admin
00686789e1
gates / gates (push) Successful in 6m41s
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
66 lines
3.6 KiB
Markdown
66 lines
3.6 KiB
Markdown
# REPORT — hub v0.153.0: no token sends, mints or reveals a household credential or link (2026-10-15)
|
|
|
|
`09` §3 decision 252 (operator 13:20) and R-1059 „A" (same day). Design: `05` §17 (read first).
|
|
|
|
The previous report (hub v0.152.0, access tokens, deploy and CC's switch to its token):
|
|
`git show 5d78569b:REPORT-hub-tokens.md`.
|
|
|
|
## For the operator — plain words
|
|
|
|
**What I did.** Your ruling (13:20, R-1055 = A) is built. No token can now:
|
|
- resend a claim code,
|
|
- create a customer,
|
|
- edit a customer (the edit can change the household's e-mail),
|
|
- create a config from a box's report.
|
|
|
|
These need you, signed in with the browser. Three were already password-only and stay so: the self-bind link, a new
|
|
passphrase, binding an appliance. „Customers: write" keeps only block, unblock and geo disable.
|
|
|
|
**Did it work?** Yes. A new test gives a token with every permission to all seven routes. Each answers 403. The
|
|
household's e-mail and passphrase stay the same, and no customer is created. I broke the rule on purpose twice; the
|
|
test failed both times. All hub tests pass.
|
|
|
|
**Off-site (R-1059 = A, same day).** No token can re-issue a household's off-site password or PBS-DR token either.
|
|
„Off-site: write" keeps the windows and freeze.
|
|
|
|
**Is it live?** Deploying on your „yes" (see the end of this file).
|
|
|
|
**What you do now.**
|
|
1. Say „yes" to deploy hub 0.153.0.
|
|
2. Nothing else for this; R-1059 is decided (A) and built.
|
|
|
|
## The Customers-write routes, checked one by one (`hub/internal/web/routes.go`)
|
|
|
|
| route | now | reason |
|
|
|---|---|---|
|
|
| `POST /configs/{id}/claim-resend` | session only | sends a fresh claim code to the household's e-mail |
|
|
| `POST /configs/{id}/edit` | session only | can change the household's e-mail; a new e-mail auto-mails the self-bind link |
|
|
| `POST /configs/new` | session only | mints the owner passphrase and controller API key; takes the e-mail; mails the self-bind link |
|
|
| `POST /customers/{id}/create-config` | session only | mints the owner passphrase and controller API key |
|
|
| `POST /customers/{id}/selfbind-link` | session only (since v0.152.0) | mints and mails a self-bind capability link |
|
|
| `POST /configs/{id}/regen-password` | session only (since v0.152.0) | mints a new owner passphrase |
|
|
| `POST /appliances/{id}/bind` | session only (since v0.152.0) | delivers the household's passphrase to the box that asks |
|
|
| `POST /configs/{id}/offsite-reissue` | session only (R-1059) | resets the household's off-site password, stages a fresh one-time secret for the box |
|
|
| `POST /configs/{id}/pbsdr-reissue` | session only (R-1059) | re-keys the household's PBS-DR token, stages a fresh one-time secret for the box |
|
|
| `POST /customers/{id}/block`, `/unblock`, `/geo/disable` | `customers:write` | no credential, link or e-mail |
|
|
|
|
The GET forms (`/configs/new`, `/configs/{id}/edit`) stay `customers:read`: they show no passphrase or key (checked in
|
|
the templates).
|
|
|
|
## Proof
|
|
|
|
- Test `TestToken_CredentialAndLinkRoutesAreSessionOnly` (`hub/internal/web/tokens_test.go`).
|
|
- Red-proofs: claim-resend put back in the group → the handler was reached (502, no claim engine in the test);
|
|
edit put back → 200; offsite-reissue put back → the handler was reached (502). Files:
|
|
`documentation/audits/hub-tokens-2026-10-15/red-proof/13-claim-resend.txt`, `14-config-edit.txt`, `15-offsite-reissue.txt`.
|
|
- `go build ./... && go vet ./... && go test ./...` in `hub/` → rc 0.
|
|
|
|
## Records
|
|
|
|
`09` §3 decision 252; `05` §17.2, §17.3, §17.5; hub CHANGELOG v0.153.0; STATUS.
|
|
Register: before 157 · after 156 · opened 1 (R-1059, off-site re-issue) · closed 2 (R-1055, R-1059).
|
|
|
|
## Teardown
|
|
|
|
Nothing provisioned. No live change: the hub still runs 0.152.0.
|