Phase 1: accounts and sessions

Implements PLAN.md Phase 1. A client can now register, log in, manage its
devices and set its profile; an operator can create accounts and flip the
runtime switches. There are still no rooms and no real /sync.

userapi: accounts, argon2id passwords in PHC format, devices, access and
refresh tokens stored as SHA-256 hashes, account data and the admin flag.
Its storage interface is storage.UserStore, implemented once in sqlstore
with `?` placeholders; the postgres driver supplies a rebind function and
unique-violation recognition rather than keeping a second copy of thirty
statements. Timestamps in these tables are int64 milliseconds, the unit the
Client-Server API uses on the wire.

Client-Server API: register (user-interactive auth with m.login.dummy and
optional registration tokens), register/available, token validity, login
with m.login.password, logout, logout/all, refresh, account/whoami,
capabilities, devices/* with password-gated deletion, profile/*, global and
per-room account data.

GET /sync is a deliberate placeholder: it answers a valid token with an
empty but well-formed response and refuses a revoked one. Phase 1 has no
rooms, so that is the whole truth, and it is what makes session revocation
observable. Phase 4 replaces it with the syncapi.

Auth middleware resolves a bearer token (header or the legacy query
parameter) to a device and user, answering an expired token with the soft
logout the spec asks for. Rate limiting is a token bucket per endpoint class
keyed on the client address, returning M_LIMIT_EXCEEDED with retry_after_ms.

adminapi v1 under /_warp/admin/v1: admin-only auth via a normal Matrix
token, GET/PUT /federation and /registration driving internal/settings and
reporting a config-pinned switch as a 409, GET/POST /users, GET /stats.

warp create-account [--admin] creates the first account straight in the
database, so a new install with registration off has a way in.

Complement is wired up for the federation=off profile: an image meeting its
contract, an entrypoint that configures Warp entirely from WARP_*
variables, and a runner that builds, clones and executes the target set
(TestRegistration, TestLogin, TestDeviceManagement). It has not been run
yet -- there is no container runtime on the development machine -- so the
three tests' assertions were read from the Complement sources and pinned as
httptest tests instead, and CI gained a job that runs the real thing.

Also fixes a .gitignore bug from Phase 0: the unanchored `warp` pattern,
meant for the built binary, also matched the directory server/cmd/warp and
silently excluded the entire command package from the repository. The
binary patterns are now anchored to the repository root, and cmd/warp is
committed for the first time.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/internal/clientapi/register_test.go

