bbs.profullstack/agentbbs
1
0
Fork 0
mirror of https://github.com/profullstack/agentbbs.git synced 2026-08-13 14:27:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Email members their git + mailbox credentials on provisioning (#57)

Browse source 
* feat(files): SFTP member storage — private workspaces + shared public area + mgmt TUI

Implements M4 (Files). A fully virtual Go SFTP server (pkg/sftp + crypto/ssh,
no OS users) wired as an "sftp" subsystem on the existing :22 wish listener, so
members reach their files with their login key:

    sftp files@bbs.profullstack.com     # scp/rsync ride the same endpoint

Identity is the SSH key (the username is conventional/ignored). Two areas per
session: a private, quota-limited /me workspace and a single shared public file
area /public (old-school BBS file area; world-read, members-only write by
default, operator-moderated). This reverses the old NG1 "no sharing" boundary in
favour of one sanctioned, inspectable sharing surface (PRD §9.3 amended).

internal/files:
- backend.go  service, layout, quota/usage, live-session registry, operator API
- fs.go       per-session virtual FS; resolve() is the single security
              chokepoint (area confinement + symlink-escape guard) + pkg/sftp
              request handlers
- server.go   subsystem handler: key auth -> member session -> request server,
              with byte metering and force-disconnect
- tui.go      in-BBS member browser (hub plugin "Files")
- admin.go    operator management TUI: sessions, workspaces/quotas, public area

Operator console: ssh sftp@<host> (allowlist-gated; sftpadmin@/filesadmin@
aliases) — list/disconnect sessions, set per-user quotas, revoke SFTP access,
toggle public write, moderate the public area.

store: files_access (per-user quota override + revoked) and files_settings
(public-write mode) tables + methods. main.go wiring guarded by AGENTBBS_FILES
(+ AGENTBBS_FILES_QUOTA_MB, default 1 GiB). Route names reserved.

Tests (incl -race): path traversal/confinement, symlink-escape rejection,
public-write ACL, quota enforcement, usage accounting, and an end-to-end run
against a real SFTP client. Docs: docs/files.md; PRD §5.3/§5.3.1/§9.3 + README
updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Add notify-creds subcommand to (re)email members git + mailbox creds

`agentbbs notify-creds` backfills credential emails to verified members
who signed up before the git/mailbox welcome emails existed.

- git (all verified): forgejo.EnsureUserReset resets each account to a
  fresh one-time password (must-change) and emails the web login link,
  username, and password. New method since the original one-time
  password is not recoverable for existing accounts.
- mailbox (all verified): ensures the forwardemail alias and emails the
  address + webmail link.
- Preview by default; --send executes. --git/--mail/--user filters.
  Refuses --send without SMTP; warns+skips when Forgejo/forwardemail
  are unconfigured.

Also folds in the welcome-email functions (gitWelcomeEmailBody,
mailWelcomeEmailBody, EnsureUser password return, provisionGit/
ensurePremium sends) that this builds on. README ops + forgejo tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Anthony Ettinger 2026-06-23 03:48:11 -07:00 • committed by GitHub
parent 7c794dcf79
commit ce0758b0ec
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
5 changed files with 356 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

9
README.md
View file

@ -74,6 +74,15 @@ Ops:
```bash
./agentbbs grant-pod alice 12 # manual pod grant (12 months)
# (re)email verified members their git + mailbox creds/links — preview first,
# then --send. Git: resets each Forgejo account to a fresh one-time password and
# emails the web login link; mailbox: ensures the @mail alias and emails the
# address + webmail link. Needs AGENTBBS_SMTP_*, _FORGEJO_*, _FORWARDEMAIL_* set.
./agentbbs notify-creds # preview, all verified members
./agentbbs notify-creds --send # really send git + mailbox to everyone
./agentbbs notify-creds --git --send # git creds only
./agentbbs notify-creds --user alice --mail --send
```
## Deploy

