feat(aether): initial commit – self-hosted Cloud, Phasen 1–7
Go-Backend (chi, pgx, golang-migrate) + React/TS-Frontend als PWA. Enthalten: Auth inkl. OIDC, Dateien mit Versionen und Papierkorb, Freigaben (Links + intern), WebDAV, Gruppenordner, Admin/Theming, Volltextsuche mit OCR, eigener PDF-Betrachter und WOPI-Office (Collabora/OnlyOffice). Nicht im Repo: deploy/.env (Sitzungsschlüssel, DB- und Admin-Passwort) sowie alle Daten- und Build-Verzeichnisse – siehe .gitignore. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
HoneyandClaude Opus 5 committed
commit
31a027c93a
225 files changed
+38042
No files matched your search
@@ -0,0 +1,102 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"sync"
|
||||
"time"
|
||||
)
|
||||
|
||||
// FailureLimiter throttles repeated authentication failures per key (usually a
|
||||
// client IP).
|
||||
//
|
||||
// Deliberately not a request limiter: a WebDAV sync client legitimately sends
|
||||
// hundreds of requests per minute, so capping requests would break normal use.
|
||||
// Only failed logins count, and a single success clears the record — which
|
||||
// leaves honest clients untouched while a password guesser runs out of tries.
|
||||
type FailureLimiter struct {
|
||||
mu sync.Mutex
|
||||
entries map[string]*failureEntry
|
||||
|
||||
maxFailures int
|
||||
window time.Duration
|
||||
lockout time.Duration
|
||||
lastSweep time.Time
|
||||
}
|
||||
|
||||
type failureEntry struct {
|
||||
count int
|
||||
windowStart time.Time
|
||||
lockedUntil time.Time
|
||||
}
|
||||
|
||||
// NewFailureLimiter allows maxFailures within window; exceeding that locks the
|
||||
// key out for lockout.
|
||||
func NewFailureLimiter(maxFailures int, window, lockout time.Duration) *FailureLimiter {
|
||||
return &FailureLimiter{
|
||||
entries: make(map[string]*failureEntry),
|
||||
maxFailures: maxFailures,
|
||||
window: window,
|
||||
lockout: lockout,
|
||||
lastSweep: time.Now(),
|
||||
}
|
||||
}
|
||||
|
||||
// Allowed reports whether the key may attempt authentication. The second return
|
||||
// value is how long the caller must wait, for a Retry-After header.
|
||||
func (l *FailureLimiter) Allowed(key string) (bool, time.Duration) {
|
||||
l.mu.Lock()
|
||||
defer l.mu.Unlock()
|
||||
|
||||
e, ok := l.entries[key]
|
||||
if !ok {
|
||||
return true, 0
|
||||
}
|
||||
now := time.Now()
|
||||
if now.Before(e.lockedUntil) {
|
||||
return false, e.lockedUntil.Sub(now)
|
||||
}
|
||||
return true, 0
|
||||
}
|
||||
|
||||
// Fail records a failed attempt and locks the key out once the limit is hit.
|
||||
func (l *FailureLimiter) Fail(key string) {
|
||||
l.mu.Lock()
|
||||
defer l.mu.Unlock()
|
||||
|
||||
now := time.Now()
|
||||
l.sweepLocked(now)
|
||||
|
||||
e, ok := l.entries[key]
|
||||
if !ok || now.Sub(e.windowStart) > l.window {
|
||||
l.entries[key] = &failureEntry{count: 1, windowStart: now}
|
||||
return
|
||||
}
|
||||
e.count++
|
||||
if e.count >= l.maxFailures {
|
||||
e.lockedUntil = now.Add(l.lockout)
|
||||
// Restart the window so the lockout does not extend forever on the
|
||||
// retries that arrive while it is already active.
|
||||
e.count = 0
|
||||
e.windowStart = now
|
||||
}
|
||||
}
|
||||
|
||||
// Reset clears the record after a successful authentication.
|
||||
func (l *FailureLimiter) Reset(key string) {
|
||||
l.mu.Lock()
|
||||
defer l.mu.Unlock()
|
||||
delete(l.entries, key)
|
||||
}
|
||||
|
||||
// sweepLocked drops stale records so the map cannot grow without bound from
|
||||
// one-off failures across many addresses. Caller must hold the mutex.
