feat: expand companion platform, device controls, and memoir workflows

Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.

internal/onboarding/operator_login_test.go

@@ -0,0 +1,158 @@
+package onboarding
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/google/uuid"
+)
+
+func newOperatorLoginFixture(t *testing.T) *loginFixture {
+	f := newLoginFixture(t)
+	f.s = f.s.operatorView()
+	f.newLoginSession()
+	f.mux.Handle("POST /operator-write", f.s.CustomerAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(204) })))
+	return f
+}
+
+func operatorPasswordSession(t *testing.T, f *loginFixture, password string) (*http.Cookie, string) {
+	t.Helper()
+	if f.trusted == nil || f.trusted.Name != f.s.trustedLoginCookieName() {
+		f.trustDeviceForTest()
+	}
+	in := PasswordLoginInput{Phone: f.phone, Password: password, CaptchaID: f.knownCaptcha(), CaptchaCode: "654321"}
+	w, data := f.request("POST", "/api/v1/web/login/password", in, f.cookie, f.csrf, "")
+	if w.Code != 200 {
+		t.Fatal(w.Body.String())
+	}
+	for _, c := range w.Result().Cookies() {
+		if c.Name == f.s.cookieName(true) {
+			return c, data["csrf_token"].(string)
+		}
+	}
+	t.Fatal("missing operator cookie")
+	return nil, ""
+}
+
+func TestOperatorPhoneLoginKeepsRolesAndIsolatesCustomerSession(t *testing.T) {
+	f := newOperatorLoginFixture(t)
+	_, err := f.s.ProvisionOperatorPhone(f.ctx, f.operatorID, f.p.Issuer, f.p.Subject, f.phone, "OperatorOnly123!", uuid.NewString())
+	must(t, err)
+	account, csrf := operatorPasswordSession(t, f, "OperatorOnly123!")
+	if account.Name != "__Host-platform-operator" || !account.Secure || !account.HttpOnly || account.SameSite != http.SameSiteLaxMode {
+		t.Fatal("operator cookie protections")
+	}
+	p, err := f.s.AccountPrincipal(f.ctx, account.Value, csrf, true)
+	must(t, err)
+	if p.Subject != f.p.Subject {
+		t.Fatal("wrong operator identity")
+	}
+	w, _ := f.request("POST", "/operator-write", struct{}{}, account, "wrong", "")
+	if w.Code != 403 {
+		t.Fatal("CSRF bypass")
+	}
+	w, _ = f.request("POST", "/operator-write", struct{}{}, account, csrf, "")
+	if w.Code != 204 {
+		t.Fatal(w.Body.String())
+	}
+	r := httptest.NewRequest("POST", "https://platform.example/operator-write", strings.NewReader("{}"))
+	r.Header.Set("Origin", "https://other.example")
+	r.Header.Set("X-CSRF-Token", csrf)
+	r.AddCookie(account)
+	w2 := httptest.NewRecorder()
+	f.mux.ServeHTTP(w2, r)
+	if w2.Code != 403 {
+		t.Fatal("cross-origin operator write")
+	}
+	_, state := f.request("GET", "/api/v1/web/account/password", nil, account, "", "")
+	if state["password_configured"] != true || state["sms_verified_recently"] != false {
+		t.Fatal("password login granted SMS proof")
+	}
+
+	// A phone can be registered in both portals without linking their identities.
+	customer := *f.s
+	customer.operatorLogin = false
+	_, err = customer.ProvisionCustomerPhone(f.ctx, f.web.UserID, f.user.Issuer, f.user.Subject, f.phone, "CustomerOnly123!", uuid.NewString())
+	must(t, err)
+	if _, err = customer.AccountPrincipal(f.ctx, account.Value, csrf, true); err == nil {
+		t.Fatal("operator token crossed into customer table")
+	}
+	cf := *f
+	cf.fixture = &fixture{}
+	*cf.fixture = *f.fixture
