Phase 1: accounts and sessions

Implements PLAN.md Phase 1. A client can now register, log in, manage its
devices and set its profile; an operator can create accounts and flip the
runtime switches. There are still no rooms and no real /sync.

userapi: accounts, argon2id passwords in PHC format, devices, access and
refresh tokens stored as SHA-256 hashes, account data and the admin flag.
Its storage interface is storage.UserStore, implemented once in sqlstore
with `?` placeholders; the postgres driver supplies a rebind function and
unique-violation recognition rather than keeping a second copy of thirty
statements. Timestamps in these tables are int64 milliseconds, the unit the
Client-Server API uses on the wire.

Client-Server API: register (user-interactive auth with m.login.dummy and
optional registration tokens), register/available, token validity, login
with m.login.password, logout, logout/all, refresh, account/whoami,
capabilities, devices/* with password-gated deletion, profile/*, global and
per-room account data.

GET /sync is a deliberate placeholder: it answers a valid token with an
empty but well-formed response and refuses a revoked one. Phase 1 has no
rooms, so that is the whole truth, and it is what makes session revocation
observable. Phase 4 replaces it with the syncapi.

Auth middleware resolves a bearer token (header or the legacy query
parameter) to a device and user, answering an expired token with the soft
logout the spec asks for. Rate limiting is a token bucket per endpoint class
keyed on the client address, returning M_LIMIT_EXCEEDED with retry_after_ms.

adminapi v1 under /_warp/admin/v1: admin-only auth via a normal Matrix
token, GET/PUT /federation and /registration driving internal/settings and
reporting a config-pinned switch as a 409, GET/POST /users, GET /stats.

warp create-account [--admin] creates the first account straight in the
database, so a new install with registration off has a way in.

Complement is wired up for the federation=off profile: an image meeting its
contract, an entrypoint that configures Warp entirely from WARP_*
variables, and a runner that builds, clones and executes the target set
(TestRegistration, TestLogin, TestDeviceManagement). It has not been run
yet -- there is no container runtime on the development machine -- so the
three tests' assertions were read from the Complement sources and pinned as
httptest tests instead, and CI gained a job that runs the real thing.

Also fixes a .gitignore bug from Phase 0: the unanchored `warp` pattern,
meant for the built binary, also matched the directory server/cmd/warp and
silently excluded the entire command package from the repository. The
binary patterns are now anchored to the repository root, and cmd/warp is
committed for the first time.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/internal/clientapi/auth.go

@@ -0,0 +1,101 @@
+package clientapi
+
+import (
+	"errors"
+	"net/http"
+	"strings"
+
+	"github.com/dariuszjaniak/warp/server/internal/httputil"
+	"github.com/dariuszjaniak/warp/server/internal/userapi"
+)
+
+// AuthedHandler is a handler that needs an authenticated user. The identity
+// is passed in rather than hidden in the request context, so a handler
+// cannot forget to check it and the compiler says which endpoints are
+// protected.
+type AuthedHandler func(w http.ResponseWriter, r *http.Request, auth userapi.Authenticated) error
+
+// withAuth resolves the access token before calling h.
+func (c *ClientAPI) withAuth(h AuthedHandler) httputil.Handler {
+	return func(w http.ResponseWriter, r *http.Request) error {
+		auth, err := c.authenticate(r)
+		if err != nil {
+			return err
+		}
+		c.users.RecordActivity(r.Context(), auth, c.clientIP(r), r.UserAgent())
+		return h(w, r, auth)
+	}
+}
+
+// authenticate turns a request's access token into an identity.
+func (c *ClientAPI) authenticate(r *http.Request) (userapi.Authenticated, error) {
+	token := accessTokenFrom(r)
+	if token == "" {
+		return userapi.Authenticated{}, httputil.MissingToken()
+	}
+
+	auth, err := c.users.Authenticate(r.Context(), token)
+	switch {
+	case err == nil:
+		return auth, nil
+	case errors.Is(err, userapi.ErrNoSuchToken):
+		return userapi.Authenticated{}, httputil.UnknownToken(false)
+	case errors.Is(err, userapi.ErrTokenExpired):
+		// A soft logout keeps the client's encryption state: the token
+		// aged out, the device is still real, and logging in again
+		// restores the session rather than replacing it.
+		return userapi.Authenticated{}, httputil.UnknownToken(true)
+	case errors.Is(err, userapi.ErrAccountDeactivated):
+		return userapi.Authenticated{}, httputil.UserDeactivated()
+	default:
+		return userapi.Authenticated{}, err
+	}
+}
+
+// accessTokenFrom extracts the access token from a request.
+//
+// The Authorization header is the only form the current spec defines, but
+// the ?access_token= query parameter is still what media URLs embedded in
+// web clients and a long tail of older clients use, so both are accepted.
+func accessTokenFrom(r *http.Request) string {
+	if header := r.Header.Get("Authorization"); header != "" {
+		if token, ok := bearerToken(header); ok {
+			return token
+		}
+		// A malformed Authorization header is not a reason to fall through
+		// to the query string: that would let a broken header hide a
+		// working token and make the failure hard to see.
+		return ""
+	}
+	return r.URL.Query().Get("access_token")
+}
+
+// bearerToken parses "Bearer <token>", case-insensitively on the scheme.
+func bearerToken(header string) (string, bool) {
+	scheme, token, found := strings.Cut(header, " ")
+	if !found || !strings.EqualFold(scheme, "Bearer") {
+		return "", false
+	}
+	token = strings.TrimSpace(token)
+	return token, token != ""
+}
+
+// requireSelf checks that the user ID in a path belongs to the requester.
+//
+// Several endpoints are addressed by user ID even though they only ever
+// operate on the caller's own data. The spec's answer for someone else's is
+// M_FORBIDDEN; admins are allowed through, which is what makes the admin
+// panel able to fix up a user's profile.
+func (c *ClientAPI) requireSelf(auth userapi.Authenticated, pathUserID string) (string, error) {
+	localpart, err := c.users.ParseLocalUserID(pathUserID)
+	switch {
+	case errors.Is(err, userapi.ErrForeignServer):
+		return "", httputil.Forbidden("Cannot change data belonging to another server")
+	case err != nil:
+		return "", httputil.InvalidParam("%s is not a valid user ID", pathUserID)
+	}
+	if localpart != auth.Localpart && !auth.Admin {
+		return "", httputil.Forbidden("Cannot change the data of another user")
+	}
+	return localpart, nil
+}