Compare commits
6
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 sjg
|
3c3fc69542 | ||
 sjgandClaude Opus 5
|
d539ff96e5 | ||
|
sjgandClaude Opus 5
|
ca5cd65c85 | ||
|
sjgandClaude Opus 5
|
a9e1e86fdc | ||
|
sjgandClaude Opus 5
|
76e33a91bb | ||
|
sjgandClaude Opus 5
|
ee185b98bc |
Generated
+93
-5
@@ -316,6 +316,18 @@ version = "1.0.102"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
|
||||
|
||||
[[package]]
|
||||
name = "argon2"
|
||||
version = "0.5.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
|
||||
dependencies = [
|
||||
"base64ct",
|
||||
"blake2",
|
||||
"cpufeatures 0.2.17",
|
||||
"password-hash",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "atomic-waker"
|
||||
version = "1.1.2"
|
||||
@@ -345,6 +357,12 @@ version = "0.22.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
|
||||
|
||||
[[package]]
|
||||
name = "base64ct"
|
||||
version = "1.8.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
|
||||
|
||||
[[package]]
|
||||
name = "bindgen"
|
||||
version = "0.66.1"
|
||||
@@ -395,6 +413,24 @@ version = "2.11.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
|
||||
|
||||
[[package]]
|
||||
name = "blake2"
|
||||
version = "0.10.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
|
||||
dependencies = [
|
||||
"digest 0.10.7",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "block-buffer"
|
||||
version = "0.10.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
|
||||
dependencies = [
|
||||
"generic-array",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "block-buffer"
|
||||
version = "0.12.0"
|
||||
@@ -525,7 +561,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
|
||||
dependencies = [
|
||||
"cfg-if",
|
||||
"cpufeatures",
|
||||
"cpufeatures 0.3.0",
|
||||
"rand_core 0.10.1",
|
||||
]
|
||||
|
||||
@@ -721,6 +757,15 @@ dependencies = [
|
||||
"windows",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "cpufeatures"
|
||||
version = "0.2.17"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
|
||||
dependencies = [
|
||||
"libc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "cpufeatures"
|
||||
version = "0.3.0"
|
||||
@@ -739,6 +784,16 @@ dependencies = [
|
||||
"cfg-if",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "crypto-common"
|
||||
version = "0.1.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
|
||||
dependencies = [
|
||||
"generic-array",
|
||||
"typenum",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "crypto-common"
|
||||
version = "0.2.1"
|
||||
@@ -799,15 +854,26 @@ dependencies = [
|
||||
"zeroize",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "digest"
|
||||
version = "0.10.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
|
||||
dependencies = [
|
||||
"block-buffer 0.10.4",
|
||||
"crypto-common 0.1.7",
|
||||
"subtle",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "digest"
|
||||
version = "0.11.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4850db49bf08e663084f7fb5c87d202ef91a3907271aff24a94eb97ff039153c"
|
||||
dependencies = [
|
||||
"block-buffer",
|
||||
"block-buffer 0.12.0",
|
||||
"const-oid",
|
||||
"crypto-common",
|
||||
"crypto-common 0.2.1",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -1019,6 +1085,16 @@ dependencies = [
|
||||
"slab",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "generic-array"
|
||||
version = "0.14.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
|
||||
dependencies = [
|
||||
"typenum",
|
||||
"version_check",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "getrandom"
|
||||
version = "0.2.17"
|
||||
@@ -1890,6 +1966,17 @@ dependencies = [
|
||||
"windows-link",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "password-hash"
|
||||
version = "0.5.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
|
||||
dependencies = [
|
||||
"base64ct",
|
||||
"rand_core 0.6.4",
|
||||
"subtle",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "peeking_take_while"
|
||||
version = "0.1.2"
|
||||
@@ -2492,8 +2579,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
|
||||
dependencies = [
|
||||
"cfg-if",
|
||||
"cpufeatures",
|
||||
"digest",
|
||||
"cpufeatures 0.3.0",
|
||||
"digest 0.11.2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -3215,6 +3302,7 @@ version = "0.1.0"
|
||||
dependencies = [
|
||||
"actix-web",
|
||||
"actix-ws",
|
||||
"argon2",
|
||||
"base64",
|
||||
"brotli 7.0.0",
|
||||
"bytes",
|
||||
|
||||
@@ -1043,7 +1043,7 @@ The `FrontendRuntimeContext` struct in `trx-frontend/src/lib.rs` is decomposed i
|
||||
|-----------|---------|------------|
|
||||
| `AudioContext` | Audio streaming channels | `rx`, `tx`, `info`, `decode_rx`, `clients` |
|
||||
| `DecodeHistoryContext` | Decode history for all types | `ais`, `vdes`, `aprs`, `hf_aprs`, `cw`, `ft8`, `ft4`, `ft2`, `wspr` |
|
||||
| `HttpAuthConfig` | HTTP auth settings | `enabled`, `rx_passphrase`, `session_ttl_secs`, `tokens` |
|
||||
| `HttpAuthConfig` | HTTP auth settings | `enabled`, `users_file`, bootstrap admin, `session_ttl_secs`, `tokens` |
|
||||
| `HttpUiConfig` | HTTP UI display config | `show_sdr_gain_control`, `initial_map_zoom`, `spectrum_*` |
|
||||
| `RigRoutingContext` | Remote rig state & routing | `active_rig_id`, `remote_rigs`, `rig_states`, `server_connected` |
|
||||
| `OwnerInfo` | Station metadata | `callsign`, `website_url`, `ais_vessel_url_base` |
|
||||
|
||||
@@ -322,3 +322,269 @@ trx-configurator
|
||||
| `trx-app` | Config types and validation | Yes |
|
||||
| `serialport` | Serial port enumeration | Yes (transitive) |
|
||||
| `soapysdr` | SDR device enumeration (optional) | Yes (feature-gated) |
|
||||
|
||||
---
|
||||
|
||||
## Logbook and Ham Radio Layout
|
||||
|
||||
Two halves of one feature ([#54](https://git.haxx.space/sjg/trx-rs/issues/54)): a station
|
||||
logbook in a panel of its own, and an operator layout that puts a transceiver's controls
|
||||
around it.
|
||||
|
||||
Nothing in the application records a QSO today. The map's "QSO summary" cards describe
|
||||
contacts *between other stations*, reconstructed from decoded traffic; bookmarks are
|
||||
frequencies, not contacts. Neither is the operator's own log.
|
||||
|
||||
### Requirements
|
||||
|
||||
| ID | Description |
|
||||
|----|-------------|
|
||||
| REQ-LOG-001 | The system shall record QSOs the operator makes, each holding at minimum callsign, date, time, band, frequency, mode and both signal reports. |
|
||||
| REQ-LOG-002 | When starting a log entry, the system shall pre-fill exactly six fields: frequency, mode, rig name, time, callsign and locator. |
|
||||
| REQ-LOG-003 | The system shall leave every other field of a log entry empty for the operator to fill. |
|
||||
| REQ-LOG-004 | The system shall allow a logged QSO to be edited and deleted. |
|
||||
| REQ-LOG-005 | The system shall survive a crash without losing a QSO that was recorded before it. |
|
||||
| REQ-LOG-006 | The system shall list, search and filter the log by callsign, band, mode and date range. |
|
||||
| REQ-LOG-007 | Where a decoded station is on screen, the system shall offer to start a log entry from it, pre-filled, without logging it unattended. |
|
||||
| REQ-LOG-008 | The system shall show whether a callsign has been worked before, and on which bands. |
|
||||
| REQ-FMT-001 | The system shall export the log as an ADIF 3.1.x `.adi` file. |
|
||||
| REQ-FMT-002 | The system shall import ADIF `.adi` files produced by other logging software, preserving fields it does not itself use. |
|
||||
| REQ-FMT-003 | When importing, the system shall identify QSOs already held and shall not duplicate them. |
|
||||
| REQ-FMT-004 | The system shall export a filtered selection of the log as a Cabrillo 3.0 file for contest submission. |
|
||||
| REQ-LOG-009 | The system shall stamp QSO times from the server's clock in UTC, and shall tell the operator when the browser's clock disagrees with it by more than one second. |
|
||||
| REQ-LAY-001 | The system shall present the logbook in a panel of its own, reachable whatever layout is selected. |
|
||||
| REQ-LAY-002 | The system shall offer a "Ham radio" operator layout presenting the transceiver controls and that panel together. |
|
||||
| REQ-LAY-003 | Where the selected rig cannot transmit, the system shall not offer the ham layout. |
|
||||
|
||||
### A decode is not a QSO
|
||||
|
||||
The decoders are receive-only: FT8, CW, APRS and the rest report what was *heard*. A heard
|
||||
callsign is the beginning of a log entry, not a contact, and the logbook must never write one
|
||||
by itself — REQ-LOG-007 says offer and pre-fill, never auto-log. Digital QSOs made in
|
||||
WSJT-X or similar arrive the way every other logger takes them: through ADIF import.
|
||||
|
||||
### What is pre-filled, and what is not
|
||||
|
||||
Six fields, and no more (REQ-LOG-002, REQ-LOG-003):
|
||||
|
||||
| Field | From | ADIF |
|
||||
|-------|------|------|
|
||||
| Frequency | the selected rig's dial | `FREQ`, with `BAND` derived from it |
|
||||
| Mode | the selected rig | `MODE`, and `SUBMODE` where the mode implies one |
|
||||
| Rig name | the rig's display name | `MY_RIG` |
|
||||
| Time | the server's clock, UTC, when the entry opens | `QSO_DATE`, `TIME_ON` |
|
||||
| Callsign | the decode row or map station the entry was started from, else empty | `CALL` |
|
||||
| Locator | that station's grid, where the decode carried one, else empty | `GRIDSQUARE` |
|
||||
|
||||
Signal reports, power, name, QTH and the rest stay empty. A report in particular is the
|
||||
operator's to give: an FT8 SNR is not what was sent, and pre-filling one would put a number in
|
||||
the log that nobody exchanged.
|
||||
|
||||
The station's own callsign and locator are not pre-filled per entry either — they are station
|
||||
identity, taken from configuration when the QSO is written (`STATION_CALLSIGN`, `OPERATOR`,
|
||||
`MY_GRIDSQUARE`), and shown once at the top of the panel rather than typed into every row.
|
||||
|
||||
### Architecture
|
||||
|
||||
#### New crate: `trx-logbook`
|
||||
|
||||
```
|
||||
src/trx-client/
|
||||
trx-logbook/
|
||||
src/
|
||||
lib.rs # LogbookHandle: open, add, edit, delete, query, import, export
|
||||
qso.rs # Qso: the record, its ADIF field mapping, band/mode helpers
|
||||
adif.rs # ADI reader and writer (pure Rust, no new dependencies)
|
||||
store.rs # Append-only JSON Lines file, in-memory index, compaction
|
||||
dedupe.rs # Worked-before and import-collision rules
|
||||
```
|
||||
|
||||
A library crate under `src/trx-client/`, beside `trx-frontend`, consumed by
|
||||
`trx-frontend-http`. The log belongs to the station rather than to a rig or a frontend, so it
|
||||
sits where any frontend can reach it.
|
||||
|
||||
#### Storage: append-only, not a rewritten blob
|
||||
|
||||
Bookmarks use `PickleDb` with `AutoDump`, which rewrites the whole file on every write. That
|
||||
is right for a few dozen bookmarks and wrong for a log: a station with 40 000 QSOs would
|
||||
rewrite several megabytes to log one contact, and lose the lot if the power went during the
|
||||
dump.
|
||||
|
||||
The log is instead a JSON Lines file — the shape `trx-decode-log` already uses — appended one
|
||||
record per write and read into an in-memory index at startup. An edit or a delete appends a new revision of that record's id; the load
|
||||
keeps the last one, and a compaction pass rewrites the file when superseded records exceed a
|
||||
threshold. Appending is O(1) and atomic per line, so a crash costs at most the line being
|
||||
written.
|
||||
|
||||
#### Two formats, for the two things a log is asked for
|
||||
|
||||
The file formats were left open ("pick a well-known ham format"), so: **ADIF for interchange,
|
||||
Cabrillo for contest submission.** Both are implemented in-repo, in the way this project
|
||||
already implements its decoders, and neither adds a dependency.
|
||||
|
||||
**ADIF has to stay.** It is not one option among several — it is the only thing the ecosystem
|
||||
reads. LoTW, eQSL, Club Log, QRZ.com and every other logger take ADIF and nothing else, so a
|
||||
log that cannot write `.adi` cannot be uploaded, confirmed, or moved to another program. That
|
||||
is a one-way door, and the interoperability is most of the point of keeping a log at all.
|
||||
Nothing on disk is ADI regardless: the store is JSON Lines, and ADIF is what comes out of an
|
||||
export.
|
||||
|
||||
ADI is a tagged text format — `<FIELD:length>value`, records ended by `<EOR>`, a header ended
|
||||
by `<EOH>`, everything outside a tag ignored — small enough to implement exactly. The reader
|
||||
must be lenient in the ways real files are irregular (lowercase tags, CRLF, missing header,
|
||||
unknown fields, type indicators) and the writer strict. Unknown fields are carried through
|
||||
import to export unchanged, so a round trip through trx-rs does not quietly strip what another
|
||||
logger wrote. ADX, the XML serialisation of the same data model, is out of scope: it is part
|
||||
of the standard but almost nothing reads it.
|
||||
|
||||
**Cabrillo is the second format, because ADIF cannot do its job.** Contest logs are submitted
|
||||
to sponsors in Cabrillo 3.0 and are rejected in anything else — a header of `CALLSIGN:`,
|
||||
`CONTEST:`, `CATEGORY-*` and `CLAIMED-SCORE:` lines, then one fixed-column `QSO:` line per
|
||||
contact carrying frequency in kHz, a mode code (`CW`, `PH`, `FM`, `RY`, `DG`), the UTC date and
|
||||
time, and both stations' calls, reports and exchanges. It is export-only and drops everything
|
||||
outside the contest's exchange, which is why it complements ADIF rather than replacing it.
|
||||
It arrives with the contest exchange fields in phase 5, since without a serial or a zone to
|
||||
put in the exchange there is nothing for it to write.
|
||||
|
||||
#### Integration points
|
||||
|
||||
| Source | What it gives the log | How |
|
||||
|--------|----------------------|-----|
|
||||
| `RigState` | `FREQ`, `BAND`, `MODE`/`SUBMODE`, and the rig id a QSO was made on | watch channel already in the frontend context |
|
||||
| Client config `general.callsign` | `STATION_CALLSIGN`, and the default `OPERATOR` | already surfaced as `owner_callsign` in frontend meta |
|
||||
| The QSO's own rig, and its position | `MY_GRIDSQUARE` | per-rig latitude and longitude already carried in the rig list |
|
||||
| Server clock | `QSO_DATE`, `TIME_ON` in UTC | new `GET /api/logbook/now`, which also feeds the browser-clock check |
|
||||
| Decoder panels and map | a pre-filled entry: callsign, grid, and the report to offer | existing decode history; no new plumbing |
|
||||
| `bandForHz` | `BAND` from a frequency | exists in `map-core.ts`; move to a shared module |
|
||||
|
||||
#### HTTP API
|
||||
|
||||
Under `/api/logbook`, as the recorder's endpoints are, because `/logbook` itself is the page:
|
||||
the `/bookmarks` API and the bookmarks page already share a path, and whichever is registered
|
||||
first wins.
|
||||
|
||||
| Method | Path | Purpose |
|
||||
|--------|------|---------|
|
||||
| `GET` | `/api/logbook` | Query: filters, paging |
|
||||
| `POST` | `/api/logbook` | Add a QSO |
|
||||
| `PUT` | `/api/logbook/{id}` | Edit |
|
||||
| `DELETE` | `/api/logbook/{id}` | Delete |
|
||||
| `GET` | `/api/logbook/export.adi` | ADIF export, honouring the current filter |
|
||||
| `GET` | `/api/logbook/export.cbr` | Cabrillo export of a contest selection |
|
||||
| `POST` | `/api/logbook/import` | Import, answering with counts: added, duplicate, rejected |
|
||||
| `GET` | `/api/logbook/worked/{call}` | Worked-before: bands and modes |
|
||||
| `GET` | `/api/logbook/statistics` | Contacts, stations and confirmations, per band |
|
||||
| `GET` | `/api/logbook/now` | The server's UTC clock, for checking the browser's |
|
||||
| `GET` | `/api/logbook/prefill` | The six fields an entry opens with |
|
||||
|
||||
Writes require the admin role, as the rig endpoints do.
|
||||
|
||||
### Frontend
|
||||
|
||||
The logbook is **its own panel**, not a strip bolted to the radio page: a `logbook` entry in
|
||||
the tab order beside Bookmarks, holding the entry form, the table with the filters of
|
||||
REQ-LOG-006, and import and export. It stands on its own in every layout, so a log can be kept
|
||||
without adopting the ham layout, and read while another layout is selected (REQ-LAY-001).
|
||||
|
||||
The panel is three parts: the station line at the top (own callsign, locator, the rig a QSO
|
||||
would be logged against), the entry form beneath it opening with the six pre-filled fields,
|
||||
and the log itself under that, filtered as REQ-LOG-006 asks. Worked-before shows against
|
||||
the callsign as it is typed.
|
||||
|
||||
The **ham layout** is a fifth entry in the operator layouts (`compact`, `broadcast`, `digital`,
|
||||
`full`), which already gate on capability, seed the disclosure sections and persist per rig:
|
||||
|
||||
```ts
|
||||
ham: {
|
||||
label: "Ham radio",
|
||||
unavailable: "Ham radio needs a rig that can transmit",
|
||||
advanced: true, audio: true, scheduler: false,
|
||||
preferredTab: "logbook", capability: "ham",
|
||||
}
|
||||
```
|
||||
|
||||
with the `ham` capability set from `RigCapabilities.tx`. It keeps frequency, VFO, mode, filter,
|
||||
PTT, power and the meters, and hides the broadcast furniture. What it adds over `full` is where
|
||||
it starts: the logbook panel, with the radio controls a keystroke away rather than the other
|
||||
way round — the layout an operator working the bands wants, where logging the contact is the
|
||||
task and the rig is the instrument.
|
||||
|
||||
### Phases
|
||||
|
||||
All five are implemented.
|
||||
|
||||
| Phase | Lands |
|
||||
|-------|-------|
|
||||
| 1 | `trx-logbook`: `Qso`, the ADI reader and writer, round-trip tests against files from other loggers |
|
||||
| 2 | Store, dedupe, and the HTTP API behind the admin role |
|
||||
| 3 | Logbook tab: entry, table, filters, import, export |
|
||||
| 4 | Ham layout, pre-filled entry from a decode row or the map, worked-before |
|
||||
| 5 | Contest exchange fields and Cabrillo export; QSL and LoTW/eQSL fields; per-band worked/confirmed statistics |
|
||||
|
||||
Two decisions phase 5 settled. The Cabrillo header cannot be derived from a log — how many
|
||||
operators, how much power, what the score is claimed to be — so it comes from the operator,
|
||||
with `SINGLE-OP`, `LOW`, `ALL` and `MIXED` behind it. And a confirmation counts from whichever
|
||||
bureau answered: an award wants one card or one electronic match, not one of each, so a log
|
||||
that counted them separately would tell the operator they were short of what they have.
|
||||
|
||||
### Decisions
|
||||
|
||||
**One station log, not one per rig.** Awards and uploads are per station callsign — DXCC, WAS
|
||||
and LoTW all count the callsign, not the radio — and a station worked on the second rig is
|
||||
still worked. The rig is recorded on the QSO (`MY_RIG`) rather than dividing the log by it.
|
||||
The station *location* fields do follow the rig, though: trx-rs rigs can be in different
|
||||
places, so `MY_GRIDSQUARE` is taken from the rig that made the QSO rather than from one global
|
||||
setting, which is also what LoTW's station locations expect.
|
||||
|
||||
**The operator is a per-QSO field, set once per session.** ADIF separates `STATION_CALLSIGN`
|
||||
(the call used on the air) from `OPERATOR` (the person at the key); multi-operator stations
|
||||
rotate operators through one station callsign, which is why contest loggers record it per QSO.
|
||||
It is stored per QSO, defaulted from the configured callsign so a single operator never touches
|
||||
it, and changed on the station line at the top of the panel where it sticks for the session.
|
||||
It cannot be taken from the session's identity: the auth roles are `admin` and `user`, with no
|
||||
notion of who is logged in.
|
||||
|
||||
**Server clock, and the log says so.** The server is the machine at the radio; the browser may
|
||||
be on a phone in another timezone with a clock nobody has checked. QSO times are UTC from the
|
||||
server, and when a browser's clock disagrees by more than a second the panel says so rather
|
||||
than silently logging a time the operator did not expect.
|
||||
|
||||
**The log file is configurable, and defaults to the user's data directory.** Bookmarks live in
|
||||
the config directory because they are settings; decode logs live in the cache directory because
|
||||
they are disposable. A QSO log is neither — it is irreplaceable, and cache directories are
|
||||
swept by cleaners. `[logbook].path` in the client config, defaulting to
|
||||
`dirs::data_dir()/trx-rs/logbook.jsonl`, so a station that keeps its log on a synced or
|
||||
backed-up volume can say so.
|
||||
|
||||
**Import collisions: callsign, band, mode and a two-minute window.** Two loggers rarely agree
|
||||
to the second on the same QSO — one records the time the contact started, another the time it
|
||||
was entered — so an exact-minute key duplicates half of what it is asked to merge. Two minutes
|
||||
absorbs that. It does not swallow legitimate re-works: contest rules forbid a second contact
|
||||
with the same station on the same band and mode, so a repeat inside two minutes is the same
|
||||
QSO. Times are compared as instants rather than date and time strings, so a QSO either side of
|
||||
midnight matches. Modes are normalised before comparison, or a log that stored `SSB` would fail
|
||||
to match ours that stored `USB`.
|
||||
|
||||
### Rig modes to ADIF modes
|
||||
|
||||
The rig reports what it is demodulating; ADIF wants what the contact was made on, which is not
|
||||
always the same word:
|
||||
|
||||
| Rig mode | ADIF `MODE` | ADIF `SUBMODE` |
|
||||
|----------|-------------|----------------|
|
||||
| `USB`, `LSB` | `SSB` | `USB` / `LSB` |
|
||||
| `CW`, `CWR` | `CW` | — |
|
||||
| `AM`, `SAM` | `AM` | — |
|
||||
| `FM`, `WFM` | `FM` | — |
|
||||
| `PKT` | `PKT` | — |
|
||||
| `DIG` | decided by the decoder in use, not by the rig | |
|
||||
| `AIS`, `VDES` | none — not amateur modes, and these rigs do not log | |
|
||||
| `Other(..)` | passed through when it names an ADIF mode, else left for the operator | |
|
||||
|
||||
`DIG` is the one that cannot come from the rig: a rig in `DIG` is in FT8, FT4 or something else
|
||||
depending on which decoder is running, and an entry started from an FT8 row logs `FT8` rather
|
||||
than the rig's word for it. WSPR never opens an entry at all — it is a beacon mode, and hearing
|
||||
a beacon is not a contact.
|
||||
|
||||
The table is data in `qso.rs`, checked against the ADIF enumeration when it is written, with
|
||||
anything unrecognised left to the operator rather than guessed into the log.
|
||||
|
||||
+10
-11
@@ -121,13 +121,12 @@ The spectrum panel uses `<canvas>` elements (WebGL renderer optional) and offers
|
||||
When auth is enabled, an **auth gate** blocks the UI with:
|
||||
|
||||
- Title: "Access Required"
|
||||
- Subtitle: "Enter passphrase to continue"
|
||||
- Password input + Login button (green accent, full-width)
|
||||
- Optional "Continue as Guest" button (shown when RX passphrase is not set)
|
||||
- Subtitle: "Sign in to continue"
|
||||
- Username and password inputs + Login button (green accent, full-width)
|
||||
- Error message area (red `#ff6b6b`)
|
||||
- Role badge display
|
||||
|
||||
Two roles: **Rx** (read-only) and **Control** (full access including TX/PTT).
|
||||
Two roles: **User** (read-only) and **Admin** (full access including user management).
|
||||
|
||||
Session cookie: `trx_http_sid`, HttpOnly, configurable Secure and SameSite attributes.
|
||||
|
||||
@@ -340,21 +339,21 @@ Routes are classified into three tiers:
|
||||
|
||||
| Tier | Examples | Requirement |
|
||||
|---|---|---|
|
||||
| **Public** | `/`, `/index.html`, `/map`, `/auth/*`, static assets | None |
|
||||
| **Read** | `/status`, `/events`, `/audio`, `/decode`, `/spectrum`, `/bookmarks` | Rx or Control role |
|
||||
| **Control** | `/set_freq`, `/set_mode`, `/set_ptt`, `/toggle_power`, all other POST | Control role only |
|
||||
| **Public** | `/`, `/index.html`, `/map`, login/session endpoints, static assets | None |
|
||||
| **Read** | `/status`, `/events`, `/audio`, `/decode`, `/spectrum`, `/bookmarks` | User or Admin role |
|
||||
| **Control** | `/set_freq`, `/set_mode`, `/set_ptt`, `/toggle_power`, all other POST | Admin role only |
|
||||
|
||||
### 7.2 Session Management
|
||||
|
||||
- Sessions are 128-bit random hex tokens stored in HttpOnly cookies
|
||||
- Configurable TTL (default from TOML config)
|
||||
- Expired sessions auto-pruned on access
|
||||
- Constant-time passphrase comparison to mitigate timing attacks
|
||||
- Passwords are verified against salted Argon2id hashes
|
||||
|
||||
### 7.3 TX Access Control
|
||||
### 7.3 User Management
|
||||
|
||||
An additional `tx_access_control_enabled` flag can restrict transmit-related actions even
|
||||
for Control-role users, providing an extra safety layer.
|
||||
Only administrators can list, add, update, or remove accounts. The final
|
||||
administrator cannot be removed or demoted.
|
||||
|
||||
---
|
||||
|
||||
|
||||
+51
-23
@@ -66,8 +66,7 @@ both:
|
||||
|------------|----------|----------|
|
||||
| `[listen.auth].tokens` | `tokens_file` | one token per line |
|
||||
| `[[remotes]].auth.token` | `token_file` | the token |
|
||||
| `[frontends.http.auth].rx_passphrase` | `rx_passphrase_file` | the passphrase |
|
||||
| `[frontends.http.auth].control_passphrase` | `control_passphrase_file` | the passphrase |
|
||||
| `[frontends.http.auth].bootstrap_admin_password` | `bootstrap_admin_password_file` | the initial administrator password |
|
||||
| `[frontends.http_json.auth].tokens` | `tokens_file` | one token per line |
|
||||
|
||||
Blank lines and `#` comments are ignored in the list files. A config that holds
|
||||
@@ -350,17 +349,17 @@ A name in any of those maps that no remote answers to is a config error.
|
||||
|
||||
| Field | Type | Default | Description |
|
||||
|-------|------|---------|-------------|
|
||||
| `enabled` | bool | `false` | Require a passphrase |
|
||||
| `rx_passphrase` | string | — | Passphrase granting receive-only access |
|
||||
| `rx_passphrase_file` | string | — | Read it from this file instead |
|
||||
| `control_passphrase` | string | — | Passphrase granting full control |
|
||||
| `control_passphrase_file` | string | — | Read it from this file instead |
|
||||
| `tx_access_control_enabled` | bool | `true` | Hide TX from unauthenticated users |
|
||||
| `enabled` | bool | `false` | Enable the user/password ACL |
|
||||
| `users_file` | string | `"trx-http-users.json"` | Persistent managed user database |
|
||||
| `bootstrap_admin_username` | string | — | First administrator, used only if the database is absent |
|
||||
| `bootstrap_admin_password` | string | — | First administrator password |
|
||||
| `bootstrap_admin_password_file` | string | — | Read the bootstrap password from this file instead |
|
||||
| `session_ttl_min` | u64 | `480` | Session lifetime |
|
||||
| `cookie_secure` | bool | `false` | Set Secure on the session cookie (needs HTTPS) |
|
||||
| `cookie_same_site` | string | `"Lax"` | `Strict`, `Lax`, or `None` |
|
||||
|
||||
With `enabled = true`, at least one passphrase must be set.
|
||||
When enabling ACL for the first time, configure both bootstrap fields. After
|
||||
the database exists, remove the bootstrap credentials from configuration.
