feat: complete SyncServer implementation

Full-stack Go monolith with embedded React frontend for orchestrating rsync-over-SSH file synchronization with Wake-on-LAN support. Features: - JWT auth (HS256) with bcrypt password hashing - CRUD for machines (with WoL config) and sync_pairs - Ed25519 SSH key generation and known_hosts management - WoL magic packet sender + TCP-connect waiter with backoff - Sync engine: rsync subprocess, per-pair job queue, progress parsing - Homebrew cron parser for scheduled syncs - SSE stream for live job status (queued/waking_up/running/success/failed) - React+TS+Vite+Tailwind SPA embedded via embed.FS - Debian packaging with systemd unit, postinst/prerm/postrm Tech stack: - Go 1.22+ (CGO_ENABLED=0, pure SQLite via modernc.org/sqlite) - chi router for HTTP API - TypeScript + React 18 + Tailwind CSS frontend - Cross-compiled to Linux amd64 for Proxmox LXC deployment Tests: wol (MAC parsing, magic packet), syncengine/queue, scheduler/cron
2026-07-07 15:03:22 -04:00
parent 1a66ac58cd
commit 8e08c73f60
69 changed files with 7949 additions and 152 deletions
@@ -0,0 +1,40 @@
+package auth
+
+import (
+	"net/http"
+	"time"
+)
+
+const CookieName = "ss_token"
+
+func SetAuthCookie(w http.ResponseWriter, token string, expiresAt time.Time) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     CookieName,
+		Value:    token,
+		Path:     "/",
+		Expires:  expiresAt,
+		HttpOnly: true,
+		Secure:   false,
+		SameSite: http.SameSiteStrictMode,
+	})
+}
+
+func ClearAuthCookie(w http.ResponseWriter) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     CookieName,
+		Value:    "",
+		Path:     "/",
+		Expires:  time.Unix(0, 0),
+		HttpOnly: true,
+		Secure:   false,
+		SameSite: http.SameSiteStrictMode,
+	})
+}
+
+func GetTokenFromRequest(r *http.Request) string {
+	cookie, err := r.Cookie(CookieName)
+	if err != nil {
+		return ""
+	}
+	return cookie.Value
+}
@@ -0,0 +1,69 @@
+package auth
+
+import (
+	"errors"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+var (
+	ErrInvalidToken = errors.New("invalid token")
+	ErrExpiredToken = errors.New("token expired")
+)
+
+type Claims struct {
+	UserID   int64  `json:"user_id"`
+	Username string `json:"username"`
+	Role     string `json:"role"`
+	jwt.RegisteredClaims
+}
+
+type JWTManager struct {
+	secret     []byte
+	expiryH    int
+}
+
+func NewJWTManager(secret string, expiryH int) *JWTManager {
+	return &JWTManager{
+		secret:  []byte(secret),
+		expiryH: expiryH,
+	}
+}
+
+func (m *JWTManager) Generate(userID int64, username, role string) (string, time.Time, error) {
+	expiresAt := time.Now().Add(time.Duration(m.expiryH) * time.Hour)
+	claims := &Claims{
+		UserID:   userID,
+		Username: username,
+		Role:     role,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(expiresAt),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+			NotBefore: jwt.NewNumericDate(time.Now()),
+		},
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	signed, err := token.SignedString(m.secret)
+	return signed, expiresAt, err
+}
+
+func (m *JWTManager) Validate(tokenStr string) (*Claims, error) {
+	token, err := jwt.ParseWithClaims(tokenStr, &Claims{}, func(token *jwt.Token) (interface{}, error) {
+		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, ErrInvalidToken
+		}
+		return m.secret, nil
+	})
+	if err != nil {
+		if errors.Is(err, jwt.ErrTokenExpired) {
+			return nil, ErrExpiredToken
+		}
+		return nil, ErrInvalidToken
+	}
+	claims, ok := token.Claims.(*Claims)
+	if !ok || !token.Valid {
+		return nil, ErrInvalidToken
+	}
+	return claims, nil
+}
@@ -0,0 +1,61 @@
+package auth
+
+import (
+	"context"
+	"net/http"
+)
+
+type ctxKey string
+
+const ClaimsCtxKey ctxKey = "claims"
+
+type contextKey struct{}
+
+func RequireAuth(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		token := GetTokenFromRequest(r)
+		if token == "" {
+			http.Error(w, `{"error":"unauthorized"}`, http.StatusUnauthorized)
+			return
+		}
+
+		claims, err := GlobalJWTManager.Validate(token)
+		if err != nil {
+			http.Error(w, `{"error":"unauthorized"}`, http.StatusUnauthorized)
+			return
+		}
+
+		ctx := r.Context()
+		ctx = context.WithValue(ctx, ClaimsCtxKey, claims)
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+func RequireAdmin(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		claims := GetClaims(r.Context())
+		if claims == nil || claims.Role != "admin" {
+			http.Error(w, `{"error":"forbidden"}`, http.StatusForbidden)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+func GetClaims(ctx context.Context) *Claims {
+	v := ctx.Value(ClaimsCtxKey)
+	if v == nil {
+		return nil
+	}
+	return v.(*Claims)
+}
+
+var GlobalJWTManager *JWTManager
+
+func InitJWTManager(secret string, expiryH int) {
+	GlobalJWTManager = NewJWTManager(secret, expiryH)
+}
+
+func GetJWTManager() *JWTManager {
+	return GlobalJWTManager
+}
@@ -0,0 +1,16 @@
+package auth
+
+import (
+	"golang.org/x/crypto/bcrypt"
+)
+
+var bcryptCost = bcrypt.DefaultCost
+
+func HashPassword(plain string) ([]byte, error) {
+	return bcrypt.GenerateFromPassword([]byte(plain), bcryptCost)
+}
+
+func VerifyPassword(hash []byte, plain string) bool {
+	err := bcrypt.CompareHashAndPassword(hash, []byte(plain))
+	return err == nil
+}
@@ -0,0 +1,37 @@
+package auth
+
+import (
+	"database/sql"
+	"log/slog"
+)
+
+func SeedAdmin(db *sql.DB, username, password string) error {
+	if username == "" || password == "" {
+		return nil
+	}
+
+	var exists bool
+	err := db.QueryRow("SELECT EXISTS(SELECT 1 FROM users WHERE username = ?)", username).Scan(&exists)
+	if err != nil {
+		return err
+	}
+	if exists {
+		return nil
+	}
+
+	hash, err := HashPassword(password)
+	if err != nil {
+		return err
+	}
+
+	_, err = db.Exec(
+		"INSERT INTO users (username, password_hash, role) VALUES (?, ?, ?)",
+		username, string(hash), "admin",
+	)
+	if err != nil {
+		return err
+	}
+
+	slog.Info("admin user created", "username", username)
+	return nil
+}