feat: implement authentication for admin UI

Author: strahe

.env.example

@@ -6,3 +6,4 @@
 # SYNAPS3_FILECOIN_PRIVATE_KEY=0x...
 # SYNAPS3_FILECOIN_RPC_URL=https://api.calibration.node.glif.io/rpc/v1
 # SYNAPS3_CACHE_MAX_SIZE_GB=100
+# SYNAPS3_ADMIN_AUTH_USERNAME=admin

README.md

@@ -18,7 +18,7 @@ SynapS3 is an S3-compatible gateway for storing objects on Filecoin.
 
 - S3-compatible bucket and object APIs.
 - Object storage backed by Filecoin storage providers.
-- Web dashboard for buckets, objects, wallet, tasks, topology, settings, and health.
+- Admin-authenticated web dashboard for buckets, objects, wallet, tasks, topology, settings, and health.
 - Multipart uploads for large objects.
 - Wallet funding, USDFC deposit, and background task controls.
 
@@ -35,8 +35,8 @@ SynapS3 is an S3-compatible gateway for storing objects on Filecoin.
 | Object | `PutObject` | ✅ | Stores an object |
 | Object | `GetObject` | ✅ | Reads an object |
 | Object | `HeadObject` | ✅ | Reads object metadata |
-| Object | `DeleteObject` | ✅ | Soft-deletes one object |
-| Object | `DeleteObjects` | ✅ | Soft-deletes multiple objects |
+| Object | `DeleteObject` | ✅ | Creates a delete marker, or deletes a specific `versionId` |
+| Object | `DeleteObjects` | ✅ | Creates delete markers, or deletes specific `versionId` entries |
 | Object | `CopyObject` | ✅ | Source object must be readable from cache or committed provider storage |
 | Object | `ListObjects` | ✅ | Marker pagination |
 | Object | `ListObjectsV2` | ✅ | Continuation-token pagination |

cmd/synaps3/admin.go

@@ -10,6 +10,8 @@ import (
 	"net"
 	"net/http"
 	"net/url"
+	"os"
+	"path/filepath"
 	"reflect"
 	"sort"
 	"strconv"
@@ -19,20 +21,23 @@ import (
 
 	"github.com/strahe/synaps3/internal/config"
 	"github.com/urfave/cli/v3"
+	"golang.org/x/term"
 )
 
 const (
-	defaultAdminTimeout      = 10 * time.Second
-	adminSettingsWriteHeader = "X-SynapS3-Settings-Write"
-	adminSettingsWriteValue  = "1"
+	defaultAdminTimeout = 10 * time.Second
 )
 
 type adminCommandOptions struct {
-	AdminURL   string
-	ConfigPath string
-	ConfigSet  bool
-	Timeout    time.Duration
-	JSON       bool
+	AdminURL      string
+	ConfigPath    string
+	ConfigSet     bool
+	Timeout       time.Duration
+	JSON          bool
+	AdminUsername string
+	AdminPassword string
+	AuthDisabled  bool
+	ConfigSource  string
 }
 
 func adminCommand() *cli.Command {
@@ -452,17 +457,29 @@ func adminTaskCommand() *cli.Command {
 
 type adminAPIClient struct {
 	baseURL    string
+	username   string
+	password   string
 	httpClient *http.Client
 }
 
