fix(user): harden the first-boot setup window #30

Merged

nalum merged 1 commit from fix/setup-window into main

2026-08-13 11:40:41 +00:00

nalum commented

2026-08-13 10:25:40 +00:00

Owner

Three defects in the anonymous zero-users window (ADR-0018):

TOCTOU: the founding-admin count check ran outside a transaction — two racing anonymous Creates could both become admin. The write now runs in WithinTx with an in-transaction recount, mirroring ImportData's existing fix. Race test: four concurrent Creates, exactly one wins, losers get the same "setup is complete" verdict.
Timing side channel: X-Initial-Admin-Token was compared with != in both Create and ImportData — now crypto/subtle.ConstantTimeCompare.
Silently unset token in shipped defaults: the server now logs a prominent boot WARN when the install is empty and no EAG_INITIAL_ADMIN_TOKEN is set (no refusal — seed-family, local dev and test helpers keep working). The timoni values and TrueNAS compose now document the window explicitly ("whoever reaches it first owns the install") with a CHANGE-ME placeholder.

ADR-0018 updated with the hardening note. Full suite + integration + timoni mod vet pass.

Fixes #9

🤖 Generated with Claude Code

Three defects in the anonymous zero-users window (ADR-0018): 1. **TOCTOU**: the founding-admin count check ran outside a transaction — two racing anonymous Creates could both become admin. The write now runs in `WithinTx` with an in-transaction recount, mirroring ImportData's existing fix. Race test: four concurrent Creates, exactly one wins, losers get the same "setup is complete" verdict. 2. **Timing side channel**: `X-Initial-Admin-Token` was compared with `!=` in both Create and ImportData — now `crypto/subtle.ConstantTimeCompare`. 3. **Silently unset token in shipped defaults**: the server now logs a prominent boot WARN when the install is empty and no `EAG_INITIAL_ADMIN_TOKEN` is set (no refusal — seed-family, local dev and test helpers keep working). The timoni values and TrueNAS compose now document the window explicitly ("whoever reaches it first owns the install") with a CHANGE-ME placeholder. ADR-0018 updated with the hardening note. Full suite + integration + `timoni mod vet` pass. Fixes #9 🤖 Generated with [Claude Code](https://claude.com/claude-code)

nalum added 1 commit

2026-08-13 10:25:40 +00:00

fix(user): harden the first-boot setup window

check / web (push) Successful in 1m30s

Details

check / go (push) Successful in 1m49s

Details

a0290959ca

While the install is empty, UserService/Create and
SystemService/ImportData answer anonymously — and that window had three
soft edges. The founding-admin count ran outside the transaction that
wrote the user, so two racing anonymous Creates could both become
admin; the X-Initial-Admin-Token comparison used != and leaked timing;
and the shipped deploy defaults left the token unset without a word,
so an exposed fresh install was silently claimable.

Now the count re-checks inside the same transaction that writes the
founding admin (the pattern ImportData already used), the token
compare is crypto/subtle constant-time on both endpoints, and a server
booting onto an empty install with no token set warns loudly instead
of silently opening the window. Refusing to boot was rejected: the
documented local-dev and seed flows run tokenless on purpose.

Fixes #9

nalum referenced this pull request

2026-08-13 10:43:55 +00:00

fix(server): cap request bodies and import decompression #35

nalum force-pushed fix/setup-window from a0290959ca

check / web (push) Successful in 1m30s

Details

check / go (push) Successful in 1m49s

Details

to 8e12cfc0ce

tag / tag (push) Has been cancelled

Details

check / go (push) Successful in 1m47s