User accounts, login before the title screen, own savegames per user, standalone download

- Service: accounts with Argon2 password hashes and session tokens; the first login creates
  the admin (shared savegames of before move to the admin); the admin creates and deletes
  users; everybody can change the password; savegames are stored and listed per user
- Game: login page before the title (only when the service is reachable), with licence and
  repository link; account page (password, logout; users for the admin); text fields with
  Tab/Enter, masked passwords, browser dialog on touch screens; long status messages wrap
- Download Standalone: DungeonCraft.html with the game embedded (built in the Docker image,
  served to logged-in users via nginx auth_request); works from file:// without server and
  opens downloaded savegames
- Without the service (standalone, local files) there is no login, savegame files as before

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/src/main.rs

@@ -1,25 +1,38 @@
-// DungeonCraft savegame service: a small HTTP API that stores savegames as files.
+// DungeonCraft service: user accounts and savegames stored as files.
 //
-// GET    /api/health          -> "ok"
-// GET    /api/saves           -> list of savegames (newest first)
-// GET    /api/saves/{id}      -> savegame JSON
-// POST   /api/saves?name=..   -> store a new savegame (body = savegame JSON), returns its info
-// PUT    /api/saves/{id}?name -> overwrite a savegame
-// DELETE /api/saves/{id}      -> delete a savegame
+// The very first login creates the admin account with the entered name and password.
+// The admin creates further users; every user can change the password and only sees
+// the own savegames. Requests (except health and login) need "Authorization: Bearer <token>".
 //
-// Storage is shared by everybody (no accounts). Limits: 1 MB per savegame, 500 MB in total,
-// at most 30 write requests per minute.
+// GET    /api/health            -> "ok" (or "ok setup" while there is no user yet)
+// POST   /api/login             -> {name, password} -> {token, name, admin}
+// POST   /api/logout
+// GET    /api/me                -> {name, admin}
+// GET    /api/auth              -> 204 when logged in (nginx auth_request for the standalone file)
+// POST   /api/password          -> {old, new}
+// GET    /api/users             -> admin: [{name, admin}]
+// POST   /api/users             -> admin: {name, password}
+// DELETE /api/users/{name}      -> admin: delete a user and the savegames
+// GET    /api/saves             -> own savegames (newest first)
+// GET    /api/saves/{id}        -> savegame JSON
+// POST   /api/saves?name=..     -> store a new savegame (body = savegame JSON)
+// PUT    /api/saves/{id}?name=  -> overwrite a savegame
+// DELETE /api/saves/{id}
+//
+// Limits: 1 MB per savegame, 500 MB in total, 30 write requests and 20 login attempts per minute.
 
+use argon2::Argon2;
 use axum::{
     body::Bytes,
     extract::{DefaultBodyLimit, Path, Query, State},
-    http::StatusCode,
+    http::{HeaderMap, StatusCode},
     response::{IntoResponse, Response},
-    routing::get,
+    routing::{delete, get, post},
     Json, Router,
 };
 use serde::{Deserialize, Serialize};
 use std::{
+    collections::HashMap,
     path::PathBuf,
     sync::Arc,
     time::{SystemTime, UNIX_EPOCH},
@@ -29,23 +42,35 @@ use tokio::sync::Mutex;
 const MAX_SAVE: usize = 1024 * 1024;
 const MAX_TOTAL: u64 = 500 * 1024 * 1024;
 const WRITES_PER_MINUTE: usize = 30;
+const LOGINS_PER_MINUTE: usize = 20;
+
+#[derive(Clone, Serialize, Deserialize)]
+struct User {
+    name: String,
+    salt: String, // hex
+    hash: String, // hex, argon2id
+    admin: bool,
+}
 
 #[derive(Clone)]
 struct AppState {
     dir: PathBuf,
-    writes: Arc<Mutex<Vec<u64>>>, // timestamps of recent writes
+    users: Arc<Mutex<Vec<User>>>,
+    sessions: Arc<Mutex<HashMap<String, String>>>, // token -> user name
+    writes: Arc<Mutex<Vec<u64>>>,
+    logins: Arc<Mutex<Vec<u64>>>,
 }
 
