From 83b682d50151b62f1da118d0aca1f91f7da313da Mon Sep 17 00:00:00 2001 From: Jannis Braun <151788261+TheZwiss@users.noreply.github.com> Date: Mon, 20 Apr 2026 16:51:44 +0200 Subject: [PATCH] fix: block auto-peering initiation when autoAcceptPeering is disabled ensurePeered() now checks the local autoAcceptPeering setting before initiating new peering. When disabled, only admin-explicit peer/initiate and approval-request approve bypass this check. Closes the bypass where client peer/ensure or outbox worker could auto-initiate outward peering even when the admin intended to control all peering. --- packages/server/src/utils/federationPeering.ts | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/packages/server/src/utils/federationPeering.ts b/packages/server/src/utils/federationPeering.ts index 1fc49761..aa3de186 100644 --- a/packages/server/src/utils/federationPeering.ts +++ b/packages/server/src/utils/federationPeering.ts @@ -80,6 +80,22 @@ export async function ensurePeered(origin: string): Promise } } + // When autoAcceptPeering is disabled, don't auto-initiate new peering. + // The admin's intent is "I control all peering" — both incoming (gated by + // peer/accept) and outgoing auto-initiation (gated here). Only the admin + // peer/initiate endpoint and the approval-request approve endpoint bypass + // this check because those represent explicit admin action. + if (!existing) { + const settings = db + .select({ autoAcceptPeering: schema.instanceSettings.autoAcceptPeering }) + .from(schema.instanceSettings) + .where(eq(schema.instanceSettings.id, 1)) + .get(); + if ((settings?.autoAcceptPeering ?? 1) === 0) { + return { status: 'failed', error: 'Auto-peering is disabled on this instance — an admin must initiate peering manually' }; + } + } + // Deduplicate: if a handshake is already in flight, share the promise const inflight = inFlightPeering.get(normalized); if (inflight) {