@@ -0,0 +1,391 @@
+package clientapi_test
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/dariuszjaniak/warp/server/internal/clientapi"
+	"github.com/dariuszjaniak/warp/server/internal/config"
+)
+
+const registerPath = "/_matrix/client/v3/register"
+
+// TestRegisterReturnsFlows covers the first half of the registration
+// handshake: an empty body gets the flows and a session, not a complaint
+// about the missing password.
+func TestRegisterReturnsFlows(t *testing.T) {
+	ts := newTestServer(t, nil)
+
+	rec := ts.do(request{method: http.MethodPost, path: registerPath, body: map[string]any{}})
+	expectStatus(t, rec, http.StatusUnauthorized)
+	if ct := rec.Header().Get("Content-Type"); ct != "application/json" {
+		t.Errorf("Content-Type = %q, want application/json", ct)
+	}
+
+	body := jsonBody(t, rec)
+	if _, ok := body["session"].(string); !ok {
+		t.Error("the challenge must carry a session")
+	}
+	if _, ok := body["params"].(map[string]any); !ok {
+		t.Error("the challenge must carry a params object, even an empty one")
+	}
+	flows, ok := body["flows"].([]any)
+	if !ok || len(flows) == 0 {
+		t.Fatalf("flows = %v, want a non-empty array", body["flows"])
+	}
+	for _, flow := range flows {
+		stages, ok := flow.(map[string]any)["stages"].([]any)
+		if !ok || len(stages) == 0 {
+			t.Fatalf("every flow needs a non-empty stages array, got %v", flow)
+		}
+		if stages[0] != "m.login.dummy" {
+			t.Errorf("first stage = %v, want m.login.dummy", stages[0])
+		}
+	}
+}
+
+func TestRegisterCreatesAccount(t *testing.T) {
+	ts := newTestServer(t, nil)
+	acc := ts.register("alice", "sUp3rs3kr1t")
+
+	if acc.UserID != "@alice:warp.example" {
+		t.Errorf("user_id = %q, want @alice:warp.example", acc.UserID)
+	}
+
+	// The token works straight away: a registration that needs a separate
+	// login is a registration that half worked.
+	rec := ts.get("/_matrix/client/v3/account/whoami", acc.AccessToken)
+	expectStatus(t, rec, http.StatusOK)
+	if got := jsonBody(t, rec)["user_id"]; got != acc.UserID {
+		t.Errorf("whoami = %v, want %s", got, acc.UserID)
+	}
+}
+
+// TestRegisterDowncasesUsername pins the behaviour clients rely on: a
+// localpart is lowercase, so a capital in the request is normalised rather
+// than rejected.
+func TestRegisterDowncasesUsername(t *testing.T) {
+	ts := newTestServer(t, nil)
+	acc := ts.register("user-UPPER", "sUp3rs3kr1t")
+
+	if acc.UserID != "@user-upper:warp.example" {
+		t.Errorf("user_id = %q, want @user-upper:warp.example", acc.UserID)
+	}
+}
+
+func TestRegisterHonoursRequestedDeviceID(t *testing.T) {
+	ts := newTestServer(t, nil)
+
+	rec := ts.do(request{method: http.MethodPost, path: registerPath,
+		body: map[string]any{"username": "alice", "password": "sUp3rs3kr1t"}})
+	session := jsonBody(t, rec)["session"]
+
+	rec = ts.do(request{method: http.MethodPost, path: registerPath, body: map[string]any{
+		"username":                    "alice",
+		"password":                    "sUp3rs3kr1t",
+		"device_id":                   "my_device_id",
+		"initial_device_display_name": "a phone",
+		"auth":                        map[string]any{"type": "m.login.dummy", "session": session},
+	}})
+	expectStatus(t, rec, http.StatusOK)
+	if got := jsonBody(t, rec)["device_id"]; got != "my_device_id" {
+		t.Errorf("device_id = %v, want my_device_id", got)
+	}
+}
+
+// TestRegisterRejectsBadUsernamesBeforeUIA is the half of the ordering that
+// is easy to get wrong: a username that can never work is rejected with a
+// 400 straight away, rather than after the client has completed a flow.
+func TestRegisterRejectsBadUsernamesBeforeUIA(t *testing.T) {
+	ts := newTestServer(t, nil)
+
+	for _, ch := range []string{"!", `"`, ":", "?", `\`, "@", "[", "]", "{", "|", "}", "£", "é", "\n", "'", ","} {
