Phase 1: accounts and sessions

Implements PLAN.md Phase 1. A client can now register, log in, manage its
devices and set its profile; an operator can create accounts and flip the
runtime switches. There are still no rooms and no real /sync.

userapi: accounts, argon2id passwords in PHC format, devices, access and
refresh tokens stored as SHA-256 hashes, account data and the admin flag.
Its storage interface is storage.UserStore, implemented once in sqlstore
with `?` placeholders; the postgres driver supplies a rebind function and
unique-violation recognition rather than keeping a second copy of thirty
statements. Timestamps in these tables are int64 milliseconds, the unit the
Client-Server API uses on the wire.

Client-Server API: register (user-interactive auth with m.login.dummy and
optional registration tokens), register/available, token validity, login
with m.login.password, logout, logout/all, refresh, account/whoami,
capabilities, devices/* with password-gated deletion, profile/*, global and
per-room account data.

GET /sync is a deliberate placeholder: it answers a valid token with an
empty but well-formed response and refuses a revoked one. Phase 1 has no
rooms, so that is the whole truth, and it is what makes session revocation
observable. Phase 4 replaces it with the syncapi.

Auth middleware resolves a bearer token (header or the legacy query
parameter) to a device and user, answering an expired token with the soft
logout the spec asks for. Rate limiting is a token bucket per endpoint class
keyed on the client address, returning M_LIMIT_EXCEEDED with retry_after_ms.

adminapi v1 under /_warp/admin/v1: admin-only auth via a normal Matrix
token, GET/PUT /federation and /registration driving internal/settings and
reporting a config-pinned switch as a 409, GET/POST /users, GET /stats.

warp create-account [--admin] creates the first account straight in the
database, so a new install with registration off has a way in.

Complement is wired up for the federation=off profile: an image meeting its
contract, an entrypoint that configures Warp entirely from WARP_*
variables, and a runner that builds, clones and executes the target set
(TestRegistration, TestLogin, TestDeviceManagement). It has not been run
yet -- there is no container runtime on the development machine -- so the
three tests' assertions were read from the Complement sources and pinned as
httptest tests instead, and CI gained a job that runs the real thing.

Also fixes a .gitignore bug from Phase 0: the unanchored `warp` pattern,
meant for the built binary, also matched the directory server/cmd/warp and
silently excluded the entire command package from the repository. The
binary patterns are now anchored to the repository root, and cmd/warp is
committed for the first time.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/internal/adminapi/adminapi_test.go