+	cf.s = &customer
+	cf.newLoginSession()
+	cc, ccsrf := operatorPasswordSession(t, &cf, "CustomerOnly123!")
+	if _, err = f.s.AccountPrincipal(f.ctx, cc.Value, ccsrf, true); err == nil {
+		t.Fatal("customer token granted operator access")
+	}
+
+	f.newLoginSession()
+	second, _ := operatorPasswordSession(t, f, "OperatorOnly123!")
+	w, _ = f.request("POST", "/api/v1/web/account/password", SetPasswordInput{Password: "ChangedOperator123!", CurrentPassword: "OperatorOnly123!"}, account, csrf, "")
+	if w.Code != 200 {
+		t.Fatal(w.Body.String())
+	}
+	if _, err = f.s.AccountPrincipal(f.ctx, second.Value, "", false); err == nil {
+		t.Fatal("password change kept another operator session")
+	}
+	if _, err = customer.AccountPrincipal(f.ctx, cc.Value, "", false); err != nil {
+		t.Fatal("operator password change revoked customer", err)
+	}
+	w, _ = f.request("POST", "/api/v1/web/auth/logout", struct{}{}, account, csrf, "")
+	if w.Code != 200 {
+		t.Fatal(w.Body.String())
+	}
+	if _, err = f.s.AccountPrincipal(f.ctx, account.Value, "", false); err == nil {
+		t.Fatal("operator logout not revoked")
+	}
+	if _, err = customer.AccountPrincipal(f.ctx, cc.Value, "", false); err != nil {
+		t.Fatal("operator logout revoked customer", err)
+	}
+}
+
+func TestOperatorSMSOnlyAllowsProvisionedActiveOperators(t *testing.T) {
+	f := newOperatorLoginFixture(t)
+	if _, err := f.s.ProvisionOperatorPhone(f.ctx, f.web.UserID, f.user.Issuer, f.user.Subject, f.phone, "OperatorOnly123!", uuid.NewString()); err == nil {
+		t.Fatal("customer promoted by provisioning")
+	}
+	id := f.send()
+	w, _ := f.request("POST", "/api/v1/web/login/sms/verify", SMSVerifyInput{ChallengeID: id, Code: f.sender.code}, f.cookie, f.csrf, "")
+	if w.Code != 403 {
+		t.Fatal("unregistered operator accepted", w.Body.String())
+	}
+	var count int
+	must(t, f.s.pool.QueryRow(f.ctx, `SELECT count(*) FROM operator_phone_credential WHERE phone_digest=$1`, domainMAC(f.s.crypt.hashKey, "PHONE1\n"+f.phone)).Scan(&count))
+	if count != 0 {
+		t.Fatal("SMS registered operator")
+	}
+	_, err := f.s.ProvisionOperatorPhone(f.ctx, f.operatorID, f.p.Issuer, f.p.Subject, f.phone, "OperatorOnly123!", uuid.NewString())
+	must(t, err)
+	w, data := f.request("POST", "/api/v1/web/login/sms/verify", SMSVerifyInput{ChallengeID: id, Code: f.sender.code}, f.cookie, f.csrf, "")
+	if w.Code != 200 {
+		t.Fatal(w.Body.String())
+	}
+	var account *http.Cookie
+	for _, c := range w.Result().Cookies() {
+		if c.Name == f.s.cookieName(true) {
+			account = c
+		}
+	}
+	if account == nil {
+		t.Fatal("missing operator SMS session")
+	}
+	w, _ = f.request("POST", "/api/v1/web/account/password", SetPasswordInput{Password: "ResetOperator123!"}, account, data["csrf_token"].(string), "")
+	if w.Code != 200 {
+		t.Fatal("SMS reset failed", w.Body.String())
+	}
+	_, err = f.s.pool.Exec(f.ctx, `UPDATE user_account SET status='disabled' WHERE id=$1::uuid`, f.operatorID)
+	must(t, err)
+	t.Cleanup(func() {
+		_, _ = f.s.pool.Exec(f.ctx, `UPDATE user_account SET status='active' WHERE id=$1::uuid`, f.operatorID)
+	})
+	if _, err = f.s.AccountPrincipal(f.ctx, account.Value, "", false); err == nil {
+		t.Fatal("disabled operator session accepted")
+	}
+}