feature: Manager-only accounts, and the Router Manager's first administrator.

README.md

@@ -324,7 +324,12 @@ is switched on:
 - its own database, `dc=vpn-router,dc=local` in `/var/lib/ldap/vpn-router`, next to the one the
   slapd package creates; root manages it through the local socket, with no administrator
   password;
-- `ou=users` holds one `inetOrgPerson` per user, named by `uid`;
+- `ou=users` holds one entry per user, named by `uid`: an `inetOrgPerson` for a VPN user, an
+  `account` for a Manager-only account (see Managing users);
+- the package's own schema, `cn=vpn-router,cn=schema,cn=config`, under the OID
+  `2.25.98477352595735834532404256531620013001` of the UUID arc: the auxiliary class
+  `vpnRouterAccount` with `MAY ( mail $ vpnRouterScope )`, which Manager-only accounts have, and
+  the attribute `vpnRouterScope`, authorization scopes that nothing reads yet;
 - `ou=groups` holds one `groupOfNames` per group, named by `cn`, with its members' DNs in
   `member` and an optional `description`;
 - `cn=user-manager,ou=services` is the account that changes users and groups; it may write
@@ -346,9 +351,17 @@ The directory is kept on purge.
 
 ### Managing users
 
-`vpn-router-user` manages the users. A user is the directory entry, with a first name, a last
-name and an e-mail address (`givenName`, `sn` and `mail`; `cn` is the first and the last name),
-and a client certificate with the user name as its common name, in `/etc/vpn-router/pki/users`.
+`vpn-router-user` manages the users. A user is a directory entry of one of two kinds, fixed when it
+is added:
+
+- a VPN user, an `inetOrgPerson` with a first name, a last name and an e-mail address
+  (`givenName`, `sn` and `mail`; `cn` is the first and the last name), and a client certificate
+  with the user name as its common name, in `/etc/vpn-router/pki/users`;
+- a Manager-only account, an `account`, `simpleSecurityObject` and `vpnRouterAccount` with the
+  name, the password and an optional e-mail address, for notifications: no names and no
+  certificate, so no VPN access. It can sign in to `/auth` and, as a member of `admins`, manage
+  the router. `add` without the first and the last name adds one; its names cannot be set later.
+
 Passwords and TOTP secrets are read from the first line of standard input. The answer is text: a
 table of the users, the client profile, a TOTP secret or a short message, and a failure is a
 message on standard error.
@@ -358,6 +371,7 @@ after a command its options.
 
 ```sh
 echo 's3cr3t-pass' | vpn-router-user add alice --first-name Alice --last-name Smith --email alice@example.com
+echo 'm4nager-pass' | vpn-router-user add ops
 vpn-router-user update alice --email a.smith@example.com
 vpn-router-user list
 vpn-router-user profile alice > alice.ovpn
@@ -374,8 +388,9 @@ vpn-router-user otp-remove alice
 
 | Command | Effect |
 | --- | --- |
-| `list` | The users with their names and e-mail addresses, whether each is enabled or locked, has a certificate and is enrolled for TOTP |
-| `add <name> --first-name F --last-name L --email E` | Adds the user and issues the certificate; all three are required |
+| `list` | The users with their kind, names and e-mail addresses, whether each is enabled or locked, has a certificate and is enrolled for TOTP |
+| `add <name> --first-name F --last-name L --email E` | Adds a VPN user and issues the certificate |
+| `add <name> [--email E]` | Adds a Manager-only account, with the e-mail address when given; one name without the other two options is refused |
 | `update <name> [--first-name F] [--last-name L] [--email E]` | Changes the names or the e-mail address |
 | `passwd <name>` | Sets the password |
 | `disable <name>`, `enable <name>` | Locks the user out of OpenVPN and `/auth`, and lets the user in again |
@@ -390,9 +405,17 @@ A user name is 1 to 32 lowercase letters, digits and hyphens, starting with a le
 password has 8 to 128 characters; a first or last name has 1 to 64 printable characters; an
 e-mail address has one `@`, no spaces and a dot in its domain; a TOTP secret is 32 base32
 characters, as `otp-new` makes it, and a code 6 digits. Once enrolled, a user logs in to OpenVPN
-and `/auth` with the password followed by a current code. In the answers a user added
-without the names or the e-mail address has them as `null`. The exit status is 0 on success, 2 for an invalid request,
-3 when the user does not exist, 4 when the user exists and 1 for any other failure.
+and `/auth` with the password followed by a current code. In the answers `manager_only` tells the
+kind, and a Manager-only account has its names as `null`; `update` changes only its e-mail
+address, and `--email ''` removes it. Changing a user's password, disabling, unlocking or removing the user also revokes its
+refresh tokens of `/auth`. The exit status is 0 on success, 2 for an invalid request, 3 when the
+user does not exist, 4 when the user exists and 1 for any other failure.
+
+When the Router Manager is installed with an administrator (its debconf questions
+`vpn-router-manager/admin_username` and `admin_password`), its package leaves the answers in
+`/etc/vpn-router-manager/admin.json` (root only). `vpn-router-setup` then creates that user as a
+Manager-only account, adds it to the group `admins`, which it creates when missing, and removes
+the file.
 
 The certificate is also accepted by road-warrior (IKEv2 EAP-TLS) access, which checks
 certificates only, so `disable` does not affect it; `remove` revokes the certificate for both.
@@ -590,9 +613,9 @@ and answer bodies are JSON; a request body is at most 4096 bytes.
 
 | Request | Body | Answer |
 | --- | --- | --- |
-| `GET /users` | | `{"users": [{"name", "enabled", "locked", "certificate", "otp", "first_name", "last_name", "email"}, ...]}` |
-| `POST /users` | `{"name", "password", "first_name", "last_name", "email"}`, all required | 201 and the user |
-| `PUT /users/<name>` | any of `{"first_name", "last_name", "email"}` | the user |
+| `GET /users` | | `{"users": [{"name", "manager_only", "enabled", "locked", "certificate", "otp", "first_name", "last_name", "email"}, ...]}` |
+| `POST /users` | `{"name", "password", "first_name", "last_name", "email"}` for a VPN user; `{"name", "password", "email"?}` for a Manager-only account | 201 and the user |
+| `PUT /users/<name>` | any of `{"first_name", "last_name", "email"}`; for a Manager-only account only `{"email"}`, `""` removing it | the user |
 | `PUT /users/<name>/password` | `{"password": ...}` | the user |
 | `POST /users/<name>/disable` | | the user |
 | `POST /users/<name>/enable` | | the user |