refactor(auth): consolidate user+ACL into single UserACLList; drop passwords; TOTP-only login

Schema:
  - auth/users.go + auth/acl.go merged → auth/user_acl.go (single source of truth)
  - User struct: Display + ACL map (no PasswordHash field — passwords removed)
  - UserACLList map[username]User exposed at package scope
  - Helpers AllowedProjects / CanSeeProject / TagAllowed read from UserACLList[user].ACL

Auth flow (no traditional password exists at all):
  - /login form: username + 6-digit TOTP only (no password field)
  - First login: server sees UserACLList has the username + TOTP not bound →
    sets bind cookie + 302 to /bind-totp; the TOTP field on this submission
    is ignored
  - /bind-totp: scan QR + enter first 6-digit code → blob written
  - Subsequent logins: username + TOTP code → validate → session cookie
  - TOTP IS the credential

CLI:
  - hash subcommand removed (no passwords to hash)
  - totp-reset → reset_totp (snake_case to match user's project conventions)

Dependency cleanup:
  - drop golang.org/x/crypto/bcrypt
  - drop golang.org/x/term

Security envelope: LAN-only deployment. The /login surface trusts that
anyone on the LAN may attempt enrolment for any listed username (because
there's no password barrier before the bind flow). If too permissive,
restrict at firewall or extend CLI for admin-pre-bind. Documented threat
model in user_acl.go header.

Author: 0xYeah

.gitignore

@@ -10,23 +10,23 @@
 logs/
 
 # build artifacts
-/api_show
-/bin/
-/build/
+api_show
+bin/
+build/
 
 # runtime data — uploaded specs live here at runtime, not in git
-/data/*
-!/data/.gitkeep
+data/*
+!data/.gitkeep
 
 # Production config is auto-created by SyncConfigFile at first start
 # (/api_show/conf/api_show_config.toml). Dev config_local.toml is committed
 # with placeholder values (mirrors ame); devs must NOT commit secret edits.
-/conf/
+conf/
 
 # .auto_coding skill workspace + private CLAUDE.md (per repo convention)
 .auto_coding/
 .CLAUDE.md
 CLAUDE.md
 .claude/
 
-api_show
+

auth/acl.go

@@ -4,64 +4,38 @@ import (
 	"errors"
 	"fmt"
 	"os"
-
-	"golang.org/x/crypto/bcrypt"
-	"golang.org/x/term"
 )
 
 // RunCLI dispatches admin sub-commands when api_show is invoked with one.
 // Returns (handled, exitCode). Caller should exit immediately if handled.
 //
 // Sub-commands:
 //
-//	./api_show hash                 — read a password from stdin, print bcrypt
-//	./api_show totp-reset <user>    — delete that user's TOTP blob
+//	./api_show reset_totp <username>   — delete that user's TOTP blob;
+//	                                     forces them to re-bind on next login.
 //
-// `hash` deliberately does NOT take the password as an argv argument so it
-// never lands in shell history or `ps` output.
+// No password subcommand exists — there ARE no passwords; TOTP is the
+// credential. To rotate a user's TOTP, run reset_totp and the user's
+// next /login goes through the bind flow.
 func RunCLI(args []string, dataDir string, secret []byte) (handled bool, exitCode int) {
 	if len(args) == 0 {
 		return false, 0
 	}
 	switch args[0] {
-	case "hash":
-		return true, cmdHash()
-	case "totp-reset":
+	case "reset_totp":
 		if len(args) < 2 {
-			fmt.Fprintln(os.Stderr, "usage: api_show totp-reset <username>")
+			fmt.Fprintln(os.Stderr, "usage: api_show reset_totp <username>")
 			return true, 2
 		}
-		return true, cmdTotpReset(args[1], dataDir, secret)
+		return true, cmdResetTotp(args[1], dataDir, secret)
 	default:
 		return false, 0
 	}
 }
 
