admin/felhom-controller
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

R-241 part 2: the comparison the box already makes becomes the thing that offers recovery

Browse Source 
THE FACT WAS COMPUTED EVERY CYCLE AND KEPT NOWHERE. EscrowAutoConfirmer.Reconcile
has compared the hub's restic_pw_sha256 against the local key on every ACK since
SLICE 3. On the final-walk venue it logged, at 03:28:03Z and thirty-five minutes
before the customer looked, "the hub's escrow blob does not cover the CURRENT repo
password (hub hash 30ef574f != local 9b4a9a9d)" - and dropped it. The recovery
screen, evaluating in the same process, went on asking a question that could not
see it.

Now persisted: settings.HubEscrowKeySHA256 + HubEscrowKeyCheckedAt, recorded
UNCONDITIONALLY in Reconcile beside RecordPresence and RecordSuperseded - same
place, same reason: the box that needs it most is the rebuilt one with no target,
on which every gate below returns early.

OffsiteRecoveryOffer gains SHAPE (c): the hub holds a package for a key OTHER than
the one we are using. (a) and (b) are both proxies for that question and both have
now been wrong in opposite directions - (a) goes false the moment anything mints,
(b) is unreachable while the escrow is pending.

SEC 7.2, decided deliberately and stated in the code:
  - a KNOWN DIFFERENCE offers, however old the reading. Age is not gated on. Both
    sides are local; only the hub's half can be stale, and what the hub holds does
    not change without a ceremony THIS box runs, which refreshes the hash on the
    next ACK. Gating on age would make a box offline from the hub silently stop
    offering - the exact failure this session removes. CheckedAt is persisted for
    diagnosis, not as a gate.
  - an ABSENT hash falls back to (a)/(b) and does NOT offer. "" is the hub
    positively saying its package seals no repository password (legacy hash-less
    escrow). Nothing to compare, and offering would put a permanent screen in
    front of every legacy box.

The write damper: CheckedAt refreshes on every ack carrying a hash, but a save is
skipped when both the hash and the UTC day are unchanged, so an idle box does not
rewrite settings.json every fifteen minutes. It records WHEN WE LAST HEARD, not
when it last changed - the R-100 distinction.

Tests: Scenario C (a differing key offers, with both proxies asserted false first),
Scenario D (a matching key offers nothing), fact 1 still required, shape (a) still
works, and both SEC 7.2 halves.

RED-PROOFS, each with the mutation confirmed present in the file first:
  D) hubHash != localHash conjunct dropped -> Scenario D FAILS (a healthy box
     offered recovery forever); Scenario C still passes
  WIRING) RecordEscrowKeyHash removed from the EscrowAutoConfirmer literal in
     main.go -> TestMainWiresRecordEscrowKeyHash FAILS. This is the ships-inert
     shape: unwired, everything compiles, every test in the package passes, the
     auto-confirm still works, and shape (c) reads an empty hash forever.

