diff --git a/README.md b/README.md index 031b832..55bf338 100644 --- a/README.md +++ b/README.md @@ -74,6 +74,15 @@ Ops: ```bash ./agentbbs grant-pod alice 12 # manual pod grant (12 months) + +# (re)email verified members their git + mailbox creds/links — preview first, +# then --send. Git: resets each Forgejo account to a fresh one-time password and +# emails the web login link; mailbox: ensures the @mail alias and emails the +# address + webmail link. Needs AGENTBBS_SMTP_*, _FORGEJO_*, _FORWARDEMAIL_* set. +./agentbbs notify-creds # preview, all verified members +./agentbbs notify-creds --send # really send git + mailbox to everyone +./agentbbs notify-creds --git --send # git creds only +./agentbbs notify-creds --user alice --mail --send ``` ## Deploy diff --git a/cmd/agentbbs/main.go b/cmd/agentbbs/main.go index b97fb87..332165b 100644 --- a/cmd/agentbbs/main.go +++ b/cmd/agentbbs/main.go @@ -21,6 +21,8 @@ // agentbbs mint-token NAME issue a WebSocket API token for NAME // agentbbs qrypt-invite NAME mint a qrypt.chat anonymous invite for NAME // agentbbs qrypt-issuer-keygen print a fresh qrypt issuer seed + public key +// agentbbs notify-creds [flags] (re)email verified members their git + +// mailbox creds/links (preview unless --send) package main import ( @@ -146,6 +148,10 @@ func main() { qryptInviteCmd(st, os.Args[2:]) return } + if len(os.Args) > 1 && os.Args[1] == "notify-creds" { + notifyCreds(st, os.Args[2:]) + return + } if len(os.Args) > 1 && os.Args[1] == "qrypt-issuer-keygen" { qryptIssuerKeygen() return @@ -823,15 +829,36 @@ func (a *app) ensurePremium(u *store.User) bool { return false } u.Premium = true - // Create their @host alias forwarding to the email they verified. + // Create their @host alias forwarding to the email they verified, then + // email that address their new mailbox details + webmail link. if a.fe.Configured() && u.Email != "" { if err := a.fe.CreateAlias(u.Name, u.Email); err != nil { log.Error("forwardemail alias", "err", err, "alias", a.fe.Address(u.Name)) + } else if a.mail.Configured() { + if err := a.mail.Send(u.Email, "Your "+a.fe.Domain+" mailbox is ready", + mailWelcomeEmailBody(u.Name, a.fe.Address(u.Name), a.fe.WebmailURL())); err != nil { + log.Error("mail welcome email", "user", u.Name, "err", err) + } } } return true } +// mailWelcomeEmailBody is the plain-text email sent when a member's @host +// mailbox alias is provisioned: their new address and the webmail link. +func mailWelcomeEmailBody(name, address, webmail string) string { + b := "Hi " + name + ",\n\n" + + "Your member mailbox is live:\n\n" + + " " + address + "\n\n" + + "Mail sent there forwards to this address.\n" + if webmail != "" { + b += "\nRead and send from the webmail interface here:\n\n" + + " " + webmail + "\n" + } + b += "\nIf you didn't request this, you can ignore this email.\n" + return b +} + // showPremiumWelcome prints a premium member's perks: their mailbox, the webmail // URL, the in-hub Mail/Tor entries, and custom domains. func (a *app) showPremiumWelcome(s ssh.Session, u store.User) { @@ -982,14 +1009,39 @@ func (a *app) provisionGit(u *store.User) { if u == nil || !a.forgejo.Configured() || u.Name == "" || u.Email == "" { return } - created, err := a.forgejo.EnsureUser(u.Name, u.Email) + created, password, err := a.forgejo.EnsureUser(u.Name, u.Email) if err != nil { log.Error("forgejo provision", "user", u.Name, "err", err) return } - if created { - log.Info("provisioned git account", "user", u.Name, "host", a.forgejo.BaseURL) + if !created { + return } + log.Info("provisioned git account", "user", u.Name, "host", a.forgejo.BaseURL) + // Email the verified address their web sign-in link + one-time password so + // they can log in to the Forgejo UI and create