@x47base/pocketbase-addon 0.1.0

package/security/assurance_test.go

@@ -0,0 +1,149 @@
+package security
+
+import (
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestNATFairnessAndRejectedAccounting(t *testing.T) {
+	app, err := tests.NewTestApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer app.Cleanup()
+	c := core.NewAuthCollection("security_users")
+	if err := app.Save(c); err != nil {
+		t.Fatal(err)
+	}
+	tokens := []string{}
+	for _, email := range []string{"a@example.com", "b@example.com"} {
+		r := core.NewRecord(c)
+		r.SetEmail(email)
+		r.SetPassword("1234567890")
+		if err := app.Save(r); err != nil {
+			t.Fatal(err)
+		}
+		token, err := r.NewAuthToken()
+		if err != nil {
+			t.Fatal(err)
+		}
+		tokens = append(tokens, token)
+	}
+	config := DefaultConfig()
+	config.Mode = "enforce"
+	config.IdentityBurst = 1
+	config.IdentityPerSecond = .001
+	s, err := New(config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer s.Close()
+	router, _ := apis.NewRouter(app)
+	s.Bind(router)
+	router.GET("/probe", func(e *core.RequestEvent) error { return e.String(200, "ok") })
+	handler, err := router.BuildMux()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, tc := range []struct {
+		token string
+		want  int
+	}{{tokens[0], 200}, {tokens[0], 429}, {"", 200}, {"", 429}, {tokens[1], 200}} {
+		req := httptest.NewRequest("GET", "/probe", nil)
+		req.RemoteAddr = "192.0.2.1:1000"
+		req.Header.Set("Authorization", tc.token)
+		w := httptest.NewRecorder()
+		handler.ServeHTTP(w, req)
+		if w.Code != tc.want {
+			t.Fatalf("got %d want %d", w.Code, tc.want)
+		}
+		if w.Code == 429 && w.Header().Get("Retry-After") == "" {
+			t.Fatal("missing retry header")
+		}
+	}
+	if s.total != 5 || s.rejected != 2 {
+		t.Fatalf("incorrect accounting: %d/%d", s.total, s.rejected)
+	}
+}
+func TestStateRestartAndCorruption(t *testing.T) {
+	config := DefaultConfig()
+	config.StatePath = filepath.Join(t.TempDir(), "state.json")
+	s, err := New(config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	s.mu.Lock()
+	s.revision = 4
+	s.nextID = 1
+	s.incidents = []Incident{{ID: 1, Family: "auth", Phase: "active"}}
+	s.actions["auth"] = Action{Family: "auth", Reason: "test", ExpiresAt: time.Now().Add(time.Minute)}
+	s.mu.Unlock()
+	s.Close()
+	restored, err := New(config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if restored.revision != 4 || len(restored.incidents) != 1 || len(restored.actions) != 1 {
+		t.Fatal("lost persisted state")
+	}
+	restored.Close()
+	os.WriteFile(config.StatePath, []byte("corrupt"), 0600)
+	degraded, err := New(config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer degraded.Close()
+	if !degraded.storageError || degraded.config.Mode != config.Mode {
+		t.Fatal("invalid state weakened startup policy")
+	}
+}
+
+func TestOperatorLaneRequiresExplicitPeerAndKeepsAuth(t *testing.T) {
+	app, err := tests.NewTestApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer app.Cleanup()
+	c := DefaultConfig()
+	c.Mode = "enforce"
+	c.OperatorPeers = []string{"192.0.2.10/32"}
+	s, err := New(c)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer s.Close()
+	s.actions["other"] = Action{Family: "other", ExpiresAt: time.Now().Add(time.Minute)}
+	r, _ := apis.NewRouter(app)
+	s.Bind(r)
+	r.GET("/probe", func(e *core.RequestEvent) error { return e.NoContent(204) })
+	r.GET("/private-probe", func(e *core.RequestEvent) error { return e.NoContent(204) }).Bind(apis.RequireSuperuserAuth())
+	mux, err := r.BuildMux()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, tc := range []struct {
+		peer, marker, path string
+		want               int
+	}{
+		{"192.0.2.10:1", "1", "/probe", 204},
+		{"192.0.2.10:1", "", "/probe", 429},
+		{"198.51.100.1:1", "1", "/probe", 429},
+		{"192.0.2.10:1", "1", "/private-probe", 401},
+	} {
+		req := httptest.NewRequest("GET", tc.path, nil)
+		req.RemoteAddr = tc.peer
+		req.Header.Set("X-Spink-Operator", tc.marker)
+		w := httptest.NewRecorder()
+		mux.ServeHTTP(w, req)
+		if w.Code != tc.want {
+			t.Fatalf("%+v got %d", tc, w.Code)
+		}
+	}
+}

