web: bokftui in the browser (ttyd + bokfweb login gate); per-user login limitv0.1.69

New image bokf-web (Dockerfile target "web", compose service "web" on
127.0.0.1:8790): Caddy routing with forward_auth, the bokfweb login gate
(C, authenticates with bokfd's session.open, per-address limit, cookie +
terminal handle, one login handed to the TUI via /redeem) and ttyd running
bokftui in web mode in an isolated throwaway HOME. TLS stays with the
host's reverse proxy. BOKF_WEB=1 blocks every local file and viewer path in
the TUI. bokfd's login limiter is now per user name instead of one global
counter (5 wrong guesses from anyone locked out everybody), and a full
counter table no longer disables it. The cross build and deploy.sh build
and ship both images.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 29 insertions, 1 deletions

diff --git a/tests/test_core.c b/tests/test_core.c
index 6376517..a82c833 100644
--- a/tests/test_core.c
+++ b/tests/test_core.c
@@ -4904,7 +4904,15 @@ static void test_rate_limit(struct tctx *t)
     (void)t;
     yyjson_doc *d;
 
-    /* rate limiting must stay last: it blocks the login key */
+    CHECK(login("admin", "secret123"));
+    d = call(reqf("{\"v\":1,\"id\":\"31\",\"cmd\":\"user.create\","
+                  "\"session\":\"%s\",\"args\":{\"username\":\"rluser\","
+                  "\"password\":\"rlpassword1\"}}",
+                  g_session));
+    CHECK_OK(d);
+    yyjson_doc_free(d);
+
+    /* rate limiting must stay last: it blocks the admin login */
     for (int i = 0; i < 5; i++)
         CHECK(!login("admin", "wrong"));
     d = call("{\"v\":1,\"id\":\"32\",\"cmd\":\"session.open\",\"args\":"
@@ -4912,6 +4920,26 @@ static void test_rate_limit(struct tctx *t)
              "\"password\":\"secret123\"}}");
     CHECK_STR(d, "error.code", "RATE_LIMITED");
     yyjson_doc_free(d);
+    /* the limit is per user name: guessing one account never locks out
+       the others (a public login page must not be a lockout switch) */
+    for (int i = 0; i < 5; i++)
+        CHECK(!login("nobody-here", "wrong"));
+    CHECK(login("rluser", "rlpassword1"));
+    /* flooding the table with names neither frees admin early nor turns
+       the limiter off */
+    char name[32];
+    for (int i = 0; i < 1100; i++) {
+        snprintf(name, sizeof name, "flood%d", i);
+        login(name, "x");
+    }
+    d = call("{\"v\":1,\"id\":\"33\",\"cmd\":\"session.open\",\"args\":"
+             "{\"method\":\"password\",\"username\":\"admin\","
+             "\"password\":\"secret123\"}}");
+    CHECK_STR(d, "error.code", "RATE_LIMITED");
+    yyjson_doc_free(d);
+    for (int i = 0; i < 5; i++)
+        CHECK(!login("rluser", "wrong"));
+    CHECK(!login("rluser", "rlpassword1"));
 }
 
 static void test_employees(struct tctx *t)