@lifeaitools/clauth 2.10.1 → 2.15.2

package/cli/watchdog-registry.js

@@ -66,6 +66,15 @@ function validateCommand(command, field) {
 export function validateWatchdogService(service) {
   if (!service || typeof service !== "object") throw new Error("service must be an object");
   if (!service.id || typeof service.id !== "string") throw new Error("service.id is required");
+  // rdc:review finding (2026-09-02): shaped identically to the id checks in
+  // cli/supervisor-registry.js (validatePluginManifest, normalizeSurface),
+  // which also reject Windows-reserved device names (con/nul/aux/prn/
+  // com1-9/lpt1-9) at registration. NOT extended here deliberately: unlike
+  // those, service.id is not used to derive a filesystem path anywhere in
+  // this file today, so there is nothing for a reserved name to collide
+  // with. Revisit if a future change starts deriving a per-service path from
+  // service.id -- that would reintroduce the same defect class this comment
+  // exists to flag before it does.
   if (!/^[a-zA-Z0-9_.-]+$/.test(service.id)) throw new Error("service.id may contain only letters, numbers, dot, underscore, and dash");
   if (!service.label || typeof service.label !== "string") throw new Error("service.label is required");
   if (!VALID_KINDS.has(service.kind)) throw new Error(`service.kind must be one of ${[...VALID_KINDS].join(", ")}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "2.10.1",
+  "version": "2.15.2",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {
@@ -28,6 +28,7 @@
     "node-fetch": "^3.3.2",
     "ora": "^8.1.0",
     "pm2": "^7.0.3",
+    "proper-lockfile": "^4.1.2",
     "typescript": "^5.9.3"
   },
   "engines": {

package/supabase/functions/auth-vault/index.ts

@@ -1,5 +1,12 @@
-// clauth — auth-vault Edge Function v2
-// Added: IP whitelist, rate limiting, machine lockout (fail_count + locked)
+// clauth — auth-vault Edge Function v3
+// IP whitelist + machine lockout (fail_count + locked) remain. Rate limiting
+// and audit logging (clauth_audit) removed 2026-09-03 -- see the comments at
+// validateHMAC and where auditLog used to be defined for why: the rate-limit
+// check was an unindexed COUNT against clauth_audit run on EVERY request,
+// pre-auth, and every rejection it produced also wrote an audit row -- a
+// feedback loop that took the whole project down under sustained load. The
+// security value it provided was already covered, tighter, by the
+// per-machine 5-failed-attempts lockout below.
 
 import { createClient } from "https://esm.sh/@supabase/supabase-js@2";
 
@@ -11,8 +18,6 @@ const ADMIN_BOOTSTRAP_TOKEN = Deno.env.get("CLAUTH_ADMIN_BOOTSTRAP_TOKEN")!;
 const ALLOWED_IPS: string[] = (Deno.env.get("CLAUTH_ALLOWED_IPS") || "")
   .split(",").map(s => s.trim()).filter(Boolean);
 
-const RATE_LIMIT_MAX    = 30;
-const RATE_LIMIT_WINDOW = 60;
 const REPLAY_WINDOW_MS  = 5 * 60 * 1000;
 const MAX_FAIL_COUNT    = 5;
 const DEFAULT_INSTALL_ID = "default";
@@ -55,18 +60,22 @@ function checkIP(ip: string): { allowed: boolean; reason?: string } {
   return { allowed: false, reason: `IP not whitelisted: ${ip}` };
 }
 
-async function checkRateLimit(sb: any, machine_hash: string): Promise<{ allowed: boolean; reason?: string }> {
-  const windowStart = new Date(Date.now() - RATE_LIMIT_WINDOW * 1000).toISOString();
-  const { count } = await sb.from("clauth_audit")
-    .select("id", { count: "exact", head: true })
-    .eq("machine_hash", machine_hash)
-    .gte("created_at", windowStart);
-  if ((count || 0) >= RATE_LIMIT_MAX) {
-    return { allowed: false, reason: `Rate limit: ${count}/${RATE_LIMIT_MAX} per ${RATE_LIMIT_WINDOW}s` };
-  }
-  return { allowed: true };
-}
-
+// rate-limiting removed 2026-09-03 -- see supervisor-registry.js's own
+// state.json lock history for the shape of this bug: checkRateLimit() ran
+// this exact query -- a COUNT against clauth_audit filtered by machine_hash
+// and created_at -- on EVERY request, BEFORE authentication (validateHMAC
+// below), against a table with no index on either column and no retention.
+// As the table grew (174,385 rows, unbounded), the scan cost grew with it;
+// under sustained traffic the queries started stacking, Postgres killed them
+// at statement_timeout, and Cloudflare killed the stacked connections at its
+// own 90s ceiling (522s) -- and every one of those rejections ALSO wrote an
+// audit row (see auditLog's removal below), so the failure fed itself. The
+// actual security protection this duplicated is already provided, tighter,
+// by the per-machine lockout in validateHMAC below (5 failed attempts locks
+// the machine -- well under the 30-per-60s this used to allow). Rate
+// limiting for a genuine runaway client belongs at Cloudflare, in front of
+// this function, not as a synchronous Postgres query on the hot path of
+// every request.
 async function validateHMAC(sb: any, body: any): Promise<{ valid: boolean; reason?: string }> {
   const now = Date.now();
   if (Math.abs(now - body.timestamp) > REPLAY_WINDOW_MS) return { valid: false, reason: "timestamp_expired" };
@@ -99,20 +108,23 @@ async function validateHMAC(sb: any, body: any): Promise<{ valid: boolean; reaso
   return { valid: true };
 }
 
