Phase 1: accounts and sessions

Implements PLAN.md Phase 1. A client can now register, log in, manage its
devices and set its profile; an operator can create accounts and flip the
runtime switches. There are still no rooms and no real /sync.

userapi: accounts, argon2id passwords in PHC format, devices, access and
refresh tokens stored as SHA-256 hashes, account data and the admin flag.
Its storage interface is storage.UserStore, implemented once in sqlstore
with `?` placeholders; the postgres driver supplies a rebind function and
unique-violation recognition rather than keeping a second copy of thirty
statements. Timestamps in these tables are int64 milliseconds, the unit the
Client-Server API uses on the wire.

Client-Server API: register (user-interactive auth with m.login.dummy and
optional registration tokens), register/available, token validity, login
with m.login.password, logout, logout/all, refresh, account/whoami,
capabilities, devices/* with password-gated deletion, profile/*, global and
per-room account data.

GET /sync is a deliberate placeholder: it answers a valid token with an
empty but well-formed response and refuses a revoked one. Phase 1 has no
rooms, so that is the whole truth, and it is what makes session revocation
observable. Phase 4 replaces it with the syncapi.

Auth middleware resolves a bearer token (header or the legacy query
parameter) to a device and user, answering an expired token with the soft
logout the spec asks for. Rate limiting is a token bucket per endpoint class
keyed on the client address, returning M_LIMIT_EXCEEDED with retry_after_ms.

adminapi v1 under /_warp/admin/v1: admin-only auth via a normal Matrix
token, GET/PUT /federation and /registration driving internal/settings and
reporting a config-pinned switch as a 409, GET/POST /users, GET /stats.

warp create-account [--admin] creates the first account straight in the
database, so a new install with registration off has a way in.

Complement is wired up for the federation=off profile: an image meeting its
contract, an entrypoint that configures Warp entirely from WARP_*
variables, and a runner that builds, clones and executes the target set
(TestRegistration, TestLogin, TestDeviceManagement). It has not been run
yet -- there is no container runtime on the development machine -- so the
three tests' assertions were read from the Complement sources and pinned as
httptest tests instead, and CI gained a job that runs the real thing.

Also fixes a .gitignore bug from Phase 0: the unanchored `warp` pattern,
meant for the built binary, also matched the directory server/cmd/warp and
silently excluded the entire command package from the repository. The
binary patterns are now anchored to the repository root, and cmd/warp is
committed for the first time.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/cmd/warp/commands.go

