34 lines
2.1 KiB
C
34 lines
2.1 KiB
C
/* SPDX-License-Identifier: GPL-3.0-only */
|
|
#pragma once
|
|
#include <stdint.h>
|
|
#include "esp_http_server.h"
|
|
|
|
/* HTTPD authenticates/admin-checks and copies input; only an ID is queued to
|
|
* the existing dispatcher. HTTP 202 means admission, not mutation success.
|
|
* One global pending/result slot; only the original login can read its result
|
|
* (logging in again as the same account does not recover it). Completed results
|
|
* are replaceable, not durable history or an idempotent retry API.
|
|
* Execution rechecks the login and 30-second admission deadline; admitted DB
|
|
* work may finish after session loss. Pending create/password input also has
|
|
* periodic expiry; executing input is wiped on return, not by that timer. */
|
|
esp_err_t web_account_settings_handler(httpd_req_t *request);
|
|
void web_account_settings_execute(uint32_t id);
|
|
/* POST /api/settings/accounts/keys: admin cookie + Origin/CSRF, JSON exactly
|
|
* {username,user_id,auth_generation}. Read-only zero-wait snapshot, 512-byte
|
|
* response bound: {username,user_id,auth_generation,keys:[{index,type,fingerprint}]}.
|
|
* Fingerprints are OpenSSH SHA256: base64 without padding, never key blobs.
|
|
* Stale/absent target: 409 {error:"stale"}; busy DB: 503 accounts_unavailable.
|
|
* Register independently as an optional POST route.
|
|
*
|
|
* Existing account-operation POST adds key-add (+public_key, OpenSSH text <=384
|
|
* decoded bytes), key-delete (+key_index integer 0..2), key-clear. All require
|
|
* username/user_id/auth_generation. Exact schemas, <=768 body bytes/4 receives.
|
|
* Text/base64 errors: 400; canonical SSH blob/curve validation runs on dispatcher
|
|
* (failed result). Duplicate/full/stale use existing named result states.
|
|
* Success target-revokes immediately, including self; lost response/401 remains
|
|
* uncertain, never proof of cancellation. No automatic mutation retries. */
|
|
esp_err_t web_account_keys_handler(httpd_req_t *request);
|
|
/* POST /api/settings/accounts/generate-password; bodyless admin cookie +
|
|
* Origin/CSRF. RNG only, no queued/account/persistent state or retrieval. */
|
|
esp_err_t web_account_generate_password_handler(httpd_req_t *request);
|