fix(auth): pass through helper-identity requests so auto-enroll bootstrap works

Author: terafin

backend/cmd/server/auth_middleware.go

@@ -91,6 +91,16 @@ func (a *app) requireAuth(next http.Handler) http.Handler {
 			next.ServeHTTP(w, r)
 			return
 		}
+		// Helper protocol: requests carrying both identity headers
+		// (X-RSM-Device-Type + X-RSM-Fingerprint) are deferred to the
+		// downstream handler (authorizeHelperSyncRequest in helper_auth.go),
+		// which enforces either app-password validation or the
+		// auto-enroll-window policy. Pre-empting that decision here would
+		// break the bootstrap flow where a fresh helper has no key yet.
+		if hasHelperIdentity(r) {
+			next.ServeHTTP(w, r)
+			return
+		}
 		if a.isAuthenticatedRequest(r) {
 			next.ServeHTTP(w, r)
 			return
@@ -103,6 +113,16 @@ func (a *app) requireAuth(next http.Handler) http.Handler {
 	})
 }
 
+// hasHelperIdentity reports whether r carries both helper-identity headers
+// (X-RSM-Device-Type + X-RSM-Fingerprint). The middleware uses this to
+// recognize the helper protocol and defer the auth decision to
+// authorizeHelperSyncRequest, which knows the auto-enroll-window policy.
+func hasHelperIdentity(r *http.Request) bool {
+	dt := strings.TrimSpace(r.Header.Get("X-RSM-Device-Type"))
+	fp := strings.TrimSpace(r.Header.Get("X-RSM-Fingerprint"))
+	return dt != "" && fp != ""
+}
+
 // isAuthenticatedRequest returns true if r presents any acceptable credential
 // when AUTH_MODE=enabled. See requireAuth for the accepted forms.
 func (a *app) isAuthenticatedRequest(r *http.Request) bool {

backend/cmd/server/auth_middleware_test.go

@@ -1,6 +1,8 @@
 package main
 
 import (
+	"bytes"
+	"mime/multipart"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -124,3 +126,102 @@ func TestAuthMiddleware_Enabled_RejectsGarbageBearer(t *testing.T) {
 	rr := h.do(req)
 	assertStatus(t, rr, http.StatusUnauthorized)
 }
+
+// --- AUTH_MODE=enabled — helper-identity defer-to-handler behavior ---
+//
+// These tests cover the bug where the middleware would 401 helper requests
+// that have identity headers but no app-password, breaking the auto-enroll
+// bootstrap flow. The middleware MUST defer to authorizeHelperSyncRequest
+// (in helper_auth.go), which enforces the actual policy.
+
+// helperMultipartSaveRequest builds a POST /saves multipart request that
+// looks like a helper upload — identity carried via headers, not form fields,
+// so the middleware's hasHelperIdentity check is exercised. Optionally sets
+// an Authorization Bearer with the supplied app-password.
+func helperMultipartSaveRequest(t *testing.T, deviceType, fingerprint, appPassword string) *http.Request {
+	t.Helper()
+
+	fields := map[string]string{
+		"rom_sha1":       "middleware-helper-rom",
+		"slotName":       "default",
+		"system":         "snes",
+		"runtimeProfile": "snes/snes9x",
+	}
+
+	var buf bytes.Buffer
+	writer := multipart.NewWriter(&buf)
+	for key, value := range fields {
+		if err := writer.WriteField(key, value); err != nil {
+			t.Fatalf("write multipart field %s: %v", key, err)
+		}
+	}
+	part, err := writer.CreateFormFile("file", "Final Fantasy VI.srm")
+	if err != nil {
+		t.Fatalf("create multipart file: %v", err)
+	}
+	payload := normalizeTestUploadPayload(fields, "Final Fantasy VI.srm", []byte("helper-middleware-payload"))
+	if _, err := part.Write(payload); err != nil {
+		t.Fatalf("write multipart payload: %v", err)
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatalf("close multipart writer: %v", err)
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "/saves", &buf)
+	req.Header.Set("Content-Type", writer.FormDataContentType())
+	req.Header.Set("X-CSRF-Protection", "1")
+	req.Header.Set("X-RSM-Device-Type", deviceType)
+	req.Header.Set("X-RSM-Fingerprint", fingerprint)
+	if appPassword != "" {
+		req.Header.Set("Authorization", "Bearer "+appPassword)
+	}
+	return req
+}
+
+func TestAuthMiddleware_Enabled_HelperHeadersNoKey_AutoEnrollOpen_Allows(t *testing.T) {
+	h := authMiddlewareHarness(t, true)
+	// Open the auto-enroll window via the normal handler path.
+	h.app.mu.Lock()
+	h.app.enableAutoAppPasswordWindowLocked(15 * time.Minute)
+	h.app.mu.Unlock()
+
+	req := helperMultipartSaveRequest(t, "linux-x86", "deck-middleware-open", "")
+	rr := h.do(req)
+	assertStatus(t, rr, http.StatusOK)
+	if got := rr.Header().Get("X-RSM-Auto-App-Password"); got == "" {
+		t.Fatalf("expected auto-provisioned app password header on bootstrap; headers=%v", rr.Header())
+	}
+}
+
+func TestAuthMiddleware_Enabled_HelperHeadersNoKey_AutoEnrollClosed_Rejects(t *testing.T) {
+	h := authMiddlewareHarness(t, true)
+	// Default state: auto-enroll window is NOT open.
+
+	req := helperMultipartSaveRequest(t, "linux-x86", "deck-middleware-closed", "")
+	rr := h.do(req)
+	// The middleware passes through; the downstream handler enforces the
+	// no-key + closed-window policy with 401.
+	assertStatus(t, rr, http.StatusUnauthorized)
+}
+
+func TestAuthMiddleware_Enabled_HelperHeadersValidKey_Allows(t *testing.T) {
+	h := authMiddlewareHarness(t, true)
+	key := mintAppPassword(t, h)
+
+	req := helperMultipartSaveRequest(t, "linux-x86", "deck-middleware-key", key)
+	rr := h.do(req)
+	assertStatus(t, rr, http.StatusOK)
+}
+
+// Regression test for the GET /api/saves + valid Bearer path. The empirical
+// repro that surfaced the bootstrap bug had an empty Bearer (enrollment had
+// failed), so this confirms the happy path independently.
+func TestAuthMiddleware_Enabled_GetApiSavesWithValidBearer_Allows(t *testing.T) {
+	h := authMiddlewareHarness(t, true)
+	key := mintAppPassword(t, h)
+
+	req := rawRequest(http.MethodGet, "/api/saves")
+	req.Header.Set("Authorization", "Bearer "+key)
+	rr := h.do(req)
+	assertStatus(t, rr, http.StatusOK)
+}