6 Commits

Include renames

Author	SHA1	Message	Date
sneak	778b26cc0d	Test that neoirc-cli keeps its auth cookie off plain HTTP to other hosts ... The cookie test showed the Secure auth cookie reaching localhost and 127.0.0.1 over plain HTTP, but not that it is still withheld over plain HTTP from every other host. A new test points the client at neoirc.example, sends its connections to the test server, and checks that the cookie does not arrive. Model: opus-5-5	2026-10-06 16:16:05 +00:00
clawbot	58d8f5cc94	Keep neoirc-cli sessions on localhost and test the relay goroutine stop ... The auth cookie is always Secure, and Go 1.24's cookie jar sends a Secure cookie only over HTTPS, so neoirc-cli lost its session against a plain-HTTP server on localhost. Its jar now treats a server on localhost as HTTPS, as curl does. The README's Transport Security section and Python example say what a client needs. A test checks that closing a registered IRC client's connection stops its relay goroutine. The README Entrypoints section names a make target only for the scripts that have one, and the Dockerfile says why the test phase runs with -p 4. Model: opus-5-5	2026-10-06 14:13:31 +00:00
clawbotandclawbot	f829f9e3da	Change module path to sneak.berlin/go/neoirc (#99) ... Changes the Go module path from `git.eeqj.de/sneak/neoirc` to `sneak.berlin/go/neoirc`. All occurrences updated: - `go.mod` module directive - All Go import paths across 35 `.go` files (107 import statements) - All JSON schema `$id` URIs across 30 `.json` files in `schema/` No functional changes — this is a pure rename of the module path. `docker build .` passes clean (formatting, linting, all tests, binary build). closes #98 Co-authored-by: clawbot <clawbot@users.noreply.git.eeqj.de> Reviewed-on: #99 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-04-01 23:05:41 +02:00
3 people	5f3c0633f6	refactor: replace Bearer token auth with HttpOnly cookies (#84) ... ## Summary Major auth refactor replacing Bearer token authentication with HttpOnly cookie-based auth, removing the registration endpoint, and adding the PASS IRC command for password management. ## Changes ### Removed - `POST /api/v1/register` endpoint (no separate registration path) - `RegisterUser` DB method - `Authorization: Bearer` header parsing - `token` field from all JSON response bodies - `Token` field from CLI `SessionResponse` type ### Added - **Cookie-based authentication**: `neoirc_auth` HttpOnly cookie set on session creation and login - **PASS IRC command**: set a password on the authenticated session via `POST /api/v1/messages {"command":"PASS","body":["password"]}` (minimum 8 characters) - `SetPassword` DB method (bcrypt hashing) - Cookie helpers: `setAuthCookie()`, `clearAuthCookie()` - Cookie properties: HttpOnly, SameSite=Strict, Secure when behind TLS, Path=/ - CORS updated: `AllowCredentials: true` with origin reflection function ### Auth Flow 1. `POST /api/v1/session {"nick":"alice"}` → sets `neoirc_auth` cookie, returns `{"id":1,"nick":"alice"}` 2. (Optional) `POST /api/v1/messages {"command":"PASS","body":["s3cret"]}` → sets password for multi-client 3. Another client: `POST /api/v1/login {"nick":"alice","password":"s3cret"}` → sets `neoirc_auth` cookie 4. Logout and QUIT clear the cookie ### Tests - All existing tests updated to use cookies instead of Bearer tokens - New tests: `TestPassCommand`, `TestPassCommandShortPassword`, `TestPassCommandEmpty`, `TestSessionCookie` - Register tests removed - Login tests updated to use session creation + PASS command flow ### README - Extensively updated: auth model documentation, API reference, curl examples, security model, design principles, roadmap - All Bearer token references replaced with cookie-based auth - Register endpoint documentation removed - PASS command documented ### CI - `docker build .` passes (format check, lint, all tests, build) closes sneak/chat#83 Co-authored-by: clawbot <clawbot@eeqj.de> Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de> Reviewed-on: sneak/chat#84 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-03-20 23:54:23 +01:00
3 people	bf4d63bc4d	feat: per-channel hashcash proof-of-work for PRIVMSG anti-spam (#79) ... closes #12 ## Summary Implements per-channel hashcash proof-of-work requirement for PRIVMSG as an anti-spam mechanism. Channel operators set a difficulty level via `MODE +H <bits>`, and clients must compute a proof-of-work stamp bound to the channel name and message body before sending. ## Changes ### Database - Added `hashcash_bits` column to `channels` table (default 0 = no requirement) - Added `spent_hashcash` table with `stamp_hash` unique key and `created_at` for TTL pruning - New queries: `GetChannelHashcashBits`, `SetChannelHashcashBits`, `RecordSpentHashcash`, `IsHashcashSpent`, `PruneSpentHashcash` ### Hashcash Validation (`internal/hashcash/channel.go`) - `ChannelValidator` type for per-channel