stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Require an operator session for privileged dashboard access #258

New Issue
Closed
opened 2026-08-08 03:31:22 +00:00 by timmy · 0 comments
timmy commented 2026-08-08 03:31:22 +00:00
Owner
Copy Link

Problem

The dashboard forwards a shared privileged Gitea token, but inbound dashboard routes have no authentication boundary. A network caller can read private work metadata and invoke issue, notification, review, and merge mutations as the configured Gitea user. CORS does not prevent direct requests.

Vertical slice

Add an optional single-operator access-token sign-in that exchanges the configured secret for a short-lived signed HttpOnly/Secure/SameSite session. Protect the dashboard and private APIs, validate same-origin mutation requests with a session-bound CSRF token, stop background delivery on session expiry, and provide sign-out/device-clear behavior. Keep health and sign-in assets public. Deployments exposed beyond an already-authenticated gateway must configure the secret.

Acceptance

  • Anonymous private requests return 401 before any Gitea call when access control is configured.
  • Valid sign-in sets a scoped secure HttpOnly session and returns a CSRF token without exposing the configured secret.
  • Foreign-origin or missing-CSRF mutations return 403 before any Gitea call.
  • Expired/logout sessions cannot use cached private APIs; logout tells the PWA to clear private local data and caches.
  • Public health remains available and readiness does not disclose the Gitea login in protected mode.
  • Existing and new behavioral tests pass.

Audit of all 254 historical issue/PR records and recent commits through #257 found no prior inbound dashboard session or CSRF boundary.

## Problem The dashboard forwards a shared privileged Gitea token, but inbound dashboard routes have no authentication boundary. A network caller can read private work metadata and invoke issue, notification, review, and merge mutations as the configured Gitea user. CORS does not prevent direct requests. ## Vertical slice Add an optional single-operator access-token sign-in that exchanges the configured secret for a short-lived signed HttpOnly/Secure/SameSite session. Protect the dashboard and private APIs, validate same-origin mutation requests with a session-bound CSRF token, stop background delivery on session expiry, and provide sign-out/device-clear behavior. Keep health and sign-in assets public. Deployments exposed beyond an already-authenticated gateway must configure the secret. ## Acceptance - Anonymous private requests return 401 before any Gitea call when access control is configured. - Valid sign-in sets a scoped secure HttpOnly session and returns a CSRF token without exposing the configured secret. - Foreign-origin or missing-CSRF mutations return 403 before any Gitea call. - Expired/logout sessions cannot use cached private APIs; logout tells the PWA to clear private local data and caches. - Public health remains available and readiness does not disclose the Gitea login in protected mode. - Existing and new behavioral tests pass. Audit of all 254 historical issue/PR records and recent commits through #257 found no prior inbound dashboard session or CSRF boundary.
timmy self-assigned this 2026-08-08 03:31:23 +00:00
timmy closed this issue 2026-08-08 03:42:54 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#258
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?