Talon/voice-cat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

M5: moderation, permissions, channel CRUD, in-app account management

Browse Source 
- Server-side moderation & permissions (kick/ban/move/server-mute, channel CRUD).

- Database schema v2: channels, bans; BLAKE2b channel passwords, Argon2id accounts.

- C ABI additions and client-side handling (vc_kick_user, vc_ban_user, vc_set_permission, vc_set_server_mute, vc_move_user, vc_create/edit/delete_channel, vc_create/reset/delete/list_account).

- vccli flags for all M5 operations plus --username/--password auth.

- Four new tests covering permissions, kick/ban/move/mute, admin accounts, channel CRUD.

- Docs: protocol.md envelope updates, security.md channel-password hashing, PROGRESS.md.
This commit is contained in:
Talon
2026-06-17 15:08:05 +02:00
parent a2f159e971
commit 3990f63f0f
23 changed files with 3281 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files

393
server/src/db.cpp
View File

@@ -4,6 +4,7 @@
#include <chrono>
#include <cstring>
#include <random>
#include <stdexcept>
#include <sodium.h>
@@ -13,7 +14,9 @@ namespace voicecat::server {
// ── Schema ────────────────────────────────────────────────────────────────────
static constexpr const char* kCreateSchema = R"sql(
static constexpr int kCurrentSchemaVersion = 2;
static constexpr const char* kCreateSchemaV1 = R"sql(
CREATE TABLE IF NOT EXISTS accounts (
id INTEGER PRIMARY KEY AUTOINCREMENT,
username TEXT UNIQUE NOT NULL,
@@ -26,7 +29,38 @@ CREATE TABLE IF NOT EXISTS server_meta (
key TEXT PRIMARY KEY,
value TEXT NOT NULL
);
INSERT OR IGNORE INTO server_meta (key, value) VALUES ('schema_version', '1');
)sql";
static constexpr const char* kCreateSchemaV2 = R"sql(
CREATE TABLE IF NOT EXISTS channels (
id INTEGER PRIMARY KEY AUTOINCREMENT,
parent_id INTEGER NOT NULL DEFAULT 0,
name TEXT UNIQUE NOT NULL,
topic TEXT NOT NULL DEFAULT '',
password_hash TEXT NOT NULL DEFAULT '',
max_users INTEGER NOT NULL DEFAULT 0,
type INTEGER NOT NULL DEFAULT 0,
audio_codec INTEGER NOT NULL DEFAULT 0,
audio_mode INTEGER NOT NULL DEFAULT 0,
audio_sample_rate INTEGER NOT NULL DEFAULT 48000,
audio_bitrate_bps INTEGER NOT NULL DEFAULT 24000,
audio_frame_ms INTEGER NOT NULL DEFAULT 20,
audio_application INTEGER NOT NULL DEFAULT 0,
audio_fec INTEGER NOT NULL DEFAULT 1,
audio_expected_packet_loss INTEGER NOT NULL DEFAULT 10,
audio_dtx INTEGER NOT NULL DEFAULT 1,
audio_complexity INTEGER NOT NULL DEFAULT 5,
sort_order INTEGER NOT NULL DEFAULT 0
);
CREATE TABLE IF NOT EXISTS bans (
id INTEGER PRIMARY KEY AUTOINCREMENT,
subject_type TEXT NOT NULL,
subject TEXT NOT NULL,
reason TEXT NOT NULL DEFAULT '',
expires_at INTEGER NOT NULL DEFAULT 0,
created_at INTEGER NOT NULL
);
CREATE INDEX IF NOT EXISTS idx_bans_subject ON bans(subject_type, subject);
)sql";
// ── Database ──────────────────────────────────────────────────────────────────
@@ -50,7 +84,37 @@ bool Database::open(std::string& error) {
exec("PRAGMA journal_mode=WAL", error);
exec("PRAGMA synchronous=NORMAL", error);
error.clear();
if (!exec(kCreateSchema, error)) return false;
if (!exec(kCreateSchemaV1, error)) return false;
if (!migrate(error)) return false;
return true;
}
bool Database::migrate(std::string& error) {
// Ensure server_meta row exists.
if (!exec("INSERT OR IGNORE INTO server_meta (key, value) VALUES ('schema_version', '1')",
error))
return false;
sqlite3_stmt* stmt = nullptr;
sqlite3_prepare_v2(db_, "SELECT value FROM server_meta WHERE key='schema_version'",
-1, &stmt, nullptr);
int version = 1;
if (sqlite3_step(stmt) == SQLITE_ROW) {
