auth

func CSRFMiddleware ¶

func CSRFMiddleware(next http.Handler) http.Handler

CSRFMiddleware implements double-submit cookie CSRF protection.

GET/HEAD/OPTIONS/TRACE: issues csrf_token cookie if absent, then passes. POST/PUT/PATCH/DELETE: compares the cookie with the X-CSRF-Token header (for HTMX / fetch callers) or the _csrf form field (for plain HTML forms); 403 on mismatch.

Exempt paths:

• /auth and /auth/* (protected by one-time pairing token)
• /api/* (programmatic CLI access via UNIX socket)

func DeviceIDFromContext ¶

func DeviceIDFromContext(ctx context.Context) (string, bool)

DeviceIDFromContext returns the authenticated device ID stored in ctx by NewWebAuthMiddleware. Returns ("", false) for unauthenticated requests.

func ExtractBearerToken ¶ added in v0.0.13

func ExtractBearerToken(r *http.Request) (token string, present bool, ok bool)

ExtractBearerToken parses an `Authorization: Bearer <token>` header on r. Returns:

• token, true, true — a Bearer scheme header carrying a syntactically usable token (non-empty after trimming leading whitespace);
• "", true, false — a Bearer scheme header that is malformed (missing token part, empty after trimming, etc.);
• "", false, false — no Authorization header, or a header using a different scheme (Basic, Digest, …).

The three-way return exists so callers (NewTCPAPIAuthMiddleware, WSAttachHandler.authenticateDevice) can implement the plan doc's PR0 rule "an Authorization: Bearer header, when present, is a hard commitment to the Bearer path" — a present-but-malformed Bearer header must fail authentication outright, NOT silently fall back to cookie auth (which could resolve to a different device identity than the caller intended). Scheme matching is case-insensitive.

func GenerateDeviceToken ¶ added in v0.0.13

func GenerateDeviceToken() (string, error)

GenerateDeviceToken returns a new raw Bearer device token: DeviceTokenPrefix followed by 32 bytes of crypto/rand, URL-safe base64 (no padding) encoded. The raw token is handed back to the caller exactly once (the POST /api/auth/device response body) — only its HashToken hash is ever persisted (web_devices.token_hash).

func GeneratePairingCode ¶

func GeneratePairingCode() string

func HashCode ¶

func HashCode(code string) []byte

func HashToken ¶ added in v0.0.13

func HashToken(token string) []byte

HashToken returns the SHA-256 hash of a raw Bearer token — the value stored in web_devices.token_hash. Mirrors HashCode's role for pairing codes (pairing.go): the raw secret never touches the database, only its hash does.

func IsLoopback ¶

func IsLoopback(r *http.Request) bool

IsLoopback reports whether the request came from a loopback address. UNIX domain socket connections (RemoteAddr == "" or "@") are also considered loopback since they are only reachable from the local machine.

If the request carries upstream-proxy headers (X-Forwarded-For, CF-Connecting-IP, Forwarded), the request is treated as NOT loopback even when RemoteAddr is 127.0.0.1 — because such a request arrived via a reverse proxy / tunnel (e.g. cloudflared forwarding to localhost:8080) and must not benefit from the bootstrap exemption granted to real local sessions. Header values themselves are not trusted (they can be spoofed); only the presence of the header is used as a "I came through a proxy" signal.

func NewTCPAPIAuthMiddleware ¶ added in v0.0.5

func NewTCPAPIAuthMiddleware(signer *SessionSigner, store *Store) func(http.Handler) http.Handler

NewTCPAPIAuthMiddleware guards the data/control JSON API when it is reached over the (potentially externally-exposed) TCP listener.

The UNIX socket is trusted: it is filesystem-permission protected and only reachable by the local user (CLI and in-sandbox agents dial it via BOID_SOCKET). It is served by the bare router WITHOUT this middleware, so CLI/agent access is never gated. This middleware is applied ONLY to the TCP listener's handler.

Over TCP, every /api/* path except the public ones (see apiAuthRequired) requires either a valid Bearer device token or a valid session cookie (docs/plans/cli-remote-connection.md Phase 3 PR0). An `Authorization: Bearer <token>` header, when present, is a hard commitment to that path: success or failure is decided on the Bearer token alone, with no fallback to the cookie check below even if a valid session cookie is also attached to the same request. This keeps the two paths' pass/fail semantics independent and makes the priority unambiguous (Bearer over cookie) rather than needing to reconcile which one "wins" when both are present. When no Bearer header is present at all, the logic below is byte-for-byte the pre-PR0 cookie/bootstrap behavior — see 決定事項 「既存 cookie 経路は 100% 温存」.

The loopback-bootstrap exemption (no cookie + genuine loopback + zero registered devices) is preserved so the Web UI is usable before the first device is paired. Requests that arrived via a reverse proxy / tunnel (IsLoopback==false because of proxy headers) get no bootstrap and must authenticate.

Failures return 401 JSON (not a 302 redirect to /login) because callers here are API clients. Non-/api paths (HTML pages, /login, /auth, /static) fall through to the router, which applies its own WebAuthMiddleware.

func NewWebAuthMiddleware ¶

func NewWebAuthMiddleware(signer *SessionSigner, store *Store) func(http.Handler) http.Handler

NewWebAuthMiddleware returns middleware that enforces session cookie auth for web UI routes.

Exempt paths (pass through without any check): /login, /auth*, /static/*.

For non-exempt paths the logic is:

no cookie + loopback + no devices registered → warn + pass (bootstrap mode)
no cookie + anything else                    → 302 /login
invalid cookie                               → clear cookie + 302 /login
valid cookie                                 → pass (Verify updates last_seen, deviceID stored in ctx)

func WithAuthMethod ¶ added in v0.0.13

func WithAuthMethod(ctx context.Context, method AuthMethod) context.Context

WithAuthMethod returns ctx tagged with the auth method used to authenticate this request. Called by NewTCPAPIAuthMiddleware (bearer or cookie branch) and NewWebAuthMiddleware (cookie branch); handlers read it via AuthMethodFromContext.

func WithDeviceID ¶

func WithDeviceID(ctx context.Context, deviceID string) context.Context

WithDeviceID returns ctx with deviceID embedded. Used by NewWebAuthMiddleware and in tests to inject a device identity without running the full middleware.