// Copyright (c) 2026 Nikolay Govorov

// SPDX-License-Identifier: AGPL-3.0-or-later

// Actor is the principal making a database request. It carries identity,

// display metadata, and coarse capability. Zero value is invalid: dbID

// Synthetic actors (System/Operator/Anon) live only as Go constants —

// they are not rows in the users table, so they cannot be logged in as

// even if somebody writes a password into the DB.

type Actor struct {

kind actorKind

id uuid.UUID

)

var (

systemUUID = uuid.MustParse("00000000-0000-0000-0000-000000000001")

operatorUUID = uuid.MustParse("00000000-0000-0000-0000-000000000002")

)

// UserActor identifies an authenticated user from a session or token.

panic("database: UserActor with nil UUID")

}

if email == "" {

panic("database: UserActor with empty email")

}

}

// OperatorActor is the principal for externally invoked privileged

return KindInvalid

}

func (a Actor) Email() string { return a.email }

func (a Actor) IsSuperuser() bool { return a.superuser }

}

panic("database: zero-value Actor; use UserActor/SystemActor/OperatorActor/AnonActor")

}

"strings"

"unicode"

"github.com/spf13/cobra"

"github.com/spf13/pflag"

"google.golang.org/protobuf/proto"

func parseBytesFlag(fieldName, v string) ([]byte, error) {

switch {

case fieldName == "id" || strings.HasSuffix(fieldName, "_id"):

if err != nil {

}

case strings.Contains(fieldName, "key"):

der, err := base64.StdEncoding.DecodeString(v)

if err != nil {

func formatBytes(b []byte) string {

if len(b) == 16 {

}

return base64.StdEncoding.EncodeToString(b)

}

"os"

"dimidiumlabs/mirum/internal/config"

"dimidiumlabs/mirum/internal/forges"

"dimidiumlabs/mirum/internal/protocol/pb"

"dimidiumlabs/mirum/internal/protocol/pb/pbconnect"

ctx, cancel := context.WithCancel(sup.WaitForStop(context.Background()))

defer cancel()

if err != nil {

slog.Error("couldn't open database", "err", err)

return err

adminSrv := hardenServer(&http.Server{

Handler: adminMux,

ConnContext: func(ctx context.Context, _ net.Conn) context.Context {

},

BaseContext: func(_ net.Listener) context.Context {

return ctx

"time"

"dimidiumlabs/mirum/internal/config"

"dimidiumlabs/mirum/internal/forges"

"dimidiumlabs/mirum/internal/protocol/pb"

)

// server holds the shared application state.

type server struct {

cfg *appConfig

forge forges.Forge

queue chan *pb.Task

for {

select {

case <-ticker.C:

slog.Error("purge sessions", "err", err)

}

case <-ctx.Done():

"connectrpc.com/connect"

"connectrpc.com/validate"

"google.golang.org/protobuf/types/known/timestamppb"

"dimidiumlabs/mirum/internal/protocol/pb"

"dimidiumlabs/mirum/internal/protocol/pb/pbconnect"

)

func NewAdminHandler(srv *server) (string, http.Handler) {

as := &adminService{srv: srv}

return pbconnect.NewAdminHandler(as,

)

}

code connect.Code

reason pb.ErrorReason

}{

}

func mapErr(err error) error {

// --- Ref converters ---

switch v := r.GetRef().(type) {

case *pb.UserRef_Id:

case *pb.UserRef_Email:

default:

}

}

switch v := r.GetRef().(type) {

case *pb.OrgRef_Id:

case *pb.OrgRef_Slug:

default:

}

}

maxPageSize = 200

)

limit = defaultPageSize

if p != nil {

if p.PageSize > 0 && int(p.PageSize) < maxPageSize {

limit = maxPageSize

}

if len(p.Cursor) == 16 {

}

}

return

}

resp := &pb.PageResponse{TotalCount: int32(total)}

if items == limit {

}

return resp

}

// --- Proto converters ---

return &pb.User{

}

}

return &pb.Org{

Public: o.Public, CreatedAt: timestamppb.New(o.CreatedAt),

}

}

return &pb.OrgMemberInfo{

User: userToProto(m.User), Role: roleToProto[m.Role],

JoinedAt: timestamppb.New(m.JoinedAt),

}

}

pw := &pb.Worker{

}

if w.OrgID != nil {

}

return pw

}

if err != nil {

return nil, mapErr(err)

