mirror of
https://github.com/Such-Software/smirk-backend-core.git
synced 2026-10-17 15:31:38 +02:00
jwinterm
67faf8f762
No trust-on-first-use: bootstrap mode is an explicit, MAC-protected latch
(server_config singleton), NOT inferred from "no admin keys". The latch MAC
(ADMIN_KEY_INTEGRITY_SECRET over setup_state|bootstrap_completed_at) means a
DB-write attacker who restores a pre-bootstrap backup or flips the state to
re-open TOFU produces a mismatch the boot path detects and fails closed on.
- migration 20260626000002: server_config (id=1 singleton; setup_state +
bootstrap_completed_at + integrity_mac).
- db::server_config: read_setup_state -> {Fresh,Uninitialized,Locked,Tampered}
(MAC-verified); has_any_users; init_server_config (adoption: a live upgrade
latches `locked` so it never exposes a setup window; a truly empty DB begins
uninitialized); bootstrap_admin (insert the FIRST active admin AND latch
locked + hash-chained audit, ONE tx; refuses if an active admin already
exists); reset_setup (shell recovery; recomputes MAC, preserves admin keys).
- main boot (admin enabled): adopt/await-bootstrap, and FAIL CLOSED on a tampered
latch.
- smirk-admin: `setup --pubkey` (the supported headless bootstrap) + `reset-setup
--i-understand`.
- 1 L1 test: Fresh -> locked(valid) -> wrong-secret Tampered -> raw-flip Tampered
-> reset Uninitialized -> bootstrap refused while an active admin exists.
Deferred (documented): the HTTP /setup/* wizard. Per the spec the CLI / `docker
exec` is the SUPPORTED bootstrap (pure-PaaS without shell is explicitly
unsupported), so the loopback TTY wizard is a later convenience, not load-bearing.
17 lines
857 B
SQL
17 lines
857 B
SQL
-- First-run bootstrap latch (operator §3.2).
|
|
--
|
|
-- Bootstrap mode is NOT derived from "no active admin keys" — it is an explicit,
|
|
-- MAC-protected latch, so a DB-write attacker who restores a pre-bootstrap backup
|
|
-- (or flips the state) to re-open trust-on-first-use produces a MAC mismatch the
|
|
-- server detects and fails closed on. The MAC is keyed by the same
|
|
-- ADMIN_KEY_INTEGRITY_SECRET as admin_keys, over setup_state|bootstrap_completed_at.
|
|
-- Singleton row (id = 1).
|
|
CREATE TABLE server_config (
|
|
id INT PRIMARY KEY DEFAULT 1 CHECK (id = 1),
|
|
setup_state TEXT NOT NULL DEFAULT 'uninitialized', -- uninitialized | locked
|
|
bootstrap_completed_at TIMESTAMPTZ,
|
|
locked_at TIMESTAMPTZ,
|
|
updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
|
integrity_mac TEXT NOT NULL
|
|
);
|