From 392b5e4a53aace725794c7bbabf9e95fb4e1b9c5 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Mon, 14 Sep 2026 01:53:04 +0200 Subject: fix(hub): a per-account sign-in lockout, and a reviewed unauthenticated surface MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Passphrase sign-in locks per username: after `login.max_failures` wrong passphrases (default 4) the name is refused with `429 account_locked` and a `Retry-After` for `login.lockout_minutes` (default 60), without the passphrase being checked. Both numbers are instance policy an admin sets from the panel; zero failures turns it off. The per-IP limit bounds one address, and IPv6 gives every subscriber a /64 of them — an online guess targets an account, so the account is what is counted. - Counted by the name as typed, existing or not, so `login` stays uniform (M1). The key is a hash: people type passphrases into the username field. - The attempt is taken before the check in one `INSERT … ON CONFLICT DO UPDATE … WHERE … RETURNING`, so a concurrent burst gets no more than the limit. - Sign-in, passphrase change and account deletion count on the same row; the last had no rate limit at all. - A lockout refuses passphrase sign-in and nothing else: sessions, renewal and device sign-in continue, and a reset code clears it (AV26). A session learns its own lockout from `/v1/users/me`, and the passphrase change checks it before re-wrapping any node's bundle — the hub accepts the new passphrase only after the nodes have it. The SPA now shows what the hub said. `loginAndRecover` threw "Login failed: {json}", so `email_verification_required` never matched and was never shown; the passphrase-change form rendered no error at all in its first phase. The unauthenticated surface, reviewed route by route: - No `/docs`, `/redoc` or `/openapi.json`, in the code. The Caddyfile hid them on meshbay.org only; a packaged hub behind any other proxy published all three. - The node socket's first message must arrive within ten seconds. It is accepted before anyone is known, and an unbounded read is a connection any stranger holds for free. - `/v1/relays` answers 503 behind `relay.RELAYS_ENABLED`, as federation does: nothing in the tree calls it and two of its routes take no account. - `test_unauthenticated_surface.py` walks every route and fails on one without an authentication dependency that is not listed with its reason. Verified in Chrome against a local hub: the lockout and wrong-passphrase messages, the admin section saving both lockout and mail limits, and the passphrase change refused while locked. Not verified in Firefox (a running instance blocks the headless one), nor the upsert's concurrency on PostgreSQL. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01LcF3QKWii7uQ2kSyXErzCt --- packages/meshbay-hub/src/meshbay_hub/api/admin.py | 39 +++++++++++++++++------ 1 file changed, 30 insertions(+), 9 deletions(-) (limited to 'packages/meshbay-hub/src/meshbay_hub/api/admin.py') diff --git a/packages/meshbay-hub/src/meshbay_hub/api/admin.py b/packages/meshbay-hub/src/meshbay_hub/api/admin.py index 087c221..397b4d9 100644 --- a/packages/meshbay-hub/src/meshbay_hub/api/admin.py +++ b/packages/meshbay-hub/src/meshbay_hub/api/admin.py @@ -40,20 +40,25 @@ class SettingsPatchRequest(BaseModel): allow_public_groups: bool | None = None # Every mail bound, each optional: the panel sends only what changed. mail: dict[str, int] | None = None + # The sign-in lockout's two numbers, each optional, as for mail. + login: dict[str, int] | None = None # ── Instance settings ──────────────────────────────────────────────────────── -def _settings_payload(allow_public_groups: bool, mail: dict) -> dict: +async def _settings_payload(db: AsyncSession) -> dict: return { - "allow_public_groups": allow_public_groups, - "mail": mail, + "allow_public_groups": await hub_settings.public_groups_allowed(db), + "mail": await hub_settings.mail_limits(db), # So the panel can show what a field falls back to, and label the # bounds it will refuse — rather than the operator finding out by # having a value silently clamped. "mail_defaults": {k: hub_settings.mail_default(k) for k in hub_settings.MAIL_KEYS}, "mail_bounds": {k: list(v) for k, v in hub_settings.MAIL_BOUNDS.items()}, + "login": await hub_settings.login_limits(db), + "login_defaults": dict(hub_settings.LOGIN_DEFAULTS), + "login_bounds": {k: list(v) for k, v in hub_settings.LOGIN_BOUNDS.items()}, } @@ -63,9 +68,7 @@ async def admin_get_settings( db: AsyncSession = Depends(get_db), ): """Instance-wide policy an admin controls from the panel. Moderators may read.""" - return _settings_payload( - await hub_settings.public_groups_allowed(db), - await hub_settings.mail_limits(db)) + return await _settings_payload(db) @router.patch("/settings") @@ -115,9 +118,27 @@ async def admin_patch_settings( )) await db.commit() - return _settings_payload( - await hub_settings.public_groups_allowed(db), - await hub_settings.mail_limits(db)) + if body.login: + unknown = sorted(set(body.login) - set(hub_settings.LOGIN_KEYS)) + if unknown: + raise HTTPException( + status_code=422, detail=f"Unknown login setting(s): {unknown}") + changed = [] + for key, value in body.login.items(): + clamped = hub_settings.clamp_login_value(key, value) + await hub_settings.set_raw(db, f"login.{key}", str(clamped)) + changed.append(f"{key}={clamped}") + log.info("Sign-in lockout changed by %s: %s", + current_user.username, ", ".join(changed)) + db.add(IPLog( + user_id=current_user.id, + event="admin_login_lockout_update", + ip_address="admin", + detail=", ".join(changed)[:255], + )) + await db.commit() + + return await _settings_payload(db) @router.get("/mail") -- cgit v1.2.3