hanna/fabrica

feat(web): account settings — credentials and API tokens

339469b · hanna committed on 2026-07-25

Expand /settings with an Account section (change username and email, both
uniqueness-checked via new store update_username/update_email) and a Password
section (re-verifies the current password, then rotates it and re-establishes
this session since set_password clears all). Add an API tokens section:
list, create (scope checkboxes; the JWT is shown once), and revoke.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

assets/base.css +33 −0

crates/store/src/users.rs +48 −0

crates/web/src/lib.rs +5 −0

crates/web/src/pages.rs +350 −12

crates/web/src/tests.rs +17 −0

   margin: 0.25rem 0 0.5rem;
   font-size: 0.85em;
+}
+/* API token settings. */
+.token-secret {
+  margin: 0.5rem 0 0;
+  padding: 0.6rem 0.85rem;
+  overflow-x: auto;
+  background: var(--fb-bg-inset);
+  border-radius: var(--fb-radius);
+}
+.token-list {
+  margin-bottom: 1rem;
+}
+.token-scopes {
+  margin: 0.75rem 0 0;
+  padding: 0.5rem 0.85rem;
+  border: 1px solid var(--fb-border);
+  border-radius: var(--fb-radius);
+}
+.token-scopes legend {
+  padding: 0 0.35rem;
+  font-size: 0.9em;
+  font-weight: 600;
+}
+label.checkbox {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.3rem;
+  margin: 0 1rem 0 0;
+  font-weight: 400;
+}
+label.checkbox input {
+  width: auto;
+}
 /* Link slots stack full-width; the Add button sits beside the last one. */
 .link-fields {
   display: flex;

             .map_err(Into::into)
+    }
+    /// Change a user's username (case-preserved, case-insensitively unique).
+    ///
+    /// # Errors
+    ///
+    /// * [`StoreError::Name`] if the username is invalid.
+    /// * [`StoreError::Conflict`] if the username is already taken.
+    /// * [`StoreError::Query`] for any other database failure.
+    pub async fn update_username(
+        &self,
+        user_id: &str,
+        new_username: &str,
+    ) -> Result<bool, StoreError> {
+        model::validate_name(new_username)?;
+        let updated = sqlx::query(
+            "UPDATE users SET username = $1, username_lower = $2, updated_at = $3 WHERE id = $4",
+        )
+        .bind(new_username)
+        .bind(new_username.to_lowercase())
+        .bind(now_ms())
+        .bind(user_id)
+        .execute(&self.pool)
+        .await
+        .map_err(|e| map_conflict(e, "user", &[("username", "username")]))?
+        .rows_affected();
+        Ok(updated > 0)
+    }
+    /// Change a user's email (case-insensitively unique).
+    ///
+    /// # Errors
+    ///
+    /// * [`StoreError::Conflict`] if the email is already taken.
+    /// * [`StoreError::Query`] for any other database failure.
+    pub async fn update_email(&self, user_id: &str, new_email: &str) -> Result<bool, StoreError> {
+        let updated = sqlx::query(
+            "UPDATE users SET email = $1, email_lower = $2, updated_at = $3 WHERE id = $4",
+        )
+        .bind(new_email)
+        .bind(new_email.to_lowercase())
+        .bind(now_ms())
+        .bind(user_id)
+        .execute(&self.pool)
+        .await
+        .map_err(|e| map_conflict(e, "user", &[("email", "email")]))?
+        .rows_affected();
+        Ok(updated > 0)
+    }
     /// Set (or clear) a user's password hash.
     ///
     /// Passing `Some(hash)` sets the credential and clears the

             "/settings",
             get(pages::settings).post(pages::settings_submit),
+        )
+        .route("/settings/username", post(pages::account_username))
+        .route("/settings/email", post(pages::account_email))
+        .route("/settings/password", post(pages::account_password))
+        .route("/settings/tokens", post(pages::token_create))
+        .route("/settings/tokens/revoke", post(pages::token_revoke))
         .route("/settings/avatar", post(avatar::upload))
         .route("/settings/theme", get(pages::set_theme))
         .route("/avatar/{username}", get(avatar::show))

