API Access
@@ -233,3 +243,66 @@ export class QuickSettings {
this.panel?.remove();
}
}
+
+// ---- Cognitum browser sign-in (ADR-271) -------------------------------------
+//
+// `/oauth/status` is intentionally UNGATED: a signed-out browser cannot ask a
+// gated endpoint whether sign-in is available. It returns capability flags and,
+// when a session exists, who it belongs to — never a credential.
+//
+// Sign-in is a full-page navigation, not fetch(): the server replies 302 to
+// auth.cognitum.one, and the browser must follow it and carry the transaction
+// cookie. An XHR would follow the redirect invisibly and land nowhere useful.
+export async function refreshSignInPanel(root = document) {
+ const status = root.querySelector('#qs-signin-status');
+ const signIn = root.querySelector('#qs-signin');
+ const signOut = root.querySelector('#qs-signout');
+ if (!status || !signIn || !signOut) return null;
+
+ let info;
+ try {
+ const resp = await fetch('/oauth/status', { credentials: 'same-origin' });
+ // 404 = a server predating ADR-271. Say so plainly rather than offering a
+ // button that will 404.
+ if (resp.status === 404) {
+ status.textContent = 'This server does not support Cognitum sign-in.';
+ signIn.hidden = true;
+ signOut.hidden = true;
+ return null;
+ }
+ if (!resp.ok) throw new Error(`status ${resp.status}`);
+ info = await resp.json();
+ } catch (err) {
+ status.textContent = `Could not reach the server (${err.message}).`;
+ signIn.hidden = true;
+ signOut.hidden = true;
+ return null;
+ }
+
+ if (info.signed_in) {
+ status.textContent = `Signed in${info.account ? ` as ${info.account}` : ''}${
+ info.scope ? ` \u2014 ${info.scope}` : ''
+ }`;
+ signIn.hidden = true;
+ signOut.hidden = false;
+ } else if (info.browser_signin) {
+ status.textContent = info.auth_required
+ ? 'This server requires sign-in.'
+ : 'Optional: sign in to use your Cognitum account.';
+ signIn.hidden = false;
+ signOut.hidden = true;
+ } else if (info.auth_required) {
+ // Auth is on but OAuth is not — the static-token panel below is the path.
+ status.textContent = 'This server uses a shared API token (see API Access below).';
+ signIn.hidden = true;
+ signOut.hidden = true;
+ } else {
+ status.textContent = 'This server does not require sign-in.';
+ signIn.hidden = true;
+ signOut.hidden = true;
+ }
+
+ signIn.onclick = () => { window.location.href = '/oauth/start'; };
+ signOut.onclick = () => { window.location.href = '/oauth/logout'; };
+ return info;
+}
diff --git a/v2/crates/wifi-densepose-sensing-server/src/browser_session.rs b/v2/crates/wifi-densepose-sensing-server/src/browser_session.rs
index f5fe5ad1..d2663668 100644
--- a/v2/crates/wifi-densepose-sensing-server/src/browser_session.rs
+++ b/v2/crates/wifi-densepose-sensing-server/src/browser_session.rs
@@ -31,6 +31,7 @@
//! arrived over TLS. Every other attribute — `HttpOnly`, `SameSite=Lax`,
//! `Path=/` — matches, and the signature is what actually protects the value.
+use std::path::Path;
use std::time::{SystemTime, UNIX_EPOCH};
use hmac::{Hmac, Mac};
@@ -155,13 +156,86 @@ pub enum SessionError {
InvalidToken(String),
}
-fn secret() -> Result {
- std::env::var(SESSION_SECRET_ENV)
+/// Process-wide secret, resolved once.
+static SECRET: std::sync::OnceLock> = std::sync::OnceLock::new();
+
+/// Resolve the signing secret: env first, then a persisted file, then generate.
+///
+/// Requiring an operator to invent a secret before browser sign-in works is a
+/// footgun — they set `RUVIEW_OAUTH_ISSUER`, expect sign-in, and get a 503 that
+/// names an env var they have never heard of. A single-host appliance has no
+/// reason to need that step, so we generate one and persist it `0600` next to
+/// the server's other state.
+///
+/// Persisted rather than in-memory so a restart does not silently sign everyone
+/// out. The env var still wins, which is what a multi-instance deployment needs
+/// — several servers must share a secret or a session issued by one is
+/// rejected by the next.
