When blank the wizard GENERATES a 128-bit - // one and prints it in the startup banner (`Actions.Code`); an operator may - // pin it via `setup_code` in the config. + // Code is the OPTIONAL setup code (D-044 · D-045). When blank the toggle + // alone admits and the wizard is served directly; when set, the wizard + // requires it (a second factor). The startup banner prints it only when set + // (`Actions.Code`). Code string // Users creates and inspects the top admin. Users Users @@ -151,8 +156,8 @@ func New(d Deps) (*Actions, error) { if d.WriteFile == nil { d.WriteFile = writeFile0600 } - // D-044: the first-run gate — the code + the signed unlock cookie. A blank - // code generates one (printed in the startup banner via Actions.Code). + // D-044: the first-run gate — the OPTIONAL setup code + the signed unlock + // cookie. A blank code means no code is required (D-045). gate, err := NewGate(d.Code, d.CSRF, d.Logger) if err != nil { return nil, err @@ -160,32 +165,43 @@ func New(d Deps) (*Actions, error) { return &Actions{d: d, gate: gate}, nil } -// Code returns the setup code to print in the startup banner (D-044). It is the -// operator's `setup_code`, or the generated 128-bit value. +// Code returns the setup code to print in the startup banner, or "" when no +// code is required (D-045) — there is nothing to print in that case. func (a *Actions) Code() string { return a.gate.Code() } +// CodeRequired reports whether the wizard requires a code (D-045: `setup_code` +// is set). The startup banner prints the code only when it does. +func (a *Actions) CodeRequired() bool { return a.gate.Required() } + // Gate exposes the first-run gate so the door can ask whether a request is -// unlocked and render the boilerplate (D-044). The wizard itself never parses a -// path — the door decides. +// unlocked and render the first-run pages (D-044/D-045). The wizard itself +// never parses a path — the door decides. func (a *Actions) Gate() *Gate { return a.gate } // ── the first-run gate (D-044) ────────────────────────────────────────────── -// Unlock is the D-044 gate: `POST /setup?do=setup&action=unlock` carrying the -// setup code. The door has already verified the pre-session CSRF token (A15) -// and rate-limited the request (A3); here we check the code, grant the unlock -// for this browser, and send the operator on to the wizard (post/redirect/get). +// Unlock is the D-044 code gate: `POST /setup?do=setup&action=unlock` carrying +// the setup code. The door has already verified the pre-session CSRF token +// (A15) and rate-limited the request (A3); here we check the code, grant the +// unlock for this browser, and send the operator on to the wizard +// (post/redirect/get). // -// A wrong or absent code gets a GENERIC answer — the same page and message -// either way, so the form is no oracle — and is audited (no code value logged). +// When no code is required (D-045) the action is a no-op that simply lands on +// the wizard. A wrong or absent code gets a GENERIC answer — the same page and +// message either way, so the form is no oracle — and is audited (no code value +// logged). func (a *Actions) Unlock(w http.ResponseWriter, r *http.Request) error { if a.done.Load() { writeError(w, http.StatusNotFound, "not found") return nil } + if !a.gate.Required() { + redirect(w, r, "/setup") + return nil + } if !a.gate.Accept(r.FormValue("code")) { a.recordSetup(r.Context(), "setup.unlock", "refused") - return a.gate.boilerplateError(w, r) + return a.gate.codeFormError(w, r) } a.gate.SetUnlockCookie(w, r) a.recordSetup(r.Context(), "setup.unlock", "unlocked")