@@ -0,0 +1,412 @@
+package adminapi_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"testing"
+
+	"github.com/dariuszjaniak/warp/server/internal/adminapi"
+	"github.com/dariuszjaniak/warp/server/internal/federation"
+	"github.com/dariuszjaniak/warp/server/internal/httputil"
+	"github.com/dariuszjaniak/warp/server/internal/settings"
+	"github.com/dariuszjaniak/warp/server/internal/storage"
+	_ "github.com/dariuszjaniak/warp/server/internal/storage/drivers"
+	"github.com/dariuszjaniak/warp/server/internal/userapi"
+)
+
+const testServerName = "warp.example"
+
+// testServer is an admin API on a throwaway SQLite database.
+type testServer struct {
+	t        *testing.T
+	handler  http.Handler
+	users    *userapi.API
+	settings *settings.Service
+}
+
+// newTestServer builds the component. defaults are the config-file values
+// the settings service starts from, which is how a test pins a switch.
+func newTestServer(t *testing.T, defaults settings.Defaults) *testServer {
+	t.Helper()
+
+	path := filepath.ToSlash(filepath.Join(t.TempDir(), "warp.db"))
+	db, err := storage.Open(t.Context(), storage.Config{
+		Driver:           storage.DriverSQLite,
+		ConnectionString: "file:" + path,
+	}, slog.New(slog.DiscardHandler))
+	if err != nil {
+		t.Fatalf("open storage: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	if err := db.Migrate(t.Context()); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+
+	users, err := userapi.New(userapi.Options{
+		ServerName: testServerName,
+		Store:      db.Users(),
+		Logger:     slog.New(slog.DiscardHandler),
+	})
+	if err != nil {
+		t.Fatalf("userapi.New: %v", err)
+	}
+
+	settingsService, err := settings.New(t.Context(), db.Settings(), defaults, slog.New(slog.DiscardHandler))
+	if err != nil {
+		t.Fatalf("settings.New: %v", err)
+	}
+
+	api, err := adminapi.New(adminapi.Options{
+		ServerName: testServerName,
+		Users:      users,
+		Settings:   settingsService,
+		Federation: federation.NewGate(settingsService.FederationEnabled,
+			federation.NewPolicy([]string{"friend.example"}, []string{"spam.example"})),
+		Database: db,
+		Logger:   slog.New(slog.DiscardHandler),
+	})
+	if err != nil {
+		t.Fatalf("adminapi.New: %v", err)
+	}
+
+	router := httputil.NewRouter(nil)
+	api.RegisterRoutes(router)
+	return &testServer{t: t, handler: router, users: users, settings: settingsService}
+}
+
+func (ts *testServer) do(method, path, token string, body any) *httptest.ResponseRecorder {
+	ts.t.Helper()
+
+	var reader io.Reader
+	if body != nil {
+		raw, err := json.Marshal(body)
+		if err != nil {
+			ts.t.Fatal(err)
+		}
+		reader = bytes.NewReader(raw)
+	}
+	req := httptest.NewRequest(method, path, reader)
+	if token != "" {
+		req.Header.Set("Authorization", "Bearer "+token)
+	}
+	rec := httptest.NewRecorder()
+	ts.handler.ServeHTTP(rec, req)
+	return rec
+}
+
+// admin creates an administrator and returns its access token.
+func (ts *testServer) admin(localpart string) string {
+	ts.t.Helper()
+	return ts.account(localpart, true)
+}
+
+// user creates an ordinary account and returns its access token.
+func (ts *testServer) user(localpart string) string {
+	ts.t.Helper()
+	return ts.account(localpart, false)
+}
+
+func (ts *testServer) account(localpart string, admin bool) string {
+	ts.t.Helper()
+	if _, err := ts.users.CreateAccount(ts.t.Context(), userapi.NewAccountRequest{
+		Localpart: localpart,
+		Password:  "sUp3rs3kr1t",
+		Admin:     admin,
+	}); err != nil {
+		ts.t.Fatalf("CreateAccount: %v", err)
+	}
+	session, err := ts.users.CreateSession(ts.t.Context(), userapi.SessionRequest{Localpart: localpart})
+	if err != nil {
+		ts.t.Fatalf("CreateSession: %v", err)
+	}
+	return session.AccessToken
+}
+
+func jsonBody(t *testing.T, rec *httptest.ResponseRecorder) map[string]any {
+	t.Helper()
+	var out map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
+		t.Fatalf("response is not JSON (%s): %v", rec.Body.String(), err)
+	}
+	return out
+}
+
+func expectStatus(t *testing.T, rec *httptest.ResponseRecorder, want int) {
+	t.Helper()
+	if rec.Code != want {
+		t.Fatalf("status = %d, want %d (body: %s)", rec.Code, want, rec.Body.String())
+	}
+}
+
+func expectError(t *testing.T, rec *httptest.ResponseRecorder, status int, errcode string) {
+	t.Helper()
+	expectStatus(t, rec, status)
+	if got := jsonBody(t, rec)["errcode"]; got != errcode {
+		t.Errorf("errcode = %v, want %s (body: %s)", got, errcode, rec.Body.String())
+	}
+}
+
+const (
+	federationPath   = adminapi.Prefix + "/federation"
+	registrationPath = adminapi.Prefix + "/registration"
