Rework configuration file format.

The "users" entry is now a dictionary mapping user names to
passwords and permissions.  In order to allow for wildcards,
there is a new type of password, the wildcard password, and
an extra array called "fallback-users".

The field "allow-anonymous" no longer exists, this is now
the default behaviour.  The field "allow-subgroups" has been
renamed to "auto-subgroups".

We provide backwards compatibility for group definition files,
but not for the config.json file, where the old "admin" array
is simply ignored.

webserver/webserver.go

@@ -466,13 +466,24 @@ func adminMatch(username, password string) (bool, error) {
 		return false, err
 	}
 
-	for _, cred := range conf.Admin {
-		if cred.Username == "" || cred.Username == username {
-			if ok, _ := cred.Password.Match(password); ok {
+	u, found := conf.Users[username]
+	if found {
+		ok, err := u.Password.Match(password)
+		if err != nil {
+			return false, err
+		}
+		if !ok {
+			return false, nil
+		}
+		perms := u.Permissions.Permissions(nil)
+		for _, p := range perms {
+			if p == "admin" {
 				return true, nil
 			}
 		}
+		return false, nil
 	}
+
 	return false, nil
 }
 

webserver/webserver_test.go

@@ -8,8 +8,9 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/jech/galene/group"
 	"github.com/pion/webrtc/v3"
+
+	"github.com/jech/galene/group"
 )
 
 func TestParseGroupName(t *testing.T) {
@@ -190,6 +191,54 @@ func TestFormatICEServer(t *testing.T) {
 	}
 }
 
+func TestMatchAdmin(t *testing.T) {
+	d := t.TempDir()
+	group.DataDirectory = d
+
+	filename := filepath.Join(d, "config.json")
+	f, err := os.Create(filename)
+	if err != nil {
+		t.Fatalf("Create %v: %v", filename, err)
+	}
+	f.Write([]byte(`{
+	    "users": {
+		"root": {"password": "pwd", "permissions": "admin"},
+		"notroot": {"password": "pwd"}
+	    }
+	}`))
+	f.Close()
+
+	ok, err := adminMatch("jch", "pwd")
+	if ok || err != nil {
+		t.Errorf("jch: %v %v", ok, err)
+	}
+
+	ok, err = adminMatch("root", "pwd")
+	if !ok || err != nil {
+		t.Errorf("root: %v %v", ok, err)
+	}
+
+	ok, err = adminMatch("root", "notpwd")
+	if ok || err != nil {
+		t.Errorf("root: %v %v", ok, err)
+	}
+
+	ok, err = adminMatch("root", "")
+	if ok || err != nil {
+		t.Errorf("root: %v %v", ok, err)
+	}
+
+	ok, err = adminMatch("notroot", "pwd")
+	if ok || err != nil {
+		t.Errorf("notroot: %v %v", ok, err)
+	}
+
+	ok, err = adminMatch("notroot", "notpwd")
+	if ok || err != nil {
+		t.Errorf("notroot: %v %v", ok, err)
+	}
+}
+
 func TestObfuscate(t *testing.T) {
 	id := newId()
 	obfuscated, err := obfuscate(id)