admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hub v0.66.0 + ISO v1.20.0: customer self-bind (R-27 slice 1)

Browse Source 
Let a customer bind their own freshly-installed appliance without the
operator: operator "Send self-bind link" mints a 7-day tokenized
capability link, emailed (Hungarian, sibling sender) to the customer, who
opens a public /bind/<token> page and proves two factors — the console
pairing code shown on the box screen + their retrieval passphrase — and
the hub stages the bind via the same BindAppliance (provenance
customer_selfbind). The box's ~30s appliance poll delivers.

Viktor's three rulings verbatim: console pairing code (no appliance list
ever rendered), operator-sent tokenized link, 5-attempt lockout ->
"call support". Wrong code == wrong passphrase (one generic failure, no
oracle, both factors compared unconditionally); expiry falls back to
operator-bind unchanged.

THE TRAP: one public prefix /bind/, exempt from auth+CSRF at both /login
gate sites via a single isPublicBindPath predicate (tight trailing-slash
match; ServeMux ..-cleans; handler rejects '/' in token). 9 tests
(Scenarios A-F + F1/F2); 4 red-proofs verified red-then-green (lockout,
oracle, widened-prefix, single-active). GC verdict: no appliance GC ->
the 7-day TTL stands alone. Controller/agent untouched; R-27b deferred.