+	usersPath        = adminapi.Prefix + "/users"
+	statsPath        = adminapi.Prefix + "/stats"
+)
+
+var toggleable = settings.Defaults{
+	FederationAllowRuntimeToggle:   true,
+	RegistrationAllowRuntimeToggle: true,
+}
+
+// TestAdminAuth is the gate everything else here depends on.
+func TestAdminAuth(t *testing.T) {
+	ts := newTestServer(t, toggleable)
+	admin := ts.admin("root")
+	ordinary := ts.user("alice")
+
+	for name, tc := range map[string]struct {
+		token  string
+		status int
+		code   string
+	}{
+		"no token":      {"", http.StatusUnauthorized, "M_MISSING_TOKEN"},
+		"unknown token": {"not-a-token", http.StatusUnauthorized, "M_UNKNOWN_TOKEN"},
+		"ordinary user": {ordinary, http.StatusForbidden, "M_FORBIDDEN"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			expectError(t, ts.do(http.MethodGet, statsPath, tc.token, nil), tc.status, tc.code)
+		})
+	}
+
+	expectStatus(t, ts.do(http.MethodGet, statsPath, admin, nil), http.StatusOK)
+}
+
+// TestAdminTokenNotAcceptedInQueryString: an admin token in a URL ends up in
+// every access log between here and the browser.
+func TestAdminTokenNotAcceptedInQueryString(t *testing.T) {
+	ts := newTestServer(t, toggleable)
+	admin := ts.admin("root")
+
+	expectError(t, ts.do(http.MethodGet, statsPath+"?access_token="+admin, "", nil),
+		http.StatusUnauthorized, "M_MISSING_TOKEN")
+}
+
+// TestFederationSwitch is the admin half of PLAN.md section 3: the switch
+// flips at runtime and the gate follows.
+func TestFederationSwitch(t *testing.T) {
+	ts := newTestServer(t, toggleable)
+	admin := ts.admin("root")
+
+	rec := ts.do(http.MethodGet, federationPath, admin, nil)
+	expectStatus(t, rec, http.StatusOK)
+	body := jsonBody(t, rec)
+	if body["enabled"] != false {
+		t.Errorf("federation should start disabled, got %v", body["enabled"])
+	}
+	if body["toggleable"] != true {
+		t.Errorf("toggleable = %v, want true", body["toggleable"])
+	}
+	// The dashboard needs to show which servers a running Warp will talk
+	// to, even though editing the lists is Phase 9.
+	if allowlist, _ := body["allowlist"].([]any); len(allowlist) != 1 || allowlist[0] != "friend.example" {
+		t.Errorf("allowlist = %v", body["allowlist"])
+	}
+	if denylist, _ := body["denylist"].([]any); len(denylist) != 1 || denylist[0] != "spam.example" {
+		t.Errorf("denylist = %v", body["denylist"])
+	}
+
+	rec = ts.do(http.MethodPut, federationPath, admin, map[string]any{"enabled": true})
+	expectStatus(t, rec, http.StatusOK)
+	if jsonBody(t, rec)["enabled"] != true {
+		t.Errorf("the PUT should report the new state, got %s", rec.Body.String())
+	}
+	if !ts.settings.FederationEnabled() {
+		t.Error("the settings service did not pick the change up")
+	}
+
+	rec = ts.do(http.MethodPut, federationPath, admin, map[string]any{"enabled": false})
+	expectStatus(t, rec, http.StatusOK)
+	if ts.settings.FederationEnabled() {
+		t.Error("switching back off did not take effect")
+	}
+}
+
+func TestRegistrationSwitch(t *testing.T) {
+	ts := newTestServer(t, toggleable)
+	admin := ts.admin("root")
+
+	rec := ts.do(http.MethodPut, registrationPath, admin, map[string]any{"enabled": true})
+	expectStatus(t, rec, http.StatusOK)
+	if !ts.settings.RegistrationEnabled() {
+		t.Error("registration was not enabled")
+	}
+
+	rec = ts.do(http.MethodGet, registrationPath, admin, nil)
+	expectStatus(t, rec, http.StatusOK)
+	if jsonBody(t, rec)["enabled"] != true {
+		t.Errorf("GET = %s", rec.Body.String())
+	}
+}
+
+// TestSwitchPinnedByConfig covers settings.ErrNotToggleable: the request was
+// fine, the server's own configuration is what refuses it, so it is a
+// conflict rather than a bad request.
+func TestSwitchPinnedByConfig(t *testing.T) {
+	ts := newTestServer(t, settings.Defaults{})
+	admin := ts.admin("root")
+
+	for _, path := range []string{federationPath, registrationPath} {
+		rec := ts.do(http.MethodPut, path, admin, map[string]any{"enabled": true})
+		expectError(t, rec, http.StatusConflict, "M_FORBIDDEN")
+		if msg, _ := jsonBody(t, rec)["error"].(string); msg == "" {
+			t.Error("the refusal must say which setting is pinned")
+		}
+
+		// And the GET says so in advance, so the panel can grey the
+		// switch out instead of offering something that will bounce.
+		rec = ts.do(http.MethodGet, path, admin, nil)
+		expectStatus(t, rec, http.StatusOK)
+		if jsonBody(t, rec)["toggleable"] != false {
+			t.Errorf("GET %s reports toggleable, but it is pinned", path)
+		}
+	}
+}
+
+func TestSwitchRequiresTheEnabledField(t *testing.T) {
+	ts := newTestServer(t, toggleable)
+	admin := ts.admin("root")
+
