Implement role-aware HTTPS and SSH authentication

src/web_serial_transport.h

@@ -10,6 +10,7 @@
 #include "esp_err.h"
 #include "esp_http_server.h"
 #include "session_broker.h"
+#include "user_database.h"
 
 #ifdef __cplusplus
 extern "C" {
@@ -63,12 +64,16 @@ typedef struct {
 
 typedef struct {
     bool active;
+    bool principal_valid;
     bool writer;
     bool tx_pending;
     bool close_requested;
     int socket_fd;
     uint32_t generation;
     session_broker_client_id_t broker_client_id;
+    user_role_t user_role;
+    user_auth_method_t auth_method;
+    char username[USER_DATABASE_USERNAME_CAPACITY + 1U];
 } web_serial_transport_session_snapshot_t;
 
 typedef struct {
@@ -93,19 +98,20 @@ esp_err_t web_serial_transport_attach_server(httpd_handle_t server);
 esp_err_t web_serial_transport_detach_server(httpd_handle_t server);
 
 /*
- * Mint a one-time bearer ticket for an already-authenticated caller. The output
- * is exactly 32 Base64URL characters plus a terminator and expires after 30
- * monotonic seconds. Never log or persist the returned value.
+ * Mint a one-time bearer ticket bound to a current authenticated principal. The
+ * principal is copied; the output is exactly 32 Base64URL characters plus a
+ * terminator and expires after 30 monotonic seconds. Never log or persist it.
  */
-esp_err_t web_serial_transport_mint_ticket(char *ticket, size_t capacity);
+esp_err_t web_serial_transport_mint_ticket(const user_principal_t *principal,
+                                           char *ticket, size_t capacity);
 
 /*
  * Convenience POST response helper for /api/ws-ticket. Authentication is
- * intentionally outside this module: call this only after Basic authentication
- * has already succeeded. Register it as HTTP_POST, not as a public handler.
+ * intentionally outside this module: pass the principal returned by successful
+ * Basic authentication. Register it as HTTP_POST, not as a public handler.
  */
 esp_err_t web_serial_transport_handle_authenticated_ticket_request(
-    httpd_req_t *request);
+    httpd_req_t *request, const user_principal_t *principal);
 
 /*
  * Handler for /ws/serial. Register as HTTP_GET with is_websocket=true and
@@ -120,7 +126,9 @@ esp_err_t web_serial_transport_get_snapshot(
 /* Clearing counters does not alter tickets, sessions, ownership, or queued data. */
 esp_err_t web_serial_transport_clear_counters(void);
 
-/* Invalidate outstanding tickets and close authenticated web serial sessions. */
+/* Invalidate tickets/sessions for one account, or all authenticated sessions. */
+esp_err_t web_serial_transport_revoke_user(const uint8_t *username,
+                                           size_t username_length);
 esp_err_t web_serial_transport_revoke_sessions(void);
 
 #ifdef __cplusplus