Hermes 8a6aed546d [grade=A urn:ump:5bm325dgncwgwsl2joztkf4br3wh5lh6jam3rn32fvyr62zyoysa] fix(auth): machine credentials (dk_ keys, JWTs) dead under TOTP — audit P0-1 ...

With TOTP enabled, totpAuthMiddleware answered 401 before
jwtApiKeyAuthMiddleware ever ran: API keys and JWTs were rejected on
every TOTP-protected install (live-verified during the 2026-10-27
sweep with a freshly minted dk_ key getting 401 on /api/v1/mcp/info).
MCP-over-HTTP ('Connect your AI'), fleet endpoints and every machine
integration were broken in production.

Fix: the TOTP gate now verifies Bearer JWT then x-api-key itself
(try/catch, fall-through to the unchanged 401) and sets req.auth;
the JWT/API-key gate passes through on already-set machine auth
(no double verification). Session/public/TOTP-disabled paths
byte-identical.

New chain-level test (no req.auth injection — the gap that hid this
bug) boots the real configureMiddleware chain; VERIFIED it fails 2/5
with the fix stashed and passes 5/5 with it. Judge polish (call-count
assertion) noted as optional follow-up.

Full suite: 172/172 suites, 3731/3731 tests.

2026-10-28 00:35:20 -07:00

..

billing

DC-061: remove superseded status/pricing/index.html and obsolete pricing-page-catalog test

2026-08-23 20:24:42 -07:00

calendar

[grade=A urn:ump:zmnws7b7c63n4sr4qr6collvmttg4ksuaju4z2ndhxo5lntczfbq] test(DC-168): update widget-contract sandbox for batch-2 widget contract

2026-10-28 00:34:14 -07:00

e2e-node

[pending-judge] feat(DC-165 rev5): product/site uniformity — fleet gate proven at composition root, single-source capabilities manifest

2026-10-09 02:56:41 -07:00

helpers

DC-005: Fix all 138 broken test paths after src/ refactor

2026-06-13 12:16:56 -07:00

mcp

[grade=A urn:ump:5clu4udrbwuwxn74tqwxtukfjnrwkrbiykp6uh66ipipzxr32xsq] Merge dc/DC-166-mcp-completion (e524d16): MCP 17->28 tools + workflows double-prefix fix

2026-10-28 00:04:01 -07:00

middleware

[grade=A urn:ump:5bm325dgncwgwsl2joztkf4br3wh5lh6jam3rn32fvyr62zyoysa] fix(auth): machine credentials (dk_ keys, JWTs) dead under TOTP — audit P0-1

2026-10-28 00:35:20 -07:00

plugins

[grade=B] DC-080: Plugin/extension system framework

2026-08-12 12:25:26 -07:00

routes

[grade=A urn:ump:3n5xljspojvc57x7isxi4busps2dxlpwuzivhntg44i3jkpiqfaa] test(DC-168): make calendar events fixture date-relative (was a time bomb)

2026-10-27 23:49:40 -07:00

scripts

[pending-judge] feat(DC-164 rev5): operator env overrides — fd-pinned contract, no-blocking opens, fail-loud wiring, untracked license material

2026-10-08 23:25:41 -07:00

test-helpers

DC-017: Regression tests for depth-2 route paths + PUBLIC_ROUTES drift

2026-06-26 12:16:38 -07:00

unit

[pending-judge] fix(DC-161 r3): address judge r2 blockers

2026-10-07 20:44:07 -07:00

websocket

[glm-grade=A] fix(websocket): HMAC-verify dashboard WS auth + listener isolation (DC-061)

2026-08-18 08:22:29 -07:00

admin-invites.test.js

[glm-grade=B] fix(auth): DC-089 mask invite/user emails in server logs

2026-08-22 16:22:53 -07:00

app-startup-smoke.test.js

DC-020: fix last broken require in server.js (./state-manager -> ./src/managers/state-manager)

2026-07-01 07:37:45 -07:00

app-templates.test.js

DC-005: Fix all 138 broken test paths after src/ refactor

2026-06-13 12:16:56 -07:00

atomic-write-dc099.test.js

refactor(persistence): migrate bridge events file to canonical atomic-write util (DC-104) [glm-grade=A]

2026-08-23 01:57:20 -07:00

audit-gate-path-dc111.test.js

fix(audit): restore named audit actions for SSO gate traffic — 3 live defects (DC-111) [glm-grade=A]

