feat(auth): add CSRF tokens, styled 403, login rate-limit, mr user CLI, per-role E2E

Implements the remaining deferred hardening/completeness groups for the opt-in
user-accounts/RBAC feature. All of it is auth-gated, so the auth-off default
deployment is byte-for-byte unchanged (verified by the green auth-off E2E run).

Group B — hardening
- Synchronizer-token CSRF (defense-in-depth atop SameSite=Lax). Each session
  carries a random Session.CsrfToken, published via a <meta> tag, /v1/auth/me,
  and the template chokepoint. withCSRFProtection (authn -> CSRF -> authz)
  rejects state-changing cookie-authenticated requests whose token is missing or
  wrong. The token is read from the X-CSRF-Token header, the csrf_token query
  param (native multipart upload forms), or an urlencoded body field — never
  from a multipart/JSON body, so per-upload size limits are preserved. Bearer,
  auth-off, safe methods, the login/logout flow, and read-via-POST are exempt.
  JS wraps fetch + native form submits to attach the token automatically.
- Styled 403 page (RenderForbidden, mirroring RenderNotFound); denyAccess and
  denyCSRF render it for browser navigations, JSON stays machine-readable.
- Per-IP login rate-limit (in-memory sliding window) via -login-max-attempts /
  -login-attempt-window (default off / no-op).

Group C — mr user admin CLI
- user list|get|create|update|delete (update is a client-side partial update,
  since the API is a full replace). Registered, CLI docs regenerated.

Group D — test matrix
- Auth-enabled ephemeral E2E server + auth.fixture.ts (seeds the four roles and
  in/out-of-scope groups) + dedicated `auth` Playwright project with per-role
  access, scope-confinement, and login-page a11y specs.
- Fixed a real WCAG bug surfaced by the new a11y specs: login button contrast
  (bg-amber-600, 3.4:1) -> bg-amber-700 (AA), matching the standard submit button.

Tests: full Go unit suite (sqlite + postgres) green; new csrf/forbidden/
rate-limit Go tests; full browser+CLI E2E green (1537 passed, 2 known flakes);
auth E2E (12) green on both sqlite and postgres; staticcheck clean; mr docs lint OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: egeozcan

CLAUDE.md

@@ -146,6 +146,8 @@ All settings can be configured via environment variables (in `.env`) or command-
 | `-session-cookie-secure` | `SESSION_COOKIE_SECURE=1` | Mark the session cookie `Secure` (HTTPS-only). Enable behind TLS. |
 | `-create-admin-user` | `CREATE_ADMIN_USER` | Bootstrap: create (or reset to enabled admin) this username at startup. Idempotent. Requires `-create-admin-password`. |
 | `-create-admin-password` | `CREATE_ADMIN_PASSWORD` | Password for `-create-admin-user`. |
+| `-login-max-attempts` | `LOGIN_MAX_ATTEMPTS` | Max failed login attempts per client IP within `-login-attempt-window` before throttling with HTTP 429. `0` (default) disables login rate-limiting. In-memory and per-process (counters reset on restart). |
+| `-login-attempt-window` | `LOGIN_ATTEMPT_WINDOW` | Sliding window for `-login-max-attempts`, and the lockout duration once it is hit (default: 15m). |
 
 ### Authentication & roles
 
@@ -158,7 +160,7 @@ Auth is **opt-in**. With `-auth` set, requests must authenticate via a browser s
 
 Group-limited users/guests are confined to their scope group and all of its descendants across lists, single-item reads, search, MRQL, file serving, group export, and writes (fail-closed). Bootstrap the first admin with `-create-admin-user`/`-create-admin-password`. The `mr` CLI authenticates with `mr auth login` (stores an API token) or the `MR_TOKEN` env var.
 
-CSRF: the session cookie is `SameSite=Lax`, which blocks cross-site state-changing (POST/PUT/DELETE) requests; API-token (Bearer) requests carry no ambient cookie and are not CSRF-exposed.
+CSRF: the session cookie is `SameSite=Lax`, which blocks cross-site state-changing (POST/PUT/DELETE) requests; API-token (Bearer) requests carry no ambient cookie and are not CSRF-exposed. Layered on top of that baseline is a per-session synchronizer token (defense-in-depth): each session carries a random `Session.CsrfToken`, published to the page in a `<meta name="csrf-token">` tag and on `/v1/auth/me`. State-changing, cookie-authenticated requests must echo it via the `X-CSRF-Token` header (the JS `fetch` wrapper adds it automatically), the `csrf_token` query parameter (native multipart upload forms), or a `csrf_token` urlencoded form field; the `withCSRFProtection` middleware rejects mismatches with 403. The check is a no-op when auth is disabled, and skips safe methods, the login/logout flow, read-via-POST endpoints, and Bearer requests. The CSRF middleware never reads multipart or JSON bodies, so per-upload size limits are preserved.
 
