From 46a1b29d1e60fa0ac478fdff45dc6456807d6297 Mon Sep 17 00:00:00 2001 From: Agando Date: Mon, 2 Nov 2026 21:51:31 +0100 Subject: fix(auth): one session writer for every login path; expire dead credentials MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Third occurrence of the same class of bug, and the first fix is why: commit e95b7be (2026-11-01, "multi-session .newsession v3") touched exactly ONE hunk of auth-file-api.py β€” handle_login. handle_device_poll, handle_telegram_login and handle_register kept overwriting the whole .newsession with a single-session v2 payload, so a phone sign-in logged the desktop out and the loser held a session id no store knew: permanent `401 Invalid session or API key` (newOS4 asked for a login it could never complete). Measured: agando's store held 1 entry (sha8 45cb7819) while the phone sent 9ac607f1 for 3 h; 26 device-polls in 2 s from one page minted 26 cookies and only the last write survived, which also drained the shared nginx `webx11` zone (11x 503 on /admin/api/*). api/webx11_auth.py - add_session() is now THE writer: v3 `sessions[]` (cap 5) under a per-user `flock` (LOCK_DIR outside the spaces), plus the legacy `.session` mirror - module-level import so no handler has to reach for it lazily api/auth-file-api.py - device-poll / telegram-login / register / recover-by-backup-code all call add_session(); a bare write_newsession_file() is now only the admin-gated handle_create_session - handle_device_poll runs its approved branch under a per-code `flock` and mints exactly one session per approved code (idempotent under a poll storm), with a cheap pre-lock reject so unvalidated codes cannot mint lock files - handle_me_cookie expires an unknown session cookie (Set-Cookie Max-Age=0, code SESSION_DEAD): the cookie is HttpOnly, so no page could ever clear a dead credential and every load re-sent it api/newcrypto.py - write_newsession_file() is atomic (tmp + fsync + os.replace); the temp name carries pid+tid because a fixed `.tmp` lets two concurrent writers of one store steal each other's temp file (reproduced: FileNotFoundError) admin-login.html single-flight poll (polling/finished guards) β€” 26 calls -> 1 dashboard.html device-code fallback when the Telegram popup has no opener spaces/newos4/* 401 -> session-repair notice + endpoint normalisation, v4.6.144 nginx /api/auth/ + /api/security/ on zone wx11auth (120r/m, burst 60) admin/scripts/verify-session-writers.py NEW static guard, wired into smoke-auth.sh Proof (live, after restart): 5 concurrent polls on one approved code -> 5x approved, 1 distinct session id, store v3 with 2 entries, pre-fix session still valid; dead cookie -> 401 + Set-Cookie expiry, valid cookie -> 200; 200-call auth burst -> 503s only on /api/auth/, /admin/ stayed 302; smoke-auth.sh PASS. Guard RED (3 offenders) -> GREEN. Backups: /home/darkbot/backups/authfix-20261102_214424 --- modules/core/core-bundle.js | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) (limited to 'modules/core/core-bundle.js') diff --git a/modules/core/core-bundle.js b/modules/core/core-bundle.js index 2a7ec3e..6a37d61 100644 --- a/modules/core/core-bundle.js +++ b/modules/core/core-bundle.js @@ -1307,6 +1307,22 @@ class OllamaManager { return err; } + _sessionRepairNotice() { + // A 401 here means the cookie/Bearer we sent is not in any session store: the store + // moved on (another device signed in, poll race, expired) and this tab kept the old + // value. Clear the local copy so the next attempt is anonymous-demo instead of a + // permanent 401, and say what to do. (2026-11-02) + try { + localStorage.removeItem('webx11_session_id'); + localStorage.removeItem('webx11_session'); + localStorage.removeItem('webx11_encrypted_session'); + document.cookie = 'webx11_session=; path=/; max-age=0'; + } catch (e) {} + this.terminal.print('πŸ”’ Your login session is no longer valid on the server. ' + + 'Open https://webx11.duckdns.org/dashboard.html , sign in with Telegram ' + + '(or β€œSign in with a code”), then reload this page.', 'warning'); + } + constructor(terminal) { this.terminal = terminal; // --- Backward-compat properties (reflected from active provider) --- @@ -1403,6 +1419,7 @@ class OllamaManager { enabled: true }]; } + this.providers.forEach(p => { if (p.endpoint) p.endpoint = p.endpoint.replace(/\/+$/, ''); }); } _saveProviders() { @@ -1913,6 +1930,7 @@ class OllamaManager { } catch (error) { // Remember why this provider failed so chat() can name the real cause // instead of falling back to the generic "No provider responded". + if (error.status === 401) { this._sessionRepairNotice(); } this._lastChatError = error.message || String(error); if (fullText && fullText.length > 0) { this.terminal.printStreamingResponse(`\n\n[Stream error: ${error.message}]`, true); @@ -2321,6 +2339,7 @@ class OllamaManager { if (error.message === 'Failed to fetch' && provider.type === 'ollama') { return await this.chatWithToolsFallback(messages, tools, useModel); } + if (error.status === 401) { this._sessionRepairNotice(); } this.terminal.print(`${provider.name} /api/chat error: ${error.message}`, 'error'); this._lastChatError = error.message || String(error); return { message: null, tool_calls: null, error: error.message }; @@ -2574,6 +2593,7 @@ Only output XML function calls for tool tasks. If no tool is needed, answer norm // ─── Backward-compat methods ───────────────────────────────────────────── setEndpoint(url) { + if (typeof url === 'string') url = url.replace(/\/+$/, ''); this.endpoint = url; // Also update the current provider's endpoint if it exists if (this.currentProvider) { -- cgit v1.2.3