felhom.eu/documentation/audits/hub-tokens-2026-10-15/red-proof/7-csrf-basic.txt at ddbcabebb4e380e4c8c679efd92a3aa10d5f2dbe - felhom.eu - Gitea: Git with a cup of tea

admin/felhom.eu

0 Fork 0

Files

T

admin d62cc08b2e

gates / gates (push) Successful in 6m44s

Details

hub v0.152.0: operator access tokens with scopes (09 §3 decision 251, operator 2026-10-15 11:38)

- Configuration → Access tokens: named, scoped (group read/write), expiring (≤365 d), shown once,
  stored SHA-256 only, every use logged by name. Bearer fhp_… on the web surface only; /api/v1 refuses it.
- Route table = the code's single source (web/routes.go), pinned to ServeHTTP's switch; session-only:
  secrets shown/minted, deletes/resets, password, tokens.
- R-952 closed: /api/v1 route table names each caller, pinned to the switch; no-credential refusal test.
- Fail-open fixed: an empty operator password served the UI open (main skipped RequireAuth). Live hub never open.
- 05 §17, 04 §6.2, 13, 09 §3 251; register 155→157 (+R-1054, R-1055, R-1056, −R-952); STATUS.
- website: prowlarr-logo.svg (byte copy from felhom.eu-media) — the site gate refused every push.
Not deployed — waits for the operator's yes.

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

2026-10-15 12:20:35 +02:00

7 lines

240 B

Plaintext

Raw Blame History

 === RUN   TestToken_CSRFRuleUnchangedForBasic
     tokens_test.go:437: Basic without X-Felhom-Operator: 303, want 403
 --- FAIL: TestToken_CSRFRuleUnchangedForBasic (0.06s)
 FAIL
 FAIL	gitea.dooplex.hu/admin/felhom-hub/internal/web	0.080s
 FAIL