|
||||
|
||||
#### `[frontends.rigctl]`
|
||||
|
||||
@@ -519,6 +518,30 @@ most the contact being written. It lives in your data directory by default;
|
||||
`[trx-client.logbook].path` moves it, for a station that keeps its log on a
|
||||
backed-up volume.
|
||||
|
||||
### Contests
|
||||
|
||||
The **Contest exchange** block on the entry holds the contest's name and the
|
||||
serials — sent and received. Both stay between contacts, because they belong to
|
||||
the session rather than to the contact just logged, and the serial sent counts
|
||||
on by itself so it is not retyped forty times an hour. An exchange that is a
|
||||
zone, a section or a name rather than a number is kept as written.
|
||||
|
||||
**Contest entry (Cabrillo)** exports the entry sponsors accept. Only the
|
||||
contacts of the contest named there are included. The header — operator
|
||||
category, power, claimed score — cannot be worked out from a log, so it is
|
||||
yours to fill in; the defaults are single operator, low power, all bands, mixed
|
||||
mode.
|
||||
|
||||
### Confirmations
|
||||
|
||||
The **QSL** column shows a tick when the other station has confirmed, and the
|
||||
**Confirm** button on a row records a card that has arrived. A confirmation
|
||||
counts from wherever it came: a paper card, LoTW or eQSL. An award wants one of
|
||||
them, not all three, so the log does not ask for all three.
|
||||
|
||||
**Bands worked** counts, per band, the contacts made, the distinct stations
|
||||
worked, and how many of those contacts are confirmed.
|
||||
|
||||
### Ham radio layout
|
||||
|
||||
The **Ham radio** operator layout opens on the logbook with the transceiver
|
||||
@@ -554,7 +577,7 @@ The link button in the top bar copies the current link to the clipboard. The
|
||||
address bar itself is updated as you tune, using `replaceState`, so sweeping
|
||||
the dial does not fill the browser's history.
|
||||
|
||||
Applying a link changes the radio, so it needs the `control` role; an `rx`
|
||||
Applying a link changes the radio, so it needs the `admin` role; a `user`
|
||||
session opens the page and says the link was not applied. Links describe the
|
||||
rig's own dial — while a tab is listening to a virtual channel the address is
|
||||
left as it was, rather than publishing a frequency the rig is not on.
|
||||
@@ -563,53 +586,58 @@ left as it was, rather than publishing a frequency the rig is not on.
|
||||
|
||||
## Authentication
|
||||
|
||||
The HTTP frontend supports optional passphrase-based authentication with two
|
||||
The HTTP frontend supports an optional user/password ACL with multiple accounts and two
|
||||
roles:
|
||||
|
||||
- **rx** — read-only access (monitoring, audio, decode streams)
|
||||
- **control** — full access (frequency, mode, PTT, and all settings)
|
||||
- **user** — read-only access (monitoring, audio, decode streams)
|
||||
- **admin** — full radio control, settings, and user management
|
||||
|
||||
### Configuration
|
||||
|
||||
```toml
|
||||
[frontends.http.auth]
|
||||
enabled = false
|
||||
rx_passphrase = "rx-only-passphrase"
|
||||
control_passphrase = "full-control-passphrase"
|
||||
tx_access_control_enabled = true
|
||||
users_file = "trx-http-users.json"
|
||||
bootstrap_admin_username = "admin"
|
||||
bootstrap_admin_password = "change-this-password"
|
||||
session_ttl_min = 480
|
||||
cookie_secure = false # true if served via HTTPS
|
||||
cookie_same_site = "Lax" # Strict|Lax|None
|
||||
```
|
||||
|
||||
When `enabled = false` (the default), all auth is bypassed and the UI behaves
|
||||
as before. When enabled, at least one passphrase must be set.
|
||||
as before. When enabling it for the first time, bootstrap credentials create
|
||||
the initial administrator and the Argon2id-hashed user database.
|
||||
|
||||
### Behaviour
|
||||
|
||||
- On login, the server issues an `HttpOnly` session cookie.
|
||||
- Sessions are in-memory; a server restart invalidates all sessions.
|
||||
- Rate limiting is applied per IP to mitigate brute-force attempts.
|
||||
- When `tx_access_control_enabled = true`, TX/PTT controls are hidden and
|
||||
rejected for unauthenticated or `rx`-role users.
|
||||
- User records persist in `users_file`; passwords are stored as salted Argon2id hashes.
|
||||
- `user` sessions cannot call control routes. There is no guest-access mode.
|
||||
- Administrators can add/remove users and change roles/passwords in Settings.
|
||||
- Removing an account or changing its password/role revokes its sessions.
|
||||
|
||||
### Routes
|
||||
|
||||
| Endpoint | Method | Description |
|
||||
|----------|--------|-------------|
|
||||
| `/auth/login` | POST | Submit `{ "passphrase": "..." }` |
|
||||
| `/auth/login` | POST | Submit `{ "username": "...", "password": "..." }` |
|
||||
| `/auth/logout` | POST | Clear session |
|
||||
| `/auth/session` | GET | Check current session/role |
|
||||
| `/auth/users` | GET/POST | List or add users (admin only) |
|
||||
| `/auth/users/{username}` | PATCH/DELETE | Change password/role or remove user (admin only) |
|
||||
|
||||
Protected routes require at least `rx` role. Control routes (set frequency,
|
||||
mode, PTT, etc.) require `control` role.
|
||||
Protected routes require at least `user` role. Control routes (set frequency,
|
||||
mode, PTT, etc.) require `admin` role.
|
||||
|
||||
### Frontend Flow
|
||||
|
||||
1. On load, the UI calls `/auth/session`.
|
||||
2. If unauthenticated, a login screen is shown.
|
||||
3. On successful login, the normal UI loads.
|
||||
4. `rx` users see a read-only interface; `control` users get full controls.
|
||||
4. `user` accounts see a read-only interface; admins get full controls.
|
||||
5. If a session expires mid-use, streams stop and the login screen returns.
|
||||
|
||||
### Transport Security
|
||||
|
||||
@@ -252,11 +252,11 @@ async fn async_init() -> DynResult<AppState> {
|
||||
|
||||
// Set HTTP frontend authentication config
|
||||
frontend_runtime.http_auth.enabled = cfg.frontends.http.auth.enabled;
|
||||
frontend_runtime.http_auth.rx_passphrase = cfg.frontends.http.auth.rx_passphrase.clone();
|
||||
frontend_runtime.http_auth.control_passphrase =
|
||||
cfg.frontends.http.auth.control_passphrase.clone();
|
||||
frontend_runtime.http_auth.tx_access_control_enabled =
|
||||
cfg.frontends.http.auth.tx_access_control_enabled;
|
||||
frontend_runtime.http_auth.users_file = cfg.frontends.http.auth.users_file.clone();
|
||||
frontend_runtime.http_auth.bootstrap_admin_username =
|
||||
cfg.frontends.http.auth.bootstrap_admin_username.clone();
|
||||
frontend_runtime.http_auth.bootstrap_admin_password =
|
||||
cfg.frontends.http.auth.bootstrap_admin_password.clone();
|
||||
frontend_runtime.http_auth.session_ttl_secs = cfg.frontends.http.auth.session_ttl().as_secs();
|
||||
frontend_runtime.http_auth.cookie_secure = cfg.frontends.http.auth.cookie_secure;
|
||||
frontend_runtime.http_auth.cookie_same_site = match cfg.frontends.http.auth.cookie_same_site {
|
||||
|
||||
@@ -257,9 +257,9 @@ impl Default for DecodeHistoryContext {
|
||||
/// HTTP authentication configuration.
|
||||
pub struct HttpAuthConfig {
|
||||
pub enabled: bool,
|
||||
pub rx_passphrase: Option<String>,
|
||||
pub control_passphrase: Option<String>,
|
||||
pub tx_access_control_enabled: bool,
|
||||
pub users_file: String,
|
||||
pub bootstrap_admin_username: Option<String>,
|
||||
pub bootstrap_admin_password: Option<String>,
|
||||
pub session_ttl_secs: u64,
|
||||
pub cookie_secure: bool,
|
||||
pub cookie_same_site: String,
|
||||
@@ -271,9 +271,9 @@ impl Default for HttpAuthConfig {
|
||||
fn default() -> Self {
|
||||
Self {
|
||||
enabled: false,
|
||||
rx_passphrase: None,
|
||||
control_passphrase: None,
|
||||
tx_access_control_enabled: true,
|
||||
users_file: "trx-http-users.json".to_string(),
|
||||
bootstrap_admin_username: None,
|
||||
bootstrap_admin_password: None,
|
||||
session_ttl_secs: 480 * 60,
|
||||
cookie_secure: false,
|
||||
cookie_same_site: "Lax".to_string(),
|
||||
|
||||
@@ -28,6 +28,7 @@ flate2 = { workspace = true }
|
||||
brotli = "7"
|
||||
rand = "0.8"
|
||||
hex = "0.4"
|
||||
argon2 = "0.5"
|
||||
pickledb = "0.5"
|
||||
dirs = "6"
|
||||
uuid = { workspace = true }
|
||||
|
||||
@@ -1323,7 +1323,7 @@ function decodeAuthSession(value) {
|
||||
if (typeof session.authenticated !== "boolean") {
|
||||
throw new TypeError("The authentication response has no authenticated flag");
|
||||
}
|
||||
if (session.role !== void 0 && session.role !== "rx" && session.role !== "control") {
|
||||
if (session.role !== void 0 && session.role !== "user" && session.role !== "admin") {
|
||||
throw new TypeError("The authentication response has an invalid role");
|
||||
}
|
||||
if (session.auth_disabled !== void 0 && typeof session.auth_disabled !== "boolean") {
|
||||
@@ -1331,12 +1331,16 @@ function decodeAuthSession(value) {
|
||||
}
|
||||
const decoded = { authenticated: session.authenticated };
|
||||
if (session.role !== void 0) decoded.role = session.role;
|
||||
if (session.username !== void 0) {
|
||||
if (typeof session.username !== "string") throw new TypeError("The authentication response has an invalid username");
|
||||
decoded.username = session.username;
|
||||
}
|
||||
if (session.auth_disabled !== void 0) decoded.auth_disabled = session.auth_disabled;
|
||||
return decoded;
|
||||
}
|
||||
var authDisabledSession = {
|
||||
authenticated: true,
|
||||
role: "control",
|
||||
role: "admin",
|
||||
auth_disabled: true
|
||||
};
|
||||
async function fetchAuthSession() {
|
||||
@@ -1350,11 +1354,11 @@ async function fetchAuthSession() {
|
||||
return { authenticated: false };
|
||||
}
|
||||
}
|
||||
async function login(passphrase) {
|
||||
async function login(username, password) {
|
||||
const response = await fetch("/auth/login", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ passphrase })
|
||||
body: JSON.stringify({ username, password })
|
||||
});
|
||||
if (response.status === 404) return authDisabledSession;
|
||||
if (!response.ok) {
|
||||
@@ -1363,6 +1367,34 @@ async function login(passphrase) {
|
||||
}
|
||||
return decodeAuthSession(await response.json());
|
||||
}
|
||||
async function userRequest(path, init) {
|
||||
const response = await fetch(path, init);
|
||||
if (!response.ok) {
|
||||
const payload = await response.json().catch(() => ({}));
|
||||
throw new Error(payload.error || `User operation failed (${response.status})`);
|
||||
}
|
||||
return response;
|
||||
}
|
||||
async function listUsers() {
|
||||
const value = await userRequest("/auth/users").then((response) => response.json());
|
||||
if (!Array.isArray(value) || !value.every((user) => {
|
||||
if (typeof user !== "object" || user === null) return false;
|
||||
const record = user;
|
||||
return typeof record.username === "string" && (record.role === "user" || record.role === "admin");
|
||||
})) {
|
||||
throw new TypeError("The user list response is malformed");
|
||||
}
|
||||
return value;
|
||||
}
|
||||
async function createUser(username, password, role) {
|
||||
await userRequest("/auth/users", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ username, password, role }) });
|
||||
}
|
||||
async function updateUser(username, changes) {
|
||||
await userRequest(`/auth/users/${encodeURIComponent(username)}`, { method: "PATCH", headers: { "Content-Type": "application/json" }, body: JSON.stringify(changes) });
|
||||
}
|
||||
async function deleteUser(username) {
|
||||
await userRequest(`/auth/users/${encodeURIComponent(username)}`, { method: "DELETE" });
|
||||
}
|
||||
async function logout() {
|
||||
const response = await fetch("/auth/logout", { method: "POST" });
|
||||
if (response.status !== 404 && !response.ok) throw new Error("Logout failed");
|
||||
@@ -1863,32 +1895,32 @@ function isVchanRdsEntry(value) {
|
||||
}
|
||||
void loadDecoderRegistry(refreshOperatorLayoutCapabilities);
|
||||
var authRole = null;
|
||||
var authUsername = null;
|
||||
var authEnabled = true;
|
||||
async function checkAuthStatus() {
|
||||
return fetchAuthSession();
|
||||
}
|
||||
async function authLogin(passphrase) {
|
||||
return login(passphrase);
|
||||
async function authLogin(username, password) {
|
||||
return login(username, password);
|
||||
}
|
||||
async function authLogout() {
|
||||
try {
|
||||
await logout();
|
||||
authRole = null;
|
||||
authUsername = null;
|
||||
disconnect();
|
||||
setDecodeHistoryOverlayVisible(false);
|
||||
requiredElement("content").style.display = "none";
|
||||
requiredElement("loading").style.display = "none";
|
||||
requiredElement("auth-passphrase").value = "";
|
||||
requiredElement("auth-password").value = "";
|
||||
updateAuthUI();
|
||||
const authStatus = await checkAuthStatus();
|
||||
const allowGuest = authStatus.role === "rx";
|
||||
showAuthGate(allowGuest);
|
||||
showAuthGate();
|
||||
} catch (e) {
|
||||
console.error("Logout failed:", e);
|
||||
showAuthError("Logout failed");
|
||||
}
|
||||
}
|
||||
function showAuthGate(allowGuest = false) {
|
||||
function showAuthGate() {
|
||||
if (!authEnabled) return;
|
||||
setDecodeHistoryOverlayVisible(false);
|
||||
requiredElement("loading").style.display = "none";
|
||||
@@ -1905,10 +1937,6 @@ function showAuthGate(allowGuest = false) {
|
||||
document.querySelectorAll(".tab-panel").forEach((panel) => {
|
||||
panel.style.display = "none";
|
||||
});
|
||||
const guestBtn2 = document.getElementById("auth-guest-btn");
|
||||
if (guestBtn2) {
|
||||
guestBtn2.style.display = allowGuest ? "block" : "none";
|
||||
}
|
||||
document.querySelectorAll(".tab-bar .tab").forEach((btn) => {
|
||||
btn.classList.toggle("active", btn.dataset.tab === "main");
|
||||
});
|
||||
@@ -1952,7 +1980,7 @@ function updateAuthUI() {
|
||||
}
|
||||
if (authRole) {
|
||||
if (badge) badge.style.display = "block";
|
||||
if (badgeRole) badgeRole.textContent = authRole === "control" ? "Control (full access)" : "RX (read-only)";
|
||||
if (badgeRole) badgeRole.textContent = `${authUsername || "local"} — ${authRole === "admin" ? "Admin" : "User (read-only)"}`;
|
||||
if (headerAuthBtn2) {
|
||||
headerAuthBtn2.textContent = "Logout";
|
||||
headerAuthBtn2.style.display = "block";
|
||||
@@ -1968,7 +1996,7 @@ function updateAuthUI() {
|
||||
}
|
||||
function applyAuthRestrictions() {
|
||||
if (!authRole) return;
|
||||
if (authRole === "rx") {
|
||||
if (authRole === "user") {
|
||||
const pttBtn2 = document.getElementById("ptt-btn");
|
||||
const powerBtn2 = document.getElementById("power-btn");
|
||||
const lockBtn2 = document.getElementById("lock-btn");
|
||||
@@ -2271,7 +2299,7 @@ function syncTopBarAccess() {
|
||||
rigSwitch.style.display = loggedOut ? "none" : "";
|
||||
}
|
||||
if (headerRigSwitchSelect) {
|
||||
headerRigSwitchSelect.disabled = loggedOut || authRole === "rx" || lastRigIds.length === 0;
|
||||
headerRigSwitchSelect.disabled = loggedOut || authRole === "user" || lastRigIds.length === 0;
|
||||
}
|
||||
}
|
||||
var overviewDrawPending = false;
|
||||
@@ -2907,7 +2935,7 @@ function applyRigList(activeRigId, rigIds, displayNames) {
|
||||
}
|
||||
const nextKey = lastRigIds.join("\0") + "|" + (lastActiveRigId || "");
|
||||
const rigListChanged = prevKey !== nextKey;
|
||||
const disableSwitch = lastRigIds.length === 0 || !authRole || authRole === "rx";
|
||||
const disableSwitch = lastRigIds.length === 0 || !authRole || authRole === "user";
|
||||
populateRigPicker(headerRigSwitchSelect, lastRigIds, lastActiveRigId, disableSwitch);
|
||||
updateRigSubtitle(lastActiveRigId);
|
||||
window.trxUi?.setActiveRig(lastActiveRigId);
|
||||
@@ -4510,7 +4538,7 @@ function scheduleTuneLinkSync() {
|
||||
async function applyTuneLink(link) {
|
||||
const wanted = link.rig || link.mode || link.freqHz != null || link.bandwidthHz != null;
|
||||
if (!wanted) return;
|
||||
if (authRole === "rx") {
|
||||
if (authRole === "user") {
|
||||
showHint("Read-only session — link not applied", 2500);
|
||||
return;
|
||||
}
|
||||
@@ -5253,8 +5281,8 @@ async function switchRigFromSelect(selectEl) {
|
||||
showHint("No rig selected", 1500);
|
||||
return;
|
||||
}
|
||||
if (authRole === "rx") {
|
||||
showHint("Control role required", 1500);
|
||||
if (authRole === "user") {
|
||||
showHint("Admin role required", 1500);
|
||||
return;
|
||||
}
|
||||
if (!lastRigIds.includes(selectEl.value)) {
|
||||
@@ -5868,7 +5896,7 @@ function navigateToTab(name, options = {}) {
|
||||
const leavingSatellites = _activeTab === "satellites" && name !== "satellites";
|
||||
const { updateHistory = true, replaceHistory = false } = options;
|
||||
if (authEnabled && !authRole && name !== "main") {
|
||||
showAuthGate(false);
|
||||
showAuthGate();
|
||||
return;
|
||||
}
|
||||
const btn = document.querySelector(`.tab-bar .tab[data-tab="${name}"]`);
|
||||
@@ -5981,11 +6009,11 @@ window.addEventListener("resize", () => {
|
||||
scheduleSpectrumLayout();
|
||||
});
|
||||
async function initializeApp() {
|
||||
showAuthGate(false);
|
||||
showAuthGate();
|
||||
const authStatus = await checkAuthStatus();
|
||||
authEnabled = !authStatus.auth_disabled;
|
||||
if (!authEnabled) {
|
||||
authRole = "control";
|
||||
authRole = "admin";
|
||||
hideAuthGate();
|
||||
updateAuthUI();
|
||||
connect();
|
||||
@@ -5997,6 +6025,7 @@ async function initializeApp() {
|
||||
}
|
||||
if (authStatus.authenticated) {
|
||||
authRole = authStatus.role ?? null;
|
||||
authUsername = authStatus.username ?? null;
|
||||
hideAuthGate();
|
||||
updateAuthUI();
|
||||
applyAuthRestrictions();
|
||||
@@ -6006,8 +6035,7 @@ async function initializeApp() {
|
||||
resizeHeaderSignalCanvas();
|
||||
startHeaderSignalSampling();
|
||||
} else {
|
||||
const allowGuest = authStatus.role === "rx";
|
||||
showAuthGate(allowGuest);
|
||||
showAuthGate();
|
||||
}
|
||||
}
|
||||
var settingsUiReady = false;
|
||||
@@ -6019,19 +6047,104 @@ function initSettingsUI() {
|
||||
window.trx.modules.backgroundDecode.initialize(lastActiveRigId, authRole);
|
||||
window.trx.modules.backgroundDecode.wireEvents();
|
||||
}
|
||||
void refreshUserManagement();
|
||||
}
|
||||
async function refreshUserManagement() {
|
||||
const section = document.getElementById("user-management");
|
||||
if (!section) return;
|
||||
section.style.display = authEnabled && authRole === "admin" ? "block" : "none";
|
||||
if (section.style.display === "none") return;
|
||||
const list = requiredElement("user-list");
|
||||
try {
|
||||
const users = await listUsers();
|
||||
list.replaceChildren(...users.map((user) => {
|
||||
const row = document.createElement("div");
|
||||
row.className = "sch-row";
|
||||
row.style.cssText = "display:flex;align-items:center;gap:.5rem;flex-wrap:wrap;margin:.4rem 0";
|
||||
const name = document.createElement("strong");
|
||||
name.textContent = user.username;
|
||||
name.style.minWidth = "10rem";
|
||||
const role = document.createElement("select");
|
||||
role.className = "auth-input";
|
||||
for (const value of ["user", "admin"]) {
|
||||
const option = document.createElement("option");
|
||||
option.value = value;
|
||||
option.textContent = value === "admin" ? "Admin" : "User";
|
||||
option.selected = user.role === value;
|
||||
role.append(option);
|
||||
}
|
||||
const password = document.createElement("input");
|
||||
password.type = "password";
|
||||
password.placeholder = "New password";
|
||||
password.autocomplete = "new-password";
|
||||
password.className = "auth-input";
|
||||
password.minLength = 8;
|
||||
const save = document.createElement("button");
|
||||
save.type = "button";
|
||||
save.textContent = "Save";
|
||||
save.addEventListener("click", async () => {
|
||||
const changes = { role: role.value };
|
||||
if (password.value) changes.password = password.value;
|
||||
await runUserOperation(() => updateUser(user.username, changes));
|
||||
});
|
||||
const remove = document.createElement("button");
|
||||
remove.type = "button";
|
||||
remove.textContent = "Remove";
|
||||
remove.className = "danger";
|
||||
remove.disabled = user.username === authUsername;
|
||||
remove.addEventListener("click", async () => {
|
||||
if (await window.trxUi.confirm({ title: "Remove user?", message: `Remove ${user.username} and revoke their sessions?`, confirmLabel: "Remove", danger: true })) {
|
||||
await runUserOperation(() => deleteUser(user.username));
|
||||
}
|
||||
});
|
||||
row.append(name, role, password, save, remove);
|
||||
return row;
|
||||
}));
|
||||
} catch (error) {
|
||||
showUserManagementError(error);
|
||||
}
|
||||
}
|
||||
function showUserManagementError(error) {
|
||||
const element = document.getElementById("user-management-error");
|
||||
if (!element) return;
|
||||
element.textContent = error instanceof Error ? error.message : String(error);
|
||||
element.style.display = "block";
|
||||
}
|
||||
async function runUserOperation(operation) {
|
||||
try {
|
||||
await operation();
|
||||
const error = document.getElementById("user-management-error");
|
||||
if (error) error.style.display = "none";
|
||||
await refreshUserManagement();
|
||||
} catch (reason) {
|
||||
showUserManagementError(reason);
|
||||
}
|
||||
}
|
||||
document.getElementById("user-create-form")?.addEventListener("submit", (event) => {
|
||||
event.preventDefault();
|
||||
const username = requiredElement("user-create-username");
|
||||
const password = requiredElement("user-create-password");
|
||||
const role = requiredElement("user-create-role");
|
||||
void runUserOperation(async () => {
|
||||
await createUser(username.value, password.value, role.value);
|
||||
username.value = "";
|
||||
password.value = "";
|
||||
role.value = "user";
|
||||
});
|
||||
});
|
||||
requiredElement("auth-form").addEventListener("submit", async (e) => {
|
||||
e.preventDefault();
|
||||
const passphraseEl = requiredElement("auth-passphrase");
|
||||
const passphrase = passphraseEl.value;
|
||||
const usernameEl = requiredElement("auth-username");
|
||||
const passwordEl = requiredElement("auth-password");
|
||||
const btn = requiredElement("auth-form").querySelector("button[type=submit]");
|
||||
if (!btn) return;
|
||||
btn.disabled = true;
|
||||
btn.textContent = "Logging in...";
|
||||
try {
|
||||
const result = await authLogin(passphrase);
|
||||
const result = await authLogin(usernameEl.value, passwordEl.value);
|
||||
authRole = result.role ?? null;
|
||||
passphraseEl.value = "";
|
||||
authUsername = result.username ?? usernameEl.value;
|
||||
passwordEl.value = "";
|
||||
hideAuthGate();
|
||||
updateAuthUI();
|
||||
applyAuthRestrictions();
|
||||
@@ -6041,28 +6154,13 @@ requiredElement("auth-form").addEventListener("submit", async (e) => {
|
||||
resizeHeaderSignalCanvas();
|
||||
startHeaderSignalSampling();
|
||||
} catch (err) {
|
||||
showAuthError("Invalid passphrase");
|
||||
showAuthError("Invalid username or password");
|
||||
console.error("Login error:", err);
|
||||
} finally {
|
||||
btn.disabled = false;
|
||||
btn.textContent = "Login";
|
||||
}
|
||||
});
|
||||
var guestBtn = document.getElementById("auth-guest-btn");
|
||||
if (guestBtn) {
|
||||
guestBtn.addEventListener("click", () => {
|
||||
authRole = "rx";
|
||||
requiredElement("auth-passphrase").value = "";
|
||||
hideAuthGate();
|
||||
updateAuthUI();
|
||||
applyAuthRestrictions();
|
||||
connect();
|
||||
connectDecode();
|
||||
initSettingsUI();
|
||||
resizeHeaderSignalCanvas();
|
||||
startHeaderSignalSampling();
|
||||
});
|
||||
}
|
||||
var headerAuthBtn = document.getElementById("header-auth-btn");
|
||||
if (headerAuthBtn) {
|
||||
headerAuthBtn.addEventListener("click", async () => {
|
||||
@@ -6071,7 +6169,7 @@ if (headerAuthBtn) {
|
||||
await authLogout();
|
||||
}
|
||||
} else {
|
||||
showAuthGate(false);
|
||||
showAuthGate();
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
+1
-1
@@ -358,7 +358,7 @@ var bgdWindow = window;
|
||||
btn.title = bgdDirty ? "Apply these bookmarks to the background decoder" : "No changes to save";
|
||||
}
|
||||
function isControlRole() {
|
||||
return backgroundDecodeRole === "control" || hostState.authEnabled === false;
|
||||
return backgroundDecodeRole === "admin" || hostState.authEnabled === false;
|
||||
}
|
||||
function showToast(msg, isError) {
|
||||
const el = document.getElementById("background-decode-toast");
|
||||
|
||||
@@ -42,7 +42,7 @@ function bmEsc(str) {
|
||||
return d.innerHTML;
|
||||
}
|
||||
function bmCanControl() {
|
||||
return !hostState.authEnabled || hostState.authRole === "control";
|
||||
return !hostState.authEnabled || hostState.authRole === "admin";
|
||||
}
|
||||
function bmSyncAccess() {
|
||||
const canCtrl = bmCanControl();
|
||||
|
||||
@@ -31,6 +31,16 @@ var importFile = el("log-import-file");
|
||||
var exportLink = el("log-export-btn");
|
||||
var clearBtn = el("log-clear-btn");
|
||||
var saveBtn = el("log-save-btn");
|
||||
var contestIdInput = el("log-contest-id");
|
||||
var stxInput = el("log-stx");
|
||||
var srxInput = el("log-srx");
|
||||
var statisticsRows = el("log-statistics-rows");
|
||||
var cabrilloContest = el("log-cbr-contest");
|
||||
var cabrilloCallsign = el("log-cbr-callsign");
|
||||
var cabrilloOperator = el("log-cbr-operator");
|
||||
var cabrilloPower = el("log-cbr-power");
|
||||
var cabrilloScore = el("log-cbr-score");
|
||||
var cabrilloExport = el("log-cbr-export");
|
||||
var entryStartedAt = null;
|
||||
var entryRigId = null;
|
||||
var entryRigName = null;
|
||||
@@ -55,6 +65,12 @@ function parseFreq(text) {
|
||||
if (!Number.isFinite(value) || value <= 0) return null;
|
||||
return value < 1e5 ? Math.round(value * 1e6) : Math.round(value);
|
||||
}
|
||||
function numberOrNull(text) {
|
||||
const trimmed = (text ?? "").trim();
|
||||
if (!trimmed || !/^\d+$/.test(trimmed)) return null;
|
||||
const value = Number(trimmed);
|
||||
return Number.isSafeInteger(value) ? value : null;
|
||||
}
|
||||
function utcDate(iso) {
|
||||
const date = new Date(iso);
|
||||
return Number.isNaN(date.getTime()) ? "" : date.toISOString().slice(0, 10);
|
||||
@@ -96,7 +112,7 @@ function showClock(prefill) {
|
||||
clockEl.classList.toggle("is-adrift", drift > 1e3);
|
||||
}
|
||||
function resetEntry() {
|
||||
for (const input of [callInput, rstSentInput, rstRcvdInput, gridInput, nameInput, commentInput]) {
|
||||
for (const input of [callInput, rstSentInput, rstRcvdInput, gridInput, nameInput, commentInput, srxInput]) {
|
||||
if (input) input.value = "";
|
||||
}
|
||||
if (workedEl) workedEl.textContent = "";
|
||||
@@ -131,6 +147,13 @@ async function submitEntry(event) {
|
||||
gridsquare: gridInput?.value ?? null,
|
||||
name: nameInput?.value ?? null,
|
||||
comment: commentInput?.value ?? null,
|
||||
contest_id: contestIdInput?.value ?? null,
|
||||
// The exchange is a number when it is a serial and a word when it is a
|
||||
// zone or a section; both are kept, and the log writes whichever it has.
