devsyncwrld/backspace
1
0
Fork 0
Code Issues Pull Requests Actions 32 Packages Projects Releases Wiki Activity

fix(federation): extend /peer/accept safeguard to cover needs_attention

Browse Source 
Unauthenticated /peer/accept must not overwrite hmac_secret for peers in
needs_attention, same as active. needs_attention means 'auth trust broke
and we don't know why' — letting an unauthenticated request flip it back
would reintroduce a path for silent HMAC rotation via the outbox-401 loop
the rest of #19 closes. Legitimate recovery is the admin 'Reset peering'
action (next task).
This commit is contained in:
Jannis Braun
2026-04-21 20:49:19 +02:00
parent 48dbe32a69
commit ceaa08b4bd
1 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/server/src/routes/federation.ts
+11 -2
View File
@@ -491,8 +491,17 @@ export async function federationRoutes(app: FastifyInstance): Promise<void> {
.get();
if (existing) {
if (existing.status === 'active') {
// Idempotent — already peered
if (existing.status === 'active' || existing.status === 'needs_attention') {
// Idempotent — already peered (or peering is in needs_attention state).
// In both cases we refuse to overwrite hmac_secret via this
// unauthenticated endpoint. An unauthenticated caller cannot
// prove prior trust, and needs_attention means "we don't know
// why this broke" — letting an unauthenticated request flip it
// to active with a new secret defeats the purpose.
//
// Legitimate recovery path: local admin clicks "Reset peering" →
// row is deleted → remote's /peer/accept then lands on a
// non-existent row and the normal handshake path runs.
return reply.code(200).send({ accepted: true });
}
if (existing.status === 'revoked') {