diff --git a/internal/server/db.go b/internal/server/db.go
index b8326b7..b5c58a0 100644
--- a/internal/server/db.go
+++ b/internal/server/db.go
@@ -119,6 +119,7 @@ CREATE TABLE IF NOT EXISTS forward_rules (
`ALTER TABLE forward_rules ADD COLUMN label TEXT NOT NULL DEFAULT ''`,
`ALTER TABLE admins ADD COLUMN password_off INTEGER NOT NULL DEFAULT 0`,
`ALTER TABLE agents ADD COLUMN transport TEXT NOT NULL DEFAULT 'auto'`,
+ `ALTER TABLE admins ADD COLUMN pin_hash TEXT NOT NULL DEFAULT ''`,
} {
if _, err := db.sql.Exec(alter); err != nil && !strings.Contains(err.Error(), "duplicate column") {
return err
@@ -256,6 +257,18 @@ func (db *DB) PasswordOff(adminID int64) bool {
return off == 1 && db.CountAdminKeys(adminID) > 0
}
+// AdminPin is the hash of the admin's PIN, "" when there is none.
+func (db *DB) AdminPin(adminID int64) string {
+ var h string
+ _ = db.sql.QueryRow(`SELECT pin_hash FROM admins WHERE id = ?`, adminID).Scan(&h)
+ return h
+}
+
+func (db *DB) SetAdminPin(adminID int64, pinHash string) error {
+ _, err := db.sql.Exec(`UPDATE admins SET pin_hash = ? WHERE id = ?`, pinHash, adminID)
+ return err
+}
+
func (db *DB) SetAdminPassword(adminID int64, passHash string) error {
_, err := db.sql.Exec(`UPDATE admins SET pass_hash = ? WHERE id = ?`, passHash, adminID)
return err
diff --git a/internal/server/passkeys.go b/internal/server/passkeys.go
index f313435..2df064e 100644
--- a/internal/server/passkeys.go
+++ b/internal/server/passkeys.go
@@ -353,7 +353,7 @@ func (s *Server) handleAccount(w http.ResponseWriter, r *http.Request) {
for _, k := range keys {
list = append(list, map[string]any{"id": k.ID, "name": k.Name, "created": k.CreatedAt, "last_used": k.LastUsed})
}
- writeJSON(w, map[string]any{"username": a.Username, "keys": list, "password_off": s.db.PasswordOff(a.ID)})
+ writeJSON(w, map[string]any{"username": a.Username, "keys": list, "password_off": s.db.PasswordOff(a.ID), "pin": s.db.AdminPin(a.ID) != ""})
}
// POST /api/panel/account/password/change - a new password, given the
diff --git a/internal/server/pin.go b/internal/server/pin.go
new file mode 100644
index 0000000..a6b5e89
--- /dev/null
+++ b/internal/server/pin.go
@@ -0,0 +1,108 @@
+package server
+
+import (
+ "encoding/json"
+ "net/http"
+ "regexp"
+ "sync"
+)
+
+// The PIN: four digits an admin can set, asked for by the page in every new
+// browser tab (a reload of the same tab does not ask again). The server
+// checks it; five wrong ones in a row end the session.
+
+var pinRe = regexp.MustCompile(`^[0-9]{4}$`)
+
+// pinMisses counts wrong PINs per session.
+type pinMisses struct {
+ mu sync.Mutex
+ m map[string]int
+}
+
+func (p *pinMisses) miss(sid string) int {
+ p.mu.Lock()
+ defer p.mu.Unlock()
+ if p.m == nil {
+ p.m = map[string]int{}
+ }
+ p.m[sid]++
+ return p.m[sid]
+}
+
+func (p *pinMisses) clear(sid string) {
+ p.mu.Lock()
+ delete(p.m, sid)
+ p.mu.Unlock()
+}
+
+// GET /api/panel/pin - whether the admin has a PIN to ask for.
+func (s *Server) handlePinState(w http.ResponseWriter, r *http.Request) {
+ a := s.currentAdmin(r)
+ w.Header().Set("Cache-Control", "no-store")
+ writeJSON(w, map[string]any{"pin": s.db.AdminPin(a.ID) != ""})
+}
+
+// POST /api/panel/pin/check {"pin"} - the PIN typed in a new tab.
