oficina / home Public

Third review pass: a suite-wide sign-in DoS, and a second factor with a door open

My own diagnosis of the rate limit was wrong, and the truth is worse.
I said RemoteAddr is "" behind the unix socket so the IP budget is
skipped. Measured it: on Linux it is "@". SplitHostPort fails, clientIP
returns "@" unchanged, and Flow skips the budget only for exactly "".
So every request in the world shares the key ip:@ with a budget of 20
per 15 minutes — twenty POSTs to /signin lock out sign-in for the whole
suite for a quarter of an hour, on the service §2.1 already calls the
single point of failure. The carlos edge sets X-Forwarded-For on every
proxied request and strips inbound forwarded headers on unverified
hops, so the header is trustworthy at the app: take the last element,
fall back to RemoteAddr only when it is absent, and never pass "@" as a
limiter key.

The Gate was named only on the magic-link path, so a Keymail-upgraded
account with a passkey enrolled would have signed in with one factor.
In rastrillo both Verify and Callback funnel through one admit; this
plan has two entry points and needed the call twice. The test that
would have caught it — an enrolled person cannot get a session from the
first factor alone — is now Task 6 step 2, written before the wiring.

Task 5 dropped the Keymail upgrade in the step that was supposed to
deliver it: "303 to a check-your-mail page, always" is only the
NextMagicLink branch. On NextKeymail no mail is sent at all — Begin
returns Redirect and Pending, and the handler must set the pending
cookie and 303 there. The cookie's attributes are unexported in auth
and have to be replicated deliberately, because __Host-, Lax, HttpOnly
and cleared-on-read are precisely what the "callback may mint on GET"
argument rests on. The force escape hatch comes with it, or a failed
Keymail approval is a dead end against §5.1's every-address-has-a-path.

Task 6 was a stub with no steps at all — the only task without them,
because it had only ever been a placeholder for the ruling. It now has
files, the passkey.Schema merge Task 2 omitted (Gate INSERTs into
passkey_pending, so without it the first enrolled sign-in fails at the
database), the seven routes, and the confirm page that carries the
ceremony and the recovery form together.

"Nobody has to write it" was overstated twice. webauthn.mjs exports
bare navigator.credentials wrappers and makes no network call, so the
app writes glue. Both are static same-origin files — rastrillo's
default CSP forbids inline script, and ruling 21's carve-out is for
files, not blocks. And the allowlist now constrains what may load
rather than which screens are exempt: same-origin src only, no inline,
an assertion that the served CSP is untouched, and a script-stripped
confirm page whose recovery form still posts.

There is a fourth secret. Flow.Key seals the Keymail pending blob and
sealPending refuses a zero one, so the list Paul provisions is
HOME_DEK, HOME_PEPPER, HOME_SIGNIN_KEY and CARLOS_SMTP_PASS.

Plus the Task 4/5 restructure's own loose ends: the two tasks listed
each other's files, both claimed to produce (*App).links, the signin
dependency arrived a task after the interface that needs it,
sealtest.Token does not exist (Canaries does), three templates had no
renderer named, newTestApp had to wire a non-nil Flow.Keymail or the
classification test passes vacuously, RegisterConnectionHook is
process-global and needs a sync.Once, and signIn must send an Origin
header or csrf refuses every POST in the suite.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>