Implement role-aware HTTPS and SSH authentication

src/user_console.c

@@ -11,8 +11,10 @@
 #include "esp_console.h"
 #include "mbedtls/base64.h"
 #include "secure_random.h"
+#include "ssh_transport.h"
 #include "user_database.h"
 #include "web_security.h"
+#include "web_serial_transport.h"
 
 #define USER_CONSOLE_KEY_LINE_CAPACITY 256U
 
@@ -32,6 +34,22 @@ static void print_usage(void)
     printf("  user key clear <username> --force\n");
 }
 
+static void revoke_user_network_sessions(const char *username)
+{
+    size_t username_length = strlen(username);
+    esp_err_t web_error = web_serial_transport_revoke_user(
+        (const uint8_t *)username, username_length);
+    esp_err_t ssh_error = ssh_transport_revoke_user(
+        (const uint8_t *)username, username_length);
+    if (web_error != ESP_OK && web_error != ESP_ERR_INVALID_STATE) {
+        printf("Warning: WebSocket revocation failed: %s\n",
+               esp_err_to_name(web_error));
+    }
+    if (ssh_error != ESP_OK && ssh_error != ESP_ERR_INVALID_STATE) {
+        printf("Warning: SSH revocation failed: %s\n", esp_err_to_name(ssh_error));
+    }
+}
+
 static void print_fingerprint(const uint8_t fingerprint[USER_DATABASE_SHA256_LENGTH])
 {
     uint8_t encoded[48] = {0};
@@ -191,7 +209,8 @@ static int bootstrap(bool generated)
         printf("Could not bootstrap administrator: %s\n", esp_err_to_name(error));
         return 1;
     }
-    printf("Administrator account bootstrapped. Authentication integration follows in Phase 8B.\n");
+    revoke_user_network_sessions("admin");
+    printf("Administrator account bootstrapped. Role-aware HTTPS and SSH authentication is active.\n");
     return 0;
 }
 
@@ -225,6 +244,7 @@ static int add_user(const char *username, const char *role_text, bool generated)
         printf("Could not add user: %s\n", esp_err_to_name(error));
         return 1;
     }
+    revoke_user_network_sessions(username);
     printf("User '%s' added with role %s.\n", username, user_role_to_string(role));
     return 0;
 }
@@ -254,7 +274,8 @@ static int change_password(const char *username, bool generated)
         printf("Could not change password: %s\n", esp_err_to_name(error));
         return 1;
     }
-    printf("Password changed; affected network sessions will be revoked in Phase 8B.\n");
+    revoke_user_network_sessions(username);
+    printf("Password changed; affected network sessions are now stale and will be revoked.\n");
     return 0;
 }
 
@@ -338,7 +359,8 @@ static int add_key(const char *username)
         printf("Could not add SSH key: %s\n", esp_err_to_name(error));
         return 1;
     }
-    printf("SSH public key added at index %u. Key login is enabled in Phase 8B.\n",
+    revoke_user_network_sessions(username);
+    printf("SSH public key added at index %u. Public-key login is active.\n",
            (unsigned int)key_index);
     return 0;
 }
@@ -380,6 +402,7 @@ static int command_user(int argc, char **argv)
                    esp_err_to_name(error));
             return 1;
         }
+        revoke_user_network_sessions(argv[2]);
         printf("User '%s' deleted.\n", argv[2]);
         return 0;
     }
@@ -398,6 +421,7 @@ static int command_user(int argc, char **argv)
                    esp_err_to_name(error));
             return 1;
         }
+        revoke_user_network_sessions(argv[2]);
         printf("User '%s' role changed to %s.\n", argv[2], user_role_to_string(role));
         return 0;
     }
@@ -426,6 +450,7 @@ static int command_user(int argc, char **argv)
             printf("Could not delete SSH key: %s\n", esp_err_to_name(error));
             return 1;
         }
+        revoke_user_network_sessions(argv[3]);
         printf("SSH key %u deleted for '%s'.\n", (unsigned int)index, argv[3]);
         return 0;
     }
@@ -437,6 +462,7 @@ static int command_user(int argc, char **argv)
             printf("Could not clear SSH keys: %s\n", esp_err_to_name(error));
             return 1;
         }
+        revoke_user_network_sessions(argv[3]);
         printf("SSH keys cleared for '%s'.\n", argv[3]);
         return 0;
     }