feat(settings): hub auth-policy panel — T4/T5 security parity in the GUI
Some checks failed
Security / Security check (push) Failing after 1s
Some checks failed
Security / Security check (push) Failing after 1s
Settings → Security now shows the hub's effective auth policy via the new read-only AuthStatus RPC: active token validator (static / jwt-rs256 with issuer, audience, JWKS source), anonymous-access warning, per-token cards with scope grants, env-var presence and rate limits, plus a localized admin-denied story for non-admin tokens. Live-reloads on endpoint change. Also fixes a batch of fai→chain rename leftovers this panel's verification uncovered: hub_auth_token.dart and registry_token.dart read/wrote ~/.fai/ while the hub reads ~/.chain/ (stored registry tokens never reached the hub), today_story_loader + tools/today used ~/.fai/today, chain_log legacy ~/.fai/logs migration removed per the no-legacy-recognisers decision, and UI strings still advertised the retired .fai bundle extension. Includes 5 widget tests for the panel, an integration-test screenshot harness (auth_policy_shots_test.dart, guide-shots style), and DE+EN l10n. flutter analyze clean, 58 tests green. Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
This commit is contained in:
flemming-it
parent
c6da5025ce
commit
efaa089454
18 changed files with 1208 additions and 74 deletions
|
|
@ -17,6 +17,7 @@ import '../theme/tokens.dart';
|
|||
import 'chain_error_box.dart';
|
||||
import 'chain_pill.dart';
|
||||
import 'chain_system_ai_editor.dart';
|
||||
import 'hub_auth_policy_panel.dart';
|
||||
import 'theme_picker_grid.dart';
|
||||
|
||||
class ChainSettingsDialog extends StatefulWidget {
|
||||
|
|
@ -648,6 +649,8 @@ class _FaiSettingsDialogState extends State<ChainSettingsDialog> {
|
|||
onSave: _saveHubAuthToken,
|
||||
onClear: _clearHubAuthToken,
|
||||
),
|
||||
const SizedBox(height: ChainSpace.xl),
|
||||
const HubAuthPolicyPanel(),
|
||||
];
|
||||
}
|
||||
|
||||
|
|
@ -1820,7 +1823,7 @@ class _MaintenancePanelState extends State<_MaintenancePanel> {
|
|||
/// Credentials panel for the operator's registry auth token.
|
||||
/// The hub reads the same token via `~/.chain/registry-token`
|
||||
/// (or the `CHAIN_REGISTRY_TOKEN` env var, which still wins)
|
||||
/// when downloading `.fai` bundles from a registry behind a
|
||||
/// when downloading `.chain` bundles from a registry behind a
|
||||
/// signin wall — Forgejo with REQUIRE_SIGNIN_VIEW=true,
|
||||
/// GitHub-private releases, etc.
|
||||
///
|
||||
|
|
|
|||
390
lib/widgets/hub_auth_policy_panel.dart
Normal file
390
lib/widgets/hub_auth_policy_panel.dart
Normal file
|
|
@ -0,0 +1,390 @@
|
|||
// Read-only view of the hub's authentication policy (T4/T5):
|
||||
// which token validator is active, whether anonymous calls are
|
||||
// accepted, and the configured tokens with their scope grants —
|
||||
// surfaced in Settings → Security so security administration is
|
||||
// inspectable without opening config.yaml. Editing stays in the
|
||||
// operator config on purpose (secrets live in env vars, the file
|
||||
// carries only names); the panel says so and offers the live
|
||||
// reload that applies a rotation without a daemon restart.
|
||||
|
||||
import 'package:flutter/material.dart';
|
||||
|
||||
import '../data/hub.dart';
|
||||
import '../l10n/app_localizations.dart';
|
||||
import '../theme/tokens.dart';
|
||||
import 'chain_error_box.dart';
|
||||
|
||||
class HubAuthPolicyPanel extends StatefulWidget {
|
||||
/// Test seam: replaces the live [HubService.authStatus] call.
|
||||
@visibleForTesting
|
||||
final Future<HubAuthPolicy> Function()? loader;
|
||||
|
||||
/// Test seam: replaces the live [HubService.reloadHubAuth] call.
