diff --git a/README.md b/README.md index 378eb4e..aa4a452 100644 --- a/README.md +++ b/README.md @@ -30,6 +30,7 @@ Go backend server providing a RESTful API for chess gameplay with user authentic - Authenticated stored-game listing with cursor pagination and filters - Configurable structured debug logs for persistence, cleanup, and engine work - User management with secure Argon2id password storage and scoped JWTs +- Self-service account deletion: claims and names are cleared from stored games - Static, CGO-free binaries (cross-compiles for FreeBSD) - Scripted deployment: FreeBSD jail (rc.d) or Linux (sandboxed systemd unit) - Optional hourly integrity sweep of stored games and accounts diff --git a/doc/api.md b/doc/api.md index 9241c33..5de3b8d 100644 --- a/doc/api.md +++ b/doc/api.md @@ -90,6 +90,32 @@ Authorization: Bearer } ``` +### Delete Account +`DELETE /auth/me` + +Deletes the caller's own account. Requires authentication and the account +password again, so a token left on an unattended device is not enough. + +**Request:** +```json +{"password": "SecurePass123"} +``` + +**Response (204):** no body. + +What happens, in order: the session ends, so the token stops working at +once; the account's claims are released on every game in memory; then, behind +any gameplay write already queued, the account's claims and name snapshots are +cleared from every stored game and the account is deleted. A game no other +user claims is anonymous from then on and is purged 24 hours after its last +activity; a game another user claims stays with that user, with this side +unnamed. (The administrative `db user delete` keeps claims and names for the +record instead.) + +Errors: 400 `INVALID_REQUEST` without a password, 401 for a wrong password or +token, 429 past 5 attempts a minute per IP, 503 `RESOURCE_LIMIT` when password +hashing is saturated or `STORAGE_UNAVAILABLE` when storage is down. + ## Game Endpoints ### Health Check @@ -523,13 +549,15 @@ Error codes: - Development (`-dev`): 20 requests/second/IP - Registration: 5 requests/minute/IP - Login: 10 requests/minute/IP +- Account deletion: 5 requests/minute/IP Exceeding limit returns 429 status. Behind a reverse proxy the client IP is the proxy's `X-Real-IP` header, trusted only from addresses listed in `-trusted-proxies`. Password hashing is bounded to four concurrent operations. When all are busy -for five seconds, registration and login return 503 with `RESOURCE_LIMIT`. +for five seconds, registration, login and account deletion return 503 with +`RESOURCE_LIMIT`. ## JWT Token Format diff --git a/go.mod b/go.mod index 3a222f2..2ba8d46 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/lixenwraith/chess -go 1.27.1 +go 1.27.2 require ( github.com/go-playground/validator/v10 v10.30.5 @@ -8,7 +8,7 @@ require ( github.com/google/uuid v1.6.0 github.com/jackc/pgx/v5 v5.11.0 github.com/lixenwraith/auth v0.5.1 - golang.org/x/term v0.46.0 + golang.org/x/term v0.47.0 ) require ( @@ -19,19 +19,19 @@ require ( github.com/golang-jwt/jwt/v5 v5.3.1 // indirect github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect - github.com/jackc/puddle/v2 v2.2.2 // indirect - github.com/klauspost/compress v1.20.1 // indirect + github.com/jackc/puddle/v2 v2.2.3 // indirect + github.com/klauspost/compress v1.20.3 // indirect github.com/leodido/go-urn v1.5.0 // indirect - github.com/mattn/go-colorable v0.1.15 // indirect + github.com/mattn/go-colorable v0.1.16 // indirect github.com/mattn/go-isatty v0.0.24 // indirect - github.com/mattn/go-runewidth v0.0.30 // indirect - github.com/molecule-man/go-brrr v1.1.1 // indirect + github.com/mattn/go-runewidth v0.0.31 // indirect + github.com/molecule-man/go-brrr v1.3.0 // indirect github.com/philhofer/fwd v1.2.0 // indirect - github.com/tinylib/msgp v1.6.4 // indirect + github.com/tinylib/msgp v1.6.5 // indirect github.com/valyala/bytebufferpool v1.0.0 // indirect - github.com/valyala/fasthttp v1.74.0 // indirect - golang.org/x/crypto v0.57.0 // indirect - golang.org/x/sync v0.23.0 // indirect - golang.org/x/sys v0.48.0 // indirect - golang.org/x/text v0.42.0 // indirect + github.com/valyala/fasthttp v1.75.0 // indirect + golang.org/x/crypto v0.58.0 // indirect + golang.org/x/sync v0.24.0 // indirect + golang.org/x/sys v0.49.0 // indirect + golang.org/x/text v0.43.0 // indirect ) diff --git a/go.sum b/go.sum index afbe721..a7007e9 100644 --- a/go.sum +++ b/go.sum @@ -25,22 +25,22 @@ github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7Ulw github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM= github.com/jackc/pgx/v5 v5.11.0 h1:IzBBtyK9AHqf98cctWFifYSci2hgQR/cd56wB4p+ogg= github.com/jackc/pgx/v5 v5.11.0/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4= -github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo= -github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4= -github.com/klauspost/compress v1.20.1 h1:T7kKElXUMXrUJ2E9QhQhxFtcK5rPyLdsGZvdbLMPdiQ= -github.com/klauspost/compress v1.20.1/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI= +github.com/jackc/puddle/v2 v2.2.3 h1:f8HoREISb3l5eO9coPgK7U3hKLhWGokOFVcThl5jrao= +github.com/jackc/puddle/v2 v2.2.3/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4= +github.com/klauspost/compress v1.20.3 h1:zWNoFqq/lSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4= +github.com/klauspost/compress v1.20.3/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI= github.com/leodido/go-urn v1.5.0 h1:pLqT2kq1zpHW/1D18QMjMpdtX7cekxqtJJjg5ANyWw0= github.com/leodido/go-urn v1.5.0/go.mod h1:9BORnCDhdPBJNDEX+w1bJisa8yOKYi116VeO96s4ifE= github.com/lixenwraith/auth v0.5.1 h1:5/eKRyEO4af/vpSLsUgAXaFiECNbCKtQ0EEXnO/oPF4= github.com/lixenwraith/auth v0.5.1/go.mod h1:411JUqnbQgy9jgoFV+fH91TfVUEfzYA4dyPv7f4c264= -github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY= -github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= +github.com/mattn/go-colorable v0.1.16 h1:+2YjeAe7xP1OQbZW1jERPWWCDLlNqFNCvjiqGiAt84A= +github.com/mattn/go-colorable v0.1.16/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI= github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A= -github.com/mattn/go-runewidth v0.0.30 h1:+KUuiDA4fF0R1p5FeueHefjDm+GIM+kWfFnDjybOPgk= -github.com/mattn/go-runewidth v0.0.30/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8= -github.com/molecule-man/go-brrr v1.1.1 h1:KYwusQhjtV3smALnhmafZf4OBrh7vP4p8O47DyUmmuY= -github.com/molecule-man/go-brrr v1.1.1/go.mod h1:7ybW6/7gA3oKY45jOfVNjSJDtrr6ea4tzbsTkjmQDC4= +github.com/mattn/go-runewidth v0.0.31 h1:1oCV4ReTlosDBc6rYRw5cL8S/4y8iv5oRl4SJ5IBgwo= +github.com/mattn/go-runewidth v0.0.31/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8= +github.com/molecule-man/go-brrr v1.3.0 h1:KEGPkUk9PYFw5+Sv/evCOSU5OmMDXCGFqQ9YjRB7GeU= +github.com/molecule-man/go-brrr v1.3.0/go.mod h1:7ybW6/7gA3oKY45jOfVNjSJDtrr6ea4tzbsTkjmQDC4= github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM= github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= @@ -50,24 +50,24 @@ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UV github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= -github.com/tinylib/msgp v1.6.4 h1:mOwYbyYDLPj35mkA2BjjYejgJk9BuHxDdvRnb6v2ZcQ= -github.com/tinylib/msgp v1.6.4/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA= +github.com/tinylib/msgp v1.6.5 h1:iAH6XTP7BpzErjBZlujJQXxA+GmRi2YWs6M4KdLtNbE= +github.com/tinylib/msgp v1.6.5/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA= github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw= github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc= -github.com/valyala/fasthttp v1.74.0 h1:wMS9fnO2QTALozYx5pId2Vi7ZwU/epUkY8i/KPWCHoU= -github.com/valyala/fasthttp v1.74.0/go.mod h1:3ARmLamUcw7ElxVtC8PXaGzQ6VEuvnetlkrwIklQBSE= -golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= -golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= -golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= -golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= -golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= -golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= -golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE= -golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc= -golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= -golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= -golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= -golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= +github.com/valyala/fasthttp