jason.woltje
068d868a99
Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
169 lines
6.4 KiB
JSON
169 lines
6.4 KiB
JSON
[
|
|
{
|
|
"name": "M01-auth-before-proof",
|
|
"path": "packages/webui/src/serve.mjs",
|
|
"before": " // The proof precedes every auth-header read, including the wrong-Host fence.",
|
|
"after": " if (named && req.headersDistinct[preview.header]?.[0] !== preview.user) return json(res, 401, { error: 'sign-in required' });\n // The proof precedes every auth-header read, including the wrong-Host fence.",
|
|
"test": "packages/webui/tests/proof.test.mjs",
|
|
"pattern": "refuses missing wrong short",
|
|
"check": "proof refusal precedes auth"
|
|
},
|
|
{
|
|
"name": "M02-wrong-equal-length",
|
|
"path": "packages/webui/src/serve.mjs",
|
|
"before": " || !timingSafeEqual(value, proof.value)",
|
|
"after": "",
|
|
"test": "packages/webui/tests/proof.test.mjs",
|
|
"pattern": "refuses missing wrong short",
|
|
"check": "same-length incorrect proof refuses"
|
|
},
|
|
{
|
|
"name": "M03-missing-proof",
|
|
"path": "packages/webui/src/serve.mjs",
|
|
"before": "if (!value || value.length !== proof.value.length || !timingSafeEqual(value, proof.value))",
|
|
"after": "if (value && (value.length !== proof.value.length || !timingSafeEqual(value, proof.value)))",
|
|
"test": "packages/webui/tests/proof.test.mjs",
|
|
"pattern": "refuses missing wrong short",
|
|
"check": "absent proof refuses"
|
|
},
|
|
{
|
|
"name": "M04-loopback-proof",
|
|
"path": "packages/webui/src/serve.mjs",
|
|
"before": "if (!named && values) return json",
|
|
"after": "if (false) return json",
|
|
"test": "packages/webui/tests/proof.test.mjs",
|
|
"pattern": "header is refused on other Hosts",
|
|
"check": "proof on nonpublic Host refuses"
|
|
},
|
|
{
|
|
"name": "M05-mode-0644",
|
|
"path": "packages/webui/src/serve.mjs",
|
|
"before": "[0o600, 0o400].includes(st.mode & 0o7777)",
|
|
"after": "[0o600, 0o400, 0o644].includes(st.mode & 0o7777)",
|
|
"test": "packages/webui/tests/proof-cli.test.mjs",
|
|
"pattern": "startup refuses",
|
|
"check": "0644 file refused"
|
|
},
|
|
{
|
|
"name": "M06-log-refusal",
|
|
"path": "packages/webui/src/serve.mjs",
|
|
"before": "return json(res, 401, { error: 'proxy proof required' });",
|
|
"after": "log(proof.value.toString('ascii')); return json(res, 401, { error: 'proxy proof required' });",
|
|
"test": "packages/webui/tests/proof.test.mjs",
|
|
"pattern": "refuses missing wrong short",
|
|
"check": "refusal log never includes proof"
|
|
},
|
|
{
|
|
"name": "M07-no-follow",
|
|
"path": "packages/webui/src/serve.mjs",
|
|
"before": " | constants.O_NOFOLLOW",
|
|
"after": "",
|
|
"test": "packages/webui/tests/proof-cli.test.mjs",
|
|
"pattern": "startup refuses",
|
|
"check": "fixture symlink refused"
|
|
},
|
|
{
|
|
"name": "M08-owner",
|
|
"path": "packages/webui/src/serve.mjs",
|
|
"before": " || st.uid !== process.getuid()",
|
|
"after": "",
|
|
"test": "packages/webui/tests/proof-cli.test.mjs",
|
|
"pattern": "startup refuses",
|
|
"check": "another uid refused"
|
|
},
|
|
{
|
|
"name": "M09-line-bytes",
|
|
"path": "packages/webui/src/serve.mjs",
|
|
"before": "line.length < 32 || /[^A-Za-z0-9_-]/.test(line)",
|
|
"after": "false",
|
|
"test": "packages/webui/tests/proof-cli.test.mjs",
|
|
"pattern": "startup refuses",
|
|
"check": "short/newline/bad-byte file refused"