|
||||
@visibleForTesting
|
||||
final Future<int> Function()? reloader;
|
||||
|
||||
const HubAuthPolicyPanel({super.key, this.loader, this.reloader});
|
||||
|
||||
@override
|
||||
State<HubAuthPolicyPanel> createState() => _HubAuthPolicyPanelState();
|
||||
}
|
||||
|
||||
class _HubAuthPolicyPanelState extends State<HubAuthPolicyPanel> {
|
||||
HubAuthPolicy? _policy;
|
||||
Object? _error;
|
||||
bool _loading = true;
|
||||
bool _reloading = false;
|
||||
String? _reloadNote;
|
||||
|
||||
@override
|
||||
void initState() {
|
||||
super.initState();
|
||||
_load();
|
||||
}
|
||||
|
||||
Future<void> _load() async {
|
||||
setState(() {
|
||||
_loading = true;
|
||||
_error = null;
|
||||
});
|
||||
try {
|
||||
final load = widget.loader ?? HubService.instance.authStatus;
|
||||
final p = await load();
|
||||
if (!mounted) return;
|
||||
setState(() {
|
||||
_policy = p;
|
||||
_loading = false;
|
||||
});
|
||||
} catch (e) {
|
||||
if (!mounted) return;
|
||||
setState(() {
|
||||
_error = e;
|
||||
_loading = false;
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
Future<void> _reload() async {
|
||||
final l = AppLocalizations.of(context)!;
|
||||
setState(() {
|
||||
_reloading = true;
|
||||
_reloadNote = null;
|
||||
});
|
||||
try {
|
||||
final reload = widget.reloader ?? HubService.instance.reloadHubAuth;
|
||||
final n = await reload();
|
||||
if (!mounted) return;
|
||||
setState(() {
|
||||
_reloading = false;
|
||||
_reloadNote = l.authPolicyReloadDone(n);
|
||||
});
|
||||
await _load();
|
||||
} catch (e) {
|
||||
if (!mounted) return;
|
||||
setState(() {
|
||||
_reloading = false;
|
||||
_error = e;
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
/// True when the failure is the hub refusing the caller —
|
||||
/// either no/invalid token (UNAUTHENTICATED) or a token
|
||||
/// without the admin scope (PERMISSION_DENIED). Both get the
|
||||
/// same plain-language fix: store an admin token above.
|
||||
bool _isPermissionDenied(Object e) {
|
||||
final s = e.toString();
|
||||
return s.contains('PERMISSION_DENIED') ||
|
||||
s.contains('code: 7') ||
|
||||
s.contains('UNAUTHENTICATED') ||
|
||||
s.contains('code: 16');
|
||||
}
|
||||
|
||||
/// True when the hub predates the AuthStatus RPC (skew: Studio
|
||||
/// newer than the hub) — gets an update hint, not a raw error.
|
||||
bool _isUnimplemented(Object e) {
|
||||
final s = e.toString();
|
||||
return s.contains('UNIMPLEMENTED') || s.contains('code: 12');
|
||||
}
|
||||
|
||||
@override
|
||||
Widget build(BuildContext context) {
|
||||
final theme = Theme.of(context);
|
||||
final l = AppLocalizations.of(context)!;
|
||||
return Column(
|
||||
crossAxisAlignment: CrossAxisAlignment.start,
|
||||
children: [
|
||||
Text(
|
||||
l.authPolicyHeader,
|
||||
style: theme.textTheme.labelSmall?.copyWith(
|
||||
color: theme.colorScheme.onSurfaceVariant,
|
||||
letterSpacing: 0.6,
|
||||
fontSize: 10,
|
||||
),
|
||||
),
|
||||
const SizedBox(height: 2),
|
||||
Text(
|
||||
l.authPolicyBlurb,
|
||||
style: theme.textTheme.bodySmall?.copyWith(
|
||||
color: theme.colorScheme.onSurfaceVariant,
|
||||
),
|
||||
),
|
||||
const SizedBox(height: ChainSpace.sm),
|
||||
if (_loading)
|
||||
const Padding(
|
||||
padding: EdgeInsets.symmetric(vertical: ChainSpace.md),
|
||||
child: Center(
|
||||
child: SizedBox(
|
||||
width: 18,
|
||||
height: 18,
|
||||
child: CircularProgressIndicator(strokeWidth: 2),
|
||||
),
|
||||
),
|
||||
)
|
||||
else if (_error != null) ...[
|
||||
if (_isPermissionDenied(_error!))
|
||||
_hintRow(theme, Icons.lock_outline, l.authPolicyNeedsAdmin)
|
||||
else if (_isUnimplemented(_error!))