+		rec := ts.do(request{method: http.MethodPost, path: registerPath,
+			body: map[string]any{"username": "user-" + ch + "-reject", "password": "sUp3rs3kr1t"}})
+		expectError(t, rec, http.StatusBadRequest, "M_INVALID_USERNAME")
+	}
+
+	// The characters the spec does allow must still get through.
+	for _, ch := range []string{"q", "3", ".", "_", "=", "-", "/", "+"} {
+		ts.register("chrtest"+ch, "sUp3rs3kr1t")
+	}
+}
+
+func TestRegisterRejectsOverlongUsername(t *testing.T) {
+	ts := newTestServer(t, nil)
+
+	rec := ts.do(request{method: http.MethodPost, path: registerPath, body: map[string]any{
+		"username": strings.Repeat("a", 256),
+		"password": "sUp3rs3kr1t",
+	}})
+	expectError(t, rec, http.StatusBadRequest, "M_INVALID_USERNAME")
+}
+
+// TestRegisterRejectsTakenUsernameBeforeUIA is the other half: the name is
+// checked before the challenge, so a client is not asked to authenticate
+// only to be told the name was gone all along.
+func TestRegisterRejectsTakenUsernameBeforeUIA(t *testing.T) {
+	ts := newTestServer(t, nil)
+	ts.register("alice", "sUp3rs3kr1t")
+
+	rec := ts.do(request{method: http.MethodPost, path: registerPath,
+		body: map[string]any{"username": "alice", "password": "sUp3rs3kr1t"}})
+	expectError(t, rec, http.StatusBadRequest, "M_USER_IN_USE")
+
+	// Capitalisation does not get around it, because the name is
+	// normalised first.
+	rec = ts.do(request{method: http.MethodPost, path: registerPath,
+		body: map[string]any{"username": "ALICE", "password": "sUp3rs3kr1t"}})
+	expectError(t, rec, http.StatusBadRequest, "M_USER_IN_USE")
+}
+
+// TestRegisterRequiresTheSession covers the rule that makes the flow a flow:
+// an `auth` without the session the server handed out starts again rather
+// than completing.
+func TestRegisterRequiresTheSession(t *testing.T) {
+	ts := newTestServer(t, nil)
+
+	rec := ts.do(request{method: http.MethodPost, path: registerPath, body: map[string]any{
+		"username": "alice",
+		"password": "sUp3rs3kr1t",
+		"auth":     map[string]any{"type": "m.login.dummy"},
+	}})
+	expectStatus(t, rec, http.StatusUnauthorized)
+
+	// An unknown session is treated the same way, with a fresh one offered.
+	rec = ts.do(request{method: http.MethodPost, path: registerPath, body: map[string]any{
+		"username": "alice",
+		"password": "sUp3rs3kr1t",
+		"auth":     map[string]any{"type": "m.login.dummy", "session": "not-a-session"},
+	}})
+	expectStatus(t, rec, http.StatusUnauthorized)
+	if _, ok := jsonBody(t, rec)["session"].(string); !ok {
+		t.Error("a rejected session must come with a new one to try")
+	}
+}
+
+func TestRegisterRejectsUnknownStage(t *testing.T) {
+	ts := newTestServer(t, nil)
+
+	rec := ts.do(request{method: http.MethodPost, path: registerPath,
+		body: map[string]any{"username": "alice", "password": "sUp3rs3kr1t"}})
+	session := jsonBody(t, rec)["session"]
+
+	rec = ts.do(request{method: http.MethodPost, path: registerPath, body: map[string]any{
+		"username": "alice",
+		"password": "sUp3rs3kr1t",
+		"auth":     map[string]any{"type": "m.login.recaptcha", "session": session},
+	}})
+	expectError(t, rec, http.StatusBadRequest, "M_UNRECOGNIZED")
+}
+
+func TestRegisterRequiresPasswordAfterUIA(t *testing.T) {
+	ts := newTestServer(t, nil)
+
+	rec := ts.do(request{method: http.MethodPost, path: registerPath,
+		body: map[string]any{"username": "alice"}})
+	expectStatus(t, rec, http.StatusUnauthorized)
+	session := jsonBody(t, rec)["session"]
+
+	rec = ts.do(request{method: http.MethodPost, path: registerPath, body: map[string]any{
+		"username": "alice",
+		"auth":     map[string]any{"type": "m.login.dummy", "session": session},
+	}})
+	expectError(t, rec, http.StatusBadRequest, "M_MISSING_PARAM")