|
||||
stx: numberOrNull(stxInput?.value),
|
||||
stx_string: numberOrNull(stxInput?.value) == null ? stxInput?.value ?? null : null,
|
||||
srx: numberOrNull(srxInput?.value),
|
||||
srx_string: numberOrNull(srxInput?.value) == null ? srxInput?.value ?? null : null,
|
||||
station_callsign: stationCallEl?.textContent?.trim() ?? null,
|
||||
operator: operatorInput?.value ?? null,
|
||||
my_gridsquare: entryGrid,
|
||||
@@ -149,7 +172,9 @@ async function submitEntry(event) {
|
||||
throw new Error(detail.error ?? `HTTP ${String(response.status)}`);
|
||||
}
|
||||
notify(`${call} logged`);
|
||||
const sent = numberOrNull(stxInput?.value);
|
||||
resetEntry();
|
||||
if (stxInput && sent != null) stxInput.value = String(sent + 1);
|
||||
await refreshLog();
|
||||
} catch (error) {
|
||||
notify(`Could not log: ${error instanceof Error ? error.message : String(error)}`, "error");
|
||||
@@ -201,10 +226,51 @@ async function refreshLog() {
|
||||
summaryEl.textContent = query ? `${String(qsos.length)} of ${String(answer.total)} contacts` : `${String(answer.total)} contact${answer.total === 1 ? "" : "s"}`;
|
||||
}
|
||||
if (exportLink) exportLink.href = `/api/logbook/export.adi${query ? `?${query}` : ""}`;
|
||||
await refreshStatistics();
|
||||
} catch (error) {
|
||||
console.error("logbook read failed", error);
|
||||
}
|
||||
}
|
||||
async function refreshStatistics() {
|
||||
if (!statisticsRows) return;
|
||||
try {
|
||||
const answer = await getJson("/api/logbook/statistics");
|
||||
if (answer.bands.length === 0) {
|
||||
statisticsRows.innerHTML = '<tr><td colspan="4" class="log-empty">Nothing worked yet.</td></tr>';
|
||||
return;
|
||||
}
|
||||
const fragment = document.createDocumentFragment();
|
||||
for (const band of answer.bands) {
|
||||
const row = document.createElement("tr");
|
||||
for (const value of [band.band, band.contacts, band.stations, band.confirmed]) {
|
||||
const cell = document.createElement("td");
|
||||
cell.textContent = String(value);
|
||||
row.appendChild(cell);
|
||||
}
|
||||
fragment.appendChild(row);
|
||||
}
|
||||
statisticsRows.replaceChildren(fragment);
|
||||
} catch (error) {
|
||||
console.error("logbook statistics failed", error);
|
||||
}
|
||||
}
|
||||
function syncCabrilloLink() {
|
||||
if (!cabrilloExport) return;
|
||||
const params = new URLSearchParams();
|
||||
const contest = cabrilloContest?.value.trim();
|
||||
if (contest) {
|
||||
params.set("contest", contest);
|
||||
}
|
||||
const callsign = cabrilloCallsign?.value.trim() || (stationCallEl?.textContent?.trim() ?? "");
|
||||
if (callsign) params.set("callsign", callsign);
|
||||
if (cabrilloOperator?.value) params.set("category_operator", cabrilloOperator.value);
|
||||
if (cabrilloPower?.value) params.set("category_power", cabrilloPower.value);
|
||||
const score = numberOrNull(cabrilloScore?.value);
|
||||
if (score != null) params.set("claimed_score", String(score));
|
||||
const operator = operatorInput?.value.trim();
|
||||
if (operator) params.set("operators", operator);
|
||||
cabrilloExport.href = `/api/logbook/export.cbr?${params.toString()}`;
|
||||
}
|
||||
function renderRows() {
|
||||
if (!rowsBody) return;
|
||||
if (qsos.length === 0) {
|
||||
@@ -224,7 +290,8 @@ function renderRows() {
|
||||
qso.rst_sent ?? "",
|
||||
qso.rst_rcvd ?? "",
|
||||
qso.gridsquare ?? "",
|
||||
qso.my_rig ?? ""
|
||||
qso.my_rig ?? "",
|
||||
qso.confirmed ? "✓" : ""
|
||||
];
|
||||
for (const [index, value] of cells.entries()) {
|
||||
const cell = document.createElement("td");
|
||||
@@ -233,6 +300,15 @@ function renderRows() {
|
||||
row.appendChild(cell);
|
||||
}
|
||||
const actions = document.createElement("td");
|
||||
const confirm = document.createElement("button");
|
||||
confirm.type = "button";
|
||||
confirm.className = "log-row-btn";
|
||||
confirm.textContent = qso.confirmed ? "Unconfirm" : "Confirm";
|
||||
confirm.title = qso.confirmed ? "Mark this contact as not confirmed" : "Mark this contact confirmed by QSL";
|
||||
confirm.addEventListener("click", () => {
|
||||
void setConfirmed(qso, !qso.confirmed);
|
||||
});
|
||||
actions.appendChild(confirm);
|
||||
const remove = document.createElement("button");
|
||||
remove.type = "button";
|
||||
remove.className = "log-row-btn";
|
||||
@@ -262,6 +338,24 @@ function renderFilterOptions() {
|
||||
select.value = chosen;
|
||||
}
|
||||
}
|
||||
async function setConfirmed(qso, confirmed) {
|
||||
try {
|
||||
const response = await fetch(`/api/logbook/${encodeURIComponent(qso.id)}`, {
|
||||
method: "PUT",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({
|
||||
...qso,
|
||||
// A card is a card: this is the paper one, and an electronic
|
||||
// confirmation the log already holds is left where it is.
|
||||
qsl_rcvd: confirmed ? "Y" : "N"
|
||||
})
|
||||
});
|
||||
if (!response.ok) throw new Error(`HTTP ${String(response.status)}`);
|
||||
await refreshLog();
|
||||
} catch (error) {
|
||||
notify(`Could not update: ${error instanceof Error ? error.message : String(error)}`, "error");
|
||||
}
|
||||
}
|
||||
async function deleteQso(qso) {
|
||||
const confirmed = await bridge.trxUi.confirm({
|
||||
title: "Delete this contact?",
|
||||
@@ -314,6 +408,10 @@ for (const control of [filterCall, filterBand, filterMode]) {
|
||||
void refreshLog();
|
||||
});
|
||||
}
|
||||
for (const control of [cabrilloContest, cabrilloCallsign, cabrilloOperator, cabrilloPower, cabrilloScore]) {
|
||||
control?.addEventListener("input", syncCabrilloLink);
|
||||
control?.addEventListener("change", syncCabrilloLink);
|
||||
}
|
||||
importBtn?.addEventListener("click", () => {
|
||||
importFile?.click();
|
||||
});
|
||||
@@ -327,5 +425,9 @@ bridge.logContact = (seed) => {
|
||||
void openEntry(seed).then(() => callInput?.focus());
|
||||
};
|
||||
renderStation();
|
||||
if (cabrilloCallsign && !cabrilloCallsign.value) {
|
||||
cabrilloCallsign.value = stationCallEl?.textContent?.trim() ?? "";
|
||||
}
|
||||
syncCabrilloLink();
|
||||
void openEntry();
|
||||
void refreshLog();
|
||||
|
||||
@@ -272,7 +272,7 @@ function schedulerOptionalEl(id) {
|
||||
const nextBtn = schedulerEl("scheduler-next-btn");
|
||||
if (!prevBtn || !nextBtn) return;
|
||||
const state = schedulerInterleaveState(currentConfig);
|
||||
const enabled = schedulerRole === "control" && !!currentRigId && !schedulerStepPending && state.activeEntries.length > 1;
|
||||
const enabled = schedulerRole === "admin" && !!currentRigId && !schedulerStepPending && state.activeEntries.length > 1;
|
||||
prevBtn.disabled = !enabled;
|
||||
nextBtn.disabled = !enabled;
|
||||
const hint = enabled ? "Select a different active scheduler entry" : "Available only when multiple scheduler entries are active";
|
||||
@@ -354,7 +354,7 @@ function schedulerOptionalEl(id) {
|
||||
const panel = schedulerEl("scheduler-panel");
|
||||
if (!panel) return;
|
||||
const mode = currentConfig && currentConfig.mode || "disabled";
|
||||
const isControl = schedulerRole === "control";
|
||||
const isControl = schedulerRole === "admin";
|
||||
setSelected("scheduler-mode-select", mode);
|
||||
const satEnabled = currentConfig && currentConfig.satellites && currentConfig.satellites.enabled;
|
||||
const controlRow = document.querySelector(".scheduler-control-row");
|
||||
|
||||
@@ -123,13 +123,13 @@ SPDX-License-Identifier: GPL-2.0-or-later
|
||||
<div id="auth-gate" class="auth-gate" style="display:none;">
|
||||
<div class="auth-gate-head">
|
||||
<div class="auth-gate-title">Access Required</div>
|
||||
<div class="auth-gate-sub">Enter passphrase to continue</div>
|
||||
<div class="auth-gate-sub">Sign in to continue</div>
|
||||
</div>
|
||||
<form id="auth-form" class="auth-form">
|
||||
<input type="password" id="auth-passphrase" class="auth-input" placeholder="Passphrase" autocomplete="off" />
|
||||
<input type="text" id="auth-username" class="auth-input" placeholder="Username" autocomplete="username" required />
|
||||
<input type="password" id="auth-password" class="auth-input" placeholder="Password" autocomplete="current-password" required />
|
||||
<button type="submit" class="auth-submit">Login</button>
|
||||
</form>
|
||||
<button id="auth-guest-btn" type="button" class="auth-guest" style="display: none;">Continue as Guest</button>
|
||||
<div id="auth-error" class="auth-error" style="display: none;"></div>
|
||||
<div id="auth-role" class="auth-role" style="display: none;"></div>
|
||||
</div>
|
||||
@@ -543,6 +543,24 @@ SPDX-License-Identifier: GPL-2.0-or-later
|
||||
<input type="text" id="log-comment" class="status-input" />
|
||||
</label>
|
||||
</div>
|
||||
<details class="log-contest" id="log-contest-block">
|
||||
<summary>Contest exchange</summary>
|
||||
<div class="log-entry-grid">
|
||||
<label class="log-field">
|
||||
<span>Contest</span>
|
||||
<input type="text" id="log-contest-id" class="status-input" spellcheck="false"
|
||||
placeholder="CQ-WW-SSB" />
|
||||
</label>
|
||||
<label class="log-field log-field-narrow">
|
||||
<span>Serial sent</span>
|
||||
<input type="text" id="log-stx" class="status-input" inputmode="numeric" />
|
||||
</label>
|
||||
<label class="log-field log-field-narrow">
|
||||
<span>Received</span>
|
||||
<input type="text" id="log-srx" class="status-input" />
|
||||
</label>
|
||||
</div>
|
||||
</details>
|
||||
<div class="log-entry-actions">
|
||||
<span id="log-worked-before" class="log-worked" aria-live="polite"></span>
|
||||
<span class="log-entry-buttons">
|
||||
@@ -581,6 +599,7 @@ SPDX-License-Identifier: GPL-2.0-or-later
|
||||
<th scope="col">Rcvd</th>
|
||||
<th scope="col">Locator</th>
|
||||
<th scope="col">Rig</th>
|
||||
<th scope="col">QSL</th>
|
||||
<th scope="col"><span class="visually-hidden">Actions</span></th>
|
||||
</tr>
|
||||
</thead>
|
||||
@@ -588,6 +607,68 @@ SPDX-License-Identifier: GPL-2.0-or-later
|
||||
</table>
|
||||
</div>
|
||||
<div id="log-summary" class="log-summary" aria-live="polite"></div>
|
||||
|
||||
<details class="log-report" id="log-statistics-block">
|
||||
<summary>Bands worked</summary>
|
||||
<div class="log-table-wrap">
|
||||
<table class="log-table">
|
||||
<thead>
|
||||
<tr>
|
||||
<th scope="col">Band</th>
|
||||
<th scope="col">Contacts</th>
|
||||
<th scope="col">Stations</th>
|
||||
<th scope="col">Confirmed</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody id="log-statistics-rows"></tbody>
|
||||
</table>
|
||||
</div>
|
||||
</details>
|
||||
|
||||
<details class="log-report" id="log-contest-export-block">
|
||||
<summary>Contest entry (Cabrillo)</summary>
|
||||
<p class="log-report-note">
|
||||
Contest logs are submitted in Cabrillo and rejected in anything else.
|
||||
Only the contacts of the contest named here go into the entry.
|
||||
</p>
|
||||
<div class="log-entry-grid">
|
||||
<label class="log-field">
|
||||
<span>Contest</span>
|
||||
<input type="text" id="log-cbr-contest" class="status-input" spellcheck="false"
|
||||
placeholder="CQ-WW-SSB" />
|
||||
</label>
|
||||
<label class="log-field">
|
||||
<span>Callsign</span>
|
||||
<input type="text" id="log-cbr-callsign" class="status-input" spellcheck="false" />
|
||||
</label>
|
||||
<label class="log-field">
|
||||
<span>Operators</span>
|
||||
<select id="log-cbr-operator" class="status-input">
|
||||
<option value="SINGLE-OP">Single operator</option>
|
||||
<option value="MULTI-OP">Multi operator</option>
|
||||
<option value="CHECKLOG">Checklog</option>
|
||||
</select>
|
||||
</label>
|
||||
<label class="log-field">
|
||||
<span>Power</span>
|
||||
<select id="log-cbr-power" class="status-input">
|
||||
<option value="LOW">Low</option>
|
||||
<option value="HIGH">High</option>
|
||||
<option value="QRP">QRP</option>
|
||||
</select>
|
||||
</label>
|
||||
<label class="log-field log-field-narrow">
|
||||
<span>Claimed score</span>
|
||||
<input type="text" id="log-cbr-score" class="status-input" inputmode="numeric" />
|
||||
</label>
|
||||
</div>
|
||||
<div class="log-entry-actions">
|
||||
<span class="log-entry-buttons">
|
||||
<a id="log-cbr-export" class="log-secondary-btn" href="/api/logbook/export.cbr"
|
||||
download>Export Cabrillo</a>
|
||||
</span>
|
||||
</div>
|
||||
</details>
|
||||
</div>
|
||||
</div>
|
||||
<div id="tab-bookmarks" class="tab-panel" style="display:none;">
|
||||
@@ -1669,6 +1750,19 @@ SPDX-License-Identifier: GPL-2.0-or-later
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<section id="user-management" style="display:none; margin-top:1rem;">
|
||||
<h2 class="section-heading">User management</h2>
|
||||
<div class="settings-card">
|
||||
<form id="user-create-form" class="sch-row" style="flex-wrap:wrap; gap:.5rem;">
|
||||
<input id="user-create-username" class="auth-input" placeholder="Username" autocomplete="off" required />
|
||||
<input id="user-create-password" class="auth-input" type="password" placeholder="Password (8+ characters)" autocomplete="new-password" minlength="8" required />
|
||||
<select id="user-create-role" class="auth-input"><option value="user">User</option><option value="admin">Admin</option></select>
|
||||
<button type="submit" class="auth-submit">Add user</button>
|
||||
</form>
|
||||
<div id="user-management-error" class="auth-error" style="display:none;"></div>
|
||||
<div id="user-list" style="margin-top:.75rem;"></div>
|
||||
</div>
|
||||
</section>
|
||||
</div>
|
||||
<div id="tab-about" class="tab-panel" style="display:none;">
|
||||
<h2 class="section-heading">About</h2>
|
||||
|
||||
@@ -196,8 +196,7 @@ body {
|
||||
font-size: var(--fs-base);
|
||||
box-sizing: border-box;
|
||||
}
|
||||
.auth-submit,
|
||||
.auth-guest {
|
||||
.auth-submit {
|
||||
width: 100%;
|
||||
padding: 0.65rem 0.75rem;
|
||||
border-radius: var(--radius-md);
|
||||
@@ -213,16 +212,11 @@ body {
|
||||
font-weight: 700;
|
||||
}
|
||||
.auth-submit:hover:not(:disabled) { background: var(--accent-green-hover); }
|
||||
.auth-guest {
|
||||
background: var(--btn-bg);
|
||||
color: var(--text);
|
||||
border: 1px solid var(--border-light);
|
||||
font-weight: 600;
|
||||
margin-top: var(--space-4);
|
||||
}
|
||||
.auth-guest:hover:not(:disabled) { background: var(--btn-hover-bg); }
|
||||
.auth-error { color: var(--accent-red); font-size: var(--fs-sm); margin-top: var(--space-4); }
|
||||
.auth-role { margin-top: var(--space-4); color: var(--text-muted); font-size: var(--fs-sm); }
|
||||
#user-management .auth-input { width: auto; min-width: 9rem; flex: 1 1 10rem; margin-bottom: 0; }
|
||||
#user-management .auth-submit { width: auto; }
|
||||
#user-management button { padding: 0.55rem 0.75rem; }
|
||||
|
||||
.label { color: var(--text-muted); font-size: 0.9rem; margin-bottom: 6px; display: block; }
|
||||
#tab-main .label > span {
|
||||
@@ -6633,3 +6627,35 @@ body[data-operator-layout="ham"] #rds-panel { display: none !important; }
|
||||
flex: 1 1 8rem;
|
||||
}
|
||||
}
|
||||
/* Contest exchange and the reports below the log: folded away, because most
|
||||
operating is not a contest and most sessions do not export one. */
|
||||
.log-contest,
|
||||
.log-report {
|
||||
border: 1px solid var(--border-light);
|
||||
border-radius: 0.5rem;
|
||||
background: var(--bg-secondary);
|
||||
padding: 0.5rem 0.85rem;
|
||||
}
|
||||
.log-contest {
|
||||
margin-top: 0.75rem;
|
||||
}
|
||||
.log-contest > summary,
|
||||
.log-report > summary {
|
||||
cursor: pointer;
|
||||
font-size: 0.78rem;
|
||||
font-weight: 700;
|
||||
text-transform: uppercase;
|
||||
letter-spacing: 0.05em;
|
||||
color: var(--text-muted);
|
||||
}
|
||||
.log-contest[open] > summary,
|
||||
.log-report[open] > summary {
|
||||
margin-bottom: 0.65rem;
|
||||
}
|
||||
.log-report-note {
|
||||
margin: 0 0 0.65rem;
|
||||
max-width: 62ch;
|
||||
color: var(--text-muted);
|
||||
font-size: 0.8rem;
|
||||
line-height: 1.45;
|
||||
}
|
||||
|
||||
@@ -2,11 +2,12 @@
|
||||
//
|
||||
// SPDX-License-Identifier: GPL-2.0-or-later
|
||||
|
||||
export type AuthRole = "rx" | "control";
|
||||
export type AuthRole = "user" | "admin";
|
||||
|
||||
export interface AuthSession {
|
||||
authenticated: boolean;
|
||||
role?: AuthRole;
|
||||
username?: string;
|
||||
auth_disabled?: boolean;
|
||||
}
|
||||
|
||||
@@ -18,7 +19,7 @@ function decodeAuthSession(value: unknown): AuthSession {
|
||||
if (typeof session.authenticated !== "boolean") {
|
||||
throw new TypeError("The authentication response has no authenticated flag");
|
||||
}
|
||||
if (session.role !== undefined && session.role !== "rx" && session.role !== "control") {
|
||||
if (session.role !== undefined && session.role !== "user" && session.role !== "admin") {
|
||||
throw new TypeError("The authentication response has an invalid role");
|
||||
}
|
||||
if (session.auth_disabled !== undefined && typeof session.auth_disabled !== "boolean") {
|
||||
@@ -26,13 +27,17 @@ function decodeAuthSession(value: unknown): AuthSession {
|
||||
}
|
||||
const decoded: AuthSession = { authenticated: session.authenticated };
|
||||
if (session.role !== undefined) decoded.role = session.role;
|
||||
if (session.username !== undefined) {
|
||||
if (typeof session.username !== "string") throw new TypeError("The authentication response has an invalid username");
|
||||
decoded.username = session.username;
|
||||
}
|
||||
if (session.auth_disabled !== undefined) decoded.auth_disabled = session.auth_disabled;
|
||||
return decoded;
|
||||
}
|
||||
|
||||
const authDisabledSession: AuthSession = {
|
||||
authenticated: true,
|
||||
role: "control",
|
||||
role: "admin",
|
||||
auth_disabled: true,
|
||||
};
|
||||
|
||||
@@ -48,11 +53,11 @@ export async function fetchAuthSession(): Promise<AuthSession> {
|
||||
}
|
||||
}
|
||||
|
||||
export async function login(passphrase: string): Promise<AuthSession> {
|
||||
export async function login(username: string, password: string): Promise<AuthSession> {
|
||||
const response = await fetch("/auth/login", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ passphrase }),
|
||||
body: JSON.stringify({ username, password }),
|
||||
});
|
||||
if (response.status === 404) return authDisabledSession;
|
||||
if (!response.ok) {
|
||||
@@ -62,6 +67,41 @@ export async function login(passphrase: string): Promise<AuthSession> {
|
||||
return decodeAuthSession(await response.json());
|
||||
}
|
||||
|
||||
export interface ManagedUser { username: string; role: AuthRole }
|
||||
|
||||
async function userRequest(path: string, init?: RequestInit): Promise<Response> {
|
||||
const response = await fetch(path, init);
|
||||
if (!response.ok) {
|
||||
const payload = await response.json().catch(() => ({})) as { error?: string };
|
||||
throw new Error(payload.error || `User operation failed (${response.status})`);
|
||||
}
|
||||
return response;
|
||||
}
|
||||
|
||||
export async function listUsers(): Promise<ManagedUser[]> {
|
||||
const value: unknown = await userRequest("/auth/users").then(response => response.json());
|
||||
if (!Array.isArray(value) || !value.every((user: unknown) => {
|
||||
if (typeof user !== "object" || user === null) return false;
|
||||
const record = user as Record<string, unknown>;
|
||||
return typeof record.username === "string" && (record.role === "user" || record.role === "admin");
|
||||
})) {
|
||||
throw new TypeError("The user list response is malformed");
|
||||
}
|
||||
return value as ManagedUser[];
|
||||
}
|
||||
|
||||
export async function createUser(username: string, password: string, role: AuthRole): Promise<void> {
|
||||
await userRequest("/auth/users", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ username, password, role }) });
|
||||
}
|
||||
|
||||
export async function updateUser(username: string, changes: { password?: string; role?: AuthRole }): Promise<void> {
|
||||
await userRequest(`/auth/users/${encodeURIComponent(username)}`, { method: "PATCH", headers: { "Content-Type": "application/json" }, body: JSON.stringify(changes) });
|
||||
}
|
||||
|
||||
export async function deleteUser(username: string): Promise<void> {
|
||||
await userRequest(`/auth/users/${encodeURIComponent(username)}`, { method: "DELETE" });
|
||||
}
|
||||
|
||||
export async function logout(): Promise<void> {
|
||||
const response = await fetch("/auth/logout", { method: "POST" });
|
||||
if (response.status !== 404 && !response.ok) throw new Error("Logout failed");
|
||||
|
||||
@@ -21,6 +21,10 @@ import {
|
||||
fetchAuthSession,
|
||||
login,
|
||||
logout,
|
||||
listUsers,
|
||||
createUser,
|
||||
updateUser,
|
||||
deleteUser,
|
||||
} from "./api/auth.js";
|
||||
import {
|
||||
formatByteSize as recorderFormatSize,
|
||||
@@ -407,39 +411,38 @@ void loadDecoderRegistry(refreshOperatorLayoutCapabilities);
|
||||
|
||||
// --- Authentication ---
|
||||
let authRole: AuthRole | null = null;
|
||||
let authUsername: string | null = null;
|
||||
let authEnabled = true;
|
||||
|
||||
async function checkAuthStatus() {
|
||||
return fetchAuthSession();
|
||||
}
|
||||
|
||||
async function authLogin(passphrase: string) {
|
||||
return login(passphrase);
|
||||
async function authLogin(username: string, password: string) {
|
||||
return login(username, password);
|
||||
}
|
||||
|
||||
async function authLogout() {
|
||||
try {
|
||||
await logout();
|
||||
authRole = null;
|
||||
authUsername = null;
|
||||
// Disconnect and show auth gate without page reload
|
||||
disconnect();
|
||||
setDecodeHistoryOverlayVisible(false);
|
||||
requiredElement("content").style.display = "none";
|
||||
requiredElement("loading").style.display = "none";
|
||||
requiredElement<HTMLInputElement>("auth-passphrase").value = "";
|
||||
requiredElement<HTMLInputElement>("auth-password").value = "";
|
||||
updateAuthUI();
|
||||
|
||||
// Check if guest mode is available after logout
|
||||
const authStatus = await checkAuthStatus();
|
||||
const allowGuest = authStatus.role === "rx";
|
||||
showAuthGate(allowGuest);
|
||||
showAuthGate();
|
||||
} catch (e) {
|
||||
console.error("Logout failed:", e);
|
||||
showAuthError("Logout failed");
|
||||
}
|
||||
}
|
||||
|
||||
function showAuthGate(allowGuest = false) {
|
||||
function showAuthGate() {
|
||||
if (!authEnabled) return;
|
||||
setDecodeHistoryOverlayVisible(false);
|
||||
requiredElement("loading").style.display = "none";
|
||||
@@ -459,12 +462,6 @@ function showAuthGate(allowGuest = false) {
|
||||
panel.style.display = "none";
|
||||
});
|
||||
|
||||
// Show guest button if guest mode is available
|
||||
const guestBtn = document.getElementById("auth-guest-btn");
|
||||
if (guestBtn) {
|
||||
guestBtn.style.display = allowGuest ? "block" : "none";
|
||||
}
|
||||
|
||||
document.querySelectorAll<HTMLElement>(".tab-bar .tab").forEach((btn) => {
|
||||
btn.classList.toggle("active", btn.dataset.tab === "main");
|
||||
});
|
||||
@@ -516,7 +513,7 @@ function updateAuthUI() {
|
||||
|
||||
if (authRole) {
|
||||
if (badge) badge.style.display = "block";
|
||||
if (badgeRole) badgeRole.textContent = authRole === "control" ? "Control (full access)" : "RX (read-only)";
|
||||
if (badgeRole) badgeRole.textContent = `${authUsername || "local"} — ${authRole === "admin" ? "Admin" : "User (read-only)"}`;
|
||||
if (headerAuthBtn) {
|
||||
headerAuthBtn.textContent = "Logout";
|
||||
headerAuthBtn.style.display = "block";
|
||||
@@ -534,8 +531,8 @@ function updateAuthUI() {
|
||||
function applyAuthRestrictions() {
|
||||
if (!authRole) return;
|
||||
|
||||
// Disable TX/PTT/frequency/mode/VFO controls for rx role
|
||||
if (authRole === "rx") {
|
||||
// Disable TX/PTT/frequency/mode/VFO controls for user role
|
||||
if (authRole === "user") {
|
||||
const pttBtn = document.getElementById("ptt-btn") as HTMLButtonElement | null;
|
||||
const powerBtn = document.getElementById("power-btn") as HTMLButtonElement | null;
|
||||
const lockBtn = document.getElementById("lock-btn") as HTMLButtonElement | null;
|
||||
@@ -883,7 +880,7 @@ function syncTopBarAccess() {
|
||||
}
|
||||
|
||||
if (headerRigSwitchSelect) {
|
||||
headerRigSwitchSelect.disabled = loggedOut || authRole === "rx" || lastRigIds.length === 0;
