A new hub gives administrator only to whoever brings its setup code c8684d44d549

pub struct Registration {

    /// `open`, `invite` or `closed`; the admin page can override it.

    pub mode: String,

}

impl Default for Registration {

    fn default() -> Self {

    }

}

        if let Some(v) = get("OXYHUB_REGISTRATION_MODE") {

            self.registration.mode = v;

        }

        if let Some(v) = get("OXYHUB_AUTH_PUSH_TOKENS") {

            self.auth.push_tokens = v.split(',').map(str::trim).filter(|s| !s.is_empty()).map(String::from).collect();

        }

pub mod reports;

pub mod repos;

pub mod secrets;

pub mod signin;

pub mod social;

pub mod storage;

            }

        }

    });

    Ok(app)

}

    password: String,

    #[serde(default)]

    invite: String,

}

pub async fn register(State(app): State<Shared>, viewer: Viewer, Form(f): Form<RegisterForm>) -> Result<Response, Error> {

    }

    if let Err(e) = auth::password_ok(&f.password) {

        return Ok(fail(e));

    }

    if !first {

        match mode.as_str() {

        .map_err(|e| Error::from_db(shell.clone(), e))?;

    if !first && mode == "invite" {

        accounts::use_invitation(&app.db, f.invite.trim(), account.id).await.ok();

    }

    accounts::audit(&app.db, Some(&account), "register", &username, if first { "first account: administrator" } else { "" }).await.ok();

    if let Err(e) = super::recovery::send_verification(&app, &account).await {

    let username = signin::free_username(&app.db, &who.login, p.id).await?;

    let hash = auth::hash_password(&auth::random_hex(24)).unwrap_or_default();

    let first = accounts::account_count(&app.db).await? == 0;

    let account =

        accounts::create_account(&app.db, &username, who.email.as_deref().unwrap_or(""), &hash, &auth::random_hex(16), first).await?;

    if who.email.is_some() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

    let port = listener.local_addr().unwrap().port();

    config.server.base_url = format!("http://127.0.0.1:{port}");

/// Register (or sign in) and return the session cookie value.

async fn register(app: &Shared, user: &str, invite: &str) -> String {

    assert_eq!(r.status, StatusCode::SEE_OTHER, "{}", r.body);

    r.cookie.expect("session cookie")

}

    let me = db::accounts::account_by_name(&app.db, "andy").await.unwrap().unwrap();

    assert!(me.is_admin);

    // A second registration needs an invitation.

    assert_eq!(r.status, StatusCode::OK);

    assert!(r.body.contains("invitation"), "{}", r.body);

    let admin_page = get(app, "/admin", Some(&andy)).await;

    let code = oxygenhub::auth::totp::current(&secret, now).unwrap();

    let r = post(app, "/settings/security/totp/enable", Some(&fresh), &format!("_csrf={csrf}&secret={secret}&code={code}")).await;

    assert!(r.body.contains("Recovery codes"), "{}", r.body);

    assert!(r.body.contains("authenticator"), "second step asked: {}", r.body);

    // Submit the second step as a browser would: every field of the

    // rendered form, each name once (a repeated name is refused).

    };

    let login = |user: &'static str| {

        let app = app.clone();

    };

    // Disabled: sign-in says so, the old session no longer counts.

    assert_eq!(get(app, "/settings", Some(&bob)).await.status, StatusCode::SEE_OTHER);

    // Its name stays retired.

    let code = invite(app.clone(), andy.clone()).await;

    assert!(r.body.contains("That name is taken"), "{}", r.body);

    // The last admin can be neither disabled nor deleted.

    assert!(act("andy", "delete", "andy").await.contains("Not on yourself"));

    let (mock, seen) = mock_provider().await;

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

    let port = listener.local_addr().unwrap().port();

    config.server.base_url = format!("http://127.0.0.1:{port}");

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.server.base_url = "https://hub.example.org".into();

    config.registration.mode = "open".into();

    let app = oxygenhub::build(config).await.unwrap();

        "POST",

        "/register",

        Some(("x-forwarded-proto", "https")),

    )