|
||||
func (l *FailureLimiter) sweepLocked(now time.Time) {
|
||||
if now.Sub(l.lastSweep) < l.window {
|
||||
return
|
||||
}
|
||||
l.lastSweep = now
|
||||
for k, e := range l.entries {
|
||||
if now.After(e.lockedUntil) && now.Sub(e.windowStart) > l.window {
|
||||
delete(l.entries, k)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,63 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func TestFailureLimiterLocksOutAfterLimit(t *testing.T) {
|
||||
l := NewFailureLimiter(3, time.Minute, time.Minute)
|
||||
|
||||
for i := 0; i < 2; i++ {
|
||||
l.Fail("10.0.0.1")
|
||||
if allowed, _ := l.Allowed("10.0.0.1"); !allowed {
|
||||
t.Fatalf("locked out after %d of 3 failures", i+1)
|
||||
}
|
||||
}
|
||||
|
||||
l.Fail("10.0.0.1")
|
||||
allowed, retryAfter := l.Allowed("10.0.0.1")
|
||||
if allowed {
|
||||
t.Fatal("still allowed after reaching the failure limit")
|
||||
}
|
||||
if retryAfter <= 0 {
|
||||
t.Fatalf("retryAfter = %v, want positive so Retry-After is usable", retryAfter)
|
||||
}
|
||||
}
|
||||
|
||||
// Ein Sync-Client darf nicht unter fremden Fehlversuchen leiden: Erfolg räumt
|
||||
// den Zähler weg.
|
||||
func TestFailureLimiterResetOnSuccess(t *testing.T) {
|
||||
l := NewFailureLimiter(2, time.Minute, time.Minute)
|
||||
|
||||
l.Fail("10.0.0.2")
|
||||
l.Reset("10.0.0.2")
|
||||
l.Fail("10.0.0.2")
|
||||
|
||||
if allowed, _ := l.Allowed("10.0.0.2"); !allowed {
|
||||
t.Fatal("locked out although a success cleared the earlier failure")
|
||||
}
|
||||
}
|
||||
|
||||
func TestFailureLimiterIsolatesKeys(t *testing.T) {
|
||||
l := NewFailureLimiter(1, time.Minute, time.Minute)
|
||||
l.Fail("10.0.0.3")
|
||||
|
||||
if allowed, _ := l.Allowed("10.0.0.4"); !allowed {
|
||||
t.Fatal("a different address was locked out")
|
||||
}
|
||||
}
|
||||
|
||||
// Nach Ablauf des Fensters zählt der Versuch nicht mehr mit – sonst summierten
|
||||
// sich Vertipper über Wochen zu einer Sperre.
|
||||
func TestFailureLimiterWindowExpires(t *testing.T) {
|
||||
l := NewFailureLimiter(2, 10*time.Millisecond, time.Minute)
|
||||
|
||||
l.Fail("10.0.0.5")
|
||||
time.Sleep(20 * time.Millisecond)
|
||||
l.Fail("10.0.0.5")
|
||||
|
||||
if allowed, _ := l.Allowed("10.0.0.5"); !allowed {
|
||||
t.Fatal("locked out although the first failure was outside the window")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,43 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"time"
|
||||
|
||||
"github.com/rs/zerolog"
|
||||
"github.com/rs/zerolog/log"
|
||||
)
|
||||
|
||||
func Logger(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
start := time.Now()
|
||||
ww := &responseWriter{ResponseWriter: w, status: http.StatusOK}
|
||||
|
||||
next.ServeHTTP(ww, r)
|
||||
|
||||
level := zerolog.InfoLevel
|
||||
if ww.status >= 500 {
|
||||
level = zerolog.ErrorLevel
|
||||
} else if ww.status >= 400 {
|
||||
level = zerolog.WarnLevel
|
||||
}
|
||||
|
||||
log.WithLevel(level).
|
||||
Str("method", r.Method).
|
||||
Str("path", r.URL.Path).
|
||||
Int("status", ww.status).
|
||||
Dur("duration", time.Since(start)).
|
||||
Str("ip", r.RemoteAddr).
|
||||
Msg("")
|
||||
})
|
||||
}
|
||||
|
||||
type responseWriter struct {
|
||||
http.ResponseWriter
|
||||
status int
|
||||
}
|
||||
|
||||
func (rw *responseWriter) WriteHeader(status int) {
|
||||
rw.status = status
|
||||
rw.ResponseWriter.WriteHeader(status)
|
||||
}
|
||||
@@ -0,0 +1,75 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"context"
|
||||
"net"
|
||||
"net/http"
|
||||
"strings"
|
||||
|
||||
"aether/pkg/config"
|
||||
)
|
||||
|
||||
type contextKey int
|
||||
|
||||
const (
|
||||
keyRealIP contextKey = iota
|
||||
keyIsHTTPS contextKey = iota
|
||||
)
|
||||
|
||||
// RealIP returns the real client IP stored in context by TrustedProxy middleware.
|
||||
// Falls back to r.RemoteAddr if the middleware was not applied.