@@ -0,0 +1,191 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"log/slog"
+	"os"
+
+	"github.com/dariuszjaniak/warp/server/internal/buildinfo"
+	"github.com/dariuszjaniak/warp/server/internal/config"
+	"github.com/dariuszjaniak/warp/server/internal/logging"
+	"github.com/dariuszjaniak/warp/server/internal/matrix/signing"
+	"github.com/dariuszjaniak/warp/server/internal/setup"
+	"github.com/dariuszjaniak/warp/server/internal/storage"
+	_ "github.com/dariuszjaniak/warp/server/internal/storage/drivers" // link in the storage drivers
+)
+
+// defaultConfigPath is used when neither --config nor WARP_CONFIG is given
+// and the file happens to exist next to the binary's working directory.
+const defaultConfigPath = "warp.yaml"
+
+// newFlagSet builds a flag set that prints usage to stdout on --help.
+func newFlagSet(name string) *flag.FlagSet {
+	fs := flag.NewFlagSet(name, flag.ContinueOnError)
+	fs.SetOutput(os.Stdout)
+	return fs
+}
+
+// addConfigFlag registers --config and returns the resolver for it.
+func addConfigFlag(fs *flag.FlagSet) func() (*config.Config, error) {
+	path := fs.String("config", "", "path to warp.yaml (default: $WARP_CONFIG, then ./warp.yaml)")
+	return func() (*config.Config, error) {
+		resolved := resolveConfigPath(*path)
+		cfg, err := config.Load(resolved)
+		if err != nil {
+			return nil, err
+		}
+		return cfg, nil
+	}
+}
+
+// resolveConfigPath implements the --config / $WARP_CONFIG / ./warp.yaml
+// precedence. An empty result means "defaults plus environment", which is
+// how a container with only WARP_* variables starts.
+func resolveConfigPath(flagValue string) string {
+	if flagValue != "" {
+		return flagValue
+	}
+	if env := os.Getenv("WARP_CONFIG"); env != "" {
+		return env
+	}
+	if _, err := os.Stat(defaultConfigPath); err == nil {
+		return defaultConfigPath
+	}
+	return ""
+}
+
+// newLogger builds the logger described by the config.
+func newLogger(cfg *config.Config) (*slog.Logger, error) {
+	return logging.New(os.Stderr, logging.Options{
+		Level:     cfg.Logging.Level,
+		Format:    cfg.Logging.Format,
+		AddSource: cfg.Logging.AddSource,
+	})
+}
+
+func runServe(ctx context.Context, args []string) error {
+	fs := newFlagSet("serve")
+	loadConfig := addConfigFlag(fs)
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+
+	cfg, err := loadConfig()
+	if err != nil {
+		return err
+	}
+	log, err := newLogger(cfg)
+	if err != nil {
+		return err
+	}
+	slog.SetDefault(log)
+
+	if cfg.Path() == "" {
+		log.Warn("no configuration file; using defaults and WARP_* environment variables")
+	} else {
+		log.Info("loaded configuration", "path", cfg.Path())
+	}
+
+	server, err := setup.New(ctx, cfg, setup.Options{Logger: log})
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err := server.Close(); err != nil {
+			log.Error("closing storage failed", "error", err)
+		}
+	}()
+
+	return server.Run(ctx)
+}
+
+func runMigrate(ctx context.Context, args []string) error {
+	fs := newFlagSet("migrate")
+	loadConfig := addConfigFlag(fs)
+	statusOnly := fs.Bool("status", false, "list pending migrations without applying them")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+
+	cfg, err := loadConfig()
+	if err != nil {
+		return err
+	}
+	log, err := newLogger(cfg)
+	if err != nil {
+		return err
+	}
+	slog.SetDefault(log)
+
+	db, err := openDatabase(ctx, cfg, log)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = db.Close() }()
+
+	pending, err := db.PendingMigrations(ctx)
+	if err != nil {
+		return err
+	}
+	if len(pending) == 0 {
+		fmt.Printf("%s: schema is up to date\n", db.Driver())
+		return nil
+	}
+	if *statusOnly {
+		fmt.Printf("%s: %d pending migration(s):\n", db.Driver(), len(pending))
+		for _, name := range pending {
+			fmt.Printf("  %s\n", name)
+		}
+		return nil
+	}
+	if err := db.Migrate(ctx); err != nil {
+		return err
+	}
+	fmt.Printf("%s: applied %d migration(s)\n", db.Driver(), len(pending))
+	return nil
+}
+
+func runGenerateKeys(_ context.Context, args []string) error {
+	fs := newFlagSet("generate-keys")
+	loadConfig := addConfigFlag(fs)
+	output := fs.String("output", "", "where to write the key (default: global.private_key from the config)")
+	keyID := fs.String("key-id", "", "key identifier without the \"ed25519:\" prefix (default: random)")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+
+	path := *output
+	if path == "" {
+		cfg, err := loadConfig()
+		if err != nil {
+			return fmt.Errorf("%w\n(pass --output to generate a key without a configuration file)", err)
+		}
+		path = cfg.Global.PrivateKeyPath
+	}
+
+	key, err := signing.Generate(*keyID)
+	if err != nil {
+		return err
+	}
+	if err := key.Save(path); err != nil {
+		return err
+	}
+	fmt.Printf("wrote %s\n  key ID:     %s\n  public key: %s\n", path, key.KeyID(), key.PublicBase64())
+	return nil
+}
+
+func runVersion(_ context.Context, args []string) error {
+	fs := newFlagSet("version")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if fs.NArg() > 0 {
+		return errors.New("version takes no arguments")
+	}
+	fmt.Printf("warp %s\n", buildinfo.String())
+	fmt.Printf("storage drivers: %v\n", storage.Drivers())
+	return nil
+}