 #[derive(Serialize, Deserialize, Clone)]
 struct SaveInfo {
     id: String,
     name: String,
-    saved_at: u64, // unix seconds
+    saved_at: u64,
     size: usize,
     map_w: u64,
     map_h: u64,
     wave: u64,
-    time: f64, // play time in seconds
+    time: f64,
 }
 
 #[derive(Deserialize)]
@@ -53,14 +78,55 @@ struct NameQuery {
     name: Option<String>,
 }
 
+#[derive(Deserialize)]
+struct Credentials {
+    name: String,
+    password: String,
+}
+
+#[derive(Deserialize)]
+struct PasswordChange {
+    old: String,
+    new: String,
+}
+
 fn now() -> u64 {
     SystemTime::now().duration_since(UNIX_EPOCH).map(|d| d.as_secs()).unwrap_or(0)
 }
 
+fn now_nanos() -> u128 {
+    SystemTime::now().duration_since(UNIX_EPOCH).map(|d| d.as_nanos()).unwrap_or(0)
+}
+
+fn hex(b: &[u8]) -> String {
+    b.iter().map(|x| format!("{:02x}", x)).collect()
+}
+
+fn random_hex(n: usize) -> String {
+    let mut b = vec![0u8; n];
+    getrandom::getrandom(&mut b).expect("random numbers");
+    hex(&b)
+}
+
+fn hash_password(password: &str, salt: &str) -> String {
+    let mut out = [0u8; 32];
+    Argon2::default().hash_password_into(password.as_bytes(), salt.as_bytes(), &mut out).expect("argon2");
+    hex(&out)
+}
+
+// constant-time comparison of two hashes
+fn same(a: &str, b: &str) -> bool {
+    a.len() == b.len() && a.bytes().zip(b.bytes()).fold(0u8, |acc, (x, y)| acc | (x ^ y)) == 0
+}
+
 fn valid_id(id: &str) -> bool {
     !id.is_empty() && id.len() <= 40 && id.chars().all(|c| c.is_ascii_alphanumeric() || c == '-')
 }
 
+fn valid_user(name: &str) -> bool {
+    !name.is_empty() && name.len() <= 24 && name.chars().all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')
+}
+
 fn clean_name(n: Option<String>) -> String {
     let n: String = n.unwrap_or_default().chars().filter(|c| !c.is_control()).take(60).collect();
     if n.trim().is_empty() {
@@ -74,36 +140,232 @@ fn err(code: StatusCode, msg: &str) -> Response {
     (code, msg.to_string()).into_response()
 }
 
-async fn rate_ok(st: &AppState) -> bool {
-    let mut w = st.writes.lock().await;
+async fn limited(list: &Mutex<Vec<u64>>, max: usize) -> bool {
+    let mut w = list.lock().await;
     let t = now();
     w.retain(|&x| t - x < 60);
-    if w.len() >= WRITES_PER_MINUTE {
-        return false;
+    if w.len() >= max {
+        return true;
     }
     w.push(t);
-    true
+    false
+}
+
+impl AppState {
+    fn user_dir(&self, name: &str) -> PathBuf {
+        self.dir.join("users").join(name)
+    }
+
+    async fn store_users(&self) {
+        let users = self.users.lock().await;
+        let _ = tokio::fs::write(self.dir.join("users.json"), serde_json::to_vec_pretty(&*users).unwrap_or_default()).await;
+    }
+
+    async fn store_sessions(&self) {
+        let s = self.sessions.lock().await;
+        let _ = tokio::fs::write(self.dir.join("sessions.json"), serde_json::to_vec(&*s).unwrap_or_default()).await;
+    }
+
+    // the user behind the request's token
+    async fn auth(&self, headers: &HeaderMap) -> Result<User, Response> {
+        let token = headers
+            .get("authorization")
+            .and_then(|v| v.to_str().ok())
+            .and_then(|v| v.strip_prefix("Bearer "))
+            .map(|t| t.trim().to_string())
+            .ok_or_else(|| err(StatusCode::UNAUTHORIZED, "login needed"))?;
+        let name = self.sessions.lock().await.get(&token).cloned().ok_or_else(|| err(StatusCode::UNAUTHORIZED, "login needed"))?;
+        self.users.lock().await.iter().find(|u| u.name == name).cloned().ok_or_else(|| err(StatusCode::UNAUTHORIZED, "login needed"))
+    }
+
+    async fn admin(&self, headers: &HeaderMap) -> Result<User, Response> {
+        let u = self.auth(headers).await?;
+        if u.admin {
+            Ok(u)
+        } else {
+            Err(err(StatusCode::FORBIDDEN, "admins only"))
+        }
+    }
+
+    async fn new_session(&self, name: &str) -> String {
+        let token = random_hex(32);
+        self.sessions.lock().await.insert(token.clone(), name.to_string());
+        self.store_sessions().await;
+        token
+    }
 }
 