    .await;

    let cookie = r.headers().get(header::SET_COOKIE).expect("signed in").to_str().unwrap();

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.server.behind_proxy = true;

    config.registration.mode = "open".into();

    let app = oxygenhub::build(config).await.unwrap();

        }

    };

    register(&app, "andy", "").await;

    // An account: five wrong passwords cost nothing, the sixth starts a

    // wait, and then even the right password waits (told when to retry).

    let app = &h.app;

    let a = register(app, "andy", "").await;

    assert_eq!(a.len(), 64, "a random id, not the account's name");

    assert_ne!(a, b, "each sign-in is a new session");

    let page = get(app, "/settings/security", Some(&a)).await.body;

    assert!(!signed_in(a.clone()).await, "idle too long");

    // Signing out ends the record itself, not just the cookie.

    let csrf = csrf_of(&get(app, "/settings/security", Some(&c)).await.body);

    post(app, "/logout", Some(&c), &format!("_csrf={csrf}")).await;

    assert!(!signed_in(c).await, "the old cookie no longer works");

    let (mock, _) = mock_provider().await;

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

    let port = listener.local_addr().unwrap().port();

    config.server.base_url = format!("http://127.0.0.1:{port}");

    assert_eq!(r.status, StatusCode::BAD_REQUEST);

    assert!(r.body.contains("That invitation has been used or does not exist."), "{}", r.body);

    assert_eq!(get(app, "/login/github?invite=not-a.code", None).await.status, StatusCode::BAD_REQUEST);

}

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.auth.push_tokens = vec!["site".into()];

    config.registration.mode = "open".into();

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

    let h = hub().await;

    let app = &h.app;

    // Accounts and tokens through the pages.

    let andy = r.cookie.unwrap();

    let bob = r.cookie.unwrap();

    let mint = |cookie: String, scopes: &'static str| {

        let app = app.clone();

async fn api_issue_triage_and_labels() {

    let h = hub().await;

    let app = &h.app;

    let mint = |cookie: String, scopes: &'static str| {

        let app = app.clone();

        async move {

async fn webhook_formats_editing_and_web_issue_events() {

    let h = hub().await;

    let app = &h.app;

    let page = call(app, "GET", "/settings/tokens", None, Some(&andy), None, None).await;

    let r = call(

        app,

async fn api_projects() {

    let h = hub().await;

    let app = &h.app;

    let mint = |cookie: String, scopes: &'static str| {

        let app = app.clone();

        async move {

async fn api_required_checks() {

    let h = hub().await;

    let app = &h.app;

    let page = call(app, "GET", "/settings/tokens", None, Some(&andy), None, None).await;

    let csrf = csrf_of(&page.body);

    let mint = |scopes: &'static str| {

async fn flow_is_switched_per_repository_by_site_admins() {

    let h = hub().await;

    let app = &h.app;

    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;

    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;

    let row = || async { oxygenhub::db::repos::get(&app.db, "andy", "demo").await.unwrap().unwrap() };

async fn bookmarks_are_deleted_by_push_and_on_the_web() {

    let h = hub().await;

    let app = &h.app;

    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;

    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;

    let url = format!("{}/andy/demo", h.base);

async fn changes_signed_by_unlinked_keys_say_so() {

    let h = hub().await;

    let app = &h.app;

    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;

    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;

    let url = format!("{}/andy/demo", h.base);

async fn a_function_has_its_own_history() {

    let h = hub().await;

    let app = &h.app;

    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;

    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;

    let url = format!("{}/andy/demo", h.base);

async fn a_bookmark_shows_as_swimlanes() {

    let h = hub().await;

    let app = &h.app;

    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;

    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;

    let url = format!("{}/andy/demo", h.base);

async fn a_proposal_board_plans_squashes_and_rebases() {

    let h = hub().await;

    let app = &h.app;

    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;

    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;

    let url = format!("{}/andy/demo", h.base);

async fn proposals_and_issues_show_their_chain() {

    let h = hub().await;

    let app = &h.app;