+}
 #[tokio::test]
+async fn settings_page_shows_account_and_tokens() {
+    let (_state, app) = app().await;
+    let cookie = login(&app).await;
+    let req = Request::builder()
+        .uri("/settings")
+        .header(header::COOKIE, cookie)
+        .body(Body::empty())
+        .unwrap();
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+    let html = body_string(res).await;
+    assert!(html.contains("Change username"), "account section");
+    assert!(html.contains("Change password"), "password section");
+    assert!(html.contains("API tokens"), "tokens section");
+}
+#[tokio::test]
 async fn settings_requires_authentication() {
     let (_state, app) = app().await;
     let res = app.oneshot(get("/settings")).await.unwrap();

     RequireUser(user): RequireUser,
     jar: CookieJar,
     uri: Uri,
-) -> Response {
+) -> AppResult<Response> {
+    let tokens = state.store.tokens_by_user(&user.id).await?;
     let (jar, chrome) = build_chrome(&state, jar, Some(user.clone()), uri.path().to_string());
-    let body = settings_body(&user, &chrome.csrf, None);
+    let body = settings_body(&user, &chrome.csrf, &tokens, None);
-    (jar, page(&chrome, "Settings", body)).into_response()
+    Ok((jar, page(&chrome, "Settings", body)).into_response())
+}
 /// Profile settings form fields. Empty strings clear the corresponding column.
     (!t.is_empty()).then(|| t.to_string())
+}
-/// Render the settings page: avatar, profile fields, and read-only account info.
+/// A single-field account form (username or email) with a CSRF token.
-fn settings_body(user: &User, csrf: &str, notice: Option<&str>) -> Markup {
+#[derive(Debug, Deserialize)]
+pub struct AccountFieldForm {
+    /// The new username.
+    #[serde(default)]
+    username: String,
+    /// The new email.
+    #[serde(default)]
+    email: String,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /settings/username` — change the viewer's username.
+pub async fn account_username(
+    State(state): State<AppState>,
+    RequireUser(user): RequireUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Form(form): Form<AccountFieldForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    match state
+        .store
+        .update_username(&user.id, form.username.trim())
+        .await
+    {
+        Ok(_) => Redirect::to("/settings").into_response(),
+        Err(store::StoreError::Conflict { .. }) => {
+            AppError::BadRequest("That username is already taken.".to_string()).into_response()
+        }
+        Err(store::StoreError::Name(_)) => {
+            AppError::BadRequest("Invalid username.".to_string()).into_response()
+        }
+        Err(err) => AppError::from(err).into_response(),
+    }
+}
+/// `POST /settings/email` — change the viewer's email.
+pub async fn account_email(
+    State(state): State<AppState>,
+    RequireUser(user): RequireUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Form(form): Form<AccountFieldForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let email = form.email.trim();
+    if !email.contains('@') {
+        return AppError::BadRequest("Enter a valid email address.".to_string()).into_response();
+    }
+    match state.store.update_email(&user.id, email).await {
+        Ok(_) => Redirect::to("/settings").into_response(),
+        Err(store::StoreError::Conflict { .. }) => {
+            AppError::BadRequest("That email is already in use.".to_string()).into_response()
+        }
+        Err(err) => AppError::from(err).into_response(),
+    }
+}
+/// The change-password form.
+#[derive(Debug, Deserialize)]
+pub struct PasswordForm {
+    /// The current password (re-verified).
+    #[serde(default)]
+    current: String,
+    /// The new password.
+    #[serde(default)]
+    new_password: String,
+    /// Confirmation of the new password.
+    #[serde(default)]
+    confirm: String,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /settings/password` — change the password after re-verifying the current
+/// one; all other sessions are invalidated and this one is re-established.
+pub async fn account_password(
+    State(state): State<AppState>,
+    RequireUser(user): RequireUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Form(form): Form<PasswordForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    if !auth::verify_password(&form.current, user.password_hash.as_deref()) {
+        return AppError::BadRequest("Current password is incorrect.".to_string()).into_response();
+    }
+    if form.new_password != form.confirm {
+        return AppError::BadRequest("New passwords do not match.".to_string()).into_response();
+    }
+    if form.new_password.len() < 8 {
+        return AppError::BadRequest("New password must be at least 8 characters.".to_string())
+            .into_response();
+    }
+    let result = async {
+        let params = auth::HashParams {
+            m_cost: state.config.auth.argon2_m_cost,
+            t_cost: state.config.auth.argon2_t_cost,
