mirror of https://github.com/gadgethd/ukmesh.git synced 2026-10-15 02:30:12 +00:00

Files

T

b285cdb288 fix(security,ops): close ukmesh auth/users findings (#50 #51 #52 #53 #58 ) (#103 )

* docs: add C5a mission handoff

* security: classify channel keys and baseline reviewed findings

* security: revalidate MQTT auth and revoke owner sessions

* test(ops): cover concurrent newuser grant updates

* fix(ops): preserve executable newuser test

* fix(ops): cover partial newuser rollback failures

* fix(owner): preserve password whitespace during login

* docs: add C5c mission handoff

* test(cache): drop stale authCache policy entry (cache removed by auth revalidation)

* docs: keep HANDOFF on current mission

---------

Co-authored-by: gadgethd <111318106+gadgethd@users.noreply.github.com>
Co-authored-by: hermes-gadget <284726080+hermes-gadget@users.noreply.github.com>

2026-10-01 00:09:44 +01:00

4.3 KiB

Raw Blame History

Mission C5c handoff

Status: complete locally Branch: fix/ukmesh-auth-users Push state: not pushed; coordinator relays these commits.

Commits

9ce8633 — security: classify channel keys and baseline reviewed findings
b50ecfa — security: revalidate MQTT auth and revoke owner sessions
c1bc7c8 — test(ops): cover concurrent newuser grant updates
a6b7a49 — fix(ops): preserve executable newuser test
771fc6f — fix(ops): cover partial newuser rollback failures
2be3357 — fix(owner): preserve password whitespace during login

Changes

#50: Classified the 41 committed recovered/community-known channels as intentionally public; environment-supplied keys are classified confidential. Replaced broad Gitleaks regex exceptions with 47 exact reviewed fingerprints and added full-history scans on push/PR plus a scheduled scan. A synthetic unclassified key was still rejected by Gitleaks.
#51: Removed positive MQTT credential caching. Existing credential-generation checks now fail closed on Redis read errors. Added owner-auth:revoke and dist/tools/revokeOwnerSessions.js for immediate session revocation after external MQTT password resets; the seven-day session lifetime was already in place.
#52: Added a two-process regression test that adds a grant during discovery and verifies the first process preserves it after reacquiring the lock. The reread/merge logic was already present.
#53: Marked credential, environment, and database mutations before issuing them so an interrupted/failed command reaches rollback. Added failures after credential, environment, database, and ACL changes.
#58: Kept username normalization and preserved password whitespace through browser and backend login validation. Added frontend and API tests.

Main overlap and audit note

Fetched origin/main before editing; it had no changes to these target files. This worktree remains based on the open #99 resolver branch. Existing session generations, seven-day expiry, newuser map reread/EXIT trap, and backend password preservation were already present in the base; this mission closed the remaining gaps and added regression tests.

The brief cites a historical broker credential. Gitleaks 8.30.0 scanned all 476 commits reachable from the fetched refs and found 47 historical hits, all reviewed as public channel values, test fixtures, or generated revision identifiers. It found no separate broker credential in those refs. The exact baseline does not allowlist an unidentified credential; Ben should still rotate the credential identified by the audit and confirm its source/history.

Tests and checks

cd backend && node --import tsx --test src/mqtt/channelRegistry.test.ts src/owner/mqttCredentialVerifier.test.ts src/owner/ownerSession.test.ts src/api/routes/owner.test.ts — passed, 7/7.
cd backend && ./node_modules/.bin/tsc --noEmit — passed.
cd frontend && ./node_modules/.bin/tsx --test src/pages/owner/ownerPortalModel.test.ts — passed, 5/5.
cd frontend && ./node_modules/.bin/tsc --noEmit — passed.
cd scripts && NPM_CONFIG_CACHE="$PWD/.tmp/npm-cache" TMPDIR="$PWD/.tmp" npm test — passed (observer-key, infrastructure resolver, concurrent newuser, and rollback tests).
gitleaks 8.30.0 git --config .gitleaks.toml --log-opts=--all --redact --no-banner — passed; 476 commits scanned, no unclassified findings.
git diff --check — passed.

Gated items for Ben

Rotate the MQTT broker credential identified in the audit. No broker/service/database operations were performed here.
Confirm all 41 committed channel values are intentionally public. Move any confidential value to managed environment configuration before deployment.
After deploying the backend tool, run node dist/tools/revokeOwnerSessions.js immediately after each MQTT password reset. Do not consider the reset complete unless the command succeeds.
Coordinate merge/push and deployment. Nothing was pushed or merged from this host.

Workspace note

Backend/frontend dependencies were installed from lockfiles into ignored node_modules. I initially ran those two npm ci commands without setting NPM_CONFIG_CACHE, so npm used its default host cache outside the worktree; subsequent script dependency installation used a worktree-local cache. No live checkout, .env, service/container, or database was changed, and no push was made.

4.3 KiB Raw Blame History