-func cmdHash() int {
-	fmt.Fprint(os.Stderr, "password (input hidden): ")
-	pw, err := term.ReadPassword(int(os.Stdin.Fd()))
-	fmt.Fprintln(os.Stderr) // newline after hidden input
-	if err != nil {
-		fmt.Fprintln(os.Stderr, "read password:", err)
-		return 1
-	}
-	if len(pw) == 0 {
-		fmt.Fprintln(os.Stderr, "empty password rejected")
-		return 1
-	}
-	hash, err := bcrypt.GenerateFromPassword(pw, 10)
-	if err != nil {
-		fmt.Fprintln(os.Stderr, "bcrypt:", err)
-		return 1
-	}
-	fmt.Println(string(hash))
-	fmt.Fprintln(os.Stderr, "→ paste into auth/users.go Users map and ship a new release.")
-	return 0
-}
-
-func cmdTotpReset(user, dataDir string, secret []byte) int {
+func cmdResetTotp(user, dataDir string, secret []byte) int {
 	if !UserExists(user) {
-		fmt.Fprintf(os.Stderr, "warn: %q is not in auth.Users — resetting blob anyway in case of stale entry\n", user)
+		fmt.Fprintf(os.Stderr, "warn: %q is not in auth.UserACLList — clearing blob anyway in case of stale entry\n", user)
 	}
 	store := NewTOTPStore(dataDir, secret)
 	path := store.Path(user)

auth/cli.go

@@ -8,7 +8,6 @@ import (
 	"sync"
 
 	"github.com/pquerna/otp"
-	"golang.org/x/crypto/bcrypt"
 )
 
 // HandlerDeps bundles the shared state every handler needs.
@@ -40,26 +39,22 @@ func loginSubmit(w http.ResponseWriter, r *http.Request, d HandlerDeps) {
 		return
 	}
 	user := strings.TrimSpace(r.FormValue("username"))
-	pass := r.FormValue("password")
 	code := strings.TrimSpace(r.FormValue("totp"))
 	next := safeNext(r.FormValue("next"))
-	if user == "" || pass == "" {
-		renderLogin(w, "username + password required", next)
+	if user == "" {
+		renderLogin(w, "username required", next)
 		return
 	}
-	hash, ok := Users[user]
-	if !ok {
-		renderLogin(w, "invalid credentials", next)
-		return
-	}
-	if err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(pass)); err != nil {
+	if !UserExists(user) {
+		// Don't leak whether the username is valid before TOTP — same
+		// generic error either way.
 		renderLogin(w, "invalid credentials", next)
 		return
 	}
 
-	// Password OK — branch on TOTP binding state
+	// First login: no bound TOTP yet → set bind cookie + 302 to QR page.
+	// The `code` field is ignored on this path.
 	if !d.TOTP.IsBound(user) {
-		// First-time user → temp bind cookie + redirect to QR page
 		if err := IssueBindCookie(w, d.Secret, user); err != nil {
 			http.Error(w, "set bind cookie: "+err.Error(), http.StatusInternalServerError)
 			return
@@ -68,13 +63,14 @@ func loginSubmit(w http.ResponseWriter, r *http.Request, d HandlerDeps) {
 		return
 	}
 
+	// Subsequent login: TOTP IS the credential. No password.
 	if code == "" {
 		renderLogin(w, "TOTP code required", next)
 		return
 	}
 	verified, err := d.TOTP.Verify(user, code)
 	if err != nil || !verified {
-		renderLogin(w, "TOTP code invalid", next)
+		renderLogin(w, "invalid credentials", next)
 		return
 	}
 	if err := IssueSessionCookie(w, d.Secret, user); err != nil {
@@ -234,13 +230,11 @@ var loginTpl = template.Must(template.New("login").Parse(`<!doctype html>
     <input type="hidden" name="next" value="{{.Next}}">
     <label>Username</label>
     <input name="username" autocomplete="username" autofocus required>
-    <label>Password</label>
-    <input name="password" type="password" autocomplete="current-password" required>
     <label>TOTP code <span style="opacity:.6">(leave blank on first login)</span></label>
     <input name="totp" inputmode="numeric" pattern="[0-9]{6}" autocomplete="one-time-code" placeholder="6-digit">
     <button type="submit">Sign in</button>
     <div class="err">{{.Err}}</div>
-    <div class="hint">First-time users skip the TOTP field — you'll be redirected to bind your authenticator app.</div>
+    <div class="hint">No password — TOTP is the credential. First-time users leave the TOTP field empty and will be redirected to bind an authenticator app (Google Authenticator / Authy / 1Password).</div>
   </form>
 </div>
 </body></html>`))