repositories. Best-effort: + // the account already exists, so a mail failure must not block anything. + if a.mail.Configured() { + if err := a.mail.Send(u.Email, "Your git.profullstack.com account is ready", + gitWelcomeEmailBody(u.Name, password, a.forgejo.LoginURL())); err != nil { + log.Error("git welcome email", "user", u.Name, "err", err) + } + } +} + +// gitWelcomeEmailBody is the plain-text email sent when a member's AgentGit +// (Forgejo) account is created: web login link, username, and the one-time +// password they must change on first sign-in. +func gitWelcomeEmailBody(name, password, loginURL string) string { + return "Hi " + name + ",\n\n" + + "Your git account is ready. Sign in to the web interface here:\n\n" + + " " + loginURL + "\n\n" + + " username: " + name + "\n" + + " password: " + password + "\n\n" + + "You'll be asked to set a new password the first time you sign in.\n" + + "After that, click the \"+\" (top right) → \"New Repository\" to create repos.\n\n" + + "Pushing over git uses your registered SSH key — no password needed.\n\n" + + "If you didn't request this, you can ignore this email.\n" } // verifyPage renders the minimal confirmation result page. diff --git a/cmd/agentbbs/notifycreds.go b/cmd/agentbbs/notifycreds.go new file mode 100644 index 0000000..26774ae --- /dev/null +++ b/cmd/agentbbs/notifycreds.go @@ -0,0 +1,155 @@ +package main + +// notify-creds re-emails verified members their account credentials and links: +// - git: their git.profullstack.com (Forgejo/AgentGit) web login URL, username, +// and a freshly reset one-time password (must change on first sign-in). +// - mail: their @ mailbox address and the webmail link, after +// ensuring the forwardemail alias exists. +// +// Both features were added after some accounts already existed, so this lets the +// operator backfill notifications to everyone who never received them. +// +// It is a PREVIEW by default — it scans and prints what it would do without +// touching Forgejo, forwardemail, or sending any email. Pass --send to execute. +// Resetting git passwords clobbers any password a member set themselves, which is +// why it only runs under --send. +// +// agentbbs notify-creds # preview for all verified members +// agentbbs notify-creds --send # really send git + mail to everyone +// agentbbs notify-creds --git --send # git creds only +// agentbbs notify-creds --mail --send # mailbox creds only +// agentbbs notify-creds --user alice,bob --send + +import ( + "flag" + "fmt" + "os" + "strings" + + "github.com/profullstack/agentbbs/internal/forgejo" + "github.com/profullstack/agentbbs/internal/forwardemail" + "github.com/profullstack/agentbbs/internal/mail" + "github.com/profullstack/agentbbs/internal/store" +) + +func notifyCreds(st store.Store, args []string) { + fs := flag.NewFlagSet("notify-creds", flag.ExitOnError) + send := fs.Bool("send", false, "actually reset passwords and send email (default: preview only)") + gitFlag := fs.Bool("git", false, "include git account creds/links") + mailFlag := fs.Bool("mail", false, "include mailbox creds/links") + only := fs.String("user", "", "comma-separated usernames to target (default: all verified)") + limit := fs.Int("limit", 100000, "max accounts to scan") + fs.Parse(args) + + // Default (neither flag given) is both; either flag alone narrows it. + doGit, doMail := *gitFlag, *mailFlag + if !doGit && !doMail { + doGit, doMail = true, true + } + + // Resolve the same configs main() builds for the live server. + smtp := mail.ConfigFromEnv() + fe := forwardemail.ConfigFromEnv() + if fe.Domain == "" { + fe.Domain = env("AGENTBBS_MAIL_DOMAIN", "mail.profullstack.com") + } + fj := forgejo.ConfigFromEnv() + + // Optional username allow-list. + var want map[string]bool + if strings.TrimSpace(*only) != "" { + want = map[string]bool{} + for _, n := range strings.Split(*only, ",") { + if n = strings.ToLower(strings.TrimSpace(n)); n != "" { + want[n] = true + } + } + } + + users, err := st.ListUsers(*limit) + if err != nil { + fmt.Fprintln(os.Stderr, "list users:", err) + os.Exit(1) + } + + if !