Require email for daemon startup, persist in account file

Like certbot, the daemon now requires an email address on first run.
The email is persisted alongside the identity file so subsequent
restarts don't need it. Resolution order: -email flag > -owner flag
(deprecated) > account.json file.

Add internal/validate for email format checks and internal/account
for atomic account file persistence. Six integration tests cover
the full lifecycle: required, persistence, reload, update, validation,
and backward compatibility with the -owner flag.

Author: teovl

cmd/daemon/main.go

@@ -24,7 +24,8 @@ func main() {
 	registryTLS := flag.Bool("registry-tls", false, "use TLS for registry connection")
 	registryFingerprint := flag.String("registry-fingerprint", "", "hex SHA-256 fingerprint of registry TLS certificate")
 	identityPath := flag.String("identity", "", "path to persist Ed25519 identity (enables stable identity across restarts)")
-	owner := flag.String("owner", "", "owner identifier (email) for key rotation recovery")
+	email := flag.String("email", "", "email address for account identification and key recovery")
+	owner := flag.String("owner", "", "(deprecated: use -email) owner identifier for key rotation recovery")
 	keepalive := flag.Duration("keepalive", 0, "keepalive probe interval (default 30s)")
 	idleTimeout := flag.Duration("idle-timeout", 0, "idle connection timeout (default 120s)")
 	synRate := flag.Int("syn-rate-limit", 0, "max SYN packets per second (default 100)")
@@ -62,6 +63,7 @@ func main() {
 		RegistryTLS:           *registryTLS,
 		RegistryFingerprint:   *registryFingerprint,
 		IdentityPath:          *identityPath,
+		Email:                 *email,
 		Owner:                 *owner,
 		KeepaliveInterval:     *keepalive,
 		IdleTimeout:           *idleTimeout,

internal/account/account.go

@@ -0,0 +1,53 @@
+package account
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/TeoSlayer/pilotprotocol/internal/fsutil"
+)
+
+// Account holds persisted account information alongside the identity file.
+type Account struct {
+	Email string `json:"email"`
+}
+
+// Save writes the account to disk atomically with 0600 permissions.
+func Save(path string, acct *Account) error {
+	if err := os.MkdirAll(filepath.Dir(path), 0700); err != nil {
+		return fmt.Errorf("create account dir: %w", err)
+	}
+	data, err := json.MarshalIndent(acct, "", "  ")
+	if err != nil {
+		return fmt.Errorf("marshal account: %w", err)
+	}
+	if err := fsutil.AtomicWrite(path, data); err != nil {
+		return fmt.Errorf("write account: %w", err)
+	}
+	// Ensure 0600 permissions
+	return os.Chmod(path, 0600)
+}
+
+// Load reads an account from disk. Returns nil, nil if the file does not exist.
+func Load(path string) (*Account, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("read account: %w", err)
+	}
+	var acct Account
+	if err := json.Unmarshal(data, &acct); err != nil {
+		return nil, fmt.Errorf("unmarshal account: %w", err)
+	}
+	return &acct, nil
+}
+
+// PathFromIdentity returns the account file path derived from an identity file path.
+// If identity is "/var/lib/pilot/identity.json", returns "/var/lib/pilot/account.json".
+func PathFromIdentity(identityPath string) string {
+	return filepath.Join(filepath.Dir(identityPath), "account.json")
+}

internal/account/account_test.go

@@ -0,0 +1,104 @@
+package account
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestSaveAndLoad(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "account.json")
+
+	acct := &Account{Email: "user@example.com"}
+	if err := Save(path, acct); err != nil {
+		t.Fatalf("Save: %v", err)
+	}
+
+	loaded, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if loaded == nil {
+		t.Fatal("Load returned nil")
+	}
+	if loaded.Email != "user@example.com" {
+		t.Errorf("Email = %q, want %q", loaded.Email, "user@example.com")
+	}
+
+	// Check file permissions
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatalf("Stat: %v", err)
+	}
+	if perm := info.Mode().Perm(); perm != 0600 {
+		t.Errorf("permissions = %o, want 0600", perm)
+	}
+}
+
+func TestLoadNotFound(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "nonexistent.json")
+
+	acct, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if acct != nil {
+		t.Errorf("expected nil account for nonexistent file, got %+v", acct)
+	}
+}
+
+func TestSaveOverwrite(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "account.json")
+
+	if err := Save(path, &Account{Email: "old@example.com"}); err != nil {
+		t.Fatalf("Save: %v", err)
+	}
+	if err := Save(path, &Account{Email: "new@example.com"}); err != nil {
+		t.Fatalf("Save overwrite: %v", err)
+	}
+
+	loaded, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if loaded.Email != "new@example.com" {
+		t.Errorf("Email = %q, want %q", loaded.Email, "new@example.com")
+	}
+}
+
+func TestPathFromIdentity(t *testing.T) {
+	cases := []struct {
+		input string
+		want  string
+	}{
+		{"/var/lib/pilot/identity.json", "/var/lib/pilot/account.json"},
+		{"/home/user/.pilot/identity.json", "/home/user/.pilot/account.json"},
+		{"identity.json", "account.json"},
+	}
+	for _, tc := range cases {
+		got := PathFromIdentity(tc.input)
+		if got != tc.want {
+			t.Errorf("PathFromIdentity(%q) = %q, want %q", tc.input, got, tc.want)
+		}
+	}
+}
+
+func TestSaveCreatesDirectory(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "subdir", "account.json")
+
+	if err := Save(path, &Account{Email: "user@example.com"}); err != nil {
+		t.Fatalf("Save with nested dir: %v", err)
+	}
+
+	loaded, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if loaded.Email != "user@example.com" {
+		t.Errorf("Email = %q, want %q", loaded.Email, "user@example.com")
+	}
+}