server/cmd/warp/createaccount.go

@@ -0,0 +1,175 @@
+package main
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"os"
+	"strings"
+
+	"golang.org/x/term"
+
+	"github.com/dariuszjaniak/warp/server/internal/config"
+	"github.com/dariuszjaniak/warp/server/internal/storage"
+	"github.com/dariuszjaniak/warp/server/internal/userapi"
+)
+
+// runCreateAccount implements `warp create-account`.
+//
+// It talks to the database directly rather than to a running server, so the
+// first account on a fresh install can be made before anything is listening
+// and without turning registration on. That is the whole point of it: a
+// private homeserver with registration off still needs a first admin.
+func runCreateAccount(ctx context.Context, args []string) error {
+	fs := newFlagSet("create-account")
+	loadConfig := addConfigFlag(fs)
+	username := fs.String("username", "", "localpart of the new user, e.g. alice")
+	password := fs.String("password", "", "password (prompted for if omitted)")
+	passwordFile := fs.String("password-file", "", "read the password from this file instead of prompting")
+	displayName := fs.String("display-name", "", "profile display name (default: none)")
+	admin := fs.Bool("admin", false, "give the account the server administrator flag")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if *username == "" {
+		return errors.New("create-account: --username is required")
+	}
+	if *password != "" && *passwordFile != "" {
+		return errors.New("create-account: pass either --password or --password-file, not both")
+	}
+
+	cfg, err := loadConfig()
+	if err != nil {
+		return err
+	}
+	log, err := newLogger(cfg)
+	if err != nil {
+		return err
+	}
+	slog.SetDefault(log)
+
+	secret, err := resolvePassword(*password, *passwordFile)
+	if err != nil {
+		return err
+	}
+
+	db, err := openDatabase(ctx, cfg, log)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = db.Close() }()
+
+	// The schema has to be there before an account can be written. Running
+	// the migrations here rather than erroring out means the documented
+	// first-run sequence works whatever order the operator does it in.
+	if err := db.Migrate(ctx); err != nil {
+		return fmt.Errorf("migrate database: %w", err)
+	}
+
+	users, err := userapi.New(userapi.Options{
+		ServerName: cfg.Global.ServerName,
+		Store:      db.Users(),
+		Logger:     log,
+	})
+	if err != nil {
+		return err
+	}
+
+	account, err := users.CreateAccount(ctx, userapi.NewAccountRequest{
+		Localpart:   *username,
+		Password:    secret,
+		DisplayName: *displayName,
+		Admin:       *admin,
+	})
+	switch {
+	case errors.Is(err, userapi.ErrUserExists):
+		return fmt.Errorf("%s already exists", users.UserID(userapi.NormaliseLocalpart(*username)))
+	case err != nil:
+		return err
+	}
+
+	fmt.Printf("created %s\n", users.UserID(account.Localpart))
+	if account.Admin {
+		fmt.Println("  server administrator: yes")
+	}
+	if secret == "" {
+		fmt.Println("  no password set: this account cannot log in until one is")
+	}
+	return nil
+}
+
+// openDatabase opens the storage driver named in the config.
+func openDatabase(ctx context.Context, cfg *config.Config, log *slog.Logger) (storage.Database, error) {
+	return storage.Open(ctx, storage.Config{
+		Driver:           cfg.Database.Driver,
+		ConnectionString: cfg.Database.ConnectionString,
+		MaxOpenConns:     cfg.Database.MaxOpenConns,
+		MaxIdleConns:     cfg.Database.MaxIdleConns,
+		ConnMaxLifetime:  cfg.Database.ConnMaxLifetime,
+	}, log)
+}
+
+// resolvePassword settles where the password comes from.
+//
+// An interactive prompt is the default because a password on the command
+// line is a password in the shell history and in the process list of every
+// other user on the machine. --password is kept for scripts that have
+// already dealt with that, and --password-file for the ones that have not.
+func resolvePassword(flagValue, file string) (string, error) {
+	if flagValue != "" {
+		return flagValue, nil
+	}
+	if file != "" {
+		data, err := os.ReadFile(file)
+		if err != nil {
+			return "", fmt.Errorf("read password file: %w", err)
+		}
+		secret := strings.TrimRight(string(data), "\r\n")
+		if secret == "" {
+			return "", fmt.Errorf("password file %s is empty", file)
+		}
+		return secret, nil
+	}
+	return promptForPassword()
+}
+
+// promptForPassword reads a password twice without echoing it.
+//
+// When stdin is not a terminal — a pipe in a container entrypoint, say —
+// one line is read instead, with no confirmation, because there is nobody
+// there to mistype it.
+func promptForPassword() (string, error) {
+	if !term.IsTerminal(int(os.Stdin.Fd())) {
+		line, err := bufio.NewReader(os.Stdin).ReadString('\n')
+		if err != nil && line == "" {
+			return "", fmt.Errorf("read password from standard input: %w", err)
+		}
+		secret := strings.TrimRight(line, "\r\n")
+		if secret == "" {
+			return "", errors.New("no password given on standard input")
+		}
+		return secret, nil
+	}
+
+	fmt.Print("Password: ")
+	first, err := term.ReadPassword(int(os.Stdin.Fd()))
+	fmt.Println()
+	if err != nil {
+		return "", fmt.Errorf("read password: %w", err)
+	}
+	fmt.Print("Confirm:  ")
+	second, err := term.ReadPassword(int(os.Stdin.Fd()))
+	fmt.Println()
+	if err != nil {
+		return "", fmt.Errorf("read password: %w", err)
+	}
+	if string(first) != string(second) {
+		return "", errors.New("the passwords do not match")
+	}
+	if len(first) == 0 {
+		return "", errors.New("the password must not be empty")
+	}
+	return string(first), nil
+}

