Merge pull request #27 from AppsGanin/feat/admin-roles-and-audit

feat(admins): multiple admins with roles and an admin audit trail

Author: AppsGanin

README.md

@@ -329,6 +329,7 @@ func paymentPollLoop(mgr *core.Manager) {
 func retentionLoop(mgr *core.Manager) {
 	sweep := func() {
 		mgr.PurgeOldEvents()
+		mgr.PurgeOldAdminAudit()
 		mgr.PurgeOldConnections()
 	}
 	sweep() // sweep once at boot, then on the timer
@@ -423,15 +424,15 @@ func bootstrapPanel(st *store.Store) (string, error) {
 		if err != nil {
 			return "", err
 		}
-		if _, err := st.CreateAdmin("admin", hash); err != nil {
-			return "", err
-		}
-		// Gate the whole authed API on a password change: until the default password
-		// is replaced, requireAuth lets through only the password-change/restore
-		// endpoints. This makes the change server-enforced, not just a wizard prompt
+		// Whoever installs the panel owns it: the bootstrap account is the one role
+		// that can manage the admin roster, and it cannot be deleted afterwards.
+		//
+		// It is created gated on a password change: until the default password is
+		// replaced, requireAuth lets through only the password-change/restore
+		// endpoints. That makes the change server-enforced, not just a wizard prompt
 		// the SPA happens to show, so a leaked secret path before first setup can't be
 		// driven with admin/admin.
-		if err := st.SetMustChangePassword(true); err != nil {
+		if _, err := st.CreateAdmin("admin", hash, model.RoleOwner, true); err != nil {
 			return "", err
 		}
 		printFirstRunBanner(set.Host, secret, "admin", password)

cmd/rospanel/service.go

@@ -0,0 +1,47 @@
+package core
+
+import (
+	"time"
+
+	"github.com/AppsGanin/rospanel/internal/model"
+	"github.com/AppsGanin/rospanel/internal/store"
+)
+
+// The admin trail — see model/admin_audit.go for what it holds and why it isn't the
+// user journal. Writes come from the HTTP layer (one middleware over the panel
+// routes), not from here: the thing worth recording is "an admin called this route
+// and it succeeded", which only the router knows.
+//
+// Like the user journal, auditing is best-effort: a failed write is logged and
+// swallowed. Losing an audit row must never fail the operation that produced it.
+
+// AddAdminAudit records one event.
+func (m *Manager) AddAdminAudit(ev model.AdminAudit) {
+	if ev.CreatedAt == 0 {
+		ev.CreatedAt = time.Now().Unix()
+	}
+	if err := m.store.AddAdminAudit(ev); err != nil {
+		logErr("admin audit: write failed", "action", ev.Action, "err", err)
+	}
+}
+
+// AdminAudit returns the admin trail, newest first.
+func (m *Manager) AdminAudit(f store.AdminAuditFilter) ([]model.AdminAudit, error) {
+	f.Limit = EventPageLimit(f.Limit)
+	return m.store.ListAdminAudit(f)
+}
+
+// PurgeOldAdminAudit drops trail rows past the retention window. Called from the
+// same slow timer as the user journal's sweep.
+func (m *Manager) PurgeOldAdminAudit() {
+	cutoff := time.Now().AddDate(0, 0, -model.AdminAuditRetentionDays).Unix()
+	n, err := m.store.PurgeAdminAudit(cutoff)
+	if err != nil {
+		logErr("admin audit: retention sweep failed", "err", err)
+		return
+	}
+	if n > 0 {
+		logInfo("admin audit: old events purged",
+			"count", n, "older_than_days", model.AdminAuditRetentionDays)
+	}
+}