 async fn total_size(dir: &PathBuf) -> u64 {
+    // all savegames of all users
     let mut total = 0;
-    if let Ok(mut rd) = tokio::fs::read_dir(dir).await {
-        while let Ok(Some(e)) = rd.next_entry().await {
-            if let Ok(m) = e.metadata().await {
-                total += m.len();
+    let mut stack = vec![dir.clone()];
+    while let Some(d) = stack.pop() {
+        if let Ok(mut rd) = tokio::fs::read_dir(&d).await {
+            while let Ok(Some(e)) = rd.next_entry().await {
+                if let Ok(m) = e.metadata().await {
+                    if m.is_dir() {
+                        stack.push(e.path());
+                    } else {
+                        total += m.len();
+                    }
+                }
             }
         }
     }
     total
 }
 
-async fn health() -> &'static str {
-    "ok"
+async fn health(State(st): State<AppState>) -> &'static str {
+    if st.users.lock().await.is_empty() {
+        "ok setup"
+    } else {
+        "ok"
+    }
 }
 
-async fn list(State(st): State<AppState>) -> Response {
-    let mut out: Vec<SaveInfo> = Vec::new();
+async fn login(State(st): State<AppState>, Json(c): Json<Credentials>) -> Response {
+    if limited(&st.logins, LOGINS_PER_MINUTE).await {
+        return err(StatusCode::TOO_MANY_REQUESTS, "too many attempts");
+    }
+    let name = c.name.trim().to_string();
+    if !valid_user(&name) || c.password.len() < 4 {
+        return err(StatusCode::BAD_REQUEST, "invalid name or password too short");
+    }
+    let mut users = st.users.lock().await;
+    let user = if users.is_empty() {
+        // first login: this becomes the admin account
+        let salt = random_hex(16);
+        let u = User { name: name.clone(), hash: hash_password(&c.password, &salt), salt, admin: true };
+        users.push(u.clone());
+        drop(users);
+        st.store_users().await;
+        migrate_shared_saves(&st, &name).await;
+        u
+    } else {
+        let Some(u) = users.iter().find(|u| u.name == name).cloned() else {
+            return err(StatusCode::UNAUTHORIZED, "wrong name or password");
+        };
+        drop(users);
+        if !same(&hash_password(&c.password, &u.salt), &u.hash) {
+            return err(StatusCode::UNAUTHORIZED, "wrong name or password");
+        }
+        u
+    };
+    let token = st.new_session(&user.name).await;
+    Json(serde_json::json!({ "token": token, "name": user.name, "admin": user.admin })).into_response()
+}
+
+// savegames of the time before user accounts belong to the admin
+async fn migrate_shared_saves(st: &AppState, admin: &str) {
+    let target = st.user_dir(admin);
+    let _ = tokio::fs::create_dir_all(&target).await;
     if let Ok(mut rd) = tokio::fs::read_dir(&st.dir).await {
+        while let Ok(Some(e)) = rd.next_entry().await {
+            let p = e.path();
+            let ext = p.extension().and_then(|x| x.to_str()).unwrap_or("");
+            let fname = p.file_name().and_then(|x| x.to_str()).unwrap_or("").to_string();
+            if (ext == "json" || ext == "meta") && fname != "users.json" && fname != "sessions.json" {
+                let _ = tokio::fs::rename(&p, target.join(&fname)).await;
+            }
+        }
+    }
+}
+
+async fn logout(State(st): State<AppState>, headers: HeaderMap) -> Response {
+    if let Some(t) = headers.get("authorization").and_then(|v| v.to_str().ok()).and_then(|v| v.strip_prefix("Bearer ")) {
+        st.sessions.lock().await.remove(t.trim());
+        st.store_sessions().await;
+    }
