hub 0.153.0 deployed (operator yes): six credential/link routes refused live with CC's token; all three boxes report
gates / gates (push) Successful in 6m45s
gates / gates (push) Successful in 6m45s
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
This commit is contained in:
@@ -23,11 +23,11 @@ test failed both times. All hub tests pass.
|
||||
**Off-site (R-1059 = A, same day).** No token can re-issue a household's off-site password or PBS-DR token either.
|
||||
„Off-site: write" keeps the windows and freeze.
|
||||
|
||||
**Is it live?** Deploying on your „yes" (see the end of this file).
|
||||
**Is it live?** Yes, since 13:39. With CC's token, for a customer that does not exist, all six routes answered
|
||||
„403 session only" (the off-site re-issue too, although the token holds „Off-site: write").
|
||||
|
||||
**What you do now.**
|
||||
1. Say „yes" to deploy hub 0.153.0.
|
||||
2. Nothing else for this; R-1059 is decided (A) and built.
|
||||
Nothing for this. Still open from before: change the hub password and delete the `HUB_PW` line.
|
||||
|
||||
## The Customers-write routes, checked one by one (`hub/internal/web/routes.go`)
|
||||
|
||||
@@ -62,4 +62,5 @@ Register: before 157 · after 156 · opened 1 (R-1059, off-site re-issue) · clo
|
||||
|
||||
## Teardown
|
||||
|
||||
Nothing provisioned. No live change: the hub still runs 0.152.0.
|
||||
Machine and host: nothing provisioned. Hub: v0.153.0 deployed (manifest `1dc1a08`); live probes used a customer id
|
||||
that does not exist, so a broken guard could change nothing real. Evidence: `audits/hub-tokens-2026-10-15/C153-live.txt`.
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
**Ready for the first real tester (Tester-2): yes. Tester 2 (a laptop) is off; nothing was sent to it.**
|
||||
|
||||
**Updated 2026-10-15 (evening).** Agent 0.156.1 + its bundle on all three boxes; controller 0.313.0 is the floor (vouched golden 0.313.0) — demo-felhom and demo-hp run it, Tester 1 still runs the test build rc.4 (R-1053); hub 0.152.0 (access tokens — CC uses its own token now, not your password). Open items: see `documentation/backlog/OPEN-ITEMS.md`. Older notes, day by day:
|
||||
**Updated 2026-10-15 (evening).** Agent 0.156.1 + its bundle on all three boxes; controller 0.313.0 is the floor (vouched golden 0.313.0) — demo-felhom and demo-hp run it, Tester 1 still runs the test build rc.4 (R-1053); hub 0.153.0 (access tokens — CC uses its own token now, not your password). Open items: see `documentation/backlog/OPEN-ITEMS.md`. Older notes, day by day:
|
||||
`documentation/backlog/STATUS-HISTORY.md`. Reports: `REPORT-night-2026-10-14.md`, `REPORT-immich-rollout-2026-10-14.md`, `REPORT-seo-felho-tarhely-2026-10-14.md`, `REPORT-immich-repair-2026-10-14.md`, `REPORT-power-cut-fixes-2026-10-14.md`, `REPORT-night-power-2026-10-13.md`, `REPORT-poweroff.md`.
|
||||
|
||||
## What works
|
||||
@@ -46,7 +46,7 @@
|
||||
|
||||
## Waiting on you — do
|
||||
- **Change the hub password now — CC no longer needs it.** CC uses its token „cc-releases" (tested live: the floor works; the vouch and the password-only pages are refused). Then delete the `HUB_PW` line in `~/.config/credentials` on DooPlex (CC does not delete it). Your token is wider than planned (it can also change off-site windows and approve OS updates) — revoke and re-create it narrower if you want. If you do nothing: CC still holds a password that can do everything.
|
||||
- **Hub 0.153.0 (your rulings 13:20 + R-1059 „A"): no token can resend a claim code, create or edit a customer, make a passphrase or a link, or re-issue an off-site password.** Deploying now on your „yes".
|
||||
- **Hub 0.153.0 (your rulings 13:20 + R-1059 „A"): no token can resend a claim code, create or edit a customer, make a passphrase or a link, or re-issue an off-site password.** Live since 13:39 (checked with CC's token: all six refused).