+}
+
+func TestRegisterInhibitLogin(t *testing.T) {
+	ts := newTestServer(t, nil)
+
+	rec := ts.do(request{method: http.MethodPost, path: registerPath,
+		body: map[string]any{"username": "alice", "password": "sUp3rs3kr1t"}})
+	session := jsonBody(t, rec)["session"]
+
+	rec = ts.do(request{method: http.MethodPost, path: registerPath, body: map[string]any{
+		"username":      "alice",
+		"password":      "sUp3rs3kr1t",
+		"inhibit_login": true,
+		"auth":          map[string]any{"type": "m.login.dummy", "session": session},
+	}})
+	expectStatus(t, rec, http.StatusOK)
+
+	body := jsonBody(t, rec)
+	if body["user_id"] != "@alice:warp.example" {
+		t.Errorf("user_id = %v", body["user_id"])
+	}
+	for _, field := range []string{"access_token", "device_id"} {
+		if _, present := body[field]; present {
+			t.Errorf("inhibit_login must suppress %s", field)
+		}
+	}
+}
+
+// TestRegisterGeneratesUsername covers the case where the client leaves the
+// choice of name to the server.
+func TestRegisterGeneratesUsername(t *testing.T) {
+	ts := newTestServer(t, nil)
+
+	rec := ts.do(request{method: http.MethodPost, path: registerPath,
+		body: map[string]any{"password": "sUp3rs3kr1t"}})
+	session := jsonBody(t, rec)["session"]
+
+	rec = ts.do(request{method: http.MethodPost, path: registerPath, body: map[string]any{
+		"password": "sUp3rs3kr1t",
+		"auth":     map[string]any{"type": "m.login.dummy", "session": session},
+	}})
+	expectStatus(t, rec, http.StatusOK)
+
+	userID, _ := jsonBody(t, rec)["user_id"].(string)
+	if !strings.HasPrefix(userID, "@") || !strings.HasSuffix(userID, ":warp.example") {
+		t.Errorf("generated user_id = %q, want @<something>:warp.example", userID)
+	}
+	if len(userID) <= len("@:warp.example") {
+		t.Errorf("generated user_id %q has an empty localpart", userID)
+	}
+}
+
+func TestRegisterSessionIsSpentOnce(t *testing.T) {
+	ts := newTestServer(t, nil)
+
+	rec := ts.do(request{method: http.MethodPost, path: registerPath,
+		body: map[string]any{"username": "alice", "password": "sUp3rs3kr1t"}})
+	session := jsonBody(t, rec)["session"]
+
+	complete := map[string]any{
+		"username": "alice",
+		"password": "sUp3rs3kr1t",
+		"auth":     map[string]any{"type": "m.login.dummy", "session": session},
+	}
+	expectStatus(t, ts.do(request{method: http.MethodPost, path: registerPath, body: complete}), http.StatusOK)
+
+	// Replaying the identical request must not create a second account; the
+	// name is taken now, and the session is gone either way.
+	rec = ts.do(request{method: http.MethodPost, path: registerPath, body: complete})
+	expectError(t, rec, http.StatusBadRequest, "M_USER_IN_USE")
+}
+
+func TestRegisterRespectsTheRegistrationSwitch(t *testing.T) {
+	ts := newTestServer(t, nil)
+	if err := ts.settings.SetRegistrationEnabled(t.Context(), false); err != nil {
+		t.Fatalf("SetRegistrationEnabled: %v", err)
+	}
+
+	rec := ts.do(request{method: http.MethodPost, path: registerPath,
+		body: map[string]any{"username": "alice", "password": "sUp3rs3kr1t"}})
+	expectError(t, rec, http.StatusForbidden, "M_FORBIDDEN")
+
+	// And comes back without a restart, which is the point of the switch.
+	if err := ts.settings.SetRegistrationEnabled(t.Context(), true); err != nil {
+		t.Fatalf("SetRegistrationEnabled: %v", err)
+	}
+	ts.register("alice", "sUp3rs3kr1t")
+}
+
+func TestRegisterRejectsGuests(t *testing.T) {
+	ts := newTestServer(t, nil)
+
+	rec := ts.do(request{method: http.MethodPost, path: registerPath + "?kind=guest",
+		body: map[string]any{}})
+	expectError(t, rec, http.StatusForbidden, "M_FORBIDDEN")
+}
+
+// TestRegisterWithRegistrationToken covers the second stage a server with
+// invite-only sign-up adds to the flow.