version = std::max(1, std::atoi(reinterpret_cast<const char*>(sqlite3_column_text(stmt, 0))));
}
sqlite3_finalize(stmt);
if (version < 2) {
if (!exec(kCreateSchemaV2, error)) return false;
sqlite3_stmt* upd = nullptr;
sqlite3_prepare_v2(db_,
"INSERT OR REPLACE INTO server_meta (key, value) VALUES ('schema_version', ?)",
-1, &upd, nullptr);
sqlite3_bind_text(upd, 1, "2", -1, SQLITE_TRANSIENT);
sqlite3_step(upd);
sqlite3_finalize(upd);
}
return true;
}
@@ -63,6 +127,8 @@ bool Database::is_empty() {
return count == 0;
}
// ── Accounts ──────────────────────────────────────────────────────────────────
std::optional<Account> Database::create_account(const std::string& username,
const std::string& password,
bool is_admin, std::string& error) {
@@ -108,6 +174,7 @@ std::optional<Account> Database::create_account(const std::string& username,
bool Database::reset_password(const std::string& username, const std::string& new_password,
std::string& error) {
if (new_password.empty()) { error = "password must not be empty"; return false; }
char hash[crypto_pwhash_STRBYTES];
if (crypto_pwhash_str(hash, new_password.c_str(), new_password.size(),
crypto_pwhash_OPSLIMIT_INTERACTIVE,
@@ -194,6 +261,326 @@ std::optional<Account> Database::authenticate(const std::string& username,
return acc;
}
// ── Channels ──────────────────────────────────────────────────────────────────
namespace {
void bind_audio(sqlite3_stmt* stmt, int base_idx, const voicecat::v1::AudioConfig& a) {
sqlite3_bind_int(stmt, base_idx + 0, static_cast<int>(a.codec()));
sqlite3_bind_int(stmt, base_idx + 1, static_cast<int>(a.mode()));
sqlite3_bind_int(stmt, base_idx + 2, static_cast<int>(a.sample_rate()));
sqlite3_bind_int(stmt, base_idx + 3, static_cast<int>(a.bitrate_bps()));
sqlite3_bind_int(stmt, base_idx + 4, static_cast<int>(a.frame_ms()));
sqlite3_bind_int(stmt, base_idx + 5, static_cast<int>(a.application()));
sqlite3_bind_int(stmt, base_idx + 6, a.fec() ? 1 : 0);
sqlite3_bind_int(stmt, base_idx + 7, static_cast<int>(a.expected_packet_loss()));
sqlite3_bind_int(stmt, base_idx + 8, a.dtx() ? 1 : 0);
sqlite3_bind_int(stmt, base_idx + 9, static_cast<int>(a.complexity()));
}
voicecat::v1::AudioConfig read_audio(sqlite3_stmt* stmt, int base_idx) {
voicecat::v1::AudioConfig a;
a.set_codec(static_cast<uint32_t>(sqlite3_column_int(stmt, base_idx + 0)));
a.set_mode(static_cast<voicecat::v1::ChannelMode>(sqlite3_column_int(stmt, base_idx + 1)));
a.set_sample_rate(static_cast<uint32_t>(sqlite3_column_int(stmt, base_idx + 2)));
a.set_bitrate_bps(static_cast<uint32_t>(sqlite3_column_int(stmt, base_idx + 3)));
a.set_frame_ms(static_cast<uint32_t>(sqlite3_column_int(stmt, base_idx + 4)));
a.set_application(static_cast<voicecat::v1::OpusApplication>(sqlite3_column_int(stmt, base_idx + 5)));
a.set_fec(sqlite3_column_int(stmt, base_idx + 6) != 0);
a.set_expected_packet_loss(static_cast<uint32_t>(sqlite3_column_int(stmt, base_idx + 7)));
a.set_dtx(sqlite3_column_int(stmt, base_idx + 8) != 0);
a.set_complexity(static_cast<uint32_t>(sqlite3_column_int(stmt, base_idx + 9)));
return a;
}
} // namespace
std::optional<ChannelRecord> Database::create_channel(const ChannelRecord& ch,
const std::string& password,
std::string& error) {
if (ch.name.empty()) { error = "channel name must not be empty"; return std::nullopt; }
std::string pw_hash = password.empty() ? "" : hash_channel_password(password);
sqlite3_stmt* stmt = nullptr;
const char* sql = R"sql(
INSERT INTO channels
(parent_id, name, topic, password_hash, max_users, type,
