fix(api): mint owner pairing codes only at the box - #951
Conversation
A LAN peer could print an owner QR and keep control from anywhere. Viewer invites still work from the LAN. Loopback, or a house-password proof, can still mint an owner.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d5a6a1afd9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| // from anywhere. Loopback is the box itself. A house-password proof is | ||
| // the other door, and it only exists when api.lan_auth is on. | ||
| func (s *Server) appLinkOwnerMintAllowed(w http.ResponseWriter, r *http.Request, asked string) bool { | ||
| if asked != apiauth.RoleOwner || appLinkOverSession(r) || isLoopbackClient(r.RemoteAddr) { |
There was a problem hiding this comment.
When app-link has no enrolled devices, this exemption lets any LAN or ZeroTier peer mint a role:"viewer" QR without loopback or house-password proof. appenroll.Identity.Authorise then promotes that first viewer enrollment to owner (go/internal/appenroll/enroll.go:576-582), giving the peer the same durable owner access this change is intended to prevent. Require owner-level proof when AuthorisedCount() == 0, or remove the implicit first-device promotion.
Useful? React with 👍 / 👎.
1 participant
Summary
An owner pairing QR is no longer minted from any LAN address. That is how a guest or a ZeroTier peer turned port access into a durable Noise owner.
Owner mint now requires loopback or a house-password proof (
api.lan_authon, valid cookie or Bearer). Viewer invites still work from the LAN.Test plan
go test ./internal/api -run 'Pairing|Sharing|BoxCode'make verifyon commit127.0.0.1, or after the house password, works