bbs.profullstack/agentbbs
1
0
Fork 0
mirror of https://github.com/profullstack/agentbbs.git synced 2026-08-13 14:27:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

feat(passwd): self-service password reset across git, mail & chat (#59)

Browse source 
Add a key-gated `ssh passwd@host` route (alias `password@`) that sets ONE
member-chosen password across every service with its own credential:

  - git  (Forgejo)        new forgejo.SetPassword (PATCH /admin/users, clears
                          must_change; EnsureUser first so the account exists)
  - mail (Mailu webmail)  existing mailu.SetPassword
  - chat (IRC/Ergo + The Lounge)  new internal/ircpass package

Because the route authenticates by the member's registered SSH key, it also
serves as the forgot-password path — no old password required.

The BBS runs as a non-root service user, but the Ergo password store and The
Lounge user files are root-owned. internal/ircpass bridges this by shelling out
to scripts/set-irc-password.sh through a narrow sudoers rule (installed by
setup.sh). The new password travels on stdin (a new `set-irc-password.sh
<member> -` form), so it never appears in the process table or sudo's log.

UX: masked entry typed twice (readSecret); no-PTY reads stdin; empty input
generates a strong password and shows it once. Each service leg is independent
and best-effort with a per-service ✓/✗ summary, plus a confirmation email that
never contains the password.

Tests: ircpass (stdin contract + member/password rejection), forgejo.SetPassword,
auth IsPasswdName + reservation. Docs: credentials.md (passwd@ section) + irc.md.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Anthony Ettinger 2026-06-27 03:46:23 -07:00 • committed by GitHub
parent f2bcb7e063
commit 54da317f4e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
11 changed files with 625 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

20
scripts/set-irc-password.sh
View file

@ -8,8 +8,12 @@
#
# Usage:
# set-irc-password.sh <member> [password] # password generated if omitted
# set-irc-password.sh <member> - # read the password from stdin
# set-irc-password.sh --all # provision any member missing one
#
# The "-" form is how the (non-root) BBS passwd@ flow calls this under sudo: the
# password arrives on stdin so it never lands in the process table or sudo's log.
#
# Run as root on the BBS box. The member must already be a BBS member; this only
# sets the secret — membership itself is still gated by /irc-auth.
import sys, os, json, glob, secrets, hashlib, pwd, grp
@ -98,10 +102,22 @@ def main(argv):
print(f"provisioned {len(done)} member(s) that were missing a password")
return 0
member = argv[0]
pw = argv[1] if len(argv) > 1 else secrets.token_urlsafe(9)
from_stdin = len(argv) > 1 and argv[1] == "-"
if from_stdin:
pw = sys.stdin.readline().rstrip("\n")
if not pw:
print("empty password on stdin", file=sys.stderr)
return 2
elif len(argv) > 1:
pw = argv[1]
else:
pw = secrets.token_urlsafe(9)
set_one(member, pw, store)
write_store(store)
print(f"{member}\t{pw}")
# When the password came from stdin (BBS passwd@ flow) the caller already
# knows it — don't echo it back into their captured output. Otherwise print
# it so an operator running this by hand sees the generated/set value.
print(member if from_stdin else f"{member}\t{pw}")
return 0