    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;

    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;

    let url = format!("{}/andy/demo", h.base);

async fn device_sign_in() {

    let h = hub().await;

    let app = &h.app;

    let andy = r.cookie.unwrap();

    // An unknown scope is refused.

async fn api_assistants_at_each_level() {

    let h = hub().await;

    let app = &h.app;

    let page = call(app, "GET", "/settings/tokens", None, Some(&andy), None, None).await;

    let csrf = csrf_of(&page.body);

    let mint = |scopes: &'static str| {

    }

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.apt.repos = vec!["andy/oxy".into(), "andy/hidden".into()];

    // The signing key, in the hub's data as on Earth.

    let home = dir.path().join("apt-gnupg");

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.auth.push_tokens = vec!["site".into()];

    config.backups.directories = vec![backups.to_path_buf()];

    if let Some(g) = google {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.auth.push_tokens = vec!["site".into()];

    config.backups.directories = vec![backups.to_path_buf()];

    config.backups.aws_sts_url = aws.to_string();

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.auth.push_tokens = push_tokens;

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

    let port = listener.local_addr().unwrap().port();

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.auth.push_tokens = vec!["site".into()];

    config.registration.mode = "open".into();

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

    let base = format!("http://127.0.0.1:{port}");

    let app = &app;

    let andy = r.cookie.unwrap();

    let andy_id = db::accounts::account_by_name(&app.db, "andy").await.unwrap().unwrap().id;

    let repo = RepoName::parse("andy/demo").unwrap();

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.auth.push_tokens = vec!["site".into()];

    config.registration.mode = "open".into();

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });

    let base = format!("http://127.0.0.1:{port}");

    let app = &app;

    assert!(r.cookie.is_some());

    let andy_id = db::accounts::account_by_name(&app.db, "andy").await.unwrap().unwrap().id;

    let repo = RepoName::parse("andy/demo").unwrap();

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.auth.push_tokens = vec!["site".into()];

    config.registration.mode = "open".into();

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });

    let base = format!("http://127.0.0.1:{port}");

    let app = &app;

    let andy = r.cookie.unwrap();

    let andy_id = db::accounts::account_by_name(&app.db, "andy").await.unwrap().unwrap().id;

    db::accounts::create_org(&app.db, "doomsday", "Doomsday One", andy_id).await.unwrap();

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.auth.push_tokens = vec!["site".into()];

    config.registration.mode = "open".into();

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });

    let base = format!("http://127.0.0.1:{port}");

    let app = &app;

    let andy = r.cookie.unwrap();

    let andy_id = db::accounts::account_by_name(&app.db, "andy").await.unwrap().unwrap().id;

    let repo = RepoName::parse("andy/demo").unwrap();

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.auth.push_tokens = vec!["site".into()];

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

    let port = listener.local_addr().unwrap().port();

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.auth.push_tokens = vec!["site".into()];

    config.flow.runner_tokens = vec!["runner-secret".into(), "runner-two".into(), "runner-three".into()];

    config.flow.repos = vec!["andy/*".into()];

        Request::post("/register").header(header::CONTENT_TYPE, "application/x-www-form-urlencoded").body(Body::from(f)).unwrap()

    };

    let res = oxygenhub::router(h.app.clone())

        .await

        .unwrap();

    let cookie = res.headers().get(header::SET_COOKIE).unwrap().to_str().unwrap().split(';').next().unwrap().to_string();

        .oneshot(

            Request::post("/register")

                .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")

                .unwrap(),

        )

        .await

        .oneshot(

            Request::post("/register")

                .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")

                .unwrap(),

        )

        .await

        .oneshot(

            Request::post("/register")

                .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")

                .unwrap(),

        )

        .await

        .oneshot(

            Request::post("/register")

                .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")

                .unwrap(),

        )

        .await

        .oneshot(

            Request::post("/register")

                .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")

                .unwrap(),

        )

        .await

    let register = |name: &'static str| {

        let app = h.app.clone();

        async move {

            let res = oxygenhub::router(app)

