appauth: fine-grained app passwords - #5894

App passwords stop being full-power credentials.

What an app password is. A 43-character secret, stored hashed, with a client kind (sync, cli or webdav), a list of permissions, optional root folders and an expiry. Users get one through the login flow: sync with * for the desktop client, cli with read and write for the CERNBox CLI. Administrators can create, list and revoke them for any user through the Admin API.

The token. As before, a client presents its app password and the gateway exchanges it for a reva token. That token no longer carries the owner scope but a single appauth scope, built from the stored app password:

{
  "password_id": "0d2c9f3e-…",
  "client": "cli",
  "permissions": ["files:list", "files:read", "files:write"],
  "roots": ["/eos/user/e/einstein/thesis"],
  "expires_at": 1775000000
}

The scope travels inside the token, so the same rules apply wherever the token is used: WebDAV, OCS, the data provider or gRPC.

Permissions. Every CS3 request maps to one permission, and a request whose permission is not granted is refused.

* allows every request but those on the never list. Identity lookups (users, groups, reading preferences) are always allowed. Never allowed, not even with *: creating, listing or revoking app passwords, the Admin API, storage space management, OCM invites and share changes, and data transfers. So an app password cannot mint others.

Where it is checked. The HTTP auth middleware checks how the app password is sent (sync: basic auth, cli: bearer, webdav: either) and that the user agent fits its kind. The gRPC auth interceptor, in the gateway and in every provider, checks the permission of each request. The data provider does the same for downloads and uploads, which reach the storage without gRPC.

Expiry. cli and webdav app passwords expire after 90 days by default and after 365 at most; sync ones need none. The store refuses an expired app password, and expires_at in the scope makes every token minted from it stop working at the same moment, whatever the token's own lifetime.

Roots. When set, a request must refer to a path under one of the roots: references by id are resolved to paths, and a move is checked at both ends. The store does not accept roots yet, until listings of shares and spaces can be filtered against them.

Revocation. Logins with an app password are cached for five minutes, so a revoked one stops working within that time, and at once on the node that revoked it.