Add a webhooker resetpw subcommand and a bootstrap banner (closes #208)

The bootstrap admin password was shown exactly once, as one INFO record among the roughly 45 fx lines a boot writes, and there was no reset path at all: no subcommand, no forgot-password flow, no override. Losing that line meant deleting the users row from webhooker.db by hand so the next start would re-seed. - internal/banner renders the one credential shown in the clear as a ruled block written straight to standard output, so it does not read as one more log line. The first boot emits the password there and nowhere else, and the banner names the recovery command. - `webhooker resetpw [-generate] <username>` sets an existing account's password. It reads the password as one line from standard input, or generates one with crypto/rand via the existing GenerateRandomPassword; it is never an argv value, which /proc would publish to every account on the host. Hashing goes through database.HashPassword, so the Argon2id parameters cannot drift. - It refuses to run against a DATA_DIR a live instance holds, by taking the same exclusive flock internal/datadir gives the server, and releases it when it finishes. - It creates nothing. A missing DATA_DIR, a directory with no webhooker.db, and an unknown username are each an error: datadir .Acquire calls os.MkdirAll, so a mistyped path would otherwise be built out and reported as a success. The existence checks therefore run before the lock is taken. - The account is resolved and the hash computed in full before the single UPDATE that stores it, so any failure leaves the stored credential untouched. - database.Open exposes the connect-and-migrate path without fx and without seeding; seeding moves to ensureAdminUser, which only a server start calls. - main gains subcommand dispatch. No arguments still runs the server on the same path, with the DATA_DIR lock taken before the fx graph is built and fx owning the non-zero exit; an unknown subcommand exits 2 rather than starting a server. Tests: reset then log in through the real form POST handler, the generated password verifying against the stored hash, the refusal against a held lock, both create-nothing cases, the unknown user, the unusable passwords, and the first-boot banner carrying a password that opens the account. README documents the bootstrap banner and the recovery command, including the container invocation and what resetpw will not do.
2026-08-20 05:47:04 +00:00
parent aba02bc509
commit 29ce4cc429
10 changed files with 1431 additions and 18 deletions
--- a/internal/resetpw/resetpw.go
+++ b/internal/resetpw/resetpw.go
@@ -0,0 +1,472 @@
+// Package resetpw implements the `webhooker resetpw` subcommand,
+// which sets an existing account's password from the command line.
+//
+// It exists because the bootstrap password is shown exactly once. If it
+// is lost — the boot's output rotated away, the terminal closed — the
+// deployment has no other way in: there is no second account, no
+// forgot-password flow, and no environment override. The only recovery
+// before this command was deleting the row from webhooker.db with a
+// SQLite client so the next start would re-seed.
+//
+// It operates on a stopped deployment only. The password is read from
+// standard input or generated, never taken from argv, and it reuses the
+// service's own Argon2id hashing rather than reimplementing it.
+package resetpw
+
+import (
+	"bufio"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"io/fs"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"gorm.io/gorm"
+	"sneak.berlin/go/webhooker/internal/banner"
+	"sneak.berlin/go/webhooker/internal/config"
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/datadir"
+)
+
+// Name is the subcommand's name on the command line.
+const Name = "resetpw"
+
+const (
+	// generatedPasswordLen is the length of a -generate password. It
+	// is longer than the 16 characters the first boot generates: this
+	// one is typed or pasted once by an operator recovering a
+	// deployment, not carried around.
+	generatedPasswordLen = 24
+
+	// minPasswordLen is the shortest password accepted on standard
+	// input. It is a floor against a stray keystroke or a truncated
+	// pipe silently becoming the account's credential, not a password
+	// policy.
+	minPasswordLen = 8
+)
+
+// Exit statuses. Usage errors are distinguished from operational ones
+// so that a script can tell "you called it wrong" from "it refused".
+const (
+	exitOK      = 0
+	exitFailure = 1
+	exitUsage   = 2
+)
+
+// Sentinel errors, exported so a test can assert on the refusal rather
+// than on the wording of a message.
+var (
+	// ErrNoDataDir reports that DATA_DIR names nothing, or names
+	// something that is not a directory.
