bastion 0.60.0

client-go/uisetup_owner.go

@@ -0,0 +1,101 @@
+package main
+
+// uisetup_owner.go — owner acts on Settings that used to end in "the line to
+// run": naming the owner, disconnecting a Host, releasing one from
+// quarantine. Each needs the machine's administrator, so each is offered only
+// when the bastion runs for the whole machine (the console then runs as
+// that administrator), and each that widens what a Host may do takes the
+// owner's code: anything driving the person's browser can press a button.
+// Disconnecting only takes reach away, so it takes a tick, not a code.
+// Every act is written to pairing_audit.jsonl, so it shows in Activity.
+
+import (
+	"net/http"
+	"strings"
+)
+
+// ownerCodeRefusal spends the owner's code on one act, or says why not.
+func ownerCodeRefusal(code, purpose string) string {
+	dir := existingMachineFactorDir()
+	if !stepupEnrolled(dir) {
+		return "Set up your code under Settings first."
+	}
+	code = strings.TrimSpace(code)
+	if code == "" {
+		return "Type the code from your authenticator."
+	}
+	approval, err := machineCodeSpend(dir, uiNow(), func() (string, error) {
+		return stepupIssueApproval(dir, code, purpose)
+	})
+	if err != nil {
+		return "Not done: " + err.Error() + "."
+	}
+	if err := stepupConsumeApproval(dir, approval, purpose); err != nil {
+		return "Not done: " + err.Error() + "."
+	}
+	return ""
+}
+
+func (s *uiSetup) ownerNameHere(w http.ResponseWriter, name, code string) {
+	if err := claimNameOK(name); err != nil {
+		s.flash(w, "That name will be refused: "+err.Error()+".", "bad")
+		return
+	}
+	if err := purposeBad([]string{name}, nil); err != nil {
+		s.flash(w, "That name cannot be used: "+err.Error()+".", "bad")
+		return
+	}
+	if why := ownerCodeRefusal(code, "local_owner|"+name); why != "" {
+		s.flash(w, why, "warn")
+		return
+	}
+	if _, err := writeOwnerClaim(name); err != nil {
+		s.flash(w, "Not set: "+err.Error()+".", "bad")
+		return
+	}
+	pairingAudit("claim_owner", name, "set by the owner at this machine's console")
+	s.flash(w, "The owner name is now “"+name+"”. It shows on this machine's card on every Host it serves, "+
+		"and grants nothing.", "ok")
+}
+
+func (s *uiSetup) hostDisconnect(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		return
+	}
+	host := strings.TrimSpace(r.FormValue("host"))
+	if r.FormValue("confirm") == "" {
+		s.flash(w, "Tick the box to confirm disconnecting "+host+". Connecting it again needs a new token from it.", "warn")
+		return
+	}
+	name, err := unpairHost(host)
+	if err != nil {
+		s.flash(w, "Not disconnected: "+err.Error()+".", "bad")
+		return
+	}
+	pairingAudit("unpair", name, "disconnected by the owner at this machine's console")
+	s.flash(w, name+" is disconnected: its tunnel and lanes are down. What it kept on this machine stays on disk.", "ok")
+}
+
+func (s *uiSetup) hostRelease(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		return
+	}
+	host := strings.TrimSpace(r.FormValue("host"))
+	if _, err := setupHost(host); err != nil {
+		s.flash(w, err.Error(), "bad")
+		return
+	}
+	if !machineAuthorityHeld() {
+		s.flash(w, "Releasing a Host needs the machine's administrator; this bastion runs in your own account.", "warn")
+		return
+	}
+	if why := ownerCodeRefusal(r.FormValue("code"), "local_release|"+host); why != "" {
+		s.flash(w, why, "warn")
+		return
+	}
+	quarantineClear(host)
+	pairingAudit("quarantine_clear", host, "released by the owner at this machine's console")
+	s.flash(w, host+" may ask this machine for changes again, each with your approval as before.", "ok")
+}