 func newAdminClientFromCommand(ctx context.Context, cmd *cli.Command) (*adminAPIClient, adminCommandOptions, error) {
 	opts := adminOptionsFromCommand(cmd)
+	if err := resolveAdminClientConfig(ctx, &opts); err != nil {
+		return nil, adminCommandOptions{}, err
+	}
+	password, err := resolveAdminPassword(cmd, opts)
+	if err != nil {
+		return nil, adminCommandOptions{}, err
+	}
+	opts.AdminPassword = password
 	baseURL, err := resolveAdminBaseURL(ctx, opts)
 	if err != nil {
 		return nil, adminCommandOptions{}, err
 	}
 	return &adminAPIClient{
-		baseURL: baseURL,
+		baseURL:  baseURL,
+		username: opts.AdminUsername,
+		password: opts.AdminPassword,
 		httpClient: &http.Client{
 			Timeout: opts.Timeout,
 		},
@@ -476,12 +493,77 @@ func adminOptionsFromCommand(cmd *cli.Command) adminCommandOptions {
 		timeout = defaultAdminTimeout
 	}
 	return adminCommandOptions{
-		AdminURL:   cmd.String("admin-url"),
-		ConfigPath: root.String("config"),
-		ConfigSet:  root.IsSet("config"),
-		Timeout:    timeout,
-		JSON:       cmd.Bool("json"),
+		AdminURL:      cmd.String("admin-url"),
+		ConfigPath:    root.String("config"),
+		ConfigSet:     root.IsSet("config"),
+		Timeout:       timeout,
+		JSON:          cmd.Bool("json"),
+		AdminUsername: "admin",
+		AdminPassword: os.Getenv("SYNAPS3_ADMIN_PASSWORD"),
+	}
+}
+
+func resolveAdminClientConfig(_ context.Context, opts *adminCommandOptions) error {
+	src, err := config.ResolveSource(opts.ConfigPath, opts.ConfigSet)
+	if err != nil {
+		if strings.TrimSpace(opts.AdminURL) != "" && !opts.ConfigSet {
+			return nil
+		}
+		return err
+	}
+	opts.ConfigSource = src.Path
+	cfg, err := config.LoadSource(src)
+	if err != nil {
+		if strings.TrimSpace(opts.AdminURL) != "" && !opts.ConfigSet {
+			return nil
+		}
+		return fmt.Errorf("loading config for admin client: %w", err)
+	}
+	if username := strings.TrimSpace(cfg.Admin.Auth.Username); username != "" {
+		opts.AdminUsername = username
+	}
+	opts.AuthDisabled = !cfg.Admin.Auth.Enabled
+	return nil
+}
+
+func resolveAdminPassword(cmd *cli.Command, opts adminCommandOptions) (string, error) {
+	if opts.AdminPassword != "" || opts.AuthDisabled {
+		return opts.AdminPassword, nil
 	}
+	if opts.ConfigSource != "" {
+		password, ok, err := config.ReadAdminInitialPasswordFile(filepath.Dir(opts.ConfigSource))
+		if err != nil {
+			return "", err
+		}
+		if ok {
+			return password, nil
+		}
+	}
+	if !adminPasswordPromptAvailable(cmd.Root().ErrWriter) {
+		if strings.TrimSpace(opts.AdminURL) != "" && !opts.ConfigSet {
+			return opts.AdminPassword, nil
+		}
+		return "", errors.New("admin password is required but terminal is not interactive; set SYNAPS3_ADMIN_PASSWORD or create admin-initial-password next to the config file")
+	}
+	if _, err := fmt.Fprint(cmd.Root().ErrWriter, "Admin password: "); err != nil {
+		return "", err
+	}
+	passwordBytes, err := term.ReadPassword(int(os.Stdin.Fd()))
+	if err != nil {
+		return "", fmt.Errorf("reading admin password: %w", err)
+	}
+	if _, err := fmt.Fprintln(cmd.Root().ErrWriter); err != nil {
+		return "", err
+	}
+	return string(passwordBytes), nil
+}
+
+func adminPasswordPromptAvailable(errWriter io.Writer) bool {
+	errFile, ok := errWriter.(*os.File)
+	if !ok || errFile != os.Stderr {
+		return false
+	}
+	return term.IsTerminal(int(os.Stdin.Fd())) && term.IsTerminal(int(errFile.Fd()))
 }
 
 func resolveAdminBaseURL(_ context.Context, opts adminCommandOptions) (string, error) {
@@ -582,12 +664,10 @@ func (c *adminAPIClient) doJSON(ctx context.Context, method, path string, body a
 	if err != nil {
 		return err
 	}
-	if hasBody || writeHeader {
+	c.applyAuth(req)
+	if hasBody {
 		req.Header.Set("Content-Type", "application/json")
 	}
-	if writeHeader {
-		req.Header.Set(adminSettingsWriteHeader, adminSettingsWriteValue)
-	}
 
 	resp, err := c.httpClient.Do(req)
 	if err != nil {
@@ -607,6 +687,17 @@ func (c *adminAPIClient) doJSON(ctx context.Context, method, path string, body a
 	return nil
 }
 