+            p_cost: state.config.auth.argon2_p_cost,
+        };
+        let hash = auth::hash_password(&form.new_password, params).map_err(AppError::internal)?;
+        // set_password deletes every session (including this one); re-establish it.
+        state.store.set_password(&user.id, Some(&hash)).await?;
+        open_session(&state, &jar, &user, &headers).await
+    }
+    .await;
+    match result {
+        Ok(jar) => (jar, Redirect::to("/settings")).into_response(),
+        Err(err) => err.into_response(),
+    }
+}
+/// The create-token form.
+#[derive(Debug, Deserialize)]
+pub struct TokenCreateForm {
+    /// The token label.
+    #[serde(default)]
+    name: String,
+    /// `repo:read` scope (checkbox present when granted).
+    #[serde(default)]
+    repo_read: Option<String>,
+    /// `repo:write` scope.
+    #[serde(default)]
+    repo_write: Option<String>,
+    /// `admin` scope.
+    #[serde(default)]
+    admin: Option<String>,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /settings/tokens` — mint a new API token, shown once.
+pub async fn token_create(
+    State(state): State<AppState>,
+    RequireUser(user): RequireUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Form(form): Form<TokenCreateForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let name = form.name.trim();
+    if name.is_empty() {
+        return AppError::BadRequest("Token name is required.".to_string()).into_response();
+    }
+    let mut scopes: Vec<&str> = Vec::new();
+    if form.repo_read.is_some() {
+        scopes.push("repo:read");
+    }
+    if form.repo_write.is_some() {
+        scopes.push("repo:write");
+    }
+    if form.admin.is_some() {
+        scopes.push("admin");
+    }
+    if scopes.is_empty() {
+        return AppError::BadRequest("Select at least one scope.".to_string()).into_response();
+    }
+    let scope_str = scopes.join(",");
+    let result = async {
+        let parsed = auth::parse_scopes(&scope_str).map_err(AppError::internal)?;
+        let canonical = auth::format_scopes(&parsed);
+        let token = state
+            .store
+            .create_token(store::NewToken {
+                user_id: user.id.clone(),
+                name: name.to_string(),
+                scopes: canonical.clone(),
+                expires_at: None,
+            })
+            .await?;
+        // Mint the JWT with a far-future expiry (the row's revoked_at enforces
+        // revocation regardless).
+        let now = now_ms().div_euclid(1000);
+        let claims = auth::Claims {
+            sub: user.id.clone(),
+            jti: token.id.clone(),
+            scopes: canonical,
+            iat: now,
+            exp: now.saturating_add(10 * 365 * 86_400),
+        };
+        let jwt = auth::mint_jwt(&state.secret, &claims).map_err(AppError::internal)?;
+        Ok::<String, AppError>(jwt)
+    }
+    .await;
+    match result {
+        Ok(jwt) => {
+            let tokens = state
+                .store
+                .tokens_by_user(&user.id)
+                .await
+                .unwrap_or_default();
+            let (jar, chrome) =
+                build_chrome(&state, jar, Some(user.clone()), "/settings".to_string());
+            let body = settings_body(&user, &chrome.csrf, &tokens, Some(&jwt));
+            (jar, page(&chrome, "Settings", body)).into_response()
+        }
+        Err(err) => err.into_response(),
+    }
+}
+/// The revoke-token form.
+#[derive(Debug, Deserialize)]
+pub struct TokenRevokeForm {
+    /// The token id.
+    #[serde(default)]
+    id: String,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /settings/tokens/revoke` — revoke one of the viewer's tokens.
+pub async fn token_revoke(
+    State(state): State<AppState>,
+    RequireUser(user): RequireUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Form(form): Form<TokenRevokeForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    // Only revoke a token that belongs to the viewer.
+    let owned = state
+        .store
+        .token_by_id(&form.id)
+        .await
+        .ok()
+        .flatten()
+        .is_some_and(|t| t.user_id == user.id);
+    if owned {
+        let _ = state.store.revoke_token(&form.id).await;
+    }
+    Redirect::to("/settings").into_response()
+}
+/// Render the settings page: avatar, profile, account credentials, and tokens.
+fn settings_body(
+    user: &User,
+    csrf: &str,
+    tokens: &[model::ApiToken],
+    new_token: Option<&str>,
+) -> Markup {
     let val = |v: &Option<String>| v.clone().unwrap_or_default();
     html! {
         h1 { "Settings" }
-        @if let Some(msg) = notice {
-            div class="notice notice-success" { (msg) }
-        }
         section class="listing" {
             h2 { "Avatar" }
             div class="card avatar-settings" {
         section class="listing" {
             h2 { "Account" }
             div class="card" {
-                table class="list" {
