admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: record hub 0.66.0 self-bind live validation (R-27 slice 1)

Browse Source 
Live through the real ingress: public /bind/ renders logged-out with the
no-oracle expired state (200-not-500 proves selfbind_tokens migrated);
gate intact (/ and /hosts -> /login); CSRF exemption is /bind/-only
(POST /bind/ no-CSRF 200 vs POST /customers/x/block no-CSRF 302).
Operator-minted full walk + new-ISO console banner remain operator/R-1.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017qDiBqKKQ5vPB5fXBqu7Kp
This commit is contained in:
authentik Default Admin
2026-07-18 00:01:51 +02:00
parent ce1e9c64e0
commit cfdcb50bc2
2 changed files with 23 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
REPORT.md
+15 -2
View File
@@ -66,9 +66,22 @@ simply reads as expired (no security or storage pressure).
`/configuration`, `/offsite` all `302 → /login` through `RequireAuth`, while `/bind/<token>` renders
`200` — proving the exemption is tight (`TestSelfBind_D_AuthGateIntact`, `TestSelfBind_E_TheTrap`).
### Live validation
### Live validation (hub 0.66.0 live on k3s, through the real `hub.felhom.eu` ingress, 2026-07-18)
Filled in after deploy — see the CONTEXT.md live-state note.
- **Public page renders logged-out, no oracle:** `GET /bind/<garbage>` → `200` rendering the Hungarian
*"Doboz összekötése … érvénytelen vagy lejárt"* page (an unknown token folds into the generic
expired state — no *was-this-real* signal). The `200` (not `500`) also **proves the `selfbind_tokens`
table migrated live** — `SelfBindTokenByHash` queried it successfully (a missing table would 500).
- **Auth gate intact (THE TRAP is tight live):** `GET /` and `GET /hosts` → `302 → /login`.
- **CSRF exemption is `/bind/`-only, live:** `POST /bind/<garbage>` with **no** CSRF/session → `200`
(exempt at gate site 1), renders the generic failure; the control `POST /customers/acme/block` with
no CSRF → `302 → /login` (auth fires first — the exemption did not widen).
- **Clean startup:** migrate() ran without error; `Listening on :8080`, all checkers seeded.
**Pending (NOT-live, as anticipated):** the operator-minted full customer walk (the "Send self-bind
link" button and the customer's real two-factor success are behind the operator password gate → CC
cannot log in) and the new-ISO console pairing-code banner on a physically re-imaged box — both fold
into the supervised rehearsal (R-1).
### Not in this slice (deferred)