mirror of https://github.com/garrytan/gstack.git
f31aff1bc6
The loopback sessions list echoed live tokens — a harvest-and-replay primitive for anything on the machine (same class as the /health token leak fixed in v1.63). The list now returns a device-salted 16-hex token_id plus metadata; the salt is shared with the attempts log so identifiers correlate. /auth/revoke keeps the list→revoke workflow alive by accepting token_id alongside the caller's own raw token and identity. saltedHash() is exported from audit.ts and writeAttempt now reuses it (was inlined). Integration tests pin raw-token absence, the id shape/metadata, and the token_id revoke round-trip (verified RED against the leaking handler). List fix ported from time-attack/gstack (GStack 2); token_id revoke is ours. Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| allowlist.ts | ||
| audit.ts | ||
| auth-mint.ts | ||
| cli-mint.ts | ||
| devicectl.ts | ||
| index.ts | ||
| proxy.ts | ||
| session-tokens.ts | ||
| single-instance.ts | ||
| tailscale-localapi.ts | ||
| tunnel-bootstrap.ts | ||
| types.ts | ||