+	expectError(t, ts.do(http.MethodPut, federationPath, admin, map[string]any{}),
+		http.StatusBadRequest, "M_MISSING_PARAM")
+}
+
+func TestListUsers(t *testing.T) {
+	ts := newTestServer(t, toggleable)
+	admin := ts.admin("root")
+	ts.user("alice")
+	ts.user("bob")
+
+	rec := ts.do(http.MethodGet, usersPath, admin, nil)
+	expectStatus(t, rec, http.StatusOK)
+
+	body := jsonBody(t, rec)
+	if total, _ := body["total"].(float64); total != 3 {
+		t.Errorf("total = %v, want 3", body["total"])
+	}
+	users, _ := body["users"].([]any)
+	if len(users) != 3 {
+		t.Fatalf("got %d users, want 3", len(users))
+	}
+	first, _ := users[0].(map[string]any)
+	if first["user_id"] != "@alice:warp.example" {
+		t.Errorf("users are not ordered by localpart: %s", rec.Body.String())
+	}
+	if first["admin"] != false {
+		t.Errorf("alice should not be an admin: %v", first)
+	}
+
+	// Paging reports the full total so the panel can show how many pages
+	// there are.
+	rec = ts.do(http.MethodGet, usersPath+"?limit=1&offset=1", admin, nil)
+	expectStatus(t, rec, http.StatusOK)
+	body = jsonBody(t, rec)
+	users, _ = body["users"].([]any)
+	if len(users) != 1 || users[0].(map[string]any)["user_id"] != "@bob:warp.example" {
+		t.Errorf("paged listing = %s", rec.Body.String())
+	}
+	if total, _ := body["total"].(float64); total != 3 {
+		t.Errorf("paged total = %v, want 3", body["total"])
+	}
+
+	rec = ts.do(http.MethodGet, usersPath+"?search=ali", admin, nil)
+	expectStatus(t, rec, http.StatusOK)
+	if total, _ := jsonBody(t, rec)["total"].(float64); total != 1 {
+		t.Errorf("search found %v users, want 1", jsonBody(t, rec)["total"])
+	}
+
+	expectError(t, ts.do(http.MethodGet, usersPath+"?limit=lots", admin, nil),
+		http.StatusBadRequest, "M_INVALID_PARAM")
+	expectError(t, ts.do(http.MethodGet, usersPath+"?offset=-1", admin, nil),
+		http.StatusBadRequest, "M_INVALID_PARAM")
+}
+
+// TestCreateUser covers the way an operator adds an account to a server with
+// registration switched off — which is the normal state of a private Warp.
+func TestCreateUser(t *testing.T) {
+	ts := newTestServer(t, toggleable)
+	admin := ts.admin("root")
+
+	if ts.settings.RegistrationEnabled() {
+		t.Fatal("this test needs registration to be off")
+	}
+
+	rec := ts.do(http.MethodPost, usersPath, admin, map[string]any{
+		"username":     "Alice",
+		"password":     "sUp3rs3kr1t",
+		"display_name": "Alice",
+		"admin":        true,
+	})
+	expectStatus(t, rec, http.StatusCreated)
+
+	body := jsonBody(t, rec)
+	if body["user_id"] != "@alice:warp.example" {
+		t.Errorf("user_id = %v; the localpart should be normalised", body["user_id"])
+	}
+	if body["admin"] != true {
+		t.Errorf("admin = %v, want true", body["admin"])
+	}
+
+	// The new account can really log in, which is the only thing that
+	// makes creating it useful.
+	if err := ts.users.CheckPassword(t.Context(), "alice", "sUp3rs3kr1t"); err != nil {
+		t.Errorf("the created account cannot log in: %v", err)
+	}
+
+	expectError(t, ts.do(http.MethodPost, usersPath, admin, map[string]any{
+		"username": "alice", "password": "sUp3rs3kr1t",
+	}), http.StatusBadRequest, "M_USER_IN_USE")
+
+	expectError(t, ts.do(http.MethodPost, usersPath, admin, map[string]any{
+		"username": "not valid", "password": "sUp3rs3kr1t",
+	}), http.StatusBadRequest, "M_INVALID_USERNAME")
+
+	expectError(t, ts.do(http.MethodPost, usersPath, admin, map[string]any{"username": "bob"}),
+		http.StatusBadRequest, "M_MISSING_PARAM")
+	expectError(t, ts.do(http.MethodPost, usersPath, admin, map[string]any{"password": "x"}),
+		http.StatusBadRequest, "M_MISSING_PARAM")
+}
+
+func TestStats(t *testing.T) {
+	ts := newTestServer(t, toggleable)
+	admin := ts.admin("root")
+	ts.user("alice")
+
+	rec := ts.do(http.MethodGet, statsPath, admin, nil)
+	expectStatus(t, rec, http.StatusOK)
+
+	body := jsonBody(t, rec)
+	if body["server_name"] != testServerName {
+		t.Errorf("server_name = %v", body["server_name"])
+	}
+	if body["database"] != storage.DriverSQLite {
+		t.Errorf("database = %v, want sqlite", body["database"])
+	}
+	if users, _ := body["users"].(float64); users != 2 {
+		t.Errorf("users = %v, want 2", body["users"])
+	}
+	if admins, _ := body["admins"].(float64); admins != 1 {
+		t.Errorf("admins = %v, want 1", body["admins"])
+	}
+	// Each account above got one session, so the device count follows.
+	if devices, _ := body["devices"].(float64); devices != 2 {
+		t.Errorf("devices = %v, want 2", body["devices"])
+	}
+	if body["federation_enabled"] != false || body["registration_enabled"] != false {
+		t.Errorf("switch state = %s", rec.Body.String())
+	}
+}