audio_codec, audio_mode, audio_sample_rate, audio_bitrate_bps, audio_frame_ms,
audio_application, audio_fec, audio_expected_packet_loss, audio_dtx, audio_complexity,
sort_order)
VALUES (?,?,?,?,?,?, ?,?,?,?,?, ?,?,?,?,?, ?)
)sql";
int rc = sqlite3_prepare_v2(db_, sql, -1, &stmt, nullptr);
if (rc != SQLITE_OK) { error = sqlite3_errmsg(db_); return std::nullopt; }
sqlite3_bind_int(stmt, 1, static_cast<int>(ch.parent_id));
sqlite3_bind_text(stmt, 2, ch.name.c_str(), -1, SQLITE_TRANSIENT);
sqlite3_bind_text(stmt, 3, ch.topic.c_str(), -1, SQLITE_TRANSIENT);
sqlite3_bind_text(stmt, 4, pw_hash.c_str(), -1, SQLITE_TRANSIENT);
sqlite3_bind_int(stmt, 5, static_cast<int>(ch.max_users));
sqlite3_bind_int(stmt, 6, static_cast<int>(ch.type));
bind_audio(stmt, 7, ch.audio); // parameters 7-16
sqlite3_bind_int(stmt, 17, static_cast<int>(ch.sort_order));
rc = sqlite3_step(stmt);
sqlite3_finalize(stmt);
if (rc != SQLITE_DONE) { error = sqlite3_errmsg(db_); return std::nullopt; }
ChannelRecord out = ch;
out.id = static_cast<uint32_t>(sqlite3_last_insert_rowid(db_));
out.password_protected = !pw_hash.empty();
return out;
}
bool Database::update_channel(const ChannelRecord& ch, const std::string& password,
std::string& error) {
std::string pw_hash;
bool update_password = false;
if (!password.empty()) {
pw_hash = hash_channel_password(password);
update_password = true;
}
std::string sql = R"sql(
UPDATE channels SET
parent_id=?, name=?, topic=?, max_users=?, type=?,
audio_codec=?, audio_mode=?, audio_sample_rate=?, audio_bitrate_bps=?, audio_frame_ms=?,
audio_application=?, audio_fec=?, audio_expected_packet_loss=?, audio_dtx=?, audio_complexity=?,
sort_order=?
)sql";
if (update_password) sql += ", password_hash=?";
sql += " WHERE id=?";
sqlite3_stmt* stmt = nullptr;
int rc = sqlite3_prepare_v2(db_, sql.c_str(), -1, &stmt, nullptr);
if (rc != SQLITE_OK) { error = sqlite3_errmsg(db_); return false; }
int idx = 1;
sqlite3_bind_int(stmt, idx++, static_cast<int>(ch.parent_id));
sqlite3_bind_text(stmt, idx++, ch.name.c_str(), -1, SQLITE_TRANSIENT);
sqlite3_bind_text(stmt, idx++, ch.topic.c_str(), -1, SQLITE_TRANSIENT);
sqlite3_bind_int(stmt, idx++, static_cast<int>(ch.max_users));
sqlite3_bind_int(stmt, idx++, static_cast<int>(ch.type));
bind_audio(stmt, idx, ch.audio); idx += 10;
sqlite3_bind_int(stmt, idx++, static_cast<int>(ch.sort_order));
if (update_password) {
sqlite3_bind_text(stmt, idx++, pw_hash.c_str(), -1, SQLITE_TRANSIENT);
}
sqlite3_bind_int(stmt, idx++, static_cast<int>(ch.id));
rc = sqlite3_step(stmt);
sqlite3_finalize(stmt);
if (rc != SQLITE_DONE) { error = sqlite3_errmsg(db_); return false; }
if (sqlite3_changes(db_) == 0) { error = "channel not found"; return false; }
return true;
}
bool Database::delete_channel(uint32_t id, std::string& error) {
sqlite3_stmt* stmt = nullptr;
sqlite3_prepare_v2(db_, "DELETE FROM channels WHERE id=?", -1, &stmt, nullptr);
sqlite3_bind_int(stmt, 1, static_cast<int>(id));
int rc = sqlite3_step(stmt);
sqlite3_finalize(stmt);
if (rc != SQLITE_DONE) { error = sqlite3_errmsg(db_); return false; }
if (sqlite3_changes(db_) == 0) { error = "channel not found"; return false; }
return true;
}
std::vector<ChannelRecord> Database::list_channels() {
std::vector<ChannelRecord> result;
sqlite3_stmt* stmt = nullptr;
sqlite3_prepare_v2(db_, R"sql(
SELECT id, parent_id, name, topic, password_hash, max_users, type,
audio_codec, audio_mode, audio_sample_rate, audio_bitrate_bps, audio_frame_ms,
audio_application, audio_fec, audio_expected_packet_loss, audio_dtx, audio_complexity,
sort_order
FROM channels
ORDER BY sort_order, id