+    StatusCode::NO_CONTENT.into_response()
+}
+
+async fn me(State(st): State<AppState>, headers: HeaderMap) -> Response {
+    match st.auth(&headers).await {
+        Ok(u) => Json(serde_json::json!({ "name": u.name, "admin": u.admin })).into_response(),
+        Err(r) => r,
+    }
+}
+
+async fn auth_check(State(st): State<AppState>, headers: HeaderMap) -> Response {
+    match st.auth(&headers).await {
+        Ok(_) => StatusCode::NO_CONTENT.into_response(),
+        Err(r) => r,
+    }
+}
+
+async fn change_password(State(st): State<AppState>, headers: HeaderMap, Json(c): Json<PasswordChange>) -> Response {
+    let u = match st.auth(&headers).await {
+        Ok(u) => u,
+        Err(r) => return r,
+    };
+    if !same(&hash_password(&c.old, &u.salt), &u.hash) {
+        return err(StatusCode::FORBIDDEN, "wrong password");
+    }
+    if c.new.len() < 4 {
+        return err(StatusCode::BAD_REQUEST, "password too short");
+    }
+    {
+        let mut users = st.users.lock().await;
+        if let Some(x) = users.iter_mut().find(|x| x.name == u.name) {
+            x.salt = random_hex(16);
+            x.hash = hash_password(&c.new, &x.salt);
+        }
+    }
+    st.store_users().await;
+    StatusCode::NO_CONTENT.into_response()
+}
+
+async fn list_users(State(st): State<AppState>, headers: HeaderMap) -> Response {
+    if let Err(r) = st.admin(&headers).await {
+        return r;
+    }
+    let users = st.users.lock().await;
+    Json(users.iter().map(|u| serde_json::json!({ "name": u.name, "admin": u.admin })).collect::<Vec<_>>()).into_response()
+}
+
+async fn create_user(State(st): State<AppState>, headers: HeaderMap, Json(c): Json<Credentials>) -> Response {
+    if let Err(r) = st.admin(&headers).await {
+        return r;
+    }
+    let name = c.name.trim().to_string();
+    if !valid_user(&name) || c.password.len() < 4 {
+        return err(StatusCode::BAD_REQUEST, "invalid name or password too short");
+    }
+    {
+        let mut users = st.users.lock().await;
+        if users.iter().any(|u| u.name == name) {
+            return err(StatusCode::CONFLICT, "user exists");
+        }
+        let salt = random_hex(16);
+        users.push(User { name: name.clone(), hash: hash_password(&c.password, &salt), salt, admin: false });
+    }
+    st.store_users().await;
+    StatusCode::CREATED.into_response()
+}
+
+async fn delete_user(State(st): State<AppState>, headers: HeaderMap, Path(name): Path<String>) -> Response {
+    let admin = match st.admin(&headers).await {
+        Ok(u) => u,
+        Err(r) => return r,
+    };
+    if name == admin.name || !valid_user(&name) {
+        return err(StatusCode::BAD_REQUEST, "cannot delete this user");
+    }
+    st.users.lock().await.retain(|u| u.name != name);
+    st.sessions.lock().await.retain(|_, n| *n != name);
+    st.store_users().await;
+    st.store_sessions().await;
+    let _ = tokio::fs::remove_dir_all(st.user_dir(&name)).await;
+    StatusCode::NO_CONTENT.into_response()
+}
+
+async fn list(State(st): State<AppState>, headers: HeaderMap) -> Response {
+    let u = match st.auth(&headers).await {
+        Ok(u) => u,
+        Err(r) => return r,
+    };
+    let mut out: Vec<SaveInfo> = Vec::new();
+    if let Ok(mut rd) = tokio::fs::read_dir(st.user_dir(&u.name)).await {
         while let Ok(Some(e)) = rd.next_entry().await {
             let p = e.path();
             if p.extension().and_then(|x| x.to_str()) == Some("meta") {
@@ -119,27 +381,30 @@ async fn list(State(st): State<AppState>) -> Response {
     Json(out).into_response()
 }
 