|
||||
func RealIP(r *http.Request) string {
|
||||
if ip, ok := r.Context().Value(keyRealIP).(string); ok && ip != "" {
|
||||
return ip
|
||||
}
|
||||
host, _, err := net.SplitHostPort(r.RemoteAddr)
|
||||
if err != nil {
|
||||
return r.RemoteAddr
|
||||
}
|
||||
return host
|
||||
}
|
||||
|
||||
// IsHTTPS reports whether the original client connection was HTTPS,
|
||||
// either directly or via a trusted proxy's X-Forwarded-Proto header.
|
||||
func IsHTTPS(r *http.Request) bool {
|
||||
if v, ok := r.Context().Value(keyIsHTTPS).(bool); ok {
|
||||
return v
|
||||
}
|
||||
return r.TLS != nil
|
||||
}
|
||||
|
||||
// TrustedProxy extracts the real client IP and protocol from X-Forwarded-*
|
||||
// headers, but only when the immediate peer is in the trusted proxy list.
|
||||
// Untrusted peers never override RemoteAddr.
|
||||
func TrustedProxy(cfg *config.Config) func(http.Handler) http.Handler {
|
||||
return func(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
remoteHost, _, err := net.SplitHostPort(r.RemoteAddr)
|
||||
if err != nil {
|
||||
remoteHost = r.RemoteAddr
|
||||
}
|
||||
peerIP := net.ParseIP(remoteHost)
|
||||
|
||||
realIP := remoteHost
|
||||
isHTTPS := r.TLS != nil
|
||||
|
||||
if peerIP != nil && cfg.IsTrustedProxy(peerIP) {
|
||||
if xfp := r.Header.Get("X-Forwarded-Proto"); xfp != "" {
|
||||
isHTTPS = strings.EqualFold(strings.TrimSpace(xfp), "https")
|
||||
}
|
||||
// X-Forwarded-For may be a comma-separated chain; the leftmost
|
||||
// entry is the original client (set by the first proxy).
|
||||
if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
|
||||
parts := strings.SplitN(xff, ",", 2)
|
||||
if candidate := strings.TrimSpace(parts[0]); candidate != "" {
|
||||
realIP = candidate
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
ctx := context.WithValue(r.Context(), keyRealIP, realIP)
|
||||
ctx = context.WithValue(ctx, keyIsHTTPS, isHTTPS)
|
||||
next.ServeHTTP(w, r.WithContext(ctx))
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,55 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// SecurityHeaders adds security headers that the app controls.
|
||||
// HSTS is intentionally omitted — it belongs on the edge reverse proxy.
|
||||
//
|
||||
// frameSrc nennt zusätzliche Ursprünge, die in einem Rahmen erscheinen dürfen.
|
||||
// Gebraucht für den Office-Server: Seine Bedienoberfläche läuft in einem
|
||||
// <iframe>, und `default-src 'self'` deckt auch `frame-src` ab – ohne
|
||||
// Ausnahme blockt der Browser sie, noch bevor eine Anfrage hinausgeht.
|
||||
// Gemessen als „Framing 'http://…:9980/' violates … default-src 'self'".
|
||||
//
|
||||
// Bewusst **nur der eine konfigurierte Ursprung** und kein Platzhalter: Die
|
||||
// Ausnahme soll so schmal sein wie der Anlass.
|
||||
func SecurityHeaders(frameSrc ...string) func(http.Handler) http.Handler {
|
||||
frame := "frame-src 'self'"
|
||||
for _, raw := range frameSrc {
|
||||
if origin := originOf(raw); origin != "" {
|
||||
frame += " " + origin
|
||||
}
|
||||
}
|
||||
csp := "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; " +
|
||||
"img-src 'self' data: blob:; " + frame
|
||||
|
||||
return func(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
h := w.Header()
|
||||
h.Set("X-Content-Type-Options", "nosniff")
|
||||
h.Set("X-Frame-Options", "DENY")
|
||||
h.Set("Referrer-Policy", "strict-origin-when-cross-origin")
|
||||
h.Set("Content-Security-Policy", csp)
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// originOf reduziert eine Adresse auf Schema und Host. Ein Pfad in einer
|
||||
// CSP-Quelle wäre nicht falsch, aber enger als gemeint – und ein Tippfehler
|
||||
// darin fiele erst auf, wenn der Rahmen leer bleibt.
|
||||
func originOf(raw string) string {
|
||||
raw = strings.TrimSpace(raw)
|
||||
if raw == "" {
|
||||
return ""
|
||||
}
|
||||
u, err := url.Parse(raw)
|
||||
if err != nil || u.Scheme == "" || u.Host == "" {
|
||||
return ""
|
||||
}
|
||||
return u.Scheme + "://" + u.Host
|
||||
}
|
||||
Reference in new issue
Block a user