|
||||
headerRigSwitchSelect.disabled = loggedOut || authRole === "user" || lastRigIds.length === 0;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1464,7 +1461,7 @@ function applyRigList(activeRigId: string | null, rigIds: string[], displayNames
|
||||
}
|
||||
const nextKey = lastRigIds.join("\0") + "|" + (lastActiveRigId || "");
|
||||
const rigListChanged = prevKey !== nextKey;
|
||||
const disableSwitch = lastRigIds.length === 0 || !authRole || authRole === "rx";
|
||||
const disableSwitch = lastRigIds.length === 0 || !authRole || authRole === "user";
|
||||
populateRigPicker(headerRigSwitchSelect, lastRigIds, lastActiveRigId, disableSwitch);
|
||||
updateRigSubtitle(lastActiveRigId);
|
||||
window.trxUi?.setActiveRig(lastActiveRigId);
|
||||
@@ -3352,7 +3349,7 @@ function scheduleTuneLinkSync() {
|
||||
async function applyTuneLink(link: TuneLink) {
|
||||
const wanted = link.rig || link.mode || link.freqHz != null || link.bandwidthHz != null;
|
||||
if (!wanted) return;
|
||||
if (authRole === "rx") {
|
||||
if (authRole === "user") {
|
||||
showHint("Read-only session — link not applied", 2500);
|
||||
return;
|
||||
}
|
||||
@@ -4191,8 +4188,8 @@ async function switchRigFromSelect(selectEl: HTMLSelectElement) {
|
||||
showHint("No rig selected", 1500);
|
||||
return;
|
||||
}
|
||||
if (authRole === "rx") {
|
||||
showHint("Control role required", 1500);
|
||||
if (authRole === "user") {
|
||||
showHint("Admin role required", 1500);
|
||||
return;
|
||||
}
|
||||
if (!lastRigIds.includes(selectEl.value)) {
|
||||
@@ -4875,7 +4872,7 @@ function navigateToTab(name: TabName, options: { updateHistory?: boolean; replac
|
||||
const leavingSatellites = _activeTab === "satellites" && name !== "satellites";
|
||||
const { updateHistory = true, replaceHistory = false } = options;
|
||||
if (authEnabled && !authRole && name !== "main") {
|
||||
showAuthGate(false);
|
||||
showAuthGate();
|
||||
return;
|
||||
}
|
||||
const btn = document.querySelector<HTMLElement>(`.tab-bar .tab[data-tab="${name}"]`);
|
||||
@@ -5008,12 +5005,12 @@ window.addEventListener("resize", () => { scheduleSpectrumLayout(); });
|
||||
|
||||
// --- Auth startup sequence ---
|
||||
async function initializeApp() {
|
||||
showAuthGate(false);
|
||||
showAuthGate();
|
||||
const authStatus = await checkAuthStatus();
|
||||
authEnabled = !authStatus.auth_disabled;
|
||||
|
||||
if (!authEnabled) {
|
||||
authRole = "control";
|
||||
authRole = "admin";
|
||||
hideAuthGate();
|
||||
updateAuthUI();
|
||||
connect();
|
||||
@@ -5027,6 +5024,7 @@ async function initializeApp() {
|
||||
if (authStatus.authenticated) {
|
||||
// User has valid session
|
||||
authRole = authStatus.role ?? null;
|
||||
authUsername = authStatus.username ?? null;
|
||||
hideAuthGate();
|
||||
updateAuthUI();
|
||||
applyAuthRestrictions();
|
||||
@@ -5036,10 +5034,7 @@ async function initializeApp() {
|
||||
resizeHeaderSignalCanvas();
|
||||
startHeaderSignalSampling();
|
||||
} else {
|
||||
// No valid session - show auth gate
|
||||
// Guest button is shown if guest mode is available (role granted without auth)
|
||||
const allowGuest = authStatus.role === "rx";
|
||||
showAuthGate(allowGuest);
|
||||
showAuthGate();
|
||||
}
|
||||
}
|
||||
|
||||
@@ -5055,22 +5050,96 @@ function initSettingsUI() {
|
||||
window.trx.modules.backgroundDecode.initialize(lastActiveRigId, authRole);
|
||||
window.trx.modules.backgroundDecode.wireEvents();
|
||||
}
|
||||
void refreshUserManagement();
|
||||
}
|
||||
|
||||
async function refreshUserManagement() {
|
||||
const section = document.getElementById("user-management");
|
||||
if (!section) return;
|
||||
section.style.display = authEnabled && authRole === "admin" ? "block" : "none";
|
||||
if (section.style.display === "none") return;
|
||||
const list = requiredElement("user-list");
|
||||
try {
|
||||
const users = await listUsers();
|
||||
list.replaceChildren(...users.map((user) => {
|
||||
const row = document.createElement("div");
|
||||
row.className = "sch-row";
|
||||
row.style.cssText = "display:flex;align-items:center;gap:.5rem;flex-wrap:wrap;margin:.4rem 0";
|
||||
const name = document.createElement("strong");
|
||||
name.textContent = user.username;
|
||||
name.style.minWidth = "10rem";
|
||||
const role = document.createElement("select");
|
||||
role.className = "auth-input";
|
||||
for (const value of ["user", "admin"] as AuthRole[]) {
|
||||
const option = document.createElement("option"); option.value = value; option.textContent = value === "admin" ? "Admin" : "User"; option.selected = user.role === value; role.append(option);
|
||||
}
|
||||
const password = document.createElement("input");
|
||||
password.type = "password"; password.placeholder = "New password"; password.autocomplete = "new-password"; password.className = "auth-input"; password.minLength = 8;
|
||||
const save = document.createElement("button"); save.type = "button"; save.textContent = "Save";
|
||||
save.addEventListener("click", async () => {
|
||||
const changes: { role?: AuthRole; password?: string } = { role: role.value as AuthRole };
|
||||
if (password.value) changes.password = password.value;
|
||||
await runUserOperation(() => updateUser(user.username, changes));
|
||||
});
|
||||
const remove = document.createElement("button"); remove.type = "button"; remove.textContent = "Remove"; remove.className = "danger";
|
||||
remove.disabled = user.username === authUsername;
|
||||
remove.addEventListener("click", async () => {
|
||||
if (await window.trxUi.confirm({ title: "Remove user?", message: `Remove ${user.username} and revoke their sessions?`, confirmLabel: "Remove", danger: true })) {
|
||||
await runUserOperation(() => deleteUser(user.username));
|
||||
}
|
||||
});
|
||||
row.append(name, role, password, save, remove);
|
||||
return row;
|
||||
}));
|
||||
} catch (error) {
|
||||
showUserManagementError(error);
|
||||
}
|
||||
}
|
||||
|
||||
function showUserManagementError(error: unknown) {
|
||||
const element = document.getElementById("user-management-error");
|
||||
if (!element) return;
|
||||
element.textContent = error instanceof Error ? error.message : String(error);
|
||||
element.style.display = "block";
|
||||
}
|
||||
|
||||
async function runUserOperation(operation: () => Promise<void>) {
|
||||
try {
|
||||
await operation();
|
||||
const error = document.getElementById("user-management-error");
|
||||
if (error) error.style.display = "none";
|
||||
await refreshUserManagement();
|
||||
} catch (reason) {
|
||||
showUserManagementError(reason);
|
||||
}
|
||||
}
|
||||
|
||||
document.getElementById("user-create-form")?.addEventListener("submit", (event) => {
|
||||
event.preventDefault();
|
||||
const username = requiredElement<HTMLInputElement>("user-create-username");
|
||||
const password = requiredElement<HTMLInputElement>("user-create-password");
|
||||
const role = requiredElement<HTMLSelectElement>("user-create-role");
|
||||
void runUserOperation(async () => {
|
||||
await createUser(username.value, password.value, role.value as AuthRole);
|
||||
username.value = ""; password.value = ""; role.value = "user";
|
||||
});
|
||||
});
|
||||
|
||||
// Setup auth form
|
||||
requiredElement<HTMLFormElement>("auth-form").addEventListener("submit", async (e) => {
|
||||
e.preventDefault();
|
||||
const passphraseEl = requiredElement<HTMLInputElement>("auth-passphrase");
|
||||
const passphrase = passphraseEl.value;
|
||||
const usernameEl = requiredElement<HTMLInputElement>("auth-username");
|
||||
const passwordEl = requiredElement<HTMLInputElement>("auth-password");
|
||||
const btn = requiredElement<HTMLFormElement>("auth-form").querySelector<HTMLButtonElement>("button[type=submit]");
|
||||
if (!btn) return;
|
||||
btn.disabled = true;
|
||||
btn.textContent = "Logging in...";
|
||||
|
||||
try {
|
||||
const result = await authLogin(passphrase);
|
||||
const result = await authLogin(usernameEl.value, passwordEl.value);
|
||||
authRole = result.role ?? null;
|
||||
passphraseEl.value = "";
|
||||
authUsername = result.username ?? usernameEl.value;
|
||||
passwordEl.value = "";
|
||||
hideAuthGate();
|
||||
updateAuthUI();
|
||||
applyAuthRestrictions();
|
||||
@@ -5080,7 +5149,7 @@ requiredElement<HTMLFormElement>("auth-form").addEventListener("submit", async (
|
||||
resizeHeaderSignalCanvas();
|
||||
startHeaderSignalSampling();
|
||||
} catch (err) {
|
||||
showAuthError("Invalid passphrase");
|
||||
showAuthError("Invalid username or password");
|
||||
console.error("Login error:", err);
|
||||
} finally {
|
||||
btn.disabled = false;
|
||||
@@ -5088,23 +5157,6 @@ requiredElement<HTMLFormElement>("auth-form").addEventListener("submit", async (
|
||||
}
|
||||
});
|
||||
|
||||
// Setup guest button
|
||||
const guestBtn = document.getElementById("auth-guest-btn") as HTMLButtonElement | null;
|
||||
if (guestBtn) {
|
||||
guestBtn.addEventListener("click", () => {
|
||||
authRole = "rx";
|
||||
requiredElement<HTMLInputElement>("auth-passphrase").value = "";
|
||||
hideAuthGate();
|
||||
updateAuthUI();
|
||||
applyAuthRestrictions();
|
||||
connect();
|
||||
connectDecode();
|
||||
initSettingsUI();
|
||||
resizeHeaderSignalCanvas();
|
||||
startHeaderSignalSampling();
|
||||
});
|
||||
}
|
||||
|
||||
// Setup header auth button (Login/Logout)
|
||||
const headerAuthBtn = document.getElementById("header-auth-btn") as HTMLButtonElement | null;
|
||||
if (headerAuthBtn) {
|
||||
@@ -5116,7 +5168,7 @@ if (headerAuthBtn) {
|
||||
}
|
||||
} else {
|
||||
// Not logged in - show auth gate
|
||||
showAuthGate(false);
|
||||
showAuthGate();
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
+1
-1
@@ -468,7 +468,7 @@ const bgdWindow = window as unknown as BackgroundBridge;
|
||||
}
|
||||
|
||||
function isControlRole(): boolean {
|
||||
return backgroundDecodeRole === "control" || hostState.authEnabled === false;
|
||||
return backgroundDecodeRole === "admin" || hostState.authEnabled === false;
|
||||
}
|
||||
|
||||
function showToast(msg: string, isError: boolean): void {
|
||||
|
||||
@@ -100,7 +100,7 @@ function bmEsc(str: unknown): string {
|
||||
}
|
||||
|
||||
function bmCanControl() {
|
||||
return !hostState.authEnabled || hostState.authRole === "control";
|
||||
return !hostState.authEnabled || hostState.authRole === "admin";
|
||||
}
|
||||
|
||||
// Show/hide the Add Bookmark / Select All buttons based on the current auth role.
|
||||
|
||||
@@ -32,6 +32,20 @@ interface Qso {
|
||||
my_gridsquare?: string | null;
|
||||
my_rig?: string | null;
|
||||
rig_id?: string | null;
|
||||
contest_id?: string | null;
|
||||
stx?: number | null;
|
||||
srx?: number | null;
|
||||
srx_string?: string | null;
|
||||
qsl_rcvd?: string | null;
|
||||
lotw_qsl_rcvd?: string | null;
|
||||
confirmed?: boolean;
|
||||
}
|
||||
|
||||
interface BandStatistics {
|
||||
band: string;
|
||||
contacts: number;
|
||||
stations: number;
|
||||
confirmed: number;
|
||||
}
|
||||
|
||||
interface Prefill {
|
||||
@@ -86,6 +100,16 @@ const importFile = el<HTMLInputElement>("log-import-file");
|
||||
const exportLink = el<HTMLAnchorElement>("log-export-btn");
|
||||
const clearBtn = el<HTMLButtonElement>("log-clear-btn");
|
||||
const saveBtn = el<HTMLButtonElement>("log-save-btn");
|
||||
const contestIdInput = el<HTMLInputElement>("log-contest-id");
|
||||
const stxInput = el<HTMLInputElement>("log-stx");
|
||||
const srxInput = el<HTMLInputElement>("log-srx");
|
||||
const statisticsRows = el<HTMLTableSectionElement>("log-statistics-rows");
|
||||
const cabrilloContest = el<HTMLInputElement>("log-cbr-contest");
|
||||
const cabrilloCallsign = el<HTMLInputElement>("log-cbr-callsign");
|
||||
const cabrilloOperator = el<HTMLSelectElement>("log-cbr-operator");
|
||||
const cabrilloPower = el<HTMLSelectElement>("log-cbr-power");
|
||||
const cabrilloScore = el<HTMLInputElement>("log-cbr-score");
|
||||
const cabrilloExport = el<HTMLAnchorElement>("log-cbr-export");
|
||||
|
||||
/** The time the open entry was started, as the server gave it. */
|
||||
let entryStartedAt: string | null = null;
|
||||
@@ -121,6 +145,14 @@ function parseFreq(text: string): number | null {
|
||||
return value < 100_000 ? Math.round(value * 1e6) : Math.round(value);
|
||||
}
|
||||
|
||||
/** A serial, or null when the exchange is a word rather than a number. */
|
||||
function numberOrNull(text: string | undefined): number | null {
|
||||
const trimmed = (text ?? "").trim();
|
||||
if (!trimmed || !/^\d+$/.test(trimmed)) return null;
|
||||
const value = Number(trimmed);
|
||||
return Number.isSafeInteger(value) ? value : null;
|
||||
}
|
||||
|
||||
function utcDate(iso: string): string {
|
||||
const date = new Date(iso);
|
||||
return Number.isNaN(date.getTime()) ? "" : date.toISOString().slice(0, 10);
|
||||
@@ -176,7 +208,9 @@ function showClock(prefill: Prefill): void {
|
||||
|
||||
/** Clear the entry and open a fresh one. */
|
||||
function resetEntry(): void {
|
||||
for (const input of [callInput, rstSentInput, rstRcvdInput, gridInput, nameInput, commentInput]) {
|
||||
// The contest and the serial sent stay: they belong to the session, not to
|
||||
// the contact just logged.
|
||||
for (const input of [callInput, rstSentInput, rstRcvdInput, gridInput, nameInput, commentInput, srxInput]) {
|
||||
if (input) input.value = "";
|
||||
}
|
||||
if (workedEl) workedEl.textContent = "";
|
||||
@@ -214,6 +248,13 @@ async function submitEntry(event: Event): Promise<void> {
|
||||
gridsquare: gridInput?.value ?? null,
|
||||
name: nameInput?.value ?? null,
|
||||
comment: commentInput?.value ?? null,
|
||||
contest_id: contestIdInput?.value ?? null,
|
||||
// The exchange is a number when it is a serial and a word when it is a
|
||||
// zone or a section; both are kept, and the log writes whichever it has.
|
||||
stx: numberOrNull(stxInput?.value),
|
||||
stx_string: numberOrNull(stxInput?.value) == null ? stxInput?.value ?? null : null,
|
||||
srx: numberOrNull(srxInput?.value),
|
||||
srx_string: numberOrNull(srxInput?.value) == null ? srxInput?.value ?? null : null,
|
||||
station_callsign: stationCallEl?.textContent?.trim() ?? null,
|
||||
operator: operatorInput?.value ?? null,
|
||||
my_gridsquare: entryGrid,
|
||||
@@ -232,7 +273,11 @@ async function submitEntry(event: Event): Promise<void> {
|
||||
throw new Error(detail.error ?? `HTTP ${String(response.status)}`);
|
||||
}
|
||||
notify(`${call} logged`);
|
||||
// A contest runs on serials: the next one is this one plus one, so it is
|
||||
// not retyped forty times an hour.
|
||||
const sent = numberOrNull(stxInput?.value);
|
||||
resetEntry();
|
||||
if (stxInput && sent != null) stxInput.value = String(sent + 1);
|
||||
await refreshLog();
|
||||
} catch (error: unknown) {
|
||||
notify(`Could not log: ${error instanceof Error ? error.message : String(error)}`, "error");
|
||||
@@ -292,11 +337,57 @@ async function refreshLog(): Promise<void> {
|
||||
: `${String(answer.total)} contact${answer.total === 1 ? "" : "s"}`;
|
||||
}
|
||||
if (exportLink) exportLink.href = `/api/logbook/export.adi${query ? `?${query}` : ""}`;
|
||||
await refreshStatistics();
|
||||
} catch (error: unknown) {
|
||||
console.error("logbook read failed", error);
|
||||
}
|
||||
}
|
||||
|
||||
/** What has been worked and confirmed, band by band. */
|
||||
async function refreshStatistics(): Promise<void> {
|
||||
if (!statisticsRows) return;
|
||||
try {
|
||||
const answer = await getJson<{ bands: BandStatistics[] }>("/api/logbook/statistics");
|
||||
if (answer.bands.length === 0) {
|
||||
statisticsRows.innerHTML = '<tr><td colspan="4" class="log-empty">Nothing worked yet.</td></tr>';
|
||||
return;
|
||||
}
|
||||
const fragment = document.createDocumentFragment();
|
||||
for (const band of answer.bands) {
|
||||
const row = document.createElement("tr");
|
||||
for (const value of [band.band, band.contacts, band.stations, band.confirmed]) {
|
||||
const cell = document.createElement("td");
|
||||
cell.textContent = String(value);
|
||||
row.appendChild(cell);
|
||||
}
|
||||
fragment.appendChild(row);
|
||||
}
|
||||
statisticsRows.replaceChildren(fragment);
|
||||
} catch (error: unknown) {
|
||||
console.error("logbook statistics failed", error);
|
||||
}
|
||||
}
|
||||
|
||||
/** The Cabrillo link, carrying the header the operator filled in. */
|
||||
function syncCabrilloLink(): void {
|
||||
if (!cabrilloExport) return;
|
||||
const params = new URLSearchParams();
|
||||
const contest = cabrilloContest?.value.trim();
|
||||
if (contest) {
|
||||
// Only that contest's contacts belong in the entry.
|
||||
params.set("contest", contest);
|
||||
}
|
||||
const callsign = cabrilloCallsign?.value.trim() || (stationCallEl?.textContent?.trim() ?? "");
|
||||
if (callsign) params.set("callsign", callsign);
|
||||
if (cabrilloOperator?.value) params.set("category_operator", cabrilloOperator.value);
|
||||
if (cabrilloPower?.value) params.set("category_power", cabrilloPower.value);
|
||||
const score = numberOrNull(cabrilloScore?.value);
|
||||
if (score != null) params.set("claimed_score", String(score));
|
||||
const operator = operatorInput?.value.trim();
|
||||
if (operator) params.set("operators", operator);
|
||||
cabrilloExport.href = `/api/logbook/export.cbr?${params.toString()}`;
|
||||
}
|
||||
|
||||
function renderRows(): void {
|
||||
if (!rowsBody) return;
|
||||
if (qsos.length === 0) {
|
||||
@@ -319,6 +410,7 @@ function renderRows(): void {
|
||||
qso.rst_rcvd ?? "",
|
||||
qso.gridsquare ?? "",
|
||||
qso.my_rig ?? "",
|
||||
qso.confirmed ? "✓" : "",
|
||||
];
|
||||
for (const [index, value] of cells.entries()) {
|
||||
const cell = document.createElement("td");
|
||||
@@ -327,6 +419,17 @@ function renderRows(): void {
|
||||
row.appendChild(cell);
|
||||
}
|
||||
const actions = document.createElement("td");
|
||||
// Confirming is the commonest edit a log gets, so it is a button rather
|
||||
// than a form: a card arrives, and the contact counts towards an award.
|
||||
const confirm = document.createElement("button");
|
||||
confirm.type = "button";
|
||||
confirm.className = "log-row-btn";
|
||||
confirm.textContent = qso.confirmed ? "Unconfirm" : "Confirm";
|
||||
confirm.title = qso.confirmed
|
||||
? "Mark this contact as not confirmed"
|
||||
: "Mark this contact confirmed by QSL";
|
||||
confirm.addEventListener("click", () => { void setConfirmed(qso, !qso.confirmed); });
|
||||
actions.appendChild(confirm);
|
||||
const remove = document.createElement("button");
|
||||
remove.type = "button";
|
||||
remove.className = "log-row-btn";
|
||||
@@ -357,6 +460,26 @@ function renderFilterOptions(): void {
|
||||
}
|
||||
}
|
||||
|
||||
/** Record, or withdraw, the other station's confirmation. */
|
||||
async function setConfirmed(qso: Qso, confirmed: boolean): Promise<void> {
|
||||
try {
|
||||
const response = await fetch(`/api/logbook/${encodeURIComponent(qso.id)}`, {
|
||||
method: "PUT",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({
|
||||
...qso,
|
||||
// A card is a card: this is the paper one, and an electronic
|
||||
// confirmation the log already holds is left where it is.
|
||||
qsl_rcvd: confirmed ? "Y" : "N",
|
||||
}),
|
||||
});
|
||||
if (!response.ok) throw new Error(`HTTP ${String(response.status)}`);
|
||||
await refreshLog();
|
||||
} catch (error: unknown) {
|
||||
notify(`Could not update: ${error instanceof Error ? error.message : String(error)}`, "error");
|
||||
}
|
||||
}
|
||||
|
||||
async function deleteQso(qso: Qso): Promise<void> {
|
||||
const confirmed = await bridge.trxUi.confirm({
|
||||
title: "Delete this contact?",
|
||||
@@ -412,6 +535,10 @@ for (const control of [filterCall, filterBand, filterMode]) {
|
||||
control?.addEventListener("input", () => { void refreshLog(); });
|
||||
control?.addEventListener("change", () => { void refreshLog(); });
|
||||
}
|
||||
for (const control of [cabrilloContest, cabrilloCallsign, cabrilloOperator, cabrilloPower, cabrilloScore]) {
|
||||
control?.addEventListener("input", syncCabrilloLink);
|
||||
control?.addEventListener("change", syncCabrilloLink);
|
||||
}
|
||||
importBtn?.addEventListener("click", () => { importFile?.click(); });
|
||||
importFile?.addEventListener("change", () => {
|
||||
const file = importFile.files?.[0];
|
||||
@@ -426,5 +553,9 @@ bridge.logContact = (seed) => {
|
||||
};
|
||||
|
||||
renderStation();
|
||||
if (cabrilloCallsign && !cabrilloCallsign.value) {
|
||||
cabrilloCallsign.value = stationCallEl?.textContent?.trim() ?? "";
|
||||
}
|
||||
syncCabrilloLink();
|
||||
void openEntry();
|
||||
void refreshLog();
|
||||
|
||||
@@ -356,7 +356,7 @@ function schedulerOptionalEl(id: string): SchedulerElement | null {
|
||||
if (!prevBtn || !nextBtn) return;
|
||||
const state = schedulerInterleaveState(currentConfig);
|
||||
const enabled =
|
||||
schedulerRole === "control" &&
|
||||
schedulerRole === "admin" &&
|
||||
!!currentRigId &&
|
||||
!schedulerStepPending &&
|
||||
state.activeEntries.length > 1;
|
||||
@@ -466,7 +466,7 @@ function schedulerOptionalEl(id: string): SchedulerElement | null {
|
||||
if (!panel) return;
|
||||
|
||||
const mode = (currentConfig && currentConfig.mode) || "disabled";
|
||||
const isControl = schedulerRole === "control";
|
||||
const isControl = schedulerRole === "admin";
|
||||
|
||||
// Mode selector
|
||||
setSelected("scheduler-mode-select", mode);
|
||||
|
||||
+1
-1
@@ -40,7 +40,7 @@ test("background decode loads configuration for the explicitly selected rig", as
|
||||
const source = await bundleEntry(new URL("../src/plugins/background-decode.ts", import.meta.url));
|
||||
new vm.Script(source).runInContext(context);
|
||||
|
||||
window.trx.modules.backgroundDecode.initialize("rig/a", "control");
|
||||
window.trx.modules.backgroundDecode.initialize("rig/a", "admin");
|
||||
await new Promise((resolve) => setTimeout(resolve, 0));
|
||||
assert.ok(requested.includes("/background-decode/rig%2Fa"));
|
||||
assert.ok(requested.includes("/bookmarks"));
|
||||
|
||||
@@ -32,7 +32,7 @@ function hostFixture(overrides = {}) {
|
||||
const calls = { postPath: [], setRigFrequency: [], armOptimisticFrequency: [], applyLocalTunedFrequency: [], syncBandwidthInput: [], scheduleSpectrumDraw: 0, syncModePicker: 0 };
|
||||
const state = {
|
||||
authEnabled: false,
|
||||
authRole: "control",
|
||||
authRole: "admin",
|
||||
lastActiveRigId: null,
|
||||
lastRigIds: [],
|
||||
lastRigDisplayNames: {},
|
||||
@@ -157,7 +157,7 @@ test("bookmark controls follow the host authentication state", async () => {
|
||||
if (!elements.has(id)) elements.set(id, new ElementFixture());
|
||||
return elements.get(id);
|
||||
};
|
||||
const { window } = hostFixture({ authEnabled: true, authRole: "rx" });
|
||||
const { window } = hostFixture({ authEnabled: true, authRole: "user" });
|
||||
const context = vm.createContext({
|
||||
window,
|
||||
document: documentFixture(element),
|
||||
@@ -171,7 +171,7 @@ test("bookmark controls follow the host authentication state", async () => {
|
||||
|
||||
assert.equal(element("bm-add-btn").style.display, "none");
|
||||
|
||||
window.trx.state.authRole = "control";
|
||||
window.trx.state.authRole = "admin";
|
||||
await window.trx.modules.bookmarks.fetch("");
|
||||
assert.equal(element("bm-add-btn").style.display, "");
|
||||
});
|
||||
|
||||
@@ -19,7 +19,7 @@ export function createHost({ state = {}, core = {}, modules = {} } = {}) {
|
||||
serverLat: null,
|
||||
serverLon: null,
|
||||
authEnabled: false,
|
||||
authRole: "control",
|
||||
authRole: "admin",
|
||||
lastActiveRigId: null,
|
||||
lastRigIds: [],
|
||||
lastRigDisplayNames: {},
|
||||
|
||||
@@ -137,6 +137,69 @@ try {
|
||||
assert.equal(inHamLayout.layout, "ham");
|
||||
assert.equal(inHamLayout.path, "/logbook", "the ham layout opened somewhere else");
|
||||
|
||||
// ── Contest working ─────────────────────────────────────────────────────
|
||||
// The exchange belongs to the session: the contest and the serial sent stay
|
||||
// between contacts, and the serial counts on by itself.
