From ec70060ae5fa665953741da921e28031b56bc5e0 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 7 Nov 2026 22:35:09 +0100
Subject: auth: logging in, and tokens as bearers

POST /auth/login (by htpasswd or the proxy), /auth/refresh,
/auth/logout, GET /auth/whoami; every request may bring
Authorization: Bearer instead of a password. --token-lifetime and
--session-lifetime.

Auth plan M2.
---
 src/config/mod.rs | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

(limited to 'src/config')

diff --git a/src/config/mod.rs b/src/config/mod.rs
index 5306c5e..60ad413 100644
--- a/src/config/mod.rs
+++ b/src/config/mod.rs
@@ -123,6 +123,20 @@ pub(crate) const OPTIONS: &[OptionSpec] = &[
         None,
         "HTTP API users (from htpasswd or user-header) who may write protocol data under /store/_continuum (remake records, members, forget records), e.g. to repair a stuck remake, in a swarm without a user registry. Such writes act on the whole swarm and are logged. Epoch metadata and the swarm ID are never writable. With a registry its capabilities decide instead (docs/access.md), but for a registry nobody may manage users of any more: then these may do everything on this node, to set it right.",
     ),
+    option(
+        "token-lifetime",
+        Kind::Duration,
+        "DURATION",
+        Some("12h"),
+        "How long a token this node issues (POST /auth/login, /auth/refresh) is taken, by every node of the swarm (docs/access.md, Tokens). Refreshed before it ends, it lasts until the login's end (session-lifetime).",
+    ),
+    option(
+        "session-lifetime",
+        Kind::Duration,
+        "DURATION",
+        Some("7d"),
+        "How long after a login (POST /auth/login) its tokens may be refreshed; then the user logs in again.",
+    ),
     option(
         "bootstrap-users",
         Kind::List,
@@ -543,6 +557,16 @@ pub(crate) struct Settings {
     pub(crate) protocol_writers: Vec<String>,
     #[serde(default)]
     pub(crate) bootstrap_users: Vec<String>,
+    #[serde(
+        default = "default_token_lifetime",
+        with = "crate::units::duration_option"
+    )]
+    pub(crate) token_lifetime: Duration,
+    #[serde(
+        default = "default_session_lifetime",
+        with = "crate::units::duration_option"
+    )]
+    pub(crate) session_lifetime: Duration,
     #[serde(default)]
     pub(crate) debug_api: bool,
     #[serde(default = "default_log_format")]
@@ -700,6 +724,12 @@ fn default_document_append() -> Duration {
 fn default_document_rewrite() -> Duration {
     Duration::from_secs(3600)
 }
+fn default_token_lifetime() -> Duration {
+    Duration::from_secs(12 * 3600)
+}
+fn default_session_lifetime() -> Duration {
+    Duration::from_secs(7 * 24 * 3600)
+}
 fn default_keepalive() -> Duration {
     Duration::from_secs(60)
 }
-- 
cgit v1.3.1