feat(login): tokenUser:tokenPass Basic auth + meshctrl --token (VS-1) #21

Merged

David merged 2 commits from feat/meshctrl-token-vs-1 into main

2026-05-17 14:36:19 +02:00

David commented

2026-05-17 04:48:08 +02:00

Owner

Summary

Wires the existing createLoginToken admin action to a Basic-auth login path on /login and removes the meshctrl --token stub.

Changes

Server (crates/meshcentral-web/src/login.rs):

post_login extracts headers + body bytes directly so the Basic-auth path can short-circuit before the form decoder runs.
New parse_basic + basic_token_login helpers verify the token-user's stored salt/hash, honour the expire field, and mint a normal mc_session cookie. Success is 200 + Set-Cookie; failure is 401.
meshcentral-web gains a serde_urlencoded direct dep.

Client (crates/meshctrl):

login::login_token(client, base, "user:pass") does the Basic-auth POST and captures the cookie.
--token (env: MESHCTRL_TOKEN) shortcircuits before the --user/--pass requirement and dispatches through login_token.
meshctrl gains a base64 direct dep.

Test plan

cargo check --workspace clean.
cargo test -p meshcentral-web --test login (3/3 still passing; existing form path unchanged).
Reviewer: end-to-end against a local server: mint a token via the SPA's "Login Tokens" panel, then meshctrl --token <user:pass> list-meshes.

Closes VS-1.

## Summary Wires the existing `createLoginToken` admin action to a Basic-auth login path on `/login` and removes the `meshctrl --token` stub. ## Changes Server (`crates/meshcentral-web/src/login.rs`): - `post_login` extracts headers + body bytes directly so the Basic-auth path can short-circuit before the form decoder runs. - New `parse_basic` + `basic_token_login` helpers verify the token-user's stored salt/hash, honour the `expire` field, and mint a normal `mc_session` cookie. Success is 200 + Set-Cookie; failure is 401. - `meshcentral-web` gains a `serde_urlencoded` direct dep. Client (`crates/meshctrl`): - `login::login_token(client, base, "user:pass")` does the Basic-auth POST and captures the cookie. - `--token` (env: `MESHCTRL_TOKEN`) shortcircuits before the `--user`/`--pass` requirement and dispatches through `login_token`. - `meshctrl` gains a `base64` direct dep. ## Test plan - [x] `cargo check --workspace` clean. - [x] `cargo test -p meshcentral-web --test login` (3/3 still passing; existing form path unchanged). - [ ] Reviewer: end-to-end against a local server: mint a token via the SPA's "Login Tokens" panel, then `meshctrl --token <user:pass> list-meshes`. Closes VS-1.

David added 1 commit

2026-05-17 04:48:09 +02:00

feat(login): accept tokenUser:tokenPass Basic auth on /login + wire meshctrl --token (VS-1)

Check / fmt + clippy + build + tests (pull_request) Failing after 3s

Details

f10082d597

Server: `post_login` now inspects `Authorization: Basic <b64>` before parsing the form body. The token-auth path looks up `logintoken-<tokenUser>` (already minted by the existing `createLoginToken` admin action), runs `verify_password` against its stored salt/hash, checks the `expire` field, and mints a normal `mc_session` cookie. Success is 200 with Set-Cookie; failure is 401 (without disclosing which half is wrong). The form-body path is unchanged.

Client: `meshctrl --token <user:pass>` (env: `MESHCTRL_TOKEN`) now reaches `meshctrl::login::login_token`, which sends the Basic header and captures the session cookie. The earlier `bail!("not implemented yet")` is gone; `--token` short-circuits before the `--user`/`--pass` requirement so a token-only invocation works without a dummy username.

Cargo: `meshcentral-web` gains a `serde_urlencoded` direct dep (Form extractor was replaced by manual decode of the body bytes so the Basic-auth path doesn't need a body); `meshctrl` gains `base64`.

#VS-1 State Done

David added 1 commit

2026-05-17 14:36:13 +02:00

Merge branch 'main' into feat/meshctrl-token-vs-1

Check / fmt + clippy + build + tests (pull_request) Failing after 3s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

b906f3fe31