+pub fn init_secret(data_dir: &Path) {
+ let resolved = std::env::var(SESSION_SECRET_ENV)
.ok()
.filter(|s| !s.trim().is_empty())
+ .map(|s| {
+ tracing::info!("browser session secret: from {SESSION_SECRET_ENV}");
+ s
+ })
+ .or_else(|| load_or_create_secret(data_dir));
+ let _ = SECRET.set(resolved);
+}
+
+fn load_or_create_secret(data_dir: &Path) -> Option {
+ let path = data_dir.join("session-secret");
+ if let Ok(existing) = std::fs::read_to_string(&path) {
+ let trimmed = existing.trim().to_string();
+ if !trimmed.is_empty() {
+ tracing::info!(path = %path.display(), "browser session secret: loaded");
+ return Some(trimmed);
+ }
+ }
+ let mut bytes = [0u8; 32];
+ rand::RngCore::fill_bytes(&mut rand::rngs::OsRng, &mut bytes);
+ let generated = b64(&bytes);
+ if let Err(e) = write_secret(&path, &generated) {
+ tracing::warn!(
+ path = %path.display(),
+ error = %e,
+ "could not persist a browser session secret; sessions will not survive a restart. \
+ Set {SESSION_SECRET_ENV} to fix this permanently."
+ );
+ // Still usable this run — better than refusing sign-in outright.
+ return Some(generated);
+ }
+ tracing::info!(path = %path.display(), "browser session secret: generated");
+ Some(generated)
+}
+
+fn write_secret(path: &Path, value: &str) -> std::io::Result<()> {
+ if let Some(dir) = path.parent() {
+ std::fs::create_dir_all(dir)?;
+ }
+ let tmp = path.with_extension("tmp");
+ std::fs::write(&tmp, value)?;
+ #[cfg(unix)]
+ {
+ use std::os::unix::fs::PermissionsExt;
+ // Restrict BEFORE publishing the path, as with the CLI's credentials.
+ std::fs::set_permissions(&tmp, std::fs::Permissions::from_mode(0o600))?;
+ }
+ std::fs::rename(&tmp, path)
+}
+
+fn secret() -> Result {
+ SECRET
+ .get()
+ .and_then(|s| s.clone())
.ok_or(SessionError::NotConfigured)
}
+/// Is browser sign-in usable on this server?
+pub fn is_configured() -> bool {
+ secret().is_ok()
+}
+
/// Begin sign-in: where to redirect, and the cookie to set.
pub fn begin(issuer: &str, client_id: &str, scope: &str, secure: bool) -> Result<(String, String), SessionError> {
let secret = secret()?;
diff --git a/v2/crates/wifi-densepose-sensing-server/src/main.rs b/v2/crates/wifi-densepose-sensing-server/src/main.rs
index 7fdfd5e3..147dd721 100644
--- a/v2/crates/wifi-densepose-sensing-server/src/main.rs
+++ b/v2/crates/wifi-densepose-sensing-server/src/main.rs
@@ -7673,6 +7673,10 @@ async fn main() {
// ADR-044 §5.3: load persisted runtime config from the data directory.
let data_dir = std::path::PathBuf::from("data");
let runtime_config = load_runtime_config(&data_dir);
+ // ADR-271: resolve (or generate + persist) the browser-session signing key
+ // before any request can arrive. Zero-config for a single appliance; the
+ // env var still wins for a multi-instance deployment that must share one.
+ wifi_densepose_sensing_server::browser_session::init_secret(&data_dir);
info!(
"Loaded runtime config: dedup_factor={:.2}",
runtime_config.dedup_factor
@@ -8087,6 +8091,10 @@ async fn main() {
.route("/oauth/start", get(oauth_start))
.route("/oauth/callback", get(oauth_callback))
.route("/oauth/logout", get(oauth_logout))
+ // Ungated on purpose: a signed-OUT browser needs to discover whether
+ // sign-in is available, and it cannot ask a gated endpoint that.
+ // Returns only capability + who-you-are, never a credential.
+ .route("/oauth/status", get(oauth_status))
.route("/api/v1/stream/pose", get(ws_pose_handler))
// Sensing WebSocket on the HTTP port so the UI can reach it without a second port
.route("/ws/sensing", get(ws_sensing_handler))
@@ -9321,3 +9329,27 @@ async fn oauth_logout(headers: axum::http::HeaderMap) -> axum::response::Respons
)
.into_response()
}
+
+/// `GET /oauth/status` — what a signed-out browser needs to render the right UI.
+///
+/// Deliberately ungated and deliberately thin: capability flags and, if a live
+/// session exists, who it belongs to. No token, no scope escalation hints, no
+/// server configuration beyond "is sign-in possible here".
+async fn oauth_status(
+ axum::Extension(auth): axum::Extension,
+ headers: axum::http::HeaderMap,
+) -> axum::Json {
+ use wifi_densepose_sensing_server::browser_session as bs;
+ let session = headers
+ .get(axum::http::header::COOKIE)
+ .and_then(|v| v.to_str().ok())
+ .and_then(bs::from_cookie_header);
+ axum::Json(serde_json::json!({
+ "auth_required": auth.is_enabled(),
+ "oauth_enabled": auth.oauth_enabled(),
+ "browser_signin": auth.oauth_enabled() && bs::is_configured(),
+ "signed_in": session.is_some(),
+ "account": session.as_ref().map(|s| s.account_id.clone()),
+ "scope": session.as_ref().map(|s| s.scope.clone()),
+ }))
+}