4lt/novaconium
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 11 Activity

Replace Basic Auth with multi-user login, roles, groups, and Lib\Access

Browse Source 
Admin login & user management (novaconium/ISSUES.md): session-based
login against a SQLite users table replaces the single-user HTTP Basic
Auth stopgap (admin_username/admin_password_hash and /admin/password-hash
are gone; one admin_auth_enabled flag, off by default with zero DB
footprint). New /admin/login, /admin/logout (POST-only, real page), and
/admin/users pages plus bin/create-admin-user.php.

First user created is the admin; everyone after is registered with a
unique normalized email and an optional group. /admin/* and drafts are
admin-only; Lib\Access gates page content from sidecars
(Access::require('group:members')) with login-redirect/404 responses —
public by default, static pages always public by construction. User
management covers disable/enable, delete, promote/demote, group, email,
and password, with last-active-admin lockout guards.

Also: Session::regenerate() against fixation, friendly missing-PDO-driver
errors in Lib\Db, docs at /admin/docs/access-control and updates across
admin-auth/drafts/sidecars/config/libraries and README/AGENTS.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
code
2026-07-15 00:17:54 +00:00
parent cb64836901
commit b882c304b1
39 changed files with 1476 additions and 318 deletions
Download Patch File Download Diff File Expand all files Collapse all files
novaconium/bin/create-admin-user.php
+75
View File
@@ -0,0 +1,75 @@
<?php
use Lib\Db;
use Lib\Validate;
require __DIR__ . '/../autoload.php';
// Creates an admin user from the command line (e.g. from a deploy script,
// or to fix a lockout) — the CLI counterpart to /admin/users, and the way
// to create the first user *before* flipping admin_auth_enabled on, which
// avoids the brief open-access setup window /admin/users otherwise relies
// on (see /admin/docs/admin-auth).
//
// php novaconium/bin/create-admin-user.php <username> <email>
//
// The password is read from stdin — typed at the prompt (echo suppressed
// where the terminal supports it), or piped:
//
// echo 'the-password' | php novaconium/bin/create-admin-user.php admin admin@example.com
//
// Deliberately not gated on admin_auth_enabled: creating the row is
// harmless while the gate is off, and doing it first is the safer order.
$username = trim((string) ($argv[1] ?? ''));
$email = Validate::isEmail((string) ($argv[2] ?? ''));
if ($username === '' || strlen($username) > 64 || $email === false) {
fwrite(STDERR, "Usage: php novaconium/bin/create-admin-user.php <username> <email>\n");
exit(1);
}
// Db::connection() runs pending migrations on first touch, so the users
// table exists after this even on a fresh clone.
$exists = (bool) Db::query('SELECT EXISTS(SELECT 1 FROM users WHERE username = ?)', [$username])->fetchColumn();
if ($exists) {
fwrite(STDERR, "A user named '{$username}' already exists.\n");
exit(1);
}
$emailExists = (bool) Db::query('SELECT EXISTS(SELECT 1 FROM users WHERE email = ?)', [$email])->fetchColumn();
if ($emailExists) {
fwrite(STDERR, "A user with the email '{$email}' already exists.\n");
exit(1);
}
$interactive = stream_isatty(STDIN);
if ($interactive) {
fwrite(STDOUT, "Password for '{$username}': ");
// Suppress echo while the password is typed; restore afterwards.
// shell_exec() may be unavailable/no-op on some setups — then the
// password just echoes, same as any basic CLI prompt.
shell_exec('stty -echo 2> /dev/null');
}
$password = rtrim((string) fgets(STDIN), "\r\n");
if ($interactive) {
shell_exec('stty echo 2> /dev/null');
fwrite(STDOUT, "\n");
}
if (strlen($password) < 8) {
fwrite(STDERR, "Use a password of at least 8 characters.\n");
exit(1);
}
// Always role 'admin', as the script name says — /admin/users is the
// place to create registered users; this exists for first-user setup and
// lockout recovery, both of which need an admin.
Db::query(
"INSERT INTO users (username, email, password_hash, role, user_group, is_disabled, created_at) VALUES (?, ?, ?, 'admin', '', 0, ?)",
[$username, $email, password_hash($password, PASSWORD_DEFAULT), gmdate('Y-m-d\TH:i:s\Z')]
);
echo "User '{$username}' created.\n";
echo "If admin auth isn't enabled yet, set 'admin_auth_enabled' => true in App/config.php.\n";