45
cmd/agentbbs/main.go
View file

@ -24,6 +24,8 @@
// agentbbs mint-token NAME issue a WebSocket API token for NAME
// agentbbs qrypt-invite NAME mint a qrypt.chat anonymous invite for NAME
// agentbbs qrypt-issuer-keygen print a fresh qrypt issuer seed + public key
// agentbbs notify-creds [flags] (re)email verified members their git +
// mailbox creds/links (preview unless --send)
package main
import (
@ -155,6 +157,10 @@ func main() {
qryptInviteCmd(st, os.Args[2:])
return
}
if len(os.Args) > 1 && os.Args[1] == "notify-creds" {
notifyCreds(st, os.Args[2:])
return
}
if len(os.Args) > 1 && os.Args[1] == "qrypt-issuer-keygen" {
qryptIssuerKeygen()
return
@ -880,6 +886,22 @@ func (a *app) ensurePremium(u *store.User) bool {
return true
}
// mailWelcomeEmailBody is the plain-text email sent when a member's @host
// mailbox alias is provisioned: their new address and the webmail link. Used by
// the `notify-creds` backfill command (see notifycreds.go).
func mailWelcomeEmailBody(name, address, webmail string) string {
b := "Hi " + name + ",\n\n" +
"Your member mailbox is live:\n\n" +
" " + address + "\n\n" +
"Mail sent there forwards to this address.\n"
if webmail != "" {
b += "\nRead and send from the webmail interface here:\n\n" +
" " + webmail + "\n"
}
b += "\nIf you didn't request this, you can ignore this email.\n"
return b
}
// showPremiumWelcome prints a premium member's perks: custom domains and the
// in-hub Tor shell. (Email is free for all members — see the join@ summary.)
func (a *app) showPremiumWelcome(s ssh.Session, u store.User) {
@ -1028,14 +1050,15 @@ func (a *app) provisionGit(u *store.User, pubKey string) {
if u == nil || !a.forgejo.Configured() || u.Name == "" || u.Email == "" {
return
}
created, err := a.forgejo.EnsureUser(u.Name, u.Email)
created, password, err := a.forgejo.EnsureUser(u.Name, u.Email)
if err != nil {
log.Error("forgejo provision", "user", u.Name, "err", err)
return
}
if created {
log.Info("provisioned git account", "user", u.Name, "host", a.forgejo.BaseURL)
if !created {
return
}
log.Info("provisioned git account", "user", u.Name, "host", a.forgejo.BaseURL)
// Register the BBS SSH key so the member can push with the same key they sign
// in with. No-op when called without a session key (e.g. the web verify flow).
if pubKey != "" {
@ -1045,11 +1068,21 @@ func (a *app) provisionGit(u *store.User, pubKey string) {
log.Info("registered git ssh key", "user", u.Name)
}
}
// Email the verified address their web sign-in link + one-time password so
// they can log in to the Forgejo UI and create repositories. Best-effort:
// the account already exists, so a mail failure must not block anything.
if a.mail.Configured() {
if err := a.mail.Send(u.Email, "Your git.profullstack.com account is ready",
gitWelcomeEmailBody(u.Name, password, a.forgejo.LoginURL())); err != nil {
log.Error("git welcome email", "user", u.Name, "err", err)
}
}
}
// gitWelcomeEmailBody is the plain-text email sent by the notify-creds ops
// command when a member's AgentGit (Forgejo) account is created or reset: web
// login link, username, and the one-time password to change on first sign-in.
// gitWelcomeEmailBody is the plain-text email sent when a member's AgentGit
// (Forgejo) account is created or reset — on provisioning and by the
// notify-creds ops command: web login link, username, and the one-time password
// they must change on first sign-in.
func gitWelcomeEmailBody(name, password, loginURL string) string {
return "Hi " + name + ",\n\n" +
"Your git account is ready. Sign in to the web interface here:\n\n" +