Green: full hub build/vet/test (17 ok) + bash -n + hub confirm gate.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017qDiBqKKQ5vPB5fXBqu7Kp
This commit is contained in:
authentik Default Admin
2026-07-17 23:56:53 +02:00
parent c6d7a69e6d
commit 592818492c
24 changed files with 1304 additions and 138 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hub/internal/store/appliance.go
+65 -21
View File
@@ -32,6 +32,7 @@ type ApplianceRegistration struct {
CustomerID string // set at bind
InstallMode string // staged at bind (appliance|byo)
ExtraArgs string // staged at bind
PairingCode string // v0.66.0 (R-27): stable 6-char code shown on the box console + the self-bind page
FirstSeen time.Time
LastSeen time.Time
BoundAt *time.Time
@@ -46,57 +47,65 @@ type ApplianceRegistration struct {
// token yet, so it is genuinely starting over; the operator re-binds. isNew is true only on first
// insert (so the caller can log the first sighting). The token itself is never passed in — only its
// hash.
func (s *Store) RegisterAppliance(uuid, macSet, sshKeys, hwSummary, tokenHash string) (isNew bool, err error) {
// v0.66.0 (R-27 slice 1): the caller passes a candidateCode (minted via configgen — store must not
// import configgen, an import cycle); it is used ONLY on the first insert and stays STABLE across the
// idempotent re-register. The effective stored code is returned so the register response can carry it.
func (s *Store) RegisterAppliance(uuid, macSet, sshKeys, hwSummary, tokenHash, candidateCode string) (isNew bool, pairingCode string, err error) {
tx, err := s.db.Begin()
if err != nil {
return false, err
return false, "", err
}
defer tx.Rollback()
var id int64
var status string
row := tx.QueryRow(`SELECT id, status FROM appliance_registrations WHERE uuid = ? AND mac_set = ?`, uuid, macSet)
switch err := row.Scan(&id, &status); err {
var status, existingCode string
row := tx.QueryRow(`SELECT id, status, COALESCE(pairing_code,'') FROM appliance_registrations WHERE uuid = ? AND mac_set = ?`, uuid, macSet)
switch err := row.Scan(&id, &status, &existingCode); err {
case sql.ErrNoRows:
if _, err := tx.Exec(`
INSERT INTO appliance_registrations (uuid, mac_set, ssh_host_pubkeys, hw_summary, token_hash, status)
VALUES (?, ?, ?, ?, ?, 'registered')`, uuid, macSet, sshKeys, hwSummary, tokenHash); err != nil {
return false, fmt.Errorf("register appliance insert: %w", err)
INSERT INTO appliance_registrations (uuid, mac_set, ssh_host_pubkeys, hw_summary, token_hash, status, pairing_code)
VALUES (?, ?, ?, ?, ?, 'registered', ?)`, uuid, macSet, sshKeys, hwSummary, tokenHash, candidateCode); err != nil {
return false, "", fmt.Errorf("register appliance insert: %w", err)
}
if err := tx.Commit(); err != nil {
return false, err
return false, "", err
}
return true, nil
return true, candidateCode, nil
case nil:
// The code stays STABLE across re-register; a pre-v0.66.0 row (empty code) is backfilled once.
effectiveCode := existingCode
if effectiveCode == "" {
effectiveCode = candidateCode
}
// Existing record: refresh last_seen + identity + the token. Sticky-discard keeps its status;
// everything else resets to registered (a re-registering box is starting over).
if status == ApplianceDiscarded {
if _, err := tx.Exec(`UPDATE appliance_registrations
SET token_hash = ?, ssh_host_pubkeys = ?, hw_summary = ?, last_seen = datetime('now')
WHERE id = ?`, tokenHash, sshKeys, hwSummary, id); err != nil {
return false, fmt.Errorf("register appliance (discarded) update: %w", err)
SET token_hash = ?, ssh_host_pubkeys = ?, hw_summary = ?, pairing_code = ?, last_seen = datetime('now')
WHERE id = ?`, tokenHash, sshKeys, hwSummary, effectiveCode, id); err != nil {
return false, "", fmt.Errorf("register appliance (discarded) update: %w", err)
}
} else {
if _, err := tx.Exec(`UPDATE appliance_registrations
SET token_hash = ?, ssh_host_pubkeys = ?, hw_summary = ?, status = 'registered',
SET token_hash = ?, ssh_host_pubkeys = ?, hw_summary = ?, pairing_code = ?, status = 'registered',
customer_id = NULL, install_mode = NULL, extra_args = NULL,
bound_at = NULL, delivered_at = NULL, last_seen = datetime('now')
WHERE id = ?`, tokenHash, sshKeys, hwSummary, id); err != nil {
return false, fmt.Errorf("register appliance update: %w", err)
WHERE id = ?`, tokenHash, sshKeys, hwSummary, effectiveCode, id); err != nil {
return false, "", fmt.Errorf("register appliance update: %w", err)
}
}
if err := tx.Commit(); err != nil {
return false, err
return false, "", err
}
return false, nil
return false, effectiveCode, nil
default:
return false, fmt.Errorf("register appliance lookup: %w", err)
return false, "", fmt.Errorf("register appliance lookup: %w", err)
}
}
// scanAppliance scans a full appliance row (column order fixed by applianceCols).
const applianceCols = `id, uuid, mac_set, ssh_host_pubkeys, hw_summary, status,
COALESCE(customer_id,''), COALESCE(install_mode,''), COALESCE(extra_args,''),
COALESCE(customer_id,''), COALESCE(install_mode,''), COALESCE(extra_args,''), COALESCE(pairing_code,''),
first_seen, last_seen, bound_at, delivered_at, discarded_at`
func scanAppliance(sc interface{ Scan(...any) error }) (*ApplianceRegistration, error) {
@@ -104,7 +113,7 @@ func scanAppliance(sc interface{ Scan(...any) error }) (*ApplianceRegistration,
var firstSeen, lastSeen string
var boundAt, deliveredAt, discardedAt sql.NullString
if err := sc.Scan(&a.ID, &a.UUID, &a.MACSet, &a.SSHHostPubkeys, &a.HWSummary, &a.Status,
&a.CustomerID, &a.InstallMode, &a.ExtraArgs,
&a.CustomerID, &a.InstallMode, &a.ExtraArgs, &a.PairingCode,
&firstSeen, &lastSeen, &boundAt, &deliveredAt, &discardedAt); err != nil {
return nil, err
}
@@ -138,6 +147,41 @@ func (s *Store) ApplianceByToken(tokenHash string) (*ApplianceRegistration, erro
return a, err
}
// ApplianceByPairingCode resolves a console pairing code to the ONE bindable (registered, not yet
// bound/delivered/discarded) appliance carrying it — the customer-self-bind factor-1 lookup (v0.66.0,
// R-27). Returns (nil, nil) when zero OR more than one registered appliance matches (an ambiguous
// code binds nothing — the public handler maps that to the same generic failure as a wrong code, no
// oracle). code is the RAW stored form (uppercased, no separator); the caller normalizes first.
func (s *Store) ApplianceByPairingCode(code string) (*ApplianceRegistration, error) {
if code == "" {
return nil, nil
}
rows, err := s.db.Query(`SELECT `+applianceCols+` FROM appliance_registrations
WHERE pairing_code = ? AND status = 'registered'`, code)
if err != nil {
return nil, err
}
defer rows.Close()
var matches []*ApplianceRegistration
for rows.Next() {
a, err := scanAppliance(rows)
if err != nil {
return nil, err
}
matches = append(matches, a)
if len(matches) > 1 {
return nil, nil // ambiguous — bind nothing
}
}
if err := rows.Err(); err != nil {
return nil, err
}
if len(matches) != 1 {
return nil, nil
}
return matches[0], nil
}
// GetAppliance fetches by row id (operator UI actions).
func (s *Store) GetAppliance(id int64) (*ApplianceRegistration, error) {
a, err := scanAppliance(s.db.QueryRow(`SELECT `+applianceCols+` FROM appliance_registrations WHERE id = ?`, id))