Add DB-backed application tokens for the update endpoint

app/admin/application_tokens.rb

@@ -0,0 +1,96 @@
+ActiveAdmin.register WarpEngine::ApplicationToken, as: "Application Token" do
+  actions :index, :show, :new, :create, :edit, :update, :destroy
+  permit_params :name, :owner_id, :expires_at, :scopes_string
+
+  menu priority: 9, label: "🎟️ App Tokens"
+
+  config.sort_order = "created_at_desc"
+  config.batch_actions = false
+
+  scope :all, default: true
+  scope("Active")  { |scope| scope.where("expires_at IS NULL OR expires_at > ?", Time.current) }
+  scope("Expired") { |scope| scope.where("expires_at <= ?", Time.current) }
+
+  index do
+    id_column
+    column :name
+    column("Token") { |t| code "#{t.token_prefix}…", style: "font-family:monospace;" }
+    column("Owner") { |t| t.owner.try(:email) || t.owner.try(:name) || "#{t.owner_type} ##{t.owner_id}" }
+    column("Scopes") { |t| t.scopes_string }
+    column :expires_at
+    column :last_used_at
+    column :created_at
+    actions
+  end
+
+  filter :name_cont, label: "Name"
+  filter :token_prefix_cont, label: "Token prefix"
+  filter :expires_at
+  filter :last_used_at
+
+  form do |f|
+    owner_class = WarpEngine.config.application_token_owner_class&.safe_constantize
+    f.inputs do
+      if f.object.new_record?
+        if owner_class
+          f.input :owner_id, as: :select, label: owner_class.name,
+                  collection: owner_class.all.map { |o| [ o.try(:email) || o.try(:name) || "##{o.id}", o.id ] },
+                  include_blank: false
+        else
+          f.template.concat(f.template.content_tag(:li,
+            "application_token_owner_class nincs beállítva — token nem hozható létre.",
+            class: "flash flash_error"))
+        end
+      end
+      f.input :name
+      f.input :scopes_string, label: "Scopes (comma separated)",
+              hint: %(A /update végponthoz az "update" scope kell.)
+      f.input :expires_at, hint: "Üresen hagyva sosem jár le."
+    end
+    f.actions
+  end
+
+  show do
+    if (plain = controller.instance_variable_get(:@plain_token))
+      panel "⚠️ Token — csak most látható, másold ki!" do
+        pre plain, style: "font-family:monospace;font-size:14px;padding:8px;background:#fff3cd;user-select:all;"
+      end
+    end
+    attributes_table do
+      row :id
+      row :name
+      row("Token") { |t| code "#{t.token_prefix}… (SHA256 digest tárolva)" }
+      row("Owner") { |t| "#{t.owner_type} ##{t.owner_id} — #{t.owner.try(:email) || t.owner.try(:name)}" }
+      row("Scopes") { |t| t.scopes_string }
+      row :expires_at
+      row :last_used_at
+      row :created_at
+      row :updated_at
+    end
+  end
+
+  controller do
+    # A plain token csak közvetlenül a létrehozás után létezik; a session-ön át
+    # jut el az egyszeri megjelenítésig (a flash nem jó: az AA layout minden
+    # flash kulcsot üzenetsávként renderel).
+    def create
+      create! do |success, _failure|
+        success.html do
+          session[:warp_engine_plain_token] = resource.plain_token
+          redirect_to resource_path(resource) and return
+        end
+      end
+    end
+
+    def show
+      @plain_token = session.delete(:warp_engine_plain_token)
+      show!
+    end
+
+    # Revoke = soft delete, audit-nyommal.
+    def destroy
+      resource.revoke!
+      redirect_to collection_path, notice: "Token revoked."
+    end
+  end
+end

app/controllers/warp_engine/update_controller.rb

@@ -15,7 +15,7 @@ module WarpEngine
     end
 
     api :GET, "/update", "Update software version in database"
-    param :secret, String, required: true, desc: "Authorization secret"
+    param :secret, String, required: true, desc: "Shared secret or application token (X-Update-Secret header preferred)"
     param :platform, String, required: false, desc: "Platform (tic80, love, ebitengine, c64, godot, bevy, phaser)"
     param :name, String, required: false, desc: "Software name"
     param :version, String, required: true, desc: "Version string"
@@ -39,11 +39,35 @@ module WarpEngine
 