v1.75.0 h1:W3xrvNJHG60j2ZCjxpP8kkB+oPG8kh9/g1n4+3xUwNA= +github.com/valyala/fasthttp v1.75.0/go.mod h1:JiVkPRZU124PuPsreV/s9dZRgG2lRK7wNEikdQ0Rk4s= +golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54= +golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w= +golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA= +golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= +golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= +golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM= +golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY= +golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc= +golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s= +golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI= +golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= diff --git a/internal/server/game/game.go b/internal/server/game/game.go index a6fbb95..1a91e5a 100644 --- a/internal/server/game/game.go +++ b/internal/server/game/game.go @@ -406,6 +406,20 @@ func (g *Game) ClaimSlot(color core.Color, userID string) error { return nil } +// ReleaseUser clears userID's claims and name snapshots, leaving those slots +// anonymous, and reports whether any slot changed. Player IDs stay: once the +// account is gone they identify nobody. Caller must hold the lock. +func (g *Game) ReleaseUser(userID string) bool { + changed := false + for _, player := range g.players { + if player != nil && player.ClaimedBy == userID { + player.ClaimedBy, player.Name = "", "" + changed = true + } + } + return changed +} + // GetSlotOwner returns the userID that claimed the slot, empty if unclaimed // Caller must hold the lock func (g *Game) GetSlotOwner(color core.Color) string { diff --git a/internal/server/http/auth.go b/internal/server/http/auth.go index c2c7a91..a110bb2 100644 --- a/internal/server/http/auth.go +++ b/internal/server/http/auth.go @@ -30,6 +30,11 @@ type LoginRequest struct { Password string `json:"password" validate:"required"` } +// DeleteAccountRequest re-confirms the password before an account is deleted. +type DeleteAccountRequest struct { + Password string `json:"password" validate:"required"` +} + // AuthResponse contains JWT token and user information type AuthResponse struct { Token string `json:"token"` @@ -269,3 +274,51 @@ func (h *HTTPHandler) LogoutHandler(c *fiber.Ctx) error { return c.JSON(fiber.Map{"message": "logged out"}) } + +// DeleteAccountHandler deletes the caller's account after re-checking the +// password. The caller's games lose the claim and the name; see +// Service.DeleteAccount. +func (h *HTTPHandler) DeleteAccountHandler(c *fiber.Ctx) error { + userID, _ := c.Locals("userID").(string) + sessionID, _ := c.Locals("sessionID").(string) + if userID == "" || sessionID == "" { + return c.Status(fiber.StatusUnauthorized).JSON(core.ErrorResponse{ + Error: "unauthorized", + Code: core.ErrInvalidRequest, + }) + } + + var req DeleteAccountRequest + if err := c.BodyParser(&req); err != nil || req.Password == "" { + return c.Status(fiber.StatusBadRequest).JSON(core.ErrorResponse{ + Error: "invalid request body", + Code: core.ErrInvalidRequest, + Details: "password is required to delete the account", + }) + } + + if err := h.svc.DeleteAccount(userID, sessionID, req.Password); err != nil { + switch { + case errors.Is(err, service.ErrInvalidCredentials): + return c.Status(fiber.StatusUnauthorized).JSON(core.ErrorResponse{ + Error: "invalid credentials", + Code: core.ErrInvalidRequest, + }) + case errors.Is(err, service.ErrAuthBusy): + return c.Status(fiber.StatusServiceUnavailable).JSON(core.ErrorResponse{ + Error: "authentication temporarily unavailable", Code: core.ErrResourceLimit, + }) + case errors.Is(err, service.ErrStorageDisabled) || errors.Is(err, service.ErrStorageUnavailable): + return c.Status(fiber.StatusServiceUnavailable).JSON(core.ErrorResponse{ + Error: "account storage unavailable", Code: core.ErrStorageUnavailable, + }) + default: + return c.Status(fiber.StatusInternalServerError).JSON(core.ErrorResponse{ + Error: "failed to delete account", + Code: core.ErrInternalError, + }) + } + } + + return c.SendStatus(fiber.StatusNoContent) +} diff --git a/internal/server/http/handler.go b/internal/server/http/handler.go index 1003100..4012823 100644 --- a/internal/server/http/handler.go +++ b/internal/server/http/handler.go @@ -145,6 +145,22 @@ func NewFiberApp(proc *processor.Processor, svc *service.Service, opts Options) // Logout auth.Post("/logout", AuthRequired(validateToken), h.LogoutHandler) + // Delete own account: 5 req/min per IP. It takes a password, so it is + // limited like login; authentication runs first, so only a signed-in + // caller reaches the password check. + auth.Delete("/me", AuthRequired(validateToken), limiter.New(limiter.Config{ + Max: 5, + Expiration: 1 * time.Minute, + KeyGenerator: clientIP, + LimitReached: func(c *fiber.Ctx) error { + return c.Status(fiber.StatusTooManyRequests).JSON(core.ErrorResponse{ + Error: "rate limit exceeded", + Code: core.ErrRateLimitExceeded, + Details: "5 account deletion attempts per minute allowed", + }) + }, + }), h.DeleteAccountHandler) + // Game routes with standard rate limiting maxReq := rateLimitRate if devMode { diff --git a/internal/server/http/handler_test.go b/internal/server/http/handler_test.go index 4fbf567..b6f5ef7 100644 --- a/internal/server/http/handler_test.go +++ b/internal/server/http/handler_test.go @@ -88,6 +88,7 @@ func TestAPIRoutes(t *testing.T) { "POST /api/auth/login", "GET /api/auth/me", "POST /api/auth/logout", + "DELETE /api/auth/me", "POST /api/games", "GET /api/games/:gameId", "GET /api/games/:gameId/history", @@ -212,3 +213,74 @@ func TestStoredGameEndpoints(t *testing.T) { } } } + +func TestDeleteAccountRequiresPasswordAndEndsTheSession(t *testing.T) { + store, err := storage.NewStore(pgtest.DSN(t)) + if err != nil { + t.Fatal(err) + } + if err := store.InitDB(); err != nil { + t.Fatal(err) + } + svc, err := service.New(store, []byte("test-secret-test-secret-test-secret")) + if err != nil { + t.Fatal(err) + } + t.Cleanup(func() { svc.Shutdown(time.Second) }) + app := NewFiberApp(nil, svc, Options{DevMode: true}) + + send := func(method, path, token, body string) int { + t.Helper() + var reader io.Reader + if body != "" { + reader = strings.NewReader(body) + } + request := httptest.NewRequest(method, path, reader) + if body != "" { + request.Header.Set("Content-Type", "application/json") + } + if token != "" { + request.Header.Set("Authorization", "Bearer "+token) + } + response, err := app.Test(request, 10_000) + if err != nil { + t.Fatal(err) + } + return response.StatusCode + } + + user, sessionID, err := svc.RegisterUser("alice", "", "Password1") + if err != nil { + t.Fatal(err) + } + token, err := svc.GenerateUserToken(user.UserID, sessionID) + if err != nil { + t.Fatal(err) + } + + for name, test := range map[string]struct { + token, body string + want int + }{ + "no token": {"", `{"password":"Password1"}`, 401}, + "no password": {token, `{}`, 400}, + "wrong password": {token, `{"password":"Password2"}`, 401}, + } { + if got := send("DELETE", "/api/auth/me", test.token, test.body); got != test.want { + t.Errorf("%s: status %d, want %d", name, got, test.want) + } + } + if got := send("GET", "/api/auth/me", token, ""); got != 200 { + t.Fatalf("a refused deletion must leave the account working: /auth/me = %d", got) + } + + if got := send("DELETE", "/api/auth/me", token, `{"password":"Password1"}`); got != 204 { + t.Fatalf("delete: status %d, want 204", got) + } + if got := send("GET", "/api/auth/me", token, ""); got != 401 { + t.Errorf("token still accepted after deletion: /auth/me = %d", got) + } + if _, _, err := svc.AuthenticateUser("alice", "Password1"); err == nil { + t.Error("deleted account can still sign in") + } +} diff --git a/internal/server/service/user.go b/internal/server/service/user.go index 428dda3..6bcdda4 100644 --- a/internal/server/service/user.go +++ b/internal/server/service/user.go @@ -203,6 +203,56 @@ func (s *Service) InvalidateSession(sessionID string) error { return nil } +// DeleteAccount deletes the caller's own account after re-checking the +// password, so a token left on an unattended device is not enough. The +// session goes first, so no new request can act for the account; then the +// account's claims are released on every game in memory, then the store +// clears them from stored games and deletes the account, behind any gameplay +// write already queued. Games nobody else claimed are anonymous from then on +// and are purged after the usual inactivity window. +func (s *Service) DeleteAccount(userID, sessionID, password string) error { + if s.store == nil { + return ErrStorageDisabled + } + record, err := s.store.GetUserByID(userID) + if err != nil { + if errors.Is(err, sql.ErrNoRows) { + return ErrInvalidCredentials + } + return fmt.Errorf("%w: look up user: %v", ErrStorageUnavailable, err) + } + if err := s.verifyPassword(password, record.PasswordHash); err != nil { + if errors.Is(err, ErrAuthBusy) { + return err + } + return ErrInvalidCredentials + } + + if err := s.store.DeleteSession(sessionID); err != nil { + return fmt.Errorf("%w: end session: %v", ErrStorageUnavailable, err) + } + released := s.releaseClaims(userID) + if err := s.store.DeleteAccount(userID); err != nil && !errors.Is(err, sql.ErrNoRows) { + return fmt.Errorf("%w: delete account: %v", ErrStorageUnavailable, err) + } + slog.Info("account deleted by its owner", "user_id", userID, "live_games_released", released) + return nil +} + +// releaseClaims makes userID's slots anonymous in every game in memory and +// returns how many games changed. +func (s *Service) releaseClaims(userID string) int { + s.mu.Lock() + defer s.mu.Unlock() + released := 0 + for _, g := range s.games { + if g.ReleaseUser(userID) { + released++ + } + } + return released +} + // GetUserByID retrieves user information by user ID func (s *Service) GetUserByID(userID string) (*User, error) { if s.store == nil { diff --git a/internal/server/service/user_test.go b/internal/server/service/user_test.go index dd3fcb6..ee50970 100644 --- a/internal/server/service/user_test.go +++ b/internal/server/service/user_test.go @@ -5,6 +5,8 @@ import ( "testing" "time" + "github.com/lixenwraith/chess/internal/server/chess" + "github.com/lixenwraith/chess/internal/server/core" "github.com/lixenwraith/chess/internal/server/storage" "github.com/google/uuid" @@ -146,3 +148,44 @@ func TestNewRejectsShortJWTSecret(t *testing.T) { t.Fatal("31-byte JWT secret accepted") } } + +func TestDeleteAccountReleasesLiveClaims(t *testing.T) { + svc := newPersistentTestService(t) + user, sessionID, err := svc.RegisterUser("alice", "", "Password1") + if err != nil { + t.Fatal(err) + } + token, err := svc.GenerateUserToken(user.UserID, sessionID) + if err != nil { + t.Fatal(err) + } + + gameID := uuid.NewString() + white := core.NewPlayer(core.PlayerConfig{Type: core.PlayerHuman}, core.ColorWhite) + white.ID, white.ClaimedBy = user.UserID, user.UserID + black := core.NewPlayer(core.PlayerConfig{Type: core.PlayerComputer, Level: 1, SearchTime: 100}, core.ColorBlack) + if err := svc.CreateGame(gameID, white, black, chess.StartFEN, core.ColorWhite, core.StateOngoing, core.TermNone); err != nil { + t.Fatal(err) + } + + if err := svc.DeleteAccount(user.UserID, sessionID, "Password2"); !errors.Is(err, ErrInvalidCredentials) { + t.Fatalf("wrong password: %v, want ErrInvalidCredentials", err) + } + if _, _, err := svc.ValidateToken(token); err != nil { + t.Fatalf("a refused deletion ended the session: %v", err) + } + + if err := svc.DeleteAccount(user.UserID, sessionID, "Password1"); err != nil { + t.Fatal(err) + } + if _, _, err := svc.ValidateToken(token); err == nil { + t.Error("token still valid after deletion") + } + view, err := svc.GetGameView(gameID) + if err != nil { + t.Fatal(err) + } + if owner := view.WhitePlayer.ClaimedBy; owner != "" { + t.Errorf("live game still claimed by the deleted account: %q", owner) + } +} diff --git a/internal/server/storage/storage.go b/internal/server/storage/storage.go