-async fn get_save(State(st): State<AppState>, Path(id): Path<String>) -> Response {
+async fn get_save(State(st): State<AppState>, headers: HeaderMap, Path(id): Path<String>) -> Response {
+    let u = match st.auth(&headers).await {
+        Ok(u) => u,
+        Err(r) => return r,
+    };
     if !valid_id(&id) {
         return err(StatusCode::BAD_REQUEST, "bad id");
     }
-    match tokio::fs::read(st.dir.join(format!("{}.json", id))).await {
+    match tokio::fs::read(st.user_dir(&u.name).join(format!("{}.json", id))).await {
         Ok(b) => ([("content-type", "application/json")], b).into_response(),
         Err(_) => err(StatusCode::NOT_FOUND, "not found"),
     }
 }
 
-async fn store(st: &AppState, id: String, name: Option<String>, body: Bytes) -> Response {
+async fn store(st: &AppState, user: &User, id: String, name: Option<String>, body: Bytes) -> Response {
     if body.len() > MAX_SAVE {
         return err(StatusCode::PAYLOAD_TOO_LARGE, "savegame too large");
     }
-    if !rate_ok(st).await {
+    if limited(&st.writes, WRITES_PER_MINUTE).await {
         return err(StatusCode::TOO_MANY_REQUESTS, "too many requests");
     }
     if total_size(&st.dir).await + body.len() as u64 > MAX_TOTAL {
         return err(StatusCode::INSUFFICIENT_STORAGE, "storage full");
     }
-    // must be a DungeonCraft savegame; a few values are kept for the list
     let v: serde_json::Value = match serde_json::from_slice(&body) {
         Ok(v) => v,
         Err(_) => return err(StatusCode::BAD_REQUEST, "not JSON"),
@@ -158,55 +423,81 @@ async fn store(st: &AppState, id: String, name: Option<String>, body: Bytes) ->
         wave: game["wave"].as_u64().unwrap_or(0),
         time: game["time"].as_f64().unwrap_or(0.0),
     };
-    let save_path = st.dir.join(format!("{}.json", id));
-    let meta_path = st.dir.join(format!("{}.meta", id));
-    if tokio::fs::write(&save_path, &body).await.is_err() || tokio::fs::write(&meta_path, serde_json::to_vec(&info).unwrap_or_default()).await.is_err() {
+    let dir = st.user_dir(&user.name);
+    let _ = tokio::fs::create_dir_all(&dir).await;
+    let ok = tokio::fs::write(dir.join(format!("{}.json", id)), &body).await.is_ok()
+        && tokio::fs::write(dir.join(format!("{}.meta", id)), serde_json::to_vec(&info).unwrap_or_default()).await.is_ok();
+    if !ok {
         return err(StatusCode::INTERNAL_SERVER_ERROR, "write failed");
     }
     Json(info).into_response()
 }
 
-async fn create(State(st): State<AppState>, Query(q): Query<NameQuery>, body: Bytes) -> Response {
+async fn create(State(st): State<AppState>, headers: HeaderMap, Query(q): Query<NameQuery>, body: Bytes) -> Response {
+    let u = match st.auth(&headers).await {
+        Ok(u) => u,
+        Err(r) => return r,
+    };
     let id = format!("{}-{:04x}", now(), (now_nanos() % 0xffff) as u16);
-    store(&st, id, q.name, body).await
+    store(&st, &u, id, q.name, body).await
 }
 
