Every password door counts in the sign-in windows: the API session and token doors, HTTP Basic and the terminal sign-in go through one throttled verify #42

Merged

grokbot merged 13 commits from dev/signin-throttle-password-doors into main 2026-10-18 03:32:25 +00:00

Conversation 0 Commits 13 Files changed 15 +345 -86

grokbot commented 2026-10-17 19:09:24 +00:00

Owner

Copy link

Problem. Four password doors had no sign-in limit: POST /api/v1/sessions, the password branch of POST /api/v1/tokens, HTTP Basic on any request (it gives scope admin), and the terminal sign-in. A client could guess passwords with no limit. Each guess also used one argon2 verify.

Root cause. The sign-in windows (#2439, #2366, #2470) were in the /signin page handler. verifyPassword was exported, so each door had to remember to ask the windows first. Four doors did not.

Fix.

• The windows move to src/core/signin-window.ts (per account, per source, per forge, same limits and keys). signinAllowed for the passkey, claim and parent doors calls it.
• verifyPasswordThrottled(db, { username, password, source }) is the only exported password check. It counts the attempt before argon2. The raw check is not exported, so a new door cannot skip the windows.
• All password doors call it: /signin, the API session and token doors (429 with retry-after), HTTP Basic (401 when throttled, also for the right password), the terminal (throttled) and the password change.
• A right password gives its attempt back. A git client that sends the right password on each request does not fill a window. Each wrong guess stays counted.

Test. test/signin-password-doors.test.ts: with signin.per_account = 3, three wrong tries, then the right password is refused at each door. Tries at /signin close the API door. 9 right Basic passwords in a row all pass. No module but core/users.ts calls Bun.password.verify. On main: 6 of 7 fail. With the fix: 8 of 8 pass. test/throttle-scope.test.ts now expects the API password sign-in to be refused by the full sign-in window.

Validate (fast). Result: baseline. Only contain.test.ts, release-handover.test.ts and web-code.test.ts failed, and they also fail on main 1051d451 on this box. tsc passes.

**Problem.** Four password doors had no sign-in limit: `POST /api/v1/sessions`, the password branch of `POST /api/v1/tokens`, HTTP Basic on any request (it gives scope `admin`), and the terminal sign-in. A client could guess passwords with no limit. Each guess also used one argon2 verify. **Root cause.** The sign-in windows (#2439, #2366, #2470) were in the `/signin` page handler. `verifyPassword` was exported, so each door had to remember to ask the windows first. Four doors did not. **Fix.** - The windows move to `src/core/signin-window.ts` (per account, per source, per forge, same limits and keys). `signinAllowed` for the passkey, claim and parent doors calls it. - `verifyPasswordThrottled(db, { username, password, source })` is the only exported password check. It counts the attempt before argon2. The raw check is not exported, so a new door cannot skip the windows. - All password doors call it: `/signin`, the API session and token doors (429 with `retry-after`), HTTP Basic (401 when throttled, also for the right password), the terminal (`throttled`) and the password change. - A right password gives its attempt back. A git client that sends the right password on each request does not fill a window. Each wrong guess stays counted. **Test.** `test/signin-password-doors.test.ts`: with `signin.per_account` = 3, three wrong tries, then the right password is refused at each door. Tries at `/signin` close the API door. 9 right Basic passwords in a row all pass. No module but `core/users.ts` calls `Bun.password.verify`. On main: 6 of 7 fail. With the fix: 8 of 8 pass. `test/throttle-scope.test.ts` now expects the API password sign-in to be refused by the full sign-in window. **Validate (fast).** Result: baseline. Only `contain.test.ts`, `release-handover.test.ts` and `web-code.test.ts` failed, and they also fail on main 1051d451 on this box. tsc passes.

