v0.126.3: storage wizard CSRF on claimed boxes — wizard pages rendered via raw render() shipped an EMPTY csrf-meta token, every /api/storage/init|attach POST died with 'token mismatch'; latent until the claim arc (unclaimed boxes skip CsrfProtect); fix = executeTemplate injection + session-backed regression test (red-proven)

2026-07-13 13:51:19 +02:00
parent 93c95f0fb5
commit f8df1e9f16
3 changed files with 58 additions and 1 deletions
@@ -0,0 +1,42 @@
+package web
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// v0.126.3 — the storage wizard pages must render the session's CSRF token into the meta tag
+// (the wizard's fetch() POSTs /api/storage/init|attach with csrfHeaders()). The pre-fix
+// storageWizardPageHandler used raw render() (no CSRF injection) → empty meta → every init
+// POST on a CLAIMED box died with "token mismatch". Latent until the claim arc because an
+// unclaimed box skips CsrfProtect entirely; first live hit was the agent-0.87.0 drill wizard
+// leg (2026-07-13).
+// COMPANION red-proof: swap executeTemplate back to render() → both cases fail on the empty
+// meta token.
+func TestStorageWizardPages_CarrySessionCSRFToken(t *testing.T) {
+	s := testServer(t)
+	s.loadTemplates()
+	if s.sessions == nil {
+		s.sessions = map[string]*session{} // testServer skips the login wiring
+	}
+
+	// A real session, exactly as login creates it.
+	tok := s.createSession()
+	want := s.csrfTokenForSession(tok)
+	if want == "" {
+		t.Fatal("test session has no csrf token")
+	}
+
+	for _, page := range []string{"storage_init", "storage_attach"} {
+		rr := httptest.NewRecorder()
+		req := httptest.NewRequest("GET", "/storage/init", nil)
+		req.AddCookie(&http.Cookie{Name: sessionCookieName, Value: tok})
+		s.storageWizardPageHandler(rr, req, page)
+		body := rr.Body.String()
+		if !strings.Contains(body, `name="csrf-token" content="`+want+`"`) {
+			t.Errorf("%s: the csrf meta must carry the SESSION token (got empty or wrong token)", page)
+		}
+	}
+}