Console accounts and sign-in #821

Parent

#776

What to build

The Console sits behind a sign-in by email and password, for the addresses in the User config's [console] allowlist.

• Accounts are kept in a file of their own beside the Credentials, readable only by the owner, written by atomic replace. Each holds an argon2id hash and hashed session tokens with their last use.
• thirdshift console password [--email <address>] sets an allowed account's password. It prompts twice and doesn't echo.
• Sessions: the cookie is HttpOnly and Secure, and lasts 30 days from last use.
• CSRF: every action needs a token.
• Slowdown: after five wrong passwords for an address, sign-in for it slows to one try a minute.
• Signing out: from the page, or with thirdshift console sign-out [--email <address>]. A new password ends that account's other sessions.
• The allowlist is the switch: taking an address off it ends its sessions and blocks it at once, and the account is kept.
• An empty allowlist: thirdshift console refuses to start unless --no-sign-in is given, which serves only to localhost.
• The Console log: one file per machine, written by sign-in, failed sign-in, password set, sign-out and blocked-address events, each naming the account. thirdshift console log [--json] prints it, and the page shows it. Page views are never recorded.

Acceptance criteria

• Only allowlisted addresses with a password can sign in. Every page and stream needs a session, apart from the sign-in itself.
• Every action without a valid CSRF token is refused.
• The slowdown, the 30-day lifetime, sign-out, and a new password ending other sessions all behave as described.
• Taking an address off the allowlist ends its sessions at once and keeps the account.
• The Console refuses to start with an empty allowlist, unless --no-sign-in.
• console password, console sign-out and console log work from the binary. The Console log page is paired with console log.
• Tested over HTTP and through the binary.