qa(onboarding): gate 4 unauthenticated control-plane + inference-allocation endpoints#46
Merged
Merged
Conversation
…ation endpoints The wavex-os-server has no global auth hook; every route self-gates. Four mutating onboarding/control-plane endpoints had no assertBoard gate, making them callable by any unauthenticated client that can reach the port: - POST /api/system/pull-and-restart (git pull --ff-only + pnpm install + restart on REPO_ROOT — remote code-pull / RCE-adjacent) - POST /api/system/restart-processes (launchctl kickstart — control-plane DoS) - POST /api/system/discard-local-changes (git stash wipes working tree) - PUT /api/inference-allocation (swarm_pct=100 zeros Pool-A, strands the onboarding wizard a new customer is in front of) Adds the same assertBoard(authReq(req)) gate already used by activate.ts. In WAVEX_AUTH_MODE=dev the gate is a no-op (synthetic local board actor), so Mission Control and the onboarding wizard are unaffected; in production it requires a board actor. Verified: tsc --noEmit exit 0; 18/19 wavex-os-server test files green. The e2e-onboarding failures are pre-existing on main (no inference backend in sandbox) and unrelated to this change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
QA-hardening of the WaveX-OS onboarding, exercising the live use case https://www.wavexcard.com end-to-end (static audit of 45 routes + live Playwright walk). The local control plane has no global auth hook — every route self-gates — and an audit found 12 ungated mutating endpoints out of 75. This PR closes the 4 highest-severity, lowest-regression-risk ones with the minimal
assertBoardgate already used byactivate.ts.Fixes (4 endpoints, 2 files)
POST /api/system/pull-and-restartgit pull+pnpm install+ restart on REPO_ROOT — RCE-adjacentPOST /api/system/restart-processeslaunchctl kickstart— control-plane DoSPOST /api/system/discard-local-changesgit stashwipes working treePUT /api/inference-allocationswarm_pct=100zeros Pool-A, strands the onboarding wizardIn
WAVEX_AUTH_MODE=dev(default) the gate is a no-op via the synthetic local board actor, so Mission Control + the onboarding wizard keep working; production requires a real board actor.Why only these 4
auth-events,activation-events,wizard-eventsare intentionally public browser beacons fired before a board actor exists — a hard gate would break new-user signup; their correct fix is session-binding + rate-limit (documented, deferred).credentials.tsis the connectors mission's active file and was left untouched per non-interference. Full reasoning in the deliverable.Verification
tsc --noEmiton@wavex-os/wavex-os-server→ exit 0e2e-onboarding.test.ts) was proven pre-existing on clean main by stashing this change and re-running — finalize→500 from the missing inference backend in-sandbox, unrelated to this diff.Changed files
packages/wavex-os-server/src/routes/system-actions.tspackages/wavex-os-server/src/routes/inference-allocation.tsDeliverable
.plateau-agency/deliverables/onboarding/—report.md(55 findings, anchored),screenshots/(11 live PNGs),qa-artifacts/step{1..5}/findings.md+live-walk{,2}.json. 6-item follow-up backlog in report §5.🤖 Generated with Claude Code