v0.126.3: storage wizard CSRF on claimed boxes — wizard pages rendered via raw render() shipped an EMPTY csrf-meta token, every /api/storage/init|attach POST died with 'token mismatch'; latent until the claim arc (unclaimed boxes skip CsrfProtect); fix = executeTemplate injection + session-backed regression test (red-proven)

2026-07-13 13:51:19 +02:00
parent 93c95f0fb5
commit f8df1e9f16
3 changed files with 58 additions and 1 deletions
@@ -1,5 +1,16 @@
 ## Changelog

+### v0.126.3 — storage wizard on a CLAIMED box: the init/attach POST no longer dies on CSRF (2026-07-13)
+
+First live hit during the agent-0.87.0 drill wizard leg: /api/storage/init → "CSRF token missing
+or invalid" (log: token mismatch). Root cause: `storageWizardPageHandler` rendered via raw
+`render()` instead of `executeTemplate()`, so /storage/init + /storage/attach shipped an EMPTY
+csrf-meta token — and the wizard's fetch() posts that token. LATENT until the claim arc: an
+unclaimed box skips CsrfProtect entirely, so the wizard had never run against a password-gated
+box before. Fix: executeTemplate (CSRF auto-injection); regression test renders both wizard
+pages with a real session and asserts the meta carries the SESSION token (red-proven: swap back
+to render() → both cases fail on the empty meta).
+
 ### v0.126.2 — stylesheet cache-bust (2026-07-13)

 0.126.1 live QA: Cloudflare edge-caches `/static/style.css` for 4h (`Cf-Cache-Status: HIT`), so