mteehan
0ed275835d
Refresh/logout and token robustness - drop the post-rotation refresh_tokens row delete in auth_refresh so logout blacklists the current (rotated) refresh token; remove the dead _clear_refresh_token_after_rotation helper and clear_active_refresh_token - reject non-object JWT payloads in _extract_unverified_sub so crafted Authorization headers return 401 instead of crashing with 500 SQLite user store - make builtin-admin seeding idempotent: on a concurrent first start the losing seeder re-checks, finds the winner, and returns instead of raising IntegrityError - per-thread sqlite connections + busy_timeout so Flask worker threads don't hit cross-thread ProgrammingError / SQLITE_BUSY - add LogsDirectory + /var/log/vacuum-wall to ReadWritePaths in both systemd units so the fallback admin password actually lands on disk Frontend - skip apiFetch 401-recovery for public auth endpoints so a failed login no longer logs out a valid session - add /passkeys to the nav (passkey registration was unreachable); remove the dead checkWebAuthnCapable export - drop the CSP-blocked inline WS-URL script and the __WS_URL_PLACEHOLDER__ plumbing; the WS URL is derived from location Daemon / WS - parse Sec-WebSocket-Protocol manually (web.Request.get_subprotocols does not exist in aiohttp 3.13); X-Auth-Token is a custom-nginx fallback only — docstring and security docs corrected Install / system - bootstrap_auth.py is now idempotent: preserves existing auth config and syncs the admin password on re-runs (new reset_password helper) - WebUI server block renders auth_basic off (the UI is JWT-protected) - install.sh chown/chmod skips .git to avoid git dubious-ownership breakage - tolerate unreadable /etc/wireguard during system import Contracts / docs - create_user returns 409 on duplicate username per docs/api.md - correct docs/api.md response shapes, docs/security.md blacklist cleanup wording + one-refresh-per-user caveat, stale WS-URL references, and the .htpasswd description Tests: +7 regression tests (rotation/logout revocation, crafted-token 401, concurrent seeding); placeholder-substitution tests replaced with serve-as-is SPA root tests.
89 lines
3.1 KiB
Python
89 lines
3.1 KiB
Python
"""Bootstrap auth: initialize DB and seed admin user at install time.
|
|
|
|
Idempotent — safe to run on every install (and re-install):
|
|
|
|
- Writes config/auth/config.json only if it does not exist (existing
|
|
JWT/WebAuthn settings are preserved).
|
|
- Creates the admin user if missing; if the user already exists, updates
|
|
the admin password to the provided value (docs/deployment.md: "On
|
|
re-run, updates the admin password if already present").
|
|
|
|
Usage:
|
|
python scripts/bootstrap_auth.py --project-dir /path/to/project \
|
|
--username admin \
|
|
--password secret \
|
|
--domain wall.example.com
|
|
"""
|
|
|
|
import argparse
|
|
import json
|
|
import os
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
# Ensure project lib is importable
|
|
|
|
|
|
def main() -> None:
|
|
parser = argparse.ArgumentParser(description="Bootstrap Vacuum Wall auth")
|
|
parser.add_argument("--project-dir", required=True, help="Project root directory")
|
|
parser.add_argument("--username", required=True, help="Admin username")
|
|
parser.add_argument("--password", required=True, help="Admin password")
|
|
parser.add_argument("--domain", required=True, help="Management domain (rp_id)")
|
|
args = parser.parse_args()
|
|
|
|
project_dir = Path(args.project_dir).resolve()
|
|
sys.path.insert(0, str(project_dir))
|
|
|
|
# Set DB path before importing lib modules
|
|
db_path = str(project_dir / "data" / "auth.db")
|
|
os.environ["VACUUM_WALL_DB_BACKEND"] = "sqlite"
|
|
os.environ["VACUUM_WALL_DB_PATH"] = db_path
|
|
|
|
from lib.auth_users import (
|
|
ALL_SUBSYSTEMS,
|
|
create_user,
|
|
find_user,
|
|
reset_password,
|
|
)
|
|
|
|
# Write config — only if missing, so re-runs never clobber existing
|
|
# JWT/WebAuthn settings (e.g. a customized rp_id/origin).
|
|
config_dir = project_dir / "config" / "auth"
|
|
config_dir.mkdir(parents=True, exist_ok=True)
|
|
config_path = config_dir / "config.json"
|
|
|
|
if not config_path.exists():
|
|
config = {
|
|
"jwt": {
|
|
"access_token_ttl": 300,
|
|
"refresh_token_ttl": 604800,
|
|
"algorithm": "HS256",
|
|
},
|
|
"webauthn": {
|
|
"rp_name": "Vacuum Wall",
|
|
"rp_id": args.domain,
|
|
"origin": f"https://{args.domain}",
|
|
},
|
|
}
|
|
with open(config_path, "w") as f:
|
|
json.dump(config, f, indent=2)
|
|
f.write("\n")
|
|
print(f"Wrote auth config: {config_path}")
|
|
else:
|
|
print(f"Auth config already present, leaving unchanged: {config_path}")
|
|
|
|
# Initialize DB and create the admin user, or sync the password on re-run
|
|
if find_user(args.username) is not None:
|
|
reset_password(args.username, args.password)
|
|
print(f"Updated existing user: {args.username} (password synced)")
|
|
else:
|
|
permissions = {sub: "rw" for sub in ALL_SUBSYSTEMS}
|
|
user = create_user(args.username, args.password, permissions)
|
|
print(f"Created admin user: {user['username']} (id={user['id']})")
|
|
print(f"Permissions: {len(permissions)} subsystems, all 'rw'")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|