chore: Fix app
This commit is contained in:
@@ -1,6 +1,14 @@
|
||||
# Authentication
|
||||
|
||||
Session-token authentication for the signaling server and product client.
|
||||
> **Area:** authentication
|
||||
> **Status:** Active
|
||||
> **Last updated:** 2026-07-05
|
||||
|
||||
## Overview
|
||||
|
||||
Session-token authentication binds REST mutations and WebSocket `identify` to a user identity on each signaling server. The product client may hold **multiple** server credentials (home + foreign auto-provisioned accounts) while keeping one local user profile. Multi-device tabs share one identity via separate `clientInstanceId` values and `account_sync` relay.
|
||||
|
||||
WebSocket details: [signaling.md](signaling.md). Local API tokens: [desktop-local-api.md](desktop-local-api.md).
|
||||
|
||||
## Trust boundaries
|
||||
|
||||
@@ -8,8 +16,8 @@ Session-token authentication for the signaling server and product client.
|
||||
|---|---|---|
|
||||
| Signaling server REST (mutations) | `Authorization: Bearer <token>` | Actor user IDs in request bodies are ignored; server derives `authUserId` from the token |
|
||||
| Signaling server REST (discovery) | None | `GET /api/servers`, featured/trending/search remain public |
|
||||
| Signaling server WebSocket | `identify.token` | Connections must identify before any other message type |
|
||||
| Electron Local API | Separate in-memory bearer tokens | Proxies login to allowed signaling servers only |
|
||||
| Signaling server WebSocket | `identify.token` | Connections must identify before any other message type — see [signaling.md](signaling.md) |
|
||||
| Electron Local API | Separate in-memory bearer tokens | Proxies login to allowed signaling servers only — see [desktop-local-api.md](desktop-local-api.md) |
|
||||
| Product client local DB | OS user account | SQLite and attachments are plaintext at rest |
|
||||
|
||||
## Client logout
|
||||
@@ -36,13 +44,81 @@ Session-token authentication for the signaling server and product client.
|
||||
|
||||
## Protected REST routes
|
||||
|
||||
Require `Authorization: Bearer`:
|
||||
Require `Authorization: Bearer` (`requireAuth` middleware). Public routes are listed for contrast.
|
||||
|
||||
- `PUT/POST/DELETE` under `/api/servers/*` (except public `GET`)
|
||||
- `PUT /api/requests/:id`
|
||||
- Plugin-support mutations under `/api/servers/:serverId/plugins/*`
|
||||
- `/api/users/device-tokens/*`
|
||||
- `POST /api/users/logout`
|
||||
### Users (`/api/users`)
|
||||
|
||||
| Method | Path | Auth |
|
||||
|--------|------|------|
|
||||
| POST | `/register` | Public |
|
||||
| POST | `/login` | Public |
|
||||
| GET | `/:id/signing-public-key` | Public |
|
||||
| PUT | `/me/signing-key` | Bearer |
|
||||
| POST | `/logout` | Bearer |
|
||||
|
||||
### Device tokens (`/api/users/device-tokens`)
|
||||
|
||||
All routes require bearer; `userId` in body or path must equal `authUserId` (`403` otherwise).
