feat: password-gated web UI on the same backend (#1)

Adds a password-gated browser UI for the bookmark list, served by the same Go binary and container as the userscript API. ## What - `GET /` — list page, or the login page when there is no session (200, no redirect). - `POST /login`, `POST /logout` — stateless HMAC session cookie, 60-day Max-Age. - `GET /ui/list?tab=all|fav`, `POST /ui/bookmarks/{key}/favorite`, `POST /ui/bookmarks/{key}/chapter`, `DELETE /ui/bookmarks/{key}` — htmx fragments. - `GET /static/*` — embedded `style.css`, `htmx.min.js`, `filter.js`. Mobile-first dark CSS, 2–3 column grid at ≥900px, "Continue reading" strip of the five most recent series, NEW badge, client-side title search, no build step. ## Stack Go `html/template` + htmx 2.0.4 (vendored, 50 KB) + plain CSS. No npm, no bundler. Templates and assets are `go:embed`-ed, so `CGO_ENABLED=0` and the distroless image still hold. ## Auth `WEB_PASSWORD` gates the UI; unset means the web routes are never registered and `/` returns 404. Session cookie is `HttpOnly`, `SameSite=Lax`, `Secure` when the request is HTTPS. The signing key derives from `API_TOKEN` + `WEB_PASSWORD`, so rotating either logs every browser out. Login is rate-limited to 10 failures per 20 minutes per client IP, keyed on the **rightmost** `X-Forwarded-For` entry (Traefik appends the observed peer, so the leftmost is client-spoofable). CGNAT lockout is a known, accepted limitation — the window self-heals. ## Invariants preserved - A session cookie never authenticates `/bookmarks*`. That API stays JSON + bearer token, unchanged, as does the userscript. - `Store.Upsert` is byte-for-byte unmodified. Every UI write goes read-modify-write through the new `Store.Get`, so the conditional-`updated_at` rule (favouriting must not reorder the list, a chapter override must) lives in exactly one function. ## Deployment `docker-compose.prod.yml` gains a second Traefik router on `MANGA_WEB_HOST` pointing at the same service — one container, one certificate resolver, no second service. Both `MANGA_API_HOST` and `MANGA_WEB_HOST` are required (`:?`), with no example fallback in `.env.example`: a placeholder there would make Traefik silently publish the UI on a domain you do not own. Needs a DNS A/AAAA record for `manga.<domain>`. See `DEPLOY.md` §1b. ## Docs - Design: `docs/superpowers/specs/2026-07-25-web-ui-design.md` - Plan: `plans/2026-07-25-web-ui-implementation-plan.md` ## Verification `gofmt` clean, `go vet`, `go test -race ./...`, `CGO_ENABLED=0 go build`, a real `docker build` + curl smoke test, and a Playwright pass covering login reject/accept, favourite-without-reorder, chapter edit, delete-with-confirm, search, tab switch + back button, 390px with no horizontal overflow, and zero JS console errors. Reviewed-on: #1 Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com> Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>
2026-07-26 03:59:58 +07:00
parent c2914d0b5a
commit ebc7a546c5
24 changed files with 4446 additions and 7 deletions
@@ -0,0 +1,232 @@
+package main
+
+import (
+	"crypto/tls"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestSessionRoundTrip(t *testing.T) {
+	key := sessionKey("token-abc", "pw-abc")
+	now := time.Now().UnixMilli()
+	value := signSession(key, now+60_000)
+	if !verifySession(key, value, now) {
+		t.Fatal("verifySession = false for a freshly signed cookie, want true")
+	}
+}
+
+func TestSessionRejects(t *testing.T) {
+	key := sessionKey("token-abc", "pw-abc")
+	now := time.Now().UnixMilli()
+	valid := signSession(key, now+60_000)
+	payload, sig, _ := strings.Cut(valid, ".")
+
+	cases := []struct {
+		name  string
+		value string
+	}{
+		{"empty", ""},
+		{"no separator", payload + sig},
+		{"unparseable expiry", "notanumber." + sig},
+		{"expired", signSession(key, now-1)},
+		{"tampered signature", payload + "." + flipLastChar(sig)},
+		{"tampered expiry", "99999999999999." + sig},
+		{"signed with another key", signSession(sessionKey("other-token", "pw-abc"), now+60_000)},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if verifySession(key, tc.value, now) {
+				t.Fatalf("verifySession(%q) = true, want false", tc.value)
+			}
+		})
+	}
+}
+
+func flipLastChar(s string) string {
+	if s == "" {
+		return "x"
+	}
+	last := s[len(s)-1]
+	if last == 'A' {
+		return s[:len(s)-1] + "B"
+	}
+	return s[:len(s)-1] + "A"
+}
+
+func TestSessionKeyDependsOnToken(t *testing.T) {
+	a := sessionKey("token-a", "pw-abc")
+	b := sessionKey("token-b", "pw-abc")
+	if string(a) == string(b) {
+		t.Fatal("sessionKey collided for different API tokens")
+	}
+}
+
+func TestSessionKeyDependsOnWebPassword(t *testing.T) {
+	a := sessionKey("token-abc", "pw-a")
+	b := sessionKey("token-abc", "pw-b")
