test: build the fixture config and the keyset with ecoretest
The hand-built ini in web_test.go, the random fernet key in authn's
TestMain and the same seeding copied into the git-hook test are one call
to ecoretest now. The keys are fixed rather than generated on purpose:
they secure nothing inside a test process, and a constant keyset is what
lets two packages of this service initialise without the second rotating
what the first sealed with.
The synthetic instance runs in production mode, so the environment
banner is off in tests unless one asks for it.
authn: cookie, PAT, and dolt-JWT caller resolution
Add the authn package resolving the SourceHut caller across dolt.sr.ht's
three auth flows, producing core-go *auth.AuthContext values mapped onto the
pure core.Caller domain type:
- ctx.go: WithCaller/CallerFromContext (nil for anonymous, never panics) and
AsCoreCaller (maps UserType, derives Suspended).
- cookie.go: OptionalCookieMiddleware, the never-rejecting unified-login
cookie reader (fernet decrypt -> {name} -> LookupUser); any failure degrades
to anonymous so public browsing keeps working.
- token.go: ResolveBasic, the meta personal-access-token trio (offline
DecodeBearerToken -> username match -> LookupUser + revocation) with a 60s
positive cache keyed by sha512(password); TokenGrantsAllow gates
dolt.sr.ht/repos RO/RW grants (empty grants pass).
- jwt.go: ResolveDoltJWT, EdDSA JWS verification for dolt keypair auth (kid ->
KeyStore pubkey, alg=EdDSA, aud/exp/sub checked, iss ignored), reusing
dolt's creds.PubKeyToKIDStr for the kid<->pubkey integrity check.
- grpc.go: ResolveGRPCAuth dispatching Basic/Bearer/anonymous.
Meta lookup + revocation sit behind the MetaBackend interface and JWT keys
behind the KeyStore interface (implemented later by db/), so tests forge
cookies (fernet), PATs (BearerToken.Encode) and real Ed25519 JWTs against
in-memory stubs with no network or Postgres.