Accounts and sign-in, and fix the read toggle

epAction's redraw closure called itself when handed a row, so Mark read
recursed until the stack blew; it now swaps that row in place. Opening an
item also marks it read, redrawn where it stands so nothing vanishes from
under the pointer on the Unread tab.

Step A of multi-user: users and sessions tables, Argon2id, a session
cookie, ipx user subcommands, and a trusted proxy header for Cloudflare
Zero Trust -- honoured only from a trusted_proxies address. The shared
token still works and is the admin. A new database starts with
admin/ipodderx.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AdXho5tTkjFLeUXKbEjKBh

src/main.rs

@@ -1,3 +1,4 @@
+mod auth;
 mod config;
 mod db;
 mod download;
@@ -67,6 +68,11 @@ enum Command {
     Import { file: PathBuf },
     /// Write subscriptions out as OPML
     Export { file: PathBuf },
+    /// Add, list or remove the accounts that can sign in to the web UI
+    User {
+        #[command(subcommand)]
+        cmd: UserCmd,
+    },
     /// Run the scheduler and serve the control socket
     Daemon {
         /// Serve the web UI on this address, overriding [web] in the config
@@ -75,6 +81,30 @@ enum Command {
     },
 }
 
+#[derive(Subcommand)]
+enum UserCmd {
+    /// Create an account. The password is read from stdin: `echo -n hunter2 | ipx user add ray`
+    Add {
+        name: String,
+        /// May manage other accounts, and is who the shared web token signs in as
+        #[arg(long)]
+        admin: bool,
+        /// Sign-in comes from the proxy instead, so there is no password to set
+        #[arg(long)]
+        no_password: bool,
+    },
+    /// Show the accounts and how each one signs in
+    List,
+    /// Replace a password, read from stdin
+    Passwd { name: String },
+    /// Delete an account and everything it knows: its subscriptions and read state
+    Rm { name: String },
+}
+
+/// What a brand new database starts with, so there is always a way in. Announced loudly
+/// in the log, and the first thing the settings page nags about.
+const DEFAULT_PASSWORD: &str = "ipodderx";
+
 /// Everything a command needs. One per process.
 pub struct Ctx {
     /// Swapped wholesale when the web UI rewrites config.toml, so a running daemon picks
@@ -157,6 +187,7 @@ async fn main() -> Result<()> {
         Command::Status => Some(Cmd::Status),
         Command::List
         | Command::Daemon { .. }
+        | Command::User { .. }
         | Command::Add { .. }
         | Command::Rm { .. }
         | Command::Import { .. }
@@ -191,12 +222,89 @@ async fn main() -> Result<()> {
             add(&ctx, &config_path, &url, folder, keywords).await
         }
         Command::Rm { feed } => rm(&ctx, &config_path, &feed),
+        Command::User { cmd } => user_cmd(&ctx, cmd),
         Command::Import { file } => import(&ctx, &config_path, &file).await,
         Command::Export { file } => export(&ctx, &file),
         _ => run(&ctx, wire_cmd.expect("only List and Daemon have no wire form")).await,
     }
 }
 
+/// Accounts. Passwords come in on stdin so they never reach a shell history or a `ps`
+/// listing.
+fn user_cmd(ctx: &Arc<Ctx>, cmd: UserCmd) -> Result<()> {
+    let read_password = || -> Result<String> {
+        use std::io::Read;
+        let mut buf = String::new();
+        std::io::stdin().read_to_string(&mut buf)?;
+        let pw = buf.trim_end_matches(['\n', '\r']).to_string();
+        if pw.is_empty() {
+            anyhow::bail!("no password on stdin: try `echo -n secret | ipx user ...`");
+        }
+        Ok(pw)
+    };
+
+    match cmd {
+        UserCmd::Add { name, admin, no_password } => {
+            let name = name.trim().to_ascii_lowercase();
+            if name.is_empty() {
+                anyhow::bail!("a name is required");
+            }
+            if ctx.db.user_by_name(&name)?.is_some() {
+                anyhow::bail!("{name} already exists");
+            }
+            let hash = if no_password {
+                None
+            } else {
+                Some(crate::auth::hash_password(&read_password()?)?)
+            };
+            // The first account runs the place; there is nobody else to grant it.
+            let first = ctx.db.users()?.is_empty();
+            ctx.db.create_user(&name, hash.as_deref(), admin || first)?;
+            println!(
+                "added {name}{}{}",
+                if admin || first { " (admin)" } else { "" },
+                if no_password { ", signs in through the proxy" } else { "" }
+            );
+            Ok(())
+        }
+        UserCmd::List => {
+            let users = ctx.db.users()?;
+            if users.is_empty() {
+                println!("no accounts yet: ipx user add <name>");
+            }
+            for u in users {
+                println!(
+                    "{:<20} {:<8} {}",
+                    u.name,
+                    if u.is_admin { "admin" } else { "" },
+                    if u.pass_hash.is_some() { "password" } else { "proxy only" }
+                );
+            }
+            Ok(())
+        }
+        UserCmd::Passwd { name } => {
+            let name = name.trim().to_ascii_lowercase();
+            let user = ctx
+                .db
+                .user_by_name(&name)?
+                .ok_or_else(|| anyhow::anyhow!("no such account: {name}"))?;
+            ctx.db.set_password(user.id, &crate::auth::hash_password(&read_password()?)?)?;
+            println!("password changed for {name}");
+            Ok(())
+        }
+        UserCmd::Rm { name } => {
+            let name = name.trim().to_ascii_lowercase();
+            let user = ctx
+                .db
+                .user_by_name(&name)?
+                .ok_or_else(|| anyhow::anyhow!("no such account: {name}"))?;
+            ctx.db.delete_user(user.id)?;
+            println!("removed {name}");
+            Ok(())
+        }
+    }
+}
+
 async fn run(ctx: &Arc<Ctx>, cmd: Cmd) -> Result<()> {
     match cmd {
         Cmd::Fetch { feed, force } => {
@@ -226,6 +334,16 @@ async fn daemon(
         anyhow::bail!("a daemon is already listening on {}", socket.display());
     }
 
+    // A database with nobody in it cannot be signed into, and an install that predates
+    // accounts still has to serve its owner. Both get the same starting point.
+    if ctx.db.users()?.is_empty() {
+        ctx.db.create_user("admin", Some(&crate::auth::hash_password(DEFAULT_PASSWORD)?), true)?;
+        tracing::warn!(
+            "no accounts yet: created 'admin' with the default password '{DEFAULT_PASSWORD}'. \
+             Change it with `echo -n <password> | ipx user passwd admin`"
+        );
+    }
+
     match migrate_opml_children(&ctx) {
         Ok(n) if n > 0 => tracing::info!(count = n, "moved OPML feeds out of config.toml into the database"),
         Ok(_) => {}