mixandClaude Opus 5.5
07be0cfb58
test / test (push) Canceled after 0s
Steps 1-3 of stage 4, tested together (their docs share files).
Step 1 (M8, L15, L16): an unknown name pays a bcrypt comparison at the
panel's work factor too (noSuchUserHash, made once) -
TestLoginTakesAsLongForAnUnknownName holds the medians within a factor of
two; the Account form's current-password check has its own limiter, per
user (AllowPasswordChange); a sign-in destroys every session the request
presents before it issues its own.
Step 2 (L14): newHTTPServer - ReadTimeout 30 s, WriteTimeout 60 s,
IdleTimeout 2 min beside ReadHeaderTimeout; the full backup moves its write
deadline to two hours through http.ResponseController (e2e: the log shows
no failure to move it).
Step 3 (M11), read in htmx 2.0.4's source (dev/upstream/htmx-2.0.4, the npm
build byte-equal to the shipped htmx.min.js): the poll passes source: box,
and the next refresh is scheduled from htmx:afterRequest, which htmx fires
on load, error, abort and timeout, and after a swap on the nearest parent
left (the box found by detail.target's id); failures in a row double the
wait to 60 s. RequireAuth answers htmx with 401 + HX-Redirect: /login,
which htmx follows before it looks at the status. testdata/poll_test.js
runs panel.js in node against a stand-in DOM and clock (TestPanelJS; skipped
without node, which the test server lacks - run here, and it fails on the
old panel.js).
Also measured: the stage-3 e2e regression for H1 fails as it should on HEAD
with the old entrypoint ("check data/postfix/e2e_extra_map: permission
denied", the panel restarting).
Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 639 s) on this tree.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
67 lines
2.1 KiB
Go
67 lines
2.1 KiB
Go
package auth
|
|
|
|
import (
|
|
"net/http"
|
|
)
|
|
|
|
// RequireAuth wraps a handler so only requests with a valid session cookie
|
|
// reach it; everyone else is redirected to the login page. The authenticated
|
|
// principal is stashed in the request context for downstream handlers.
|
|
func (m *Module) RequireAuth(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
token, ok := m.sessionToken(r)
|
|
if !ok {
|
|
toLogin(w, r)
|
|
return
|
|
}
|
|
userID, ok := m.sessions.Lookup(token)
|
|
if !ok {
|
|
toLogin(w, r)
|
|
return
|
|
}
|
|
u, err := m.store.GetUser(userID)
|
|
if err != nil {
|
|
toLogin(w, r)
|
|
return
|
|
}
|
|
// Only a session whose user exists is kept alive by being used.
|
|
if isSessionActivity(r) && m.sessions.Touch(token) {
|
|
m.setSessionCookie(w, token)
|
|
}
|
|
p := principalFromUser(u)
|
|
ctx := withPrincipal(r.Context(), p)
|
|
next.ServeHTTP(w, r.WithContext(ctx))
|
|
})
|
|
}
|
|
|
|
// toLogin sends a request without a session to the sign-in page. A browser
|
|
// gets a redirect; htmx gets HX-Redirect, which it follows with the whole
|
|
// page, before it looks at the status (htmx 2.0.4, src/htmx.js
|
|
// handleAjaxResponse(): location.href = the header's value). A 303 to htmx
|
|
// was followed inside the request, and the sign-in page swapped into the box
|
|
// that asked (audit 2026-10-12, M11).
|
|
func toLogin(w http.ResponseWriter, r *http.Request) {
|
|
if r.Header.Get("HX-Request") != "" {
|
|
w.Header().Set("HX-Redirect", "/login")
|
|
w.WriteHeader(http.StatusUnauthorized)
|
|
return
|
|
}
|
|
http.Redirect(w, r, "/login", http.StatusSeeOther)
|
|
}
|
|
|
|
// isSessionActivity: a GET from htmx is a background poll - every panel hx-get
|
|
// is a load or a poll - and does not renew the session. htmx 2.0.4, src/htmx.js
|
|
// getHeaders(): every request it issues carries HX-Request: true (and
|
|
// loadHistoryFromServer() sets it too).
|
|
func isSessionActivity(r *http.Request) bool {
|
|
return !(r.Method == http.MethodGet && r.Header.Get("HX-Request") != "")
|
|
}
|
|
|
|
// CurrentUser returns the authenticated username from the request context.
|
|
func CurrentUser(r *http.Request) string {
|
|
if v, ok := r.Context().Value(usernameKey).(string); ok {
|
|
return v
|
|
}
|
|
return ""
|
|
}
|