amadan
edge: POST /purge is unauthenticated and a sibling app can lift another host's admin token from its .env Issue open
Migrated from github.com/carlosframework/platform issue #314, opened 2026-08-27. GitHub issues are closed for this repo; see AGENTS.md, "Work is tracked on amadan, not GitHub".
Still outstanding: POST /purge is unauthenticated, and a sibling app can lift another host's admin token.
---
Surfaced by the open-source redaction audit (2026-08-27). Both halves are documented in code comments (\internal/edge/purge.go\ ~L71/L83, \internal/activator/admintoken.go\, \internal/schedule/control.go\) as "narrowed, not closed".
- \
POST /purge\on the control socket keeps its unauthenticated behaviour deliberately. - Every exec-backed instance shares a uid and \
<DataDir>\(#232), so any app can read a sibling's \<host>.env\, take \CARLOS_ADMIN_TOKEN\(64 lowercase hex) and drive that host's schedule verbs — a platform-delivered wake plus a POST at a path and time of the attacker's choosing.
The comments are honest and will be public; the fix is per-instance uids (#232) or per-instance token delivery that isn't file-readable by siblings (e.g. passed on an inherited fd / socket-peer-credential check on the control socket). Until then, \/purge\ should at least require the caller's own admin token.