+	if string(a) == string(b) {
+		t.Fatal("sessionKey collided for different web passwords with the same API token")
+	}
+}
+
+func TestSetSessionCookieAttributes(t *testing.T) {
+	cases := []struct {
+		name       string
+		tls        bool
+		forwarded  string
+		wantSecure bool
+	}{
+		{"plain http dev", false, "", false},
+		{"direct tls", true, "", true},
+		{"behind https proxy", false, "https", true},
+		{"behind http proxy", false, "http", false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodPost, "/login", nil)
+			if tc.tls {
+				r.TLS = &tls.ConnectionState{}
+			}
+			if tc.forwarded != "" {
+				r.Header.Set("X-Forwarded-Proto", tc.forwarded)
+			}
+			rr := httptest.NewRecorder()
+			setSessionCookie(rr, r, sessionKey("token-abc", "pw-abc"))
+
+			cookies := rr.Result().Cookies()
+			if len(cookies) != 1 {
+				t.Fatalf("got %d cookies, want 1", len(cookies))
+			}
+			c := cookies[0]
+			if c.Name != sessionCookieName {
+				t.Fatalf("cookie name = %q, want %q", c.Name, sessionCookieName)
+			}
+			if !c.HttpOnly {
+				t.Fatal("cookie HttpOnly = false, want true")
+			}
+			if c.SameSite != http.SameSiteLaxMode {
+				t.Fatalf("cookie SameSite = %v, want Lax", c.SameSite)
+			}
+			if c.Path != "/" {
+				t.Fatalf("cookie Path = %q, want /", c.Path)
+			}
+			if c.Secure != tc.wantSecure {
+				t.Fatalf("cookie Secure = %v, want %v", c.Secure, tc.wantSecure)
+			}
+			if c.MaxAge != int(sessionTTL/time.Second) {
+				t.Fatalf("cookie MaxAge = %d, want %d", c.MaxAge, int(sessionTTL/time.Second))
+			}
+		})
+	}
+}
+
+func TestClearSessionCookie(t *testing.T) {
+	r := httptest.NewRequest(http.MethodPost, "/logout", nil)
+	rr := httptest.NewRecorder()
+	clearSessionCookie(rr, r)
+
+	cookies := rr.Result().Cookies()
+	if len(cookies) != 1 {
+		t.Fatalf("got %d cookies, want 1", len(cookies))
+	}
+	if cookies[0].MaxAge >= 0 {
+		t.Fatalf("cleared cookie MaxAge = %d, want negative", cookies[0].MaxAge)
+	}
+}
+
+func TestClientIP(t *testing.T) {
+	cases := []struct {
+		name       string
+		remoteAddr string
+		xff        []string
+		want       string
+	}{
+		{"no header falls back to remote addr", "203.0.113.9:5555", nil, "203.0.113.9"},
+		{"single proxy hop", "10.0.0.1:5555", []string{"203.0.113.9"}, "203.0.113.9"},
+		{
+			// The client sent "1.2.3.4" itself; Traefik appended the address it
+			// actually saw. Only the rightmost entry is trustworthy.
+			name:       "spoofed left entry is ignored",
+			remoteAddr: "10.0.0.1:5555",
+			xff:        []string{"1.2.3.4, 203.0.113.9"},
+			want:       "203.0.113.9",
+		},
+		{
+			name:       "spoofed separate header line is ignored",
+			remoteAddr: "10.0.0.1:5555",
+			xff:        []string{"1.2.3.4", "203.0.113.9"},
+			want:       "203.0.113.9",
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodPost, "/login", nil)
+			r.RemoteAddr = tc.remoteAddr
+			for _, v := range tc.xff {
+				r.Header.Add("X-Forwarded-For", v)
+			}
+			if got := clientIP(r); got != tc.want {
+				t.Fatalf("clientIP() = %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestLoginLimiterBlocksAfterMaxFailures(t *testing.T) {
+	l := newLoginLimiter()
+	now := time.Now()
+	for i := 0; i < loginMaxFailures; i++ {
+		if wait := l.retryAfter("1.2.3.4", now); wait != 0 {
+			t.Fatalf("blocked after %d failures, want block only after %d", i, loginMaxFailures)
+		}
+		l.fail("1.2.3.4", now)
+	}
+	wait := l.retryAfter("1.2.3.4", now)
+	if wait <= 0 {
+		t.Fatalf("retryAfter = %v after %d failures, want > 0", wait, loginMaxFailures)
+	}
+	if wait > loginWindow {
+		t.Fatalf("retryAfter = %v, want <= %v", wait, loginWindow)
+	}
+}
+
+func TestLoginLimiterWindowExpires(t *testing.T) {
+	l := newLoginLimiter()
+	start := time.Now()
+	for i := 0; i < loginMaxFailures; i++ {
+		l.fail("1.2.3.4", start)
+	}
+	if l.retryAfter("1.2.3.4", start) == 0 {
+		t.Fatal("expected block immediately after the failures")
+	}
+	later := start.Add(loginWindow + time.Second)
+	if wait := l.retryAfter("1.2.3.4", later); wait != 0 {
+		t.Fatalf("retryAfter = %v once the window passed, want 0", wait)
+	}
+}
+
+func TestLoginLimiterResetClearsCounter(t *testing.T) {
+	l := newLoginLimiter()
+	now := time.Now()
+	for i := 0; i < loginMaxFailures; i++ {
+		l.fail("1.2.3.4", now)
+	}
+	l.reset("1.2.3.4")
+	if wait := l.retryAfter("1.2.3.4", now); wait != 0 {
+		t.Fatalf("retryAfter = %v after reset, want 0", wait)
+	}
+}
+
+func TestLoginLimiterIsPerIP(t *testing.T) {
+	l := newLoginLimiter()
+	now := time.Now()
+	for i := 0; i < loginMaxFailures; i++ {
+		l.fail("1.2.3.4", now)
+	}
+	if wait := l.retryAfter("5.6.7.8", now); wait != 0 {
+		t.Fatalf("retryAfter for a different IP = %v, want 0", wait)
+	}
+}