}

}

func (a *adminService) UserGet(ctx context.Context, req *connect.Request[pb.UserGetRequest]) (*connect.Response[pb.UserGetResponse], error) {

if err != nil {

return nil, mapErr(err)

}

}

func (a *adminService) UserList(ctx context.Context, req *connect.Request[pb.UserListRequest]) (*connect.Response[pb.UserListResponse], error) {

filter := ""

if req.Msg.Filter != nil {

filter = *req.Msg.Filter

}

if err != nil {

return nil, mapErr(err)

}

out[i] = userToProto(users[i])

}

if len(users) > 0 {

lastID = users[len(users)-1].ID

}

}

func (a *adminService) UserUpdate(ctx context.Context, req *connect.Request[pb.UserUpdateRequest]) (*connect.Response[pb.UserUpdateResponse], error) {

return nil, mapErr(err)

}

return connect.NewResponse(&pb.UserUpdateResponse{}), nil

}

func (a *adminService) UserDelete(ctx context.Context, req *connect.Request[pb.UserDeleteRequest]) (*connect.Response[pb.UserDeleteResponse], error) {

return nil, mapErr(err)

}

return connect.NewResponse(&pb.UserDeleteResponse{}), nil

// --- Org handlers ---

func (a *adminService) OrgCreate(ctx context.Context, req *connect.Request[pb.OrgCreateRequest]) (*connect.Response[pb.OrgCreateResponse], error) {

if err != nil {

return nil, mapErr(err)

}

if err != nil {

return nil, mapErr(err)

}

}

func (a *adminService) OrgGet(ctx context.Context, req *connect.Request[pb.OrgGetRequest]) (*connect.Response[pb.OrgGetResponse], error) {

if err != nil {

return nil, mapErr(err)

}

}

func (a *adminService) OrgList(ctx context.Context, req *connect.Request[pb.OrgListRequest]) (*connect.Response[pb.OrgListResponse], error) {

filter := ""

if req.Msg.Filter != nil {

filter = *req.Msg.Filter

}

if err != nil {

return nil, mapErr(err)

}

out[i] = orgToProto(orgs[i])

}

if len(orgs) > 0 {

lastID = orgs[len(orgs)-1].ID

}

func (a *adminService) OrgUpdate(ctx context.Context, req *connect.Request[pb.OrgUpdateRequest]) (*connect.Response[pb.OrgUpdateResponse], error) {

var slug *string

if req.Msg.Slug != nil {

if err != nil {

return nil, mapErr(err)

}

slug = &s

}

return nil, mapErr(err)

}

return connect.NewResponse(&pb.OrgUpdateResponse{}), nil

}

func (a *adminService) OrgDelete(ctx context.Context, req *connect.Request[pb.OrgDeleteRequest]) (*connect.Response[pb.OrgDeleteResponse], error) {

return nil, mapErr(err)

}

return connect.NewResponse(&pb.OrgDeleteResponse{}), nil

if !ok {

return nil, newAPIError(connect.CodeInvalidArgument, pb.ErrorReason_ERROR_REASON_INVALID_ROLE, nil)

}

return nil, mapErr(err)

}

return connect.NewResponse(&pb.OrgMemberAddResponse{}), nil

}

func (a *adminService) OrgMemberGet(ctx context.Context, req *connect.Request[pb.OrgMemberGetRequest]) (*connect.Response[pb.OrgMemberGetResponse], error) {

if err != nil {

return nil, mapErr(err)

}

}

func (a *adminService) OrgMemberList(ctx context.Context, req *connect.Request[pb.OrgMemberListRequest]) (*connect.Response[pb.OrgMemberListResponse], error) {

filter := ""

if req.Msg.Filter != nil {

filter = *req.Msg.Filter

}

if err != nil {

return nil, mapErr(err)