package/security/compatibility_test.go

@@ -0,0 +1,128 @@
+package security
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/subscriptions"
+)
+
+func TestBatchAndSubscriptionReservationRelease(t *testing.T) {
+	app, err := tests.NewTestApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer app.Cleanup()
+	config := DefaultConfig()
+	config.Mode = "enforce"
+	config.MaxWrites = 2
+	config.MaxSubscriptionsTotal = 2
+	if err := Register(app, config); err != nil {
+		t.Fatal(err)
+	}
+	s := app.Store().Get("pb.security.service").(*Service)
+	defer s.Close()
+	event := func() *core.RequestEvent {
+		e := &core.RequestEvent{App: app}
+		e.Request = httptest.NewRequest("POST", "/api/batch", nil)
+		e.Response = httptest.NewRecorder()
+		return e
+	}
+	s.active["writes"] = 1
+	called := false
+	err = app.OnBatchRequest().Trigger(&core.BatchRequestEvent{RequestEvent: event(), Batch: make([]*core.InternalRequest, 3)}, func(e *core.BatchRequestEvent) error { called = true; return nil })
+	if err == nil || called || s.active["writes"] != 1 {
+		t.Fatal("oversized weighted batch admitted or permit leaked")
+	}
+	sentinel := errors.New("handler failed")
+	err = app.OnBatchRequest().Trigger(&core.BatchRequestEvent{RequestEvent: event(), Batch: make([]*core.InternalRequest, 2)}, func(e *core.BatchRequestEvent) error {
+		if s.active["writes"] != 2 {
+			t.Fatal("missing weight")
+		}
+		return sentinel
+	})
+	if err != sentinel || s.active["writes"] != 1 {
+		t.Fatal("batch failure leaked permits")
+	}
+	client := subscriptions.NewDefaultClient()
+	err = app.OnRealtimeConnectRequest().Trigger(&core.RealtimeConnectRequestEvent{RequestEvent: event(), Client: client}, func(e *core.RealtimeConnectRequestEvent) error {
+		subscribe := func(items []string, fail bool) error {
+			return app.OnRealtimeSubscribeRequest().Trigger(&core.RealtimeSubscribeRequestEvent{RequestEvent: event(), Client: client, Subscriptions: items}, func(e *core.RealtimeSubscribeRequestEvent) error {
+				if fail {
+					return sentinel
+				}
+				client.Unsubscribe()
+				client.Subscribe(items...)
+				return nil
+			})
+		}
+		if subscribe([]string{"a", "b"}, false) != nil || s.totalSubscriptions != 2 {
+			t.Fatal("subscriptions not reserved")
+		}
+		if subscribe([]string{"a", "b", "c"}, false) == nil || s.totalSubscriptions != 2 {
+			t.Fatal("aggregate limit not enforced")
+		}
+		if subscribe([]string{"a"}, true) != sentinel || s.totalSubscriptions != 2 {
+			t.Fatal("failed update changed reservation")
+		}
+		if subscribe([]string{"a"}, false) != nil || s.totalSubscriptions != 1 {
+			t.Fatal("unsubscribe did not free capacity")
+		}
+		return sentinel
+	})
+	if err != sentinel || s.totalSubscriptions != 0 || len(s.clients) != 0 {
+		t.Fatal("disconnect leaked subscriptions")
+	}
+}
+
+func TestManagementRevisionAndNetwork(t *testing.T) {
+	app, err := tests.NewTestApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer app.Cleanup()
+	admin, err := app.FindFirstRecordByData(core.CollectionNameSuperusers, "email", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	token, err := admin.NewAuthToken()
+	if err != nil {
+		t.Fatal(err)
+	}
+	s, err := New(DefaultConfig())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer s.Close()
+	r, _ := apis.NewRouter(app)
+	s.Bind(r)
+	h, err := r.BuildMux()
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, _ := json.Marshal(DefaultConfig())
+	for _, tc := range []struct {
+		peer, revision string
+		want           int
+	}{{"192.0.2.1:1234", "1", 403}, {"127.0.0.1:1234", "0", 409}, {"127.0.0.1:1234", "1", 200}, {"127.0.0.1:1234", "1", 409}} {
+		req := httptest.NewRequest("PUT", "/api/security/policy", strings.NewReader(string(body)))
+		req.RemoteAddr = tc.peer
+		req.Header.Set("Content-Type", "application/json")
+		req.Header.Set("Authorization", token)
+		req.Header.Set("If-Match", tc.revision)
+		w := httptest.NewRecorder()
+		h.ServeHTTP(w, req)
+		if w.Code != tc.want {
+			t.Fatalf("got %d want %d", w.Code, tc.want)
+		}
+	}
+	if s.revision != 2 {
+		t.Fatal("rejected mutation changed policy")
+	}
+}