2026-08-23 09:05:27 -07:00

audit-logger-pii-masking-dc110.test.js

fix(security): audit-logger PII masking parity with unified logger (DC-110) [glm-grade=A]

2026-08-23 08:01:29 -07:00

audit-logger.security.test.js

DC-026/027/028: close 3 more auth security holes + rate limit /auth/* + audit credential exposures

2026-07-01 04:20:57 -07:00

auth-manager.test.js

DC-005: Fix all 138 broken test paths after src/ refactor

2026-06-13 12:16:56 -07:00

auth-multistore-integration.test.js

DC-048: multi-user bootstrap + admin invites (opt-in)

2026-07-20 17:44:11 -07:00

auth-provider-registry.test.js

DC-046 DC-047 pluggable auth providers + email magic link

2026-07-20 01:40:33 -07:00

auth-rate-limiter.test.js

DC-029: skip authLimiter for already-authenticated requests

2026-07-02 18:27:03 -07:00

auto-restart-manager.test.js

[glm-grade=A] fix(auto-restart): await async servicesStateManager.read() so handleContainerDown actually fires (DC-060)

2026-08-18 05:52:32 -07:00

backup-manager.test.js

DC-019: fix flaky backup-manager tamper test (authTag byte corruption)

2026-06-27 07:02:47 -07:00

bundled-workflows-health-check.test.js

[glm-grade=A] fix(notifications): un-gate 7 dead emitters + repair legacy 4-arg send shape (DC-094)

2026-08-22 19:42:25 -07:00

caddy-upstream-watcher.test.js

refactor(persistence): migrate caddy-upstream-watcher state to canonical atomic-write util (DC-105) [glm-grade=A]

2026-08-23 02:31:16 -07:00

caddy-worker-naming-dc112.test.js

feat(security): activate caddy security-event pipeline — bounded first-start replay, self-noise filter, host fidelity (DC-113) [glm-grade=A]

2026-08-23 12:40:32 -07:00

caddy-worker-pipeline-dc113.test.js

feat(security): activate caddy security-event pipeline — bounded first-start replay, self-noise filter, host fidelity (DC-113) [glm-grade=A]

2026-08-23 12:40:32 -07:00

caddy-worker-self-noise-dc118.test.js

fix(security): caddy-event self-noise conjunction filter for host curl probes (DC-118) [glm-grade=A]

2026-08-23 15:53:58 -07:00

catalog-dc160.test.js

[pending-judge] fix(integration): catalog detail reads app.docker.* (DC-160); Shield committed; composition-root e2e

2026-10-07 00:58:03 -07:00

config-drift-detector.test.js

DC-005: Fix all 138 broken test paths after src/ refactor

2026-06-13 12:16:56 -07:00

config-migrations.test.js

[grade=A] DC-068: Fix all 3 ESLint errors + auto-fix warnings

2026-08-12 12:35:58 -07:00

config-schema.test.js

[glm-grade=A] fix(config): teach schema KNOWN_KEYS the licenseBackup/_version writer keys (DC-091)

2026-08-22 17:22:13 -07:00

credential-manager.test.js

fix(security): close rotateEncryptionKey crash window with in-process key rollback (DC-107) [glm-grade=A]

2026-08-23 04:40:41 -07:00

crypto-utils.test.js

DC-005: Fix all 138 broken test paths after src/ refactor

2026-06-13 12:16:56 -07:00

csrf-protection.test.js

[glm-grade=A] fix(csrf): tag browser auto-retry as [CSRF-debug], keep [CSRF] for real probes (DC-058)

2026-08-18 04:17:50 -07:00

dc165-uniformity.test.js

[pending-judge] feat(DC-165 rev5): product/site uniformity — fleet gate proven at composition root, single-source capabilities manifest

2026-10-09 02:56:41 -07:00

depth2-routes-smoke.test.js

DC-017: Regression tests for depth-2 route paths + PUBLIC_ROUTES drift

2026-06-26 12:16:38 -07:00

disk-settings-loader.test.js

fix(api): rehydrate process.env from disk-settings.json on boot (DC-048) [glm-grade=A]

2026-08-17 16:04:18 -07:00

dns-propagation.test.js

DC-005: Fix all 138 broken test paths after src/ refactor

2026-06-13 12:16:56 -07:00

docker-security.test.js

DC-005: Fix all 138 broken test paths after src/ refactor

2026-06-13 12:16:56 -07:00

error-handler.test.js

[grade=A] DC-065: Sweep 15 console.* calls to process.stderr.write

2026-08-12 04:50:16 -07:00

error-tracker.test.js

[grade=B] DC-071: Error tracking integration framework (Sentry-compatible)