|
||||
await page.evaluate(() => { window.navigateToTab("logbook"); });
|
||||
await page.waitForTimeout(600);
|
||||
await page.locator("#log-contest-block > summary").click();
|
||||
await page.locator("#log-contest-id").fill("CQ-WW-SSB");
|
||||
await page.locator("#log-stx").fill("1");
|
||||
await page.locator("#log-call").fill("DL9CON");
|
||||
await page.locator("#log-srx").fill("014");
|
||||
await page.locator("#log-rst-sent").fill("59");
|
||||
await page.locator("#log-rst-rcvd").fill("59");
|
||||
await page.locator("#log-save-btn").click();
|
||||
await page.waitForTimeout(900);
|
||||
const afterContest = await page.evaluate(() => ({
|
||||
contest: document.getElementById("log-contest-id")?.value ?? "",
|
||||
stx: document.getElementById("log-stx")?.value ?? "",
|
||||
srx: document.getElementById("log-srx")?.value ?? "",
|
||||
call: document.getElementById("log-call")?.value ?? "",
|
||||
}));
|
||||
assert.equal(afterContest.contest, "CQ-WW-SSB", "the contest was cleared with the contact");
|
||||
assert.equal(afterContest.stx, "2", `the serial sent went to "${afterContest.stx}"`);
|
||||
assert.equal(afterContest.srx, "", "the received exchange was kept for the next station");
|
||||
assert.equal(afterContest.call, "");
|
||||
|
||||
// The Cabrillo link carries the header, and names the contest so that only
|
||||
// its contacts are entered.
|
||||
await page.locator("#log-contest-export-block > summary").click();
|
||||
await page.locator("#log-cbr-contest").fill("CQ-WW-SSB");
|
||||
await page.locator("#log-cbr-score").fill("4242");
|
||||
await page.waitForTimeout(300);
|
||||
const cabrillo = await page.evaluate(() =>
|
||||
document.getElementById("log-cbr-export")?.getAttribute("href") ?? "");
|
||||
assert.match(cabrillo, /contest=CQ-WW-SSB/, `the Cabrillo link reads "${cabrillo}"`);
|
||||
assert.match(cabrillo, /claimed_score=4242/, `the Cabrillo link reads "${cabrillo}"`);
|
||||
const entry = await page.evaluate(async (href) => {
|
||||
const response = await fetch(href);
|
||||
return await response.text();
|
||||
}, cabrillo);
|
||||
assert.match(entry, /^START-OF-LOG: 3\.0/, entry);
|
||||
assert.match(entry, /DL9CON/, "the contest contact is not in the entry");
|
||||
assert.ok(!entry.includes("OZ1NEW"), "a contact outside the contest was entered");
|
||||
|
||||
// ── Confirmations ───────────────────────────────────────────────────────
|
||||
// A card arrives: the contact is marked confirmed, and the per-band report
|
||||
// counts it.
|
||||
const confirmRow = page.locator("#log-rows tr", { hasText: "DL9CON" }).first();
|
||||
await confirmRow.getByRole("button", { name: "Confirm" }).click();
|
||||
await page.waitForTimeout(800);
|
||||
await page.locator("#log-statistics-block > summary").click();
|
||||
await page.waitForTimeout(400);
|
||||
const confirmed = await page.evaluate(() => ({
|
||||
marks: [...document.querySelectorAll("#log-rows tr")]
|
||||
.map((row) => [...row.querySelectorAll("td")].at(-2)?.textContent ?? ""),
|
||||
bands: [...document.querySelectorAll("#log-statistics-rows tr")]
|
||||
.map((row) => [...row.querySelectorAll("td")].map((cell) => cell.textContent)),
|
||||
}));
|
||||
assert.equal(confirmed.marks.filter((mark) => mark === "✓").length, 1,
|
||||
`the QSL column reads ${JSON.stringify(confirmed.marks)}`);
|
||||
const twenty = confirmed.bands.find((band) => band[0] === "20m");
|
||||
assert.ok(twenty, `the bands are ${JSON.stringify(confirmed.bands)}`);
|
||||
assert.equal(twenty[3], "1", `20m shows ${twenty[3]} confirmed`);
|
||||
|
||||
assert.deepEqual(runtimeErrors, []);
|
||||
} finally {
|
||||
await browser.close();
|
||||
|
||||
@@ -76,7 +76,7 @@ test("scheduler self-initializes for the active rig when a role is already known
|
||||
return elements.get(id);
|
||||
};
|
||||
const window = {
|
||||
...createHost({ state: { authRole: "control", lastActiveRigId: "sdr" } }),
|
||||
...createHost({ state: { authRole: "admin", lastActiveRigId: "sdr" } }),
|
||||
trxUi: { confirm: async () => true },
|
||||
};
|
||||
const context = vm.createContext({
|
||||
|
||||
@@ -232,7 +232,7 @@ export async function startWebFixture({
|
||||
};
|
||||
|
||||
const jsonRoutes = new Map([
|
||||
["/auth/session", { authenticated: true, role: "control", auth_disabled: true }],
|
||||
["/auth/session", { authenticated: true, role: "admin", auth_disabled: true }],
|
||||
["/decoders", DECODER_REGISTRY],
|
||||
["/rigs", rigsResponse],
|
||||
["/status", status],
|
||||
@@ -309,6 +309,49 @@ export async function startWebFixture({
|
||||
response.end(JSON.stringify({ call, worked }));
|
||||
return;
|
||||
}
|
||||
if (tail === "/statistics") {
|
||||
const bands = new Map();
|
||||
for (const qso of logbook) {
|
||||
const entry = bands.get(qso.band) ?? { band: qso.band, contacts: 0, stations: 0, confirmed: 0, calls: new Set() };
|
||||
entry.contacts += 1;
|
||||
entry.calls.add(qso.call);
|
||||
if (qso.confirmed || qso.qsl_rcvd === "Y" || qso.lotw_qsl_rcvd === "Y") entry.confirmed += 1;
|
||||
bands.set(qso.band, entry);
|
||||
}
|
||||
const list = [...bands.values()].map(({ calls, ...rest }) => ({ ...rest, stations: calls.size }));
|
||||
response.writeHead(200, { "content-type": "application/json" });
|
||||
response.end(JSON.stringify({
|
||||
contacts: logbook.length,
|
||||
confirmed: list.reduce((total, band) => total + band.confirmed, 0),
|
||||
bands: list,
|
||||
}));
|
||||
return;
|
||||
}
|
||||
if (tail === "/export.cbr") {
|
||||
const contest = url.searchParams.get("contest");
|
||||
const entered = contest ? logbook.filter((qso) => qso.contest_id === contest) : logbook;
|
||||
response.writeHead(200, { "content-type": "text/plain" });
|
||||
response.end(`START-OF-LOG: 3.0\nCONTEST: ${contest ?? ""}\n`
|
||||
+ entered.map((qso) => `QSO: 14200 PH ${qso.call}\n`).join("")
|
||||
+ "END-OF-LOG:\n");
|
||||
return;
|
||||
}
|
||||
if (request.method === "PUT") {
|
||||
const raw = await new Promise((resolve) => {
|
||||
let text = "";
|
||||
request.on("data", (chunk) => { text += chunk; });
|
||||
request.on("end", () => resolve(text));
|
||||
});
|
||||
const input = JSON.parse(raw);
|
||||
const id = tail.replace("/", "");
|
||||
const held = logbook.find((qso) => qso.id === id);
|
||||
if (held) {
|
||||
Object.assign(held, input, { id, confirmed: input.qsl_rcvd === "Y" });
|
||||
}
|
||||
response.writeHead(200, { "content-type": "application/json" });
|
||||
response.end(JSON.stringify(held ?? {}));
|
||||
return;
|
||||
}
|
||||
if (tail === "/export.adi") {
|
||||
const body = logbook
|
||||
.map((qso) => `<CALL:${qso.call.length}>${qso.call}<EOR>\n`)
|
||||
@@ -337,6 +380,10 @@ export async function startWebFixture({
|
||||
gridsquare: input.gridsquare ? String(input.gridsquare).toUpperCase() : null,
|
||||
my_rig: input.my_rig,
|
||||
operator: input.operator,
|
||||
contest_id: input.contest_id ?? null,
|
||||
stx: input.stx ?? null,
|
||||
srx: input.srx ?? null,
|
||||
confirmed: input.qsl_rcvd === "Y" || input.lotw_qsl_rcvd === "Y",
|
||||
};
|
||||
logbook.unshift(qso);
|
||||
response.writeHead(200, { "content-type": "application/json" });
|
||||
|
||||
@@ -27,12 +27,15 @@ struct QsoView {
|
||||
#[serde(flatten)]
|
||||
qso: Qso,
|
||||
band: Option<&'static str>,
|
||||
/// Whether the other station has confirmed, from whichever bureau answered.
|
||||
confirmed: bool,
|
||||
}
|
||||
|
||||
impl From<Qso> for QsoView {
|
||||
fn from(qso: Qso) -> Self {
|
||||
Self {
|
||||
band: qso.band(),
|
||||
confirmed: qso.is_confirmed(),
|
||||
qso,
|
||||
}
|
||||
}
|
||||
@@ -79,6 +82,39 @@ struct QsoInput {
|
||||
my_rig: Option<String>,
|
||||
#[serde(default)]
|
||||
rig_id: Option<String>,
|
||||
#[serde(default)]
|
||||
contest_id: Option<String>,
|
||||
#[serde(default)]
|
||||
stx: Option<u32>,
|
||||
#[serde(default)]
|
||||
stx_string: Option<String>,
|
||||
#[serde(default)]
|
||||
srx: Option<u32>,
|
||||
#[serde(default)]
|
||||
srx_string: Option<String>,
|
||||
#[serde(default)]
|
||||
cqz: Option<u8>,
|
||||
#[serde(default)]
|
||||
ituz: Option<u8>,
|
||||
#[serde(default)]
|
||||
qsl_sent: Option<String>,
|
||||
#[serde(default)]
|
||||
qsl_rcvd: Option<String>,
|
||||
#[serde(default)]
|
||||
lotw_qsl_sent: Option<String>,
|
||||
#[serde(default)]
|
||||
lotw_qsl_rcvd: Option<String>,
|
||||
#[serde(default)]
|
||||
eqsl_qsl_sent: Option<String>,
|
||||
#[serde(default)]
|
||||
eqsl_qsl_rcvd: Option<String>,
|
||||
}
|
||||
|
||||
/// ADIF's QSL states are single letters. Anything else is refused rather than
|
||||
/// written, or a log would grow states no other program can read.
|
||||
fn qsl_state(value: Option<String>) -> Option<String> {
|
||||
let state = blank_to_none(value)?.to_uppercase();
|
||||
matches!(state.as_str(), "Y" | "N" | "R" | "I" | "Q" | "V").then_some(state)
|
||||
}
|
||||
|
||||
fn blank_to_none(value: Option<String>) -> Option<String> {
|
||||
@@ -123,6 +159,19 @@ impl QsoInput {
|
||||
qso.my_gridsquare = blank_to_none(self.my_gridsquare).map(|g| g.to_uppercase());
|
||||
qso.my_rig = blank_to_none(self.my_rig);
|
||||
qso.rig_id = blank_to_none(self.rig_id);
|
||||
qso.contest_id = blank_to_none(self.contest_id).map(|c| c.to_uppercase());
|
||||
qso.stx = self.stx;
|
||||
qso.stx_string = blank_to_none(self.stx_string);
|
||||
qso.srx = self.srx;
|
||||
qso.srx_string = blank_to_none(self.srx_string);
|
||||
qso.cqz = self.cqz;
|
||||
qso.ituz = self.ituz;
|
||||
qso.qsl_sent = qsl_state(self.qsl_sent);
|
||||
qso.qsl_rcvd = qsl_state(self.qsl_rcvd);
|
||||
qso.lotw_qsl_sent = qsl_state(self.lotw_qsl_sent);
|
||||
qso.lotw_qsl_rcvd = qsl_state(self.lotw_qsl_rcvd);
|
||||
qso.eqsl_qsl_sent = qsl_state(self.eqsl_qsl_sent);
|
||||
qso.eqsl_qsl_rcvd = qsl_state(self.eqsl_qsl_rcvd);
|
||||
// Whatever an imported contact carried that this application does not
|
||||
// model stays with it through an edit.
|
||||
if let Some(existing) = existing {
|
||||
@@ -271,6 +320,41 @@ pub async fn import_adi(
|
||||
}
|
||||
}
|
||||
|
||||
/// `GET /api/logbook/export.cbr` — a contest entry, in the only format sponsors
|
||||
/// take.
|
||||
///
|
||||
/// The header cannot be worked out from the log — how many operators, how much
|
||||
/// power — so it comes as query parameters from the operator.
|
||||
#[get("/api/logbook/export.cbr")]
|
||||
pub async fn export_cabrillo(
|
||||
query: web::Query<LogQuery>,
|
||||
header: web::Query<trx_logbook::CabrilloHeader>,
|
||||
logbook: web::Data<Arc<Logbook>>,
|
||||
) -> impl Responder {
|
||||
let text = book(&logbook).export_cabrillo(&query.into_inner(), &header.into_inner());
|
||||
let filename = format!("trx-rs-contest-{}.cbr", Utc::now().format("%Y%m%d"));
|
||||
HttpResponse::Ok()
|
||||
.insert_header((header::CONTENT_TYPE, "text/plain; charset=utf-8"))
|
||||
.insert_header((
|
||||
header::CONTENT_DISPOSITION,
|
||||
format!("attachment; filename=\"{filename}\""),
|
||||
))
|
||||
.body(text)
|
||||
}
|
||||
|
||||
/// `GET /api/logbook/statistics` — what has been worked and confirmed, per band.
|
||||
#[get("/api/logbook/statistics")]
|
||||
pub async fn statistics(logbook: web::Data<Arc<Logbook>>) -> impl Responder {
|
||||
let bands = book(&logbook).band_statistics();
|
||||
let contacts: usize = bands.iter().map(|band| band.contacts).sum();
|
||||
let confirmed: usize = bands.iter().map(|band| band.confirmed).sum();
|
||||
HttpResponse::Ok().json(serde_json::json!({
|
||||
"contacts": contacts,
|
||||
"confirmed": confirmed,
|
||||
"bands": bands,
|
||||
}))
|
||||
}
|
||||
|
||||
/// `GET /api/logbook/worked/{call}` — which bands and modes this station has been
|
||||
/// worked on.
|
||||
#[get("/api/logbook/worked/{call}")]
|
||||
|
||||
@@ -399,8 +399,8 @@ fn require_control(
|
||||
return Ok(());
|
||||
}
|
||||
match crate::server::auth::get_session_role(req, auth_state) {
|
||||
Some(crate::server::auth::AuthRole::Control) => Ok(()),
|
||||
_ => Err(actix_web::error::ErrorForbidden("control role required")),
|
||||
Some(crate::server::auth::AuthRole::Admin) => Ok(()),
|
||||
_ => Err(actix_web::error::ErrorForbidden("admin role required")),
|
||||
}
|
||||
}
|
||||
|
||||
@@ -709,12 +709,18 @@ pub fn configure(cfg: &mut web::ServiceConfig) {
|
||||
.service(crate::server::auth::login)
|
||||
.service(crate::server::auth::logout)
|
||||
.service(crate::server::auth::session_status)
|
||||
.service(crate::server::auth::list_users)
|
||||
.service(crate::server::auth::create_user)
|
||||
.service(crate::server::auth::update_user)
|
||||
.service(crate::server::auth::delete_user)
|
||||
// Logbook
|
||||
.service(logbook::list_qsos)
|
||||
.service(logbook::add_qso)
|
||||
.service(logbook::edit_qso)
|
||||
.service(logbook::delete_qso)
|
||||
.service(logbook::export_adi)
|
||||
.service(logbook::export_cabrillo)
|
||||
.service(logbook::statistics)
|
||||
.service(logbook::import_adi)
|
||||
.service(logbook::worked_before)
|
||||
.service(logbook::server_now)
|
||||
@@ -947,30 +953,33 @@ mod tests {
|
||||
);
|
||||
}
|
||||
|
||||
/// Auth off: every session may write, as a station with no passphrase set.
|
||||
/// Auth off: every session may write without an account.
|
||||
fn auth_state_disabled() -> crate::server::auth::AuthState {
|
||||
crate::server::auth::AuthState::new(crate::server::auth::AuthConfig::new(
|
||||
false,
|
||||
std::path::PathBuf::from("unused-users.json"),
|
||||
None,
|
||||
None,
|
||||
false,
|
||||
std::time::Duration::from_secs(3600),
|
||||
false,
|
||||
crate::server::auth::SameSite::Lax,
|
||||
))
|
||||
.unwrap()
|
||||
}
|
||||
|
||||
/// Auth on with no session presented, which is what a listener is.
|
||||
fn auth_state_locked() -> crate::server::auth::AuthState {
|
||||
let directory = tempfile::tempdir().unwrap();
|
||||
crate::server::auth::AuthState::new(crate::server::auth::AuthConfig::new(
|
||||
true,
|
||||
Some("listen".to_string()),
|
||||
Some("control".to_string()),
|
||||
false,
|
||||
directory.path().join("users.json"),
|
||||
Some("admin".to_string()),
|
||||
Some("password123".to_string()),
|
||||
std::time::Duration::from_secs(3600),
|
||||
false,
|
||||
crate::server::auth::SameSite::Lax,
|
||||
))
|
||||
.unwrap()
|
||||
}
|
||||
|
||||
/// A contact written over HTTP comes back out of the log, and out of an
|
||||
@@ -1045,6 +1054,116 @@ mod tests {
|
||||
assert!(text.contains("<EOR>"), "{text}");
|
||||
}
|
||||
|
||||
/// A contest entry comes out in Cabrillo, holding that contest's contacts
|
||||
/// and no others, with the header the operator gave.
|
||||
#[actix_web::test]
|
||||
async fn a_contest_entry_is_exported_as_cabrillo() {
|
||||
let dir = tempfile::tempdir().expect("tempdir");
|
||||
let logbook = std::sync::Arc::new(
|
||||
trx_logbook::Logbook::open(&dir.path().join("logbook.jsonl")).expect("open"),
|
||||
);
|
||||
let app = actix_test::init_service(
|
||||
App::new()
|
||||
.app_data(web::Data::new(logbook.clone()))
|
||||
.app_data(web::Data::new(auth_state_disabled()))
|
||||
.service(logbook::add_qso)
|
||||
.service(logbook::export_cabrillo)
|
||||
.service(logbook::statistics),
|
||||
)
|
||||
.await;
|
||||
|
||||
for (call, contest, serial, confirmed) in [
|
||||
("DL1AB", Some("CQ-WW-SSB"), 1, true),
|
||||
("OZ2CD", Some("CQ-WW-SSB"), 2, false),
|
||||
("SP3EF", None, 0, false),
|
||||
] {
|
||||
let response = actix_test::call_service(
|
||||
&app,
|
||||
actix_test::TestRequest::post()
|
||||
.uri("/api/logbook")
|
||||
.set_json(serde_json::json!({
|
||||
"call": call,
|
||||
"freq_hz": 14_200_000_u64,
|
||||
"mode": "SSB",
|
||||
"rst_sent": "59",
|
||||
"rst_rcvd": "59",
|
||||
"station_callsign": "SP0TRX",
|
||||
"contest_id": contest,
|
||||
"stx": serial,
|
||||
"srx": serial,
|
||||
"lotw_qsl_rcvd": if confirmed { "Y" } else { "N" },
|
||||
}))
|
||||
.to_request(),
|
||||
)
|
||||
.await;
|
||||
assert_eq!(response.status(), 200);
|
||||
}
|
||||
|
||||
let entry = actix_test::call_and_read_body(
|
||||
&app,
|
||||
actix_test::TestRequest::get()
|
||||
.uri("/api/logbook/export.cbr?contest=CQ-WW-SSB&callsign=SP0TRX&claimed_score=42")
|
||||
.to_request(),
|
||||
)
|
||||
.await;
|
||||
let text = String::from_utf8_lossy(&entry);
|
||||
assert!(text.starts_with("START-OF-LOG: 3.0"), "{text}");
|
||||
assert!(text.contains("CONTEST: CQ-WW-SSB"), "{text}");
|
||||
assert!(text.contains("CLAIMED-SCORE: 42"), "{text}");
|
||||
assert_eq!(
|
||||
text.lines().filter(|line| line.starts_with("QSO:")).count(),
|
||||
2,
|
||||
"the entry holds contacts from outside the contest: {text}"
|
||||
);
|
||||
assert!(!text.contains("SP3EF"), "{text}");
|
||||
|
||||
// And the statistics count the station once per band, with the
|
||||
// confirmation counted wherever it came from.
|
||||
let stats: serde_json::Value = actix_test::call_and_read_body_json(
|
||||
&app,
|
||||
actix_test::TestRequest::get()
|
||||
.uri("/api/logbook/statistics")
|
||||
.to_request(),
|
||||
)
|
||||
.await;
|
||||
assert_eq!(stats["contacts"], 3);
|
||||
assert_eq!(stats["confirmed"], 1);
|
||||
assert_eq!(stats["bands"][0]["band"], "20m");
|
||||
assert_eq!(stats["bands"][0]["stations"], 3);
|
||||
}
|
||||
|
||||
/// A QSL state that is not one of ADIF's letters is dropped rather than
|
||||
/// written, or the log grows states nothing else can read.
|
||||
#[actix_web::test]
|
||||
async fn a_qsl_state_outside_the_enumeration_is_not_written() {
|
||||
let dir = tempfile::tempdir().expect("tempdir");
|
||||
let logbook = std::sync::Arc::new(
|
||||
trx_logbook::Logbook::open(&dir.path().join("logbook.jsonl")).expect("open"),
|
||||
);
|
||||
let app = actix_test::init_service(
|
||||
App::new()
|
||||
.app_data(web::Data::new(logbook))
|
||||
.app_data(web::Data::new(auth_state_disabled()))
|
||||
.service(logbook::add_qso),
|
||||
)
|
||||
.await;
|
||||
let written: serde_json::Value = actix_test::call_and_read_body_json(
|
||||
&app,
|
||||
actix_test::TestRequest::post()
|
||||
.uri("/api/logbook")
|
||||
.set_json(serde_json::json!({
|
||||
"call": "SP1AA", "freq_hz": 14_074_000_u64, "mode": "FT8",
|
||||
"qsl_rcvd": "maybe", "lotw_qsl_rcvd": "y",
|
||||
}))
|
||||
.to_request(),
|
||||
)
|
||||
.await;
|
||||
assert!(written.get("qsl_rcvd").is_none(), "{written}");
|
||||
// ...but a lowercase letter that is in the enumeration is taken.
|
||||
assert_eq!(written["lotw_qsl_rcvd"], "Y");
|
||||
assert_eq!(written["confirmed"], true);
|
||||
}
|
||||
|
||||
/// A read-only session may read the log and may not write to it.
|
||||
#[actix_web::test]
|
||||
async fn a_read_only_session_cannot_write_to_the_log() {
|
||||
|
||||
@@ -4,18 +4,24 @@
|
||||
|
||||
//! HTTP authentication module for trx-frontend-http.
|
||||
//!
|
||||
//! Provides optional session-based authentication with two roles:
|
||||
//! - `Rx`: read-only access to status/events/audio
|
||||
//! - `Control`: full access including TX/PTT control
|
||||
//! Provides optional session-based authentication backed by a persistent,
|
||||
//! administrator-managed user database.
|
||||
|
||||
use actix_web::{
|
||||
cookie::Cookie,
|
||||
delete,
|
||||
dev::{forward_ready, Service, ServiceRequest, ServiceResponse, Transform},
|
||||
get, post, web, Error, HttpRequest, HttpResponse, Responder,
|
||||
get, patch, post, web, Error, HttpRequest, HttpResponse, Responder,
|
||||
};
|
||||
use argon2::{
|
||||
password_hash::{rand_core::OsRng, PasswordHash, PasswordHasher, PasswordVerifier, SaltString},
|
||||
Argon2,
|
||||
};
|
||||
use futures_util::future::LocalBoxFuture;
|
||||
use serde::{Deserialize, Serialize};
|
||||
use std::collections::HashMap;
|
||||
use std::fs;
|
||||
use std::path::{Path, PathBuf};
|
||||
use std::sync::{Arc, Mutex, RwLock};
|
||||
use std::time::{Duration, Instant, SystemTime};
|
||||
use tracing::warn;
|
||||
@@ -27,17 +33,17 @@ pub type SessionId = String;
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
|
||||
#[serde(rename_all = "lowercase")]
|
||||
pub enum AuthRole {
|
||||
/// Read-only access (rx passphrase)
|
||||
Rx,
|
||||
/// Full control access (control passphrase)
|
||||
Control,
|
||||
/// Read-only access.
|
||||
User,
|
||||
/// Full control and user-management access.
|
||||
Admin,
|
||||
}
|
||||
|
||||
impl AuthRole {
|
||||
pub fn as_str(&self) -> &'static str {
|
||||
match self {
|
||||
Self::Rx => "rx",
|
||||
Self::Control => "control",
|
||||
Self::User => "user",
|
||||
Self::Admin => "admin",
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -45,6 +51,7 @@ impl AuthRole {
|
||||
/// Session record stored in the session store
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct SessionRecord {
|
||||
pub username: String,
|
||||
pub role: AuthRole,
|
||||
pub issued_at: SystemTime,
|
||||
pub expires_at: SystemTime,
|
||||
@@ -75,12 +82,13 @@ impl SessionStore {
|
||||
}
|
||||
|
||||
/// Create a new session with the given role and TTL
|
||||
pub fn create(&self, role: AuthRole, ttl: Duration) -> SessionId {
|
||||
pub fn create(&self, username: String, role: AuthRole, ttl: Duration) -> SessionId {
|
||||
let now = SystemTime::now();
|
||||
let expires_at = now + ttl;
|
||||
let session_id = Self::generate_session_id();
|
||||
|
||||
let record = SessionRecord {
|
||||
username,
|
||||
role,
|
||||
issued_at: now,
|
||||
expires_at,
|
||||
@@ -121,6 +129,12 @@ impl SessionStore {
|
||||
store.remove(session_id);
|
||||
}
|
||||
|
||||
/// Invalidate every session belonging to a user.
|
||||
pub fn remove_user(&self, username: &str) {
|
||||
let mut store = self.sessions.write().unwrap_or_else(|e| e.into_inner());
|
||||
store.retain(|_, record| record.username != username);
|
||||
}
|
||||
|
||||
/// Remove all expired sessions
|
||||
pub fn cleanup_expired(&self) {
|
||||
let mut store = self.sessions.write().unwrap_or_else(|e| {
|
||||
@@ -167,9 +181,9 @@ impl SameSite {
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct AuthConfig {
|
||||
pub enabled: bool,
|
||||
pub rx_passphrase: Option<String>,
|
||||
pub control_passphrase: Option<String>,
|
||||
pub tx_access_control_enabled: bool,
|
||||
pub users_file: PathBuf,
|
||||
pub bootstrap_admin_username: Option<String>,
|
||||
pub bootstrap_admin_password: Option<String>,
|
||||
pub session_ttl: Duration,
|
||||
pub cookie_secure: bool,
|
||||
pub cookie_same_site: SameSite,
|
||||
@@ -179,39 +193,236 @@ impl AuthConfig {
|
||||
/// Create a new auth config with all fields
|
||||
pub fn new(
|
||||
enabled: bool,
|
||||
rx_passphrase: Option<String>,
|
||||
control_passphrase: Option<String>,
|
||||
tx_access_control_enabled: bool,
|
||||
users_file: PathBuf,
|
||||
bootstrap_admin_username: Option<String>,
|
||||
bootstrap_admin_password: Option<String>,
|
||||
session_ttl: Duration,
|
||||
cookie_secure: bool,
|
||||
cookie_same_site: SameSite,
|
||||
) -> Self {
|
||||
Self {
|
||||
enabled,
|
||||
rx_passphrase,
|
||||
control_passphrase,
|
||||
tx_access_control_enabled,
|
||||
users_file,
|
||||
bootstrap_admin_username,
|
||||
bootstrap_admin_password,
|
||||
session_ttl,
|
||||
cookie_secure,
|
||||
cookie_same_site,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Check passphrase and return the corresponding role
|
||||
pub fn check_passphrase(&self, passphrase: &str) -> Option<AuthRole> {
|
||||
// Use constant-time comparison to reduce timing attacks
|
||||
if let Some(ctrl_pass) = &self.control_passphrase {
|
||||
if constant_time_eq(passphrase, ctrl_pass) {
|
||||
return Some(AuthRole::Control);
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct UserRecord {
|
||||
pub username: String,
|
||||
pub password_hash: String,
|
||||
pub role: AuthRole,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize, Deserialize, Default)]
|
||||
struct UserDatabase {
|
||||
users: Vec<UserRecord>,
|
||||
}
|
||||
|
||||
/// Persistent user database. Passwords are Argon2id hashes; writes replace the
|
||||
/// database atomically so an interrupted update cannot truncate it.
