Idle sessions sign themselves out; a KVM's login is remembered; the compose editor knows YAML

A session unused for seven days is dropped, the Sessions list marks a day's idleness and
can sign all of those out at once. The hub keeps a KVM's own cookies from any browser that
has them and lends them to one that hasn't, on the wire and back to the page. The stack
editor and the new-stack dialog use CodeEditor: line numbers, YAML and .env colour under a
real textarea, Tab/Shift+Tab/Enter indentation, and a key bar on touch screens.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/api/kvm_test.go

@@ -0,0 +1,123 @@
+package api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"hamlab/internal/auth"
+	"hamlab/internal/config"
+	"hamlab/internal/store"
+)
+
+// A KVM's own login is a cookie its page sets in one browser. The hub remembers it from the
+// requests that carry it, lends it to a browser that lacks it — both on the wire to the
+// device and back to the browser, since the device's page checks for it client-side — and
+// forgets it when the device says it is gone or the KVM is removed.
+func TestKVMCookiesAreRememberedAndLent(t *testing.T) {
+	var seen []string // the Cookie header the fake device received, per request
+	device := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		seen = append(seen, r.Header.Get("Cookie"))
+		if r.URL.Path == "/api/auth/login" {
+			// a device that sets its token by header, with its own domain and Secure
+			http.SetCookie(w, &http.Cookie{Name: "nano-kvm-token", Value: "tok-1", Domain: "10.0.0.217", Secure: true})
+		}
+		if r.URL.Path == "/api/auth/logout" {
+			http.SetCookie(w, &http.Cookie{Name: "nano-kvm-token", Value: "", MaxAge: -1})
+		}
+		w.WriteHeader(200)
+	}))
+	defer device.Close()
+
+	dir := t.TempDir()
+	cfg := config.Default(filepath.Join(dir, "config.json"))
+	if err := cfg.Update(func(c *config.Config) {
+		c.KVMs = []config.KVM{{ID: "abc123", Name: "test", URL: device.URL, Machine: ""}}
+	}); err != nil {
+		t.Fatal(err)
+	}
+	st, err := store.Open(filepath.Join(dir, "state.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	s := &Server{cfg: cfg, store: st, sessions: auth.NewSessions(st)}
+	k, _ := s.kvm("abc123")
+	p, err := s.kvmProxy(k)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ask := func(path string, cookies ...*http.Cookie) *httptest.ResponseRecorder {
+		r := httptest.NewRequest("GET", path, nil)
+		r.SetPathValue("id", "abc123")
+		for _, c := range cookies {
+			r.AddCookie(c)
+		}
+		w := httptest.NewRecorder()
+		if strings.HasPrefix(path, kvmPrefix) {
+			s.serveKVM(w, r)
+		} else {
+			p.ServeHTTP(w, r)
+		}
+		return w
+	}
+
+	// 1. the device sets its token by header: it reaches the browser without the device's
+	//    domain or Secure (plain-http console), and the hub remembers it
+	w := ask("/api/auth/login", &http.Cookie{Name: cookieName, Value: "hamlab-session"})
+	var set *http.Cookie
+	for _, c := range w.Result().Cookies() {
+		if c.Name == "nano-kvm-token" {
+			set = c
+		}
+	}
+	if set == nil || set.Domain != "" || set.Secure || set.Value != "tok-1" || set.Path != "/" {
+		t.Fatalf("rewritten Set-Cookie = %+v, want nano-kvm-token=tok-1 for / without Domain or Secure", set)
+	}
+	if got := s.kvmCookies("abc123"); got["nano-kvm-token"] != "tok-1" {
+		t.Fatalf("remembered = %v, want the token", got)
+	}
+	if strings.Contains(seen[0], "hamlab_session") {
+		t.Fatalf("the device was handed Ham Lab's session: %q", seen[0])
+	}
+
+	// 2. a browser that has the cookie teaches a newer value
+	ask("/api/vm/info", &http.Cookie{Name: "nano-kvm-token", Value: "tok-2"}, &http.Cookie{Name: cookieName, Value: "x"})
+	if got := s.kvmCookies("abc123"); got["nano-kvm-token"] != "tok-2" {
+		t.Fatalf("remembered = %v, want tok-2", got)
+	}
+	if seen[1] != "nano-kvm-token=tok-2" {
+		t.Fatalf("device saw %q, want the browser's own cookie only", seen[1])
+	}
+
+	// 3. a browser without it is lent it: on the wire, and back as a Set-Cookie it can read
+	w = ask(kvmPrefix+"abc123/", &http.Cookie{Name: cookieName, Value: "x"})
+	if seen[2] != "nano-kvm-token=tok-2" {
+		t.Fatalf("device saw %q from a browser with no cookie, want the remembered token", seen[2])
+	}
+	lent := false
+	for _, c := range w.Result().Cookies() {
+		if c.Name == "nano-kvm-token" && c.Value == "tok-2" && !c.HttpOnly && c.Path == "/" && c.MaxAge > 0 {
+			lent = true
+		}
+	}
+	if !lent {
+		t.Fatalf("browser was not lent the token: %v", w.Result().Cookies())
+	}
+
+	// 4. the device logging out forgets it
+	ask("/api/auth/logout", &http.Cookie{Name: "nano-kvm-token", Value: "tok-2"})
+	if got := s.kvmCookies("abc123"); got != nil {
+		t.Fatalf("after logout remembered = %v, want nothing", got)
+	}
+
+	// 5. removing the KVM clears whatever is left
+	s.rememberKVMCookies("abc123", []*http.Cookie{{Name: "nano-kvm-token", Value: "tok-3"}})
+	s.forgetKVMCookies("abc123")
+	if got := s.kvmCookies("abc123"); got != nil {
+		t.Fatalf("after remove remembered = %v, want nothing", got)
+	}
+	_ = url.Parse
+}