*send { + fmt.Println("PREVIEW (no email sent, no passwords reset) — re-run with --send to execute") + } + if doGit && !fj.Configured() { + fmt.Fprintln(os.Stderr, "warning: Forgejo not configured (AGENTBBS_FORGEJO_URL/_ADMIN_TOKEN) — skipping git") + doGit = false + } + if doMail && !fe.Configured() { + fmt.Fprintln(os.Stderr, "warning: forwardemail not configured (AGENTBBS_FORWARDEMAIL_API_KEY/_DOMAIN) — skipping mail") + doMail = false + } + if *send && !smtp.Configured() { + fmt.Fprintln(os.Stderr, "error: SMTP not configured (AGENTBBS_SMTP_HOST/_FROM) — cannot send email") + os.Exit(1) + } + if !doGit && !doMail { + fmt.Fprintln(os.Stderr, "nothing to do") + os.Exit(2) + } + + var targeted, gitOK, gitErr, mailOK, mailErr int + for _, u := range users { + if want != nil && !want[strings.ToLower(u.Name)] { + continue + } + if !u.EmailVerified || u.Email == "" || u.Banned { + continue + } + targeted++ + + if doGit { + if !*send { + fmt.Printf(" [git] %-20s -> %s (reset password + email %s)\n", u.Name, fj.LoginURL(), u.Email) + } else { + created, pw, err := fj.EnsureUserReset(u.Name, u.Email) + if err != nil { + gitErr++ + fmt.Fprintf(os.Stderr, " [git] %s: %v\n", u.Name, err) + } else if err := smtp.Send(u.Email, "Your git.profullstack.com account is ready", + gitWelcomeEmailBody(u.Name, pw, fj.LoginURL())); err != nil { + gitErr++ + fmt.Fprintf(os.Stderr, " [git] %s: send: %v\n", u.Name, err) + } else { + gitOK++ + verb := "reset+emailed" + if created { + verb = "created+emailed" + } + fmt.Printf(" [git] %-20s %s -> %s\n", u.Name, verb, u.Email) + } + } + } + + if doMail { + addr := fe.Address(u.Name) + if !*send { + fmt.Printf(" [mail] %-20s -> %s (ensure alias + email %s)\n", u.Name, addr, u.Email) + } else { + if err := fe.CreateAlias(u.Name, u.Email); err != nil { + mailErr++ + fmt.Fprintf(os.Stderr, " [mail] %s: alias: %v\n", u.Name, err) + } else if err := smtp.Send(u.Email, "Your "+fe.Domain+" mailbox is ready", + mailWelcomeEmailBody(u.Name, addr, fe.WebmailURL())); err != nil { + mailErr++ + fmt.Fprintf(os.Stderr, " [mail] %s: send: %v\n", u.Name, err) + } else { + mailOK++ + fmt.Printf(" [mail] %-20s ensured+emailed -> %s\n", u.Name, addr) + } + } + } + } + + fmt.Printf("\n%d verified account(s) targeted.\n", targeted) + if *send { + fmt.Printf("git: %d sent, %d failed\nmail: %d sent, %d failed\n", gitOK, gitErr, mailOK, mailErr) + if gitErr > 0 || mailErr > 0 { + os.Exit(1) + } + } +} diff --git a/internal/forgejo/forgejo.go b/internal/forgejo/forgejo.go index 9450bde..a235ab8 100644 --- a/internal/forgejo/forgejo.go +++ b/internal/forgejo/forgejo.go @@ -47,26 +47,34 @@ func ConfigFromEnv() Config { // Configured reports whether accounts can actually be provisioned. func (c Config) Configured() bool { return c.BaseURL != "" && c.Token != "" } +// LoginURL is the web sign-in page members are pointed at in their welcome +// email, e.g. https://git.profullstack.com/user/login. +func (c Config) LoginURL() string { + return strings.TrimRight(c.BaseURL, "/") + "/user/login" +} + // EnsureUser creates a Forgejo account for username (forwarding to email) if it -// does not already exist. It is idempotent: created is false when the account -// was already present. New accounts are created with must_change_password — git -// access is via SSH keys, so the generated password is never used interactively. -func (c Config) EnsureUser(username, email string) (created bool, err error) { +// does