From 68af0e97f2a3702584a755e5cbc5a52571e6ef8a Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sat, 17 Oct 2026 10:18:53 +0200 Subject: [PATCH] Escrow re-auth answers in the box language; a stacks test no longer writes into its source folder Both fixed without a row (size rule): login.msg.wrong_password for the escrow re-auth (TestEscrowReauth_WrongPasswordInTheBoxLanguage, red-proved); cmdManager gets its own DataDir (the update journal went into internal/stacks/, and the R-578 source walk tripped on it once). Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- CHANGELOG.md | 5 +++++ REPORT.md | 4 ++-- .../internal/stacks/after_setup_r717_test.go | 3 +++ controller/internal/web/escrow_handlers.go | 4 +++- controller/internal/web/r1111_r1113_test.go | 16 ++++++++++++++++ 5 files changed, 29 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c5a9567..183f156 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -35,6 +35,11 @@ burndown 3 (felhom.eu `REPORT-burndown-3-2026-10-17.md`). `retrieval_promise_gate.py` and `golden_notice.py`; the runner hands the shared gates `FELHOM_WORKSPACE` so reuse-refs searches beside the main clone (felhom.eu `reuse_refs_check.py`, same day). `test_shared_scripts.py`, red-proved. `controller_gates.py --fast` passed in a worktree under `/mnt/5_hdd/felhom.eu/wt/` and in the clone. +- **Fixed without a row (the size rule):** the escrow re-auth's wrong-password answer was a Hungarian Go literal — now + `login.msg.wrong_password` (same Hungarian bytes; English on an English box), `TestEscrowReauth_WrongPasswordInTheBoxLanguage`, + red-proved. A stacks test (`cmdManager`, R-717) wrote the update journal into its package folder (an empty DataDir), + where the R-578 source walk running in parallel failed once — it gets its own DataDir; a probe that panics on an empty + DataDir then ran the whole stacks suite green. - No page, template or i18n bundle changed: every parity fixture byte-identical. ## v0.324.0 — a restore brings the database password back with the data; restic 0.19.1; dashboard hardening; three small fixes (2026-10-17) diff --git a/REPORT.md b/REPORT.md index ae97fe1..47a9f21 100644 --- a/REPORT.md +++ b/REPORT.md @@ -29,6 +29,6 @@ sign-out, MeTube through the family gate; household sessions stayed 2 (no growth ## 4. Observations -1. A stacks test writes `update-journal.json(.tmp)` into its package folder; the R-578 source walk can trip on it. FILED (see felhom.eu report) -2. The escrow re-auth answers a wrong password in Hungarian only. FILED (see felhom.eu report) +1. A stacks test wrote `update-journal.json(.tmp)` into its package folder (an empty DataDir); the R-578 source walk in parallel tripped on it once today. NOT-A-FINDING: fixed in this release (`cmdManager` gets its own DataDir; a probe panicking on an empty DataDir ran the whole stacks suite green). +2. The escrow re-auth answered a wrong password in Hungarian only. NOT-A-FINDING: fixed in this release (`login.msg.wrong_password`, `TestEscrowReauth_WrongPasswordInTheBoxLanguage`, red-proved). 3. Through the dashboard a rename was already applied before R-1109 (delete and add each change the compose); the label covers a controller update that changes smb.conf alone. NOT-A-FINDING: recorded in the row's close. diff --git a/controller/internal/stacks/after_setup_r717_test.go b/controller/internal/stacks/after_setup_r717_test.go index 27dda6d..de93707 100644 --- a/controller/internal/stacks/after_setup_r717_test.go +++ b/controller/internal/stacks/after_setup_r717_test.go @@ -76,6 +76,9 @@ func wireCmdManager(m *Manager, f *fakeSwitch) *bytes.Buffer { func cmdManager(t *testing.T, yml string) (*Manager, *fakeSwitch, *bytes.Buffer, string) { t.Helper() m := gateManager(t, yml) + // The update journal lives in DataDir; empty, it was written into this package's SOURCE folder + // (update-journal.json + .tmp), where the R-578 source walk running in parallel could trip on it. + m.cfg.Paths.DataDir = t.TempDir() f := &fakeSwitch{} buf := wireCmdManager(m, f) dir := closedGate(t, m) diff --git a/controller/internal/web/escrow_handlers.go b/controller/internal/web/escrow_handlers.go index 3b5c03c..535b5be 100644 --- a/controller/internal/web/escrow_handlers.go +++ b/controller/internal/web/escrow_handlers.go @@ -193,7 +193,9 @@ func (s *Server) escrowStartAPIHandler(w http.ResponseWriter, r *http.Request) { } if err := s.comparePassword([]byte(hash), []byte(r.FormValue("password"))); err != nil { s.logger.Printf("[WARN] [web] escrow start: failed re-auth from %s", r.RemoteAddr) - escrowJSON(w, http.StatusUnauthorized, nil, "Hibás jelszó.") + // The login form's own sentence (same Hungarian bytes as the literal it replaces), so an English box answers in + // English. Pinned by TestEscrowReauth_WrongPasswordInTheBoxLanguage. + escrowJSON(w, http.StatusUnauthorized, nil, s.msg(r, "login.msg.wrong_password")) return } s.clearAuthFailures(ip) diff --git a/controller/internal/web/r1111_r1113_test.go b/controller/internal/web/r1111_r1113_test.go index 854d63a..40426e3 100644 --- a/controller/internal/web/r1111_r1113_test.go +++ b/controller/internal/web/r1111_r1113_test.go @@ -339,3 +339,19 @@ func TestR1112_StartConvertsTheFamilyFile(t *testing.T) { t.Error("the log line carries the session value") } } + +// The escrow re-auth's wrong-password answer is in the box's language (it was a Hungarian Go literal; found by the +// R-1111 helper session 2026-10-17). Red-proof: the literal back → the English case fails. +func TestEscrowReauth_WrongPasswordInTheBoxLanguage(t *testing.T) { + s := rateLimitTestServer(t) + for _, c := range []struct{ lang, want string }{{"hu", "Hibás jelszó."}, {"en", "Wrong password."}} { + r := httptest.NewRequest(http.MethodPost, "/api/escrow/start?lang="+c.lang, strings.NewReader(url.Values{"password": {"wrong"}}.Encode())) + r.Header.Set("Content-Type", "application/x-www-form-urlencoded") + r.RemoteAddr = "198.51.100.77:6000" + w := httptest.NewRecorder() + s.escrowStartAPIHandler(w, r) + if w.Code != http.StatusUnauthorized || !strings.Contains(w.Body.String(), c.want) { + t.Errorf("%s: want 401 with %q, got %d %s", c.lang, c.want, w.Code, ex(w.Body.String())) + } + } +}