|
||||
_hintRow(theme, Icons.update, l.authPolicyHubTooOld)
|
||||
else
|
||||
ChainErrorBox(error: _error!, isError: true, maxHeight: 160),
|
||||
const SizedBox(height: ChainSpace.xs),
|
||||
Align(
|
||||
alignment: Alignment.centerLeft,
|
||||
child: OutlinedButton.icon(
|
||||
onPressed: _load,
|
||||
icon: const Icon(Icons.refresh, size: 16),
|
||||
label: Text(l.authPolicyRetry),
|
||||
),
|
||||
),
|
||||
] else if (_policy != null)
|
||||
..._policyView(theme, l, _policy!),
|
||||
],
|
||||
);
|
||||
}
|
||||
|
||||
List<Widget> _policyView(ThemeData theme, AppLocalizations l, HubAuthPolicy p) {
|
||||
final isJwt = p.validator == 'jwt-rs256';
|
||||
return [
|
||||
Row(
|
||||
children: [
|
||||
Icon(
|
||||
Icons.verified_user_outlined,
|
||||
size: 16,
|
||||
color: theme.colorScheme.primary,
|
||||
),
|
||||
const SizedBox(width: ChainSpace.xs),
|
||||
Expanded(
|
||||
child: Text(
|
||||
isJwt ? l.authPolicyValidatorJwt : l.authPolicyValidatorStatic,
|
||||
style: theme.textTheme.bodyMedium?.copyWith(
|
||||
fontWeight: FontWeight.w600,
|
||||
),
|
||||
),
|
||||
),
|
||||
],
|
||||
),
|
||||
if (p.anonymousAllowed) ...[
|
||||
const SizedBox(height: ChainSpace.xs),
|
||||
_hintRow(
|
||||
theme,
|
||||
Icons.warning_amber_outlined,
|
||||
l.authPolicyAnonymous,
|
||||
color: theme.colorScheme.tertiary,
|
||||
),
|
||||
],
|
||||
if (p.tokens.isNotEmpty) ...[
|
||||
const SizedBox(height: ChainSpace.sm),
|
||||
for (final t in p.tokens) _tokenRow(theme, l, t),
|
||||
],
|
||||
if (isJwt && p.jwt != null) ...[
|
||||
const SizedBox(height: ChainSpace.sm),
|
||||
_kvRow(theme, l.authPolicyJwtKeySource, p.jwt!.keySource),
|
||||
_kvRow(
|
||||
theme,
|
||||
l.authPolicyJwtAudience,
|
||||
p.jwt!.audience.isEmpty ? l.authPolicyNotChecked : p.jwt!.audience,
|
||||
),
|
||||
_kvRow(
|
||||
theme,
|
||||
l.authPolicyJwtIssuer,
|
||||
p.jwt!.issuer.isEmpty ? l.authPolicyNotChecked : p.jwt!.issuer,
|
||||
),
|
||||
_kvRow(theme, l.authPolicyJwtScopeClaim, p.jwt!.scopeClaim),
|
||||
],
|
||||
const SizedBox(height: ChainSpace.sm),
|
||||
Text(
|
||||
l.authPolicyEditHint,
|
||||
style: theme.textTheme.bodySmall?.copyWith(
|
||||
color: theme.colorScheme.onSurfaceVariant,
|
||||
),
|
||||
),
|
||||
const SizedBox(height: ChainSpace.xs),
|
||||
Row(
|
||||
children: [
|
||||
OutlinedButton.icon(
|
||||
onPressed: _reloading ? null : _reload,
|
||||
icon: _reloading
|
||||
? const SizedBox(
|
||||
width: 14,
|
||||
height: 14,
|
||||
child: CircularProgressIndicator(strokeWidth: 2),
|
||||
)
|
||||
: const Icon(Icons.refresh, size: 16),
|
||||
label: Text(l.authPolicyReload),
|
||||
),
|
||||
if (_reloadNote != null) ...[
|
||||
const SizedBox(width: ChainSpace.sm),
|
||||
Flexible(
|
||||
child: Text(
|
||||
_reloadNote!,
|
||||
style: theme.textTheme.bodySmall?.copyWith(
|
||||
color: theme.colorScheme.primary,
|
||||
),
|
||||
),
|
||||
),
|
||||
],
|
||||
],
|
||||
),
|
||||
];
|
||||
}
|
||||
|
||||
Widget _tokenRow(ThemeData theme, AppLocalizations l, HubAuthTokenEntry t) {
|
||||
return Padding(
|
||||
padding: const EdgeInsets.only(bottom: ChainSpace.sm),
|
||||
child: Container(
|
||||
width: double.infinity,
|
||||
padding: const EdgeInsets.symmetric(
|
||||
horizontal: ChainSpace.sm,
