Phase 1: accounts and sessions

Implements PLAN.md Phase 1. A client can now register, log in, manage its
devices and set its profile; an operator can create accounts and flip the
runtime switches. There are still no rooms and no real /sync.

userapi: accounts, argon2id passwords in PHC format, devices, access and
refresh tokens stored as SHA-256 hashes, account data and the admin flag.
Its storage interface is storage.UserStore, implemented once in sqlstore
with `?` placeholders; the postgres driver supplies a rebind function and
unique-violation recognition rather than keeping a second copy of thirty
statements. Timestamps in these tables are int64 milliseconds, the unit the
Client-Server API uses on the wire.

Client-Server API: register (user-interactive auth with m.login.dummy and
optional registration tokens), register/available, token validity, login
with m.login.password, logout, logout/all, refresh, account/whoami,
capabilities, devices/* with password-gated deletion, profile/*, global and
per-room account data.

GET /sync is a deliberate placeholder: it answers a valid token with an
empty but well-formed response and refuses a revoked one. Phase 1 has no
rooms, so that is the whole truth, and it is what makes session revocation
observable. Phase 4 replaces it with the syncapi.

Auth middleware resolves a bearer token (header or the legacy query
parameter) to a device and user, answering an expired token with the soft
logout the spec asks for. Rate limiting is a token bucket per endpoint class
keyed on the client address, returning M_LIMIT_EXCEEDED with retry_after_ms.

adminapi v1 under /_warp/admin/v1: admin-only auth via a normal Matrix
token, GET/PUT /federation and /registration driving internal/settings and
reporting a config-pinned switch as a 409, GET/POST /users, GET /stats.

warp create-account [--admin] creates the first account straight in the
database, so a new install with registration off has a way in.

Complement is wired up for the federation=off profile: an image meeting its
contract, an entrypoint that configures Warp entirely from WARP_*
variables, and a runner that builds, clones and executes the target set
(TestRegistration, TestLogin, TestDeviceManagement). It has not been run
yet -- there is no container runtime on the development machine -- so the
three tests' assertions were read from the Complement sources and pinned as
httptest tests instead, and CI gained a job that runs the real thing.

Also fixes a .gitignore bug from Phase 0: the unanchored `warp` pattern,
meant for the built binary, also matched the directory server/cmd/warp and
silently excluded the entire command package from the repository. The
binary patterns are now anchored to the repository root, and cmd/warp is
committed for the first time.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/internal/adminapi/users.go

