fix(#1367): mint-seat-credential — secrets out of argv; discriminating pins (review 259 blocker, review 260 SF1-SF3)
ci/woodpecker/pr/ci Pipeline was successful
ci/woodpecker/pr/ci Pipeline was successful
Blocker (rev-security-01 review 259): admin token, generated password and minted seat token travelled curl ARGV (three Authorization sites, -u at the mint, inline -d bodies), leaking to /proc cmdline and bash -x traces — the durable password under must_change_password:false is a live credential. All three now travel in 0600 staging files: --config for the Authorization header (the landed gitea_write_auth_config pattern), a user= directive for basic auth at the mint, --data @file for bodies. Unlinked after each use; M6 asserts no call is unauthenticated and no body is inline. Scope pin (SF2 + rev-security-01 M1, same defect): a mutant writing the REQUESTED scopes passed green because the grep target appears in both sets. M7 now asserts write:issue (requested, not granted) is ABSENT; mutant killed. SF3: hyphenated instance overrides map hyphen->underscore exactly like seat-logins.sh (url_override_var); M8 pins it; the uppercase-only mutant dies at the invalid-variable-name refusal again, now by design. SF1: mint-seat-credential.sh mode 755 (update-index), README invocation updated to name the now-required MOSAIC_SEAT_EMAIL_DOMAIN. Framework-PR firewall answer (rev-security-01): the email domain has NO default — unset is rc=3 with a named variable (M9); the instance host map stays per the seat-logins.sh precedent already on next. Estate domains belong to the estate, not the tree.
This commit is contained in:
@@ -11,6 +11,17 @@
|
||||
# override MOSAIC_GITEA_URL_<INSTANCE> is honoured.
|
||||
# M4 no admin seat configured is a usage error (rc=3), nothing written.
|
||||
# M5 the admin token value never appears on stdout or stderr.
|
||||
# M6 secrets never touch argv: no Authorization header, no -u user:pass, no
|
||||
# inline --data JSON carrying the password, on any curl invocation; auth
|
||||
# travels in --config files and bodies in --data @files (#1343 class,
|
||||
# rev-security-01 review 259 blocker).
|
||||
# M7 the scopes record discriminates: a requested-but-not-granted scope
|
||||
# (write:issue) must be ABSENT from .scopes — the pin is on the RESPONSE,
|
||||
# and a mutant writing the requested set fails here (both reviewers).
|
||||
# M8 hyphenated instance names resolve their override through the underscore
|
||||
# variable, matching seat-logins.sh (SF3).
|
||||
# M9 MOSAIC_SEAT_EMAIL_DOMAIN is required: unset is a usage error (rc=3),
|
||||
# nothing written (framework-PR firewall answer).
|
||||
set -euo pipefail
|
||||
|
||||
WORK_ROOT="${AGENT_WORK_ROOT:-${TMPDIR:-/tmp}}"
|
||||
@@ -38,23 +49,34 @@ done
|
||||
export PATH="$MOCK_BIN:$SYS_BIN" CALLS
|
||||
export MOSAIC_BRAIN_HOME="$BRAIN"
|
||||
export MOSAIC_GITEA_URL_ALPHA="https://alpha.example.test"
|
||||
export MOSAIC_SEAT_EMAIL_DOMAIN="seats.example.test"
|
||||
unset MOSAIC_ADMIN_SEAT MOSAIC_GITEA_INSTANCES
|
||||
|
||||
# --- mock curl: records method + URL, answers the minting sequence -----------
|
||||
# --- mock curl: records method + URL + a REDACTED auth marker, answers minting --
|
||||
cat > "$MOCK_BIN/curl" <<'EOF'
|
||||
#!/bin/bash
|
||||
method=GET; url=""; out=""; wcode=0
|
||||
method=GET; url=""; out=""; wcode=0; auth=""; body=""
|
||||
while [ $# -gt 0 ]; do
|
||||
case "$1" in
|
||||
-X) method="$2"; shift 2 ;;
|
||||
-o) out="$2"; shift 2 ;;
|
||||
-w) wcode=1; shift 2 ;;
|
||||
-H|-d|-u) shift 2 ;;
|
||||
--config)
|
||||
if grep -q 'Authorization: token' "$2" 2>/dev/null; then auth="${auth}token,"; fi
|
||||
if grep -q '^user = ' "$2" 2>/dev/null; then auth="${auth}user,"; fi
|
||||
shift 2 ;;
|
||||
--data)
|
||||
case "$2" in
|
||||
@*) body="@file" ;;
|
||||
*) body="inline" ;;
|
||||
esac
|
||||
shift 2 ;;
|
||||
-H|-u) shift 2 ;;
|
||||
http*) url="$1"; shift ;;
|
||||
*) shift ;;
|
||||
esac
|
||||
done
|
||||
printf '%s %s\n' "$method" "$url" >> "$CALLS"
|
||||
printf '%s %s auth=%s body=%s\n' "$method" "$url" "${auth:-NONE}" "$body" >> "$CALLS"
|
||||
emit() { if [ -n "$out" ]; then printf '%s' "$1" > "$out"; else printf '%s' "$1"; fi; }
|
||||
case "$method $url" in
|
||||
"GET "*/api/v1/users/newseat) exit 22 ;; # 404 under -f: account does not exist yet
|
||||
@@ -77,6 +99,13 @@ rc=$(run newseat)
|
||||
grep -q 'MOSAIC_ADMIN_SEAT' "$SANDBOX/err" || fail "M4: error does not name MOSAIC_ADMIN_SEAT"
|
||||
[ ! -e "$BRAIN/fleet/agents/newseat/secrets/gitea-alpha-newseat.token" ] || fail "M4: a token was written without an admin seat"
|
||||
|
||||
# M9: email domain is required, unset is a usage error, nothing written.
|
||||
rc=$(MOSAIC_ADMIN_SEAT=admin-seat MOSAIC_GITEA_INSTANCES=alpha MOSAIC_SEAT_EMAIL_DOMAIN= run newseat)
|
||||
[ "$rc" = 3 ] || fail "M9: expected rc=3 with no email domain, got $rc: $(cat "$SANDBOX/err")"
|
||||
grep -q 'MOSAIC_SEAT_EMAIL_DOMAIN' "$SANDBOX/err" || fail "M9: error does not name MOSAIC_SEAT_EMAIL_DOMAIN"
|
||||
[ ! -s "$CALLS" ] || fail "M9: API called without an email domain"
|
||||
[ ! -e "$BRAIN/fleet/agents/newseat/secrets/gitea-alpha-newseat.token" ] || fail "M9: token written without an email domain"
|
||||
|
||||
# M1 + M3 + M5: mint on the single configured instance.
|
||||
: > "$CALLS"
|
||||
rc=$(MOSAIC_ADMIN_SEAT=admin-seat MOSAIC_GITEA_INSTANCES=alpha run newseat)
|
||||
@@ -92,7 +121,33 @@ grep -q 'alpha: create, minted, GET /user -> newseat' "$SANDBOX/out" || fail "M1
|
||||
grep -q 'https://alpha.example.test/api/v1/admin/users' "$CALLS" || fail "M3: URL override not honoured: $(cat "$CALLS")"
|
||||
if grep -q 'usc\|mosaicstack' "$CALLS"; then fail "M3: an instance outside MOSAIC_GITEA_INSTANCES was touched: $(cat "$CALLS")"; fi
|
||||
grep -q 'tea not on PATH' "$SANDBOX/err" || fail "tea-absent path should warn, not fail: $(cat "$SANDBOX/err")"
|
||||
if grep -q "$ADMIN_TOKEN_VALUE" "$SANDBOX/out" "$SANDBOX/err"; then fail "M5: admin token value leaked to output"; fi
|
||||
if grep -q "$ADMIN_TOKEN_VALUE" "$SANDBOX/out" "$SANDBOX/err" "$CALLS"; then fail "M5: admin token value leaked to output or call log"; fi
|
||||
|
||||
# M7: scopes pin discriminates — requested-but-not-granted scope is ABSENT.
|
||||
if grep -q 'write:issue' "$SLOT/gitea-alpha-newseat.scopes"; then
|
||||
fail "M7: write:issue appears in .scopes — the record is the REQUESTED set, not the response"
|
||||
fi
|
||||
|
||||
# M6: no secret ever travels argv — every call authenticates via --config
|
||||
# (token header or user= basic-auth directive) and bodies go as --data @file.
|
||||
while IFS= read -r line; do
|
||||
case "$line" in
|
||||
*auth=NONE*) fail "M6: unauthenticated call: $line" ;;
|
||||
*body=inline*) fail "M6: inline body (secret in argv risk): $line" ;;
|
||||
esac
|
||||
done < "$CALLS"
|
||||
[ "$(grep -c 'auth=token' "$CALLS")" -eq 3 ] || fail "M6: expected exactly 3 token-auth calls (exists-check, admin write, verify), got: $(cat "$CALLS")"
|
||||
grep -q 'auth=user' "$CALLS" || fail "M6: mint call did not use the user= directive: $(cat "$CALLS")"
|
||||
|
||||
# M8: hyphenated instance name resolves its override via the underscore variable.
|
||||
printf '%s\n' "$ADMIN_TOKEN_VALUE" > "$BRAIN/fleet/agents/admin-seat/secrets/gitea-my-inst-admin-seat.token"
|
||||
chmod 600 "$BRAIN/fleet/agents/admin-seat/secrets/gitea-my-inst-admin-seat.token"
|
||||
export MOSAIC_GITEA_URL_MY_INST="https://myinst.example.test"
|
||||
: > "$CALLS"; rm -rf "$BRAIN/fleet/agents/newseat"
|
||||
rc=$(MOSAIC_ADMIN_SEAT=admin-seat MOSAIC_GITEA_INSTANCES=my-inst run newseat)
|
||||
[ "$rc" = 0 ] || fail "M8: hyphenated instance mint failed rc=$rc: $(cat "$SANDBOX/err")"
|
||||
grep -q 'https://myinst.example.test/api/v1/admin/users' "$CALLS" || fail "M8: hyphen override (MY_INST) not honoured: $(cat "$CALLS")"
|
||||
unset MOSAIC_GITEA_URL_MY_INST
|
||||
|
||||
# M2: admin token missing for the instance is reported, rc=1, nothing written.
|
||||
rm -rf "$BRAIN/fleet/agents/newseat"
|
||||
|
||||
Reference in New Issue
Block a user