felhom.eu/documentation/audits/hub-safety-2026-10-05/partA/route-table.md

Hub state-changing routes and how each is protected (hub v0.135.0, R-135)

Every route below is reached through RequireAuth → ServeHTTP; the CSRF gate is the first thing ServeHTTP does for any method other than GET/HEAD/OPTIONS, before the route switch — so the protection is the same for every route, and an unknown path is refused by the gate before it can 404.

Route (representative path)	Protected how	Test
POST /configuration	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /apps/demo/reset-telemetry	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /apps/demo/dismiss-issues	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /offsite/endpoints	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /offsite/endpoints/1/delete	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /appliances/1/bind	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /appliances/1/discard	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /hosts/h1/delete	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /hosts/h1/reveal-recovery-credential	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /hosts/h1/request-logs	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /customers/c1/block	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /customers/c1/selfbind-link	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /customers/c1/unblock	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /customers/c1/geo/disable	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /customers/c1/floor	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /customers/c1/create-config	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /customers/c1/request-log-tail	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /configs/new	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /configuration/global-floor	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /configuration/artifacts	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /configuration/password	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /configs/c1/delete	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /configs/c1/edit	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /configs/c1/offsite-reissue	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /configs/c1/claim-resend	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /configs/c1/pbsdr-reissue	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /configs/c1/offsite-freeze	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /configs/c1/regen-password	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /configs/c1/reset	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /offsite/remove-unpinned/c1	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /offsite/abandon-cancel/c1	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /offsite/window-grant/c1	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /offsite/windows-enabled	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /offsite/key-audit	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /os/ring/h1	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /os/enabled/h1	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /os/approve-now	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /os/approve-docker	session cookie + token, OR Basic auth + X-Felhom-Operator	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /no-such-route	the gate, before routing (not a route)	TestR135_BasicAuthWithoutHeaderIsRefused, TestR135_SessionWithoutTokenIsRefused, TestR135_TheTwoAllowedShapesPassTheGate
POST /login	exempt (no session to ride; a wrong password is 401)	—
POST /bind/<token>	exempt (public self-bind; the e-mailed URL token is the capability, rate-limited)	existing selfbind_test.go
GET routes	not gated by design (a GET must not change state). Not audited in this session for a GET that writes — the route switch sends POST-only actions to handlers that check MethodPost, but the GET renderers were not read line by line	TestR135_GetIsNotGated