Secure first administrator bootstrap (#242) #243
No reviewers
Labels
No labels
accessibility
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
P1
P2
P3
question
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
Creatidy/scarcity-router!243
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "issue-242-secure-bootstrap"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Refs #242.
Require a locally provisioned 15-minute claim and atomically consume its verifier with insert-only first administrator creation in the existing SQLite store. JSON and same-origin browser onboarding share the authorization. Local reissuance before setup supports recovery without an unauthenticated reset. Operator instructions specify the running server's data directory, including the Compose volume.
Base
0493ed2b1892be6df0f96fb227fc96c68186e229; current HEAD17908f41111039aa0deaf4c3b9026fdb68923069. A barrier-controlled pre-fix regression produced two successful concurrent bootstrap calls; no observed real-world exploit is claimed. Tests cover concurrent HTTP and independent stores, rollback, expiry, reissue, cross-origin and installed composed-server onboarding with distinct default and configured data directories.Post-remediation validation:
make check3204 tests OK, 18 skipped;uv run basedpyright0 diagnostics;make package-checkpassed;git diff --checkand staged check clean. Security-critical independent exact-head correctness/security/UX review and current Forgejo CI remain required. No release or deployment.Review reservation #1/10: imminent fresh user-visible independent whole-PR security/correctness/UX review, requested GPT-6.1 Sol High, frozen HEAD
2bdb6459d1841555f8aceda422a0e53400fa0705, base/merge-base0493ed2b1892be6df0f96fb227fc96c68186e229. Reservation is not a verdict; all actual outcomes and further ordinals remain bounded and recorded.Review #1/10 dispatched via native user-visible session
ses_e68690041ffeto6Yk2WAAskxX6, requested GPT-6.1 Sol / openai / high, frozen HEAD2bdb6459d1841555f8aceda422a0e53400fa0705and base0493ed2b1892be6df0f96fb227fc96c68186e229. Runtime backend identity is not inferred from dispatch. Result pending.Independent review #1/10: REQUEST_CHANGES at HEAD
2bdb6459d1841555f8aceda422a0e53400fa0705, base0493ed2b1892be6df0f96fb227fc96c68186e229; native sessionses_e68690041ffeto6Yk2WAAskxX6, requested GPT-6.1 Sol/openai/high (runtime backend identity unobserved). P2 UX: displayed provisioning command omits--data-dir, so documented container/custom-data deployments can issue a valid-looking claim against the wrong store and cannot complete onboarding. Required: explicit same-store/custom-dir guidance, actual Compose first-run recipe, deterministic installed workflow coverage with distinct default and server directories. Reviewer recovered complete frozen diff and source through canonical pinned Forgejo getters after local source/Bash permission denial; no reviewer-run tests or independent local cleanliness verification. UX impact material. No approval; remediate and re-review complete changed HEAD.Review reservation #2/10: imminent fresh user-visible independent whole-PR security/correctness/UX review, requested GPT-6.1 Sol High, frozen HEAD
17908f41111039aa0deaf4c3b9026fdb68923069, base/merge-base0493ed2b1892be6df0f96fb227fc96c68186e229. Reservation is not a verdict.Review #1 remediation committed at
17908f41111039aa0deaf4c3b9026fdb68923069: onboarding now shows the explicit same-store requirement without disclosing the actual private path; Compose and container instructions target/data; installed-wheel test distinguishes default and configured stores and verifies wrong-store rejection and correct-store success. Post-remediationmake check: 3204 passed, 18 skipped; basedpyright and package-check passed. Prior CI success applies only to the superseded HEAD.Review #2/10 dispatched via native user-visible session
ses_e6853cb8affeNAmRAp1FAn3E7j, requested GPT-6.1 Sol/openai/high, frozen HEAD17908f41111039aa0deaf4c3b9026fdb68923069, base0493ed2b1892be6df0f96fb227fc96c68186e229. Runtime backend identity is not inferred from dispatch; result pending.Independent review #2/10: APPROVE, findings empty, exact HEAD
17908f41111039aa0deaf4c3b9026fdb68923069, base/merge-base0493ed2b1892be6df0f96fb227fc96c68186e229; native sessionses_e6853cb8affeNAmRAp1FAn3E7j, requested GPT-6.1 Sol/openai/high (runtime backend identity not inferred from dispatch). Complete 18-file diff and security/transaction/HTTP/installed operator UX were inspected; exact Git objects and ancestry were independently verified through the permitted shared object database and SHA-pinned canonical source despite direct delivery-checkout permission denial. UX: added local provisioning is justified; no material regression found. Reviewer did not execute tests/container, so local gate and exact-head CI remain separate evidence. Forgejo CI #3431 pending.Standalone acceptance: READY_TO_MERGE, not merged. Independent review #2 APPROVE with no findings at HEAD
17908f41111039aa0deaf4c3b9026fdb68923069and base0493ed2b1892be6df0f96fb227fc96c68186e229; exact-HEAD Forgejo PR workflow run #3431 succeeded. Fresh canonical PR refs and fetched develop match, delivery checkout clean, no merge commits; localmake check3204 tests / 18 skipped, basedpyright and package-check passed. Forgejo job-detail endpoint returned 404 on this instance; run-level status is success. Standalone delivery does not grant merge/closure authority. No release or deployment.