                .oneshot(

                    Request::post("/register")

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.auth.push_tokens = vec!["site".into()];

    config.registration.mode = "open".into();

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

}

async fn register(app: &Shared, user: &str) -> String {

    assert_eq!(r.status, StatusCode::SEE_OTHER, "{}", r.body);

    r.cookie.unwrap()

}

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.auth.push_tokens = vec!["site".into()];

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

    let port = listener.local_addr().unwrap().port();

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.auth.push_tokens = vec!["site".into()];

    config.registration.mode = "open".into();

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

}

async fn register(app: &Shared, user: &str) -> String {

    assert_eq!(r.status, StatusCode::SEE_OTHER, "{}", r.body);

    r.cookie.unwrap()

}

    let mailbox = dir.path().join("mailbox");

    std::fs::create_dir_all(&mailbox).unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.server.base_url = "http://hub.test".into();

    config.registration.mode = "open".into();

    if mail {

async fn verification_and_reset() {

    let h = hub(true).await;

    let app = &h.app;

    assert_eq!(r.status, StatusCode::SEE_OTHER, "{}", r.body);

    let old_session = r.cookie.unwrap();

    assert!(get(app, &reset, None).await.body.contains("expired or was already used"), "single use");

    let stale = get(app, "/settings", Some(&old_session)).await;

    assert!(stale.status.is_redirection() || !stale.body.contains("name=\"_csrf\""), "the old session ended");

    assert!(wrong.body.contains("Wrong username or password"));

    let signed = post(app, "/login", None, "username=andy&password=new-password-long-enough").await;

    assert_eq!(signed.status, StatusCode::SEE_OTHER);

    assert!(again.body.contains("less than two minutes ago"), "{}", again.body);

    // An administrator's link, for an account without a verified email.

    let admin = get(app, "/admin", Some(&session)).await;

    assert!(admin.body.contains("value=\"reset_link\""));

    let r = post(app, "/admin/account", Some(&session), &format!("_csrf={}&username=bob&action=reset_link", csrf_of(&admin.body))).await;

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.auth.push_tokens = vec!["site".into()];

    config.registration.mode = "open".into();

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

        None,

        None,

        Some("application/x-www-form-urlencoded"),

    )

    .await

    .cookie

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.auth.push_tokens = vec!["site".into()];

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

    let port = listener.local_addr().unwrap().port();

}

async fn andy(app: &Shared) -> String {

    assert_eq!(st, StatusCode::SEE_OTHER, "{body}");

    cookie.expect("session")

}

### 5.1 Accounts

Sessions are server-side records (oxygenhub#223): the cookie `oxyhub=<id>` holds 32 random bytes in hex, and the hub keeps only the id's BLAKE3 hash, with the account, the account's session salt at sign-in, the times it was made and last used, and the address and browser it came from. A session is good while its salt is still the account's, it has been used in the last 14 days, and it is under 30 days old; the cookie is `HttpOnly`, `Secure` when served over HTTPS, `SameSite=Lax`. Every sign-in (after the code, with two-factor) makes a new session; signing out deletes its record. Password changes, resets and "sign out everywhere" rotate the salt, which ends every session at once; Settings › Security lists the signed-in browsers and signs any one out. Ended sessions are swept nightly. CSRF tokens are bound to the session id. Sign-in is also slowed against guessing (§15.6, oxygenhub#221). Passkeys (WebAuthn) are planned for 1.0 as a second factor or password replacement.

  <label for="username">Username</label><input type="text" id="username" name="username" autocomplete="username" required pattern="[A-Za-z0-9][A-Za-z0-9._-]{0,63}">

  <label for="email">Email</label><input type="email" id="email" name="email" autocomplete="email">

  <label for="password">Password (at least 10 characters)</label><input type="password" id="password" name="password" autocomplete="new-password" required minlength="10">

  {% if !first && mode == "invite" %}<label for="invite">Invitation code</label><input type="text" id="invite" name="invite" value="{{ invite }}" required>{% endif %}

  <button type="submit">CREATE ACCOUNT</button>

</form>