@@ -0,0 +1,149 @@
+package adminapi
+
+import (
+	"errors"
+	"net/http"
+	"strconv"
+
+	"github.com/dariuszjaniak/warp/server/internal/httputil"
+	"github.com/dariuszjaniak/warp/server/internal/storage"
+	"github.com/dariuszjaniak/warp/server/internal/userapi"
+)
+
+// adminUser is one row of the user list. It is a flatter shape than the
+// Client-Server API's profile object because the panel shows it as a table.
+type adminUser struct {
+	UserID      string `json:"user_id"`
+	DisplayName string `json:"display_name,omitempty"`
+	AvatarURL   string `json:"avatar_url,omitempty"`
+	Admin       bool   `json:"admin"`
+	Deactivated bool   `json:"deactivated"`
+	CreatedAtMS int64  `json:"created_at_ms"`
+}
+
+type usersResponse struct {
+	Users []adminUser `json:"users"`
+
+	// Total is the number of users matching the query, not the number
+	// returned, so the panel can page.
+	Total int `json:"total"`
+
+	Limit  int `json:"limit"`
+	Offset int `json:"offset"`
+}
+
+// defaultUserPageLimit is what a request without ?limit= gets.
+const defaultUserPageLimit = 50
+
+// handleGetUsers implements GET /_warp/admin/v1/users.
+func (a *AdminAPI) handleGetUsers(w http.ResponseWriter, r *http.Request, _ userapi.Authenticated) error {
+	query := r.URL.Query()
+
+	limit, err := intParam(query.Get("limit"), defaultUserPageLimit)
+	if err != nil {
+		return httputil.InvalidParam("limit must be a number")
+	}
+	offset, err := intParam(query.Get("offset"), 0)
+	if err != nil {
+		return httputil.InvalidParam("offset must be a number")
+	}
+	if limit < 0 || offset < 0 {
+		return httputil.InvalidParam("limit and offset must not be negative")
+	}
+
+	accounts, total, err := a.users.ListAccounts(r.Context(), storage.AccountFilter{
+		Search: query.Get("search"),
+		Limit:  limit,
+		Offset: offset,
+	})
+	if err != nil {
+		return err
+	}
+
+	users := make([]adminUser, 0, len(accounts))
+	for _, acc := range accounts {
+		users = append(users, adminUser{
+			UserID:      a.users.UserID(acc.Localpart),
+			DisplayName: acc.DisplayName,
+			AvatarURL:   acc.AvatarURL,
+			Admin:       acc.Admin,
+			Deactivated: acc.Deactivated,
+			CreatedAtMS: acc.CreatedAtMS,
+		})
+	}
+	httputil.WriteJSON(w, http.StatusOK, usersResponse{
+		Users:  users,
+		Total:  total,
+		Limit:  limit,
+		Offset: offset,
+	})
+	return nil
+}
+
+// createUserRequest is the body of POST /_warp/admin/v1/users.
+type createUserRequest struct {
+	// Username is the localpart; it is normalised like any other.
+	Username string `json:"username"`
+
+	Password    string `json:"password"`
+	DisplayName string `json:"display_name"`
+	Admin       bool   `json:"admin"`
+}
+
+// handlePostUsers implements POST /_warp/admin/v1/users.
+//
+// This is how an operator adds an account on a server with registration
+// turned off, so it deliberately ignores the registration switch: it is the
+// admin's own action, not a public sign-up. It does require a password —
+// unlike `warp create-account`, which may leave one unset — because an
+// account created from the panel is meant to be handed to somebody.
+func (a *AdminAPI) handlePostUsers(w http.ResponseWriter, r *http.Request, auth userapi.Authenticated) error {
+	var req createUserRequest
+	if err := httputil.DecodeJSON(w, r, &req); err != nil {
+		return err
+	}
+	if req.Username == "" {
+		return httputil.MissingParam("username is required")
+	}
+	if req.Password == "" {
+		return httputil.MissingParam("password is required")
+	}
+	if len(req.Password) > userapi.MaxPasswordLength {
+		return httputil.NewError(http.StatusBadRequest, httputil.ErrCodeWeakPassword,
+			"Password must be at most %d bytes", userapi.MaxPasswordLength)
+	}
+
+	account, err := a.users.CreateAccount(r.Context(), userapi.NewAccountRequest{
+		Localpart:   req.Username,
+		Password:    req.Password,
+		DisplayName: req.DisplayName,
+		Admin:       req.Admin,
+	})
+	switch {
+	case errors.Is(err, userapi.ErrUserExists):
+		return httputil.UserInUse()
+	case errors.Is(err, userapi.ErrInvalidLocalpart):
+		return httputil.InvalidUsername("%s", err.Error())
+	case err != nil:
+		return err
+	}
+
+	a.log.Info("account created through the admin API",
+		"user_id", a.users.UserID(account.Localpart), "admin", account.Admin, "by", auth.UserID)
+
+	httputil.WriteJSON(w, http.StatusCreated, adminUser{
+		UserID:      a.users.UserID(account.Localpart),
+		DisplayName: account.DisplayName,
+		Admin:       account.Admin,
+		CreatedAtMS: account.CreatedAtMS,
+	})
+	return nil
+}
+
+// intParam parses an optional integer query parameter.
+func intParam(raw string, fallback int) (int, error) {
+	if raw == "" {
+		return fallback, nil
+	}
+	return strconv.Atoi(raw)
+}