felhom.eu/REPORT-hub-tokens.md

REPORT — hub v0.153.0: no token sends, mints or reveals a household credential or link (2026-10-15)

09 §3 decision 252 (operator 13:20) and R-1059 „A" (same day). Design: 05 §17 (read first).

The previous report (hub v0.152.0, access tokens, deploy and CC's switch to its token): git show 5d78569b:REPORT-hub-tokens.md.

For the operator — plain words

What I did. Your ruling (13:20, R-1055 = A) is built. No token can now:

• resend a claim code,
• create a customer,
• edit a customer (the edit can change the household's e-mail),
• create a config from a box's report.

These need you, signed in with the browser. Three were already password-only and stay so: the self-bind link, a new passphrase, binding an appliance. „Customers: write" keeps only block, unblock and geo disable.

Did it work? Yes. A new test gives a token with every permission to all seven routes. Each answers 403. The household's e-mail and passphrase stay the same, and no customer is created. I broke the rule on purpose twice; the test failed both times. All hub tests pass.

Off-site (R-1059 = A, same day). No token can re-issue a household's off-site password or PBS-DR token either. „Off-site: write" keeps the windows and freeze.

Is it live? Deploying on your „yes" (see the end of this file).

What you do now.

1. Say „yes" to deploy hub 0.153.0.
2. Nothing else for this; R-1059 is decided (A) and built.

The Customers-write routes, checked one by one (hub/internal/web/routes.go)

route	now	reason
POST /configs/{id}/claim-resend	session only	sends a fresh claim code to the household's e-mail
POST /configs/{id}/edit	session only	can change the household's e-mail; a new e-mail auto-mails the self-bind link
POST /configs/new	session only	mints the owner passphrase and controller API key; takes the e-mail; mails the self-bind link
POST /customers/{id}/create-config	session only	mints the owner passphrase and controller API key
POST /customers/{id}/selfbind-link	session only (since v0.152.0)	mints and mails a self-bind capability link
POST /configs/{id}/regen-password	session only (since v0.152.0)	mints a new owner passphrase
POST /appliances/{id}/bind	session only (since v0.152.0)	delivers the household's passphrase to the box that asks
POST /configs/{id}/offsite-reissue	session only (R-1059)	resets the household's off-site password, stages a fresh one-time secret for the box
POST /configs/{id}/pbsdr-reissue	session only (R-1059)	re-keys the household's PBS-DR token, stages a fresh one-time secret for the box
POST /customers/{id}/block, /unblock, /geo/disable	customers:write	no credential, link or e-mail

The GET forms (/configs/new, /configs/{id}/edit) stay customers:read: they show no passphrase or key (checked in the templates).

Proof

• Test TestToken_CredentialAndLinkRoutesAreSessionOnly (hub/internal/web/tokens_test.go).
• Red-proofs: claim-resend put back in the group → the handler was reached (502, no claim engine in the test); edit put back → 200; offsite-reissue put back → the handler was reached (502). Files: documentation/audits/hub-tokens-2026-10-15/red-proof/13-claim-resend.txt, 14-config-edit.txt, 15-offsite-reissue.txt.
• go build ./... && go vet ./... && go test ./... in hub/ → rc 0.

Records

09 §3 decision 252; 05 §17.2, §17.3, §17.5; hub CHANGELOG v0.153.0; STATUS. Register: before 157 · after 156 · opened 1 (R-1059, off-site re-issue) · closed 2 (R-1055, R-1059).

Teardown

Nothing provisioned. No live change: the hub still runs 0.152.0.