index 6d6cdfe..f5c2cf8 100644 --- a/internal/server/storage/storage.go +++ b/internal/server/storage/storage.go @@ -284,6 +284,37 @@ func (s *Store) enqueue(operation, gameID string, fn func(context.Context, *sql. } } +// enqueueWait queues fn on the ordered writer and waits for its own outcome, +// for a write that must be ordered after queued gameplay writes and must also +// report success only once it is durable. +func (s *Store) enqueueWait(ctx context.Context, operation string, fn func(context.Context, *sql.Tx) error) error { + s.enqueueMu.RLock() + if s.closed.Load() { + s.enqueueMu.RUnlock() + return ErrStoreClosed + } + if !s.healthStatus.Load() { + s.enqueueMu.RUnlock() + return ErrStorageDegraded + } + + done := make(chan error, 1) + select { + case s.writeChan <- writeRequest{operation: operation, run: fn, barrier: done}: + s.enqueueMu.RUnlock() + case <-ctx.Done(): + s.enqueueMu.RUnlock() + return ctx.Err() + } + + select { + case err := <-done: + return err + case <-ctx.Done(): + return ctx.Err() + } +} + // Flush waits until every write queued before this call has completed. Replay // reads use this barrier to provide read-after-write consistency while normal // gameplay retains the low-latency async write path. diff --git a/internal/server/storage/storage_test.go b/internal/server/storage/storage_test.go index 817cad7..d6b7f81 100644 --- a/internal/server/storage/storage_test.go +++ b/internal/server/storage/storage_test.go @@ -837,6 +837,75 @@ func TestClaimsSnapshotPlayerNames(t *testing.T) { } } +func TestDeleteAccountClearsClaimsAndNames(t *testing.T) { + store := openStore(t, pgtest.DSN(t)) + now := time.Now().UTC() + alice, bob := uuid.NewString(), uuid.NewString() + for id, name := range map[string]string{alice: "alice", bob: "bob"} { + if err := store.CreateUser(UserRecord{UserID: id, Username: name, PasswordHash: "hash", CreatedAt: now}); err != nil { + t.Fatal(err) + } + } + if err := store.CreateSession(SessionRecord{ + SessionID: uuid.NewString(), UserID: alice, CreatedAt: now, ExpiresAt: now.Add(time.Hour), + }); err != nil { + t.Fatal(err) + } + + // Alice against Bob, and Alice alone against the computer. + shared, solo := uuid.NewString(), uuid.NewString() + for _, record := range []GameRecord{ + {GameID: shared, InitialFEN: "initial", + WhitePlayerID: alice, WhiteType: 1, WhiteClaimedBy: alice, + BlackPlayerID: bob, BlackType: 1, BlackClaimedBy: bob, StartTimeUTC: now}, + {GameID: solo, InitialFEN: "initial", + WhitePlayerID: uuid.NewString(), WhiteType: 2, + BlackPlayerID: alice, BlackType: 1, BlackClaimedBy: alice, StartTimeUTC: now}, + } { + if err := store.RecordNewGame(record); err != nil { + t.Fatal(err) + } + } + + if err := store.DeleteAccount(alice); err != nil { + t.Fatal(err) + } + if _, err := store.GetUserByID(alice); !errors.Is(err, sql.ErrNoRows) { + t.Fatalf("account still present: %v", err) + } + var sessions int + if err := store.db.QueryRow(`SELECT count(*) FROM sessions WHERE user_id = $1`, alice).Scan(&sessions); err != nil || sessions != 0 { + t.Fatalf("sessions left: %d, %v", sessions, err) + } + + record, _, err := store.GetGameHistory(shared) + if err != nil || record.WhiteClaimedBy != "" || record.WhiteName != "" || + record.BlackClaimedBy != bob || record.BlackName != "bob" { + t.Fatalf("shared game after deletion: white %q/%q black %q/%q, %v", + record.WhiteClaimedBy, record.WhiteName, record.BlackClaimedBy, record.BlackName, err) + } + // Nobody claims the solo game now, so the inactivity purge takes it. + if err := store.DeleteAnonymousGames(now.Add(time.Minute), nil); err != nil { + t.Fatal(err) + } + if err := store.Flush(context.Background()); err != nil { + t.Fatal(err) + } + if _, _, err := store.GetGameHistory(solo); !errors.Is(err, sql.ErrNoRows) { + t.Fatalf("solo game survived the anonymous purge: %v", err) + } + if _, _, err := store.GetGameHistory(shared); err != nil { + t.Fatalf("a game another user claims must stay: %v", err) + } + + if err := store.DeleteAccount(alice); !errors.Is(err, sql.ErrNoRows) { + t.Fatalf("second deletion: %v, want sql.ErrNoRows", err) + } + if !store.IsHealthy() { + t.Fatal("deleting a missing account degraded the writer") + } +} + func timePointer(value time.Time) *time.Time { return &value } diff --git a/internal/server/storage/user.go b/internal/server/storage/user.go index f0c88b3..87c114c 100644 --- a/internal/server/storage/user.go +++ b/internal/server/storage/user.go @@ -1,6 +1,7 @@ package storage import ( + "context" "database/sql" "errors" "fmt" @@ -124,6 +125,52 @@ func (s *Store) DeleteUser(userID string) error { return nil } +// DeleteAccount removes an account at its owner's request. Unlike DeleteUser, +// which keeps the claim IDs and name snapshots for the record, it first clears +// the user's claims and names from every stored game, so nothing in the +// database still names the person, and a game nobody else claimed becomes +// anonymous and falls to the inactivity purge. Sessions cascade. +// +// It runs on the ordered game writer, behind every gameplay write already +// queued, so a queued claim cannot land on a game after it was cleared. It +// returns sql.ErrNoRows when no such user exists. +func (s *Store) DeleteAccount(userID string) error { + if !validUUID(userID) { + return sql.ErrNoRows + } + // Set inside the transaction, read after the writer reports back: the + // barrier channel orders the two. A missing row is an answer, not a + // failed write, so it must not degrade the writer. + var deleted int64 + // Behind the queue, then its own transaction. + ctx, cancel := context.WithTimeout(context.Background(), flushTimeout+writeTimeout) + defer cancel() + err := s.enqueueWait(ctx, "delete_account", func(ctx context.Context, tx *sql.Tx) error { + if _, err := tx.ExecContext(ctx, `UPDATE games SET + white_claimed_by = CASE WHEN white_claimed_by = $1 THEN NULL ELSE white_claimed_by END, + white_name = CASE WHEN white_claimed_by = $1 THEN NULL ELSE white_name END, + black_claimed_by = CASE WHEN black_claimed_by = $1 THEN NULL ELSE black_claimed_by END, + black_name = CASE WHEN black_claimed_by = $1 THEN NULL ELSE black_name END + WHERE white_claimed_by = $1 OR black_claimed_by = $1`, userID); err != nil { + return err + } + result, err := tx.ExecContext(ctx, `DELETE FROM users WHERE user_id = $1`, userID) + if err != nil { + return err + } + deleted, err = result.RowsAffected() + return err + }) + if err != nil { + return err + } + if deleted == 0 { + return sql.ErrNoRows + } + slog.Debug("storage account deleted", "user_id", userID) + return nil +} + // UpdateUserPassword updates user password hash func (s *Store) UpdateUserPassword(userID, passwordHash string) error { return s.execUserUpdate(`UPDATE users SET password_hash = $2 WHERE user_id = $1`, diff --git a/internal/server/webserver/chess-client-web/app.js b/internal/server/webserver/chess-client-web/app.js index f867426..75b0bdb 100644 --- a/internal/server/webserver/chess-client-web/app.js +++ b/internal/server/webserver/chess-client-web/app.js @@ -17,6 +17,7 @@ let gameState = { username: null, authBusy: false, newGameBusy: false, + accountBusy: false, // logout or account deletion in flight termination: '', actionBusy: false, // a draw or resign request is in flight }; @@ -85,6 +86,9 @@ document.getElementById('login-submit-btn').addEventListener('click', handleLogi document.getElementById('register-submit-btn').addEventListener('click', handleRegister); document.getElementById('auth-cancel-btn').addEventListener('click', hideAuthModal); document.getElementById('auth-cancel-btn-2').addEventListener('click', hideAuthModal); +document.getElementById('logout-btn').addEventListener('click', handleLogoutClick); +document.getElementById('account-cancel-btn').addEventListener('click', hideAccountModal); +document.getElementById('delete-account-btn').addEventListener('click', deleteAccount); document.querySelectorAll('.promotion-choice').forEach(btn => { btn.addEventListener('click', () => closePromotion(btn.dataset.piece)); }); @@ -143,15 +147,113 @@ function updateAuthIndicator(authenticated) { function handleAuthClick() { if (gameState.authToken) { - // Logged in - confirm logout - if (confirm(`Logout ${gameState.username}?