155
cmd/agentbbs/notifycreds.go Normal file
View file

@ -0,0 +1,155 @@
package main
// notify-creds re-emails verified members their account credentials and links:
// - git: their git.profullstack.com (Forgejo/AgentGit) web login URL, username,
// and a freshly reset one-time password (must change on first sign-in).
// - mail: their <name>@<mail-domain> mailbox address and the webmail link, after
// ensuring the forwardemail alias exists.
//
// Both features were added after some accounts already existed, so this lets the
// operator backfill notifications to everyone who never received them.
//
// It is a PREVIEW by default — it scans and prints what it would do without
// touching Forgejo, forwardemail, or sending any email. Pass --send to execute.
// Resetting git passwords clobbers any password a member set themselves, which is
// why it only runs under --send.
//
// agentbbs notify-creds # preview for all verified members
// agentbbs notify-creds --send # really send git + mail to everyone
// agentbbs notify-creds --git --send # git creds only
// agentbbs notify-creds --mail --send # mailbox creds only
// agentbbs notify-creds --user alice,bob --send
import (
"flag"
"fmt"
"os"
"strings"
"github.com/profullstack/agentbbs/internal/forgejo"
"github.com/profullstack/agentbbs/internal/forwardemail"
"github.com/profullstack/agentbbs/internal/mail"
"github.com/profullstack/agentbbs/internal/store"
)
func notifyCreds(st store.Store, args []string) {
fs := flag.NewFlagSet("notify-creds", flag.ExitOnError)
send := fs.Bool("send", false, "actually reset passwords and send email (default: preview only)")
gitFlag := fs.Bool("git", false, "include git account creds/links")
mailFlag := fs.Bool("mail", false, "include mailbox creds/links")
only := fs.String("user", "", "comma-separated usernames to target (default: all verified)")
limit := fs.Int("limit", 100000, "max accounts to scan")
fs.Parse(args)
// Default (neither flag given) is both; either flag alone narrows it.
doGit, doMail := *gitFlag, *mailFlag
if !doGit && !doMail {
doGit, doMail = true, true
}
// Resolve the same configs main() builds for the live server.
smtp := mail.ConfigFromEnv()
fe := forwardemail.ConfigFromEnv()
if fe.Domain == "" {
fe.Domain = env("AGENTBBS_MAIL_DOMAIN", "mail.profullstack.com")
}
fj := forgejo.ConfigFromEnv()
// Optional username allow-list.
var want map[string]bool
if strings.TrimSpace(*only) != "" {
want = map[string]bool{}
for _, n := range strings.Split(*only, ",") {
if n = strings.ToLower(strings.TrimSpace(n)); n != "" {
want[n] = true
}
}
}
users, err := st.ListUsers(*limit)
if err != nil {
fmt.Fprintln(os.Stderr, "list users:", err)
os.Exit(1)
}
if !*send {
fmt.Println("PREVIEW (no email sent, no passwords reset) — re-run with --send to execute")
}
if doGit && !fj.Configured() {
fmt.Fprintln(os.Stderr, "warning: Forgejo not configured (AGENTBBS_FORGEJO_URL/_ADMIN_TOKEN) — skipping git")
doGit = false
}
if doMail && !fe.Configured() {
fmt.Fprintln(os.Stderr, "warning: forwardemail not configured (AGENTBBS_FORWARDEMAIL_API_KEY/_DOMAIN) — skipping mail")
doMail = false
}
if *send && !smtp.Configured() {
fmt.Fprintln(os.Stderr, "error: SMTP not configured (AGENTBBS_SMTP_HOST/_FROM) — cannot send email")
os.Exit(1)
}
if !doGit && !doMail {
fmt.Fprintln(os.Stderr, "nothing to do")
os.Exit(2)
}
var targeted, gitOK, gitErr, mailOK, mailErr int
for _, u := range users {
if want != nil && !want[strings.ToLower(u.Name)] {
continue
}
if !u.EmailVerified || u.Email == "" || u.Banned {
continue
}
targeted++
if doGit {
if !*send {
fmt.Printf(" [git] %-20s -> %s (reset password + email %s)\n", u.Name, fj.LoginURL(), u.Email)
} else {
created, pw, err := fj.EnsureUserReset(u.Name, u.Email)
if err != nil {
gitErr++
fmt.Fprintf(os.Stderr, " [git] %s: %v\n", u.Name, err)
} else if err := smtp.Send(u.Email, "Your git.profullstack.com account is ready",
gitWelcomeEmailBody(u.Name, pw, fj.LoginURL())); err != nil {
gitErr++
fmt.Fprintf(os.Stderr, " [git] %s: send: %v\n", u.Name, err)
} else {
gitOK++
verb := "reset+emailed"
if created {
verb = "created+emailed"
}
fmt.Printf(" [git] %-20s %s -> %s\n", u.Name, verb, u.Email)
}
}
}
if doMail {
addr := fe.Address(u.Name)
if !*send {
fmt.Printf(" [mail] %-20s -> %s (ensure alias + email %s)\n", u.Name, addr, u.Email)
} else {
if err := fe.CreateAlias(u.Name, u.Email); err != nil {
mailErr++
fmt.Fprintf(os.Stderr, " [mail] %s: alias: %v\n", u.Name, err)
} else if err := smtp.Send(u.Email, "Your "+fe.Domain+" mailbox is ready",
mailWelcomeEmailBody(u.Name, addr, fe.WebmailURL())); err != nil {
mailErr++
fmt.Fprintf(os.Stderr, " [mail] %s: send: %v\n", u.Name, err)
} else {
mailOK++
fmt.Printf(" [mail] %-20s ensured+emailed -> %s\n", u.Name, addr)
}
}
}
}
fmt.Printf("\n%d verified account(s) targeted.\n", targeted)
if *send {
fmt.Printf("git: %d sent, %d failed\nmail: %d sent, %d failed\n", gitOK, gitErr, mailOK, mailErr)
if gitErr > 0 || mailErr > 0 {
os.Exit(1)
}
}
}

