Users, with their own settings, and a list of where each is signed in

The login is a user name and a password. The old single password becomes the account named after the OS user on first boot, along with its sessions and the machine-wide look. Settings gains Users (add, remove, reset a password — your own password confirms) and Sessions (device, IP, last seen; revoke one or sign out everywhere else). Theme, accents and the dashboard layout follow the account; the refresh rate, graph history and alerts stay the machine's. Pairing a machine takes a user on it. Log lines name the actor. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-22 18:20:30 -07:00
parent db214ebc2b
commit 2b54a06821
15 changed files with 1059 additions and 170 deletions
@@ -9,12 +9,15 @@ import (
 	"encoding/hex"
 	"errors"
 	"fmt"
+	"regexp"
+	"sort"
 	"strings"
 	"sync"
 	"time"

 	"golang.org/x/crypto/argon2"

+	"hamlab/internal/config"
 	"hamlab/internal/store"
 )

@@ -78,17 +81,52 @@ func HashToken(token string) string {
 }

 // TokenMatches compares a presented token against stored hashes in constant time.
-func TokenMatches(token string, hashes []string) bool {
+func TokenMatches(token string, hashes []string) bool { return TokenIndex(token, hashes) >= 0 }
+
+// TokenIndex is which of hashes the presented token matches, -1 for none; every hash is
+// compared whatever the answer.
+func TokenIndex(token string, hashes []string) int {
 	h := []byte(HashToken(token))
-	ok := false
-	for _, want := range hashes {
+	idx := -1
+	for i, want := range hashes {
 		if subtle.ConstantTimeCompare(h, []byte(want)) == 1 {
-			ok = true
+			idx = i
 		}
 	}
-	return ok
+	return idx
 }

+// ---- users ----
+
+// UserNameRe is what an account may be called: like a Unix login, lower-case.
+var UserNameRe = regexp.MustCompile(`^[a-z0-9][a-z0-9._-]{0,31}$`)
+
+const MinPasswordLen = 12
+
+// dummyHash is verified against when the named user does not exist, so a login attempt
+// takes the same time either way and the form cannot be used to list accounts.
+var dummyHash = func() string {
+	h, err := HashPassword("not-a-real-password")
+	if err != nil {
+		return ""
+	}
+	return h
+}()
+
+// CheckUser verifies a password for one of users. A missing user fails in the same time
+// as a wrong password.
+func CheckUser(users []config.User, name, pw string) bool {
+	for _, u := range users {
+		if u.Name == name {
+			return VerifyPassword(u.Hash, pw)
+		}
+	}
+	VerifyPassword(dummyHash, pw)
+	return false
+}
+
+// ---- sessions ----
+
 // Sessions is a token store backed by the state file. Expiry is sliding.
 type Sessions struct {
 	st *store.Store
@@ -102,54 +140,136 @@ func NewSessions(st *store.Store) *Sessions {

 func pruneExpired(state *store.State) {
 	now := time.Now()
-	for tok, exp := range state.Sessions {
-		if exp.Before(now) {
+	for tok, ses := range state.Sessions {
+		if ses.Expires.Before(now) {
 			delete(state.Sessions, tok)
 		}
 	}
 }

-func (s *Sessions) Create() (string, error) {
-	b := make([]byte, 32)
+func randomHex(n int) (string, error) {
+	b := make([]byte, n)
 	if _, err := rand.Read(b); err != nil {
 		return "", err
 	}
-	tok := hex.EncodeToString(b)
-	err := s.st.Update(func(state *store.State) {
+	return hex.EncodeToString(b), nil
+}
+
+// Create signs user in from ip with agent, returning the cookie token.
+func (s *Sessions) Create(user, ip, agent string) (string, error) {
+	tok, err := randomHex(32)
+	if err != nil {
+		return "", err
+	}
+	id, err := randomHex(6)
+	if err != nil {
+		return "", err
+	}
+	if len(agent) > 200 {
+		agent = agent[:200]
+	}
+	now := time.Now()
+	err = s.st.Update(func(state *store.State) {
 		pruneExpired(state)
-		state.Sessions[tok] = time.Now().Add(SessionTTL)
+		state.Sessions[tok] = store.Session{ID: id, User: user, Expires: now.Add(SessionTTL), Created: now, LastSeen: now, IP: ip, Agent: agent}
 	})
 	return tok, err
 }