2026-08-12 12:30:57 -07:00

errors.test.js

DC-005: Fix all 138 broken test paths after src/ refactor

2026-06-13 12:16:56 -07:00

event-store-retention-dc116.test.js

fix(security): event-store retention + race + total-cap defects (DC-116) [glm-grade=B]

2026-08-23 15:02:00 -07:00

health-checker-hysteresis.test.js

[glm-grade=A] fix(monitoring): DC-086 round-2 — probe/config race hardening + env parse + incident compare

2026-08-22 14:23:25 -07:00

health-checker-incident-parity.test.js

[glm-grade=A] fix(monitoring): DC-090 outage incidents follow displayed hysteresis status

2026-08-22 16:52:53 -07:00

health-checker.test.js

[glm-grade=A] fix(monitoring): DC-090 outage incidents follow displayed hysteresis status

2026-08-22 16:52:53 -07:00

health-endpoints.test.js

test(api): DC-087 hermetic caddy-admin health mirrors + file-level raw-fetch guard [glm-grade=B]

2026-08-22 15:14:25 -07:00

health-probe-aliases.test.js

test(api): DC-087 hermetic caddy-admin health mirrors + file-level raw-fetch guard [glm-grade=B]

2026-08-22 15:14:25 -07:00

i18n.test.js

[grade=B] fix: i18n detectLanguage RFC 7231 q-value compliance + stale test fixes

2026-08-13 16:30:20 -07:00

input-validator.test.js

DC-005: Fix all 138 broken test paths after src/ refactor

2026-06-13 12:16:56 -07:00

invite-store.test.js

DC-048: multi-user bootstrap + admin invites (opt-in)

2026-07-20 17:44:11 -07:00

jest.setup.js

test: build comprehensive test suite reaching 80%+ coverage threshold

2026-04-06 21:36:46 -07:00

license-keygen.test.js

DC-057: close checkout-to-license contract drift (grade B)

2026-08-04 14:18:49 -07:00

license-manager.test.js

[grade=A] Harden server-managed license renewals

2026-08-22 18:15:37 -07:00

license-server-contract.test.js

[grade=A] Harden server-managed license renewals

2026-08-22 18:15:37 -07:00

license-status-refresh.test.js

[grade=A] Harden server-managed license renewals

2026-08-22 18:15:37 -07:00

license-tier-enforcement.test.js

DC-052: license-tier enforcement (Free caps at 3, gates share on Pro)

2026-07-20 21:40:26 -07:00

log-digest.test.js

DC-005: Fix all 138 broken test paths after src/ refactor

2026-06-13 12:16:56 -07:00

logging-email-masking-dc095.test.js

fix(security): quoted local-part email mask — strip delimiter quotes, split on last @ (DC-109) [glm-grade=A]

2026-08-23 07:28:10 -07:00

logging-redact-on-rotate-dc108.test.js

fix(security): redact-on-rotate for error.log archive + README PII docs (DC-108) [glm-grade=B]

2026-08-23 05:22:04 -07:00

logging.test.js

DC-012: Add Kubernetes-style /healthz + /readyz probe aliases

2026-06-25 17:16:16 -07:00

metrics.test.js

[grade=A] DC-068: Fix all 3 ESLint errors + auto-fix warnings

2026-08-12 12:35:58 -07:00

monitoring-journald-reader.test.js

[glm-grade=B] feat(monitoring): host journald log viewer (DC-055)

2026-08-18 01:29:19 -07:00

monitoring-public-gate-dc096.test.js

fix(config): monitoring.public gate was dead 4 ways — live gate + schema + dedupe (DC-096) [glm-grade=A]

2026-08-22 21:35:51 -07:00

nesting-guard.test.js

fix(nesting-guard): export dataDir from src/config/paths; harden fallback to platform-paths (DC-077) [glm-grade=B]

2026-08-18 17:07:13 -07:00

network-access-store.test.js

DC-145: access map store (grants, effective access, change events) + /network/access routes + tests

2026-10-03 21:12:35 -07:00

network-access.routes.test.js

DC-145: access map store (grants, effective access, change events) + /network/access routes + tests

2026-10-03 21:12:35 -07:00

network-acl-compiler.test.js

DC-148: Tailscale ACL compiler + lockout guard + preview/push/rollback + drift detection + tests

