admin
b505ce4ba0
The first draft (5121536f, unpushed) re-issued the claim code and the off-site login on a
reuse whose old box was stale or switched off. A security review flagged it: the caller
holds only the household's retrieval passphrase, and both re-issues are operator
session-only actions (05 section 17.5, 09 decision 252, R-1055/R-1059). Now the reuse
path classifies the old box and re-issues nothing: gone -> host_reinstall_over_old_host
(warning, mailed to the operator: delete the old host and re-run, or re-issue by hand);
live -> host_reenroll_while_live (info). The mint path after the operator's delete is
unchanged and still re-issues. The once-per-silence record and the claim engine comment
edit are reverted. 05 section 8, README and CHANGELOG updated; tests red-proved.
130 lines
6.5 KiB
Go
130 lines
6.5 KiB
Go
package api
|
|
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
"time"
|
|
|
|
"gitea.dooplex.hu/admin/felhom-hub/internal/intent"
|
|
"gitea.dooplex.hu/admin/felhom-hub/internal/store"
|
|
)
|
|
|
|
// R-1154 (hub v0.159.0, brief 2026-10-19) — a reinstall while the customer's OLD host record still exists.
|
|
//
|
|
// POST /host-enroll is called by the installer (felhom-host-install.sh step 4) on EVERY pass, a --resume
|
|
// included, with the customer's retrieval passphrase. An existing host record is reused (same host id and
|
|
// key — a reinstalled box takes over the record). The clean-slate re-issues (reissueOnReenroll: a new claim
|
|
// code mailed to the household, the off-site provider password reset) run ONLY on the mint path, i.e. after
|
|
// the OPERATOR deleted the old host. Until v0.159.0 a reinstall that kept the old record skipped them IN
|
|
// SILENCE (demo-hp 2026-08-21; Tester4's standing reinstalls).
|
|
//
|
|
// THE RULE: the reuse path NEVER re-issues anything; it makes the reinstall LOUD instead.
|
|
//
|
|
// - The old box looks gone (no controller wait connection open now, AND either the household switched it
|
|
// off on purpose — deliberate_off_at inside its hold — or BOTH the agent's host report and the
|
|
// controller's report are older than staleThreshold or absent; the hostStatus threshold and comparison):
|
|
// the operator-only WARNING host_reinstall_over_old_host, mailed to the operator, saying what to do.
|
|
// - The box is live (a --resume after its agent started, a repair re-run, or a reinstall done within the
|
|
// threshold of the old box's last report): the operator-only INFO host_reenroll_while_live, recorded on
|
|
// the event list, never mailed.
|
|
//
|
|
// WHY NOT RE-ISSUE AUTOMATICALLY (security review of the first draft, 2026-10-19): the passphrase is a
|
|
// household-held secret typed into the installer. Re-issuing a household's off-site credential and
|
|
// (re)sending its claim code are operator SESSION-ONLY actions — not even an operator token may do them
|
|
// (`05` §17.5; `09` §3 decision 252, R-1055 / R-1059: a re-issue „stops its backup for a while"). An automatic
|
|
// re-issue here would hand those powers to anyone holding the passphrase whenever the box is off or silent
|
|
// (a household on holiday). The operator's delete stays the gate: delete the old host, run the installer
|
|
// again, and the mint path re-issues exactly as before.
|
|
//
|
|
// Not wired (staleThreshold 0) or a failed lookup: no verdict, a WARN log line only. Both event types are
|
|
// hub-origin only (not in allowedEventTypes) and operator-only. Pinned by r1154_reenroll_test.go.
|
|
|
|
const (
|
|
eventHostReinstallOverOldHost = "host_reinstall_over_old_host"
|
|
eventHostReenrollWhileLive = "host_reenroll_while_live"
|
|
)
|
|
|
|
// reenrollVerdict classifies a reuse-path enroll.