`)) { - handleLogout(); - } + showAccountModal(); } else { showAuthModal(); } } +// Account dialog, for a signed-in user: log out, or delete the account. It +// replaces a native confirm(), which a sandboxed embed may not be allowed. +function showAccountModal() { + document.getElementById('account-username').textContent = gameState.username || ''; + document.getElementById('delete-account').open = false; + document.getElementById('delete-password').value = ''; + clearModalMessage('account-modal-message'); + document.getElementById('account-overlay').classList.add('show'); + document.removeEventListener('keydown', handleAccountKeydown); + document.addEventListener('keydown', handleAccountKeydown); + document.getElementById('account-cancel-btn').focus(); +} + +function hideAccountModal() { + if (gameState.accountBusy) return; + document.getElementById('account-overlay').classList.remove('show'); + document.getElementById('delete-password').value = ''; + document.removeEventListener('keydown', handleAccountKeydown); +} + +function setAccountBusy(busy) { + gameState.accountBusy = busy; + for (const id of ['logout-btn', 'account-cancel-btn', 'delete-account-btn', 'delete-password']) { + document.getElementById(id).disabled = busy; + } +} + +function handleAccountKeydown(e) { + if (gameState.accountBusy) { + if (e.key === 'Enter' || e.key === 'Escape') e.preventDefault(); + return; + } + if (e.key === 'Escape') { + e.preventDefault(); + hideAccountModal(); + } else if (e.key === 'Enter' && document.activeElement?.id === 'delete-password') { + e.preventDefault(); + deleteAccount(); + } +} + +async function handleLogoutClick() { + setAccountBusy(true); + await handleLogout(); + setAccountBusy(false); + hideAccountModal(); +} + +// The server re-checks the password, ends the session, clears the account's +// claims and names from its games, then deletes it (DELETE /api/auth/me). +async function deleteAccount() { + if (gameState.accountBusy) return; + const password = document.getElementById('delete-password').value; + if (!password) { + setModalMessage('account-modal-message', 'Enter your password to delete the account', 'error'); + return; + } + + setAccountBusy(true); + clearModalMessage('account-modal-message'); + let response; + try { + response = await authFetch(`${gameState.apiUrl}/api/auth/me`, { + method: 'DELETE', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ password }), + }); + } catch { + setAccountBusy(false); + setModalMessage('account-modal-message', 'Network error: the account was not deleted', 'error'); + return; + } + + if (response.status === 204) { + const name = gameState.username; + clearAuthState(); + setModalMessage('account-modal-message', `Account ${name} deleted`, 'success'); + setTimeout(() => { + setAccountBusy(false); + hideAccountModal(); + }, MODAL_SUCCESS_DISPLAY_MS * 2); + return; + } + + setAccountBusy(false); + const data = await parseErrorResponse(response); + let message; + if (response.status === 401 && data.error === 'invalid credentials') { + message = 'Wrong password'; + } else if (response.status === 401) { + // The token itself was refused: the session is already gone. + clearAuthState(); + message = 'Your session has ended. Log in again to delete the account.'; + } else if (response.status === 429) { + message = 'Too many attempts. Wait a minute and try again.'; + } else { + message = data.error ? `Not deleted: ${data.error}` : `Server error (${response.status})`; + } + setModalMessage('account-modal-message', message, 'error'); +} + // Disables/enables every interactive control in the auth modal at once, and tracks // whether a login/register request is in flight (or its success message is showing). // Guards re-entrancy from the Enter-key handler, which bypasses individual button diff --git a/internal/server/webserver/chess-client-web/index.html b/internal/server/webserver/chess-client-web/index.html index 1999aae..5d56fa8 100644 --- a/internal/server/webserver/chess-client-web/index.html +++ b/internal/server/webserver/chess-client-web/index.html @@ -117,14 +117,40 @@ + + +