2026-10-03 21:26:29 -07:00

network-acl-push.test.js

DC-148: Tailscale ACL compiler + lockout guard + preview/push/rollback + drift detection + tests

2026-10-03 21:26:29 -07:00

network-ca-hardening.test.js

DC-147: named root CA with critical name constraints, leaf compliance assertions, install-page hardening, encrypted backup + tests

2026-10-03 21:43:11 -07:00

network-forward-auth.test.js

P7 r8 fix: forward_auth trust boundary (XFF/XFH honored only from trusted proxy; direct/spoofed requests use socket identity) + adversarial tests

2026-10-03 23:25:23 -07:00

network-groups.routes.test.js

DC-144: DashCaddy-side groups + resources model/routes with cascade delete + tests

2026-10-03 21:37:13 -07:00

network-invites.routes.test.js

DC-142: link-first invites routes via network provider + tests

2026-10-03 21:31:57 -07:00

network-ips-route.test.js

DC-031: fix /api/v1/network/ips ReferenceError + add regression tests

2026-07-06 15:06:28 -07:00

network-lifecycle.routes.test.js

DC-143: block/unblock/remove person + revoke device orchestration + tests

2026-10-03 21:29:41 -07:00

network-lifecycle.test.js

DC-143: block/unblock/remove person + revoke device orchestration + tests

2026-10-03 21:29:41 -07:00

network-people-store.test.js

[grade=B urn:ump:bbfbsfru4nizg75wcxum7mwzhie6txhr22hw6jvz36wiihmgzmlq] P7 people store: dedupe upsert by providerUserId

2026-10-04 03:12:23 -07:00

network-people.routes.test.js

DC-141: people store (atomic JSON) + /network/people routes + last-admin guard + tests

2026-10-03 21:14:20 -07:00

network-provider-tailscale.test.js

P7 r3 fix: single-preview contract (syncAccess delegates drift-check+preview+push to pushIfNoDrift; acl_preview_failed mapped non-retryable) + test updates

2026-10-03 22:55:22 -07:00

network-provider-wireguard.test.js

DC-153: provider.syncAccess enforcement wiring (tailscale ACL push + wireguard nftables apply) + contract tests

2026-10-03 22:34:02 -07:00

network-registry.test.js

DC-140: network provider abstraction (src/network/) + tailscale provider + registry + tests

2026-10-03 21:16:20 -07:00

network-resources.routes.test.js

DC-144: DashCaddy-side groups + resources model/routes with cascade delete + tests

2026-10-03 21:37:13 -07:00

network-syncaccess.test.js

P7 r2 fixes: drift guard wired through pushIfNoDrift (acl_drift_detected ProviderError, never overwrites drifted remote) + unknown-device forward_auth audit + drift regression tests

2026-10-03 22:47:27 -07:00

network-technitium.test.js

DC-146: Technitium zone/record sync (idempotent upserts) + split-DNS gate + setup check + tests

2026-10-03 21:39:33 -07:00

network-wg-firewall.test.js

DC-151: WG nftables matrix compiler + transactional apply/rollback + tests

2026-10-03 21:35:15 -07:00

network-wg-redeem.routes.test.js

DC-150: WG invite redemption page (browser X25519 keygen, client-side config+QR) + public redeem API + tests

2026-10-03 21:40:09 -07:00

network-wizard.routes.test.js

DC-152: Private Network setup wizard (mode/domain/connect/dns/ca/admin steps) + status API + tests

2026-10-03 21:47:34 -07:00

notification-config-writeback-dc097.test.js

refactor(persistence): canonical atomic file writer + notifications.json crash-safety (DC-099) [glm-grade=B]

2026-08-22 23:28:36 -07:00

notification-manager-dc094.test.js

[glm-grade=A] fix(notifications): un-gate 7 dead emitters + repair legacy 4-arg send shape (DC-094)

2026-08-22 19:42:25 -07:00

notification-manager.test.js

refactor(persistence): canonical atomic file writer + notifications.json crash-safety (DC-099) [glm-grade=B]

2026-08-22 23:28:36 -07:00

pagination.test.js

DC-005: Fix all 138 broken test paths after src/ refactor

2026-06-13 12:16:56 -07:00

platform-paths.test.js

[grade=B] DC-063: Coverage threshold adjustment + toDockerMountPath edge case test