-async function auditLog(sb: any, machine_hash: string, service_name: string, action: string, result: string, detail?: string) {
-  await sb.from("clauth_audit").insert({ machine_hash, service_name, action, result, detail });
-}
-
+// auditLog() removed 2026-09-03 alongside checkRateLimit() -- it wrote a row
+// to clauth_audit on every path through this function, including rejections
+// (rate-limited, auth-denied, IP-blocked), which is what turned "the table
+// got slow" into a feedback loop (more rejections -> more rows -> slower
+// scans -> more rejections). No retention policy ever existed for this
+// table. If durable audit logging is wanted back, it needs its own design --
+// write-only, indexed for its actual read pattern (if any), with a real
+// retention/partition policy -- not a bare insert-on-every-call with no cap.
 async function handleRetrieve(sb: any, body: any, mh: string) {
   const { service } = body;
   if (!service) return { error: "service required" };
   const { data: svc } = await sb.from("clauth_services").select("*").eq("name", service).single();
-  if (!svc)           { await auditLog(sb, mh, service, "retrieve", "fail", "service_not_found"); return { error: "service_not_found" }; }
-  if (!svc.enabled)   { await auditLog(sb, mh, service, "retrieve", "denied", "service_disabled"); return { error: "service_disabled" }; }
-  if (!svc.vault_key) { await auditLog(sb, mh, service, "retrieve", "fail", "no_key_stored"); return { error: "no_key_stored" }; }
+  if (!svc)           return { error: "service_not_found" };
+  if (!svc.enabled)   return { error: "service_disabled" };
+  if (!svc.vault_key) return { error: "no_key_stored" };
   const { data: secret } = await sb.rpc("vault_decrypt_secret", { secret_name: svc.vault_key });
   await sb.from("clauth_services").update({ last_retrieved: new Date().toISOString() }).eq("name", service);
-  await auditLog(sb, mh, service, "retrieve", "success");
   return { service, key_type: svc.key_type, value: secret };
 }
 
@@ -121,9 +133,8 @@ async function handleWrite(sb: any, body: any, mh: string) {
   if (!service || !value) return { error: "service and value required" };
   const vaultKey = `clauth.${service}`;
   const { error } = await sb.rpc("vault_upsert_secret", { secret_name: vaultKey, secret_value: typeof value === "string" ? value : JSON.stringify(value) });
-  if (error) { await auditLog(sb, mh, service, "write", "fail", error.message); return { error: error.message }; }
+  if (error) return { error: error.message };
   await sb.from("clauth_services").update({ vault_key: vaultKey, last_rotated: new Date().toISOString() }).eq("name", service);
-  await auditLog(sb, mh, service, "write", "success");
   return { success: true, service, vault_key: vaultKey };
 }
 
@@ -133,7 +144,6 @@ async function handleEnable(sb: any, body: any, mh: string) {
   q = service !== "all" ? q.eq("name", service) : q.not("vault_key", "is", null);
   const { error } = await q;
   if (error) return { error: error.message };
-  await auditLog(sb, mh, service, enabled ? "enable" : "disable", "success");
   return { success: true, service, enabled };
 }
 
@@ -144,7 +154,6 @@ async function handleAdd(sb: any, body: any, mh: string) {
   if (project) row.project = project;
   const { error } = await sb.from("clauth_services").insert(row);
   if (error) return { error: error.message };
-  await auditLog(sb, mh, name, "add", "success");
   return { success: true, name, label, key_type, project: project || null };
 }
 
@@ -157,7 +166,6 @@ async function handleUpdate(sb: any, body: any, mh: string) {
   if (description !== undefined) updates.description = description || null;
   const { error } = await sb.from("clauth_services").update(updates).eq("name", service);
   if (error) return { error: error.message };
-  await auditLog(sb, mh, service, "update", "success", `fields: ${Object.keys(updates).join(", ")}`);
   return { success: true, service, ...updates };
 }
 
@@ -166,7 +174,6 @@ async function handleRemove(sb: any, body: any, mh: string) {
   if (confirm !== `CONFIRM REMOVE ${service.toUpperCase()}`) return { error: "confirm phrase mismatch" };
   await sb.rpc("vault_delete_secret", { secret_name: `clauth.${service}` });
   await sb.from("clauth_services").delete().eq("name", service);
-  await auditLog(sb, mh, service, "remove", "success");
   return { success: true, service };
 }
 