+                form method="post" action="/settings/username" {
-                    tr { th { "Username" } td { (user.username) } }
+                    input type="hidden" name="_csrf" value=(csrf);
-                    tr { th { "Email" } td { (user.email) } }
+                    label for="username" { "Username" }
-                    tr { th { "Administrator" } td { (if user.is_admin { "yes" } else { "no" }) } }
+                    input type="text" id="username" name="username" value=(user.username) required;
+                    button class="btn" type="submit" { "Change username" }
+                }
+                form method="post" action="/settings/email" {
+                    input type="hidden" name="_csrf" value=(csrf);
+                    label for="email" { "Email" }
+                    input type="email" id="email" name="email" value=(user.email) required;
+                    button class="btn" type="submit" { "Change email" }
+                }
+                p class="muted field-hint" {
+                    "Administrator: " (if user.is_admin { "yes" } else { "no" })
+                }
+            }
+        }
+        section class="listing" {
+            h2 { "Password" }
+            div class="card" {
+                form method="post" action="/settings/password" {
+                    input type="hidden" name="_csrf" value=(csrf);
+                    label for="current" { "Current password" }
+                    input type="password" id="current" name="current"
+                          autocomplete="current-password" required;
+                    label for="new_password" { "New password" }
+                    input type="password" id="new_password" name="new_password"
+                          autocomplete="new-password" required minlength="8";
+                    label for="confirm" { "Confirm new password" }
+                    input type="password" id="confirm" name="confirm"
+                          autocomplete="new-password" required;
+                    button class="btn btn-primary" type="submit" { "Change password" }
+                }
+            }
+        }
+        (tokens_section(csrf, tokens, new_token))
+    }
+}
+/// The API tokens settings section.
+fn tokens_section(csrf: &str, tokens: &[model::ApiToken], new_token: Option<&str>) -> Markup {
+    html! {
+        section class="listing" {
+            h2 { "API tokens" }
+            div class="card" {
+                @if let Some(secret) = new_token {
+                    div class="notice notice-success" {
+                        p { strong { "New token created." } " Copy it now — it is not shown again." }
+                        pre class="token-secret" { code { (secret) } }
+                    }
+                }
+                @if tokens.is_empty() {
+                    p class="muted" { "No API tokens yet." }
+                } @else {
+                    ul class="entry-list token-list" {
+                        @for t in tokens {
+                            li class="entry-row" {
+                                div class="entry-row-body" {
+                                    span class="entry-row-title" { (t.name) }
+                                    div class="entry-row-meta muted" {
+                                        span { (t.scopes) }
+                                        @if t.revoked_at.is_some() { span class="badge badge-private" { "revoked" } }
+                                    }
+                                }
+                                div class="entry-row-actions" {
+                                    @if t.revoked_at.is_none() {
+                                        form method="post" action="/settings/tokens/revoke" {
+                                            input type="hidden" name="_csrf" value=(csrf);
+                                            input type="hidden" name="id" value=(t.id);
+                                            button class="btn btn-danger" type="submit" { "Revoke" }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+                form class="token-add" method="post" action="/settings/tokens" {
+                    input type="hidden" name="_csrf" value=(csrf);
+                    label for="token_name" { "New token" }
+                    input type="text" id="token_name" name="name" placeholder="Token name" required;
+                    fieldset class="token-scopes" {
+                        legend { "Scopes" }
+                        label class="checkbox" { input type="checkbox" name="repo_read" value="1" checked; " repo:read" }
+                        label class="checkbox" { input type="checkbox" name="repo_write" value="1"; " repo:write" }
+                        label class="checkbox" { input type="checkbox" name="admin" value="1"; " admin" }
+                    }
+                    button class="btn btn-primary" type="submit" { "Create token" }
+                }
+            }
+        }