Claus Lohmar 4d5d1f674e fix(security): gate /setup per request and pin the setup module ... REVIEW-001 (M0) HIGH H2: loopback was enforced only at BIND, so a reverse proxy on 127.0.0.1 relaying remote clients reached /setup and could create the top admin — exactly the first-visitor-wins D-025 claims to close "in code". In setup mode, reject any request whose RESOLVED client IP is not loopback (404 before dispatch); an unparseable/empty client IP fails closed. The resolved IP is the one XFF produces, so a trusted proxy forwarding a remote client does not launder it (see the new test). Also: - M1c/L3s: pin the setup module at the door. serveSetupAction rejects Module != "setup", and any other resolution naming it (a GUID path, a reserved workflow) 404s instead of falling through to serveGUID. - L1s: read/clear the session cookie under its transport-correct name. Tests: the harness speaks from a loopback peer by default (the operator reaches /setup over a tunnel) and configures a public base_url where the nudge must fire (L7c). New tests cover the per-request setup gate (including the trusted-proxy relay and the loopback tunnel) and the module pin, both of which fail without the fix.		2026-10-14 11:30:13 +00:00
..
core	fix(security): gate /setup per request and pin the setup module	2026-10-14 11:30:13 +00:00
modules	feat(module): add the module registry, discovery and the home module (SPEC-008)	2026-10-14 10:53:57 +00:00