internal/validate/email.go

@@ -0,0 +1,36 @@
+package validate
+
+import (
+	"fmt"
+	"strings"
+)
+
+// Email validates an email address with basic checks:
+// non-empty, contains exactly one @, domain has a dot, no spaces.
+// This is not a full RFC 5322 parser — just enough to catch typos.
+func Email(email string) error {
+	if email == "" {
+		return fmt.Errorf("email address is required")
+	}
+	if strings.Contains(email, " ") {
+		return fmt.Errorf("email address must not contain spaces")
+	}
+	at := strings.Index(email, "@")
+	if at < 1 {
+		return fmt.Errorf("email address must contain @")
+	}
+	if strings.Count(email, "@") > 1 {
+		return fmt.Errorf("email address must contain exactly one @")
+	}
+	domain := email[at+1:]
+	if domain == "" {
+		return fmt.Errorf("email address must have a domain after @")
+	}
+	if !strings.Contains(domain, ".") {
+		return fmt.Errorf("email domain must contain a dot")
+	}
+	if strings.HasPrefix(domain, ".") || strings.HasSuffix(domain, ".") {
+		return fmt.Errorf("email domain must not start or end with a dot")
+	}
+	return nil
+}

internal/validate/email_test.go

@@ -0,0 +1,58 @@
+package validate
+
+import "testing"
+
+func TestEmailValid(t *testing.T) {
+	valid := []string{
+		"user@example.com",
+		"admin@pilot.local",
+		"test+tag@sub.domain.org",
+		"a@b.co",
+	}
+	for _, email := range valid {
+		if err := Email(email); err != nil {
+			t.Errorf("Email(%q) = %v, want nil", email, err)
+		}
+	}
+}
+
+func TestEmailInvalid(t *testing.T) {
+	cases := []struct {
+		input string
+		want  string
+	}{
+		{"", "required"},
+		{"noatsign", "must contain @"},
+		{"@domain.com", "must contain @"},
+		{"user@", "must have a domain"},
+		{"user@nodot", "must contain a dot"},
+		{"user @example.com", "must not contain spaces"},
+		{"user@ example.com", "must not contain spaces"},
+		{"user@.example.com", "must not start or end with a dot"},
+		{"user@example.", "must not start or end with a dot"},
+		{"a@b@c.com", "exactly one @"},
+	}
+	for _, tc := range cases {
+		err := Email(tc.input)
+		if err == nil {
+			t.Errorf("Email(%q) = nil, want error containing %q", tc.input, tc.want)
+			continue
+		}
+		if got := err.Error(); !contains(got, tc.want) {
+			t.Errorf("Email(%q) = %q, want error containing %q", tc.input, got, tc.want)
+		}
+	}
+}
+
+func contains(s, substr string) bool {
+	return len(s) >= len(substr) && containsAt(s, substr)
+}
+
+func containsAt(s, substr string) bool {
+	for i := 0; i <= len(s)-len(substr); i++ {
+		if s[i:i+len(substr)] == substr {
+			return true
+		}
+	}
+	return false
+}

pkg/daemon/daemon.go

@@ -10,7 +10,9 @@ import (
 	"sync/atomic"
 	"time"
 
+	"github.com/TeoSlayer/pilotprotocol/internal/account"
 	"github.com/TeoSlayer/pilotprotocol/internal/crypto"
+	"github.com/TeoSlayer/pilotprotocol/internal/validate"
 	"github.com/TeoSlayer/pilotprotocol/pkg/protocol"
 	"github.com/TeoSlayer/pilotprotocol/pkg/registry"
 )
@@ -29,7 +31,8 @@ type Config struct {
 	RegistryTLS         bool   // use TLS for registry connection
 	RegistryFingerprint string // hex SHA-256 fingerprint for TLS cert pinning
 	IdentityPath        string // path to persist Ed25519 identity (empty = no persistence)
-	Owner               string // owner identifier (email) for key rotation recovery
+	Email               string // email address for account identification and key recovery
+	Owner               string // deprecated: use Email instead
 
 	Endpoint string // fixed public endpoint (host:port) — skips STUN discovery (for cloud VMs)
 	Public   bool   // make this node's endpoint publicly discoverable
@@ -250,6 +253,35 @@ func (d *Daemon) reapPerSrcSYN() {
 }
 
 func (d *Daemon) Start() error {
+	// 0. Resolve email: flag > owner (deprecated) > account file
+	email := d.config.Email
+	if email == "" && d.config.Owner != "" {
+		email = d.config.Owner
+	}
+	if email == "" && d.config.IdentityPath != "" {
+		acctPath := account.PathFromIdentity(d.config.IdentityPath)
+		if acct, err := account.Load(acctPath); err == nil && acct != nil {
+			email = acct.Email
+			slog.Info("loaded email from account file", "path", acctPath)
+		}
+	}
+	if email == "" {
+		return fmt.Errorf("email address required: use -email you@example.com")
+	}
+	if err := validate.Email(email); err != nil {
+		return fmt.Errorf("invalid email: %w", err)
+	}
+	d.config.Email = email
+	d.config.Owner = email // keep Owner in sync for registry and DaemonInfo
+
+	// Persist email to account file (if identity path is set)
+	if d.config.IdentityPath != "" {
+		acctPath := account.PathFromIdentity(d.config.IdentityPath)
+		if err := account.Save(acctPath, &account.Account{Email: email}); err != nil {
+			slog.Warn("failed to save account file", "error", err)
+		}
+	}
+
 	// 1. Discover our public endpoint via beacon using a temporary UDP socket.
 	// If -endpoint is set, skip STUN and use the fixed address (for cloud VMs).
 	var registrationAddr string