 Alternative file systems via flags use format `-alt-fs=key:path` (can be repeated).
 Via env vars, use `FILE_ALT_COUNT=N` with `FILE_ALT_NAME_1`, `FILE_ALT_PATH_1`, etc.

application_context/auth_config.go

@@ -28,3 +28,22 @@ func (ctx *MahresourcesContext) SessionTTL() time.Duration {
 	}
 	return ctx.Config.SessionTTL
 }
+
+// LoginRateLimit returns the max failed login attempts per client IP within
+// LoginRateWindow before throttling. 0 (the default) disables rate-limiting.
+func (ctx *MahresourcesContext) LoginRateLimit() int {
+	if ctx.Config.LoginRateLimit < 0 {
+		return 0
+	}
+	return ctx.Config.LoginRateLimit
+}
+
+// LoginRateWindow returns the sliding window over which failed logins are
+// counted (and the lockout duration once the limit is hit), defaulting to 15
+// minutes when rate-limiting is enabled but no window is configured.
+func (ctx *MahresourcesContext) LoginRateWindow() time.Duration {
+	if ctx.Config.LoginRateWindow <= 0 {
+		return 15 * time.Minute
+	}
+	return ctx.Config.LoginRateWindow
+}

application_context/context.go

@@ -124,6 +124,13 @@ type MahresourcesConfig struct {
 	SessionCookieName string
 	// SessionCookieSecure marks the session cookie Secure (HTTPS-only).
 	SessionCookieSecure bool
+	// LoginRateLimit is the number of failed login attempts permitted from a
+	// single client IP within LoginRateWindow before further attempts are
+	// throttled (HTTP 429). 0 disables login rate-limiting.
+	LoginRateLimit int
+	// LoginRateWindow is the sliding window over which failed login attempts are
+	// counted (and the lockout duration once the limit is hit).
+	LoginRateWindow time.Duration
 }
 
 // MahresourcesInputConfig holds all configuration options that can be passed
@@ -211,6 +218,11 @@ type MahresourcesInputConfig struct {
 	SessionTTL time.Duration
 	// SessionCookieSecure marks the session cookie Secure (HTTPS-only).
 	SessionCookieSecure bool
+	// LoginRateLimit caps failed login attempts per client IP within
+	// LoginRateWindow before throttling (0 disables it).
+	LoginRateLimit int
+	// LoginRateWindow is the sliding window for LoginRateLimit.
+	LoginRateWindow time.Duration
 	// CreateAdminUser/CreateAdminPassword bootstrap an admin account at startup
 	// when set. Idempotent: an existing account with that username is reset to an
 	// enabled admin with the given password.
@@ -905,6 +917,8 @@ func CreateContextWithConfig(cfg *MahresourcesInputConfig) (*MahresourcesContext
 		SessionTTL:                   sessionTTL,
 		SessionCookieName:            "mr_session",
 		SessionCookieSecure:          cfg.SessionCookieSecure,
+		LoginRateLimit:               cfg.LoginRateLimit,
+		LoginRateWindow:              cfg.LoginRateWindow,
 	}), db, mainFs
 }
 

application_context/session_context.go

@@ -26,10 +26,15 @@ func (ctx *MahresourcesContext) CreateSession(userID uint, ttl time.Duration, us
 	if err != nil {
 		return "", nil, err
 	}
+	csrf, err := auth.GenerateToken()
+	if err != nil {
+		return "", nil, err
+	}
 	now := time.Now()
 	session := &models.Session{
 		UserId:     userID,
 		TokenHash:  auth.HashToken(raw),
+		CsrfToken:  csrf,
 		ExpiresAt:  now.Add(ttl),
 		LastSeenAt: now,
 		UserAgent:  userAgent,

auth/context.go

@@ -6,6 +6,7 @@ import "context"
 type contextKey struct{ name string }
 
 var principalKey = contextKey{"principal"}
+var csrfTokenKey = contextKey{"csrfToken"}
 
 // WithPrincipal returns a child context carrying the authenticated principal.
 func WithPrincipal(ctx context.Context, p *Principal) context.Context {
@@ -21,3 +22,20 @@ func PrincipalFromContext(ctx context.Context) *Principal {
 	p, _ := ctx.Value(principalKey).(*Principal)
 	return p
 }
+
+// WithCSRFToken returns a child context carrying the session's CSRF synchronizer
+// token. Only set for cookie-authenticated requests; Bearer requests carry no
+// token (and are exempt from CSRF checks).
+func WithCSRFToken(ctx context.Context, token string) context.Context {
+	return context.WithValue(ctx, csrfTokenKey, token)
+}
+
+// CSRFTokenFromContext returns the session CSRF token stored on the context, or
+// "" if none is present.
+func CSRFTokenFromContext(ctx context.Context) string {
+	if ctx == nil {
+		return ""
+	}
+	t, _ := ctx.Value(csrfTokenKey).(string)
+	return t
+}