2026-08-12 05:07:24 -07:00

port-lock-manager.test.js

DC-005: Fix all 138 broken test paths after src/ refactor

2026-06-13 12:16:56 -07:00

public-route-placeholders.test.js

fix: match parameterized public auth routes

2026-07-21 21:59:03 -07:00

public-routes-drift.test.js

[pending-judge] feat(DC-165 rev5): product/site uniformity — fleet gate proven at composition root, single-source capabilities manifest

2026-10-09 02:56:41 -07:00

redact-log-pii.test.js

fix(security): quoted local-part email mask — strip delimiter quotes, split on last @ (DC-109) [glm-grade=A]

2026-08-23 07:28:10 -07:00

resource-monitor.test.js

DC-005: Fix all 138 broken test paths after src/ refactor

2026-06-13 12:16:56 -07:00

self-updater-isnewer.test.js

[grade=A urn:ump:seyasvbntxsjibq5jiaqmfowc6xgchwe4jvcc54jd6355ujgm75q] DC-122: self-updater hardening + auto-update on + docker disk discipline (v1.16.0)

2026-09-13 05:32:14 -07:00

self-updater-version.test.js

[grade=B] test: sync auth and version contracts

2026-07-24 22:39:29 -07:00

session-cookie-scope.test.js

[grade=B] feat(auth): onboard missing credentials into encrypted vault

2026-08-22 05:41:38 -07:00

share-dc083.routes.test.js

[glm-grade=A] fix(share): public-endpoint input hardening + rate limit (DC-083)

2026-08-19 00:10:37 -07:00

share-routes.test.js

[glm-grade=A] fix(share): public-endpoint input hardening + rate limit (DC-083)

2026-08-19 00:10:37 -07:00

share-store.test.js

DC-053: Public share links + Tailscale-mediated share (Pro-gated)

2026-07-21 00:45:46 -07:00

shield-dc.routes.test.js

[pending-judge] fix(integration): catalog detail reads app.docker.* (DC-160); Shield committed; composition-root e2e

2026-10-07 00:58:03 -07:00

ssl-monitor.test.js

DC-005: Fix all 138 broken test paths after src/ refactor

2026-06-13 12:16:56 -07:00

sso-handoff-exchange.test.js

[grade=B] feat(auth): onboard missing credentials into encrypted vault

2026-08-22 05:41:38 -07:00

state-manager.test.js

DC-005: Fix all 138 broken test paths after src/ refactor

2026-06-13 12:16:56 -07:00

tailscale-coord.test.js

DC-043: tailscale coordination API client + admin/settings routes

2026-07-06 21:28:03 -07:00

tailscale-manager.test.js

DC-042: implement real Tailscale manager — replace null stub

2026-07-06 18:55:16 -07:00

update-manager-compose-prefix.test.js

[glm-grade=A] fix(update-manager): compose-prefixed image names probe <project>/<service> not library/<project>-<service> (DC-082)

2026-08-18 19:45:08 -07:00

update-manager.test.js

fix(update-manager): force IPv4 + per-request timeout + transient-only retry on registry digest probes (DC-078) [glm-grade=A]

2026-08-18 17:35:59 -07:00

url-resolver.test.js

DC-005: Fix all 138 broken test paths after src/ refactor

2026-06-13 12:16:56 -07:00

user-store.test.js

DC-048: multi-user bootstrap + admin invites (opt-in)

2026-07-20 17:44:11 -07:00

utilities-fleet-validation.test.js

fix(fleet): SSRF hardening — hostname validation + DNS rebinding + probe-by-IP (DC-068) [glm-grade=A]

2026-08-18 13:16:44 -07:00

utils-http-caddy-admin-ipv6-origin.test.js

fix(caddy-admin): IPv6 loopback origin allowlist + bracket-strip helper (DC-069) [glm-grade=A]

2026-08-18 13:34:51 -07:00

utils-http-caddy-admin-origin.test.js

[grade=B] api: fix undeclared 'format' runtime bug in routes/ca.js + 10 lint errors

2026-08-31 23:37:00 -07:00

utils-logging-aggregate-error.test.js

[glm-grade=B] fix(logging): surface AggregateError causes + .cause chains in error.log (DC-056)

2026-08-18 01:59:14 -07:00

utils-responses-dc-062.test.js

[glm-grade=A] fix(caddy-upstreams): swap errorResponse arg order to statusCode-first; add type validator (DC-062)

2026-08-18 09:03:58 -07:00

version-image-contract.test.js

[glm-grade=A-] refactor: extract /api/v1/version into routes/version.js + npm ci build

2026-08-15 00:01:16 -07:00