Split backend into internal packages by responsibility

All Go files lived flat in backend/ as one package main. Move store, latest-chapter polling, sessions, HTTP middleware, the JSON API, the userscript handler, and the web UI (with its templates/static assets) into backend/internal/{store,latest,session,httpmw,api,userscript,web}, each with an exported API. main.go becomes the composition root wiring them into newRouter; root-level tests cover the assembled router while package-local tests cover unit behavior. Update Dockerfile/.dockerignore for the new internal/ tree and CLAUDE.md to describe the layout. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-02 19:41:38 +07:00
parent e250762ea6
commit eeb601cbe2
36 changed files with 971 additions and 843 deletions
@@ -0,0 +1,188 @@
+package session
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/base64"
+	"net"
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+)
+
+const (
+	CookieName = "mangabm_session"
+	// 60 days: long enough that a phone stays logged in between reading spells.
+	sessionTTL = 60 * 24 * time.Hour
+	// Domain separation, so the session key can never collide with any other
+	// use of the secrets it is derived from. Changing this string logs
+	// everyone out.
+	sessionKeyPurpose = "mangabm-web-session-v1"
+)
+
+// Key derives the cookie-signing key from both secrets. Sessions are
+// stateless — there is no session table — so rotating either API_TOKEN or
+// WEB_PASSWORD invalidates every outstanding cookie at once. The \x00
+// separator prevents the concatenation ambiguity a bare apiToken+webPassword
+// would have (e.g. "ab"+"c" colliding with "a"+"bc").
+func Key(apiToken, webPassword string) []byte {
+	sum := sha256.Sum256([]byte(apiToken + "\x00" + webPassword + sessionKeyPurpose))
+	return sum[:]
+}
+
+// Sign encodes "<expiryMs>.<base64url HMAC(expiryMs)>".
+func Sign(key []byte, expiryMs int64) string {
+	payload := strconv.FormatInt(expiryMs, 10)
+	return payload + "." + sessionMAC(key, payload)
+}
+
+func sessionMAC(key []byte, payload string) string {
+	mac := hmac.New(sha256.New, key)
+	mac.Write([]byte(payload))
+	return base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
+}
+
+// Verify checks shape, then expiry, then the signature — in that order.
+// The signature comparison is constant-time; the checks before it only look at
+// data the holder already supplied, so their timing leaks nothing.
+func Verify(key []byte, value string, nowMs int64) bool {
+	payload, sig, ok := strings.Cut(value, ".")
+	if !ok {
+		return false
+	}
+	expiry, err := strconv.ParseInt(payload, 10, 64)
+	if err != nil || expiry <= nowMs {
+		return false
+	}
+	want := sessionMAC(key, payload)
+	return subtle.ConstantTimeCompare([]byte(sig), []byte(want)) == 1
+}
+
+// isHTTPS reports whether the browser's connection is encrypted. Behind Traefik
+// the Go server itself speaks plain HTTP, so the forwarded header is the only
+// signal; without this check the Secure cookie would never be set in
+// production, and setting it unconditionally would break http://localhost dev.
+func isHTTPS(r *http.Request) bool {
+	return r.TLS != nil || r.Header.Get("X-Forwarded-Proto") == "https"
+}
+
+func SetCookie(w http.ResponseWriter, r *http.Request, key []byte) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     CookieName,
+		Value:    Sign(key, time.Now().Add(sessionTTL).UnixMilli()),
+		Path:     "/",
+		MaxAge:   int(sessionTTL / time.Second),
+		HttpOnly: true,
+		Secure:   isHTTPS(r),
+		SameSite: http.SameSiteLaxMode,
+	})
+}
+
+func ClearCookie(w http.ResponseWriter, r *http.Request) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     CookieName,
+		Value:    "",
+		Path:     "/",
+		MaxAge:   -1,
+		HttpOnly: true,
+		Secure:   isHTTPS(r),
+		SameSite: http.SameSiteLaxMode,
+	})
+}
+
+const (
+	MaxFailures = 10
+	Window      = 20 * time.Minute
+)
+
+// ClientIP returns the address the reverse proxy actually observed.
+//
+// Traefik appends the peer address to whatever X-Forwarded-For the client sent,
+// so the leftmost entry is attacker-controlled and the rightmost is not. Go's
+// Header.Get would only read the first header line, which a client can preempt
+// by sending its own; Values covers every line so the true last hop is found.
+// RemoteAddr is useless behind the proxy — it is always the Traefik container —
+// so it serves only as the direct-connection fallback for local development.
+func ClientIP(r *http.Request) string {
+	if vals := r.Header.Values("X-Forwarded-For"); len(vals) > 0 {
+		hops := strings.Split(vals[len(vals)-1], ",")
+		if ip := strings.TrimSpace(hops[len(hops)-1]); ip != "" {
+			return ip
+		}
+	}
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		return r.RemoteAddr
+	}
+	return host
+}
+
+// LoginLimiter throttles password guessing: MaxFailures failures inside a
+// rolling Window blocks further attempts from that IP until the oldest one
+// ages out. There is no permanent ban and no unlock step.
