3 Commits

Author	SHA1	Message	Date
xarmian	d915cc3cf8	feat(cli): per-server credentials in credentials.json with v1 → v2 migration (TASK-1228) (#435) ... Implements IDEA-1226. ~/.pad/credentials.json is now a map keyed by server URL so one developer machine can stay logged in to multiple Pad instances simultaneously — `apm/` repo on Pad Cloud, `target/` repo on local, `testing/` repo on staging — without each `pad init --url <other>` clobbering the previous server's credentials. ## On-disk format v2 (new): { "version": 2, "credentials": { "https://app.getpad.dev": {"token": "...", "user_id": "...", ...}, "http://127.0.0.1:7777": {"token": "...", "user_id": "...", ...} } } v1 (legacy, read-only): {"server_url": "...", "token": "...", "user_id": "...", ...} Reads transparently migrate v1 → v2 in memory; writes always emit v2. Side-effect-free reads — the on-disk file stays v1 until login/logout/ setup triggers a Save, which is when migration becomes durable. This keeps `pad <read-only-command>` from rewriting credentials.json on every invocation just because the binary upgraded. ## API Replaces the three top-level helpers (LoadCredentials / SaveCredentials / DeleteCredentials) with a CredentialStore type: - LoadStore() (*CredentialStore, error) - (s).Get(serverURL) *Credentials // nil-receiver safe - (s).Set(serverURL, *Credentials) - (s).Delete(serverURL) - (s).Save() error - WipeCredentialsFile() error // file-level — replaces DeleteCredentials URL canonicalization is built in: trailing slash + surrounding whitespace are stripped before lookup/store, so http://x:7777 and http://x:7777/ hit the same bucket. Same rule cmd/pad/server_info.go was already applying via its now-redundant normalizeURL — removed. No top-level `default` field. The configured server (cfg.BaseURL() from ~/.pad/config.toml or --url) is always the source of truth for "which server am I targeting" — a separate `default` would create a second source of truth and the split-brain bugs that follow. ## Behavioral changes - `pad init --url <other>` against a server you've authed to before now reuses the saved credential instead of clobbering it. - `pad auth logout` removes only the configured server's entry. Other servers' tokens stay intact (pre-fix: wiped the whole file). - `pad auth whoami` reads only the entry matching the configured server. - Single-server users see no behavior change — one entry, identical shape per entry, identical UX. ## Compat shims removed LoadCredentials / SaveCredentials / DeleteCredentials are deleted outright (no // Deprecated lifecycle) — they're internal package helpers with no external API contract. All 10 call sites in cmd/pad/ and internal/cli/ are migrated to the per-server API in this PR. ## Tests internal/cli/credentials_test.go (15 tests): - File missing / empty → empty store (callers don't need nil checks) - v1 format reads + migrates in memory - v1 with empty token → empty store (no phantom entries) - v1 migration is durable on first Save (file flips to v2) - v2 round-trip preserves multiple entries - Set adds + replaces; mirrors URL into ServerURL field - Delete keeps siblings (multi-server keystone behavior) - Delete on absent key is a no-op - Nil receiver Get/Delete don't panic (NewClientFromURL relies on this) - URL normalization (trailing slash + whitespace) - Save preserves all entries across the file boundary - Save uses 0600 permissions - WipeCredentialsFile removes the file + is idempotent - Garbage file errors loudly (so we never silently lose data) Existing tests unchanged. Full suite + lint + web-check green. Closes: TASK-1228. Implements: IDEA-1226.	2026-05-07 20:23:13 -04:00
xarmian	89db556e29	feat(server): add info command for TASK-134 (#52)	2026-04-02 21:44:08 -04:00
xarmian	46447e5504	feat: user management & authentication (Phase 6) (#14) ... * feat: add user management database migration and models Add migration 012_users.sql with users, sessions, and workspace_members tables. Add user_id columns to api_tokens, items, comments, activities, item_links, and item_versions for proper user attribution. Create Go model structs (User, Session, WorkspaceMember) in models/user.go. * feat: add store layer for users, sessions, and workspace members Implement CRUD operations for user management: - users.go: create, get, update, list, validate password (bcrypt) - sessions.go: create, validate, delete, cleanup expired (SHA-256 hashed tokens) - workspace_members.go: add/remove members, role management, access checks Adds golang.org/x/crypto/bcrypt dependency. Includes 16 new tests covering all store methods, password validation, session lifecycle, and workspace membership operations. * feat: rewrite auth system from single-password to user-based Replace single-password auth with email/password user authentication: - New endpoints: POST /auth/register, GET /auth/me - Rewritten: POST /auth/login (email+password), GET /auth/session (needs_setup detection), POST /auth/logout (DB session destroy) - Delete in-memory SessionManager, use DB-backed sessions via store - New middleware: SessionAuth (cookie→user), RequireAuth (with fresh-install passthrough when no users