|
||||
|
||||
| Method | Path |
|
||||
|--------|------|
|
||||
| POST | `/` |
|
||||
| GET | `/:userId` |
|
||||
| POST | `/:userId/dispatch` |
|
||||
|
||||
### Servers (`/api/servers`)
|
||||
|
||||
| Method | Path | Auth |
|
||||
|--------|------|------|
|
||||
| GET | `/`, `/featured`, `/trending`, `/:id` | Public |
|
||||
| POST | `/` | Bearer |
|
||||
| PUT | `/:id` | Bearer |
|
||||
| DELETE | `/:id` | Bearer |
|
||||
| POST | `/:id/join` | Bearer |
|
||||
| POST | `/:id/leave` | Bearer |
|
||||
| POST | `/:id/heartbeat` | Bearer |
|
||||
| POST | `/:id/invites` | Bearer |
|
||||
| GET | `/:id/requests` | Bearer |
|
||||
| POST | `/:id/moderation/kick` | Bearer |
|
||||
| POST | `/:id/moderation/ban` | Bearer |
|
||||
| POST | `/:id/moderation/unban` | Bearer |
|
||||
|
||||
### Join requests (`/api/requests`)
|
||||
|
||||
| Method | Path | Auth |
|
||||
|--------|------|------|
|
||||
| PUT | `/:id` | Bearer (approve/deny) |
|
||||
|
||||
### Plugin support (`/api/servers/:serverId/plugins`)
|
||||
|
||||
| Method | Path | Auth |
|
||||
|--------|------|------|
|
||||
| GET | `/` | Public (metadata read) |
|
||||
| PUT | `/:pluginId/requirement` | Bearer |
|
||||
| DELETE | `/:pluginId/requirement` | Bearer |
|
||||
| PUT | `/:pluginId/events/:eventName` | Bearer |
|
||||
| DELETE | `/:pluginId/events/:eventName` | Bearer |
|
||||
| GET/PUT/DELETE | `/:pluginId/data/*` | **410 Gone** (server plugin data disabled) |
|
||||
|
||||
### Public (no bearer)
|
||||
|
||||
- `GET /api/health`, `/api/time`
|
||||
- `GET /api/link-metadata`, `/api/image-proxy`
|
||||
- `GET /api/klipy/config`, `/api/klipy/gifs`
|
||||
- `POST /api/games/match`
|
||||
- `GET /api/invites/:id`
|
||||
- `GET /invite/:id` (HTML invite page)
|
||||
- OpenAPI docs routes (`/api/openapi.json`, `/api/docs`, …) — gated by server config, not session auth
|
||||
|
||||
Full server-directory semantics: [server-directory.md](server-directory.md).
|
||||
|
||||
## Message signing key registration
|
||||
|
||||
Ed25519 signing keys for [message-integrity.md](message-integrity.md) register via `PUT /api/users/me/signing-key` with `{ publicKeyJwk }`.
|
||||
|
||||
- **When registered:** `AuthenticationService` calls `MessageSigningService.registerSigningPublicKeyIfNeeded()` after successful **home** `POST /login` and `POST /register` only (`authentication.service.ts`).
|
||||
- **Scope:** registration uses the **active** signaling server's API base (`ServerDirectoryFacade.activeServer()`). Foreign-server auto-provision (`authorizeSignalServer` / `SignalServerProvisionerService`) does **not** currently call signing-key registration — message integrity on foreign servers depends on a later login path or manual registration when that server becomes active.
|
||||
- **Storage:** private key in `localStorage` (`metoyou.messageSigningKeyPair`); public key directory on server SQLite only.
|
||||
|
||||
## WebSocket identify contract
|
||||
|
||||
@@ -135,3 +211,16 @@ Startup routing for signed-out visitors is decided by `resolveUnauthenticatedSta
|
||||
- CORS allowlist: optional `corsAllowlist` in `server/data/variables.json` or `CORS_ALLOWLIST` env (comma-separated). Empty allowlist keeps permissive CORS for local development.
|
||||
- Push-token routes require bearer auth and user-id match.
|
||||
- RTC relay: direct-message/direct-call types always relay; server-icon types require shared server membership; WebRTC offer/answer/ice remain open for cross-server DM WebRTC.
|
||||
|
||||
## Related
|
||||
|
||||
- [signaling.md](signaling.md) — WebSocket `identify`, `account_sync`, ordering invariants
|
||||
- [desktop-local-api.md](desktop-local-api.md) — Electron Local API bearer tokens
|
||||
- [message-integrity.md](message-integrity.md) — signing keys and revision chains
|
||||
- [server-directory.md](server-directory.md) — protected server REST mutations
|
||||
|
||||
## Changelog
|
||||
|
||||
| Date | Change |
|
||||
|------|--------|
|
||||
| 2026-07-05 | Expanded protected-route inventory; clarified signing-key registration scope; cross-links |
|
||||
|
||||
Reference in New Issue
Block a user