+//
+// Behind carrier-grade NAT this budget is shared with every other subscriber on
+// the same public address, so a stranger can lock the owner out for up to one
+// window. That is accepted: the block self-heals, and ten attempts is generous
+// for a mistyped password.
+//
+// State is in memory and per-process, so a restart clears it. Entries are
+// pruned lazily on access; for a single-user deployment the map cannot grow
+// past the handful of addresses that ever attempt a login.
+type LoginLimiter struct {
+	mu       sync.Mutex
+	failures map[string][]time.Time
+}
+
+func NewLoginLimiter() *LoginLimiter {
+	return &LoginLimiter{failures: make(map[string][]time.Time)}
+}
+
+// retryAfter returns how long ip must wait, or zero when it may try now.
+func (l *LoginLimiter) RetryAfter(ip string, now time.Time) time.Duration {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	recent := l.pruneLocked(ip, now)
+	if len(recent) < MaxFailures {
+		return 0
+	}
+	return recent[0].Add(Window).Sub(now)
+}
+
+func (l *LoginLimiter) Fail(ip string, now time.Time) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	l.failures[ip] = append(l.pruneLocked(ip, now), now)
+}
+
+func (l *LoginLimiter) Reset(ip string) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	delete(l.failures, ip)
+}
+
+// pruneLocked drops attempts older than the window and returns what is left.
+// The caller must hold l.mu.
+func (l *LoginLimiter) pruneLocked(ip string, now time.Time) []time.Time {
+	cutoff := now.Add(-Window)
+	// In-place filter: kept reuses the backing array of the slice being
+	// ranged over. Safe to alias because append writes at index len(kept),
+	// which is always <= the range index i, and element i is read before
+	// that write — the write cursor can never overtake the read cursor.
+	kept := l.failures[ip][:0]
+	for _, at := range l.failures[ip] {
+		if at.After(cutoff) {
+			kept = append(kept, at)
+		}
+	}
+	if len(kept) == 0 {
+		delete(l.failures, ip)
+		return nil
+	}
+	l.failures[ip] = kept
+	return kept
+}
@@ -0,0 +1,232 @@
+package session
+
+import (
+	"crypto/tls"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestSessionRoundTrip(t *testing.T) {
+	key := Key("token-abc", "pw-abc")
+	now := time.Now().UnixMilli()
+	value := Sign(key, now+60_000)
+	if !Verify(key, value, now) {
+		t.Fatal("Verify = false for a freshly signed cookie, want true")
+	}
+}
+
+func TestSessionRejects(t *testing.T) {
+	key := Key("token-abc", "pw-abc")
+	now := time.Now().UnixMilli()
+	valid := Sign(key, now+60_000)
+	payload, sig, _ := strings.Cut(valid, ".")
+
+	cases := []struct {
+		name  string
+		value string
+	}{
+		{"empty", ""},
+		{"no separator", payload + sig},
+		{"unparseable expiry", "notanumber." + sig},
+		{"expired", Sign(key, now-1)},
+		{"tampered signature", payload + "." + flipLastChar(sig)},
+		{"tampered expiry", "99999999999999." + sig},
+		{"signed with another key", Sign(Key("other-token", "pw-abc"), now+60_000)},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if Verify(key, tc.value, now) {
+				t.Fatalf("Verify(%q) = true, want false", tc.value)
+			}
+		})
+	}
+}
+
+func flipLastChar(s string) string {
+	if s == "" {
+		return "x"
+	}
+	last := s[len(s)-1]
+	if last == 'A' {
+		return s[:len(s)-1] + "B"
+	}
+	return s[:len(s)-1] + "A"
+}
+
+func TestSessionKeyDependsOnToken(t *testing.T) {
+	a := Key("token-a", "pw-abc")
+	b := Key("token-b", "pw-abc")
+	if string(a) == string(b) {
+		t.Fatal("Key collided for different API tokens")
+	}
+}
+
+func TestSessionKeyDependsOnWebPassword(t *testing.T) {
+	a := Key("token-abc", "pw-a")
+	b := Key("token-abc", "pw-b")
+	if string(a) == string(b) {
+		t.Fatal("Key collided for different web passwords with the same API token")
+	}
+}
+
+func TestSetSessionCookieAttributes(t *testing.T) {
+	cases := []struct {
+		name       string
+		tls        bool
+		forwarded  string
+		wantSecure bool
+	}{
+		{"plain http dev", false, "", false},
+		{"direct tls", true, "", true},
+		{"behind https proxy", false, "https", true},
+		{"behind http proxy", false, "http", false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodPost, "/login", nil)