|
||||
- **Remove the test server „plex-k6” from your Plex account** (plex.tv → Settings → Authorized Devices). The claim test passed and the server is gone from Tester 1. If not: a dead server stays listed in your Plex apps.
|
||||
- System poster needs a refresh: every public name answers only over https (http → 301).
|
||||
- **Clear demo-hp's own floor** (hub → Demo HP → floor: empty → Save floor). It still reads 0.311.0. If not: the next global raise passes demo-hp by.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
hub 0.153.0 deploy: manifest 1dc1a08, digest sha256:9214ab2225c29699ead77773a41b0bea96c91ece171f02f36932867d0344a003; ArgoCD Synced/Healthy rev 1dc1a08; pod ready 11:39 UTC
|
||||
hub 0.153.0 live check with CC's token (customer id that does not exist: zz-probe-none)
|
||||
403 /configs/zz-probe-none/offsite-reissue Forbidden: session only — never by a token
|
||||
403 /configs/zz-probe-none/pbsdr-reissue Forbidden: session only — never by a token
|
||||
403 /configs/zz-probe-none/claim-resend Forbidden: session only — never by a token
|
||||
403 /configs/zz-probe-none/edit Forbidden: session only — never by a token
|
||||
403 /configs/new Forbidden: session only — never by a token
|
||||
403 /customers/zz-probe-none/create-config Forbidden: session only — never by a token
|
||||
200 GET /configuration footer 0.153.0: True
|
||||
2026/10/15 13:39:51 [WARN] access token "cc-releases" refused: session only — never by a token — POST /configs/zz-probe-none/offsite-reissue → 403
|
||||
2026/10/15 13:39:51 [WARN] access token "cc-releases" refused: session only — never by a token — POST /configs/zz-probe-none/pbsdr-reissue → 403
|
||||
2026/10/15 13:39:51 [WARN] access token "cc-releases" refused: session only — never by a token — POST /configs/zz-probe-none/claim-resend → 403
|
||||
2026/10/15 13:39:51 [WARN] access token "cc-releases" refused: session only — never by a token — POST /configs/zz-probe-none/edit → 403
|
||||
2026/10/15 13:39:51 [WARN] access token "cc-releases" refused: session only — never by a token — POST /configs/new → 403
|
||||
2026/10/15 13:39:51 [WARN] access token "cc-releases" refused: session only — never by a token — POST /customers/zz-probe-none/create-config → 403
|
||||
2026/10/15 13:39:54 [INFO] access token "cc-releases": GET /configuration → 200
|
||||
Boxes reporting after the restart (hub DB + WAL from the running pod, last_report_at > 11:39:40 UTC): demo-felhom-8363b5=11:49:40 demo-hp-bb76ea=11:41:03 tester-1-d70be4=11:41:30 (Tester-2 off since 2026-10-04, known)
|
||||
+3
-1
@@ -16,7 +16,9 @@ Operator ruling 2026-10-15 13:20 (`09` §3 decision 252, R-1055 = A). `documenta
|
||||
- **R-1059 (operator „A", same day):** `POST /configs/{id}/offsite-reissue` and `/pbsdr-reissue` are session only too —
|
||||
each mints a household credential for the box (the off-site password; the PBS-DR token). „Off-site: write" keeps the
|
||||
windows and freeze. Same test; red-proved (offsite-reissue back in the group → the handler was reached, 502).
|
||||
- **Not deployed** — the operator's „yes" first.
|
||||
- **Deployed 2026-10-15 ~13:39 Budapest** on the operator's „yes" (manifest `1dc1a08`, digest `sha256:9214ab22…`). Live with
|
||||
CC's token, for a customer id that does not exist: the two re-issues, claim resend, edit, create and create-config
|
||||
each → 403 „session only" (`documentation/audits/hub-tokens-2026-10-15/C153-live.txt`).
|
||||
|
||||
## v0.152.0 — operator access tokens with scopes; an empty password no longer opens the UI; R-952 (2026-10-15)
|
||||
|
||||
|
||||
Reference in New Issue
Block a user