|
||||
pub struct UserStore {
|
||||
path: PathBuf,
|
||||
users: RwLock<HashMap<String, UserRecord>>,
|
||||
}
|
||||
|
||||
impl UserStore {
|
||||
fn open(config: &AuthConfig) -> Result<Self, String> {
|
||||
if !config.enabled {
|
||||
return Ok(Self {
|
||||
path: config.users_file.clone(),
|
||||
users: RwLock::new(HashMap::new()),
|
||||
});
|
||||
}
|
||||
let records = if config.users_file.exists() {
|
||||
let bytes = fs::read(&config.users_file)
|
||||
.map_err(|e| format!("read {}: {e}", config.users_file.display()))?;
|
||||
let db: UserDatabase = serde_json::from_slice(&bytes)
|
||||
.map_err(|e| format!("parse {}: {e}", config.users_file.display()))?;
|
||||
db.users
|
||||
} else {
|
||||
let username = config.bootstrap_admin_username.as_deref().ok_or_else(|| {
|
||||
format!(
|
||||
"user database {} does not exist and no bootstrap administrator was configured",
|
||||
config.users_file.display()
|
||||
)
|
||||
})?;
|
||||
let password = config
|
||||
.bootstrap_admin_password
|
||||
.as_deref()
|
||||
.ok_or_else(|| "bootstrap administrator password is missing".to_string())?;
|
||||
vec![UserRecord {
|
||||
username: validate_username(username)?.to_string(),
|
||||
password_hash: hash_password(password)?,
|
||||
role: AuthRole::Admin,
|
||||
}]
|
||||
};
|
||||
let mut users = HashMap::new();
|
||||
for record in records {
|
||||
validate_username(&record.username)?;
|
||||
if users.insert(record.username.clone(), record).is_some() {
|
||||
return Err("user database contains duplicate usernames".to_string());
|
||||
}
|
||||
}
|
||||
if let Some(rx_pass) = &self.rx_passphrase {
|
||||
if constant_time_eq(passphrase, rx_pass) {
|
||||
return Some(AuthRole::Rx);
|
||||
}
|
||||
if !users.values().any(|u| u.role == AuthRole::Admin) {
|
||||
return Err("user database must contain at least one administrator".to_string());
|
||||
}
|
||||
None
|
||||
let store = Self {
|
||||
path: config.users_file.clone(),
|
||||
users: RwLock::new(users),
|
||||
};
|
||||
if !store.path.exists() {
|
||||
store.persist()?;
|
||||
}
|
||||
Ok(store)
|
||||
}
|
||||
|
||||
fn authenticate(&self, username: &str, password: &str) -> Option<AuthRole> {
|
||||
let users = self.users.read().unwrap_or_else(|e| e.into_inner());
|
||||
let record = users.get(username)?;
|
||||
let parsed = PasswordHash::new(&record.password_hash).ok()?;
|
||||
Argon2::default()
|
||||
.verify_password(password.as_bytes(), &parsed)
|
||||
.ok()?;
|
||||
Some(record.role)
|
||||
}
|
||||
|
||||
fn list(&self) -> Vec<ManagedUser> {
|
||||
let users = self.users.read().unwrap_or_else(|e| e.into_inner());
|
||||
let mut result: Vec<_> = users
|
||||
.values()
|
||||
.map(|u| ManagedUser {
|
||||
username: u.username.clone(),
|
||||
role: u.role,
|
||||
})
|
||||
.collect();
|
||||
result.sort_by(|a, b| a.username.cmp(&b.username));
|
||||
result
|
||||
}
|
||||
|
||||
fn add(&self, username: &str, password: &str, role: AuthRole) -> Result<(), String> {
|
||||
let username = validate_username(username)?.to_string();
|
||||
validate_password(password)?;
|
||||
let record = UserRecord {
|
||||
username: username.clone(),
|
||||
password_hash: hash_password(password)?,
|
||||
role,
|
||||
};
|
||||
let mut users = self.users.write().unwrap_or_else(|e| e.into_inner());
|
||||
if users.contains_key(&username) {
|
||||
return Err("user already exists".to_string());
|
||||
}
|
||||
users.insert(username.clone(), record);
|
||||
if let Err(error) = persist_users(&self.path, &users) {
|
||||
users.remove(&username);
|
||||
return Err(error);
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn update(
|
||||
&self,
|
||||
username: &str,
|
||||
password: Option<&str>,
|
||||
role: Option<AuthRole>,
|
||||
) -> Result<(), String> {
|
||||
if let Some(value) = password {
|
||||
validate_password(value)?;
|
||||
}
|
||||
let new_hash = password.map(hash_password).transpose()?;
|
||||
let mut users = self.users.write().unwrap_or_else(|e| e.into_inner());
|
||||
let old = users
|
||||
.get(username)
|
||||
.cloned()
|
||||
.ok_or_else(|| "user not found".to_string())?;
|
||||
if old.role == AuthRole::Admin
|
||||
&& role == Some(AuthRole::User)
|
||||
&& users.values().filter(|u| u.role == AuthRole::Admin).count() == 1
|
||||
{
|
||||
return Err("cannot demote the last administrator".to_string());
|
||||
}
|
||||
let record = users.get_mut(username).expect("checked above");
|
||||
if let Some(hash) = new_hash {
|
||||
record.password_hash = hash;
|
||||
}
|
||||
if let Some(value) = role {
|
||||
record.role = value;
|
||||
}
|
||||
if let Err(error) = persist_users(&self.path, &users) {
|
||||
users.insert(username.to_string(), old);
|
||||
return Err(error);
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn remove(&self, username: &str) -> Result<(), String> {
|
||||
let mut users = self.users.write().unwrap_or_else(|e| e.into_inner());
|
||||
let old = users
|
||||
.get(username)
|
||||
.cloned()
|
||||
.ok_or_else(|| "user not found".to_string())?;
|
||||
if old.role == AuthRole::Admin
|
||||
&& users.values().filter(|u| u.role == AuthRole::Admin).count() == 1
|
||||
{
|
||||
return Err("cannot remove the last administrator".to_string());
|
||||
}
|
||||
users.remove(username);
|
||||
if let Err(error) = persist_users(&self.path, &users) {
|
||||
users.insert(username.to_string(), old);
|
||||
return Err(error);
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn persist(&self) -> Result<(), String> {
|
||||
let users = self.users.read().unwrap_or_else(|e| e.into_inner());
|
||||
persist_users(&self.path, &users)
|
||||
}
|
||||
}
|
||||
|
||||
fn persist_users(path: &Path, users: &HashMap<String, UserRecord>) -> Result<(), String> {
|
||||
if let Some(parent) = path.parent().filter(|p| !p.as_os_str().is_empty()) {
|
||||
fs::create_dir_all(parent).map_err(|e| format!("create {}: {e}", parent.display()))?;
|
||||
}
|
||||
let mut records: Vec<_> = users.values().cloned().collect();
|
||||
records.sort_by(|a, b| a.username.cmp(&b.username));
|
||||
let bytes =
|
||||
serde_json::to_vec_pretty(&UserDatabase { users: records }).map_err(|e| e.to_string())?;
|
||||
let temporary = path.with_extension("tmp");
|
||||
fs::write(&temporary, bytes).map_err(|e| format!("write {}: {e}", temporary.display()))?;
|
||||
fs::rename(&temporary, path).map_err(|e| format!("replace {}: {e}", path.display()))
|
||||
}
|
||||
|
||||
fn hash_password(password: &str) -> Result<String, String> {
|
||||
validate_password(password)?;
|
||||
Argon2::default()
|
||||
.hash_password(password.as_bytes(), &SaltString::generate(&mut OsRng))
|
||||
.map(|hash| hash.to_string())
|
||||
.map_err(|e| format!("password hashing failed: {e}"))
|
||||
}
|
||||
|
||||
fn validate_username(username: &str) -> Result<&str, String> {
|
||||
if username.is_empty()
|
||||
|| username.len() > 64
|
||||
|| !username
|
||||
.chars()
|
||||
.all(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | '.'))
|
||||
{
|
||||
return Err("username must be 1-64 ASCII letters, digits, '.', '-' or '_'".to_string());
|
||||
}
|
||||
Ok(username)
|
||||
}
|
||||
|
||||
fn validate_password(password: &str) -> Result<(), String> {
|
||||
if password.len() < 8 {
|
||||
return Err("password must contain at least 8 characters".to_string());
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Simple per-IP rate limiter for login attempts.
|
||||
@@ -283,39 +494,27 @@ impl Default for LoginRateLimiter {
|
||||
pub struct AuthState {
|
||||
pub config: AuthConfig,
|
||||
pub store: SessionStore,
|
||||
pub users: UserStore,
|
||||
pub rate_limiter: LoginRateLimiter,
|
||||
}
|
||||
|
||||
impl AuthState {
|
||||
pub fn new(config: AuthConfig) -> Self {
|
||||
Self {
|
||||
pub fn new(config: AuthConfig) -> Result<Self, String> {
|
||||
let users = UserStore::open(&config)?;
|
||||
Ok(Self {
|
||||
config,
|
||||
store: SessionStore::new(),
|
||||
users,
|
||||
rate_limiter: LoginRateLimiter::default(),
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
/// Constant-time string comparison to mitigate timing attacks
|
||||
fn constant_time_eq(a: &str, b: &str) -> bool {
|
||||
let a_bytes = a.as_bytes();
|
||||
let b_bytes = b.as_bytes();
|
||||
|
||||
if a_bytes.len() != b_bytes.len() {
|
||||
return false;
|
||||
}
|
||||
|
||||
let mut result = 0u8;
|
||||
for (x, y) in a_bytes.iter().zip(b_bytes.iter()) {
|
||||
result |= x ^ y;
|
||||
}
|
||||
result == 0
|
||||
}
|
||||
|
||||
/// Login request body
|
||||
#[derive(Debug, Deserialize)]
|
||||
pub struct LoginRequest {
|
||||
pub passphrase: String,
|
||||
pub username: String,
|
||||
pub password: String,
|
||||
}
|
||||
|
||||
/// Session status response
|
||||
@@ -323,6 +522,8 @@ pub struct LoginRequest {
|
||||
pub struct SessionStatus {
|
||||
pub authenticated: bool,
|
||||
pub role: Option<String>,
|
||||
pub username: Option<String>,
|
||||
pub auth_disabled: bool,
|
||||
}
|
||||
|
||||
/// Login response
|
||||
@@ -330,6 +531,26 @@ pub struct SessionStatus {
|
||||
pub struct LoginResponse {
|
||||
pub authenticated: bool,
|
||||
pub role: String,
|
||||
pub username: String,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct ManagedUser {
|
||||
pub username: String,
|
||||
pub role: AuthRole,
|
||||
}
|
||||
|
||||
#[derive(Debug, Deserialize)]
|
||||
pub struct CreateUserRequest {
|
||||
pub username: String,
|
||||
pub password: String,
|
||||
pub role: AuthRole,
|
||||
}
|
||||
|
||||
#[derive(Debug, Deserialize)]
|
||||
pub struct UpdateUserRequest {
|
||||
pub password: Option<String>,
|
||||
pub role: Option<AuthRole>,
|
||||
}
|
||||
|
||||
/// Extract session from cookie
|
||||
@@ -345,6 +566,20 @@ pub fn get_session_role(req: &HttpRequest, auth_state: &AuthState) -> Option<Aut
|
||||
Some(record.role)
|
||||
}
|
||||
|
||||
fn require_admin(req: &HttpRequest, auth_state: &AuthState) -> Result<SessionRecord, HttpResponse> {
|
||||
let session = extract_session_id(req)
|
||||
.and_then(|id| auth_state.store.get(&id))
|
||||
.ok_or_else(|| {
|
||||
HttpResponse::Unauthorized()
|
||||
.json(serde_json::json!({"error":"authentication required"}))
|
||||
})?;
|
||||
if session.role != AuthRole::Admin {
|
||||
return Err(HttpResponse::Forbidden()
|
||||
.json(serde_json::json!({"error":"administrator role required"})));
|
||||
}
|
||||
Ok(session)
|
||||
}
|
||||
|
||||
// ============================================================================
|
||||
// Endpoints
|
||||
// ============================================================================
|
||||
@@ -371,8 +606,10 @@ pub async fn login(
|
||||
})));
|
||||
}
|
||||
|
||||
// Check passphrase
|
||||
let role = match auth_state.config.check_passphrase(&body.passphrase) {
|
||||
let role = match auth_state
|
||||
.users
|
||||
.authenticate(&body.username, &body.password)
|
||||
{
|
||||
Some(r) => r,
|
||||
None => {
|
||||
return Ok(HttpResponse::Unauthorized().json(serde_json::json!({
|
||||
@@ -385,7 +622,10 @@ pub async fn login(
|
||||
auth_state.rate_limiter.reset(&peer_ip);
|
||||
|
||||
// Create session
|
||||
let session_id = auth_state.store.create(role, auth_state.config.session_ttl);
|
||||
let session_id =
|
||||
auth_state
|
||||
.store
|
||||
.create(body.username.clone(), role, auth_state.config.session_ttl);
|
||||
|
||||
let mut cookie = Cookie::new("trx_http_sid", session_id);
|
||||
cookie.set_path("/");
|
||||
@@ -406,6 +646,7 @@ pub async fn login(
|
||||
Ok(HttpResponse::Ok().cookie(cookie).json(LoginResponse {
|
||||
authenticated: true,
|
||||
role: role.as_str().to_string(),
|
||||
username: body.username.clone(),
|
||||
}))
|
||||
}
|
||||
|
||||
@@ -445,7 +686,9 @@ pub async fn session_status(
|
||||
if !auth_state.config.enabled {
|
||||
return Ok(HttpResponse::Ok().json(SessionStatus {
|
||||
authenticated: true,
|
||||
role: Some("control".to_string()),
|
||||
role: Some("admin".to_string()),
|
||||
username: None,
|
||||
auth_disabled: true,
|
||||
}));
|
||||
}
|
||||
|
||||
@@ -455,15 +698,8 @@ pub async fn session_status(
|
||||
return Ok(HttpResponse::Ok().json(SessionStatus {
|
||||
authenticated: true,
|
||||
role: Some(session_record.role.as_str().to_string()),
|
||||
}));
|
||||
}
|
||||
|
||||
// No session - check if rx access is unrestricted
|
||||
if auth_state.config.rx_passphrase.is_none() {
|
||||
// No rx passphrase required - grant rx role to unauthenticated users
|
||||
return Ok(HttpResponse::Ok().json(SessionStatus {
|
||||
authenticated: false,
|
||||
role: Some("rx".to_string()),
|
||||
username: Some(session_record.username),
|
||||
auth_disabled: false,
|
||||
}));
|
||||
}
|
||||
|
||||
@@ -471,9 +707,93 @@ pub async fn session_status(
|
||||
Ok(HttpResponse::Ok().json(SessionStatus {
|
||||
authenticated: false,
|
||||
role: None,
|
||||
username: None,
|
||||
auth_disabled: false,
|
||||
}))
|
||||
}
|
||||
|
||||
/// GET /auth/users
|
||||
#[get("/auth/users")]
|
||||
pub async fn list_users(req: HttpRequest, auth_state: web::Data<AuthState>) -> impl Responder {
|
||||
if let Err(response) = require_admin(&req, &auth_state) {
|
||||
return response;
|
||||
}
|
||||
HttpResponse::Ok().json(auth_state.users.list())
|
||||
}
|
||||
|
||||
/// POST /auth/users
|
||||
#[post("/auth/users")]
|
||||
pub async fn create_user(
|
||||
req: HttpRequest,
|
||||
body: web::Json<CreateUserRequest>,
|
||||
auth_state: web::Data<AuthState>,
|
||||
) -> impl Responder {
|
||||
if let Err(response) = require_admin(&req, &auth_state) {
|
||||
return response;
|
||||
}
|
||||
match auth_state
|
||||
.users
|
||||
.add(&body.username, &body.password, body.role)
|
||||
{
|
||||
Ok(()) => HttpResponse::Created().json(ManagedUser {
|
||||
username: body.username.clone(),
|
||||
role: body.role,
|
||||
}),
|
||||
Err(error) => HttpResponse::BadRequest().json(serde_json::json!({"error": error})),
|
||||
}
|
||||
}
|
||||
|
||||
/// PATCH /auth/users/{username}
|
||||
#[patch("/auth/users/{username}")]
|
||||
pub async fn update_user(
|
||||
req: HttpRequest,
|
||||
username: web::Path<String>,
|
||||
body: web::Json<UpdateUserRequest>,
|
||||
auth_state: web::Data<AuthState>,
|
||||
) -> impl Responder {
|
||||
if let Err(response) = require_admin(&req, &auth_state) {
|
||||
return response;
|
||||
}
|
||||
if body.password.is_none() && body.role.is_none() {
|
||||
return HttpResponse::BadRequest()
|
||||
.json(serde_json::json!({"error":"password or role is required"}));
|
||||
}
|
||||
match auth_state
|
||||
.users
|
||||
.update(&username, body.password.as_deref(), body.role)
|
||||
{
|
||||
Ok(()) => {
|
||||
auth_state.store.remove_user(&username);
|
||||
HttpResponse::Ok().json(serde_json::json!({"updated": true}))
|
||||
}
|
||||
Err(error) => HttpResponse::BadRequest().json(serde_json::json!({"error": error})),
|
||||
}
|
||||
}
|
||||
|
||||
/// DELETE /auth/users/{username}
|
||||
#[delete("/auth/users/{username}")]
|
||||
pub async fn delete_user(
|
||||
req: HttpRequest,
|
||||
username: web::Path<String>,
|
||||
auth_state: web::Data<AuthState>,
|
||||
) -> impl Responder {
|
||||
let admin = match require_admin(&req, &auth_state) {
|
||||
Ok(value) => value,
|
||||
Err(response) => return response,
|
||||
};
|
||||
if admin.username == *username {
|
||||
return HttpResponse::BadRequest()
|
||||
.json(serde_json::json!({"error":"administrators cannot remove their own account"}));
|
||||
}
|
||||
match auth_state.users.remove(&username) {
|
||||
Ok(()) => {
|
||||
auth_state.store.remove_user(&username);
|
||||
HttpResponse::Ok().json(serde_json::json!({"deleted": true}))
|
||||
}
|
||||
Err(error) => HttpResponse::BadRequest().json(serde_json::json!({"error": error})),
|
||||
}
|
||||
}
|
||||
|
||||
// ============================================================================
|
||||
// Middleware
|
||||
// ============================================================================
|
||||
@@ -483,9 +803,9 @@ pub async fn session_status(
|
||||
enum RouteAccess {
|
||||
/// Publicly accessible (no auth required)
|
||||
Public,
|
||||
/// Read-only (rx or control role required)
|
||||
/// Read-only (user or admin role required)
|
||||
Read,
|
||||
/// Control only (control role required)
|
||||
/// Control only (admin role required)
|
||||
Control,
|
||||
}
|
||||
|
||||
@@ -499,7 +819,9 @@ impl RouteAccess {
|
||||
|| path == "/digital-modes"
|
||||
|| path == "/settings"
|
||||
|| path == "/about"
|
||||
|| path.starts_with("/auth/")
|
||||
|| path == "/auth/login"
|
||||
|| path == "/auth/logout"
|
||||
|| path == "/auth/session"
|
||||
{
|
||||
return Self::Public;
|
||||
}
|
||||
@@ -561,7 +883,7 @@ impl RouteAccess {
|
||||
match self {
|
||||
Self::Public => true,
|
||||
Self::Read => role.is_some(),
|
||||
Self::Control => matches!(role, Some(AuthRole::Control)),
|
||||
Self::Control => matches!(role, Some(AuthRole::Admin)),
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -631,19 +953,6 @@ where
|
||||
// Auth enabled - check role
|
||||
let role = get_session_role(req.request(), &auth_state);
|
||||
|
||||
// If rx_passphrase is not set, allow unauthenticated read access
|
||||
let allow_unrestricted_read = auth_state.config.rx_passphrase.is_none();
|
||||
let is_read_route = access == RouteAccess::Read;
|
||||
|
||||
if is_read_route && allow_unrestricted_read {
|
||||
// No rx authentication required - allow read access without role
|
||||
let fut = self.service.call(req);
|
||||
return Box::pin(async move {
|
||||
let res = fut.await?;
|
||||
Ok(res)
|
||||
});
|
||||
}
|
||||
|
||||
if !access.allows(role) {
|
||||
// Access denied
|
||||
return Box::pin(async move {
|
||||
@@ -652,12 +961,6 @@ where
|
||||
Err(actix_web::error::ErrorForbidden(
|
||||
"Insufficient permissions".to_string(),
|
||||
))
|
||||
} else if allow_unrestricted_read {
|
||||
// No session but rx access is unrestricted - 403 Forbidden
|
||||
// (user has implicit rx role from unrestricted access)
|
||||
Err(actix_web::error::ErrorForbidden(
|
||||
"Insufficient permissions".to_string(),
|
||||
))
|
||||
} else {
|
||||
// No session and no unrestricted access - 401 Unauthorized
|
||||
Err(actix_web::error::ErrorUnauthorized(
|
||||
@@ -676,18 +979,10 @@ where
|
||||
}
|
||||
}
|
||||
|
||||
/// Check if a path is a TX/PTT endpoint (used for TX access control).