|
|
type reenrollVerdict int
|
|
|
|
const (
|
|
reenrollUnknown reenrollVerdict = iota // not wired / lookup failed — log only
|
|
reenrollLive // the box is live
|
|
reenrollGone // the old box looks gone: a reinstall over the old record
|
|
)
|
|
|
|
func (h *Handler) classifyReenroll(host *store.Host, now time.Time) (reenrollVerdict, string) {
|
|
if h.staleThreshold <= 0 {
|
|
return reenrollUnknown, "no stale threshold wired"
|
|
}
|
|
if h.intentHub != nil {
|
|
if p := h.intentHub.Presence(host.CustomerID, now); p.State == intent.PresenceConnected {
|
|
return reenrollLive, "the box's controller is connected to the hub right now"
|
|
}
|
|
}
|
|
if store.DeliberateOffHeld(host.DeliberateOffAt, now) {
|
|
return reenrollGone, "the household switched the box off at " + host.DeliberateOffAt.UTC().Format("2006-01-02 15:04 UTC")
|
|
}
|
|
hostAge := "never reported"
|
|
if host.LastReportAt != nil {
|
|
age := now.Sub(*host.LastReportAt)
|
|
if age <= h.staleThreshold {
|
|
return reenrollLive, "the host reported " + roundAge(age) + " ago"
|
|
}
|
|
hostAge = "last reported " + roundAge(age) + " ago"
|
|
}
|
|
found, ctrlAt, _, err := h.store.LatestReportOffsitePresence(host.CustomerID)
|
|
if err != nil {
|
|
return reenrollUnknown, "the controller report lookup failed: " + err.Error()
|
|
}
|
|
ctrlAge := "the controller never reported"
|
|
if found {
|
|
age := now.Sub(ctrlAt)
|
|
if age <= h.staleThreshold {
|
|
return reenrollLive, "the controller reported " + roundAge(age) + " ago"
|
|
}
|
|
ctrlAge = "the controller last reported " + roundAge(age) + " ago"
|
|
}
|
|
return reenrollGone, "the host " + hostAge + ", " + ctrlAge + " (stale threshold " + h.staleThreshold.String() + ")"
|
|
}
|
|
|
|
// noteReenrollOverExistingHost records (and for a reinstall, mails the operator about) an enroll that reused
|
|
// the old host record. It re-issues NOTHING and never fails the enroll.
|
|
func (h *Handler) noteReenrollOverExistingHost(cc *store.CustomerConfig, host *store.Host, now time.Time) {
|
|
v, why := h.classifyReenroll(host, now)
|
|
switch v {
|
|
case reenrollGone:
|
|
h.logger.Printf("[WARN] host re-enrolled: %s (customer %s) over the old host record — %s; nothing re-issued, the operator is told",
|
|
host.HostID, cc.CustomerID, why)
|
|
msg := "A reinstall of " + cc.CustomerID + " enrolled while the old host record " + host.HostID + " still exists (" +
|
|
why + "); nothing was re-issued — delete the old host (Hosts page) and run the installer again, or " +
|
|
"re-issue the claim code and the off-site login from the customer page."
|
|
h.saveReenrollEvent(cc.CustomerID, eventHostReinstallOverOldHost, "warning", msg, host.HostID, why)
|
|
case reenrollLive:
|
|
h.logger.Printf("[INFO] host re-enrolled: %s (customer %s) — the box is live: %s", host.HostID, cc.CustomerID, why)
|
|
msg := "Host " + host.HostID + " enrolled again while the box is live (" + why + "); nothing was re-issued. " +
|
|
"If this box was reinstalled, delete the old host and run the installer again, or re-issue from the customer page."
|
|
h.saveReenrollEvent(cc.CustomerID, eventHostReenrollWhileLive, "info", msg, host.HostID, why)
|
|
default:
|
|
h.logger.Printf("[WARN] host re-enrolled: %s (customer %s) — not classified: %s", host.HostID, cc.CustomerID, why)
|
|
}
|
|
}
|
|
|
|
func (h *Handler) saveReenrollEvent(customerID, eventType, severity, msg, hostID, why string) {
|
|
details, _ := json.Marshal(map[string]string{"host_id": hostID, "reason": why})
|
|
if _, err := h.store.SaveEvent(customerID, eventType, severity, msg, string(details), "hub"); err != nil {
|
|
h.logger.Printf("[WARN] save %s for %s: %v", eventType, customerID, err)
|
|
return
|
|
}
|
|
if h.dispatcher != nil {
|
|
go h.dispatcher.ProcessEvent(customerID, eventType, severity, msg, string(details), "hub")
|
|
}
|
|
}
|
|
|
|
func roundAge(d time.Duration) string {
|
|
if d < time.Minute {
|
|
return fmt.Sprintf("%ds", int(d.Seconds()))
|
|
}
|
|
return d.Round(time.Minute).String()
|
|
}
|