Talon/voice-cat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

M5: moderation, permissions, channel CRUD, in-app account management

Browse Source 
- Server-side moderation & permissions (kick/ban/move/server-mute, channel CRUD).

- Database schema v2: channels, bans; BLAKE2b channel passwords, Argon2id accounts.

- C ABI additions and client-side handling (vc_kick_user, vc_ban_user, vc_set_permission, vc_set_server_mute, vc_move_user, vc_create/edit/delete_channel, vc_create/reset/delete/list_account).

- vccli flags for all M5 operations plus --username/--password auth.

- Four new tests covering permissions, kick/ban/move/mute, admin accounts, channel CRUD.

- Docs: protocol.md envelope updates, security.md channel-password hashing, PROGRESS.md.
This commit is contained in:
Talon
2026-06-17 15:08:05 +02:00
parent a2f159e971
commit 3990f63f0f
23 changed files with 3281 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files

266
tests/test_m5_permissions.cpp Normal file
View File

@@ -0,0 +1,266 @@
/*
* test_m5_permissions — Phase 1 of M5: server-side permission enforcement.
*
* Verifies:
* - admin gets is_admin/can_create_temp_channel/etc.
* - normal password user gets no permissions.
* - admin can create a channel.
* - normal user cannot create a channel.
* - admin can grant can_create_temp_channel via vc_set_permission.
* - granted normal user can now create a channel.
*/
#include <cstdio>
#include <cstring>
#ifdef VOICECAT_HAS_NET
#include <atomic>
#include <chrono>
#include <condition_variable>
#include <filesystem>
#include <mutex>
#include <string>
#include <thread>
#include <vector>
#include "voicecat.h"
#include "server.h"
#include "db.h"
struct EventStore {
std::mutex mu;
std::condition_variable cv;
bool auth_ok{false};
uint32_t self_user_id{0};
bool channel_list_received{false};
bool disconnected{false};
// VC_EVENT_GENERIC_RESULT tracking
struct ResultAck {
bool ok{false};
uint32_t code{0};
std::string message;
};
std::vector<ResultAck> generic_results;
vc_client* client{nullptr};
const char* label{nullptr};
};
static void on_event(void* user, const vc_event* ev) {
auto* s = static_cast<EventStore*>(user);
std::lock_guard lk(s->mu);
switch (ev->type) {
case VC_EVENT_SERVER_IDENTITY:
vc_confirm_server_identity(s->client, 1);
break;
case VC_EVENT_AUTH_RESULT:
s->auth_ok = (ev->result == VC_OK);
s->self_user_id = ev->user_id;
break;
case VC_EVENT_CHANNEL_LIST:
s->channel_list_received = true;
break;
case VC_EVENT_GENERIC_RESULT: {
EventStore::ResultAck gr;
gr.ok = (ev->result == VC_OK);
gr.code = ev->u32a;
gr.message = ev->text ? ev->text : "";
s->generic_results.push_back(std::move(gr));
break;
}
case VC_EVENT_DISCONNECTED:
s->disconnected = true;
break;
default:
break;
}
s->cv.notify_all();
}
template<typename Pred>
static bool wait_for(EventStore& s, Pred pred, int timeout_ms) {
auto deadline = std::chrono::steady_clock::now() + std::chrono::milliseconds(timeout_ms);
std::unique_lock lk(s.mu);
return s.cv.wait_until(lk, deadline, [&] { return pred(s); });
}
static int g_failures = 0;
#define CHECK(cond) \
do { \
if (!(cond)) { \
std::printf("FAIL: %s (%s:%d)\n", #cond, __FILE__, __LINE__); \
++g_failures; \
} \
} while (0)
static bool wait_generic(EventStore& s, int timeout_ms) {
return wait_for(s, [](EventStore& st) { return !st.generic_results.empty(); }, timeout_ms);
}
static bool last_generic_ok(EventStore& s) {
std::lock_guard lk(s.mu);
return !s.generic_results.empty() && s.generic_results.back().ok;
}
static void reset_generic(EventStore& s) {
std::lock_guard lk(s.mu);
s.generic_results.clear();
}
int main() {
auto tmp = std::filesystem::temp_directory_path() /
("vctest_m5_perm_" + std::to_string(
std::chrono::steady_clock::now().time_since_epoch().count()));
std::filesystem::create_directories(tmp);
std::string data_dir = tmp.string();
// Pre-provision admin and normal user.
{
voicecat::server::Database db(data_dir + "/voicecat.db");
std::string err;
if (!db.open(err)) { std::printf("FAIL: db.open: %s\n", err.c_str()); return 1; }