+func (c *adminAPIClient) applyAuth(req *http.Request) {
+	if c.password == "" {
+		return
+	}
+	username := strings.TrimSpace(c.username)
+	if username == "" {
+		username = "admin"
+	}
+	req.SetBasicAuth(username, c.password)
+}
+
 func (c *adminAPIClient) endpoint(path string) string {
 	if strings.HasPrefix(path, "/") {
 		return c.baseURL + path

cmd/synaps3/admin_auth.go

@@ -0,0 +1,114 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/strahe/synaps3/internal/config"
+	"github.com/urfave/cli/v3"
+)
+
+var saveAdminAuthSettings = config.SaveForSettings
+
+func adminAuthCommand() *cli.Command {
+	return &cli.Command{
+		Name:  "admin-auth",
+		Usage: "manage local Admin UI authentication",
+		Commands: []*cli.Command{
+			{
+				Name:  "reset-password",
+				Usage: "generate a new local Admin password",
+				Action: func(_ context.Context, cmd *cli.Command) error {
+					if cmd.Args().Len() > 0 {
+						return fmt.Errorf("unexpected argument %q, reset-password takes no positional arguments", cmd.Args().First())
+					}
+					root := cmd.Root()
+					if !root.IsSet("config") {
+						return errors.New("admin-auth reset-password requires --config")
+					}
+					src, err := configSourceFromCommand(cmd)
+					if err != nil {
+						return err
+					}
+					cfg, presence, err := config.LoadFileForSettings(src.Path)
+					if err != nil {
+						return fmt.Errorf("loading config: %w", err)
+					}
+					bootstrap, err := config.NewAdminAuthBootstrap()
+					if err != nil {
+						return err
+					}
+					if strings.TrimSpace(cfg.Admin.Auth.Username) == "" {
+						cfg.Admin.Auth.Username = "admin"
+					}
+					cfg.Admin.Auth.Enabled = true
+					cfg.Admin.Auth.PasswordHash = bootstrap.PasswordHash
+					cfg.Admin.Auth.SessionSecret = bootstrap.SessionSecret
+					presence.AdminAuthEnabled = true
+					presence.AdminAuthUsername = true
+					presence.AdminAuthPasswordHash = true
+					presence.AdminAuthSessionSecret = true
+					passwordFile := config.AdminInitialPasswordFilePath(filepath.Dir(src.Path))
+					backup, err := backupAdminInitialPasswordFile(passwordFile)
+					if err != nil {
+						return err
+					}
+					passwordPath, err := config.WriteAdminInitialPasswordFile(filepath.Dir(src.Path), bootstrap.Password)
+					if err != nil {
+						return err
+					}
+					if err := saveAdminAuthSettings(src.Path, cfg, presence); err != nil {
+						if restoreErr := restoreAdminInitialPasswordFile(passwordPath, backup); restoreErr != nil {
+							return fmt.Errorf("saving config: %w; restoring admin initial password file: %v", err, restoreErr)
+						}
+						return fmt.Errorf("saving config: %w", err)
+					}
+					_, err = fmt.Fprintf(root.Writer, "Admin password reset\nAdmin username: %s\nAdmin initial password file: %s\n", cfg.Admin.Auth.Username, passwordPath)
+					return err
+				},
+			},
+		},
+	}
+}
+
+type adminInitialPasswordBackup struct {
+	Exists bool
+	Data   []byte
+	Mode   fs.FileMode
+}
+
+func backupAdminInitialPasswordFile(path string) (adminInitialPasswordBackup, error) {
+	info, err := os.Stat(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return adminInitialPasswordBackup{}, nil
+		}
+		return adminInitialPasswordBackup{}, fmt.Errorf("checking admin initial password file %s: %w", path, err)
+	}
+	if info.IsDir() {
+		return adminInitialPasswordBackup{}, fmt.Errorf("admin initial password file %s is a directory", path)
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return adminInitialPasswordBackup{}, fmt.Errorf("reading admin initial password file %s: %w", path, err)
+	}
+	return adminInitialPasswordBackup{Exists: true, Data: data, Mode: info.Mode().Perm()}, nil
+}
+
+func restoreAdminInitialPasswordFile(path string, backup adminInitialPasswordBackup) error {
+	if !backup.Exists {
+		if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
+			return err
+		}
+		return nil
+	}
+	if err := os.WriteFile(path, backup.Data, backup.Mode); err != nil {
+		return err
+	}
+	return os.Chmod(path, backup.Mode)
+}