|
|
},
|
|
{
|
|
"name": "M10-duplicate-proof",
|
|
"path": "packages/webui/src/serve.mjs",
|
|
"before": "values?.length === 1 ? Buffer.from(values[0], 'utf8') : null",
|
|
"after": "values?.length ? Buffer.from(values[0], 'utf8') : null",
|
|
"test": "packages/webui/tests/proof.test.mjs",
|
|
"pattern": "refuses missing wrong short",
|
|
"check": "duplicate header refused"
|
|
},
|
|
{
|
|
"name": "M11-tester-proof",
|
|
"path": "packages/webui/src/serve.mjs",
|
|
"before": "if (tester && testerProofHeader && Object.hasOwn(req.headers, testerProofHeader.toLowerCase()))",
|
|
"after": "if (false)",
|
|
"test": "packages/webui/tests/proof.test.mjs",
|
|
"pattern": "header is refused on other Hosts",
|
|
"check": "tester proof header refused"
|
|
},
|
|
{
|
|
"name": "M12-main-wiring",
|
|
"path": "packages/webui/src/cli.mjs",
|
|
"before": "preview: options.preview, proof, send,",
|
|
"after": "preview: options.preview, send,",
|
|
"test": "packages/webui/tests/proof-cli.test.mjs",
|
|
"pattern": "CLI applies proof",
|
|
"check": "actual CLI main listener checks proof"
|
|
},
|
|
{
|
|
"name": "M13-tester-wiring",
|
|
"path": "packages/webui/src/cli.mjs",
|
|
"before": "testerProofHeader: proof?.header ?? null,",
|
|
"after": "",
|
|
"test": "packages/webui/tests/proof-cli.test.mjs",
|
|
"pattern": "CLI applies proof",
|
|
"check": "actual CLI tester rejects proof header"
|
|
},
|
|
{
|
|
"name": "M14-service-location",
|
|
"path": "scripts/webui-service.sh",
|
|
"before": "case \"$proof_path\" in \"$REPO\"|\"$REPO\"/*|\"$copies_path\"|\"$copies_path\"/*) die \"proxy proof file must be outside the repository and copies\" ;; esac",
|
|
"after": ":",
|
|
"test": "packages/webui/tests/service.test.mjs",
|
|
"pattern": "proxy proof render refuses",
|
|
"check": "render refuses repository/copy path"
|
|
},
|
|
{
|
|
"name": "M15-service-propagation",
|
|
"path": "scripts/webui-service.sh",
|
|
"before": "flags=\"$flags --proof-header $PROOF_HEADER --proof-file $PROOF_FILE\"",
|
|
"after": ":",
|
|
"test": "packages/webui/tests/service.test.mjs",
|
|
"pattern": "proxy proof render carries",
|
|
"check": "render carries both flags"
|
|
},
|
|
{
|
|
"name": "M16-release-preservation",
|
|
"path": "scripts/stack-release.sh",
|
|
"before": " RUN_CONSOLE=(\"${P_CONSOLE[@]}\")",
|
|
"after": " RUN_CONSOLE=(\"${P_CONSOLE[@]:0:4}\")",
|
|
"test": "packages/cli/tests/stack-release.test.mjs",
|
|
"pattern": "T178 proxy proof header",
|
|
"check": "pointer/unit preserve pair through re-pin and rollback"
|
|
},
|
|
{
|
|
"name": "M17-render-no-open",
|
|
"path": "scripts/webui-service.sh",
|
|
"before": " proof_mode=\"$(stat -c '%a' -- \"$PROOF_FILE\")\"",
|
|
"after": " cat -- \"$PROOF_FILE\" >/dev/null\n proof_mode=\"$(stat -c '%a' -- \"$PROOF_FILE\")\"",
|
|
"test": "render-no-open.py",
|
|
"pattern": "",
|
|
"check": "render never opens or reads the fixture",
|
|
"command": [
|
|
"python3",
|
|
"/mnt/storage/src/mosaic-stack/agents/rocko/work/queue-178/render-no-open.py"
|
|
]
|
|
},
|
|
{
|
|
"name": "M18-proof-send-status",
|
|
"path": "scripts/webui-service.sh",
|
|
"before": "( --proof-header [^ ]+ --proof-file /[^ ]+)?",
|
|
"after": "",
|
|
"test": "packages/webui/tests/service.test.mjs",
|
|
"pattern": "proxy proof status",
|
|
"check": "proof flags retain send-on status"
|
|
}
|
|
]
|