Sign in as a user instead of with an API key

The web UI signs in with a username and password and holds a session
cookie; the TUI was the only client still needing an API key pasted into
a config file. It now asks for the same credentials on a form at start.

What is kept between runs is the session token, not the password, in
session.json under the config directory, mode 0600 and keyed by server
URL so one server's token is never offered to another. It resumes on the
next start; the server's sessions last 30 days and slide with use. L
signs out, which ends the session on the server and deletes the saved
one even if the server cannot be reached.

The client attaches the cookie by hand instead of using a cookie jar:
the server marks it Secure behind https, and a jar drops a Secure cookie
it is given over plain http, which would break a local server for no
reason. It sends no Authorization header at all, since the server judges
a request carrying one on that alone and never falls back to the cookie.
Writes go through the server's cross-origin guard, which lets a client
that sends neither Origin nor Sec-Fetch-Site through; checked against a
real v0.20.1 server for both reads and writes.

A 401 from anything means the session is gone (expired, ended from the
web UI, or the account disabled), so the TUI returns to the form with the
reason, forgets the saved token, and drops what the last session loaded
rather than showing it to whoever signs in next. A 403 is a permission
and leaves the session alone. The refresh timer is started once, so
signing out and in does not leave two running.

An account with no password cannot sign in, and the server answers it
exactly like a wrong password, so the form's message says a password
must be set first. Users created only for API access hit this.

Breaking: api_key in config.yaml is no longer used. It is not an error
to leave it there; the form says it is ignored. API keys still exist on
the server and k in Users still manages them.

internal/api/client_test.go

@@ -19,7 +19,9 @@ type call struct {
 	path   string
 	query  string
 	body   string
-	auth   string
+	cookie string
+	// authz is the Authorization header, which the client no longer sends at all.
+	authz string
 }
 
 // stub serves one canned response and records the request that fetched it.
@@ -29,22 +31,107 @@ func stub(t *testing.T, status int, response string) (*Client, *call) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		body, _ := io.ReadAll(r.Body)
 		got.method, got.path, got.query = r.Method, r.URL.Path, r.URL.RawQuery
-		got.body, got.auth = string(body), r.Header.Get("Authorization")
+		got.body, got.authz = string(body), r.Header.Get("Authorization")
+		if ck, err := r.Cookie(SessionCookie); err == nil {
+			got.cookie = ck.Value
+		}
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(status)
 		io.WriteString(w, response)
 	}))
 	t.Cleanup(srv.Close)
-	return NewClient(srv.URL, "test-key"), got
+	c := NewClient(srv.URL)
+	c.SetSession("test-session")
+	return c, got
 }
 
-func TestClient_SendsBearerToken(t *testing.T) {
+func TestClient_SendsTheSessionCookie(t *testing.T) {
 	c, got := stub(t, http.StatusOK, `[]`)
 	if _, err := c.ListIncidents(0, "", false, false, 0); err != nil {
 		t.Fatalf("list: %v", err)
 	}
-	if got.auth != "Bearer test-key" {
-		t.Errorf("expected bearer token, got %q", got.auth)
+	if got.cookie != "test-session" {
+		t.Errorf("expected the session cookie, got %q", got.cookie)
+	}
+	// The server judges a request with an Authorization header on that alone and
+	// never falls back to the cookie, so sending one would defeat the session.
+	if got.authz != "" {
+		t.Errorf("expected no Authorization header, got %q", got.authz)
+	}
+}
+
+// Login has to work over plain http, where a cookie jar would discard the
+// Secure cookie a server behind https sets.
+func TestLogin_KeepsTheSessionFromTheCookie(t *testing.T) {
+	var body string
+	var sentCookie bool
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		b, _ := io.ReadAll(r.Body)
+		body = string(b)
+		_, err := r.Cookie(SessionCookie)
+		sentCookie = err == nil
+		http.SetCookie(w, &http.Cookie{Name: SessionCookie, Value: "fresh", Path: "/", HttpOnly: true, Secure: true})
+		w.WriteHeader(http.StatusOK)
+		io.WriteString(w, `{"user":{"id":1},"has_password":true}`)
+	}))
+	t.Cleanup(srv.Close)
+
+	c := NewClient(srv.URL)
+	c.SetSession("stale")
+	token, err := c.Login("niklas", "correct horse")
+	if err != nil {
+		t.Fatalf("login: %v", err)
+	}
+	if token != "fresh" || !c.HasSession() {
+		t.Errorf("expected the new token to be kept, got %q", token)
+	}
+	if body != `{"username":"niklas","password":"correct horse"}` {
+		t.Errorf("unexpected body %q", body)
+	}
+	if sentCookie {
+		t.Error("a stale session must not ride along on the login that replaces it")
+	}
+}
+
+func TestLogin_RefusalCarriesTheServersWords(t *testing.T) {
+	c, _ := stub(t, http.StatusUnauthorized, `{"error":"invalid username or password"}`)
+	_, err := c.Login("niklas", "wrong")
+	if !IsUnauthorized(err) || !strings.Contains(err.Error(), "invalid username or password") {
+		t.Errorf("expected the server's 401 message, got %v", err)
+	}
+
+	c, _ = stub(t, http.StatusTooManyRequests, `{"error":"too many attempts"}`)
+	if _, err := c.Login("niklas", "wrong"); err == nil || IsUnauthorized(err) {
+		t.Errorf("a rate limit is not an authentication failure, got %v", err)
+	}
+}
+
+func TestLogin_NoCookieIsAnError(t *testing.T) {
+	c, _ := stub(t, http.StatusOK, `{}`)
+	if _, err := c.Login("niklas", "pw"); err == nil {
+		t.Error("a 200 without a session cookie is not a sign-in")
+	}
+}
+
+func TestLogout_ForgetsTheSession(t *testing.T) {
+	c, got := stub(t, http.StatusNoContent, ``)
+	if err := c.Logout(); err != nil {
+		t.Fatalf("logout: %v", err)
+	}
+	if got.method != "POST" || got.path != "/api/logout" || got.cookie != "test-session" {
+		t.Errorf("unexpected request %s %s cookie=%q", got.method, got.path, got.cookie)
+	}
+	if c.HasSession() {
+		t.Error("the session should be gone locally")
+	}
+}
+
+func TestIsUnauthorized(t *testing.T) {
+	if !IsUnauthorized(&StatusError{Code: 401}) {
+		t.Error("a 401 is unauthorized")
+	}
+	if IsUnauthorized(&StatusError{Code: 403}) || IsUnauthorized(errors.New("x")) || IsUnauthorized(nil) {
+		t.Error("only a 401 means the session is refused; a 403 is a permission")
 	}
 }