Green: go build, go vet, go test ./... all pass.
This commit is contained in:
authentik Default Admin
2026-08-07 11:33:42 +02:00
parent 763de3a025
commit a491abef6c
6 changed files with 346 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
controller/internal/report/escrow_confirm.go
+33 -1
View File
@@ -65,7 +65,23 @@ type EscrowAutoConfirmer struct {
// second wiring point in main.go is how this project accumulated six features that were built and
// never wired. nil → not recorded (older wiring, tests).
RecordSuperseded func(present bool, at string) error
Logger *log.Logger
// RecordEscrowKeyHash persists the ACK's `restic_pw_sha256` — the hash of the repository password
// the hub's sealed package COVERS — with the time it was recorded (v0.206.0, R-241).
//
// WHY IT LIVES HERE, and it is the point of the whole change: the comparison between this hash and
// the local key is ALREADY MADE in Reconcile, on every ACK, and has been since SLICE 3 — and the
// result was used for one warning line and then discarded. On the final-walk venue that line
// (03:28:03Z) was the correct answer to the recovery screen's real question, thirty-five minutes
// before the customer looked at a screen that could not see it.
//
// Recorded UNCONDITIONALLY, before every gate below, for exactly the reason RecordPresence is: the
// box that needs this most is the rebuilt one with no configured target, on which `Pending()` and
// `Escrowed()` are both false and Reconcile used to return immediately. nil → not recorded.
RecordEscrowKeyHash func(sha, checkedAt string) error
// Now returns the current time; nil → time.Now. Injected so the persisted "when we last heard"
// stamp is testable without a sleep.
Now func() time.Time
Logger *log.Logger
mu sync.Mutex
warnedHash string // last mismatched hub hash we warned about (dedupe; shared by both branches)
@@ -130,6 +146,14 @@ func (c *EscrowAutoConfirmer) Reconcile(es *EscrowStatus) {
c.logf("[WARN] [escrow-confirm] could not record the hub's superseded-package state (present=%v): %v", es.SupersededPresent, err)
}
}
// R-241: persist the hash the hub's package covers, with the moment we heard it. Same discipline,
// same place, same reason as the two above — and this one is the fact the recovery screen has been
// unable to see. A record failure is logged, never swallowed, and never blocks the auto-confirm.
if c.RecordEscrowKeyHash != nil {
if err := c.RecordEscrowKeyHash(es.ResticPwSHA256, c.now().UTC().Format(time.RFC3339)); err != nil {
c.logf("[WARN] [escrow-confirm] could not record the hub's escrowed-key hash (%.12s…): %v", es.ResticPwSHA256, err)
}
}
c.mu.Lock()
c.sealedAt = es.CreatedAt // in-memory only; a timestamp, never a secret
c.mu.Unlock()
@@ -216,3 +240,11 @@ func (c *EscrowAutoConfirmer) reconcileEscrowed(es *EscrowStatus) {
}
c.logf("[WARN] [escrow-confirm] STALE escrow: the hub's current blob does not cover the CURRENT repo password (hub hash %.12s… != local %.12s…) — create a new recovery code (wizard /backup/escrow). State stays escrowed; runs continue", hubHash, localHash)
}
// now returns the injected clock or time.Now.
func (c *EscrowAutoConfirmer) now() time.Time {
if c.Now != nil {
return c.Now()
}
return time.Now()
}
controller/internal/report/escrow_presence_wiring_test.go
+58
View File
@@ -66,3 +66,61 @@ func TestMainWiresRecordPresence(t *testing.T) {
t.Fatal("EscrowAutoConfirmer is constructed WITHOUT RecordPresence — the box will never learn the hub holds its recovery package, and R-204 item 4 ships inert")
}
}
// confirmerFieldIsWired is the generalised form of the walk above: it reports whether
// `EscrowAutoConfirmer{...}` in main.go assigns `field`, and whether the literal was found at all.
// Comments are dropped on purpose, so a commented-out assignment cannot satisfy it.
func confirmerFieldIsWired(t *testing.T, field string) (found, sawLiteral bool) {
t.Helper()
const mainPath = "../../cmd/controller/main.go"
fset := token.NewFileSet()
f, err := parser.ParseFile(fset, mainPath, nil, 0)
if err != nil {
t.Fatalf("parse %s: %v — the wiring of %s is now unasserted", mainPath, err, field)
}
ast.Inspect(f, func(n ast.Node) bool {
lit, ok := n.(*ast.CompositeLit)
if !ok {
return true
}
name := ""
switch tt := lit.Type.(type) {
case *ast.SelectorExpr:
name = tt.Sel.Name
case *ast.Ident:
name = tt.Name
}
if name != "EscrowAutoConfirmer" {
return true
}
sawLiteral = true
for _, el := range lit.Elts {
kv, ok := el.(*ast.KeyValueExpr)
if !ok {
continue
}
if k, ok := kv.Key.(*ast.Ident); ok && k.Name == field {
found = true
}
}
return true
})
return found, sawLiteral
}
// TestMainWiresRecordEscrowKeyHash — R-241's seam-discipline test, and it matters more than most.
//
// `RecordEscrowKeyHash` is nil-able exactly like `RecordPresence`. Unwired, the confirmer still
// compiles, every test in this package still passes, the auto-confirm still works — and
// `OffsiteRecoveryOffer`'s shape (c) reads an empty hash forever, silently falling back to the two
// proxies that R-241 proved insufficient. **The fix would ship inert, in precisely the shape the
// spike found: a correct answer computed and kept nowhere.**
func TestMainWiresRecordEscrowKeyHash(t *testing.T) {
found, sawLiteral := confirmerFieldIsWired(t, "RecordEscrowKeyHash")
if !sawLiteral {
t.Fatal("no EscrowAutoConfirmer composite literal found in main.go — did the wiring move? This test can no longer see it")
}
if !found {
t.Fatal("EscrowAutoConfirmer is constructed WITHOUT RecordEscrowKeyHash — the hub's escrowed-key hash is never persisted, so the recovery screen's shape (c) can never fire and R-241 ships inert")
}
}