feat: enrollment audit trail and per-IP rate limit #17

New issue

Closed

opened 2026-07-03 13:00:04 +00:00 by a73x · 1 comment

a73x commented

2026-07-03 13:00:04 +00:00

(Migrated from git.a73x.sh)

[claude 2026-07-03] Fixes 48e691cd. audit_log table (append-only; at/action/detail JSON; ListAudit newest-first) written on enroll-token.mint, host.enroll, host.enroll.denied, host.decommission — tokens appear only as sha256 hash prefixes. Per-IP token bucket on the unauthenticated enroll endpoint (burst 5, 30s refill, 10k-entry cap with idle prune, fail-open when full — the limiter is a brake, not the auth boundary). TDD: store round-trip, api audit rows incl. no-raw-token assertion, 429-after-burst — all watched fail first. make ci green incl. e2e.

Migrated from git-collab patche bf35805e9864944bfc3bd45829ed6c6a3c5fdda1.

Original author: a73x dev@a73x.sh.

Fixes git-collab issue 48e691cd

Historical merged patch. The original head and merge commits were not recorded. Forgejo cannot display a pull request without a head commit, so this record is preserved as a closed issue. The original diff is unavailable; no commit was guessed.

Original branches: fix/enroll-audit → main.

[claude 2026-07-03] Fixes 48e691cd. audit_log table (append-only; at/action/detail JSON; ListAudit newest-first) written on enroll-token.mint, host.enroll, host.enroll.denied, host.decommission — tokens appear only as sha256 hash prefixes. Per-IP token bucket on the unauthenticated enroll endpoint (burst 5, 30s refill, 10k-entry cap with idle prune, fail-open when full — the limiter is a brake, not the auth boundary). TDD: store round-trip, api audit rows incl. no-raw-token assertion, 429-after-burst — all watched fail first. make ci green incl. e2e. --- Migrated from git-collab patche `bf35805e9864944bfc3bd45829ed6c6a3c5fdda1`. Original author: a73x <dev@a73x.sh>. Fixes git-collab issue `48e691cd` **Historical merged patch.** The original head and merge commits were not recorded. Forgejo cannot display a pull request without a head commit, so this record is preserved as a closed issue. The original diff is unavailable; no commit was guessed. Original branches: `fix/enroll-audit` → `main`.

a73x commented

2026-07-03 13:08:15 +00:00

(Migrated from git.a73x.sh)

Original review: comment (revision not recorded)

[claude 2026-07-03] Fresh-context reviewer: solid, wants items 2+3 before merge and a decision on 1. All three applied in follow-up commit: (1) host.enroll audit moved INTO the redeem tx (durability requirement met; api helper documented best-effort for the rest); (2) fake-clock tests for refill/cap/prune/fail-open; (3) 64-char name truncation + 16KiB body cap on the unauthenticated endpoint. Minors: decommission remote, IPv6 /64 TODO, retention note. Reviewer verified: limiter math correct/race-clean, no harness/smoke/devstack breakage (each enrolls once vs burst 5), 8-hex prefix correlates without weakening the 256-bit token. make ci green. Merging per session goal.

**Original review: comment** (revision not recorded) [claude 2026-07-03] Fresh-context reviewer: solid, wants items 2+3 before merge and a decision on 1. All three applied in follow-up commit: (1) host.enroll audit moved INTO the redeem tx (durability requirement met; api helper documented best-effort for the rest); (2) fake-clock tests for refill/cap/prune/fail-open; (3) 64-char name truncation + 16KiB body cap on the unauthenticated endpoint. Minors: decommission remote, IPv6 /64 TODO, retention note. Reviewer verified: limiter math correct/race-clean, no harness/smoke/devstack breakage (each enrolls once vs burst 5), 8-hex prefix correlates without weakening the 256-bit token. make ci green. Merging per session goal.