+func TestRegisterWithRegistrationToken(t *testing.T) {
+	ts := newTestServer(t, func(o *clientapi.Options) {
+		o.Registration = config.Registration{Enabled: true, Tokens: []string{"let-me-in"}}
+	})
+
+	rec := ts.do(request{method: http.MethodPost, path: registerPath,
+		body: map[string]any{"username": "alice", "password": "sUp3rs3kr1t"}})
+	expectStatus(t, rec, http.StatusUnauthorized)
+
+	body := jsonBody(t, rec)
+	flows, _ := body["flows"].([]any)
+	stages, _ := flows[0].(map[string]any)["stages"].([]any)
+	if len(stages) != 2 || stages[0] != "m.login.registration_token" {
+		t.Fatalf("stages = %v, want the token stage first", stages)
+	}
+	session := body["session"]
+
+	// A wrong token fails the stage: the client gets the error and the
+	// flows together, so it can prompt again without starting over.
+	rec = ts.do(request{method: http.MethodPost, path: registerPath, body: map[string]any{
+		"username": "alice",
+		"password": "sUp3rs3kr1t",
+		"auth": map[string]any{
+			"type": "m.login.registration_token", "session": session, "token": "nope",
+		},
+	}})
+	expectStatus(t, rec, http.StatusUnauthorized)
+	body = jsonBody(t, rec)
+	if body["errcode"] != "M_FORBIDDEN" {
+		t.Errorf("a failed stage must say why, got %s", rec.Body.String())
+	}
+	if body["session"] != session {
+		t.Error("a failed stage must keep the session alive")
+	}
+
+	// The right one advances the flow but does not finish it.
+	rec = ts.do(request{method: http.MethodPost, path: registerPath, body: map[string]any{
+		"username": "alice",
+		"password": "sUp3rs3kr1t",
+		"auth": map[string]any{
+			"type": "m.login.registration_token", "session": session, "token": "let-me-in",
+		},
+	}})
+	expectStatus(t, rec, http.StatusUnauthorized)
+	completed, _ := jsonBody(t, rec)["completed"].([]any)
+	if len(completed) != 1 || completed[0] != "m.login.registration_token" {
+		t.Fatalf("completed = %v, want the token stage", completed)
+	}
+
+	// And the dummy stage completes it.
+	rec = ts.do(request{method: http.MethodPost, path: registerPath, body: map[string]any{
+		"username": "alice",
+		"password": "sUp3rs3kr1t",
+		"auth":     map[string]any{"type": "m.login.dummy", "session": session},
+	}})
+	expectStatus(t, rec, http.StatusOK)
+	if jsonBody(t, rec)["user_id"] != "@alice:warp.example" {
+		t.Errorf("user_id = %v", jsonBody(t, rec)["user_id"])
+	}
+}
+
+func TestRegisterAvailable(t *testing.T) {
+	ts := newTestServer(t, nil)
+	const path = "/_matrix/client/v3/register/available"
+
+	rec := ts.get(path+"?username=free_name", "")
+	expectStatus(t, rec, http.StatusOK)
+	if jsonBody(t, rec)["available"] != true {
+		t.Errorf("available = %v, want true", jsonBody(t, rec)["available"])
+	}
+
+	ts.register("taken", "sUp3rs3kr1t")
+	expectError(t, ts.get(path+"?username=taken", ""), http.StatusBadRequest, "M_USER_IN_USE")
+	expectError(t, ts.get(path+"?username=not,valid", ""), http.StatusBadRequest, "M_INVALID_USERNAME")
+	expectError(t, ts.get(path, ""), http.StatusBadRequest, "M_MISSING_PARAM")
+}
+
+func TestRegistrationTokenValidity(t *testing.T) {
+	ts := newTestServer(t, func(o *clientapi.Options) {
+		o.Registration = config.Registration{Enabled: true, Tokens: []string{"let-me-in"}}
+	})
+	const path = "/_matrix/client/v1/register/m.login.registration_token/validity"
+
+	rec := ts.get(path+"?token=let-me-in", "")
+	expectStatus(t, rec, http.StatusOK)
+	if jsonBody(t, rec)["valid"] != true {
+		t.Errorf("valid = %v, want true", jsonBody(t, rec)["valid"])
+	}
+
+	rec = ts.get(path+"?token=nope", "")
+	expectStatus(t, rec, http.StatusOK)
+	if jsonBody(t, rec)["valid"] != false {
+		t.Errorf("valid = %v, want false", jsonBody(t, rec)["valid"])
+	}
+
+	expectError(t, ts.get(path, ""), http.StatusBadRequest, "M_MISSING_PARAM")
+}