@@ -182,7 +189,6 @@ async function handleRevoke(sb: any, body: any, mh: string) {
     await sb.rpc("vault_delete_secret", { secret_name: `clauth.${service}` });
     await sb.from("clauth_services").update({ vault_key: null, enabled: false }).eq("name", service);
   }
-  await auditLog(sb, mh, service, "revoke", "success");
   return { success: true, service };
 }
 
@@ -193,7 +199,6 @@ async function handleStatus(sb: any, body: any, mh: string) {
     .order("name");
   if (body.project) q = q.eq("project", body.project);
   const { data: services } = await q;
-  await auditLog(sb, mh, "all", "status", "success");
   return { services: services || [] };
 }
 
@@ -204,7 +209,6 @@ async function handleChangePassword(sb: any, body: any, mh: string) {
     .update({ hmac_seed_hash: new_hmac_seed_hash, fail_count: 0, locked: false })
     .eq("machine_hash", mh);
   if (error) return { error: error.message };
-  await auditLog(sb, mh, "system", "change-password", "success");
   return { success: true };
 }
 
@@ -231,12 +235,8 @@ async function handleCreateEnrollment(sb: any, body: any, mh: string) {
     created_by_machine_hash: mh,
     expires_at,
   });
-  if (error) {
-    await auditLog(sb, mh, "system", "create-enrollment", "fail", error.message);
-    return { error: error.message };
-  }
+  if (error) return { error: error.message };
 
-  await auditLog(sb, mh, "system", "create-enrollment", "success", `install_id=${install_id}`);
   return { success: true, enrollment_code: code, install_id, expires_at, label };
 }
 
@@ -274,7 +274,6 @@ async function handleRedeemEnrollment(sb: any, body: any) {
   if (consumeError) return { error: consumeError.message };
   if (!consumedRows || consumedRows.length !== 1) return { error: "enrollment_already_used" };
 
-  await auditLog(sb, machine_hash, "system", "redeem-enrollment", "success", `install_id=${install_id}`);
   return { success: true, machine_hash, install_id };
 }
 
@@ -314,21 +313,11 @@ Deno.serve(async (req: Request) => {
 
   const ipCheck = checkIP(ip);
   if (!ipCheck.allowed) {
-    await auditLog(sb, body.machine_hash || "unknown", "system", route, "blocked", ipCheck.reason);
     return Response.json({ error: "ip_blocked", reason: ipCheck.reason }, { status: 403 });
   }
 
-  if (body.machine_hash) {
-    const rateCheck = await checkRateLimit(sb, body.machine_hash);
-    if (!rateCheck.allowed) {
-      await auditLog(sb, body.machine_hash, "system", route, "rate_limited", rateCheck.reason);
-      return Response.json({ error: "rate_limited", reason: rateCheck.reason }, { status: 429 });
-    }
-  }
-
   const authResult = await validateHMAC(sb, { machine_hash: body.machine_hash, token: body.token, timestamp: body.timestamp, password: body.password });
   if (!authResult.valid) {
-    await auditLog(sb, body.machine_hash || "unknown", body.service || "unknown", route, "denied", authResult.reason);
     return Response.json({ error: "auth_failed", reason: authResult.reason }, { status: 401 });
   }
 

package/supabase/migrations/004_remove_audit_and_rate_limiting.sql

@@ -0,0 +1,29 @@
+-- Migration: remove clauth_audit and the rate-limiting it backed
+-- Applied live to the LIFEAI project 2026-09-03; this file makes a fresh
+-- `supabase db push` (a new operator following the setup guide) match that
+-- same state instead of creating a table the current auth-vault code never
+-- reads or writes.
+--
+-- Root cause of the 2026-09-03 incident this closes: checkRateLimit() in
+-- supabase/functions/auth-vault/index.ts ran an unindexed COUNT against
+-- clauth_audit, filtered by machine_hash + created_at, on EVERY request,
+-- BEFORE authentication. As the table grew unbounded (no retention policy
+-- ever existed), the scan cost grew with it; under sustained traffic the
+-- queries stacked, Postgres killed them at statement_timeout, and Cloudflare
+-- killed the stacked connections at its own 90s ceiling (522s). Every one of
+-- those rejections also wrote an audit row via auditLog(), which fed the
+-- same table the check was scanning -- a self-reinforcing feedback loop.
+--
+-- The security value the rate limiter provided was already covered, tighter,
+-- by the per-machine lockout in validateHMAC (clauth_machines.fail_count /
+-- .locked -- 5 failed attempts locks the machine, well under the 30-per-60s
+-- window this used to allow). Rate limiting for a genuine runaway client
+-- belongs at Cloudflare, in front of this function, not as a synchronous
+-- Postgres query on the hot path of every request.
+--
+-- Confirmed before dropping the live table: no function in pg_proc
+-- referenced clauth_audit in its source, and no trigger targeted it --
+-- auth-vault's own auditLog() (now removed from the deployed function) was
+-- its only writer, and RLS (no_anon_audit, see 001_clauth_schema.sql) meant
+-- no client ever had direct write access either.
+DROP TABLE IF EXISTS public.clauth_audit CASCADE;