}

out[i] = memberToProto(members[i])

}

if len(members) > 0 {

lastID = members[len(members)-1].User.ID

}

if !ok {

return nil, newAPIError(connect.CodeInvalidArgument, pb.ErrorReason_ERROR_REASON_INVALID_ROLE, nil)

}

return nil, mapErr(err)

}

return connect.NewResponse(&pb.OrgMemberUpdateResponse{}), nil

}

func (a *adminService) OrgMemberRemove(ctx context.Context, req *connect.Request[pb.OrgMemberRemoveRequest]) (*connect.Response[pb.OrgMemberRemoveResponse], error) {

return nil, mapErr(err)

}

return connect.NewResponse(&pb.OrgMemberRemoveResponse{}), nil

// --- Worker handlers ---

func (a *adminService) WorkerCreate(ctx context.Context, req *connect.Request[pb.WorkerCreateRequest]) (*connect.Response[pb.WorkerCreateResponse], error) {

if req.Msg.Org != nil {

org = &r

}

if err != nil {

return nil, mapErr(err)

}

}

func (a *adminService) WorkerGet(ctx context.Context, req *connect.Request[pb.WorkerGetRequest]) (*connect.Response[pb.WorkerGetResponse], error) {

if err != nil {

return nil, mapErr(err)

}

}

func (a *adminService) WorkerList(ctx context.Context, req *connect.Request[pb.WorkerListRequest]) (*connect.Response[pb.WorkerListResponse], error) {

filter := ""

if req.Msg.Filter != nil {

filter = *req.Msg.Filter

}

if err != nil {

return nil, mapErr(err)

}

out[i] = workerToProto(workers[i])

}

if len(workers) > 0 {

lastID = workers[len(workers)-1].ID

}

}

func (a *adminService) WorkerDelete(ctx context.Context, req *connect.Request[pb.WorkerDeleteRequest]) (*connect.Response[pb.WorkerDeleteResponse], error) {

return nil, mapErr(err)

}

return connect.NewResponse(&pb.WorkerDeleteResponse{}), nil

"connectrpc.com/validate"

"dimidiumlabs/mirum/internal/config"

"dimidiumlabs/mirum/internal/protocol"

"dimidiumlabs/mirum/internal/protocol/pb"

"dimidiumlabs/mirum/internal/protocol/pb/pbconnect"

return errors.New("ed25519 certificate required")

}

return fmt.Errorf("unknown worker: %w", err)

}

"github.com/go-chi/httprate"

"dimidiumlabs/mirum/internal/config"

"dimidiumlabs/mirum/internal/forges"

"dimidiumlabs/mirum/internal/protocol/pb"

)

}

// ActorFromContext returns the authenticated actor, or AnonActor if none.

return v

}

}

// SessionMiddleware resolves the session cookie and puts the Actor in context.

func (h *webHandler) SessionMiddleware(next http.Handler) http.Handler {

return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

if c, err := r.Cookie(sessionCookie); err == nil {

ctx := context.WithValue(r.Context(), actorKey{}, actor)

r = r.WithContext(ctx)

}

})

}

func authonly(next authedHandler) http.HandlerFunc {

return func(w http.ResponseWriter, r *http.Request) {

actor := ActorFromContext(r.Context())

http.Redirect(w, r, "/auth/login", http.StatusSeeOther)

return

}

}

}

h.assets.renderPage(w, "dashboard", http.StatusOK, map[string]any{

"user": map[string]string{"email": actor.Email()},

"csrf": csrfToken(w, r),

email := r.FormValue("email")

password := r.FormValue("password")

if err != nil {

h.renderLogin(w, r, http.StatusUnauthorized, pb.ErrorReason_ERROR_REASON_INVALID_CREDENTIALS)

return

}

if err != nil {

slog.Error("create session failed", "err", err)

h.renderLogin(w, r, http.StatusInternalServerError, pb.ErrorReason_ERROR_REASON_INTERNAL)

return

}

if c, err := r.Cookie(sessionCookie); err == nil {

}

clearCookie(w, sessionCookie)

clearCookie(w, csrfCookie)