80
internal/forgejo/forgejo.go
View file

@ -47,26 +47,34 @@ func ConfigFromEnv() Config {
// Configured reports whether accounts can actually be provisioned.
func (c Config) Configured() bool { return c.BaseURL != "" && c.Token != "" }
// LoginURL is the web sign-in page members are pointed at in their welcome
// email, e.g. https://git.profullstack.com/user/login.
func (c Config) LoginURL() string {
return strings.TrimRight(c.BaseURL, "/") + "/user/login"
}
// EnsureUser creates a Forgejo account for username (forwarding to email) if it
// does not already exist. It is idempotent: created is false when the account
// was already present. New accounts are created with must_change_password — git
// access is via SSH keys, so the generated password is never used interactively.
func (c Config) EnsureUser(username, email string) (created bool, err error) {
// does not already exist. It is idempotent: created is false (and password "")
// when the account was already present. New accounts get a generated temporary
// password with must_change_password set; the caller emails it to the member so
// they can sign in to the web UI once and set their own. Git over SSH still uses
// their registered key.
func (c Config) EnsureUser(username, email string) (created bool, password string, err error) {
if !c.Configured() {
return false, fmt.Errorf("forgejo not configured")
return false, "", fmt.Errorf("forgejo not configured")
}
exists, err := c.userExists(username)
if err != nil {
return false, err
return false, "", err
}
if exists {
return false, nil
return false, "", nil
}
pw, err := randomPassword()
if err != nil {
return false, err
return false, "", err
}
body, _ := json.Marshal(map[string]any{
"username": username,
@ -76,12 +84,62 @@ func (c Config) EnsureUser(username, email string) (created bool, err error) {
})
status, resp, err := c.do(http.MethodPost, "/admin/users", body)
if err != nil {
return false, err
return false, "", err
}
if status < 200 || status >= 300 {
return false, fmt.Errorf("forgejo create user %q: %d: %s", username, status, truncate(resp, 200))
return false, "", fmt.Errorf("forgejo create user %q: %d: %s", username, status, truncate(resp, 200))
}
return true, nil
return true, pw, nil
}
// EnsureUserReset creates the account if missing, or resets an existing
// account's password to a fresh temporary one with must_change_password set.
// Unlike EnsureUser it always returns a usable password — even for accounts
// that already exist (whose original one-time password we no longer hold).
// created reports whether the account was newly made. Used by the notify-creds
// re-send so every member receives working web credentials.
func (c Config) EnsureUserReset(username, email string) (created bool, password string, err error) {
if !c.Configured() {
return false, "", fmt.Errorf("forgejo not configured")
}
exists, err := c.userExists(username)
if err != nil {
return false, "", err
}
pw, err := randomPassword()
if err != nil {
return false, "", err
}
if !exists {
body, _ := json.Marshal(map[string]any{
"username": username,
"email": email,
"password": pw,
"must_change_password": true,
})
status, resp, err := c.do(http.MethodPost, "/admin/users", body)
if err != nil {
return false, "", err
}
if status < 200 || status >= 300 {
return false, "", fmt.Errorf("forgejo create user %q: %d: %s", username, status, truncate(resp, 200))
}
return true, pw, nil
}
// Reset the existing account's password. login_name/source_id are optional
// for local accounts in current Forgejo, so we send only the fields we change.
body, _ := json.Marshal(map[string]any{
"password": pw,
"must_change_password": true,
})
status, resp, err := c.do(http.MethodPatch, "/admin/users/"+username, body)
if err != nil {
return false, "", err
}
if status < 200 || status >= 300 {
return false, "", fmt.Errorf("forgejo reset user %q: %d: %s", username, status, truncate(resp, 200))
}
return false, pw, nil
}
// EnsureKey registers an SSH public key on the member's Forgejo account so the