|
||||
pub fn is_tx_endpoint(path: &str) -> bool {
|
||||
path.contains("ptt")
|
||||
|| path.contains("set_ptt")
|
||||
|| path.contains("toggle_ptt")
|
||||
|| path.contains("set_tx")
|
||||
|| path.contains("toggle_tx")
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use actix_web::{test as aw_test, App};
|
||||
|
||||
#[test]
|
||||
fn test_route_access_public_paths() {
|
||||
@@ -701,6 +996,7 @@ mod tests {
|
||||
assert_eq!(RouteAccess::from_path("/about"), RouteAccess::Public);
|
||||
assert_eq!(RouteAccess::from_path("/auth/login"), RouteAccess::Public);
|
||||
assert_eq!(RouteAccess::from_path("/auth/logout"), RouteAccess::Public);
|
||||
assert_eq!(RouteAccess::from_path("/auth/users"), RouteAccess::Control);
|
||||
assert_eq!(RouteAccess::from_path("/style.css"), RouteAccess::Public);
|
||||
assert_eq!(RouteAccess::from_path("/app.js"), RouteAccess::Public);
|
||||
// Static reference data, served to every role: ".json" is not in the
|
||||
@@ -735,28 +1031,29 @@ mod tests {
|
||||
#[test]
|
||||
fn test_route_access_allows() {
|
||||
assert!(RouteAccess::Public.allows(None));
|
||||
assert!(RouteAccess::Public.allows(Some(AuthRole::Rx)));
|
||||
assert!(RouteAccess::Public.allows(Some(AuthRole::Control)));
|
||||
assert!(RouteAccess::Public.allows(Some(AuthRole::User)));
|
||||
assert!(RouteAccess::Public.allows(Some(AuthRole::Admin)));
|
||||
|
||||
assert!(!RouteAccess::Read.allows(None));
|
||||
assert!(RouteAccess::Read.allows(Some(AuthRole::Rx)));
|
||||
assert!(RouteAccess::Read.allows(Some(AuthRole::Control)));
|
||||
assert!(RouteAccess::Read.allows(Some(AuthRole::User)));
|
||||
assert!(RouteAccess::Read.allows(Some(AuthRole::Admin)));
|
||||
|
||||
assert!(!RouteAccess::Control.allows(None));
|
||||
assert!(!RouteAccess::Control.allows(Some(AuthRole::Rx)));
|
||||
assert!(RouteAccess::Control.allows(Some(AuthRole::Control)));
|
||||
assert!(!RouteAccess::Control.allows(Some(AuthRole::User)));
|
||||
assert!(RouteAccess::Control.allows(Some(AuthRole::Admin)));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_session_store_create_and_get() {
|
||||
let store = SessionStore::new();
|
||||
let ttl = Duration::from_secs(3600);
|
||||
let session_id = store.create(AuthRole::Rx, ttl);
|
||||
let session_id = store.create("alice".to_string(), AuthRole::User, ttl);
|
||||
|
||||
let record = store.get(&session_id);
|
||||
assert!(record.is_some());
|
||||
let record = record.unwrap();
|
||||
assert_eq!(record.role, AuthRole::Rx);
|
||||
assert_eq!(record.username, "alice");
|
||||
assert_eq!(record.role, AuthRole::User);
|
||||
assert!(!record.is_expired());
|
||||
}
|
||||
|
||||
@@ -764,81 +1061,151 @@ mod tests {
|
||||
fn test_session_store_remove() {
|
||||
let store = SessionStore::new();
|
||||
let ttl = Duration::from_secs(3600);
|
||||
let session_id = store.create(AuthRole::Rx, ttl);
|
||||
let session_id = store.create("alice".to_string(), AuthRole::User, ttl);
|
||||
|
||||
store.remove(&session_id);
|
||||
assert!(store.get(&session_id).is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_constant_time_eq() {
|
||||
assert!(constant_time_eq("test", "test"));
|
||||
assert!(!constant_time_eq("test", "fail"));
|
||||
assert!(!constant_time_eq("test", "test2"));
|
||||
assert!(!constant_time_eq("", "test"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_auth_config_check_passphrase_control() {
|
||||
let config = AuthConfig {
|
||||
enabled: true,
|
||||
rx_passphrase: None,
|
||||
control_passphrase: Some("ctrl-pass".to_string()),
|
||||
tx_access_control_enabled: true,
|
||||
session_ttl: Duration::from_secs(3600),
|
||||
cookie_secure: false,
|
||||
cookie_same_site: SameSite::Lax,
|
||||
};
|
||||
|
||||
assert_eq!(
|
||||
config.check_passphrase("ctrl-pass"),
|
||||
Some(AuthRole::Control)
|
||||
fn user_store_bootstraps_and_manages_users() {
|
||||
let directory = tempfile::tempdir().unwrap();
|
||||
let config = AuthConfig::new(
|
||||
true,
|
||||
directory.path().join("users.json"),
|
||||
Some("admin".to_string()),
|
||||
Some("password123".to_string()),
|
||||
Duration::from_secs(3600),
|
||||
false,
|
||||
SameSite::Lax,
|
||||
);
|
||||
assert_eq!(config.check_passphrase("wrong"), None);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_auth_config_check_passphrase_rx() {
|
||||
let config = AuthConfig {
|
||||
enabled: true,
|
||||
rx_passphrase: Some("rx-pass".to_string()),
|
||||
control_passphrase: None,
|
||||
tx_access_control_enabled: true,
|
||||
session_ttl: Duration::from_secs(3600),
|
||||
cookie_secure: false,
|
||||
cookie_same_site: SameSite::Lax,
|
||||
};
|
||||
|
||||
assert_eq!(config.check_passphrase("rx-pass"), Some(AuthRole::Rx));
|
||||
assert_eq!(config.check_passphrase("wrong"), None);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_auth_config_check_passphrase_both() {
|
||||
let config = AuthConfig {
|
||||
enabled: true,
|
||||
rx_passphrase: Some("rx-pass".to_string()),
|
||||
control_passphrase: Some("ctrl-pass".to_string()),
|
||||
tx_access_control_enabled: true,
|
||||
session_ttl: Duration::from_secs(3600),
|
||||
cookie_secure: false,
|
||||
cookie_same_site: SameSite::Lax,
|
||||
};
|
||||
|
||||
// Control is checked first
|
||||
let users = UserStore::open(&config).unwrap();
|
||||
assert_eq!(
|
||||
config.check_passphrase("ctrl-pass"),
|
||||
Some(AuthRole::Control)
|
||||
users.authenticate("admin", "password123"),
|
||||
Some(AuthRole::Admin)
|
||||
);
|
||||
assert_eq!(config.check_passphrase("rx-pass"), Some(AuthRole::Rx));
|
||||
assert_eq!(config.check_passphrase("wrong"), None);
|
||||
assert_eq!(users.authenticate("admin", "wrong"), None);
|
||||
users.add("alice", "password456", AuthRole::User).unwrap();
|
||||
assert_eq!(
|
||||
users.authenticate("alice", "password456"),
|
||||
Some(AuthRole::User)
|
||||
);
|
||||
users
|
||||
.update("alice", Some("password789"), Some(AuthRole::Admin))
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
users.authenticate("alice", "password789"),
|
||||
Some(AuthRole::Admin)
|
||||
);
|
||||
users.remove("admin").unwrap();
|
||||
assert_eq!(users.list().len(), 1);
|
||||
drop(users);
|
||||
|
||||
let mut reopen_config = config.clone();
|
||||
reopen_config.bootstrap_admin_username = None;
|
||||
reopen_config.bootstrap_admin_password = None;
|
||||
let reopened = UserStore::open(&reopen_config).unwrap();
|
||||
assert_eq!(
|
||||
reopened.authenticate("alice", "password789"),
|
||||
Some(AuthRole::Admin)
|
||||
);
|
||||
let database = fs::read_to_string(&reopen_config.users_file).unwrap();
|
||||
assert!(database.contains("$argon2"));
|
||||
assert!(!database.contains("password789"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_is_tx_endpoint() {
|
||||
assert!(is_tx_endpoint("/set_ptt"));
|
||||
assert!(is_tx_endpoint("/toggle_ptt"));
|
||||
assert!(is_tx_endpoint("/set_tx"));
|
||||
assert!(!is_tx_endpoint("/status"));
|
||||
fn user_store_protects_last_admin() {
|
||||
let directory = tempfile::tempdir().unwrap();
|
||||
let config = AuthConfig::new(
|
||||
true,
|
||||
directory.path().join("users.json"),
|
||||
Some("admin".to_string()),
|
||||
Some("password123".to_string()),
|
||||
Duration::from_secs(3600),
|
||||
false,
|
||||
SameSite::Lax,
|
||||
);
|
||||
let users = UserStore::open(&config).unwrap();
|
||||
assert!(users.remove("admin").is_err());
|
||||
assert!(users.update("admin", None, Some(AuthRole::User)).is_err());
|
||||
}
|
||||
|
||||
#[actix_web::test]
|
||||
async fn admin_endpoints_manage_multiple_users_and_reject_regular_users() {
|
||||
let directory = tempfile::tempdir().unwrap();
|
||||
let config = AuthConfig::new(
|
||||
true,
|
||||
directory.path().join("users.json"),
|
||||
Some("admin".to_string()),
|
||||
Some("password123".to_string()),
|
||||
Duration::from_secs(3600),
|
||||
false,
|
||||
SameSite::Lax,
|
||||
);
|
||||
let state = web::Data::new(AuthState::new(config).unwrap());
|
||||
let app = aw_test::init_service(
|
||||
App::new()
|
||||
.app_data(state)
|
||||
.service(login)
|
||||
.service(list_users)
|
||||
.service(create_user)
|
||||
.service(update_user)
|
||||
.service(delete_user),
|
||||
)
|
||||
.await;
|
||||
|
||||
let request = aw_test::TestRequest::post()
|
||||
.uri("/auth/login")
|
||||
.set_json(serde_json::json!({"username":"admin","password":"password123"}))
|
||||
.to_request();
|
||||
let response = aw_test::call_service(&app, request).await;
|
||||
assert_eq!(response.status(), actix_web::http::StatusCode::OK);
|
||||
let admin_cookie = response.response().cookies().next().unwrap().to_string();
|
||||
|
||||
let request = aw_test::TestRequest::post()
|
||||
.uri("/auth/users")
|
||||
.insert_header((actix_web::http::header::COOKIE, admin_cookie.clone()))
|
||||
.set_json(
|
||||
serde_json::json!({"username":"alice","password":"password456","role":"user"}),
|
||||
)
|
||||
.to_request();
|
||||
assert_eq!(
|
||||
aw_test::call_service(&app, request).await.status(),
|
||||
actix_web::http::StatusCode::CREATED
|
||||
);
|
||||
|
||||
let request = aw_test::TestRequest::post()
|
||||
.uri("/auth/login")
|
||||
.set_json(serde_json::json!({"username":"alice","password":"password456"}))
|
||||
.to_request();
|
||||
let response = aw_test::call_service(&app, request).await;
|
||||
let user_cookie = response.response().cookies().next().unwrap().to_string();
|
||||
let request = aw_test::TestRequest::get()
|
||||
.uri("/auth/users")
|
||||
.insert_header((actix_web::http::header::COOKIE, user_cookie))
|
||||
.to_request();
|
||||
assert_eq!(
|
||||
aw_test::call_service(&app, request).await.status(),
|
||||
actix_web::http::StatusCode::FORBIDDEN
|
||||
);
|
||||
|
||||
let request = aw_test::TestRequest::patch()
|
||||
.uri("/auth/users/alice")
|
||||
.insert_header((actix_web::http::header::COOKIE, admin_cookie.clone()))
|
||||
.set_json(serde_json::json!({"password":"new-password","role":"admin"}))
|
||||
.to_request();
|
||||
assert_eq!(
|
||||
aw_test::call_service(&app, request).await.status(),
|
||||
actix_web::http::StatusCode::OK
|
||||
);
|
||||
let request = aw_test::TestRequest::delete()
|
||||
.uri("/auth/users/alice")
|
||||
.insert_header((actix_web::http::header::COOKIE, admin_cookie))
|
||||
.to_request();
|
||||
assert_eq!(
|
||||
aw_test::call_service(&app, request).await.status(),
|
||||
actix_web::http::StatusCode::OK
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -254,9 +254,9 @@ fn build_server(
|
||||
};
|
||||
let auth_config = AuthConfig::new(
|
||||
context.http_auth.enabled,
|
||||
context.http_auth.rx_passphrase.clone(),
|
||||
context.http_auth.control_passphrase.clone(),
|
||||
context.http_auth.tx_access_control_enabled,
|
||||
context.http_auth.users_file.clone().into(),
|
||||
context.http_auth.bootstrap_admin_username.clone(),
|
||||
context.http_auth.bootstrap_admin_password.clone(),
|
||||
Duration::from_secs(context.http_auth.session_ttl_secs),
|
||||
context.http_auth.cookie_secure,
|
||||
same_site,
|
||||
@@ -273,7 +273,9 @@ fn build_server(
|
||||
}
|
||||
|
||||
let context_data = web::Data::new(context);
|
||||
let auth_state = web::Data::new(AuthState::new(auth_config.clone()));
|
||||
let auth_state = web::Data::new(
|
||||
AuthState::new(auth_config.clone()).map_err(actix_web::error::ErrorInternalServerError)?,
|
||||
);
|
||||
|
||||
// Spawn session cleanup task if auth is enabled
|
||||
if auth_config.enabled {
|
||||
|
||||
@@ -47,8 +47,28 @@ const MODELLED: &[&str] = &[
|
||||
"OPERATOR",
|
||||
"MY_GRIDSQUARE",
|
||||
"MY_RIG",
|
||||
"CONTEST_ID",
|
||||
"STX",
|
||||
"STX_STRING",
|
||||
"SRX",
|
||||
"SRX_STRING",
|
||||
"CQZ",
|
||||
"ITUZ",
|
||||
"QSL_SENT",
|
||||
"QSL_RCVD",
|
||||
"LOTW_QSL_SENT",
|
||||
"LOTW_QSL_RCVD",
|
||||
"EQSL_QSL_SENT",
|
||||
"EQSL_QSL_RCVD",
|
||||
];
|
||||
|
||||
/// ADIF's QSL states are single letters; anything else in that field is a
|
||||
/// misunderstanding on the writer's part and is not carried into ours.
|
||||
fn qsl_state(value: Option<&str>) -> Option<String> {
|
||||
let state = value?.trim().to_uppercase();
|
||||
matches!(state.as_str(), "Y" | "N" | "R" | "I" | "Q" | "V").then_some(state)
|
||||
}
|
||||
|
||||
/// What a file gave up, and what it could not.
|
||||
#[derive(Debug, Default, Clone)]
|
||||
pub struct ParseReport {
|
||||
@@ -215,6 +235,19 @@ fn qso_from_fields(fields: &[Field]) -> Result<Qso, String> {
|
||||
my_gridsquare: find(fields, "MY_GRIDSQUARE").map(|g| g.to_uppercase()),
|
||||
my_rig: find(fields, "MY_RIG").map(str::to_string),
|
||||
rig_id: None,
|
||||
contest_id: find(fields, "CONTEST_ID").map(|c| c.to_uppercase()),
|
||||
stx: find(fields, "STX").and_then(|value| value.parse().ok()),
|
||||
stx_string: find(fields, "STX_STRING").map(str::to_string),
|
||||
srx: find(fields, "SRX").and_then(|value| value.parse().ok()),
|
||||
srx_string: find(fields, "SRX_STRING").map(str::to_string),
|
||||
cqz: find(fields, "CQZ").and_then(|value| value.parse().ok()),
|
||||
ituz: find(fields, "ITUZ").and_then(|value| value.parse().ok()),
|
||||
qsl_sent: qsl_state(find(fields, "QSL_SENT")),
|
||||
qsl_rcvd: qsl_state(find(fields, "QSL_RCVD")),
|
||||
lotw_qsl_sent: qsl_state(find(fields, "LOTW_QSL_SENT")),
|
||||
lotw_qsl_rcvd: qsl_state(find(fields, "LOTW_QSL_RCVD")),
|
||||
eqsl_qsl_sent: qsl_state(find(fields, "EQSL_QSL_SENT")),
|
||||
eqsl_qsl_rcvd: qsl_state(find(fields, "EQSL_QSL_RCVD")),
|
||||
extra,
|
||||
})
|
||||
}
|
||||
@@ -273,11 +306,30 @@ pub fn write_adi(qsos: &[Qso], program_version: &str) -> String {
|
||||
("OPERATOR", &qso.operator),
|
||||
("MY_GRIDSQUARE", &qso.my_gridsquare),
|
||||
("MY_RIG", &qso.my_rig),
|
||||
("CONTEST_ID", &qso.contest_id),
|
||||
("STX_STRING", &qso.stx_string),
|
||||
("SRX_STRING", &qso.srx_string),
|
||||
("QSL_SENT", &qso.qsl_sent),
|
||||
("QSL_RCVD", &qso.qsl_rcvd),
|
||||
("LOTW_QSL_SENT", &qso.lotw_qsl_sent),
|
||||
("LOTW_QSL_RCVD", &qso.lotw_qsl_rcvd),
|
||||
("EQSL_QSL_SENT", &qso.eqsl_qsl_sent),
|
||||
("EQSL_QSL_RCVD", &qso.eqsl_qsl_rcvd),
|
||||
] {
|
||||
if let Some(value) = value {
|
||||
write_field(&mut out, name, value);
|
||||
}
|
||||
}
|
||||
for (name, value) in [
|
||||
("STX", qso.stx),
|
||||
("SRX", qso.srx),
|
||||
("CQZ", qso.cqz.map(u32::from)),
|
||||
("ITUZ", qso.ituz.map(u32::from)),
|
||||
] {
|
||||
if let Some(value) = value {
|
||||
write_field(&mut out, name, &value.to_string());
|
||||
}
|
||||
}
|
||||
if let Some(power) = qso.tx_pwr_w {
|
||||
write_field(&mut out, "TX_PWR", &format!("{power}"));
|
||||
}
|
||||
|
||||
@@ -0,0 +1,304 @@
|
||||
// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
|
||||
//
|
||||
// SPDX-License-Identifier: GPL-2.0-or-later
|
||||
|
||||
//! Cabrillo 3.0, the format contest logs are submitted in.
|
||||
//!
|
||||
//! ADIF cannot do this job: sponsors take Cabrillo and reject everything else.
|
||||
//! It is export-only and narrower on purpose — a header naming the entrant and
|
||||
//! the category, then one fixed-shape `QSO:` line per contact carrying the
|
||||
//! frequency, the mode, the time, and both stations' calls, reports and
|
||||
//! exchanges. Everything a log holds beyond that is left behind, which is why
|
||||
//! this complements ADIF rather than replacing it.
|
||||
|
||||
use serde::Deserialize;
|
||||
|
||||
use crate::qso::Qso;
|
||||
|
||||
/// The header of a contest entry.
|
||||
///
|
||||
/// Sponsors want the entrant's own answers here — how many operators, how much
|
||||
/// power, which bands — and no log can work them out for itself, so they come
|
||||
/// from the operator with sane defaults behind them.
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
pub struct CabrilloHeader {
|
||||
/// The contest's Cabrillo name, e.g. `CQ-WW-SSB`.
|
||||
#[serde(default)]
|
||||
pub contest: Option<String>,
|
||||
/// The callsign the entry is submitted under.
|
||||
#[serde(default)]
|
||||
pub callsign: Option<String>,
|
||||
#[serde(default)]
|
||||
pub category_operator: Option<String>,
|
||||
#[serde(default)]
|
||||
pub category_power: Option<String>,
|
||||
#[serde(default)]
|
||||
pub category_band: Option<String>,
|
||||
#[serde(default)]
|
||||
pub category_mode: Option<String>,
|
||||
#[serde(default)]
|
||||
pub claimed_score: Option<u64>,
|
||||
#[serde(default)]
|
||||
pub operators: Option<String>,
|
||||
#[serde(default)]
|
||||
pub name: Option<String>,
|
||||
#[serde(default)]
|
||||
pub email: Option<String>,
|
||||
#[serde(default)]
|
||||
pub soapbox: Option<String>,
|
||||
}
|
||||
|
||||
impl Default for CabrilloHeader {
|
||||
fn default() -> Self {
|
||||
Self {
|
||||
contest: None,
|
||||
callsign: None,
|
||||
category_operator: Some("SINGLE-OP".to_string()),
|
||||
category_power: Some("LOW".to_string()),
|
||||
category_band: Some("ALL".to_string()),
|
||||
category_mode: Some("MIXED".to_string()),
|
||||
claimed_score: None,
|
||||
operators: None,
|
||||
name: None,
|
||||
email: None,
|
||||
soapbox: None,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// The mode letters Cabrillo uses, which are not ADIF's names.
|
||||
fn cabrillo_mode(qso: &Qso) -> &'static str {
|
||||
match qso.mode.trim().to_uppercase().as_str() {
|
||||
"CW" | "CWR" => "CW",
|
||||
"SSB" | "USB" | "LSB" | "AM" | "FM" | "SAM" | "WFM" | "PHONE" => {
|
||||
// FM has a letter of its own; the rest of phone is PH.
|
||||
if matches!(qso.mode.trim().to_uppercase().as_str(), "FM" | "WFM") {
|
||||
"FM"
|
||||
} else {
|
||||
"PH"
|
||||
}
|
||||
}
|
||||
"RTTY" => "RY",
|
||||
_ => "DG",
|
||||
}
|
||||
}
|
||||
|
||||
/// Band designators above 30 MHz, where Cabrillo names the band rather than
|
||||
/// the frequency.
|
||||
const VHF_DESIGNATORS: &[(u64, u64, &str)] = &[
|
||||
(50_000_000, 54_000_000, "50"),
|
||||
(70_000_000, 71_000_000, "70"),
|
||||
(144_000_000, 148_000_000, "144"),
|
||||
(222_000_000, 225_000_000, "222"),
|
||||
(420_000_000, 450_000_000, "432"),
|
||||
(902_000_000, 928_000_000, "902"),
|
||||
(1_240_000_000, 1_300_000_000, "1.2G"),
|
||||
(2_300_000_000, 2_450_000_000, "2.3G"),
|
||||
(3_300_000_000, 3_500_000_000, "3.4G"),
|
||||
(5_650_000_000, 5_925_000_000, "5.7G"),
|
||||
(10_000_000_000, 10_500_000_000, "10G"),
|
||||
];
|
||||
|
||||
/// The frequency field: kilohertz below 30 MHz, a band designator above it.
|
||||
fn cabrillo_frequency(hz: u64) -> String {
|
||||
if hz < 30_000_000 {
|
||||
return (hz / 1000).to_string();
|
||||
}
|
||||
VHF_DESIGNATORS
|
||||
.iter()
|
||||
.find(|(low, high, _)| hz >= *low && hz <= *high)
|
||||
.map_or_else(
|
||||
|| (hz / 1000).to_string(),
|
||||
|(_, _, name)| (*name).to_string(),
|
||||
)
|
||||
}
|
||||
|
||||
fn header_line(out: &mut String, key: &str, value: Option<&str>) {
|
||||
if let Some(value) = value {
|
||||
let value = value.trim();
|
||||
if !value.is_empty() {
|
||||
out.push_str(&format!("{key}: {value}\n"));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Write a Cabrillo 3.0 entry for `qsos`.
|
||||
///
|
||||
/// The caller decides which contacts belong to the entry; this writes what it
|
||||
/// is given, in the order it is given, oldest first as sponsors expect.
|
||||
pub fn write_cabrillo(qsos: &[Qso], header: &CabrilloHeader) -> String {
|
||||
let mut out = String::with_capacity(qsos.len() * 96 + 512);
|
||||
out.push_str("START-OF-LOG: 3.0\n");
|
||||
header_line(&mut out, "CREATED-BY", Some("trx-rs"));
|
||||
header_line(&mut out, "CONTEST", header.contest.as_deref());
|
||||
header_line(&mut out, "CALLSIGN", header.callsign.as_deref());
|
||||
header_line(
|
||||
&mut out,
|
||||
"CATEGORY-OPERATOR",
|
||||
header.category_operator.as_deref(),
|
||||
);
|
||||
header_line(&mut out, "CATEGORY-BAND", header.category_band.as_deref());
|
||||
header_line(&mut out, "CATEGORY-MODE", header.category_mode.as_deref());
|
||||
header_line(&mut out, "CATEGORY-POWER", header.category_power.as_deref());
|
||||
if let Some(score) = header.claimed_score {
|
||||
header_line(&mut out, "CLAIMED-SCORE", Some(&score.to_string()));
|
||||
}
|
||||
header_line(&mut out, "OPERATORS", header.operators.as_deref());
|
||||
header_line(&mut out, "NAME", header.name.as_deref());
|
||||
header_line(&mut out, "EMAIL", header.email.as_deref());
|
||||
header_line(&mut out, "SOAPBOX", header.soapbox.as_deref());
|
||||
|
||||
// Oldest first: a contest log is read as it was worked.
|
||||
let mut ordered: Vec<&Qso> = qsos.iter().collect();
|
||||
ordered.sort_by_key(|qso| qso.started_at);
|
||||
|
||||
let station = header
|
||||
.callsign
|
||||
.clone()
|
||||
.or_else(|| qsos.first().and_then(|qso| qso.station_callsign.clone()))
|
||||
.unwrap_or_else(|| "UNKNOWN".to_string());
|
||||
|
||||
for qso in ordered {
|
||||
let sent = qso.exchange_sent().unwrap_or_default();
|
||||
let received = qso.exchange_received().unwrap_or_default();
|
||||
out.push_str(&format!(
|
||||
"QSO: {freq:>5} {mode:2} {date} {time} {mine:<13} {rst_sent:>3} {exch_sent:<6} {theirs:<13} {rst_rcvd:>3} {exch_rcvd:<6}\n",
|
||||
freq = cabrillo_frequency(qso.freq_hz),
|
||||
mode = cabrillo_mode(qso),
|
||||
date = qso.started_at.format("%Y-%m-%d"),
|
||||
time = qso.started_at.format("%H%M"),
|
||||
mine = qso.station_callsign.as_deref().unwrap_or(&station),
|
||||
rst_sent = qso.rst_sent.as_deref().unwrap_or(""),
|
||||
exch_sent = sent,
|
||||
theirs = qso.call,
|
||||
rst_rcvd = qso.rst_rcvd.as_deref().unwrap_or(""),
|
||||
exch_rcvd = received,
|
||||
));
|
||||
}
|
||||
out.push_str("END-OF-LOG:\n");
|
||||
out
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use crate::qso::parse_adif_datetime;
|
||||
|
||||
fn contest_qso(call: &str, hz: u64, mode: &str, time: &str, sent: u32, rcvd: u32) -> Qso {
|
||||
let mut qso = Qso::new(
|
||||
format!("{call}-{time}"),
|
||||
parse_adif_datetime("20260807", Some(time)).expect("time"),
|
||||
call,
|
||||
hz,
|
||||
mode,
|
||||
);
|
||||
qso.station_callsign = Some("SP0TRX".into());
|
||||
qso.rst_sent = Some("59".into());
|
||||
qso.rst_rcvd = Some("59".into());
|
||||
qso.stx = Some(sent);
|
||||
qso.srx = Some(rcvd);
|
||||
qso.contest_id = Some("CQ-WW-SSB".into());
|
||||
qso
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn an_entry_has_the_header_a_sponsor_expects() {
|
||||
let header = CabrilloHeader {
|
||||
contest: Some("CQ-WW-SSB".into()),
|
||||
callsign: Some("SP0TRX".into()),
|
||||
claimed_score: Some(1234),
|
||||
..CabrilloHeader::default()
|
||||
};
|
||||
let text = write_cabrillo(
|
||||
&[contest_qso("DL1AB", 14_200_000, "SSB", "120000", 1, 42)],
|
||||
&header,
|
||||
);
|
||||
assert!(text.starts_with("START-OF-LOG: 3.0\n"), "{text}");
|
||||
assert!(text.contains("CONTEST: CQ-WW-SSB\n"), "{text}");
|
||||
assert!(text.contains("CALLSIGN: SP0TRX\n"), "{text}");
|
||||
assert!(text.contains("CATEGORY-OPERATOR: SINGLE-OP\n"), "{text}");
|
||||
assert!(text.contains("CLAIMED-SCORE: 1234\n"), "{text}");
|
||||
assert!(text.trim_end().ends_with("END-OF-LOG:"), "{text}");
|
||||
// A header field nobody filled in is left out, not written empty.
|
||||
assert!(!text.contains("SOAPBOX:"), "{text}");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn a_qso_line_carries_both_sides_of_the_exchange() {
|
||||
let text = write_cabrillo(
|
||||
&[contest_qso("DL1AB", 14_200_000, "SSB", "120000", 1, 42)],
|
||||
&CabrilloHeader::default(),
|
||||
);
|
||||
let line = text
|
||||
.lines()
|
||||
.find(|line| line.starts_with("QSO:"))
|
||||
.expect("a QSO line");
|
||||
// Frequency in kHz on HF, the phone mode letter, the date and UTC time,
|
||||
// then mine, my report and my serial, then theirs.
|
||||
assert!(line.contains("14200"), "{line}");
|
||||
assert!(line.contains(" PH "), "{line}");
|
||||
assert!(line.contains("2026-08-07 1200"), "{line}");
|
||||
assert!(line.contains("SP0TRX"), "{line}");
|
||||
assert!(line.contains("DL1AB"), "{line}");
|
||||
assert!(line.contains("001"), "{line}");
|
||||
assert!(line.contains("042"), "{line}");
|
||||
}
|
||||
|
||||
/// Above 30 MHz Cabrillo names the band rather than the frequency.
|
||||
#[test]
|
||||
fn vhf_and_up_are_written_as_band_designators() {
|
||||
assert_eq!(cabrillo_frequency(14_200_000), "14200");
|
||||
assert_eq!(cabrillo_frequency(7_030_000), "7030");
|
||||
assert_eq!(cabrillo_frequency(144_300_000), "144");
|
||||
assert_eq!(cabrillo_frequency(432_100_000), "432");
|
||||
assert_eq!(cabrillo_frequency(1_296_000_000), "1.2G");
|
||||
assert_eq!(cabrillo_frequency(50_313_000), "50");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn the_mode_letters_are_cabrillos_not_adifs() {
|
||||
let cw = contest_qso("DL1AB", 7_030_000, "CW", "120000", 1, 1);
|
||||
let phone = contest_qso("DL1AB", 14_200_000, "SSB", "120000", 1, 1);
|
||||
let fm = contest_qso("DL1AB", 145_500_000, "FM", "120000", 1, 1);
|
||||
let digital = contest_qso("DL1AB", 14_074_000, "FT8", "120000", 1, 1);
|
||||
assert_eq!(cabrillo_mode(&cw), "CW");
|
||||
assert_eq!(cabrillo_mode(&phone), "PH");
|
||||
assert_eq!(cabrillo_mode(&fm), "FM");
|
||||
assert_eq!(cabrillo_mode(&digital), "DG");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn contacts_are_written_oldest_first_however_they_arrive() {
|
||||
let text = write_cabrillo(
|
||||
&[
|
||||
contest_qso("LATER", 14_200_000, "SSB", "130000", 2, 2),
|
||||
contest_qso("EARLIER", 14_200_000, "SSB", "120000", 1, 1),
|
||||
],
|
||||
&CabrilloHeader::default(),
|
||||
);
|
||||
let calls: Vec<&str> = text
|
||||
.lines()
|
||||
.filter(|line| line.starts_with("QSO:"))
|
||||
.map(|line| {
|
||||
if line.contains("EARLIER") {
|
||||
"EARLIER"
|
||||
} else {
|
||||
"LATER"
|
||||
}
|
||||
})
|
||||
.collect();
|
||||
assert_eq!(calls, vec!["EARLIER", "LATER"]);
|
||||
}
|
||||
|
||||
/// A word exchange -- a zone, a section, a name -- rather than a serial.
|
||||
#[test]
|
||||
fn an_exchange_that_is_not_a_number_is_written_as_it_was() {
|
||||
let mut qso = contest_qso("DL1AB", 14_200_000, "SSB", "120000", 1, 1);
|
||||
qso.stx_string = Some("14".into());
|
||||
qso.srx_string = Some("BAVARIA".into());
|
||||
let text = write_cabrillo(&[qso], &CabrilloHeader::default());
|
||||
let line = text.lines().find(|l| l.starts_with("QSO:")).expect("line");
|
||||
assert!(line.contains("BAVARIA"), "{line}");
|
||||
assert!(!line.contains("001"), "{line}");
|
||||
}
|
||||
}
|
||||
@@ -11,6 +11,7 @@
|
||||
//! from the rig that made it, because rigs can be in different places.
|
||||
|
||||
pub mod adif;
|
||||
pub mod cabrillo;
|
||||
pub mod dedupe;
|
||||
pub mod qso;
|
||||
pub mod store;
|
||||
@@ -21,6 +22,7 @@ use std::sync::{Arc, Mutex};
|
||||
use chrono::{DateTime, Utc};
|
||||
use serde::{Deserialize, Serialize};
|
||||
|
||||
pub use cabrillo::{write_cabrillo, CabrilloHeader};
|
||||
pub use dedupe::{worked_before, DuplicateIndex, MATCH_WINDOW_MINUTES};
|
||||
pub use qso::Qso;
|
||||
pub use store::LogStore;
|
||||
@@ -47,6 +49,13 @@ pub struct LogQuery {
|
||||
/// Substring of the callsign, case-insensitive.
|
||||
#[serde(default)]
|
||||
pub call: Option<String>,
|
||||
/// Only contacts in this contest.
|
||||
#[serde(default)]
|
||||
pub contest: Option<String>,
|
||||
/// Only contacts the other station has confirmed, or only those they have
|
||||
/// not.
|
||||
#[serde(default)]
|
||||
pub confirmed: Option<bool>,
|
||||
#[serde(default)]
|
||||
pub band: Option<String>,
|
||||
#[serde(default)]
|
||||
@@ -62,6 +71,16 @@ pub struct LogQuery {
|
||||
pub offset: Option<usize>,
|
||||
}
|
||||
|
||||
/// One band's worth of the log.
