Ilker ManapandClaude Opus 5
3ed211b2f4
Issuing a key worked; getting it to the person it was issued for did not. The operator had a secret on their terminal and no way to send it that did not leave a bearer credential in a chat log forever. `keys create --claim` prints a link instead. GET shows a button and consumes nothing; POST reveals the key and burns the link. That split is not politeness — chat clients, mail scanners and link previewers fetch URLs the moment they are posted, so a GET that consumed the claim would mean the first thing to unfurl the link destroys the key before anyone reads it. A pending claim has to hold the key somewhere, which would otherwise put a working credential in the database and undo what hashing bought. So the key is sealed with a key derived from the link's own token, and the token is never stored — only its hash. A database leak yields two useless hashes and a blob nothing in the database can open. HKDF rather than the raw token, so the value used for lookup can never become the value that decrypts. Consuming is one UPDATE moving claimed_at off NULL, so two people opening the same link produce one key rather than two copies. A used link, an expired one and a token that was never real all render identically, because saying which confirms that a token was once valid. The page is no-store, no-referrer and noindex: the URL is itself the credential. `GET /me` reports a key's own limits and spend, so nobody has to ask an operator to read a dashboard they cannot reach. Outside /v1, because it is not part of the OpenAI API. docs/onboarding.md is written for whoever operates this, including the parts that are deliberately absent — no self-service, no SSO, and why. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
99 lines
2.7 KiB
Go
99 lines
2.7 KiB
Go
package web
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"log/slog"
|
|
"net/http"
|
|
"time"
|
|
|
|
"gitea.mynodes.xyz/ilker/llmgw/internal/store"
|
|
)
|
|
|
|
// ClaimData is the one-time key delivery page.
|
|
type ClaimData struct {
|
|
Secret string
|
|
Gone bool
|
|
Message string
|
|
ExpiresAt string
|
|
BaseURL string
|
|
Version string
|
|
Now string
|
|
}
|
|
|
|
// Claims is the store half of the claim flow.
|
|
type Claims interface {
|
|
PeekClaim(ctx context.Context, token string) (store.Claim, error)
|
|
ConsumeClaim(ctx context.Context, token string) (string, error)
|
|
}
|
|
|
|
// Claim serves the one-time link an operator sends to a new user.
|
|
//
|
|
// GET shows a button and consumes nothing; POST reveals the key and burns the
|
|
// link. That split is not politeness — chat clients, mail scanners and link
|
|
// previewers fetch URLs the moment they are posted, so a GET that consumed the
|
|
// claim would mean the first thing to unfurl the link destroys the key before
|
|
// anyone reads it.
|
|
//
|
|
// The page is served without a key, because the person opening it is the one
|
|
// who does not have one yet. What protects it is the token: 256 random bits,
|
|
// single use, and short-lived.
|
|
func Claim(claims Claims, version string, log *slog.Logger) http.HandlerFunc {
|
|
if log == nil {
|
|
log = slog.Default()
|
|
}
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
token := r.PathValue("token")
|
|
d := ClaimData{
|
|
BaseURL: baseURL(r), Version: version,
|
|
Now: time.Now().UTC().Format(time.RFC3339),
|
|
}
|
|
// A key on a page is not something to leave in a proxy or a browser
|
|
// cache, and not something search engines should ever see.
|
|
w.Header().Set("Cache-Control", "no-store, no-cache, must-revalidate, private")
|
|
w.Header().Set("Referrer-Policy", "no-referrer")
|
|
w.Header().Set("X-Robots-Tag", "noindex, nofollow")
|
|
|
|
if token == "" {
|
|
gone(w, &d)
|
|
return
|
|
}
|
|
|
|
if r.Method == http.MethodGet {
|
|
c, err := claims.PeekClaim(r.Context(), token)
|
|
if err != nil {
|
|
if !errors.Is(err, store.ErrClaimed) {
|
|
log.Warn("could not read a claim", "err", err)
|
|
}
|
|
gone(w, &d)
|
|
return
|
|
}
|
|
d.ExpiresAt = c.ExpiresAt.Format(time.RFC1123)
|
|
render(w, "claim", d)
|
|
return
|
|
}
|
|
|
|
secret, err := claims.ConsumeClaim(r.Context(), token)
|
|
if err != nil {
|
|
if !errors.Is(err, store.ErrClaimed) {
|
|
log.Warn("could not consume a claim", "err", err)
|
|
}
|
|
gone(w, &d)
|
|
return
|
|
}
|
|
log.Info("a key was collected")
|
|
d.Secret = secret
|
|
render(w, "claim", d)
|
|
}
|
|
}
|
|
|
|
// gone renders the one answer given for a used link, an expired one, and a
|
|
// token that was never real. Distinguishing them would confirm that a token was
|
|
// once valid.
|
|
func gone(w http.ResponseWriter, d *ClaimData) {
|
|
d.Gone = true
|
|
d.Message = store.ErrClaimed.Error()
|
|
w.WriteHeader(http.StatusGone)
|
|
render(w, "claim", *d)
|
|
}
|