Add role-based user database administration

src/web_console.c

@@ -10,6 +10,7 @@
 #include "esp_console.h"
 #include "secure_random.h"
 #include "ssh_transport.h"
+#include "user_database.h"
 #include "web_security.h"
 #include "web_serial_transport.h"
 #include "web_server.h"
@@ -223,6 +224,36 @@ static int restart_if_running(bool was_running)
     return 0;
 }
 
+static void synchronize_migrated_user(
+    const web_security_credentials_t *credentials)
+{
+    const user_database_legacy_credentials_t legacy = {
+        .username = (const uint8_t *)credentials->username,
+        .username_length = credentials->username_length,
+        .password = (const uint8_t *)credentials->password,
+        .password_length = credentials->password_length,
+    };
+    bool synchronized = false;
+    esp_err_t error = user_database_sync_legacy_credentials(&legacy, &synchronized);
+    if (error != ESP_OK) {
+        printf("Warning: migrated user synchronization failed: %s. Boot will retry a valid stored database; otherwise use 'user recover --force'.\n",
+               esp_err_to_name(error));
+        return;
+    }
+    if (synchronized) {
+        printf("The pre-bootstrap migrated user credential was synchronized.\n");
+        return;
+    }
+
+    user_database_snapshot_t snapshot;
+    if (user_database_get_snapshot(&snapshot) == ESP_OK &&
+        snapshot.admin_bootstrapped) {
+        printf("Phase 8A note: this legacy HTTPS/SSH credential is separate from bootstrapped user passwords until Phase 8B.\n");
+    } else {
+        printf("Warning: no matching pre-bootstrap migrated user was synchronized; establish an administrator with 'user bootstrap'.\n");
+    }
+}
+
 static int rotate_credentials(void)
 {
     web_security_credentials_t credentials;
@@ -232,6 +263,7 @@ static int rotate_credentials(void)
         return 1;
     }
 
+    synchronize_migrated_user(&credentials);
     esp_err_t web_revoke_error = web_serial_transport_revoke_sessions();
     esp_err_t ssh_revoke_error = ssh_transport_revoke_sessions();
     printf("Administrative credentials rotated and persisted. Existing HTTPS and SSH credentials are now invalid.\n");
@@ -278,6 +310,7 @@ static int reset_material(void)
         return 1;
     }
 
+    synchronize_migrated_user(&credentials);
     esp_err_t web_revoke_error = web_serial_transport_revoke_sessions();
     esp_err_t ssh_revoke_error = ssh_transport_revoke_sessions();
     printf("Administrative credentials, HTTPS certificate, and HTTPS private key replaced and persisted.\n");