+	ErrNoDataDir = errors.New("no data directory")
+
+	// ErrNoDatabase reports that the data directory holds no main
+	// database, so there is no deployment to reset a password in.
+	ErrNoDatabase = errors.New("no webhooker database")
+
+	// ErrLiveInstance reports that a running webhooker holds the data
+	// directory.
+	ErrLiveInstance = errors.New(
+		"data directory is held by a running webhooker",
+	)
+
+	// ErrNoSuchUser reports that the named account does not exist.
+	ErrNoSuchUser = errors.New("no such user")
+
+	// ErrEmptyPassword reports that standard input carried nothing.
+	ErrEmptyPassword = errors.New("empty password")
+
+	// ErrPasswordTooShort reports a password below minPasswordLen.
+	ErrPasswordTooShort = errors.New("password too short")
+
+	// ErrNotUpdated reports that the update matched no row, which
+	// means the account disappeared between the lookup and the write.
+	ErrNotUpdated = errors.New("password was not updated")
+)
+
+// usage describes the subcommand. It is written to the same stream as
+// the error that provoked it.
+func usage(w io.Writer, flags *flag.FlagSet) {
+	_, _ = fmt.Fprintf(w, `usage: webhooker %s [-generate] <username>
+
+Set an existing account's password. The deployment must be stopped:
+webhooker %s takes the same exclusive DATA_DIR lock the server does
+and refuses to run while a live instance holds it.
+
+The password is read as one line from standard input, or generated
+with -generate. It is never taken as a command-line argument, which
+on Linux would publish it in /proc to every account on the host.
+
+DATA_DIR selects the deployment exactly as it does for the server
+(default %s). The directory and its database must already exist;
+nothing is created.
+
+Flags:
+`, Name, Name, config.DefaultDataDir)
+
+	flags.PrintDefaults()
+}
+
+// Run executes the subcommand and returns the process exit status.
+func Run(
+	args []string,
+	stdin io.Reader,
+	stdout, stderr io.Writer,
+) int {
+	flags := flag.NewFlagSet("webhooker "+Name, flag.ContinueOnError)
+	flags.SetOutput(stderr)
+
+	generate := flags.Bool(
+		"generate", false,
+		"generate a random password instead of reading one from "+
+			"standard input, and print it",
+	)
+
+	flags.Usage = func() { usage(stderr, flags) }
+
+	err := flags.Parse(args)
+	if err != nil {
+		// flag has already reported the error and printed the usage.
+		return exitUsage
+	}
+
+	if flags.NArg() != 1 {
+		_, _ = fmt.Fprintf(
+			stderr,
+			"webhooker %s: exactly one username is required\n",
+			Name,
+		)
+		usage(stderr, flags)
+
+		return exitUsage
+	}
+
+	err = reset(flags.Arg(0), *generate, stdin, stdout, stderr)
+	if err != nil {
+		_, _ = fmt.Fprintf(stderr, "webhooker %s: %v\n", Name, err)
+
+		return exitFailure
+	}
+
+	return exitOK
+}
+
+// reset performs the whole operation against the configured data
+// directory.
+func reset(
+	username string,
+	generate bool,
+	stdin io.Reader,
+	stdout, stderr io.Writer,
+) error {
+	dir := config.DataDir()
+
+	err := checkDataDir(dir)
+	if err != nil {
+		return err
+	}
+
+	lock, err := acquire(dir)
+	if err != nil {
+		return err
+	}
+
+	// The kernel drops the lock when this process exits, whatever
+	// happens below; releasing explicitly is what makes a long-running
+	// caller — a test — see it freed. A release error tells the
+	// operator nothing they can act on.
+	defer func() { _ = lock.Release() }()
+
+	db, err := database.Open(dir, cliLogger(stderr))
+	if err != nil {
+		return err
+	}
+
+	password, err := setPassword(db, username, generate, stdin, stderr)
+
+	closeErr := db.Close()
+
+	if err != nil {
+		return err
+	}
+
+	if closeErr != nil {
+		return fmt.Errorf("closing the database: %w", closeErr)
+	}
+
+	return report(stdout, stderr, dir, username, password, generate)
+}
+
+// report tells the operator what happened.