87
internal/forgejo/forgejo_test.go
View file

@ -20,7 +20,7 @@ func TestConfiguredRequiresURLAndToken(t *testing.T) {
}
func TestEnsureUserNoOpWhenUnconfigured(t *testing.T) {
if _, err := (Config{}).EnsureUser("alice", "a@x.com"); err == nil {
if _, _, err := (Config{}).EnsureUser("alice", "a@x.com"); err == nil {
t.Fatal("expected error when unconfigured")
}
}
@ -52,13 +52,19 @@ func TestEnsureUserCreatesWhenMissing(t *testing.T) {
defer srv.Close()
c := Config{BaseURL: srv.URL, Token: "secret"}
created, err := c.EnsureUser("alice", "a@x.com")
created, password, err := c.EnsureUser("alice", "a@x.com")
if err != nil {
t.Fatalf("EnsureUser: %v", err)
}
if !created {
t.Fatal("expected created=true")
}
if password == "" {
t.Fatal("expected a generated temporary password for a new account")
}
if password != got.body["password"] {
t.Errorf("returned password %q does not match the one sent to forgejo %v", password, got.body["password"])
}
if !got.lookup || !got.create {
t.Fatalf("expected lookup+create, got %+v", got)
}
@ -70,6 +76,78 @@ func TestEnsureUserCreatesWhenMissing(t *testing.T) {
}
}
func TestEnsureUserResetCreatesWhenMissing(t *testing.T) {
var posted bool
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
switch {
case r.Method == http.MethodGet && r.URL.Path == "/api/v1/users/alice":
w.WriteHeader(http.StatusNotFound)
case r.Method == http.MethodPost && r.URL.Path == "/api/v1/admin/users":
posted = true
w.WriteHeader(http.StatusCreated)
_, _ = w.Write([]byte(`{"id":1}`))
default:
t.Errorf("unexpected %s %s", r.Method, r.URL.Path)
w.WriteHeader(http.StatusTeapot)
}
}))
defer srv.Close()
c := Config{BaseURL: srv.URL, Token: "secret"}
created, password, err := c.EnsureUserReset("alice", "a@x.com")
if err != nil {
t.Fatalf("EnsureUserReset: %v", err)
}
if !created || password == "" || !posted {
t.Fatalf("expected created+password+POST, got created=%v pw=%q posted=%v", created, password, posted)
}
}
func TestEnsureUserResetPatchesWhenExists(t *testing.T) {
var patched bool
var body map[string]any
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
switch {
case r.Method == http.MethodGet && r.URL.Path == "/api/v1/users/alice":
w.WriteHeader(http.StatusOK)
_, _ = w.Write([]byte(`{"id":1}`))
case r.Method == http.MethodPatch && r.URL.Path == "/api/v1/admin/users/alice":
patched = true
_ = json.NewDecoder(r.Body).Decode(&body)
w.WriteHeader(http.StatusOK)
_, _ = w.Write([]byte(`{"id":1}`))
case r.Method == http.MethodPost:
t.Error("must not create when the account already exists")
w.WriteHeader(http.StatusTeapot)
default:
t.Errorf("unexpected %s %s", r.Method, r.URL.Path)
w.WriteHeader(http.StatusTeapot)
}
}))
defer srv.Close()
c := Config{BaseURL: srv.URL, Token: "secret"}
created, password, err := c.EnsureUserReset("alice", "a@x.com")
if err != nil {
t.Fatalf("EnsureUserReset: %v", err)
}
if created {
t.Fatal("expected created=false for existing account")
}
if password == "" {
t.Fatal("expected a fresh password even for an existing account")
}
if !patched {
t.Fatal("expected a PATCH to reset the password")
}
if body["password"] != password {
t.Errorf("returned password %q does not match the one sent %v", password, body["password"])
}
if body["must_change_password"] != true {
t.Errorf("expected must_change_password=true, got %v", body["must_change_password"])
}
}
func TestEnsureUserNoOpWhenExists(t *testing.T) {
created := false
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@ -82,13 +160,16 @@ func TestEnsureUserNoOpWhenExists(t *testing.T) {
defer srv.Close()
c := Config{BaseURL: srv.URL, Token: "secret"}
got, err := c.EnsureUser("alice", "a@x.com")
got, password, err := c.EnsureUser("alice", "a@x.com")
if err != nil {
t.Fatalf("EnsureUser: %v", err)
}
if got {
t.Fatal("expected created=false for existing user")
}
if password != "" {
t.Fatal("expected empty password when account already exists")
}
if created {
t.Fatal("must not POST when the user already exists")
}