exist) - Remove Password field from config, PAD_PASSWORD env var, SetPassword() All 23 existing server tests pass (fresh DBs have no users → passthrough). * feat: add workspace access control middleware Add RequireWorkspaceAccess middleware that checks workspace_members for authenticated users, with fallback for legacy API tokens and fresh installs (no users → implicit owner). Includes role hierarchy helpers (workspaceRole, requireRole) for downstream permission checks. Wire middleware into the /{slug} workspace route group. * feat: add CLI auth commands and credential storage Add pad login, pad logout, pad whoami commands with credential storage in ~/.pad/credentials.json (0600 permissions). Update CLI HTTP client to auto-attach auth tokens and X-Pad-Agent header on all requests. Add auth API methods (Login, Register, Logout, CheckSession, GetCurrentUser). Extend .pad.toml with optional agent_name field. Add golang.org/x/term for masked password input. * feat: derive actor/source from auth context in all handlers Replace hardcoded "user"/"web" actor/source strings with auth-aware helpers. actorFromRequest() derives actor ("user"/"agent" via X-Pad-Agent header) and source ("web"/"cli" from auth method). agentMeta() merges agent name into activity metadata. Update all item, document, comment, and move handlers to use request-based logActivity/logActivityWithMeta. Remove hardcoded CreatedBy/Source from all CLI commands — server now determines these from auth context. * feat: frontend auth — login, registration, auth guard, user menu Rewrite login page with email/password fields, add registration page for first-time setup, update auth guard to handle needs_setup redirect. Add user menu to sidebar with logout. Update API client with new auth methods (register, login with email, session with needs_setup flag). * feat: migrate API tokens from workspace-scoped to user-owned API tokens now have a user_id owner and optional workspace_id scope. CreateAPIToken takes userID as first parameter. ValidateToken resolves the token's user into the request context. TokenAuth middleware now sets ctxCurrentUser when a user-owned API token is used. Add user- scoped endpoints: GET/POST/DELETE /auth/tokens. Keep workspace-scoped token endpoints for backwards compatibility. * feat: workspace membership, invitations, and role enforcement Add workspace_invitations table (migration 013) with join codes. Implement invitation store methods (create, get by code, accept, list). Add member management handlers: list members + invitations, invite (auto-adds existing users or creates invitation), remove member, change role, accept invitation by code. Add API routes under /workspaces/{slug}/members/* and /invitations/{code}/accept. Add CLI commands: pad members, pad invite, pad join. * feat: auth tests and documentation updates Add comprehensive auth endpoint tests: registration flow (first user becomes admin), login/logout, validation errors, duplicate email, auth enforcement (401 after users exist, exempt paths), /me endpoint. Update CLAUDE.md and README.md to document user-based auth system, replacing old PAD_PASSWORD references with pad login/members/invite workflow and role-based access control. * feat: add members management UI to workspace settings page Add Members section to settings with: member list (avatar, name, email, role), role change dropdown (owner only), remove button (owner only), pending invitations display with join codes, and invite form with email + role picker. Add members API methods to the TypeScript client (list, invite, remove, updateRole). * fix: backfill workspace owners for pre-migration workspaces Add backfillWorkspaceOwners() that runs on server start. For any workspace with no members, adds the first admin user as owner. This handles the migration case where workspaces existed before the user system — without it, the members list shows empty. * feat: shareable invite links with /join/[code] page Replace raw join codes with full shareable URLs. Server generates join_url using its configured base URL (e.g. https://pad.example.com/ join/a3f8b2c1). New /join/[code] page handles the full flow: checks auth → shows login/register if needed → accepts invitation → redirects to workspace. Settings page shows "Copy invite link" button that copies URL to clipboard. CLI outputs shareable link instead of raw code. * fix: auto-add workspace creator as owner, integrate auth into pad init handleCreateWorkspace now adds the authenticated user as owner of the new workspace immediately — no more relying on the startup backfill. pad init now checks auth status before making API calls. If no users exist, prompts to register. If not logged in, prompts to login. After auth, proceeds with workspace creation normally. * fix: add join_url to invite response type in API client * fix: address codex review — invite registration, logout token revocation, workspace scoping - Allow registration with valid invitation_code (fixes invite flow for new users) - Revoke Bearer session tokens on logout, not just cookies - Filter workspace listing to user's memberships (admins see all)	2026-03-28 15:43:09 -04:00