internal/core/manager_admin_audit.go

@@ -0,0 +1,134 @@
+package core
+
+import (
+	"errors"
+	"log/slog"
+	"regexp"
+	"strings"
+
+	"github.com/AppsGanin/rospanel/internal/auth"
+	"github.com/AppsGanin/rospanel/internal/model"
+	"github.com/AppsGanin/rospanel/internal/store"
+)
+
+// The admin roster. Only the owner reaches any of this (the routes are gated); the
+// rules below are the ones that survive even a legitimate owner making a mistake:
+// the owner can neither delete themselves nor be deleted by anyone else, so the
+// panel can never end up with nobody who can manage it.
+
+var adminNameRe = regexp.MustCompile(`^[a-zA-Z0-9._-]{3,32}$`)
+
+// minAdminPassword mirrors ChangeAdminPassword's floor — an assigned password is
+// held to the same bar as a chosen one.
+const minAdminPassword = 8
+
+// ListAdmins returns the admin roster.
+func (m *Manager) ListAdmins() ([]model.Admin, error) {
+	return m.store.ListAdmins()
+}
+
+// CreateAdmin adds an account with a role and a password the owner picked. The
+// account is gated on a password change at first login: a password chosen by someone
+// else and delivered over a chat window is a bootstrap credential, not a permanent
+// one.
+func (m *Manager) CreateAdmin(username, password, role string) (model.Admin, error) {
+	username = strings.TrimSpace(username)
+	if !adminNameRe.MatchString(username) {
+		return model.Admin{}, invalid("логин: 3–32 символа, латиница, цифры, точка, дефис или подчёркивание")
+	}
+	if !model.GrantableRole(role) {
+		return model.Admin{}, invalid("неизвестная роль %q", role)
+	}
+	if len(password) < minAdminPassword {
+		return model.Admin{}, invalid("пароль должен быть не короче %d символов", minAdminPassword)
+	}
+	hash, err := auth.HashPassword(password)
+	if err != nil {
+		return model.Admin{}, err
+	}
+	id, err := m.store.CreateAdmin(username, hash, role, true)
+	if err != nil {
+		return model.Admin{}, invalid("не удалось создать администратора (логин уже занят?)")
+	}
+	slog.Info("admin roster: created", "admin", username, "role", role, "id", id)
+	return m.store.GetAdmin(id)
+}
+
+// DeleteAdmin removes an account. Deleting it revokes its sessions too (the
+// admin_sessions rows cascade), so a colleague who is let go loses the panel on
+// their next request, not when their cookie happens to expire.
+func (m *Manager) DeleteAdmin(actorID, targetID int64) error {
+	target, err := m.rosterTarget(actorID, targetID, "удалить")
+	if err != nil {
+		return err
+	}
+	if err := m.store.DeleteAdmin(targetID); err != nil {
+		return err
+	}
+	slog.Info("admin roster: deleted", "admin", target.Username, "id", targetID)
+	return nil
+}
+
+// SetAdminRole moves an account between roles.
+func (m *Manager) SetAdminRole(actorID, targetID int64, role string) error {
+	target, err := m.rosterTarget(actorID, targetID, "изменить")
+	if err != nil {
+		return err
+	}
+	if !model.GrantableRole(role) {
+		return invalid("неизвестная роль %q", role)
+	}
+	if err := m.store.SetAdminRole(targetID, role); err != nil {
+		return err
+	}
+	slog.Info("admin roster: role changed", "admin", target.Username, "role", role)
+	return nil
+}
+
+// ResetAdminPassword assigns a new password to another admin — for when a colleague
+// is locked out. Like a freshly created account it is gated on a change at first
+// login, and every session that account had is revoked: whoever was using the old
+// password is out.
+func (m *Manager) ResetAdminPassword(actorID, targetID int64, password string) error {
+	target, err := m.rosterTarget(actorID, targetID, "сбросить пароль")
+	if err != nil {
+		return err
+	}
+	if len(password) < minAdminPassword {
+		return invalid("пароль должен быть не короче %d символов", minAdminPassword)
+	}
+	hash, err := auth.HashPassword(password)
+	if err != nil {
+		return err
+	}
+	if err := m.store.UpdateAdminPassword(targetID, hash, true); err != nil {
+		return err
+	}
+	if err := m.store.DeleteSessionsForAdmin(targetID); err != nil {
+		return err
+	}
+	slog.Info("admin roster: password reset", "admin", target.Username)
+	return nil
+}
+
+// rosterTarget resolves the admin an owner is acting on and rejects the two moves
+// that would strand the panel: acting on the owner (there is exactly one, and it
+// must remain) and acting on yourself through the roster (your own login and
+// password live in the profile dialog, which re-verifies the current password —
+// the roster does not).
+func (m *Manager) rosterTarget(actorID, targetID int64, verb string) (model.Admin, error) {
+	target, err := m.store.GetAdmin(targetID)
+	if errors.Is(err, store.ErrAdminNotFound) {
+		return model.Admin{}, invalid("администратор не найден")
+	}
+	if err != nil {
+		return model.Admin{}, err
+	}
+	if target.Role == model.RoleOwner {
+		return model.Admin{}, invalid("нельзя %s владельца панели", verb)
+	}
+	if target.ID == actorID {
+		return model.Admin{}, invalid("нельзя %s собственную учётную запись", verb)
+	}
+	return target, nil
+}