auth/handlers.go

@@ -19,7 +19,11 @@ import (
 // Spec versions supported: OpenAPI 3.x (also tolerates Swagger 2.0 layout —
 // "paths" + "tags" are identical there).
 func FilterSpec(raw []byte, user, project string) ([]byte, error) {
-	allowed, ok := ACL[user][project]
+	u, ok := UserACLList[user]
+	if !ok {
+		return nil, fmt.Errorf("auth: user %q not registered", user)
+	}
+	allowed, ok := u.ACL[project]
 	if !ok || len(allowed) == 0 {
 		return nil, fmt.Errorf("auth: user %q has no visibility into project %q", user, project)
 	}

auth/spec_filter.go

@@ -0,0 +1,114 @@
+// Package auth implements api_show's authentication and per-project ACL.
+//
+// No traditional password exists. TOTP is the credential — first login
+// binds a fresh TOTP secret to the username; every subsequent login is
+// "username + 6-digit TOTP". Admin wipes a user's TOTP via:
+//
+//	./api_show reset_totp <username>
+//
+// Security envelope: LAN-only deployment. The /login surface trusts that
+// anyone already on the LAN may attempt enrolment for any listed username.
+// If that's too permissive, gate the listening port at the firewall or
+// extend the CLI to admin-pre-bind TOTP secrets out of band.
+package auth
+
+// User is the full per-account record. No password — TOTP is the credential.
+type User struct {
+	// Display is an optional friendly name shown on the bind QR / portal UI.
+	// Empty string falls back to the map key (username).
+	Display string
+
+	// ACL maps project_id → allowed-tag-prefix list.
+	//
+	// Tag matching rules:
+	//   - "*"        ← all tags allowed (full project view)
+	//   - "auth"     ← matches operations whose tag starts with "auth"
+	//                  (e.g. "auth", "auth.login", "auth.session")
+	//   - empty list ← user cannot see this project
+	//   - project not listed for user ← also denied
+	ACL map[string][]string
+}
+
+// UserACLList — hardcoded account table. Edit + ship a new release to add
+// users or change permissions.
+//
+// Demo entries (replace before LAN deploy):
+//
+//	ohyeah  → full cg, ame[auth+orgs]
+//	hl      → cg[chat] only
+var UserACLList = map[string]User{
+	"ohyeah": {
+		Display: "OhYeah",
+		ACL: map[string][]string{
+			"cg":  {"*"},
+			"ame": {"auth", "orgs"},
+		},
+	},
+	"hl": {
+		Display: "hl",
+		ACL: map[string][]string{
+			"cg": {"chat"},
+		},
+	},
+}
+
+// UserExists reports whether a username is registered.
+func UserExists(username string) bool {
+	_, ok := UserACLList[username]
+	return ok
+}
+
+// LookupUser returns the User record + ok flag for username.
+func LookupUser(username string) (User, bool) {
+	u, ok := UserACLList[username]
+	return u, ok
+}
+
+// AllowedProjects returns the project IDs a user can see at all.
+// Order is undefined; caller should not rely on it.
+func AllowedProjects(user string) []string {
+	u, ok := UserACLList[user]
+	if !ok {
+		return nil
+	}
+	out := make([]string, 0, len(u.ACL))
+	for p, tags := range u.ACL {
+		if len(tags) == 0 {
+			continue
+		}
+		out = append(out, p)
+	}
+	return out
+}
+
+// CanSeeProject reports whether user has any visibility into project.
+func CanSeeProject(user, project string) bool {
+	u, ok := UserACLList[user]
+	if !ok {
+		return false
+	}
+	tags, ok := u.ACL[project]
+	return ok && len(tags) > 0
+}
+
+// TagAllowed reports whether the given operation tag is permitted for
+// (user, project). Empty tag means "untagged operation" → matches "*" only.
+func TagAllowed(user, project, tag string) bool {
+	u, ok := UserACLList[user]
+	if !ok {
+		return false
+	}
+	allowed, ok := u.ACL[project]
+	if !ok {
+		return false
+	}
+	for _, prefix := range allowed {
+		if prefix == "*" {
+			return true
+		}
+		if tag != "" && len(tag) >= len(prefix) && tag[:len(prefix)] == prefix {
+			return true
+		}
+	}
+	return false
+}