mix
147072dbb9
Phase 12 (UI/UX). The navigation bar now renders once from layout.html instead of being copied into each content template, so it is present on every authenticated page — including the domain page and its delete confirmation, which had no links at all — and the current page is highlighted via .Active rather than quietly dropping out of the list. New /account page changes the administrator's username and/or password: the current password is required and the attempt is throttled on the same limiter as the login form, so this route cannot be used to brute-force past that limit. A password change invalidates every other session while keeping the one performing it; a rename carries that session over. Backup and domain import move from a card in the middle of the domain list to their own /backup page, one card each; the handlers themselves are unchanged, only the page the import form renders its errors on. The domain page gains a "Sending server settings" card (server, port, encryption) so a client can be configured without reading the docs; 587 is listed only when SUBMISSION_ENABLE is true for this deployment, which is a deploy-time flag the panel cannot verify at runtime. Client-side (static/panel.js, no libraries): Copy buttons on the values that get carried elsewhere (DKIM record, new application credentials, server name), and the Addresses field is hidden while the address mode is wildcard, where the server ignores it. Verified in a container on the dev server: setup, login, every page's nav and active item, domain and application creation, all account-form paths including cross-session invalidation, import errors, full backup download. gofmt/vet/test/docker build green. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
89 lines
2.3 KiB
Go
89 lines
2.3 KiB
Go
package web
|
|
|
|
import (
|
|
"sync"
|
|
"time"
|
|
)
|
|
|
|
// sessionTTL bounds how long a login lasts before re-authentication is needed.
|
|
const sessionTTL = 12 * time.Hour
|
|
|
|
// sessionStore keeps active sessions in memory. Sessions are deliberately not
|
|
// persisted (spec 9 lists what must survive restart; sessions are not on it):
|
|
// a restart simply logs the admin out, which is acceptable and avoids storing
|
|
// bearer tokens on disk. Tokens are crypto-random (spec 7.6.6).
|
|
type sessionStore struct {
|
|
mu sync.Mutex
|
|
sessions map[string]session
|
|
}
|
|
|
|
type session struct {
|
|
username string
|
|
expiresAt time.Time
|
|
}
|
|
|
|
func newSessionStore() *sessionStore {
|
|
return &sessionStore{sessions: make(map[string]session)}
|
|
}
|
|
|
|
// Create issues a new session for username and returns its token.
|
|
func (s *sessionStore) Create(username string) string {
|
|
token := randomToken(32)
|
|
s.mu.Lock()
|
|
defer s.mu.Unlock()
|
|
s.sessions[token] = session{username: username, expiresAt: time.Now().Add(sessionTTL)}
|
|
return token
|
|
}
|
|
|
|
// Lookup returns the session username for a token if it exists and is unexpired.
|
|
func (s *sessionStore) Lookup(token string) (string, bool) {
|
|
if token == "" {
|
|
return "", false
|
|
}
|
|
now := time.Now()
|
|
s.mu.Lock()
|
|
defer s.mu.Unlock()
|
|
sess, ok := s.sessions[token]
|
|
if !ok {
|
|
return "", false
|
|
}
|
|
if now.After(sess.expiresAt) {
|
|
delete(s.sessions, token)
|
|
return "", false
|
|
}
|
|
return sess.username, true
|
|
}
|
|
|
|
// Rename updates the username carried by a session, keeping its expiry. It is
|
|
// used when the administrator renames their own account so the current session
|
|
// keeps working under the new name.
|
|
func (s *sessionStore) Rename(token, username string) {
|
|
s.mu.Lock()
|
|
defer s.mu.Unlock()
|
|
if sess, ok := s.sessions[token]; ok {
|
|
sess.username = username
|
|
s.sessions[token] = sess
|
|
}
|
|
}
|
|
|
|
// DestroyOthers invalidates every session except keep. It is called when the
|
|
// administrator changes their password: a stolen cookie issued under the old
|
|
// password must stop working, while the admin performing the change stays
|
|
// signed in.
|
|
func (s *sessionStore) DestroyOthers(keep string) {
|
|
s.mu.Lock()
|
|
defer s.mu.Unlock()
|
|
for token := range s.sessions {
|
|
if token != keep {
|
|
delete(s.sessions, token)
|
|
}
|
|
}
|
|
}
|
|
|
|
// Destroy invalidates a session token (logout).
|
|
func (s *sessionStore) Destroy(token string) {
|
|
s.mu.Lock()
|
|
defer s.mu.Unlock()
|
|
delete(s.sessions, token)
|
|
}
|