-async fn overwrite(State(st): State<AppState>, Path(id): Path<String>, Query(q): Query<NameQuery>, body: Bytes) -> Response {
+async fn overwrite(State(st): State<AppState>, headers: HeaderMap, Path(id): Path<String>, Query(q): Query<NameQuery>, body: Bytes) -> Response {
+    let u = match st.auth(&headers).await {
+        Ok(u) => u,
+        Err(r) => return r,
+    };
     if !valid_id(&id) {
         return err(StatusCode::BAD_REQUEST, "bad id");
     }
-    store(&st, id, q.name, body).await
+    store(&st, &u, id, q.name, body).await
 }
 
-async fn delete(State(st): State<AppState>, Path(id): Path<String>) -> Response {
+async fn delete_save(State(st): State<AppState>, headers: HeaderMap, Path(id): Path<String>) -> Response {
+    let u = match st.auth(&headers).await {
+        Ok(u) => u,
+        Err(r) => return r,
+    };
     if !valid_id(&id) {
         return err(StatusCode::BAD_REQUEST, "bad id");
     }
-    if !rate_ok(&st).await {
+    if limited(&st.writes, WRITES_PER_MINUTE).await {
         return err(StatusCode::TOO_MANY_REQUESTS, "too many requests");
     }
-    let _ = tokio::fs::remove_file(st.dir.join(format!("{}.json", id))).await;
-    let _ = tokio::fs::remove_file(st.dir.join(format!("{}.meta", id))).await;
+    let dir = st.user_dir(&u.name);
+    let _ = tokio::fs::remove_file(dir.join(format!("{}.json", id))).await;
+    let _ = tokio::fs::remove_file(dir.join(format!("{}.meta", id))).await;
     StatusCode::NO_CONTENT.into_response()
 }
 
-fn now_nanos() -> u128 {
-    SystemTime::now().duration_since(UNIX_EPOCH).map(|d| d.as_nanos()).unwrap_or(0)
-}
-
 #[tokio::main]
 async fn main() {
     let dir = PathBuf::from(std::env::var("SAVE_DIR").unwrap_or_else(|_| "/data".into()));
-    tokio::fs::create_dir_all(&dir).await.expect("save directory");
-    let state = AppState { dir, writes: Arc::new(Mutex::new(Vec::new())) };
+    tokio::fs::create_dir_all(dir.join("users")).await.expect("data directory");
+    let users: Vec<User> = tokio::fs::read(dir.join("users.json")).await.ok().and_then(|b| serde_json::from_slice(&b).ok()).unwrap_or_default();
+    let sessions: HashMap<String, String> = tokio::fs::read(dir.join("sessions.json")).await.ok().and_then(|b| serde_json::from_slice(&b).ok()).unwrap_or_default();
+    let state = AppState {
+        dir,
+        users: Arc::new(Mutex::new(users)),
+        sessions: Arc::new(Mutex::new(sessions)),
+        writes: Arc::new(Mutex::new(Vec::new())),
+        logins: Arc::new(Mutex::new(Vec::new())),
+    };
     let app = Router::new()
         .route("/api/health", get(health))
+        .route("/api/login", post(login))
+        .route("/api/logout", post(logout))
+        .route("/api/me", get(me))
+        .route("/api/auth", get(auth_check))
+        .route("/api/password", post(change_password))
+        .route("/api/users", get(list_users).post(create_user))
+        .route("/api/users/{name}", delete(delete_user))
         .route("/api/saves", get(list).post(create))
-        .route("/api/saves/{id}", get(get_save).put(overwrite).delete(delete))
+        .route("/api/saves/{id}", get(get_save).put(overwrite).delete(delete_save))
         .layer(DefaultBodyLimit::max(MAX_SAVE + 1024))
         .with_state(state);
     let addr = std::env::var("LISTEN").unwrap_or_else(|_| "0.0.0.0:8080".into());
     let listener = tokio::net::TcpListener::bind(&addr).await.expect("bind");
-    println!("DungeonCraft savegame service on {}", addr);
+    println!("DungeonCraft service on {}", addr);
     axum::serve(listener, app).await.expect("server");
 }