feat: one-time stream tickets replace admin token in SSE URLs #31

New issue

Closed

opened 2026-07-04 15:37:13 +00:00 by a73x · 2 comments

a73x commented

2026-07-04 15:37:13 +00:00

(Migrated from git.a73x.sh)

[claude 2026-07-04] Fixes 44f5b0ee (DEF-6). ticketStore (in-memory, injectable clock, mint prunes expired, consume is one-time even when expired); POST /api/v1/stream-tickets (admin, 201); handleEvents consumes ?ticket= and ?token= is GONE. Web fleet store mints before connecting and self-reconnects with a fresh ticket on error (built-in ES retry would replay a consumed ticket). TDD: full flow test (mint auth, stream, replay 401, garbage 401, legacy ?token= 401) + TTL expiry with injected clock; legacy tests migrated. Browser + curl e2e in the consolidated pass. make ci green; web build green (2 pre-existing check errors in untouched files).

Migrated from git-collab patche 0b72bae86a193aaada12903552285f69b33626e9.

Original author: a73x dev@a73x.sh.

Fixes git-collab issue 44f5b0ee

Historical merged patch. The original head and merge commits were not recorded. Forgejo cannot display a pull request without a head commit, so this record is preserved as a closed issue. The original diff is unavailable; no commit was guessed.

Original branches: fix/def6-stream-tickets → main.

[claude 2026-07-04] Fixes 44f5b0ee (DEF-6). ticketStore (in-memory, injectable clock, mint prunes expired, consume is one-time even when expired); POST /api/v1/stream-tickets (admin, 201); handleEvents consumes ?ticket= and ?token= is GONE. Web fleet store mints before connecting and self-reconnects with a fresh ticket on error (built-in ES retry would replay a consumed ticket). TDD: full flow test (mint auth, stream, replay 401, garbage 401, legacy ?token= 401) + TTL expiry with injected clock; legacy tests migrated. Browser + curl e2e in the consolidated pass. make ci green; web build green (2 pre-existing check errors in untouched files). --- Migrated from git-collab patche `0b72bae86a193aaada12903552285f69b33626e9`. Original author: a73x <dev@a73x.sh>. Fixes git-collab issue `44f5b0ee` **Historical merged patch.** The original head and merge commits were not recorded. Forgejo cannot display a pull request without a head commit, so this record is preserved as a closed issue. The original diff is unavailable; no commit was guessed. Original branches: `fix/def6-stream-tickets` → `main`.

a73x commented

2026-07-04 17:56:15 +00:00

(Migrated from git.a73x.sh)

Original review: comment (revision not recorded)

[claude 2026-07-04] Reviewer verdict: approve with minor fixes — applied: godoc mis-attachment fixed; connect() overlap race closed with a generation counter (orphaned EventSource closes itself, never kills the current stream); token-clear now stops the stream; malformed ticket response fails fast; constant-time note on consume(); UX spec marked superseded. Reviewer verified: burn-before-expiry consume, 128-bit crypto tickets, bounded memory, empty-AdminToken covered transitively via adminAuth, no ?token= references remain. E2E: curl flows (mint-auth 401 / stream / replay 401 / legacy 401) on the real binary AND real-Chromium browser run — dashboard live-streams via ?ticket=, admin token absent from every URL, reload mints a fresh single-use ticket. Merging per session goal.

**Original review: comment** (revision not recorded) [claude 2026-07-04] Reviewer verdict: approve with minor fixes — applied: godoc mis-attachment fixed; connect() overlap race closed with a generation counter (orphaned EventSource closes itself, never kills the current stream); token-clear now stops the stream; malformed ticket response fails fast; constant-time note on consume(); UX spec marked superseded. Reviewer verified: burn-before-expiry consume, 128-bit crypto tickets, bounded memory, empty-AdminToken covered transitively via adminAuth, no ?token= references remain. E2E: curl flows (mint-auth 401 / stream / replay 401 / legacy 401) on the real binary AND real-Chromium browser run — dashboard live-streams via ?ticket=, admin token absent from every URL, reload mints a fresh single-use ticket. Merging per session goal.

a73x commented

2026-07-04 17:58:27 +00:00

(Migrated from git.a73x.sh)

Original review: comment (revision not recorded)

[claude 2026-07-04] Reviewer verdict: approve with minor fixes — all applied (godoc placement, connect() generation-counter race guard, token-clear closes the stream, malformed-ticket fast-fail, constant-time note, spec superseded). E2E: curl flows on the real binary (mint-auth 401 / stream state frame / replay 401 / legacy ?token= 401) AND a headless-Chromium run of the real dashboard — live-streams via ?ticket=, admin token absent from every URL, reload mints a fresh single-use ticket. make ci green. Merging per session goal.

**Original review: comment** (revision not recorded) [claude 2026-07-04] Reviewer verdict: approve with minor fixes — all applied (godoc placement, connect() generation-counter race guard, token-clear closes the stream, malformed-ticket fast-fail, constant-time note, spec superseded). E2E: curl flows on the real binary (mint-auth 401 / stream state frame / replay 401 / legacy ?token= 401) AND a headless-Chromium run of the real dashboard — live-streams via ?ticket=, admin token absent from every URL, reload mints a fresh single-use ticket. make ci green. Merging per session goal.