     private
 
+    # A hitelesítési forrás kizárólagos: :database módban a shared secret nem
+    # érvényes, :env módban a DB-tokenek nem.
     def authorized?
-      secret = request.headers["X-Update-Secret"].presence || params[:secret]
+      token = request.headers["X-Update-Secret"].presence || params[:secret].presence
+      return false if token.blank?
+
+      case WarpEngine.config.update_secret_source
+      when :database then database_token_authorized?(token)
+      else env_secret_authorized?(token)
+      end
+    end
+
+    def env_secret_authorized?(token)
       expected = WarpEngine.config.update_secret
       # Konfigurálatlan secret esetén az endpoint zárva marad.
-      expected.present? && secret == expected
+      expected.present? && ActiveSupport::SecurityUtils.secure_compare(token, expected)
+    end
+
+    def database_token_authorized?(token)
+      if WarpEngine.config.application_token_owner_class.blank?
+        Rails.logger.error("[UpdateController] update_secret_source=:database, de application_token_owner_class nincs beállítva — minden kérés elutasítva")
+        return false
+      end
+
+      record = WarpEngine::ApplicationToken.authenticate(token, required_scope: WarpEngine::ApplicationToken::UPDATE_SCOPE)
+      return false if record.nil?
+
+      record.touch_last_used!
+      true
     end
   end
 end

app/models/warp_engine/application_token.rb

@@ -0,0 +1,99 @@
+require "digest"
+
+module WarpEngine
+  class ApplicationToken < ApplicationRecord
+    self.table_name = "application_tokens"
+
+    UPDATE_SCOPE = "update".freeze
+
+    # A generált token csak létrehozáskor, memóriában érhető el — a DB-ben
+    # kizárólag a SHA256 digest és a nem-titkos prefix tárolódik.
+    attr_reader :plain_token
+
+    belongs_to :owner, polymorphic: true
+
+    default_scope { where(deleted_at: nil) }
+    scope :active, -> { where("expires_at IS NULL OR expires_at > ?", Time.current) }
+
+    before_validation :assign_owner_type, on: :create
+    before_validation :generate_token, on: :create
+    after_initialize { self.scopes = [] if new_record? && scopes.nil? }
+
+    validates :name, presence: true
+    validates :token_digest, presence: true, uniqueness: true
+    validates :token_prefix, presence: true
+    validates :scopes, presence: true
+    validate :owner_type_matches_configuration
+
+    def self.digest(token)
+      Digest::SHA256.hexdigest(token)
+    end
+
+    # Az élő (nem törölt, nem lejárt), a kért scope-pal rendelkező token, különben nil.
+    def self.authenticate(token, required_scope: nil)
+      return nil if token.blank?
+
+      record = active.find_by(token_digest: digest(token))
+      return nil if record.nil?
+      return nil if required_scope.present? && !Array(record.scopes).include?(required_scope)
+
+      record
+    end
+
+    def expired?
+      expires_at.present? && expires_at <= Time.current
+    end
+
+    # Visszavonás = soft delete, az audit-nyom megmarad.
+    def revoke!
+      update_column(:deleted_at, Time.current)
+    end
+
+    def touch_last_used!
+      update_column(:last_used_at, Time.current)
+    end
+
+    # Admin form: vesszővel elválasztott scope-lista
+    def scopes_string
+      Array(scopes).join(", ")
+    end
+
+    def scopes_string=(value)
+      self.scopes = value.to_s.split(",").map(&:strip).reject(&:blank?).uniq
+    end
+
+    def self.ransackable_attributes(auth_object = nil)
+      %w[created_at deleted_at expires_at id last_used_at name owner_id owner_type token_prefix updated_at]
+    end
+
+    # A polimorf owner asszociációra a Ransack nem tud szűrni.
+    def self.ransackable_associations(auth_object = nil)
+      []
+    end
+
+    private
+
+    def assign_owner_type
+      self.owner_type = WarpEngine.config.application_token_owner_class if owner_type.blank?
+    end
+
+    def generate_token
+      return if token_digest.present?
+
+      @plain_token = SecureRandom.hex(24)
+      self.token_prefix = @plain_token.first(8)
+      self.token_digest = self.class.digest(@plain_token)
+    end
+
+    def owner_type_matches_configuration
+      expected = WarpEngine.config.application_token_owner_class
+      if expected.blank?
+        errors.add(:base, "application_token_owner_class is not configured")
+      elsif owner_type != expected
+        errors.add(:owner_type, "must be #{expected}")
+      end
+    end
+
+    ActiveSupport.run_load_hooks(:warp_engine_application_token, self)
+  end
+end