not already exist. It is idempotent: created is false (and password "") +// when the account was already present. New accounts get a generated temporary +// password with must_change_password set; the caller emails it to the member so +// they can sign in to the web UI once and set their own. Git over SSH still uses +// their registered key. +func (c Config) EnsureUser(username, email string) (created bool, password string, err error) { if !c.Configured() { - return false, fmt.Errorf("forgejo not configured") + return false, "", fmt.Errorf("forgejo not configured") } exists, err := c.userExists(username) if err != nil { - return false, err + return false, "", err } if exists { - return false, nil + return false, "", nil } pw, err := randomPassword() if err != nil { - return false, err + return false, "", err } body, _ := json.Marshal(map[string]any{ "username": username, @@ -76,12 +84,62 @@ func (c Config) EnsureUser(username, email string) (created bool, err error) { }) status, resp, err := c.do(http.MethodPost, "/admin/users", body) if err != nil { - return false, err + return false, "", err } if status < 200 || status >= 300 { - return false, fmt.Errorf("forgejo create user %q: %d: %s", username, status, truncate(resp, 200)) + return false, "", fmt.Errorf("forgejo create user %q: %d: %s", username, status, truncate(resp, 200)) } - return true, nil + return true, pw, nil +} + +// EnsureUserReset creates the account if missing, or resets an existing +// account's password to a fresh temporary one with must_change_password set. +// Unlike EnsureUser it always returns a usable password — even for accounts +// that already exist (whose original one-time password we no longer hold). +// created reports whether the account was newly made. Used by the notify-creds +// re-send so every member receives working web credentials. +func (c Config) EnsureUserReset(username, email string) (created bool, password string, err error) { + if !c.Configured() { + return false, "", fmt.Errorf("forgejo not configured") + } + exists, err := c.userExists(username) + if err != nil { + return false, "", err + } + pw, err := randomPassword() + if err != nil { + return false, "", err + } + if !exists { + body, _ := json.Marshal(map[string]any{ + "username": username, + "email": email, + "password": pw, + "must_change_password": true, + }) + status, resp, err := c.do(http.MethodPost, "/admin/users", body) + if err != nil { + return false, "", err + } + if status < 200 || status >= 300 { + return false, "", fmt.Errorf("forgejo create user %q: %d: %s", username, status, truncate(resp, 200)) + } + return true, pw, nil + } + // Reset the existing account's password. login_name/source_id are optional + // for local accounts in current Forgejo, so we send only the fields we change. + body, _ := json.Marshal(map[string]any{ + "password": pw, + "must_change_password": true, + }) + status, resp, err := c.do(http.MethodPatch, "/admin/users/"+username, body) + if err != nil { + return false, "", err + } + if status < 200 || status >= 300 { + return false, "", fmt.Errorf("forgejo reset user %q: %d: %s", username, status, truncate(resp, 200)) + } + return false, pw, nil } // userExists reports whether a Forgejo user with this name is present. diff --git a/internal/forgejo/forgejo_test.go b/internal/forgejo/forgejo_test.go index 8553f10..77a9b85 100644 --- a/internal/forgejo/forgejo_test.go +++ b/internal/forgejo/forgejo_test.go @@ -20,7 +20,7 @@ func TestConfiguredRequiresURLAndToken(t *testing.T) { } func TestEnsureUserNoOpWhenUnconfigured(t *testing.T) { - if _, err := (Config{}).EnsureUser("alice", "a@x.com"); err == nil { + if _, _, err := (Config{}).EnsureUser("alice", "a@x.com"); err == nil { t.Fatal("expected error when