✨ Backend Auth, CSRF, and Security Headers

[ebigunso]

Summary

This PR implements PR-A: single-user session authentication, double-submit CSRF protection, and security headers for the Axum backend. It protects the /trends UI route and all mutating API routes, while keeping non‑mutating GET routes open.

Key changes

• Auth
  • Added /login (GET/POST) and /logout endpoints
  • Encrypted + signed session cookie __Host-session (Secure, HttpOnly, SameSite=Lax, Path=/) via axum-extra PrivateCookieJar
  • AppState introduced with Db + Key; FromRef implemented for Db and Key
  • RequireSessionJson (401 JSON on unauthenticated) and RequireSessionRedirect (302 to /login for UI)
• CSRF (double-submit)
  • Issued __Host-csrf cookie (Secure, SameSite=Lax, Path=/; not HttpOnly), URL‑safe base64 token
  • CsrfGuard verifies header X-CSRF-Token equals the cookie value (percent-decoding supported) for POST/PUT/DELETE
  • Same-site heuristic using Sec-Fetch-Site if present
• Security headers
  • X-Content-Type-Options: nosniff
  • X-Frame-Options: DENY
  • Referrer-Policy: strict-origin-when-cross-origin
  • Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'
  • Strict-Transport-Security when ENABLE_HSTS=1/true
• Route protection
  • /trends protected via RequireSessionRedirect
  • Mutating routes protected via RequireSessionJson + CsrfGuard:
    • POST /sleep, PUT /sleep/{id}, DELETE /sleep/{id}
    • POST /exercise, POST /note
  • Open routes remain: GET /health, GET /sleep/date/{date}, GET /api/trends/*
• Config and tooling
  • .env.example with ADMIN_EMAIL, ADMIN_PASSWORD_HASH, SESSION_SECRET, CSRF_SECRET placeholder, ENABLE_HSTS
  • session_key() derives Key from SESSION_SECRET or generates fallback
  • hsts_enabled() reads ENABLE_HSTS
  • pw-hash helper (cargo run -p sleep-api --bin pw-hash) to generate Argon2id hashes
• Documentation
  • Added module and item docs for auth, CSRF, headers, middleware extractors, AppState, config helpers, and pw-hash, with examples and references

Tests

• New: tests/auth_csrf.rs validates:
  • Unauth /trends redirects to /login
  • Login emits __Host-session and __Host-csrf
  • Mutating without CSRF → 403; with matching header + cookie → success
  • Logout → subsequent mutating returns 401
• Updated: tests/api_sleep.rs and tests/trends_bars.rs
  • Added login step, send Cookie (__Host‑session, __Host‑csrf) + X‑CSRF‑Token for mutating calls
  • Bound to 127.0.0.2 for isolation

Quality gates

• cargo clippy -- -D warnings passes
• cargo test -p sleep-api passes (unit, integration, doc tests)

Security & operational notes

• __Host- cookies require Secure and Path=/; browsers won’t persist over plain HTTP. Automated tests are unaffected. For local browser dev, use TLS (reverse proxy/local certs) or feature-gate for HTTP if necessary.
• Session is cookie-only; optional session expiry/idle timeouts can be added later.

Follow-ups (optional)

• Add session expiry/idle timeouts and login rate limiting
• Tighten CSP in a future PR (remove 'unsafe-inline', add nonces)
• Expand frontend UI for login

[Copilot]

Pull Request Overview

This PR implements comprehensive security features for the Axum backend including single-user session authentication, double-submit CSRF protection, and security headers. It protects the /trends UI route and all mutating API routes while keeping GET routes open for public access.

Key changes:

• Added session-based authentication with encrypted cookies and login/logout endpoints
• Implemented double-submit CSRF protection for all mutating requests (POST/PUT/DELETE)
• Added security headers including CSP, X-Frame-Options, and optional HSTS

Reviewed Changes

Copilot reviewed 16 out of 18 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
sleep-api/tests/trends_bars.rs	Updated test to include authentication flow and CSRF token handling
sleep-api/tests/auth_csrf.rs	New comprehensive test validating authentication and CSRF protection
sleep-api/tests/api_sleep.rs	Updated existing API tests to authenticate and send CSRF tokens
sleep-api/src/trends.rs	Minor string formatting improvement using string interpolation
sleep-api/src/security/mod.rs	New module documentation for security utilities
sleep-api/src/security/headers.rs	Implementation of security headers middleware
sleep-api/src/security/csrf.rs	CSRF protection implementation with double-submit cookie pattern
sleep-api/src/middleware/mod.rs	New middleware module documentation
sleep-api/src/middleware/auth_layer.rs	Authentication extractors for session validation
sleep-api/src/main.rs	Added new module declarations
sleep-api/src/lib.rs	Exposed new modules in public API
sleep-api/src/config.rs	Added configuration helpers for auth credentials and secrets
sleep-api/src/auth.rs	Core authentication utilities for session management
sleep-api/src/app.rs	Updated router with authentication routes and middleware
sleep-api/Cargo.toml	Added required dependencies for authentication and CSRF
.env.example	Configuration template with security settings