)sql", -1, &stmt, nullptr);
while (sqlite3_step(stmt) == SQLITE_ROW) {
ChannelRecord ch;
ch.id = static_cast<uint32_t>(sqlite3_column_int(stmt, 0));
ch.parent_id = static_cast<uint32_t>(sqlite3_column_int(stmt, 1));
ch.name = reinterpret_cast<const char*>(sqlite3_column_text(stmt, 2));
ch.topic = reinterpret_cast<const char*>(sqlite3_column_text(stmt, 3));
ch.password_protected = sqlite3_column_text(stmt, 4)[0] != '\0';
ch.max_users = static_cast<uint32_t>(sqlite3_column_int(stmt, 5));
ch.type = static_cast<voicecat::v1::ChannelType>(sqlite3_column_int(stmt, 6));
ch.audio = read_audio(stmt, 7);
ch.sort_order = sqlite3_column_int(stmt, 17);
result.push_back(std::move(ch));
}
sqlite3_finalize(stmt);
return result;
}
std::optional<ChannelRecord> Database::get_channel(uint32_t id) {
sqlite3_stmt* stmt = nullptr;
sqlite3_prepare_v2(db_, R"sql(
SELECT id, parent_id, name, topic, password_hash, max_users, type,
audio_codec, audio_mode, audio_sample_rate, audio_bitrate_bps, audio_frame_ms,
audio_application, audio_fec, audio_expected_packet_loss, audio_dtx, audio_complexity,
sort_order
FROM channels WHERE id=?
)sql", -1, &stmt, nullptr);
sqlite3_bind_int(stmt, 1, static_cast<int>(id));
std::optional<ChannelRecord> result;
if (sqlite3_step(stmt) == SQLITE_ROW) {
ChannelRecord ch;
ch.id = static_cast<uint32_t>(sqlite3_column_int(stmt, 0));
ch.parent_id = static_cast<uint32_t>(sqlite3_column_int(stmt, 1));
ch.name = reinterpret_cast<const char*>(sqlite3_column_text(stmt, 2));
ch.topic = reinterpret_cast<const char*>(sqlite3_column_text(stmt, 3));
ch.password_protected = sqlite3_column_text(stmt, 4)[0] != '\0';
ch.max_users = static_cast<uint32_t>(sqlite3_column_int(stmt, 5));
ch.type = static_cast<voicecat::v1::ChannelType>(sqlite3_column_int(stmt, 6));
ch.audio = read_audio(stmt, 7);
ch.sort_order = sqlite3_column_int(stmt, 17);
result = std::move(ch);
}
sqlite3_finalize(stmt);
return result;
}
std::string Database::hash_channel_password(const std::string& password) {
uint8_t salt[16];
randombytes_buf(salt, sizeof(salt));
uint8_t hash[32];
crypto_generichash(hash, sizeof(hash),
reinterpret_cast<const uint8_t*>(password.data()), password.size(),
salt, sizeof(salt));
char salt_hex[33];
char hash_hex[65];
sodium_bin2hex(salt_hex, sizeof(salt_hex), salt, sizeof(salt));
sodium_bin2hex(hash_hex, sizeof(hash_hex), hash, sizeof(hash));
return std::string(salt_hex) + ":" + hash_hex;
}
bool Database::verify_channel_password(const std::string& password, const std::string& stored) {
auto pos = stored.find(':');
if (pos == std::string::npos || pos != 32) return false;
std::string salt_hex = stored.substr(0, pos);
std::string hash_hex = stored.substr(pos + 1);
uint8_t salt[16];
uint8_t expected[32];
if (sodium_hex2bin(salt, sizeof(salt), salt_hex.c_str(), salt_hex.size(),
nullptr, nullptr, nullptr) != 0)
return false;
if (sodium_hex2bin(expected, sizeof(expected), hash_hex.c_str(), hash_hex.size(),
nullptr, nullptr, nullptr) != 0)
return false;
uint8_t hash[32];
crypto_generichash(hash, sizeof(hash),
reinterpret_cast<const uint8_t*>(password.data()), password.size(),
salt, sizeof(salt));
return sodium_memcmp(hash, expected, sizeof(hash)) == 0;
}
bool Database::check_channel_password(uint32_t id, const std::string& password) {
sqlite3_stmt* stmt = nullptr;
sqlite3_prepare_v2(db_, "SELECT password_hash FROM channels WHERE id=?", -1, &stmt, nullptr);
sqlite3_bind_int(stmt, 1, static_cast<int>(id));
bool ok = false;
if (sqlite3_step(stmt) == SQLITE_ROW) {
const char* stored = reinterpret_cast<const char*>(sqlite3_column_text(stmt, 0));
