fix(paroche): authenticate endpoints, SSRF guard, real pagination, transactional writes - #483
Merged
Merged
Conversation
…ansactional writes - #361: authenticate all zone-management handlers — RequireAdmin for topology mutations (create/delete zone, add/remove member), AuthenticatedUser for reads and playback control. - #373: gate enqueue_download to admin-only and validate download_url against SSRF (new net_validate.rs: http(s) hosts are DNS-resolved and every resolved address is range-checked; magnet trackers validated). - #374: constant-time KOSync credential comparison via subtle. - #372: real pagination in list_tracks — apotheke search_tracks gains LIMIT/OFFSET and a count_tracks sibling; total reflects the full match. - #375: delete_user soft-deletes (deactivate + delete refresh tokens + revoke api keys) and returns 404 for unknown ids, instead of a no-op 204. - #457: wrap subsonic create_playlist and sibling write sites in a single transaction and propagate INSERT errors. Closes #361 Closes #372 Closes #373 Closes #374 Closes #375 Closes #457 Gate-Passed: kanon 0.1.5 +stages:fmt,check,clippy,nextest,lint sha:6be909d1b6a94cec9961d9573a742ffe1f00f9be
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #361, #372, #373, #374, #375, #457.
Changes
RequireAdmingates topology mutations (create/delete zone, add/remove member) andAuthenticatedUsergates reads + playback control, mirroringrenderer.rs.enqueue_downloadwas member-accessible and only checked URL emptiness. Now admin-only, with a newnet_validate.rsSSRF guard: http(s) hosts are DNS-resolved and every resolved address is range-checked (loopback/private/link-local/CGNAT/cloud-metadata, with IPv4-mapped-IPv6 reduction); magnet trackers are validated (schemes + IP-literal/localhost rejection). Fail-closed on resolution failure.!=; now constant-time viasubtle::ConstantTimeEq.list_tracksdiscards the computed page offset, always returning the first page #372 — pagination.list_tracksdiscarded the computed offset.apotheke::search_tracksgainsLIMIT/OFFSET(with a deterministicORDER BY) and acount_trackssibling; the response reports the full match total.delete_userstub always returns 204 without deleting the user record #375 — delete_user. Was a no-op 204. Now extracts the id (404 on unknown/unparseable), soft-deletes (deactivate + delete refresh tokens + revoke API keys), and drops the user fromlist_users.createPlaylistsilently swallows INSERT error — playlist creation failure returns OK #457 — swallowed playlist writes.create_playlist(and sibling subsonic write sites) now run in a single transaction and propagate INSERT errors instead of returning OK on failure.Verification
kanon gate --fullgreen (fmt, check, advisory-parity, cargo-deny, clippy workspace, nextest, kanon lint). SSRF guard has unit + integration coverage; auth-rejection and rollback paths tested.Follow-ups filed
#477 (Subsonic song-attach unreachable via serde_urlencoded — surfaced writing the #457 tests), #479 (SSRF hardening residuals: DNS-rebinding, IPv4-compatible-IPv6, magnet-tracker DNS).