+//
+// A generated password is printed in the same banner the first boot
+// uses, because this is the only time it is ever shown. A password the
+// operator supplied is not echoed back: they already have it, and
+// writing it to standard output a second time would put it in another
+// log for no gain.
+func report(
+	stdout, stderr io.Writer,
+	dir, username, password string,
+	generate bool,
+) error {
+	if generate {
+		write := func(w io.Writer) error {
+			return banner.Credentials(
+				w,
+				"WEBHOOKER PASSWORD RESET: this account's new "+
+					"password is",
+				username,
+				password,
+				"Save this password now: it is shown only here.\n"+
+					"The database stores only its Argon2id hash.",
+			)
+		}
+
+		err := write(stdout)
+		if err == nil {
+			return nil
+		}
+
+		// The password is already stored. Standard output failing
+		// here is the difference between a recovered deployment and
+		// one locked out behind a password nobody has ever seen, so
+		// try the other stream before giving up.
+		if write(stderr) == nil {
+			return nil
+		}
+
+		return err
+	}
+
+	_, err := fmt.Fprintf(
+		stdout,
+		"password updated for user %q in %s\n", username, dir,
+	)
+	if err != nil {
+		return fmt.Errorf("writing the result: %w", err)
+	}
+
+	return nil
+}
+
+// acquire takes the DATA_DIR lock, translating the contended case into
+// the refusal this command owes the operator.
+//
+// Resetting a password underneath a live instance would not corrupt
+// anything, but the running process keeps serving every session that
+// authenticated with the old one, so the operator would be told the
+// password changed while the deployment still behaved as though it had
+// not. Refusing is also what the lock is for.
+func acquire(dir string) (*datadir.Lock, error) {
+	lock, err := datadir.Acquire(dir)
+	if err == nil {
+		return lock, nil
+	}
+
+	if errors.Is(err, datadir.ErrLocked) {
+		return nil, fmt.Errorf(
+			"%w: %s. Stop it and run this again: a password reset "+
+				"does not reach a running process, whose existing "+
+				"sessions stay authenticated",
+			ErrLiveInstance, dir,
+		)
+	}
+
+	return nil, err
+}
+
+// checkDataDir refuses to act on a path that does not already hold a
+// deployment.
+//
+// This runs before datadir.Acquire on purpose. Acquire calls
+// os.MkdirAll, so a mistyped DATA_DIR would otherwise be built out —
+// the directory tree, the lock file, and then an empty migrated
+// database — and the command would report success against a deployment
+// that does not exist while the real one stayed locked out. Nothing
+// here creates anything.
+func checkDataDir(dir string) error {
+	info, err := os.Stat(dir)
+
+	switch {
+	case errors.Is(err, fs.ErrNotExist):
+		return fmt.Errorf(
+			"%w: %s (DATA_DIR). This acts on an existing "+
+				"deployment and creates nothing",
+			ErrNoDataDir, dir,
+		)
+	case err != nil:
+		return fmt.Errorf("checking data directory %s: %w", dir, err)
+	case !info.IsDir():
+		return fmt.Errorf(
+			"%w: %s (DATA_DIR) is not a directory", ErrNoDataDir, dir,
+		)
+	}
+
+	dbPath := filepath.Join(dir, database.MainDBFileName)
+
+	_, err = os.Stat(dbPath)
+
+	switch {
+	case errors.Is(err, fs.ErrNotExist):
+		return fmt.Errorf(
+			"%w: %s does not exist. The admin account is created by "+
+				"the first server start",
+			ErrNoDatabase, dbPath,
+		)
+	case err != nil:
+		return fmt.Errorf("checking %s: %w", dbPath, err)
+	}
+
+	return nil
+}
+
+// setPassword looks the account up, obtains the new password, and
+// writes its hash.
+//
+// The order matters: the account is resolved before an operator is
+// asked to type anything, and the hash is computed in full before the
+// single UPDATE that stores it. A failure at any step therefore leaves
+// the stored credential exactly as it was — there is no half-written
+// state to recover from.