+			if tc.tls {
+				r.TLS = &tls.ConnectionState{}
+			}
+			if tc.forwarded != "" {
+				r.Header.Set("X-Forwarded-Proto", tc.forwarded)
+			}
+			rr := httptest.NewRecorder()
+			SetCookie(rr, r, Key("token-abc", "pw-abc"))
+
+			cookies := rr.Result().Cookies()
+			if len(cookies) != 1 {
+				t.Fatalf("got %d cookies, want 1", len(cookies))
+			}
+			c := cookies[0]
+			if c.Name != CookieName {
+				t.Fatalf("cookie name = %q, want %q", c.Name, CookieName)
+			}
+			if !c.HttpOnly {
+				t.Fatal("cookie HttpOnly = false, want true")
+			}
+			if c.SameSite != http.SameSiteLaxMode {
+				t.Fatalf("cookie SameSite = %v, want Lax", c.SameSite)
+			}
+			if c.Path != "/" {
+				t.Fatalf("cookie Path = %q, want /", c.Path)
+			}
+			if c.Secure != tc.wantSecure {
+				t.Fatalf("cookie Secure = %v, want %v", c.Secure, tc.wantSecure)
+			}
+			if c.MaxAge != int(sessionTTL/time.Second) {
+				t.Fatalf("cookie MaxAge = %d, want %d", c.MaxAge, int(sessionTTL/time.Second))
+			}
+		})
+	}
+}
+
+func TestClearSessionCookie(t *testing.T) {
+	r := httptest.NewRequest(http.MethodPost, "/logout", nil)
+	rr := httptest.NewRecorder()
+	ClearCookie(rr, r)
+
+	cookies := rr.Result().Cookies()
+	if len(cookies) != 1 {
+		t.Fatalf("got %d cookies, want 1", len(cookies))
+	}
+	if cookies[0].MaxAge >= 0 {
+		t.Fatalf("cleared cookie MaxAge = %d, want negative", cookies[0].MaxAge)
+	}
+}
+
+func TestClientIP(t *testing.T) {
+	cases := []struct {
+		name       string
+		remoteAddr string
+		xff        []string
+		want       string
+	}{
+		{"no header falls back to remote addr", "203.0.113.9:5555", nil, "203.0.113.9"},
+		{"single proxy hop", "10.0.0.1:5555", []string{"203.0.113.9"}, "203.0.113.9"},
+		{
+			// The client sent "1.2.3.4" itself; Traefik appended the address it
+			// actually saw. Only the rightmost entry is trustworthy.
+			name:       "spoofed left entry is ignored",
+			remoteAddr: "10.0.0.1:5555",
+			xff:        []string{"1.2.3.4, 203.0.113.9"},
+			want:       "203.0.113.9",
+		},
+		{
+			name:       "spoofed separate header line is ignored",
+			remoteAddr: "10.0.0.1:5555",
+			xff:        []string{"1.2.3.4", "203.0.113.9"},
+			want:       "203.0.113.9",
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodPost, "/login", nil)
+			r.RemoteAddr = tc.remoteAddr
+			for _, v := range tc.xff {
+				r.Header.Add("X-Forwarded-For", v)
+			}
+			if got := ClientIP(r); got != tc.want {
+				t.Fatalf("ClientIP() = %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestLoginLimiterBlocksAfterMaxFailures(t *testing.T) {
+	l := NewLoginLimiter()
+	now := time.Now()
+	for i := 0; i < MaxFailures; i++ {
+		if wait := l.RetryAfter("1.2.3.4", now); wait != 0 {
+			t.Fatalf("blocked after %d failures, want block only after %d", i, MaxFailures)
+		}
+		l.Fail("1.2.3.4", now)
+	}
+	wait := l.RetryAfter("1.2.3.4", now)
+	if wait <= 0 {
+		t.Fatalf("retryAfter = %v after %d failures, want > 0", wait, MaxFailures)
+	}
+	if wait > Window {
+		t.Fatalf("retryAfter = %v, want <= %v", wait, Window)
+	}
+}
+
+func TestLoginLimiterWindowExpires(t *testing.T) {
+	l := NewLoginLimiter()
+	start := time.Now()
+	for i := 0; i < MaxFailures; i++ {
+		l.Fail("1.2.3.4", start)
+	}
+	if l.RetryAfter("1.2.3.4", start) == 0 {
+		t.Fatal("expected block immediately after the failures")
+	}
+	later := start.Add(Window + time.Second)
+	if wait := l.RetryAfter("1.2.3.4", later); wait != 0 {
+		t.Fatalf("retryAfter = %v once the window passed, want 0", wait)
+	}
+}
+
+func TestLoginLimiterResetClearsCounter(t *testing.T) {
+	l := NewLoginLimiter()
+	now := time.Now()
+	for i := 0; i < MaxFailures; i++ {
+		l.Fail("1.2.3.4", now)
+	}
+	l.Reset("1.2.3.4")
+	if wait := l.RetryAfter("1.2.3.4", now); wait != 0 {
+		t.Fatalf("retryAfter = %v after reset, want 0", wait)
+	}
+}
+
+func TestLoginLimiterIsPerIP(t *testing.T) {
+	l := NewLoginLimiter()
+	now := time.Now()
+	for i := 0; i < MaxFailures; i++ {
+		l.Fail("1.2.3.4", now)
+	}
+	if wait := l.RetryAfter("5.6.7.8", now); wait != 0 {
+		t.Fatalf("retryAfter for a different IP = %v, want 0", wait)
+	}
+}