stamp validation - `BodyHash()` computes hex-encoded SHA-256 of message body - `StampHash()` computes deterministic hash of stamp for spent-token key - `MintChannelStamp()` generates valid stamps (for clients) - Stamp format: `1:bits:YYMMDD:channel:bodyhash:counter` - Validates: version, difficulty, date freshness (48h), channel binding, body hash binding, proof-of-work ### Handler Changes (`internal/handlers/api.go`) - `validateChannelHashcash()` + `verifyChannelStamp()` — checks hashcash on PRIVMSG to protected channels - `extractHashcashFromMeta()` — parses hashcash stamp from meta JSON - `applyChannelMode()` / `setHashcashMode()` / `clearHashcashMode()` — MODE +H/-H support - `queryChannelMode()` — shows +nH in mode query when hashcash is set - Meta field now passed through the full dispatch chain (dispatchCommand → handlePrivmsg → handleChannelMsg → sendChannelMsg → fanOut → InsertMessage) - ISUPPORT updated: `CHANMODES=,H,,imnst` (H in type B = parameter when set) ### Replay Prevention - Spent stamps persisted to SQLite `spent_hashcash` table - 1-year TTL (per issue requirements) - Automatic pruning in cleanup loop ### Client Support (`internal/cli/api/hashcash.go`) - `MintChannelHashcash(bits, channel, body)` — computes stamps for channel messages ### Tests - **12 unit tests** in `internal/hashcash/channel_test.go`: happy path, wrong channel, wrong body hash, insufficient bits, zero bits skip, bad format, bad version, expired stamp, missing body hash, body hash determinism, stamp hash, mint+validate round-trip - **10 integration tests** in `internal/handlers/api_test.go`: set mode, query mode, clear mode, reject no stamp, accept valid stamp, reject replayed stamp, no requirement works, invalid bits range, missing bits arg ### README - Added `+H` to channel modes table - Added "Per-Channel Hashcash (Anti-Spam)" section with full documentation - Updated `meta` field description to mention hashcash ## How It Works 1. Channel operator sets requirement: `MODE #general +H 20` (20 bits) 2. Client mints stamp: computes SHA-256 hashcash bound to `#general` + SHA-256(body) 3. Client sends PRIVMSG with `meta.hashcash` field containing the stamp 4. Server validates stamp, checks spent cache, records as spent, relays message 5. Replayed stamps are rejected for 1 year ## Docker Build `docker build .` passes clean (formatting, linting, all tests). Co-authored-by: user <user@Mac.lan guest wan> Co-authored-by: Jeffrey Paul <sneak@noreply.example.org> Reviewed-on: sneak/chat#79 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-03-18 03:40:33 +01:00
5 people	75cecd9803	feat: implement hashcash proof-of-work for session creation (#63) ... ## Summary Implement SHA-256-based hashcash proof-of-work for `POST /session` to prevent abuse via rapid session creation. closes sneak/chat#11 ## What Changed ### Server - **New `internal/hashcash` package**: Validates hashcash stamps (format, difficulty bits, date/expiry, resource, replay prevention via in-memory spent set with TTL pruning) - **Config**: `NEOIRC_HASHCASH_BITS` env var (default 20, set to 0 to disable) - **`GET /api/v1/server`**: Now includes `hashcash_bits` field when > 0 - **`POST /api/v1/session`**: Validates `X-Hashcash` header when hashcash is enabled; returns HTTP 402 for missing/invalid stamps ### Clients - **Web SPA**: Fetches `hashcash_bits` from `/server`, computes stamp using Web Crypto API (`crypto.subtle.digest`) with batched parallelism (1024 hashes/batch), shows "Computing proof-of-work..." feedback - **CLI (`neoirc-cli`)**: `CreateSession()` auto-fetches server info and computes a valid hashcash stamp when required; new `MintHashcash()` function in the API package ### Documentation - README updated with full hashcash documentation: stamp format, computing stamps, configuration, difficulty table - Server info and session creation API docs updated with hashcash fields/headers - Roadmap updated (hashcash marked as implemented) ## Stamp Format Standard hashcash: `1:bits:YYMMDD:resource::counter` The SHA-256 hash of the entire stamp string must have at least `bits` leading zero bits. ## Validation Rules - Version must be `1` - Claimed bits ≥ required bits - Resource must match server name - Date within 48 hours (not expired, not too far in future) - SHA-256 hash has required leading zero bits - Stamp not previously used (replay prevention) ## Testing - All existing tests pass (hashcash disabled in test config with `HashcashBits: 0`) - `docker build .` passes (lint + test + build) <!-- session: agent:sdlc-manager:subagent:f98d712e-8a40-4013-b3d7-588cbff670f4 --> Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de> Co-authored-by: clawbot <clawbot@noreply.eeqj.de> Co-authored-by: user <user@Mac.lan guest wan> Co-authored-by: Jeffrey Paul <sneak@noreply.example.org> Reviewed-on: sneak/chat#63 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-03-13 00:38:41 +01:00