feature: the web service creates its key and database itself and shows its starting phase.

debian-package/src/usr/lib/vpn-router/vpnrouter_auth.py

@@ -1,13 +1,13 @@
 """The tokens of the router's web service, for the web service and vpn-router-token.
 
-Tokens are HS256 JWTs signed with WEB_KEY, a key vpn-router-setup makes on the router and that
-never leaves it. /auth issues an access token naming the user in sub, valid ACCESS_SECONDS, and
+Tokens are HS256 JWTs signed with WEB_KEY, a key the web service makes on its first run on the
+router and that never leaves it. /auth issues an access token naming the user in sub, valid ACCESS_SECONDS, and
 a refresh token valid REFRESH_SECONDS; vpn-router-token issues tokens with the admin claim and
 any lifetime. A token without the admin claim must expire within MAX_LIFETIME seconds.
 
 Refresh tokens are random strings kept in PostgreSQL as their SHA-256, in the database of
-web.database, by default the vpn-router database on this host that provision() creates, with
-the password in DATABASE_SECRET. A refresh token is used once: refreshing replaces it.
+web.database, by default the vpn-router database on this host that provision() creates on the
+web service's first run, with the password in DATABASE_SECRET. A refresh token is used once: refreshing replaces it.
 """
 
 import base64
@@ -42,7 +42,7 @@ SCHEMA = 'CREATE TABLE IF NOT EXISTS refresh_tokens (hash text PRIMARY KEY, name
 
 
 def key():
-    """The signing key, or '' while vpn-router-setup has not made it."""
+    """The signing key, or '' while the web service has not made it."""
     try:
         return WEB_KEY.read_text(encoding='utf-8').strip()
     except OSError:
@@ -106,7 +106,7 @@ def admin_token(seconds):
     """A token with the admin claim, valid for the seconds given."""
     secret = key()
     if not secret:
-        raise OSError(f'{WEB_KEY} does not exist; vpn-router-setup makes it once a platform is chosen')
+        raise OSError(f'{WEB_KEY} does not exist; vpn-router-web makes it when it starts')
     now = int(time.time())
     return {'token': sign({'admin': True, 'iat': now, 'exp': now + seconds}, secret), 'expires': now + seconds}