Efremenko Arhip
3a1461315f
Let a signed-in user turn their own machine into a worker without the shared token. The coordinator already binds a JWT-authenticated registration to owner_id as untrusted; this adds the missing pieces. userservice: long-lived worker keys (scimesh_wk_live_*, hash-at-rest) with create/list/revoke and a public /worker-tokens/exchange that trades a key for a short-lived JWT carrying the owner current role/verified. python worker: SCIMESH_WORKER_KEY + SCIMESH_USERSERVICE_URL; a token provider exchanges the key and refreshes the JWT proactively and on 401, so a long-running worker survives token expiry. Static bearer token path is unchanged. coordinator UI: an "add your machine" page that mints a key and shows a ready-to-run command, proxying key management to the userservice; the dashboard gains an owner-scoped "my machines" section. docs: how to run a worker from your account, plus the untrusted/quorum/ verified trust model.
88 lines
2.7 KiB
Go
88 lines
2.7 KiB
Go
// Command userservice runs the SciMesh authentication service: it registers
|
|
// users, verifies logins, and issues the HS256 JWTs the coordinator trusts.
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
nethttp "net/http"
|
|
"os"
|
|
"os/signal"
|
|
"syscall"
|
|
|
|
"github.com/emil28092005/SciMesh/users/internal/auth"
|
|
"github.com/emil28092005/SciMesh/users/internal/infra"
|
|
"github.com/emil28092005/SciMesh/users/internal/storage/postgres"
|
|
apihttp "github.com/emil28092005/SciMesh/users/internal/transport/http"
|
|
"github.com/emil28092005/SciMesh/users/internal/usecase"
|
|
)
|
|
|
|
func main() {
|
|
if err := run(); err != nil {
|
|
fmt.Fprintln(os.Stderr, "fatal:", err)
|
|
os.Exit(1)
|
|
}
|
|
}
|
|
|
|
func run() error {
|
|
// Cancelled on SIGINT/SIGTERM so the HTTP server drains in-flight requests
|
|
// instead of dropping them.
|
|
ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
|
|
defer stop()
|
|
|
|
cfg, err := infra.LoadConfig()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
log, closer, err := infra.NewLogger(cfg)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer func() { _ = closer.Close() }()
|
|
|
|
pool, err := infra.NewPool(ctx, cfg, log)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer pool.Close()
|
|
|
|
// Adapters implementing the usecase ports.
|
|
users := postgres.NewUserRepo(pool)
|
|
workerKeys := postgres.NewWorkerKeyRepo(pool)
|
|
hasher := auth.NewHasher(cfg.BcryptCost)
|
|
clock := infra.NewClock()
|
|
issuer := auth.NewIssuer(cfg.JWTSecret, cfg.TokenTTL, clock.Now)
|
|
|
|
uc := apihttp.UseCases{
|
|
Register: usecase.NewRegister(users, hasher, clock),
|
|
Login: usecase.NewLogin(users, hasher, issuer),
|
|
SetVerified: usecase.NewSetVerified(users),
|
|
SetRole: usecase.NewSetRole(users),
|
|
CreateWorkerKey: usecase.NewCreateWorkerKey(workerKeys, clock),
|
|
ListWorkerKeys: usecase.NewListWorkerKeys(workerKeys),
|
|
RevokeWorkerKey: usecase.NewRevokeWorkerKey(workerKeys),
|
|
ExchangeWorkerKey: usecase.NewExchangeWorkerKey(workerKeys, users, issuer, cfg.TokenTTL),
|
|
Users: users,
|
|
}
|
|
|
|
// Seed the first admin, if configured. Idempotent: a no-op once it exists.
|
|
if cfg.BootstrapAdminEmail != "" && cfg.BootstrapAdminPassword != "" {
|
|
created, err := usecase.NewBootstrapAdmin(users, hasher, clock).
|
|
Execute(ctx, cfg.BootstrapAdminEmail, cfg.BootstrapAdminPassword)
|
|
if err != nil {
|
|
return fmt.Errorf("bootstrap admin: %w", err)
|
|
}
|
|
if created {
|
|
log.Info("bootstrap admin created", "email", cfg.BootstrapAdminEmail)
|
|
}
|
|
}
|
|
|
|
handler := apihttp.NewServer(log, uc, issuer)
|
|
// A blanket per-request deadline: bcrypt is bounded, so anything slower is a
|
|
// stuck handler we want to shed rather than hold a connection open.
|
|
handler = nethttp.TimeoutHandler(handler, cfg.RequestTimeout, `{"error":"request timeout"}`)
|
|
|
|
return infra.RunServer(ctx, log, cfg.Addr, handler)
|
|
}
|