if (!stored || stored[0] == '\0') {
ok = true; // no password
} else {
ok = verify_channel_password(password, stored);
}
}
sqlite3_finalize(stmt);
return ok;
}
// ── Bans ───────────────────────────────────────────────────────────────────────
std::optional<BanRecord> Database::ban_create(const std::string& subject_type,
const std::string& subject,
const std::string& reason,
int64_t expires_at,
std::string& error) {
if (subject_type != "user_id" && subject_type != "username" && subject_type != "ip") {
error = "invalid subject_type";
return std::nullopt;
}
if (subject.empty()) { error = "subject must not be empty"; return std::nullopt; }
int64_t now = now_unix();
sqlite3_stmt* stmt = nullptr;
int rc = sqlite3_prepare_v2(db_,
"INSERT INTO bans (subject_type, subject, reason, expires_at, created_at) VALUES (?,?,?,?,?)",
-1, &stmt, nullptr);
if (rc != SQLITE_OK) { error = sqlite3_errmsg(db_); return std::nullopt; }
sqlite3_bind_text(stmt, 1, subject_type.c_str(), -1, SQLITE_TRANSIENT);
sqlite3_bind_text(stmt, 2, subject.c_str(), -1, SQLITE_TRANSIENT);
sqlite3_bind_text(stmt, 3, reason.c_str(), -1, SQLITE_TRANSIENT);
sqlite3_bind_int64(stmt, 4, expires_at);
sqlite3_bind_int64(stmt, 5, now);
rc = sqlite3_step(stmt);
sqlite3_finalize(stmt);
if (rc != SQLITE_DONE) { error = sqlite3_errmsg(db_); return std::nullopt; }
BanRecord b;
b.id = sqlite3_last_insert_rowid(db_);
b.subject_type = subject_type;
b.subject = subject;
b.reason = reason;
b.expires_at = expires_at;
b.created_at = now;
return b;
}
bool Database::ban_remove(int64_t id, std::string& error) {
sqlite3_stmt* stmt = nullptr;
sqlite3_prepare_v2(db_, "DELETE FROM bans WHERE id=?", -1, &stmt, nullptr);
sqlite3_bind_int64(stmt, 1, id);
int rc = sqlite3_step(stmt);
sqlite3_finalize(stmt);
if (rc != SQLITE_DONE) { error = sqlite3_errmsg(db_); return false; }
if (sqlite3_changes(db_) == 0) { error = "ban not found"; return false; }
return true;
}
bool Database::ban_check(const std::string& subject_type, const std::string& subject) {
sqlite3_stmt* stmt = nullptr;
sqlite3_prepare_v2(db_,
"SELECT expires_at FROM bans WHERE subject_type=? AND subject=? AND (expires_at=0 OR expires_at>?)",
-1, &stmt, nullptr);
sqlite3_bind_text(stmt, 1, subject_type.c_str(), -1, SQLITE_TRANSIENT);
sqlite3_bind_text(stmt, 2, subject.c_str(), -1, SQLITE_TRANSIENT);
sqlite3_bind_int64(stmt, 3, now_unix());
bool banned = false;
if (sqlite3_step(stmt) == SQLITE_ROW) banned = true;
sqlite3_finalize(stmt);
return banned;
}
std::vector<BanRecord> Database::ban_list(bool include_expired) {
std::vector<BanRecord> result;
sqlite3_stmt* stmt = nullptr;
std::string sql = "SELECT id, subject_type, subject, reason, expires_at, created_at FROM bans";
if (!include_expired) sql += " WHERE expires_at=0 OR expires_at>?";
sql += " ORDER BY created_at DESC";
sqlite3_prepare_v2(db_, sql.c_str(), -1, &stmt, nullptr);
if (!include_expired) sqlite3_bind_int64(stmt, 1, now_unix());
while (sqlite3_step(stmt) == SQLITE_ROW) {
BanRecord b;
b.id = sqlite3_column_int64(stmt, 0);
b.subject_type = reinterpret_cast<const char*>(sqlite3_column_text(stmt, 1));
b.subject = reinterpret_cast<const char*>(sqlite3_column_text(stmt, 2));
b.reason = reinterpret_cast<const char*>(sqlite3_column_text(stmt, 3));
b.expires_at = sqlite3_column_int64(stmt, 4);
b.created_at = sqlite3_column_int64(stmt, 5);
result.push_back(std::move(b));
}
sqlite3_finalize(stmt);
return result;
}
std::string Database::generate_password(size_t length) {
static const char kAlphabet[] =
"ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz23456789!@#$%^&*";