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct BandStatistics {
|
||||
pub band: String,
|
||||
pub contacts: usize,
|
||||
/// Distinct callsigns, which is the number an award counts.
|
||||
pub stations: usize,
|
||||
pub confirmed: usize,
|
||||
}
|
||||
|
||||
/// What an import did.
|
||||
#[derive(Debug, Default, Clone, Serialize)]
|
||||
pub struct ImportOutcome {
|
||||
@@ -106,6 +125,7 @@ impl Logbook {
|
||||
let call = query.call.as_deref().map(str::to_uppercase);
|
||||
let band = query.band.as_deref().map(str::to_lowercase);
|
||||
let mode = query.mode.as_deref().map(str::to_uppercase);
|
||||
let contest = query.contest.clone();
|
||||
let matching: Vec<Qso> = store
|
||||
.all()
|
||||
.into_iter()
|
||||
@@ -117,6 +137,14 @@ impl Logbook {
|
||||
&& mode.as_ref().is_none_or(|m| qso.mode == *m)
|
||||
&& query.from.is_none_or(|from| qso.started_at >= from)
|
||||
&& query.to.is_none_or(|to| qso.started_at <= to)
|
||||
&& contest.as_ref().is_none_or(|wanted| {
|
||||
qso.contest_id
|
||||
.as_deref()
|
||||
.is_some_and(|held| held.eq_ignore_ascii_case(wanted))
|
||||
})
|
||||
&& query
|
||||
.confirmed
|
||||
.is_none_or(|wanted| qso.is_confirmed() == wanted)
|
||||
})
|
||||
.collect();
|
||||
let offset = query.offset.unwrap_or(0).min(matching.len());
|
||||
@@ -146,6 +174,52 @@ impl Logbook {
|
||||
self.with_store(|store| dedupe::worked_before(&store.all(), call))
|
||||
}
|
||||
|
||||
/// Export as Cabrillo, for submitting a contest entry.
|
||||
pub fn export_cabrillo(&self, query: &LogQuery, header: &CabrilloHeader) -> String {
|
||||
cabrillo::write_cabrillo(&self.query(query), header)
|
||||
}
|
||||
|
||||
/// What has been worked, and what has been confirmed, band by band.
|
||||
///
|
||||
/// One confirmation counts wherever it came from: an award wants a card or
|
||||
/// an electronic match, not one of each.
|
||||
pub fn band_statistics(&self) -> Vec<BandStatistics> {
|
||||
self.with_store(|store| {
|
||||
let mut by_band: std::collections::HashMap<String, BandStatistics> =
|
||||
std::collections::HashMap::new();
|
||||
let mut stations: std::collections::HashMap<String, std::collections::HashSet<String>> =
|
||||
std::collections::HashMap::new();
|
||||
for qso in store.all() {
|
||||
let band = qso.band().unwrap_or("other").to_string();
|
||||
let entry = by_band
|
||||
.entry(band.clone())
|
||||
.or_insert_with(|| BandStatistics {
|
||||
band: band.clone(),
|
||||
contacts: 0,
|
||||
stations: 0,
|
||||
confirmed: 0,
|
||||
});
|
||||
entry.contacts += 1;
|
||||
if qso.is_confirmed() {
|
||||
entry.confirmed += 1;
|
||||
}
|
||||
stations.entry(band).or_default().insert(qso.call.clone());
|
||||
}
|
||||
let mut all: Vec<BandStatistics> = by_band
|
||||
.into_values()
|
||||
.map(|mut entry| {
|
||||
entry.stations = stations
|
||||
.get(&entry.band)
|
||||
.map_or(0, std::collections::HashSet::len);
|
||||
entry
|
||||
})
|
||||
.collect();
|
||||
// Ordered by wavelength, longest first, as a band plan reads.
|
||||
all.sort_by_key(|entry| qso::band_order(&entry.band));
|
||||
all
|
||||
})
|
||||
}
|
||||
|
||||
/// Export as ADIF, honouring the same filters as a read.
|
||||
pub fn export_adi(&self, query: &LogQuery, program_version: &str) -> String {
|
||||
adif::write_adi(&self.query(query), program_version)
|
||||
@@ -294,6 +368,132 @@ mod tests {
|
||||
assert!(book.worked_before("SP9ZZ").is_empty());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn statistics_count_stations_and_confirmations_band_by_band() {
|
||||
let (_dir, book) = new_book();
|
||||
let mut first = qso("SP1AA", 14_074_000, "FT8", "120000");
|
||||
first.lotw_qsl_rcvd = Some("Y".into());
|
||||
book.put(first).expect("put");
|
||||
// The same station again on the same band: one station, two contacts.
|
||||
book.put(qso("SP1AA", 14_100_000, "SSB", "121000"))
|
||||
.expect("put");
|
||||
let mut third = qso("DL2BB", 7_030_000, "CW", "130000");
|
||||
third.qsl_rcvd = Some("Y".into());
|
||||
book.put(third).expect("put");
|
||||
book.put(qso("OZ3CC", 7_040_000, "CW", "131000"))
|
||||
.expect("put");
|
||||
|
||||
let stats = book.band_statistics();
|
||||
// Longest wavelength first, as a band plan reads.
|
||||
assert_eq!(
|
||||
stats.iter().map(|s| s.band.as_str()).collect::<Vec<_>>(),
|
||||
vec!["40m", "20m"]
|
||||
);
|
||||
let forty = &stats[0];
|
||||
assert_eq!((forty.contacts, forty.stations, forty.confirmed), (2, 2, 1));
|
||||
let twenty = &stats[1];
|
||||
assert_eq!(
|
||||
(twenty.contacts, twenty.stations, twenty.confirmed),
|
||||
(2, 1, 1)
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn a_contest_entry_holds_only_that_contest() {
|
||||
let (_dir, book) = new_book();
|
||||
for (call, contest, serial) in [
|
||||
("SP1AA", Some("CQ-WW-SSB"), 1),
|
||||
("DL2BB", Some("CQ-WW-SSB"), 2),
|
||||
("OZ3CC", None, 0),
|
||||
] {
|
||||
let mut entry = qso(call, 14_200_000, "SSB", "120000");
|
||||
entry.contest_id = contest.map(str::to_string);
|
||||
entry.stx = Some(serial);
|
||||
entry.station_callsign = Some("SP0TRX".into());
|
||||
entry.rst_sent = Some("59".into());
|
||||
entry.rst_rcvd = Some("59".into());
|
||||
book.put(entry).expect("put");
|
||||
}
|
||||
let query = LogQuery {
|
||||
contest: Some("cq-ww-ssb".into()),
|
||||
..LogQuery::default()
|
||||
};
|
||||
assert_eq!(
|
||||
book.query(&query).len(),
|
||||
2,
|
||||
"the contest filter is case-sensitive"
|
||||
);
|
||||
|
||||
let text = book.export_cabrillo(
|
||||
&query,
|
||||
&CabrilloHeader {
|
||||
contest: Some("CQ-WW-SSB".into()),
|
||||
callsign: Some("SP0TRX".into()),
|
||||
..CabrilloHeader::default()
|
||||
},
|
||||
);
|
||||
let lines: Vec<&str> = text
|
||||
.lines()
|
||||
.filter(|line| line.starts_with("QSO:"))
|
||||
.collect();
|
||||
assert_eq!(lines.len(), 2, "{text}");
|
||||
assert!(
|
||||
!text.contains("OZ3CC"),
|
||||
"a contact outside the contest was submitted"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn confirmations_come_from_whichever_bureau_answered() {
|
||||
let (_dir, book) = new_book();
|
||||
let mut card = qso("SP1AA", 14_074_000, "FT8", "120000");
|
||||
card.qsl_rcvd = Some("Y".into());
|
||||
let mut lotw = qso("DL2BB", 14_074_000, "FT8", "121000");
|
||||
lotw.lotw_qsl_rcvd = Some("Y".into());
|
||||
let mut requested = qso("OZ3CC", 14_074_000, "FT8", "122000");
|
||||
requested.qsl_rcvd = Some("R".into());
|
||||
for entry in [card, lotw, requested] {
|
||||
book.put(entry).expect("put");
|
||||
}
|
||||
let confirmed = LogQuery {
|
||||
confirmed: Some(true),
|
||||
..LogQuery::default()
|
||||
};
|
||||
let calls: Vec<String> = book.query(&confirmed).into_iter().map(|q| q.call).collect();
|
||||
assert_eq!(calls.len(), 2, "{calls:?}");
|
||||
assert!(calls.contains(&"SP1AA".to_string()) && calls.contains(&"DL2BB".to_string()));
|
||||
// Requested is not confirmed.
|
||||
let outstanding = LogQuery {
|
||||
confirmed: Some(false),
|
||||
..LogQuery::default()
|
||||
};
|
||||
assert_eq!(book.query(&outstanding)[0].call, "OZ3CC");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn the_contest_and_qsl_fields_survive_a_trip_through_adif() {
|
||||
let (_dir, book) = new_book();
|
||||
let mut entry = qso("SP1AA", 14_200_000, "SSB", "120000");
|
||||
entry.contest_id = Some("CQ-WW-SSB".into());
|
||||
entry.stx = Some(7);
|
||||
entry.srx_string = Some("BAVARIA".into());
|
||||
entry.cqz = Some(15);
|
||||
entry.qsl_sent = Some("Y".into());
|
||||
entry.lotw_qsl_rcvd = Some("Y".into());
|
||||
book.put(entry).expect("put");
|
||||
|
||||
let exported = book.export_adi(&LogQuery::default(), "0.1.0");
|
||||
let (_other_dir, other) = new_book();
|
||||
other.import_adi(exported.as_bytes()).expect("import");
|
||||
let back = &other.query(&LogQuery::default())[0];
|
||||
assert_eq!(back.contest_id.as_deref(), Some("CQ-WW-SSB"));
|
||||
assert_eq!(back.stx, Some(7));
|
||||
assert_eq!(back.srx_string.as_deref(), Some("BAVARIA"));
|
||||
assert_eq!(back.cqz, Some(15));
|
||||
assert_eq!(back.qsl_sent.as_deref(), Some("Y"));
|
||||
assert!(back.is_confirmed());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn a_contact_can_be_changed_and_forgotten() {
|
||||
let (_dir, book) = new_book();
|
||||
|
||||
@@ -64,6 +64,39 @@ pub struct Qso {
|
||||
/// Which rig of this client, by id — ours, not ADIF's.
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub rig_id: Option<String>,
|
||||
/// The contest this contact counts towards, by its Cabrillo name.
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub contest_id: Option<String>,
|
||||
/// Serial sent. Kept as text as well as a number, because plenty of
|
||||
/// exchanges are neither — a zone, a section, a name, a power.
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub stx: Option<u32>,
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub stx_string: Option<String>,
|
||||
/// Serial received, likewise.
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub srx: Option<u32>,
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub srx_string: Option<String>,
|
||||
/// CQ and ITU zones of the station worked.
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub cqz: Option<u8>,
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub ituz: Option<u8>,
|
||||
/// Paper QSL, and the two card-less bureaux, as ADIF's single letters:
|
||||
/// `Y` yes, `N` no, `R` requested, `I` ignore, `Q` queued, `V` verified.
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub qsl_sent: Option<String>,
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub qsl_rcvd: Option<String>,
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub lotw_qsl_sent: Option<String>,
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub lotw_qsl_rcvd: Option<String>,
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub eqsl_qsl_sent: Option<String>,
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub eqsl_qsl_rcvd: Option<String>,
|
||||
/// ADIF fields this application does not model, kept verbatim.
|
||||
#[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
|
||||
pub extra: BTreeMap<String, String>,
|
||||
@@ -98,6 +131,19 @@ impl Qso {
|
||||
my_gridsquare: None,
|
||||
my_rig: None,
|
||||
rig_id: None,
|
||||
contest_id: None,
|
||||
stx: None,
|
||||
stx_string: None,
|
||||
srx: None,
|
||||
srx_string: None,
|
||||
cqz: None,
|
||||
ituz: None,
|
||||
qsl_sent: None,
|
||||
qsl_rcvd: None,
|
||||
lotw_qsl_sent: None,
|
||||
lotw_qsl_rcvd: None,
|
||||
eqsl_qsl_sent: None,
|
||||
eqsl_qsl_rcvd: None,
|
||||
extra: BTreeMap::new(),
|
||||
}
|
||||
}
|
||||
@@ -107,6 +153,34 @@ impl Qso {
|
||||
band_for_hz(self.freq_hz)
|
||||
}
|
||||
|
||||
/// Whether the other station has confirmed this contact, anywhere.
|
||||
///
|
||||
/// One confirmation is a confirmation: an award needs one card or one
|
||||
/// electronic match, not all three, and a log that counted them separately
|
||||
/// would tell the operator they were three contacts short of what they have.
|
||||
pub fn is_confirmed(&self) -> bool {
|
||||
[&self.qsl_rcvd, &self.lotw_qsl_rcvd, &self.eqsl_qsl_rcvd]
|
||||
.into_iter()
|
||||
.flatten()
|
||||
.any(|state| {
|
||||
let state = state.trim().to_uppercase();
|
||||
state == "Y" || state == "V"
|
||||
})
|
||||
}
|
||||
|
||||
/// The exchange as it goes into a contest log: what was sent, or received.
|
||||
pub fn exchange_sent(&self) -> Option<String> {
|
||||
self.stx_string
|
||||
.clone()
|
||||
.or_else(|| self.stx.map(|serial| format!("{serial:03}")))
|
||||
}
|
||||
|
||||
pub fn exchange_received(&self) -> Option<String> {
|
||||
self.srx_string
|
||||
.clone()
|
||||
.or_else(|| self.srx.map(|serial| format!("{serial:03}")))
|
||||
}
|
||||
|
||||
/// What two logs have to agree on to be describing the same contact.
|
||||
///
|
||||
/// Not the time: that is compared as a window by [`crate::dedupe`], because
|
||||
@@ -183,6 +257,17 @@ pub fn band_midpoint_for_name(band: &str) -> Option<u64> {
|
||||
.map(|(_, low, high)| low + (high - low) / 2)
|
||||
}
|
||||
|
||||
/// Where a band sits in the table, for ordering a report by wavelength.
|
||||
///
|
||||
/// Anything not in the table sorts last, which is where "other" belongs.
|
||||
pub fn band_order(band: &str) -> usize {
|
||||
let wanted = band.trim().to_lowercase();
|
||||
BANDS
|
||||
.iter()
|
||||
.position(|(name, _, _)| *name == wanted)
|
||||
.unwrap_or(BANDS.len())
|
||||
}
|
||||
|
||||
/// The frequency in MHz, as ADIF writes it.
|
||||
pub fn freq_mhz_string(hz: u64) -> String {
|
||||
// Six decimals is 1 Hz, which is finer than any dial reports and is what
|
||||
|
||||
@@ -268,18 +268,15 @@ impl AsRef<str> for CookieSameSite {
|
||||
pub struct HttpAuthConfig {
|
||||
/// Enable HTTP frontend authentication
|
||||
pub enabled: bool,
|
||||
/// Passphrase for read-only access (rx role)
|
||||
pub rx_passphrase: Option<String>,
|
||||
/// Read the rx passphrase from this file instead.
|
||||
/// JSON file containing the managed user database.
|
||||
pub users_file: String,
|
||||
/// Username used to create the first administrator when the database is absent.
|
||||
pub bootstrap_admin_username: Option<String>,
|
||||
/// Password used to create the first administrator when the database is absent.
|
||||
pub bootstrap_admin_password: Option<String>,
|
||||
/// Read the bootstrap administrator password from this file instead.
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub rx_passphrase_file: Option<String>,
|
||||
/// Passphrase for full control access (control role)
|
||||
pub control_passphrase: Option<String>,
|
||||
/// Read the control passphrase from this file instead.
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub control_passphrase_file: Option<String>,
|
||||
/// Enforce TX/PTT access control (hide from unauthenticated/rx users)
|
||||
pub tx_access_control_enabled: bool,
|
||||
pub bootstrap_admin_password_file: Option<String>,
|
||||
/// Session time-to-live in minutes
|
||||
pub session_ttl_min: u64,
|
||||
/// Set Secure flag on session cookie (required for HTTPS)
|
||||
@@ -292,11 +289,10 @@ impl Default for HttpAuthConfig {
|
||||
fn default() -> Self {
|
||||
Self {
|
||||
enabled: false,
|
||||
rx_passphrase: None,
|
||||
rx_passphrase_file: None,
|
||||
control_passphrase: None,
|
||||
control_passphrase_file: None,
|
||||
tx_access_control_enabled: true,
|
||||
users_file: "trx-http-users.json".to_string(),
|
||||
bootstrap_admin_username: None,
|
||||
bootstrap_admin_password: None,
|
||||
bootstrap_admin_password_file: None,
|
||||
session_ttl_min: 480,
|
||||
cookie_secure: false,
|
||||
cookie_same_site: CookieSameSite::Lax,
|
||||
@@ -802,14 +798,9 @@ impl ClientConfig {
|
||||
)?;
|
||||
}
|
||||
resolve_secret(
|
||||
&mut self.frontends.http.auth.rx_passphrase,
|
||||
&self.frontends.http.auth.rx_passphrase_file,
|
||||
"[frontends.http.auth].rx_passphrase",
|
||||
)?;
|
||||
resolve_secret(
|
||||
&mut self.frontends.http.auth.control_passphrase,
|
||||
&self.frontends.http.auth.control_passphrase_file,
|
||||
"[frontends.http.auth].control_passphrase",
|
||||
&mut self.frontends.http.auth.bootstrap_admin_password,
|
||||
&self.frontends.http.auth.bootstrap_admin_password_file,
|
||||
"[frontends.http.auth].bootstrap_admin_password",
|
||||
)?;
|
||||
resolve_secret_list(
|
||||
&mut self.frontends.http_json.auth.tokens,
|
||||
@@ -819,7 +810,7 @@ impl ClientConfig {
|
||||
|
||||
if let Some(path) = config_path {
|
||||
if self.has_inline_secrets() {
|
||||
crate::secrets::warn_if_group_readable(path, "tokens/passphrases");
|
||||
crate::secrets::warn_if_group_readable(path, "tokens/passwords");
|
||||
}
|
||||
}
|
||||
Ok(())
|
||||
@@ -832,10 +823,13 @@ impl ClientConfig {
|
||||
.remotes
|
||||
.iter()
|
||||
.any(|r| r.auth.token_file.is_none() && r.auth.token.is_some())
|
||||
|| self.frontends.http.auth.rx_passphrase_file.is_none()
|
||||
&& self.frontends.http.auth.rx_passphrase.is_some()
|
||||
|| self.frontends.http.auth.control_passphrase_file.is_none()
|
||||
&& self.frontends.http.auth.control_passphrase.is_some()
|
||||
|| self
|
||||
.frontends
|
||||
.http
|
||||
.auth
|
||||
.bootstrap_admin_password_file
|
||||
.is_none()
|
||||
&& self.frontends.http.auth.bootstrap_admin_password.is_some()
|
||||
|| self.frontends.http_json.auth.tokens_file.is_none()
|
||||
&& !self.frontends.http_json.auth.tokens.is_empty()
|
||||
}
|
||||
@@ -905,11 +899,10 @@ impl ClientConfig {
|
||||
decode_history_retention_min_by_rig: HashMap::new(),
|
||||
auth: HttpAuthConfig {
|
||||
enabled: false,
|
||||
rx_passphrase: Some("rx-passphrase-example".to_string()),
|
||||
rx_passphrase_file: None,
|
||||
control_passphrase: Some("control-passphrase-example".to_string()),
|
||||
control_passphrase_file: None,
|
||||
tx_access_control_enabled: true,
|
||||
users_file: "trx-http-users.json".to_string(),
|
||||
bootstrap_admin_username: Some("admin".to_string()),
|
||||
bootstrap_admin_password: Some("change-this-password".to_string()),
|
||||
bootstrap_admin_password_file: None,
|
||||
session_ttl_min: 480,
|
||||
cookie_secure: false,
|
||||
cookie_same_site: CookieSameSite::Lax,
|
||||
@@ -948,29 +941,27 @@ fn validate_http_auth(auth: &HttpAuthConfig) -> Result<(), String> {
|
||||
return Ok(());
|
||||
}
|
||||
|
||||
// If enabled, require at least one passphrase
|
||||
if auth.rx_passphrase.is_none() && auth.control_passphrase.is_none() {
|
||||
if auth.users_file.trim().is_empty() {
|
||||
return Err("[frontends.http.auth].users_file must not be empty".to_string());
|
||||
}
|
||||
if auth.bootstrap_admin_username.is_some() != auth.bootstrap_admin_password.is_some() {
|
||||
return Err("[frontends.http.auth] bootstrap_admin_username and bootstrap_admin_password must be set together".to_string());
|
||||
}
|
||||
if auth
|
||||
.bootstrap_admin_username
|
||||
.as_deref()
|
||||
.is_some_and(|v| v.trim().is_empty())
|
||||
|| auth
|
||||
.bootstrap_admin_password
|
||||
.as_deref()
|
||||
.is_some_and(|v| v.is_empty())
|
||||
{
|
||||
return Err(
|
||||
"[frontends.http.auth] enabled=true requires at least one passphrase \
|
||||
(rx_passphrase and/or control_passphrase)"
|
||||
"[frontends.http.auth] bootstrap administrator credentials must not be empty"
|
||||
.to_string(),
|
||||
);
|
||||
}
|
||||
|
||||
// Validate passphrases are not empty strings
|
||||
if let Some(rx) = &auth.rx_passphrase {
|
||||
if rx.trim().is_empty() {
|
||||
return Err("[frontends.http.auth].rx_passphrase must not be empty if set".to_string());
|
||||
}
|
||||
}
|
||||
if let Some(ctrl) = &auth.control_passphrase {
|
||||
if ctrl.trim().is_empty() {
|
||||
return Err(
|
||||
"[frontends.http.auth].control_passphrase must not be empty if set".to_string(),
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// Session TTL must be > 0
|
||||
if auth.session_ttl_min == 0 {
|
||||
return Err("[frontends.http.auth].session_ttl_min must be > 0".to_string());
|
||||
@@ -1238,42 +1229,34 @@ home-hf = "audio://10.0.0.5:4600"
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_validate_rejects_http_auth_enabled_without_passphrases() {
|
||||
fn test_validate_accepts_http_auth_with_user_database() {
|
||||
let mut config = ClientConfig::default();
|
||||
config.frontends.http.auth.enabled = true;
|
||||
assert!(config.validate().is_ok());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_validate_accepts_bootstrap_admin_pair() {
|
||||
let mut config = ClientConfig::default();
|
||||
config.frontends.http.auth.enabled = true;
|
||||
config.frontends.http.auth.bootstrap_admin_username = Some("admin".to_string());
|
||||
config.frontends.http.auth.bootstrap_admin_password = Some("secret-password".to_string());
|
||||
assert!(config.validate().is_ok());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_validate_rejects_incomplete_bootstrap_admin_pair() {
|
||||
let mut config = ClientConfig::default();
|
||||
config.frontends.http.auth.enabled = true;
|
||||
config.frontends.http.auth.bootstrap_admin_username = Some("admin".to_string());
|
||||
assert!(config.validate().is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_validate_accepts_http_auth_with_rx_passphrase() {
|
||||
fn test_validate_rejects_empty_users_file() {
|
||||
let mut config = ClientConfig::default();
|
||||
config.frontends.http.auth.enabled = true;
|
||||
config.frontends.http.auth.rx_passphrase = Some("rx-secret".to_string());
|
||||
assert!(config.validate().is_ok());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_validate_accepts_http_auth_with_control_passphrase() {
|
||||
let mut config = ClientConfig::default();
|
||||
config.frontends.http.auth.enabled = true;
|
||||
config.frontends.http.auth.control_passphrase = Some("control-secret".to_string());
|
||||
assert!(config.validate().is_ok());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_validate_accepts_http_auth_with_both_passphrases() {
|
||||
let mut config = ClientConfig::default();
|
||||
config.frontends.http.auth.enabled = true;
|
||||
config.frontends.http.auth.rx_passphrase = Some("rx-secret".to_string());
|
||||
config.frontends.http.auth.control_passphrase = Some("control-secret".to_string());
|
||||
assert!(config.validate().is_ok());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_validate_rejects_empty_rx_passphrase() {
|
||||
let mut config = ClientConfig::default();
|
||||
config.frontends.http.auth.enabled = true;
|
||||
config.frontends.http.auth.rx_passphrase = Some("".to_string());
|
||||
config.frontends.http.auth.users_file.clear();
|
||||
assert!(config.validate().is_err());
|
||||
}
|
||||
|
||||
@@ -1281,16 +1264,15 @@ home-hf = "audio://10.0.0.5:4600"
|
||||
fn test_validate_rejects_zero_session_ttl() {
|
||||
let mut config = ClientConfig::default();
|
||||
config.frontends.http.auth.enabled = true;
|
||||
config.frontends.http.auth.rx_passphrase = Some("rx-secret".to_string());
|
||||
config.frontends.http.auth.session_ttl_min = 0;
|
||||
assert!(config.validate().is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_validate_auth_disabled_ignores_passphrases() {
|
||||
fn test_validate_auth_disabled_ignores_user_settings() {
|
||||
let mut config = ClientConfig::default();
|
||||
config.frontends.http.auth.enabled = false;
|
||||
config.frontends.http.auth.rx_passphrase = Some("".to_string());
|
||||
config.frontends.http.auth.users_file.clear();
|
||||
assert!(config.validate().is_ok());
|
||||
}
|
||||
|
||||
@@ -1298,9 +1280,9 @@ home-hf = "audio://10.0.0.5:4600"
|
||||
fn test_http_auth_config_default() {
|
||||
let auth = HttpAuthConfig::default();
|
||||
assert!(!auth.enabled);
|
||||
assert!(auth.rx_passphrase.is_none());
|
||||
assert!(auth.control_passphrase.is_none());
|
||||
assert!(auth.tx_access_control_enabled);
|
||||
assert_eq!(auth.users_file, "trx-http-users.json");
|
||||
assert!(auth.bootstrap_admin_username.is_none());
|
||||
assert!(auth.bootstrap_admin_password.is_none());
|
||||
assert_eq!(auth.session_ttl_min, 480);
|
||||
assert!(!auth.cookie_secure);
|
||||
assert!(matches!(auth.cookie_same_site, CookieSameSite::Lax));
|
||||
@@ -1602,15 +1584,21 @@ spectrum_interval_ms = 0
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_passphrase_file_fills_passphrase() {
|
||||
fn test_bootstrap_password_file_fills_password() {
|
||||
let f = secret_file("hunter2\n");
|
||||
let mut config = ClientConfig::default();
|
||||
config.frontends.http.auth.enabled = true;
|
||||
config.frontends.http.auth.control_passphrase_file =
|
||||
config.frontends.http.auth.bootstrap_admin_username = Some("admin".to_string());
|
||||
config.frontends.http.auth.bootstrap_admin_password_file =
|
||||
Some(f.path().to_str().unwrap().to_string());
|
||||
config.resolve_secrets(None).unwrap();
|
||||
assert_eq!(
|
||||
config.frontends.http.auth.control_passphrase.as_deref(),
|
||||
config
|
||||
.frontends
|
||||
.http
|
||||
.auth
|
||||
.bootstrap_admin_password
|
||||
.as_deref(),
|
||||
Some("hunter2")
|
||||
);
|
||||
assert!(config.validate().is_ok());
|
||||
|
||||
@@ -111,8 +111,8 @@ const SECTION_COMMENTS: &[(&str, &str)] = &[
|
||||
),
|
||||
(
|
||||
"trx-client.frontends.http.auth",
|
||||
"Passphrase login for the web UI. rx_passphrase_file and\n\
|
||||
control_passphrase_file keep the secrets out of this file.",
|
||||
"Optional user/password ACL for the web UI. Administrators manage\n\
|
||||
accounts stored in users_file.",
|
||||
),
|
||||
(
|
||||
"trx-client.frontends.rigctl",
|
||||
|
||||
+5
-5
@@ -203,13 +203,13 @@ decode_history_retention_min = 1440
|
||||
|
||||
[trx-client.frontends.http.decode_history_retention_min_by_rig]
|
||||
|
||||
# Passphrase login for the web UI. rx_passphrase_file and
|
||||
# control_passphrase_file keep the secrets out of this file.
|
||||
# Optional user/password ACL for the web UI. Administrators manage
|
||||
# accounts stored in users_file.
|
||||
[trx-client.frontends.http.auth]
|
||||
enabled = false
|
||||
rx_passphrase = "rx-passphrase-example"
|
||||
control_passphrase = "control-passphrase-example"
|
||||
tx_access_control_enabled = true
|
||||
users_file = "trx-http-users.json"
|
||||
bootstrap_admin_username = "admin"
|
||||
bootstrap_admin_password = "change-this-password"
|
||||
session_ttl_min = 480
|
||||
cookie_secure = false
|
||||
cookie_same_site = "Lax"
|
||||
|
||||
Reference in New Issue
Block a user