grokbot added 1 commit 2026-10-17 19:09:24 +00:00

Every password door counts in the sign-in windows: the API session and token doors, HTTP Basic and the terminal sign-in go through one throttled verify, and a right password is given back 3602eaacf9

grokbot added 2 commits 2026-10-17 20:26:46 +00:00

Merge remote-tracking branch 'origin/main' into dev/signin-throttle-password-doors b39a1b8666

Merge remote-tracking branch 'origin/main' into dev/signin-throttle-password-doors 8d0bdc6108

grokbot added 1 commit 2026-10-17 21:27:32 +00:00

Merge branch 'main' into dev/signin-throttle-password-doors cb56fcb6a6

grokbot added 1 commit 2026-10-17 21:43:57 +00:00

Merge origin/main (#43 createUser origin, #52, #53) into dev/signin-throttle-password-doors ... f24509d113

Conflicts were imports only: users.ts keeps admitSignin beside #43's getSignup
and SignupSlot; site.ts keeps signinWindow beside SignupSlot (RateLimiter is
no longer used there). Every password door still goes through
verifyPasswordThrottled. Two tests that call createUser without an origin get
origin "seed": signin-password-doors (this branch) and account-ceiling-reserve
(#52 landed after #43 without one, so main does not typecheck).

Progress: tsc --noEmit clean; touched tests next.

grokbot added 2 commits 2026-10-18 01:09:03 +00:00

Merge origin/main (#57 no first-account admin) into dev/signin-throttle-password-doors 7c89ffb4be

The password-doors suite seeds its admin with seedAdmin e8352a2cb9

grokbot added 1 commit 2026-10-18 01:26:16 +00:00

Re-run the checks: the preview's image push hit a registry 499 (Client Closed Request) b6cc351308

grokbot added 1 commit 2026-10-18 02:00:27 +00:00

Merge origin/main (#58 preview on the droplet runner) into dev/signin-throttle-password-doors a15b6b34af

grokbot added 1 commit 2026-10-18 02:25:20 +00:00

Merge origin/main (#59 first account follows the signup setting) into dev/signin-throttle-password-doors 1bc36acc8f

grokbot added 1 commit 2026-10-18 02:34:20 +00:00

Re-run the checks: gate (1) timed out in the hook relay under load (fifty agents at once, 174 s; passes locally in under 1 s) dfdda67237

grokbot added 1 commit 2026-10-18 02:43:40 +00:00

Merge origin/main (#60 README quickstart) into dev/signin-throttle-password-doors 2412e38a76

grokbot added 1 commit 2026-10-18 03:19:47 +00:00

Merge origin/main (release 0.7.165) into dev/signin-throttle-password-doors 231e4bc4b4

grokbot merged commit 2a94f399b6 into main 2026-10-18 03:32:25 +00:00

grokbot deleted branch dev/signin-throttle-password-doors 2026-10-18 03:32:25 +00:00

grokbot referenced this pull request from a commit 2026-10-18 03:32:26 +00:00

Merge pull request 'Every password door counts in the sign-in windows: the API session and token doors, HTTP Basic and the terminal sign-in go through one throttled verify' (#42) from dev/signin-throttle-password-doors into main

grokbot referenced this pull request from a commit 2026-10-18 03:32:48 +00:00

Merge origin/main (#42 sign-in throttle, release 0.7.165) into dev/stale-signup-admin-scope

grokbot referenced this pull request from a commit 2026-10-18 03:33:22 +00:00

Merge origin/main (#42 sign-in throttle, release 0.7.165) into dev/invite-redeem

grokbot referenced this pull request 2026-10-18 04:30:35 +00:00

Pack transfers at once follow the host's memory, so a 512 MiB cell does not run sixteen pushes and their hooks past its limit #61

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent-work

Queue this for an agent: it will build it and open a PR

  

agent-working

An agent is actively working on this

  

ultracode

Operators: run a Fable ultracode orchestrator on this issue

No labels

agent-work

agent-working

ultracode

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

trevato-apps/forge!42

No description provided.