internal/core/manager_admins.go

@@ -0,0 +1,176 @@
+package core
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/AppsGanin/rospanel/internal/auth"
+	"github.com/AppsGanin/rospanel/internal/model"
+	"github.com/AppsGanin/rospanel/internal/store"
+)
+
+// rosterManager returns a manager whose panel is already owned, mirroring a real
+// install: bootstrap creates the owner, everyone else is added through the roster.
+func rosterManager(t *testing.T) (*Manager, int64) {
+	t.Helper()
+	st, err := store.Open(filepath.Join(t.TempDir(), "roster.db"))
+	if err != nil {
+		t.Fatalf("open store: %v", err)
+	}
+	t.Cleanup(func() { st.Close() })
+
+	hash, err := auth.HashPassword("owner-password")
+	if err != nil {
+		t.Fatalf("hash: %v", err)
+	}
+	ownerID, err := st.CreateAdmin("owner", hash, model.RoleOwner, false)
+	if err != nil {
+		t.Fatalf("create owner: %v", err)
+	}
+	return &Manager{store: st}, ownerID
+}
+
+func TestCreateAdminGatesTheAssignedPassword(t *testing.T) {
+	m, _ := rosterManager(t)
+
+	a, err := m.CreateAdmin("support", "temp-password", model.RoleOperator)
+	if err != nil {
+		t.Fatalf("create: %v", err)
+	}
+	if a.Role != model.RoleOperator {
+		t.Errorf("role = %q, want %q", a.Role, model.RoleOperator)
+	}
+	// The owner picked this password and sent it over a chat window: it is a
+	// bootstrap credential, and the account is useless until it's replaced.
+	if !a.MustChangePassword {
+		t.Error("a password chosen by someone else did not raise the change gate")
+	}
+
+	// And choosing their own lifts it.
+	if err := m.ChangeAdminPassword(a.ID, "chosen-by-them"); err != nil {
+		t.Fatalf("change password: %v", err)
+	}
+	got, err := m.store.GetAdmin(a.ID)
+	if err != nil {
+		t.Fatalf("get: %v", err)
+	}
+	if got.MustChangePassword {
+		t.Error("gate still up after the admin picked their own password")
+	}
+}
+
+func TestCreateAdminRejectsBadInput(t *testing.T) {
+	m, _ := rosterManager(t)
+
+	if _, err := m.CreateAdmin("support", "temp-password", model.RoleOperator); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+
+	cases := []struct {
+		name, username, password, role string
+	}{
+		{"duplicate login", "support", "temp-password", model.RoleAdmin},
+		{"short password", "helper", "short", model.RoleAdmin},
+		{"login too short", "ab", "temp-password", model.RoleAdmin},
+		{"login with spaces", "the helper", "temp-password", model.RoleAdmin},
+		{"unknown role", "helper", "temp-password", "superuser"},
+		// The one that matters: no path may quietly produce a second owner.
+		{"owner is not grantable", "helper", "temp-password", model.RoleOwner},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if _, err := m.CreateAdmin(tc.username, tc.password, tc.role); err == nil {
+				t.Fatal("accepted, want rejected")
+			}
+		})
+	}
+	admins, err := m.ListAdmins()
+	if err != nil {
+		t.Fatalf("list: %v", err)
