felhom-controller/REPORT.md

REPORT — v0.122.0: customer-claim password gate (closes DRILL-day0-vm F-4/F-5)

Date: 2026-07-12 · Version: controller v0.122.0 (from v0.121.0) · MinAgent: 0.81.0 (UNCHANGED) · Requires: hub v0.50.0

What shipped

The dashboard password is now customer-owned, set through a one-time claim code the hub emails to the registered address. The old "no password → open dashboard" default is gone: a fresh box (claim-code hash delivered, no password) serves ONLY the claim page — every other route answers the claim page (302 → /claim) or 401 (API). This closes the DRILL-day0-vm F-4 exposure (every Day-0 dashboard was open on the internet, with the full deploy API = RCE-equivalent) and F-5 (the unauthenticated geo toggle is now behind the gate too).

• internal/web/claim.go — claimGateActive() / effectiveClaimCode() (ACK-cached settings beats the config bake by generation), the claim page (GET /claim), submit (POST /claim: verify code → set own password via SetPasswordHash → mark claimed → consume generation → session), and POST /claim/request-new-code (forwards to the hub reset-request). Code checks: bcrypt match AND generation-not-consumed (single-use) AND ≤ 72 h. Per-source + global limiter (5 → 15-min lockout) raising the allowlisted claim_lockout event. Pre-auth CSRF = HMAC over web.session_secret (fixes CTRL-007). Min password 12.
• Gate wiring (auth.go/csrf.go/server.go/cmd): gate atop RequireAuth; a SET password disables it (auth wins — claimed boxes never regress). /claim* + /static/* reachable pre-auth. Legacy-open (no password, no hash) → red transition banner (layout.html). Login "Elfelejtett jelszó" link.
• internal/report/claim_sync.go — caches the ACK claim {hash, generation} into settings.json idempotently by generation (one-way: newer advances; same/older/nil never rewrites; hub outage never clears). Report carries claimed (set-only). Hub bakes web.claim_code_* for gate-from- first-boot.
• --print-reset-code root escape hatch (one-time local code above cached/baked/consumed gen).

Tests + red-proofs

• Gate-coverage signature test (TestClaimGate_EveryRouteGated): every route → claim page/401, a deploy POST reaches no handler. Plus happy-path / reuse-refused / expired / lockout+window-reopen (fake clock), legacy-open vs password-set, claim-sync idempotence.
• Four §10 red-proofs proven (mutate → FAIL → revert → green): (1) gate skip-line, (2) single-use generation — hub RotateClaimCode bump AND controller consumed-generation check, (3) reset non-DoS (clearing claimed → fail), (4) rate-limiter (both scopes disabled → fail).
• Green gate: go build ./... && go vet ./... clean; all touched packages pass. Pre-existing env-sensitive internal/backup volume-dump failures are unrelated (fail identically on the clean baseline — no tar/zstd toolchain on the dev box).

Live validation (drill guest 9201 on qm 300, controller 0.122.0, pre-floor)

Deployed 0.122.0 → the ACK delivered the claim hash → gate flipped ON within a report cycle. Proven via the REAL Cloudflare edge (curl --resolve): / → 302 → "A szerver beállítása" claim page; /claim → 200; /api/host-metrics → 401. Controller log: claim-sync: hub claim code cached (generation 1). Hub log: claim code emailed to the registered address of demo-vm-felhom. The customer-side claim + reset + the floor raise are the operator's supervised steps.