-// Valid reports whether tok is live, sliding its expiry (persisted at most hourly).
-func (s *Sessions) Valid(tok string) bool {
+// Lookup reports whether tok is live and whose it is, sliding its expiry and noting the
+// visit (persisted at most hourly, so a busy console is not writing the file all day).
+func (s *Sessions) Lookup(tok, ip string) (store.Session, bool) {
 	if tok == "" {
-		return false
+		return store.Session{}, false
 	}
-	ok := false
-	extend := false
+	var ses store.Session
+	ok, touch := false, false
 	s.st.View(func(state *store.State) {
-		exp, found := state.Sessions[tok]
-		if found && exp.After(time.Now()) {
-			ok = true
-			extend = time.Until(exp) < SessionTTL-time.Hour
+		found, have := state.Sessions[tok]
+		if have && found.Expires.After(time.Now()) {
+			ses, ok = found, true
+			touch = time.Until(found.Expires) < SessionTTL-time.Hour || time.Since(found.LastSeen) > time.Hour
 		}
 	})
-	if ok && extend {
+	if ok && touch {
 		_ = s.st.Update(func(state *store.State) {
-			if _, found := state.Sessions[tok]; found {
-				state.Sessions[tok] = time.Now().Add(SessionTTL)
+			if x, found := state.Sessions[tok]; found {
+				x.Expires = time.Now().Add(SessionTTL)
+				x.LastSeen = time.Now()
+				if ip != "" {
+					x.IP = ip
+				}
+				state.Sessions[tok] = x
 			}
 		})
 	}
-	return ok
+	return ses, ok
 }

 func (s *Sessions) Delete(tok string) {
 	_ = s.st.Update(func(state *store.State) { delete(state.Sessions, tok) })
 }

+// List is every live session of user, newest first.
+func (s *Sessions) List(user string) []store.Session {
+	var out []store.Session
+	s.st.View(func(state *store.State) {
+		now := time.Now()
+		for _, ses := range state.Sessions {
+			if ses.User == user && ses.Expires.After(now) {
+				out = append(out, ses)
+			}
+		}
+	})
+	sort.Slice(out, func(i, j int) bool { return out[i].LastSeen.After(out[j].LastSeen) })
+	return out
+}
+
+// Count is how many live sessions each user has.
+func (s *Sessions) Count() map[string]int {
+	n := map[string]int{}
+	s.st.View(func(state *store.State) {
+		now := time.Now()
+		for _, ses := range state.Sessions {
+			if ses.Expires.After(now) {
+				n[ses.User]++
+			}
+		}
+	})
+	return n
+}
+
+// Revoke ends the session of user with this ID. Reports whether there was one.
+func (s *Sessions) Revoke(user, id string) bool {
+	found := false
+	_ = s.st.Update(func(state *store.State) {
+		for tok, ses := range state.Sessions {
+			if ses.User == user && ses.ID == id {
+				delete(state.Sessions, tok)
+				found = true
+			}
+		}
+	})
+	return found
+}
+
+// RevokeOthers ends every session of user except the one holding keep. Returns how many.
+func (s *Sessions) RevokeOthers(user, keep string) int {
+	n := 0
+	_ = s.st.Update(func(state *store.State) {
+		for tok, ses := range state.Sessions {
+			if ses.User == user && tok != keep {
+				delete(state.Sessions, tok)
+				n++
+			}
+		}
+	})
+	return n
+}
+
+// RevokeUser ends every session of user (the account is going away).
+func (s *Sessions) RevokeUser(user string) { s.RevokeOthers(user, "") }
+
 // Limiter is a single global backoff: after 5 failures, each further failure
 // doubles a lockout starting at 30s, capped at 10 minutes. Single-user box.
 // Limiter locks out a client after repeated failed logins, per client address, with a