|
||||
vertical: ChainSpace.xs,
|
||||
),
|
||||
decoration: BoxDecoration(
|
||||
color: theme.colorScheme.surfaceContainerHighest,
|
||||
borderRadius: BorderRadius.circular(ChainRadius.sm),
|
||||
border: Border.all(color: theme.colorScheme.outlineVariant),
|
||||
),
|
||||
child: Column(
|
||||
crossAxisAlignment: CrossAxisAlignment.start,
|
||||
children: [
|
||||
Row(
|
||||
children: [
|
||||
Expanded(
|
||||
child: Text(
|
||||
t.name,
|
||||
style: theme.textTheme.bodyMedium?.copyWith(
|
||||
fontWeight: FontWeight.w600,
|
||||
),
|
||||
),
|
||||
),
|
||||
if (t.rateLimitPerMinute > 0)
|
||||
Text(
|
||||
l.authPolicyRateLimit(t.rateLimitPerMinute),
|
||||
style: theme.textTheme.bodySmall?.copyWith(
|
||||
color: theme.colorScheme.onSurfaceVariant,
|
||||
),
|
||||
),
|
||||
],
|
||||
),
|
||||
const SizedBox(height: 4),
|
||||
Wrap(
|
||||
spacing: 4,
|
||||
runSpacing: 4,
|
||||
children: [
|
||||
for (final s in t.scopes)
|
||||
Container(
|
||||
padding: const EdgeInsets.symmetric(
|
||||
horizontal: 6,
|
||||
vertical: 1,
|
||||
),
|
||||
decoration: BoxDecoration(
|
||||
color: theme.colorScheme.primary.withValues(alpha: 0.10),
|
||||
borderRadius: BorderRadius.circular(ChainRadius.sm),
|
||||
),
|
||||
child: Text(
|
||||
s,
|
||||
style: theme.textTheme.labelSmall?.copyWith(
|
||||
color: theme.colorScheme.primary,
|
||||
),
|
||||
),
|
||||
),
|
||||
],
|
||||
),
|
||||
const SizedBox(height: 4),
|
||||
Row(
|
||||
children: [
|
||||
Icon(
|
||||
t.envSet ? Icons.check_circle : Icons.error_outline,
|
||||
size: 13,
|
||||
color: t.envSet
|
||||
? theme.colorScheme.primary
|
||||
: theme.colorScheme.error,
|
||||
),
|
||||
const SizedBox(width: 4),
|
||||
Expanded(
|
||||
child: Text(
|
||||
t.envSet
|
||||
? l.authPolicyEnvSet(t.tokenEnv)
|
||||
: l.authPolicyEnvMissing(t.tokenEnv),
|
||||
style: theme.textTheme.bodySmall?.copyWith(
|
||||
color: t.envSet
|
||||
? theme.colorScheme.onSurfaceVariant
|
||||
: theme.colorScheme.error,
|
||||
),
|
||||
),
|
||||
),
|
||||
],
|
||||
),
|
||||
],
|
||||
),
|
||||
),
|
||||
);
|
||||
}
|
||||
|
||||
Widget _kvRow(ThemeData theme, String label, String value) {
|
||||
return Padding(
|
||||
padding: const EdgeInsets.only(bottom: 2),
|
||||
child: Row(
|
||||
crossAxisAlignment: CrossAxisAlignment.start,
|
||||
children: [
|
||||
SizedBox(
|
||||
width: 140,
|
||||
child: Text(
|
||||
label,
|
||||
style: theme.textTheme.bodySmall?.copyWith(
|
||||
color: theme.colorScheme.onSurfaceVariant,
|
||||
),
|
||||
),
|
||||
),
|
||||
Expanded(
|
||||
child: SelectableText(
|
||||
value,
|
||||
style: theme.textTheme.bodySmall,
|
||||
),
|
||||
),
|
||||
],
|
||||
),
|
||||
);
|
||||
}
|
||||
|
||||
Widget _hintRow(
|
||||
ThemeData theme,
|
||||
IconData icon,
|
||||
String text, {
|
||||
Color? color,
|
||||
}) {
|
||||
final c = color ?? theme.colorScheme.onSurfaceVariant;
|
||||
return Row(
|
||||
crossAxisAlignment: CrossAxisAlignment.start,
|
||||
children: [
|
||||
Icon(icon, size: 16, color: c),
|
||||
const SizedBox(width: 6),
|
||||
Expanded(
|
||||
child: Text(
|
||||
text,
|
||||
style: theme.textTheme.bodySmall?.copyWith(color: c),
|
||||
),
|
||||
),
|
||||
],
|
||||
);
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue