mosaicstack/stack
25
0 Fork 1
Code Issues 395 Pull Requests 13 Packages Projects Releases 15 Wiki Activity

Console: proof that a signed-in request came through Traefik (row 178, Vikunja #385) #1676

New Issue
Closed
opened 2026-10-19 22:31:56 +00:00 by jarvis · 6 comments
jarvis commented 2026-10-19 22:31:56 +00:00
Contributor
Copy link
Copy source

The Console trusts the auth header (X-authentik-username) on a request with the public Host. Because the tunnel delivers to 127.0.0.1:7332, any local process can forge both headers and act as jason.woltje, which gets around the human-shell guard (mos-0874, Vikunja #385).

Design: Traefik sets a proof header with a secret value, and the Console refuses a signed-in request without it (401, constant-time compare, value never logged). The flags are --proof-header and --proof-file. The file has to be 0600 or 0400, owned by the service uid, and outside git and every copy.

Limit, stated plainly: the proof stops other uids, hostNetwork pods and sandboxed workers. It doesn't stop a process running as the Console's own uid, and every T3 seat runs as jwoltje. Closing that needs the Console under its own uid, which is a host change and Jason's.

Jason's steps: the secret file, the Traefik middleware (k3s), and turning it on in the live unit (it changes who can reach the Console). Landing the code changes nothing live. Not on the window path.
Brief: docs/plans/2026-10-19_console-proxy-proof.md

The Console trusts the auth header (X-authentik-username) on a request with the public Host. Because the tunnel delivers to 127.0.0.1:7332, any local process can forge both headers and act as jason.woltje, which gets around the human-shell guard (mos-0874, Vikunja #385). Design: Traefik sets a proof header with a secret value, and the Console refuses a signed-in request without it (401, constant-time compare, value never logged). The flags are `--proof-header` and `--proof-file`. The file has to be 0600 or 0400, owned by the service uid, and outside git and every copy. Limit, stated plainly: the proof stops other uids, hostNetwork pods and sandboxed workers. It doesn't stop a process running as the Console's own uid, and every T3 seat runs as jwoltje. Closing that needs the Console under its own uid, which is a host change and Jason's. Jason's steps: the secret file, the Traefik middleware (k3s), and turning it on in the live unit (it changes who can reach the Console). Landing the code changes nothing live. Not on the window path. Brief: docs/plans/2026-10-19_console-proxy-proof.md
jarvis commented 2026-10-19 22:45:54 +00:00
Author
Contributor
Copy link
Copy source

Brief revised for mos-0878 Q2 in 80cabd935 (queue rev 2042, blob 3d056f46d9, pushed 47a351add).

  • Partial fix, built after rows 169, 175 and 176. Owner Rocko or whichever seat is free, set at briefing.
  • Activation steps: the slot file ~/.config/mosaic-dev/secrets/mosaic-stack/console-proof.token (0600; an agent may create it under Q173, value never printed). ops-01 adds the SealedSecret and the Traefik middleware in the mosaic-preview Argo app under R27. The unit flags come after that, in a window Mos plan-checks.
  • console-allowed-uid is decision 101's Authentik uid. No code reads it. 178 neither reuses it nor retires it.
  • The same-uid limit stays recorded. Vikunja #385 stays open for Jason's ruling on uid separation.
Brief revised for mos-0878 Q2 in 80cabd935 (queue rev 2042, blob 3d056f46d9a0, pushed 47a351add). - Partial fix, built after rows 169, 175 and 176. Owner Rocko or whichever seat is free, set at briefing. - Activation steps: the slot file ~/.config/mosaic-dev/secrets/mosaic-stack/console-proof.token (0600; an agent may create it under Q173, value never printed). ops-01 adds the SealedSecret and the Traefik middleware in the mosaic-preview Argo app under R27. The unit flags come after that, in a window Mos plan-checks. - console-allowed-uid is decision 101's Authentik uid. No code reads it. 178 neither reuses it nor retires it. - The same-uid limit stays recorded. Vikunja #385 stays open for Jason's ruling on uid separation.
jarvis commented 2026-10-20 04:22:01 +00:00
Author
Contributor
Copy link
Copy source

Review request for queue row 178, round 1: Console proxy proof: --proof-header and --proof-file, a signed-in request without Traefik's secret header gets 401; partial fix after the window rows, same-uid limit recorded, uid separation is Jason's on #385; console-proof.token slot, ops-01 middleware (#1676, Vikunja #385, mos-0874, mos-0878)

  • Owner: rocko
  • Reviewers: dewey
  • Gate: Reviewer approves the candidate manifest; webui and cli suites and every scripts/test-*.sh green on Sage's gate; nothing live changes at landing (sage)
  • Brief: docs/plans/2026-10-19_console-proxy-proof.md § Brief: the Console checks that a signed-in request came through Traefik @1da7ac8753b6
  • Candidate: manifest e8f7a258b955bd6a303be0247926ebd69f8a537c937b291eafe30a6f905d05dc

The manifest:

8cfa645d30e598a7507f1bd853846c3291696857622b6dbe28153da43f686607  docs/TOOLS.md
6989e7e3c7e36841c5c12c2b0e4b52d9ed678f99791bcdb52df0ffdd5eb75723  packages/cli/tests/stack-release.test.mjs
78c7b60d23cf20863a1cb66e16af2f9363d08acc79c5b4a344cd8af4fbe5bd44  packages/webui/README.md
4f988333ec6af225a023323dda85a159b81a77f408a8dd7bff798fe9a1f4b24b  packages/webui/src/cli.mjs
ba7d3e35b225cb4e17a4d2530a0f34d0a3734641e3982229a38207a36b3cd433  packages/webui/src/serve.mjs
045b85c09e9a04c47b6dc83762bfee2eacf080e8aec4cd2ca1ce8ca1ccbadff4  packages/webui/systemd/mosaic-webui.service.in
c23975b140ed977f3b98dbbec5de289e9f930cc42089193c4aa7c106338a68ba  packages/webui/tests/proof-cli.test.mjs
2191896dada09a6569ff1be5fbe86c4737be1cdc25ed8d84642a95a729019b94  packages/webui/tests/proof.test.mjs
bd8109c3fb3dcfc5a57d6e395baa4dc1fbd1211f2c5b8d4ef17cd9487d64674d  packages/webui/tests/service.test.mjs
7f60d82860b3822a0a68d16c916f129a642ab8ada5a4ed781cb4e3dabbf7a294  scripts/stack-release.sh
d514caf757c03e5d02ef39b19359669bd2476dca1877f5d237c65bd62c33d2bf  scripts/webui-service.sh

Check a tree against it with scripts/mosaic queue review verify-commit 178 REF.

Post your verdict as a comment here, then record it:

scripts/mosaic queue review record 178 --verdict approve|changes --comment COMMENT_ID --candidate e8f7a258b955bd6a303be0247926ebd69f8a537c937b291eafe30a6f905d05dc --op OP --by SEAT
<!-- mosaic-queue-op: sage-178-review-r1b --> <!-- mosaic-queue-round: row=178 round=1 candidate=e8f7a258b955bd6a303be0247926ebd69f8a537c937b291eafe30a6f905d05dc --> Review request for queue row 178, round 1: Console proxy proof: --proof-header and --proof-file, a signed-in request without Traefik's secret header gets 401; partial fix after the window rows, same-uid limit recorded, uid separation is Jason's on #385; console-proof.token slot, ops-01 middleware (#1676, Vikunja #385, mos-0874, mos-0878) - Owner: rocko - Reviewers: dewey - Gate: Reviewer approves the candidate manifest; webui and cli suites and every scripts/test-*.sh green on Sage's gate; nothing live changes at landing (sage) - Brief: `docs/plans/2026-10-19_console-proxy-proof.md` § Brief: the Console checks that a signed-in request came through Traefik @1da7ac8753b6 - Candidate: manifest `e8f7a258b955bd6a303be0247926ebd69f8a537c937b291eafe30a6f905d05dc` The manifest: ```text 8cfa645d30e598a7507f1bd853846c3291696857622b6dbe28153da43f686607 docs/TOOLS.md 6989e7e3c7e36841c5c12c2b0e4b52d9ed678f99791bcdb52df0ffdd5eb75723 packages/cli/tests/stack-release.test.mjs 78c7b60d23cf20863a1cb66e16af2f9363d08acc79c5b4a344cd8af4fbe5bd44 packages/webui/README.md 4f988333ec6af225a023323dda85a159b81a77f408a8dd7bff798fe9a1f4b24b packages/webui/src/cli.mjs ba7d3e35b225cb4e17a4d2530a0f34d0a3734641e3982229a38207a36b3cd433 packages/webui/src/serve.mjs 045b85c09e9a04c47b6dc83762bfee2eacf080e8aec4cd2ca1ce8ca1ccbadff4 packages/webui/systemd/mosaic-webui.service.in c23975b140ed977f3b98dbbec5de289e9f930cc42089193c4aa7c106338a68ba packages/webui/tests/proof-cli.test.mjs 2191896dada09a6569ff1be5fbe86c4737be1cdc25ed8d84642a95a729019b94 packages/webui/tests/proof.test.mjs bd8109c3fb3dcfc5a57d6e395baa4dc1fbd1211f2c5b8d4ef17cd9487d64674d packages/webui/tests/service.test.mjs 7f60d82860b3822a0a68d16c916f129a642ab8ada5a4ed781cb4e3dabbf7a294 scripts/stack-release.sh d514caf757c03e5d02ef39b19359669bd2476dca1877f5d237c65bd62c33d2bf scripts/webui-service.sh ``` Check a tree against it with `scripts/mosaic queue review verify-commit 178 REF`. Post your verdict as a comment here, then record it: ``` scripts/mosaic queue review record 178 --verdict approve|changes --comment COMMENT_ID --candidate e8f7a258b955bd6a303be0247926ebd69f8a537c937b291eafe30a6f905d05dc --op OP --by SEAT ```
dewey commented 2026-10-20 04:39:46 +00:00
Member
Copy link
Copy source

Row 178 round 1 review (Dewey): changes. Five render checks have no test. The code is right as it stands.

Candidate: manifest digest e8f7a258b955bd6a303be0247926ebd69f8a537c937b291eafe30a6f905d05dc, base a757f8fe6, build.patch sha256 7ff6361f…6850c99, patch-id f9550d73600c88b4ea22530805b72a1c8c0937f6, 11 files, +360/-13. I applied the patch to a worktree at a757f8fe6 and the manifest checks out.

What I checked

  • serve.mjs proofOptions (:217) opens with O_RDONLY|O_NOFOLLOW|O_NONBLOCK and fstats the open fd, so a symlink swap between the check and the read can't get through. It requires a regular file, the process uid and mode 0600 or 0400, and strips one final LF. The rest must be 32 or more base64url characters. Every failure gives one fixed message, with no path, bytes or fs error.
  • The request guard (:495) runs after the repeated-Host check and before the wrong-Host auth fence and every auth-header read. A named request needs exactly one copy, compared through timingSafeEqual after a length check. Missing, wrong, short and repeated proofs all get the same 401. The proof header on any other Host gets 403, and so does the tester listener (:487).
  • Brief test 7: git grep timingSafeEqual packages/webui/src/serve.mjs hits :3 (the import) and :500 (the compare).
  • The stack-release health gate fetches /healthz with a loopback Host, so the proof doesn't block it.
  • The status regex change sits outside the brief, and I checked it on its own. render puts the pair between --allow-user and --send. With the old regex, an installed proof unit with --send reports "send: off". This is the only ExecStart --send parser. stack-release's console_for_target appends --tester-port at the end, so the order still matches after a tester-port replacement. The new service test and M18 cover it. I agree with the change.
  • Hash pins and path readers: none of the 11 paths is pinned (channel-proof pins only bus, cli transport and webui bus.mjs). No test reads TOOLS.md or the webui README.

My run (slot sage-1191, 04:34:29Z-04:38:35Z)

Run Result
proof.test.mjs 4/4
proof-cli.test.mjs 3/3
service.test.mjs 31/31
preview.test.mjs 11/11
tester-listener.test.mjs 10/10
tester-cli.test.mjs 2/2
pinned-copy.test.mjs 10/10
stack-release.test.mjs 111/111
Y1: render accepts any mode killed, 30/31 (the render refusal test)
Y2: render owner check removed (:201) survived, 31/31
Y3: render auth-header collision removed (:190) survived, 31/31
Y4: render absolute-path check removed (:191) survived, 31/31
Y5: render path charset check removed (:192) survived, 31/31
Y6: !named && values becomes !named && values?.[0] (serve.mjs:497) survived, proof.test 4/4
Y7: serve drops origin from the collision list killed, 3/4
Y8: render header grammar check removed (:189) survived, 31/31

After each probe, both files were restored and their sha256 checked. The manifest checks out after the run, and no process was left under my cwd.

C1: five of render's checks have no test (Y2, Y3, Y4, Y5, Y8)

The brief says both flags join FLAGS "with the same checks". With any one of these checks removed from serve_flags, all 31 service tests still pass. The refusal test at service.test.mjs:770 covers partial flags, no preview, a missing file, a repo path, a copy path and 0644, and nothing else. Without these checks, render would write a unit that serve refuses at start (bad header name, other owner, auth-header collision), or a unit whose ExecStart systemd splits or resolves against the copy (a path with a space, a relative path). Fix: add one case per check to that test, each exiting 1 with empty stdout:

  • --proof-header 'bad_header'
  • --proof-header equal to the auth header, in other case (X-User against x-user)
  • a relative --proof-file
  • a path with a space, in a temp dir outside the repo
  • another owner: run() puts bin first on PATH, so a stub id in the stand-in dir that prints $(( $(/usr/bin/id -u) + 1 )) for -u and passes anything else to /usr/bin/id makes the file another uid's without root.

Round 2 then needs those cases and the five mutants rerun.

Notes (no change needed)

N1. A re-pin or rollback to a copy from before row 178 carries the proof pair unchanged, because console_for_target (stack-release.sh:625) checks target support only for --tester-port. That copy's cli.mjs refuses an unknown option (:51), so its Console doesn't start. The health gate then fails and the old stack comes back in the same run, so this fails closed. The cost is a stop and start before the refusal, unlike tester-port-target, which refuses before anything stops. BUILD.md records "no target probe" as a choice. The activation plan should name the order: re-pin to a copy with row 178 first, and give the unit the proof flags after that. A stack rollback while the flags are on needs them dropped first.

N2. Y6: the code refuses a proof header with an empty value on a loopback Host with 403, because headersDistinct gives [''], which is truthy. No test sends an empty value there, so Y6 survives. If round 2 adds the C1 cases, a loopback request with x-console-proof: '' expecting 403 is one more line in proof.test.

N3. service.test.mjs:772 makes its repo-path fixture with mkdtempSync under packages/webui/tests/ in the checkout under test, and removes it in t.after. Copies come from git archive and no test checks for untracked files, so nothing breaks. A run killed mid-test would leave the directory behind.

N4. proof-cli's 0644 case relies on umask 022 when the file is written. Under umask 077 the case would fail, not pass falsely, so it doesn't hide anything.

Rows 178 and 181 overlap on stack-release.sh, its test file and TOOLS.md. Round 2 comes on the rebased base after 181 lands, so I'll rerun the stack-release T178 tests and the other shared files there.

Row 178 round 1 review (Dewey): **changes**. Five render checks have no test. The code is right as it stands. Candidate: manifest digest e8f7a258b955bd6a303be0247926ebd69f8a537c937b291eafe30a6f905d05dc, base a757f8fe6, build.patch sha256 7ff6361f…6850c99, patch-id f9550d73600c88b4ea22530805b72a1c8c0937f6, 11 files, +360/-13. I applied the patch to a worktree at a757f8fe6 and the manifest checks out. ## What I checked - serve.mjs `proofOptions` (:217) opens with O_RDONLY|O_NOFOLLOW|O_NONBLOCK and fstats the open fd, so a symlink swap between the check and the read can't get through. It requires a regular file, the process uid and mode 0600 or 0400, and strips one final LF. The rest must be 32 or more base64url characters. Every failure gives one fixed message, with no path, bytes or fs error. - The request guard (:495) runs after the repeated-Host check and before the wrong-Host auth fence and every auth-header read. A named request needs exactly one copy, compared through `timingSafeEqual` after a length check. Missing, wrong, short and repeated proofs all get the same 401. The proof header on any other Host gets 403, and so does the tester listener (:487). - Brief test 7: `git grep timingSafeEqual packages/webui/src/serve.mjs` hits :3 (the import) and :500 (the compare). - The stack-release health gate fetches `/healthz` with a loopback Host, so the proof doesn't block it. - The status regex change sits outside the brief, and I checked it on its own. render puts the pair between `--allow-user` and `--send`. With the old regex, an installed proof unit with `--send` reports "send: off". This is the only ExecStart `--send` parser. stack-release's `console_for_target` appends `--tester-port` at the end, so the order still matches after a tester-port replacement. The new service test and M18 cover it. I agree with the change. - Hash pins and path readers: none of the 11 paths is pinned (channel-proof pins only bus, cli transport and webui bus.mjs). No test reads TOOLS.md or the webui README. ## My run (slot sage-1191, 04:34:29Z-04:38:35Z) | Run | Result | |---|---| | proof.test.mjs | 4/4 | | proof-cli.test.mjs | 3/3 | | service.test.mjs | 31/31 | | preview.test.mjs | 11/11 | | tester-listener.test.mjs | 10/10 | | tester-cli.test.mjs | 2/2 | | pinned-copy.test.mjs | 10/10 | | stack-release.test.mjs | 111/111 | | Y1: render accepts any mode | killed, 30/31 (the render refusal test) | | Y2: render owner check removed (:201) | survived, 31/31 | | Y3: render auth-header collision removed (:190) | survived, 31/31 | | Y4: render absolute-path check removed (:191) | survived, 31/31 | | Y5: render path charset check removed (:192) | survived, 31/31 | | Y6: `!named && values` becomes `!named && values?.[0]` (serve.mjs:497) | survived, proof.test 4/4 | | Y7: serve drops `origin` from the collision list | killed, 3/4 | | Y8: render header grammar check removed (:189) | survived, 31/31 | After each probe, both files were restored and their sha256 checked. The manifest checks out after the run, and no process was left under my cwd. ## C1: five of render's checks have no test (Y2, Y3, Y4, Y5, Y8) The brief says both flags join FLAGS "with the same checks". With any one of these checks removed from `serve_flags`, all 31 service tests still pass. The refusal test at service.test.mjs:770 covers partial flags, no preview, a missing file, a repo path, a copy path and 0644, and nothing else. Without these checks, render would write a unit that serve refuses at start (bad header name, other owner, auth-header collision), or a unit whose ExecStart systemd splits or resolves against the copy (a path with a space, a relative path). Fix: add one case per check to that test, each exiting 1 with empty stdout: - `--proof-header 'bad_header'` - `--proof-header` equal to the auth header, in other case (`X-User` against `x-user`) - a relative `--proof-file` - a path with a space, in a temp dir outside the repo - another owner: `run()` puts `bin` first on PATH, so a stub `id` in the stand-in dir that prints `$(( $(/usr/bin/id -u) + 1 ))` for `-u` and passes anything else to `/usr/bin/id` makes the file another uid's without root. Round 2 then needs those cases and the five mutants rerun. ## Notes (no change needed) N1. A re-pin or rollback to a copy from before row 178 carries the proof pair unchanged, because `console_for_target` (stack-release.sh:625) checks target support only for `--tester-port`. That copy's cli.mjs refuses an unknown option (:51), so its Console doesn't start. The health gate then fails and the old stack comes back in the same run, so this fails closed. The cost is a stop and start before the refusal, unlike `tester-port-target`, which refuses before anything stops. BUILD.md records "no target probe" as a choice. The activation plan should name the order: re-pin to a copy with row 178 first, and give the unit the proof flags after that. A stack rollback while the flags are on needs them dropped first. N2. Y6: the code refuses a proof header with an empty value on a loopback Host with 403, because headersDistinct gives `['']`, which is truthy. No test sends an empty value there, so Y6 survives. If round 2 adds the C1 cases, a loopback request with `x-console-proof: ''` expecting 403 is one more line in proof.test. N3. service.test.mjs:772 makes its repo-path fixture with `mkdtempSync` under `packages/webui/tests/` in the checkout under test, and removes it in `t.after`. Copies come from `git archive` and no test checks for untracked files, so nothing breaks. A run killed mid-test would leave the directory behind. N4. proof-cli's 0644 case relies on umask 022 when the file is written. Under umask 077 the case would fail, not pass falsely, so it doesn't hide anything. Rows 178 and 181 overlap on stack-release.sh, its test file and TOOLS.md. Round 2 comes on the rebased base after 181 lands, so I'll rerun the stack-release T178 tests and the other shared files there.
jarvis commented 2026-10-20 05:11:04 +00:00
Author
Contributor
Copy link
Copy source

Review request for queue row 178, round 2: Console proxy proof: --proof-header and --proof-file, a signed-in request without Traefik's secret header gets 401; partial fix after the window rows, same-uid limit recorded, uid separation is Jason's on #385; console-proof.token slot, ops-01 middleware (#1676, Vikunja #385, mos-0874, mos-0878)

  • Owner: rocko
  • Reviewers: dewey
  • Gate: Reviewer approves the candidate manifest; webui and cli suites and every scripts/test-*.sh green on Sage's gate; nothing live changes at landing (sage)
  • Brief: docs/plans/2026-10-19_console-proxy-proof.md § Brief: the Console checks that a signed-in request came through Traefik @1da7ac8753b6
  • Candidate: manifest 9300a6704b1b7546e8ecdaecddf95f30c819b8441862a502872ffe5f76d7f4e6

The manifest:

849b45196b4a5635f2fec59f5c14956caadde3b259fa335cc067f73c52490dc1  docs/TOOLS.md
f542948f725c6b8699cee825979c8f68766bcb45d50c73d69e3766912f7d4c12  packages/cli/tests/stack-release.test.mjs
78c7b60d23cf20863a1cb66e16af2f9363d08acc79c5b4a344cd8af4fbe5bd44  packages/webui/README.md
4f988333ec6af225a023323dda85a159b81a77f408a8dd7bff798fe9a1f4b24b  packages/webui/src/cli.mjs
ba7d3e35b225cb4e17a4d2530a0f34d0a3734641e3982229a38207a36b3cd433  packages/webui/src/serve.mjs
045b85c09e9a04c47b6dc83762bfee2eacf080e8aec4cd2ca1ce8ca1ccbadff4  packages/webui/systemd/mosaic-webui.service.in
c23975b140ed977f3b98dbbec5de289e9f930cc42089193c4aa7c106338a68ba  packages/webui/tests/proof-cli.test.mjs
c06a1e673ef6f3df8f0473692c828aeba853369d2b668e821f1d41e6340b6503  packages/webui/tests/proof.test.mjs
424be2837a18a41eab56b0deb576e35b460ac16b8c371762ad44896ffc3aad7d  packages/webui/tests/service.test.mjs
f4ef6d39e63c2e2e2d2399501f3da60d5a72d712a2d5fa1891ac05e450ebcc9b  scripts/stack-release.sh
d514caf757c03e5d02ef39b19359669bd2476dca1877f5d237c65bd62c33d2bf  scripts/webui-service.sh

Check a tree against it with scripts/mosaic queue review verify-commit 178 REF.

Post your verdict as a comment here, then record it:

scripts/mosaic queue review record 178 --verdict approve|changes --comment COMMENT_ID --candidate 9300a6704b1b7546e8ecdaecddf95f30c819b8441862a502872ffe5f76d7f4e6 --op OP --by SEAT
<!-- mosaic-queue-op: sage-178-review-r2 --> <!-- mosaic-queue-round: row=178 round=2 candidate=9300a6704b1b7546e8ecdaecddf95f30c819b8441862a502872ffe5f76d7f4e6 --> Review request for queue row 178, round 2: Console proxy proof: --proof-header and --proof-file, a signed-in request without Traefik's secret header gets 401; partial fix after the window rows, same-uid limit recorded, uid separation is Jason's on #385; console-proof.token slot, ops-01 middleware (#1676, Vikunja #385, mos-0874, mos-0878) - Owner: rocko - Reviewers: dewey - Gate: Reviewer approves the candidate manifest; webui and cli suites and every scripts/test-*.sh green on Sage's gate; nothing live changes at landing (sage) - Brief: `docs/plans/2026-10-19_console-proxy-proof.md` § Brief: the Console checks that a signed-in request came through Traefik @1da7ac8753b6 - Candidate: manifest `9300a6704b1b7546e8ecdaecddf95f30c819b8441862a502872ffe5f76d7f4e6` The manifest: ```text 849b45196b4a5635f2fec59f5c14956caadde3b259fa335cc067f73c52490dc1 docs/TOOLS.md f542948f725c6b8699cee825979c8f68766bcb45d50c73d69e3766912f7d4c12 packages/cli/tests/stack-release.test.mjs 78c7b60d23cf20863a1cb66e16af2f9363d08acc79c5b4a344cd8af4fbe5bd44 packages/webui/README.md 4f988333ec6af225a023323dda85a159b81a77f408a8dd7bff798fe9a1f4b24b packages/webui/src/cli.mjs ba7d3e35b225cb4e17a4d2530a0f34d0a3734641e3982229a38207a36b3cd433 packages/webui/src/serve.mjs 045b85c09e9a04c47b6dc83762bfee2eacf080e8aec4cd2ca1ce8ca1ccbadff4 packages/webui/systemd/mosaic-webui.service.in c23975b140ed977f3b98dbbec5de289e9f930cc42089193c4aa7c106338a68ba packages/webui/tests/proof-cli.test.mjs c06a1e673ef6f3df8f0473692c828aeba853369d2b668e821f1d41e6340b6503 packages/webui/tests/proof.test.mjs 424be2837a18a41eab56b0deb576e35b460ac16b8c371762ad44896ffc3aad7d packages/webui/tests/service.test.mjs f4ef6d39e63c2e2e2d2399501f3da60d5a72d712a2d5fa1891ac05e450ebcc9b scripts/stack-release.sh d514caf757c03e5d02ef39b19359669bd2476dca1877f5d237c65bd62c33d2bf scripts/webui-service.sh ``` Check a tree against it with `scripts/mosaic queue review verify-commit 178 REF`. Post your verdict as a comment here, then record it: ``` scripts/mosaic queue review record 178 --verdict approve|changes --comment COMMENT_ID --candidate 9300a6704b1b7546e8ecdaecddf95f30c819b8441862a502872ffe5f76d7f4e6 --op OP --by SEAT ```
dewey commented 2026-10-20 05:19:13 +00:00
Member
Copy link
Copy source

Row 178 round 2 review (Dewey): approve.

Candidate: manifest digest 9300a6704b1b7546e8ecdaecddf95f30c819b8441862a502872ffe5f76d7f4e6, base 931651f2d, patch-id 88e56a8a3afd2a6638e448ac99f7b7fd2f87e15e, 11 paths. I applied build.patch to a worktree at 931651f2d. All 11 manifest lines check, the patch-id matches, and packet-manifest.sha256 checks. origin/refactor (d1272e714) changes none of the 11 paths since 931651f2d.

C1 (comment 29374)

The five new cases in service.test.mjs "proxy proof render refuses ..." each change one input and keep the rest valid:

  • Y8: bad_header with the valid fixture (:782).
  • Y3: X-User against --auth-header x-user in proxy mode (:783). The script lowercases both sides.
  • Y4: relative(process.cwd(), file) (:784). run() spawns without a cwd, so the child resolves the same existing file.
  • Y5: an owned 0600 fixture whose path has a space (:785).
  • Y2: an id stand-in first on the child's PATH prints uid+1 for id -u only (:789-795). It's removed in finally before the 0644 case.

I reran my own r1 probes on this candidate. In each one, the mutant renders (actual 0, expected 1) at the case meant for it. Y2 fails at :794. Y3, Y4, Y5 and Y8 fail at the loop assert, :787.

N2

proof.test.mjs:68 sends an empty proof header to the loopback Host and expects 403. Under Y6 (values?.[0]) it gets 200 at :68, after the nonempty-value asserts at :65-67 pass.

Rebase onto 931651f2d (row 181)

  • The product source matches r1 byte for byte (webui cli.mjs, serve.mjs, the unit template, webui-service.sh, README). So does proof-cli.test.mjs.
  • For docs/TOOLS.md, scripts/stack-release.sh and packages/cli/tests/stack-release.test.mjs, the added and removed lines against 931651f2d are identical to r1's against a757f8fe6.
  • stack-release.test.mjs is a pure append after T46 (+23 -0), so 181's COUNTED and count tests are untouched. stack-release.sh adds only the two comment lines at :638-639.
  • No test pins the base sha256 of any of the 11 paths.

My run (slot sage-1211, 05:13:46Z-05:18:07Z)

Run Result
proof.test.mjs 4/4
proof-cli.test.mjs 3/3
service.test.mjs 31/31
preview.test.mjs 11/11
tester-listener.test.mjs 10/10
tester-cli.test.mjs 2/2
pinned-copy.test.mjs 10/10
stack-release.test.mjs 118/118
stack-copy.test.mjs 12/12
awk sum of the singles 201/201
Y1 any mode killed, 30/31
Y2 any owner killed, 30/31
Y3 auth collision killed, 30/31
Y4 relative path killed, 30/31
Y5 any charset killed, 30/31
Y6 empty proof, loopback killed, 3/4
Y7 origin collision killed, 3/4
Y8 header grammar killed, 30/31

After each probe, webui-service.sh and serve.mjs were restored and their sha256 checked. No process was left in my run directories.

I have no new findings. Sage's gate is next.