+func setPassword(
+	db *database.Database,
+	username string,
+	generate bool,
+	stdin io.Reader,
+	stderr io.Writer,
+) (string, error) {
+	var user database.User
+
+	err := db.DB().Where("username = ?", username).First(&user).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return "", fmt.Errorf(
+			"%w: %q. This changes an existing account's password "+
+				"and never creates an account",
+			ErrNoSuchUser, username,
+		)
+	}
+
+	if err != nil {
+		return "", fmt.Errorf("looking up user %q: %w", username, err)
+	}
+
+	password, err := newPassword(generate, stdin, stderr)
+	if err != nil {
+		return "", err
+	}
+
+	hash, err := database.HashPassword(password)
+	if err != nil {
+		return "", fmt.Errorf("hashing the new password: %w", err)
+	}
+
+	result := db.DB().Model(&database.User{}).
+		Where("id = ?", user.ID).
+		Update("password", hash)
+	if result.Error != nil {
+		return "", fmt.Errorf(
+			"updating user %q: %w", username, result.Error,
+		)
+	}
+
+	if result.RowsAffected != 1 {
+		return "", fmt.Errorf(
+			"%w: %q matched %d rows",
+			ErrNotUpdated, username, result.RowsAffected,
+		)
+	}
+
+	return password, nil
+}
+
+// newPassword returns the password to store: generated, or read from
+// standard input.
+func newPassword(
+	generate bool,
+	stdin io.Reader,
+	stderr io.Writer,
+) (string, error) {
+	if generate {
+		password, err := database.GenerateRandomPassword(
+			generatedPasswordLen,
+		)
+		if err != nil {
+			return "", fmt.Errorf("generating a password: %w", err)
+		}
+
+		return password, nil
+	}
+
+	return readPassword(stdin, stderr)
+}
+
+// readPassword reads the new password as one line from standard input,
+// minus its line ending.
+//
+// Standard input rather than an argument: on Linux argv is readable
+// through /proc by every account on the host for as long as the process
+// lives, and a password typed as an argument lands in shell history
+// besides.
+//
+// When standard input is a terminal the input is echoed — no attempt is
+// made to put the terminal into no-echo mode — so the prompt says so
+// rather than letting an operator assume otherwise.
+func readPassword(stdin io.Reader, stderr io.Writer) (string, error) {
+	if f, ok := stdin.(*os.File); ok && isTerminal(f) {
+		_, _ = fmt.Fprintf(
+			stderr,
+			"New password (echoed as you type), then Enter: ",
+		)
+	}
+
+	line, err := bufio.NewReader(stdin).ReadString('\n')
+	if err != nil && !errors.Is(err, io.EOF) {
+		return "", fmt.Errorf(
+			"reading the password from standard input: %w", err,
+		)
+	}
+
+	password := strings.TrimRight(line, "\r\n")
+
+	if password == "" {
+		return "", fmt.Errorf(
+			"%w: standard input carried no password. Pipe one in, "+
+				"or pass -generate",
+			ErrEmptyPassword,
+		)
+	}
+
+	if len(password) < minPasswordLen {
+		return "", fmt.Errorf(
+			"%w: %d bytes, minimum %d",
+			ErrPasswordTooShort, len(password), minPasswordLen,
+		)
+	}
+
+	return password, nil
+}
+
+// isTerminal reports whether f is a character device, which is as much
+// as this needs to know to decide whether to prompt.
+func isTerminal(f *os.File) bool {
+	info, err := f.Stat()
+	if err != nil {
+		return false
+	}
+
+	return info.Mode()&os.ModeCharDevice != 0
+}
+
+// cliLogger builds the logger the database layer writes through while
+// this command runs. It is deliberately quiet: connecting and migrating
+// are steps the operator did not ask about, and the one thing they need
+// to see is the outcome on standard output.
+func cliLogger(stderr io.Writer) *slog.Logger {
+	return slog.New(slog.NewTextHandler(stderr, &slog.HandlerOptions{
+		Level: slog.LevelWarn,
+	}))
+}