3 Commits

Author	SHA1	Message	Date
xarmian	ba8e20c697	feat: add API token rotation, expiry defaults, and scope enforcement ... - New tokens get a default 90-day expiry (configurable via platform settings: token_default_expiry_days, token_max_lifetime_days) - POST /api/v1/auth/tokens/{id}/rotate generates a new secret while preserving token metadata; old secret is immediately invalidated - X-Token-Expires-Soon and X-Token-Expires-At headers warn when a token is within 7 days of expiry - Token scopes are now enforced: "read" restricts to GET/HEAD/OPTIONS, "write" and "*" allow all methods - Existing tokens without expiry continue to work (backward compatible) Implements TASK-170 under PLAN-15 (Pad Cloud: Hardening).	2026-04-08 18:00:43 +00:00
xarmian	46447e5504	feat: user management & authentication (Phase 6) (#14) ... * feat: add user management database migration and models Add migration 012_users.sql with users, sessions, and workspace_members tables. Add user_id columns to api_tokens, items, comments, activities, item_links, and item_versions for proper user attribution. Create Go model structs (User, Session, WorkspaceMember) in models/user.go. * feat: add store layer for users, sessions, and workspace members Implement CRUD operations for user management: - users.go: create, get, update, list, validate password (bcrypt) - sessions.go: create, validate, delete, cleanup expired (SHA-256 hashed tokens) - workspace_members.go: add/remove members, role management, access checks Adds golang.org/x/crypto/bcrypt dependency. Includes 16 new tests covering all store methods, password validation, session lifecycle, and workspace membership operations. * feat: rewrite auth system from single-password to user-based Replace single-password auth with email/password user authentication: - New endpoints: POST /auth/register, GET /auth/me - Rewritten: POST /auth/login (email+password), GET /auth/session (needs_setup detection), POST /auth/logout (DB session destroy) - Delete in-memory SessionManager, use DB-backed sessions via store - New middleware: SessionAuth (cookie→user), RequireAuth (with fresh-install passthrough when no users exist) - Remove Password field from config, PAD_PASSWORD env var, SetPassword() All 23 existing server tests pass (fresh DBs have no users → passthrough). * feat: add workspace access control middleware Add RequireWorkspaceAccess middleware that checks workspace_members for authenticated users, with fallback for legacy API tokens and fresh installs (no users → implicit owner). Includes role hierarchy helpers (workspaceRole, requireRole) for downstream permission checks. Wire middleware into the /{slug} workspace route group. * feat: add CLI auth commands and credential storage Add pad login, pad logout, pad whoami commands with credential storage in ~/.pad/credentials.json (0600 permissions). Update CLI HTTP client to auto-attach auth tokens and X-Pad-Agent header on all requests. Add auth API methods (Login, Register, Logout, CheckSession, GetCurrentUser). Extend .pad.toml with optional agent_name field. Add golang.org/x/term for masked password input. * feat: derive actor/source from auth context in all handlers Replace hardcoded "user"/"web" actor/source strings with auth-aware helpers. actorFromRequest() derives actor ("user"/"agent" via X-Pad-Agent header) and source ("web"/"cli" from auth method). agentMeta() merges agent name into activity metadata. Update all item, document, comment, and move handlers to use request-based logActivity/logActivityWithMeta. Remove hardcoded CreatedBy/Source from all CLI commands — server now determines these from auth context. * feat: frontend auth — login, registration, auth guard, user menu Rewrite login page with email/password fields, add registration page for first-time setup, update auth guard to handle needs_setup redirect. Add user menu to sidebar with logout. Update API client with new auth methods (register, login with email, session with needs_setup flag). * feat: migrate API tokens from workspace-scoped to user-owned API tokens now have a user_id owner and optional workspace_id scope. CreateAPIToken takes userID as first parameter. ValidateToken resolves the token's user into the request context. TokenAuth middleware now sets ctxCurrentUser when a user-owned API token is used. Add user- scoped endpoints: GET/POST/DELETE /auth/tokens. Keep workspace-scoped token endpoints for backwards compatibility. * feat: workspace membership, invitations, and role enforcement Add workspace_invitations table (migration 013) with join codes. Implement invitation store methods (create, get by code, accept, list). Add member management handlers: list members + invitations, invite (auto-adds existing users or creates invitation), remove member, change role, accept invitation by code. Add API routes under /workspaces/{slug}/members/* and /invitations/{code}/accept. Add CLI commands: pad members, pad invite, pad join. * feat: auth tests and documentation updates Add comprehensive auth endpoint tests: registration flow (first user becomes admin), login/logout, validation errors, duplicate email, auth enforcement (401 after users exist, exempt paths), /me endpoint. Update CLAUDE.md and README.md to document user-based auth system, replacing old PAD_PASSWORD references with pad login/members/invite workflow and role-based access control. * feat: add members management UI to workspace settings page Add Members section to settings with: member list (avatar, name, email, role), role change dropdown (owner only), remove button (owner only), pending invitations display with join codes, and invite form with email + role picker. Add members API methods to the TypeScript client (list, invite, remove, updateRole). * fix: backfill workspace owners for pre-migration workspaces Add backfillWorkspaceOwners() that runs on server start. For any workspace with no members, adds the first admin user as owner. This handles the migration case where workspaces existed before the user system — without it, the members list shows empty. * feat: shareable invite links with /join/[code] page Replace raw join codes with full shareable URLs. Server generates join_url using its configured base URL (e.g. https://pad.example.com/ join/a3f8b2c1). New /join/[code] page handles the full flow: checks auth → shows login/register if needed → accepts invitation → redirects to workspace. Settings page shows "Copy invite link" button that copies URL to clipboard. CLI outputs shareable link instead of raw code. * fix: auto-add workspace creator as owner, integrate auth into pad init handleCreateWorkspace now adds the authenticated user as owner of the new workspace immediately — no more relying on the startup backfill. pad init now checks auth status before making API calls. If no users exist, prompts to register. If not logged in, prompts to login. After auth, proceeds with workspace creation normally. * fix: add join_url to invite response type in API client * fix: address codex review — invite registration, logout token revocation, workspace scoping - Allow registration with valid invitation_code (fixes invite flow for new users) - Revoke Bearer session tokens on logout, not just cookies - Filter workspace listing to user's memberships (admins see all)	2026-03-28 15:43:09 -04:00
xarmian	cf83a60fc2	feat: Add API tokens system for programmatic access ... Add a complete API tokens system enabling CI/CD integrations, custom scripts, and third-party tools to authenticate with the Pad API. - Migration 011: api_tokens table with hash-based token storage - Model: APIToken, APITokenCreate, APITokenWithSecret types - Store: CRUD operations with crypto/rand generation and SHA-256 hashing - Middleware: Bearer token auth that sets workspace context - Handlers: POST/GET/DELETE /workspaces/{ws}/tokens endpoints - CORS: Allow Authorization header for token-based requests	2026-03-28 14:13:50 +00:00