stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Bind operator sessions to the upstream Gitea identity #1372

New Issue
Closed
opened 2026-08-25 00:53:10 +00:00 by rockachopa · 0 comments
rockachopa commented 2026-08-25 00:53:10 +00:00
Member
Copy Link

Problem

Dashboard sessions survive process restarts but are not bound to the immutable Gitea user behind the process credential. Replacing the configured Gitea token with one for another account can therefore let an already-authorized browser exercise the replacement account without a fresh sign-in. Existing offline ownership checks do not protect ordinary online requests.

User flow

  • Resolve the authenticated Gitea user before issuing token or passkey sessions.
  • Persist the immutable user ID and display login with each session.
  • Before protected request handlers run, compare the bound ID with the current process credential identity.
  • Same-user token rotation remains seamless. Different-user replacement and legacy unbound sessions fail closed, preserve device data, and require fresh authentication.
  • Upstream identity lookup failure is retryable and does not masquerade as an account change.

Acceptance tests

  • New token and passkey sessions store Gitea user ID/login, never the credential.
  • Same-user credential rotation leaves sessions usable.
  • Different-user identity blocks protected reads and mutations before endpoint execution with a machine-readable response.
  • Legacy unbound sessions require reauthentication.
  • Identity lookup outages return retryable 503.
  • Focused and full test suites pass.

Evidence / non-duplication

Current origin/main stores only session/device metadata in src/session_store.py; src/main.py issues sessions after validating only the dashboard secret. All 689 historical issue titles and recent commits through 53706f1 were checked. #238 covers offline outbox attribution; #258 creates shared-secret sessions; neither binds online sessions to upstream identity.

## Problem Dashboard sessions survive process restarts but are not bound to the immutable Gitea user behind the process credential. Replacing the configured Gitea token with one for another account can therefore let an already-authorized browser exercise the replacement account without a fresh sign-in. Existing offline ownership checks do not protect ordinary online requests. ## User flow - Resolve the authenticated Gitea user before issuing token or passkey sessions. - Persist the immutable user ID and display login with each session. - Before protected request handlers run, compare the bound ID with the current process credential identity. - Same-user token rotation remains seamless. Different-user replacement and legacy unbound sessions fail closed, preserve device data, and require fresh authentication. - Upstream identity lookup failure is retryable and does not masquerade as an account change. ## Acceptance tests - [ ] New token and passkey sessions store Gitea user ID/login, never the credential. - [ ] Same-user credential rotation leaves sessions usable. - [ ] Different-user identity blocks protected reads and mutations before endpoint execution with a machine-readable response. - [ ] Legacy unbound sessions require reauthentication. - [ ] Identity lookup outages return retryable 503. - [ ] Focused and full test suites pass. ## Evidence / non-duplication Current `origin/main` stores only session/device metadata in `src/session_store.py`; `src/main.py` issues sessions after validating only the dashboard secret. All 689 historical issue titles and recent commits through `53706f1` were checked. #238 covers offline outbox attribution; #258 creates shared-secret sessions; neither binds online sessions to upstream identity.
timmy was assigned by rockachopa 2026-08-25 00:53:11 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#1372
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?