unconfigured") } } @@ -52,13 +52,19 @@ func TestEnsureUserCreatesWhenMissing(t *testing.T) { defer srv.Close() c := Config{BaseURL: srv.URL, Token: "secret"} - created, err := c.EnsureUser("alice", "a@x.com") + created, password, err := c.EnsureUser("alice", "a@x.com") if err != nil { t.Fatalf("EnsureUser: %v", err) } if !created { t.Fatal("expected created=true") } + if password == "" { + t.Fatal("expected a generated temporary password for a new account") + } + if password != got.body["password"] { + t.Errorf("returned password %q does not match the one sent to forgejo %v", password, got.body["password"]) + } if !got.lookup || !got.create { t.Fatalf("expected lookup+create, got %+v", got) } @@ -70,6 +76,78 @@ func TestEnsureUserCreatesWhenMissing(t *testing.T) { } } +func TestEnsureUserResetCreatesWhenMissing(t *testing.T) { + var posted bool + srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + switch { + case r.Method == http.MethodGet && r.URL.Path == "/api/v1/users/alice": + w.WriteHeader(http.StatusNotFound) + case r.Method == http.MethodPost && r.URL.Path == "/api/v1/admin/users": + posted = true + w.WriteHeader(http.StatusCreated) + _, _ = w.Write([]byte(`{"id":1}`)) + default: + t.Errorf("unexpected %s %s", r.Method, r.URL.Path) + w.WriteHeader(http.StatusTeapot) + } + })) + defer srv.Close() + + c := Config{BaseURL: srv.URL, Token: "secret"} + created, password, err := c.EnsureUserReset("alice", "a@x.com") + if err != nil { + t.Fatalf("EnsureUserReset: %v", err) + } + if !created || password == "" || !posted { + t.Fatalf("expected created+password+POST, got created=%v pw=%q posted=%v", created, password, posted) + } +} + +func TestEnsureUserResetPatchesWhenExists(t *testing.T) { + var patched bool + var body map[string]any + srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + switch { + case r.Method == http.MethodGet && r.URL.Path == "/api/v1/users/alice": + w.WriteHeader(http.StatusOK) + _, _ = w.Write([]byte(`{"id":1}`)) + case r.Method == http.MethodPatch && r.URL.Path == "/api/v1/admin/users/alice": + patched = true + _ = json.NewDecoder(r.Body).Decode(&body) + w.WriteHeader(http.StatusOK) + _, _ = w.Write([]byte(`{"id":1}`)) + case r.Method == http.MethodPost: + t.Error("must not create when the account already exists") + w.WriteHeader(http.StatusTeapot) + default: + t.Errorf("unexpected %s %s", r.Method, r.URL.Path) + w.WriteHeader(http.StatusTeapot) + } + })) + defer srv.Close() + + c := Config{BaseURL: srv.URL, Token: "secret"} + created, password, err := c.EnsureUserReset("alice", "a@x.com") + if err != nil { + t.Fatalf("EnsureUserReset: %v", err) + } + if created { + t.Fatal("expected created=false for existing account") + } + if password == "" { + t.Fatal("expected a fresh password even for an existing account") + } + if !patched { + t.Fatal("expected a PATCH to reset the password") + } + if body["password"] != password { + t.Errorf("returned password %q does not match the one sent %v", password, body["password"]) + } + if body["must_change_password"] != true { + t.Errorf("expected must_change_password=true, got %v", body["must_change_password"]) + } +} + func TestEnsureUserNoOpWhenExists(t *testing.T) { created := false srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { @@ -82,13 +160,16 @@ func TestEnsureUserNoOpWhenExists(t *testing.T) { defer srv.Close() c := Config{BaseURL: srv.URL, Token: "secret"} - got, err := c.EnsureUser("alice", "a@x.com") + got, password, err := c.EnsureUser("alice", "a@x.com") if err != nil { t.Fatalf("EnsureUser: %v", err) } if got { t.Fatal("expected created=false for existing user") } + if password != "" { + t.Fatal("expected empty password when account already exists") + } if created { t.Fatal("must not POST when the user already exists") }