server/cmd/warp/main.go

@@ -0,0 +1,78 @@
+// Command warp is the Matrix homeserver: one binary, one process.
+//
+// Usage:
+//
+//	warp serve           [--config warp.yaml]
+//	warp migrate         [--config warp.yaml] [--status]
+//	warp generate-keys   [--config warp.yaml] [--output path] [--key-id id]
+//	warp create-account  [--config warp.yaml] --username alice [--admin]
+//	warp version
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/signal"
+	"syscall"
+)
+
+// command is one subcommand.
+type command struct {
+	name    string
+	summary string
+	run     func(ctx context.Context, args []string) error
+}
+
+func commands() []command {
+	return []command{
+		{"serve", "run the homeserver", runServe},
+		{"migrate", "apply pending database migrations", runMigrate},
+		{"generate-keys", "create the ed25519 signing key", runGenerateKeys},
+		{"create-account", "create a local user account", runCreateAccount},
+		{"version", "print the version and exit", runVersion},
+	}
+}
+
+func main() {
+	// Ctrl-C and SIGTERM cancel the context; the serve command turns that
+	// into a graceful shutdown.
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+
+	if err := run(ctx, os.Args[1:]); err != nil {
+		if errors.Is(err, context.Canceled) {
+			return
+		}
+		fmt.Fprintf(os.Stderr, "warp: %v\n", err)
+		os.Exit(1)
+	}
+}
+
+func run(ctx context.Context, args []string) error {
+	if len(args) == 0 {
+		usage(os.Stderr)
+		return errors.New("no command given")
+	}
+	switch args[0] {
+	case "-h", "--help", "help":
+		usage(os.Stdout)
+		return nil
+	}
+	for _, c := range commands() {
+		if c.name == args[0] {
+			return c.run(ctx, args[1:])
+		}
+	}
+	usage(os.Stderr)
+	return fmt.Errorf("unknown command %q", args[0])
+}
+
+func usage(w *os.File) {
+	fmt.Fprint(w, "warp — a Matrix homeserver\n\nUsage:\n  warp <command> [flags]\n\nCommands:\n")
+	for _, c := range commands() {
+		fmt.Fprintf(w, "  %-14s %s\n", c.name, c.summary)
+	}
+	fmt.Fprint(w, "\nRun `warp <command> --help` for the flags of a command.\n")
+}