Repository navigation
feat(s136): page authentication, and a regulated boot that refuses to serve without it - #129
Merged
Merged
Conversation
…boot that refuses to serve without it)
The web pages carried no authentication: anyone who could reach the port could answer
approvals, start an MCP stdio command from /mcp, download the keys from the settings export
and edit the gateway allow-list, and the hardened image binds every interface.
- TRINITY_WEB_AUTH in {none, oidc, local_token}. Unset is none on a loopback bind and a boot
refusal on any other bind, in every profile. :regulated refuses none and local_token on a
non-loopback bind, and refuses x-forwarded-proto trust without TRINITY_TRUSTED_PROXY.
- oidc: an OpenID Connect login (code + PKCE S256, state, nonce, iss) with oidcc 3.9 and
oidcc_plug 0.5.1 pinned past their 2026 CVEs; roles view, approve and administer mapped from
Keycloak, Entra (with overage refused), Okta and generic claims.
- Every route and live_session is guarded (a plug before the router and on_mount), held by a
route census; privileged routes need administer.
- A Host allow-list refuses a foreign Host before anything routes (DNS rebinding);
check_origin is an explicit list in every profile.
- Approval and privileged-route receipts carry the principal's sub, iss and role, on a new
access chain scope.
- local_token for a LAN outside :regulated: exchanged once for a SameSite=Strict cookie,
constant-time, rate-limited, with a shared-token banner.
Signed-off-by: Ayla Croft <aylacroft@proton.me>
The image workflow and docs/regulated/headless-image.md, both new on main with slice 130, start the image with no TRINITY_WEB_AUTH, which slice 136 refuses on a non-loopback bind: the workflow's container now runs with a local_token, and the doc's example with oidc. Signed-off-by: Ayla Croft <aylacroft@proton.me>
Signed-off-by: Ayla Croft <aylacroft@proton.me> # Conflicts: # CHANGELOG.md
…aves Partial Slice 132's mapping, merged to main, requires every census, every regulated refusal and every responsibility-matrix row to be cited. Slice 136 adds two censuses (route, policy), three refusals (web auth, origin, trusted proxy) and five matrix rows, so the merge failed test/control_mapping_test.exs. New rows: AC-3 twice, AC-6(9), SC-8, SC-23. The IA-2 row and the matrix's web-pages row no longer describe the gap 136 closes. Signed-off-by: Ayla Croft <aylacroft@proton.me>
…work on a FIPS node Plug encrypts a session cookie with XChaCha20-Poly1305 only, and the FIPS provider refuses it: 128 tests failed on both fips runs of f0591b4 with "Forbidden in FIPS" from Plug.Crypto.MessageEncryptor, every one a page request. The cookie holds a server-side session id and, during a login, the PKCE verifier and nonce; it is HttpOnly, SameSite, Secure behind TLS and HMAC-SHA256 signed. A test holds the shape of the cookie the application sends (SFMyNTY., not XCP.) on every leg; it fails with encryption_salt put back. Signed-off-by: Ayla Croft <aylacroft@proton.me>
Signed-off-by: Ayla Croft <aylacroft@proton.me> # Conflicts: # CHANGELOG.md # ci/ironbank/Dockerfile # docs/regulated/control-mapping.md
…t slice 135 asks for one Merged with slice 135, every regulated case in boot_refusal_node_test stopped at 135's egress refusal (network: :allow with no TRINITY_REGULATED_EGRESS) before the web-auth check it names. The base environment carries the list, as 135 did for regulated_boot_node_test. Signed-off-by: Ayla Croft <aylacroft@proton.me>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Slice 136, opened on the owner's 2026-10-08 answer sheet (D1), finding F-132-1.
The exposure on
main: the web pages carried no authentication. Anyone who could reach the port could:/mcp"create";GET /settings/export.tar.gz?keys=1;The hardened image (#117) binds every interface.
What changes
TRINITY_WEB_AUTHinnone | oidc | local_token.noneon a loopback bind and a boot refusal on any other bind, in every profile. So the headless image needsTRINITY_WEB_AUTHset to start (D-136-1).:regulatedrefusesnoneandlocal_tokenon a non-loopback bind.:regulatedrefusesx-forwarded-prototrust unlessTRINITY_TRUSTED_PROXYis set.oidc: an OpenID Connect login (authorization code + PKCE S256,state,nonce,isschecked). It usesoidcc3.9.0 andoidcc_plug0.5.1, both past their 2026 CVEs, with the pins asserted in a test. Rolesview,approveandadministerare mapped from Keycloak, Entra (group overage refused with a diagnostic), Okta and generic claims.live_sessionis guarded: a plug before the router, pluson_mount, held by a route census./mcpcreate,/gatewaysedit,/oban, the dashboards and the export needadminister.Hostbefore anything routes (DNS rebinding; Phoenix and Bandit have none).check_originis an explicit list in every profile.sub,issand role, on a newaccesschain scope.local_token, for a LAN outside:regulated: exchanged once for aSameSite=Strictcookie, compared in constant time, rate-limited, with a persistent shared-token banner.Proof: 12 automatic ACs, each shown red with its guard removed. AC10 (Entra overage) and AC11 (desktop Host check) are manual. The full suite passes on SQLite (1116) and Postgres. The changed tests (88), format, credo and plan_check were re-run in review.
Known before merge
hex.audituntil fix(s061): beam_mcp 0.10.1, the security patch hex.audit asks for #127 (beam_mcp 0.10.1) is onmain.local_tokenis wanted at all;noneon a wider bind should be refused outside:regulatedtoo;sendcounting asviewis right.TRINITY_MCP_SERVER_TOKEN. After both merge, that step must also setTRINITY_WEB_AUTH, or the image refuses to boot (by design).