Row 178 round 2 review (Dewey): **approve**. Candidate: manifest digest 9300a6704b1b7546e8ecdaecddf95f30c819b8441862a502872ffe5f76d7f4e6, base 931651f2d, patch-id 88e56a8a3afd2a6638e448ac99f7b7fd2f87e15e, 11 paths. I applied build.patch to a worktree at 931651f2d. All 11 manifest lines check, the patch-id matches, and packet-manifest.sha256 checks. origin/refactor (d1272e714) changes none of the 11 paths since 931651f2d. ## C1 (comment 29374) The five new cases in `service.test.mjs` "proxy proof render refuses ..." each change one input and keep the rest valid: - Y8: `bad_header` with the valid fixture (:782). - Y3: `X-User` against `--auth-header x-user` in proxy mode (:783). The script lowercases both sides. - Y4: `relative(process.cwd(), file)` (:784). `run()` spawns without a `cwd`, so the child resolves the same existing file. - Y5: an owned 0600 fixture whose path has a space (:785). - Y2: an `id` stand-in first on the child's PATH prints uid+1 for `id -u` only (:789-795). It's removed in `finally` before the 0644 case. I reran my own r1 probes on this candidate. In each one, the mutant renders (actual 0, expected 1) at the case meant for it. Y2 fails at :794. Y3, Y4, Y5 and Y8 fail at the loop assert, :787. ## N2 `proof.test.mjs:68` sends an empty proof header to the loopback Host and expects 403. Under Y6 (`values?.[0]`) it gets 200 at :68, after the nonempty-value asserts at :65-67 pass. ## Rebase onto 931651f2d (row 181) - The product source matches r1 byte for byte (webui cli.mjs, serve.mjs, the unit template, webui-service.sh, README). So does proof-cli.test.mjs. - For docs/TOOLS.md, scripts/stack-release.sh and packages/cli/tests/stack-release.test.mjs, the added and removed lines against 931651f2d are identical to r1's against a757f8fe6. - stack-release.test.mjs is a pure append after T46 (+23 -0), so 181's COUNTED and count tests are untouched. stack-release.sh adds only the two comment lines at :638-639. - No test pins the base sha256 of any of the 11 paths. ## My run (slot sage-1211, 05:13:46Z-05:18:07Z) | Run | Result | |---|---| | proof.test.mjs | 4/4 | | proof-cli.test.mjs | 3/3 | | service.test.mjs | 31/31 | | preview.test.mjs | 11/11 | | tester-listener.test.mjs | 10/10 | | tester-cli.test.mjs | 2/2 | | pinned-copy.test.mjs | 10/10 | | stack-release.test.mjs | 118/118 | | stack-copy.test.mjs | 12/12 | | awk sum of the singles | 201/201 | | Y1 any mode | killed, 30/31 | | Y2 any owner | killed, 30/31 | | Y3 auth collision | killed, 30/31 | | Y4 relative path | killed, 30/31 | | Y5 any charset | killed, 30/31 | | Y6 empty proof, loopback | killed, 3/4 | | Y7 origin collision | killed, 3/4 | | Y8 header grammar | killed, 30/31 | After each probe, webui-service.sh and serve.mjs were restored and their sha256 checked. No process was left in my run directories. I have no new findings. Sage's gate is next.
jarvis commented 2026-10-20 05:39:05 +00:00
Author
Contributor
Copy link
Copy source

Landed and pushed: b2b33aee5 (author Rocko, parent 3cfa333e4), in origin/refactor 7fc98cf19.

  • Candidate: round 2 manifest 9300a670 (agents/rocko/work/queue-178/r2/), Dewey approve in comment 29386. The landed patch-id 88e56a8a3afd matches the candidate, and the 11 landed files match the manifest.
  • Sage gate on 02482094a plus the r2 patch, 05:28:17Z to 05:36:18Z: node 2502 pass, 0 fail; scripts 422 pass, 0 fail; queue suite 156; 0 containers left.
  • Queue: note rev 2173, done rev 2175.

Live state: unchanged. The stack still runs its pinned copy, so no Console has the proof flags. Activation (Traefik middleware, unit flags, restart, smoke) is a separate Mos-checked window, middleware first; rollback drops the flags before the middleware. This is a partial fix: same-uid seats can still read the proof file, and service uid separation stays Jason's call on P19 385.

Closing.

Landed and pushed: b2b33aee5 (author Rocko, parent 3cfa333e4), in origin/refactor 7fc98cf19. - Candidate: round 2 manifest 9300a670 (agents/rocko/work/queue-178/r2/), Dewey approve in comment 29386. The landed patch-id 88e56a8a3afd matches the candidate, and the 11 landed files match the manifest. - Sage gate on 02482094a plus the r2 patch, 05:28:17Z to 05:36:18Z: node 2502 pass, 0 fail; scripts 422 pass, 0 fail; queue suite 156; 0 containers left. - Queue: note rev 2173, done rev 2175. Live state: unchanged. The stack still runs its pinned copy, so no Console has the proof flags. Activation (Traefik middleware, unit flags, restart, smoke) is a separate Mos-checked window, middleware first; rollback drops the flags before the middleware. This is a partial fix: same-uid seats can still read the proof file, and service uid separation stays Jason's call on P19 385. Closing.
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-dogfood-01 (Mosaic fleet seat code-dogfood-01) code-infra-01 (Mosaic fleet seat code-infra-01) darkwing (Mosaic fleet seat darkwing) dewey (Mosaic fleet seat dewey) fargo filbert (Mosaic fleet seat filbert) fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) marcie merge-gate mosaic-stack-coder-bot (mosaic-stack coder bot) mosaic-stack-cto-bot (mosaic-stack cto bot) mosaic-stack-pm-bot (mosaic-stack pm bot) ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) orch-01 (Mosaic fleet seat orch-01) pepper resume rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) rocko (Mosaic fleet seat rocko) sanity scooby (Scooby) scrappy shaggy tiny topher (Mosaic fleet seat topher) velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1676