if (!db.create_account("admin", "admin-pass", true, err)) {
std::printf("FAIL: create admin: %s\n", err.c_str());
std::filesystem::remove_all(tmp);
return 1;
}
if (!db.create_account("bob", "bob-pass", false, err)) {
std::printf("FAIL: create bob: %s\n", err.c_str());
std::filesystem::remove_all(tmp);
return 1;
}
}
std::atomic<uint16_t> bound_port{0};
std::mutex ready_mu;
std::condition_variable ready_cv;
bool ready{false};
voicecat::server::Config cfg;
cfg.data_dir = data_dir;
cfg.bind_port = 0;
cfg.server_name = "VoiceCat-M5-Perm";
cfg.allow_guests = false;
cfg.on_ready = [&](uint16_t p) {
bound_port.store(p);
{ std::lock_guard lk(ready_mu); ready = true; }
ready_cv.notify_all();
};
voicecat::server::Server server(cfg);
std::thread server_thread([&] { server.run(); });
{
std::unique_lock lk(ready_mu);
if (!ready_cv.wait_for(lk, std::chrono::seconds(10), [&] { return ready; })) {
std::printf("FAIL: server did not become ready\n");
server.stop();
server_thread.join();
std::filesystem::remove_all(tmp);
return 1;
}
}
uint16_t port = bound_port.load();
// Admin client.
EventStore evA;
evA.label = "admin";
vc_callbacks cbA{on_event, nullptr, &evA};
vc_config cfgA{"test-admin", "0.1", VC_LOG_OFF};
vc_client* admin = vc_client_create(&cfgA, cbA);
evA.client = admin;
CHECK(admin != nullptr);
CHECK(vc_connect(admin, "127.0.0.1", port) == VC_OK);
CHECK(vc_authenticate_user(admin, "admin", "admin-pass") == VC_OK);
CHECK(wait_for(evA, [](EventStore& s){ return s.auth_ok; }, 20000));
CHECK(wait_for(evA, [](EventStore& s){ return s.channel_list_received; }, 3000));
uint32_t admin_id = evA.self_user_id;
CHECK(admin_id != 0);
// Normal client.
EventStore evB;
evB.label = "bob";
vc_callbacks cbB{on_event, nullptr, &evB};
vc_config cfgB{"test-bob", "0.1", VC_LOG_OFF};
vc_client* bob = vc_client_create(&cfgB, cbB);
evB.client = bob;
CHECK(bob != nullptr);
CHECK(vc_connect(bob, "127.0.0.1", port) == VC_OK);
CHECK(vc_authenticate_user(bob, "bob", "bob-pass") == VC_OK);
CHECK(wait_for(evB, [](EventStore& s){ return s.auth_ok; }, 20000));
CHECK(wait_for(evB, [](EventStore& s){ return s.channel_list_received; }, 3000));
uint32_t bob_id = evB.self_user_id;
CHECK(bob_id != 0);
// Verify permissions reported by the core.
vc_permissions admin_perms{};
CHECK(vc_get_permissions(admin, &admin_perms) == VC_OK);
CHECK(admin_perms.is_admin != 0);
CHECK(admin_perms.can_create_temp_channel != 0);
vc_permissions bob_perms{};
CHECK(vc_get_permissions(bob, &bob_perms) == VC_OK);
CHECK(bob_perms.is_admin == 0);
CHECK(bob_perms.can_create_temp_channel == 0);
// Admin creates a channel.
vc_channel_info ch{};
ch.name = "Admin Channel";
ch.topic = "created by admin";
ch.max_users = 0;
ch.sort_order = 10;
CHECK(vc_create_channel(admin, &ch) == VC_OK);
CHECK(wait_generic(evA, 3000));
CHECK(last_generic_ok(evA));
// Normal user tries to create a channel — should be denied.
reset_generic(evB);
vc_channel_info ch2{};
ch2.name = "Bob Channel";
ch2.topic = "created by bob";
ch2.sort_order = 11;
CHECK(vc_create_channel(bob, &ch2) == VC_OK);
CHECK(wait_generic(evB, 3000));
CHECK(!last_generic_ok(evB));
// Admin grants can_create_temp_channel to bob.
reset_generic(evA);
vc_permissions grant{};
grant.can_create_temp_channel = 1;
CHECK(vc_set_permission(admin, bob_id, &grant) == VC_OK);
CHECK(wait_generic(evA, 3000));
CHECK(last_generic_ok(evA));
// Bob creates a channel — should succeed now.
reset_generic(evB);
CHECK(vc_create_channel(bob, &ch2) == VC_OK);
CHECK(wait_generic(evB, 3000));
CHECK(last_generic_ok(evB));
// Cleanup.
vc_disconnect(admin);
vc_disconnect(bob);
vc_client_destroy(admin);
vc_client_destroy(bob);
server.stop();
server_thread.join();
std::filesystem::remove_all(tmp);
if (g_failures == 0) {
std::printf("m5_permissions: all checks passed\n");
return 0;
}
std::printf("m5_permissions: %d failure(s)\n", g_failures);
return 1;
}
#else // !VOICECAT_HAS_NET
int main() {
std::printf("m5_permissions: SKIP (VOICECAT_HAS_NET not defined)\n");
return 0;
}
#endif // VOICECAT_HAS_NET