+func (s *Server) handlePinCheck(w http.ResponseWriter, r *http.Request) {
+ a := s.currentAdmin(r)
+ var in struct {
+ Pin string `json:"pin"`
+ }
+ _ = json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<10)).Decode(&in)
+ h := s.db.AdminPin(a.ID)
+ c, _ := r.Cookie(sessionCookie)
+ if h == "" || (pinRe.MatchString(in.Pin) && checkPassword(h, in.Pin)) {
+ s.pinMisses.clear(c.Value)
+ writeJSON(w, map[string]any{"ok": true})
+ return
+ }
+ if n := s.pinMisses.miss(c.Value); n >= 5 {
+ s.pinMisses.clear(c.Value)
+ s.clearSession(w, r)
+ s.db.Audit(a.ID, "", "pin_lockout")
+ writeJSON(w, map[string]any{"ok": false, "out": true, "error": "слишком много неверных попыток"})
+ return
+ } else {
+ writeJSON(w, map[string]any{"ok": false, "left": 5 - n, "error": "неверный PIN"})
+ }
+}
+
+// POST /api/panel/account/pin {"pin", "current"} - set or change the PIN;
+// with pin empty, remove it. A PIN in place is needed to change or drop it.
+func (s *Server) handlePinSet(w http.ResponseWriter, r *http.Request) {
+ a := s.currentAdmin(r)
+ var in struct {
+ Pin string `json:"pin"`
+ Current string `json:"current"`
+ }
+ if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<10)).Decode(&in); err != nil {
+ writeJSON(w, map[string]any{"ok": false, "error": "плохой запрос"})
+ return
+ }
+ if h := s.db.AdminPin(a.ID); h != "" && !checkPassword(h, in.Current) {
+ writeJSON(w, map[string]any{"ok": false, "error": "текущий PIN не тот"})
+ return
+ }
+ hash := ""
+ if in.Pin != "" {
+ if !pinRe.MatchString(in.Pin) {
+ writeJSON(w, map[string]any{"ok": false, "error": "PIN - ровно 4 цифры"})
+ return
+ }
+ var err error
+ if hash, err = hashPassword(in.Pin); err != nil {
+ writeJSON(w, map[string]any{"ok": false, "error": err.Error()})
+ return
+ }
+ }
+ if err := s.db.SetAdminPin(a.ID, hash); err != nil {
+ writeJSON(w, map[string]any{"ok": false, "error": err.Error()})
+ return
+ }
+ action := "pin_set"
+ if hash == "" {
+ action = "pin_remove"
+ }
+ s.db.Audit(a.ID, "", action)
+ writeJSON(w, map[string]any{"ok": true})
+}
diff --git a/internal/server/server.go b/internal/server/server.go
index 7c49c4e..287d110 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -61,6 +61,7 @@ type Server struct {
xfers xfers // files on their way between a browser and an agent
challenges challenges // passkey challenges handed out
wsAgents wsAgents // agents on their WebSocket now
+ pinMisses pinMisses // wrong PINs per session
assets map[string]string // static file -> hash of its content
}
@@ -241,6 +242,9 @@ func (s *Server) Handler() http.Handler {
mux.Handle("POST /api/panel/account/keys/finish", s.requireAdmin(s.handleKeyRegisterFinish))
mux.Handle("POST /api/panel/account/keys/{id}/delete", s.requireAdmin(s.handleKeyDelete))
mux.Handle("POST /api/panel/account/password", s.requireAdmin(s.handlePasswordToggle))
+ mux.Handle("POST /api/panel/account/pin", s.requireAdmin(s.handlePinSet))
+ mux.Handle("GET /api/panel/pin", s.requireAdmin(s.handlePinState))
+ mux.Handle("POST /api/panel/pin/check", s.requireAdmin(s.handlePinCheck))
mux.Handle("POST /api/panel/account/password/change", s.requireAdmin(s.handlePasswordChange))
mux.Handle("POST /settings/ufw/toggle", s.requireAdmin(s.handleUfwToggle))
mux.Handle("POST /settings/ufw/add", s.requireAdmin(s.handleUfwAdd))
diff --git a/internal/server/web/static/account.js b/internal/server/web/static/account.js
index 9bbe772..6995a56 100644
--- a/internal/server/web/static/account.js
+++ b/internal/server/web/static/account.js
@@ -48,6 +48,13 @@
' ' +
' ' +
' ' +
+ ' PIN-код
' +
+ ' Спрашивается в каждой новой вкладке; при перезагрузке той же вкладки - нет.
' +
+ '
' + LOCK + '
' +
+ '
Введите PIN-код
' +
+ '
' +
+ '
' +
+ '
' + keys + '
' +
+ '
' +
+ '