+	}
+	if len(admins) != 2 { // owner + support, nothing the rejected calls left behind
+		t.Fatalf("roster grew to %d, want 2", len(admins))
+	}
+}
+
+// The two moves that would strand the panel: removing the only account that can
+// manage the roster, or the owner removing themselves.
+func TestRosterCannotStrandThePanel(t *testing.T) {
+	m, ownerID := rosterManager(t)
+
+	admin, err := m.CreateAdmin("colleague", "temp-password", model.RoleAdmin)
+	if err != nil {
+		t.Fatalf("create: %v", err)
+	}
+
+	if err := m.DeleteAdmin(ownerID, ownerID); err == nil {
+		t.Error("the owner deleted themselves")
+	}
+	if err := m.DeleteAdmin(admin.ID, ownerID); err == nil {
+		t.Error("an admin deleted the owner")
+	}
+	if err := m.SetAdminRole(ownerID, ownerID, model.RoleOperator); err == nil {
+		t.Error("the owner demoted themselves to operator")
+	}
+	if err := m.ResetAdminPassword(ownerID, ownerID, "new-password"); err == nil {
+		t.Error("the owner reset their own password through the roster (bypassing re-auth)")
+	}
+
+	// The owner survived all of it and is still the owner.
+	owner, err := m.store.GetAdmin(ownerID)
+	if err != nil {
+		t.Fatalf("get owner: %v", err)
+	}
+	if owner.Role != model.RoleOwner {
+		t.Fatalf("owner role = %q, want %q", owner.Role, model.RoleOwner)
+	}
+}
+
+func TestDeleteAdminRejectsUnknownID(t *testing.T) {
+	m, ownerID := rosterManager(t)
+	err := m.DeleteAdmin(ownerID, 4242)
+	if err == nil {
+		t.Fatal("deleted an admin that does not exist")
+	}
+	if !strings.Contains(err.Error(), "не найден") {
+		t.Errorf("err = %v, want a not-found message", err)
+	}
+}
+
+// Resetting a colleague's password is what you do when they are locked out — or
+// when you no longer trust them. Either way every session they had must die with
+// the old password, or the reset achieves nothing against a stolen cookie.
+func TestResetAdminPasswordRevokesSessionsAndRegates(t *testing.T) {
+	m, ownerID := rosterManager(t)
+
+	admin, err := m.CreateAdmin("colleague", "temp-password", model.RoleAdmin)
+	if err != nil {
+		t.Fatalf("create: %v", err)
+	}
+	if err := m.ChangeAdminPassword(admin.ID, "chosen-by-them"); err != nil {
+		t.Fatalf("change password: %v", err)
+	}
+	token, err := m.store.CreateSession(admin.ID, time.Hour)
+	if err != nil {
+		t.Fatalf("session: %v", err)
+	}
+
+	if err := m.ResetAdminPassword(ownerID, admin.ID, "reset-by-owner"); err != nil {
+		t.Fatalf("reset: %v", err)
+	}
+	if _, ok := m.store.LookupSession(token); ok {
+		t.Error("session survived a password reset")
+	}
+	got, err := m.store.GetAdmin(admin.ID)
+	if err != nil {
+		t.Fatalf("get: %v", err)
+	}
+	if !got.MustChangePassword {
+		t.Error("an owner-assigned password did not raise the change gate")
+	}
+	if err := m.ResetAdminPassword(ownerID, admin.ID, "short"); err == nil {
+		t.Error("accepted a password below the minimum length")
+	}
+}