package/security/config.go

@@ -0,0 +1,78 @@
+package security
+
+import (
+	"errors"
+	"math"
+	"net/netip"
+	"path/filepath"
+)
+
+type Config struct {
+	OperatorPeers         []string `json:"-"`
+	StatePath             string   `json:"-"`
+	Mode                  string   `json:"mode"`
+	RequestsPerSecond     float64  `json:"requestsPerSecond"`
+	Burst                 int      `json:"burst"`
+	IdentityPerSecond     float64  `json:"identityPerSecond"`
+	IdentityBurst         int      `json:"identityBurst"`
+	MaxConcurrent         int      `json:"maxConcurrent"`
+	MaxWrites             int      `json:"maxWrites"`
+	MaxFiles              int      `json:"maxFiles"`
+	MaxRealtime           int      `json:"maxRealtime"`
+	MaxSubscriptionsTotal int      `json:"maxSubscriptionsTotal"`
+	MaxSubscriptions      int      `json:"maxSubscriptions"`
+	MaxIdentities         int      `json:"maxIdentities"`
+	TrustedPeers          []string `json:"trustedPeers"`
+	ManagementPeers       []string `json:"managementPeers"`
+}
+
+func DefaultConfig() Config {
+	return Config{Mode: "observe", RequestsPerSecond: 100, Burst: 200, IdentityPerSecond: 20, IdentityBurst: 40, MaxConcurrent: 64, MaxWrites: 8, MaxFiles: 8, MaxRealtime: 128, MaxSubscriptions: 100, MaxSubscriptionsTotal: 4096, MaxIdentities: 4096, ManagementPeers: []string{"127.0.0.0/8", "::1/128"}}
+}
+func (c Config) Validate() error {
+	if c.StatePath != "" && !filepath.IsAbs(c.StatePath) {
+		return errors.New("state path must be absolute")
+	}
+	if c.Mode != "disabled" && c.Mode != "observe" && c.Mode != "enforce" {
+		return errors.New("invalid security mode")
+	}
+	for _, v := range []float64{c.RequestsPerSecond, c.IdentityPerSecond} {
+		if math.IsNaN(v) || math.IsInf(v, 0) || v <= 0 || v > 100000 {
+			return errors.New("rate must be finite and between 0 and 100000")
+		}
+	}
+	for _, v := range []int{c.Burst, c.IdentityBurst, c.MaxConcurrent, c.MaxWrites, c.MaxFiles, c.MaxRealtime, c.MaxSubscriptions, c.MaxSubscriptionsTotal, c.MaxIdentities} {
+		if v < 1 || v > 50000 {
+			return errors.New("security limits must be between 1 and 50000")
+		}
+	}
+	if len(c.TrustedPeers) > 64 || len(c.ManagementPeers) > 64 || len(c.OperatorPeers) > 64 {
+		return errors.New("too many trusted networks")
+	}
+	for _, v := range append(append(append([]string{}, c.TrustedPeers...), c.ManagementPeers...), c.OperatorPeers...) {
+		if _, err := netip.ParsePrefix(v); err != nil {
+			return errors.New("invalid trusted network")
+		}
+	}
+	return nil
+}
+func cloneConfig(c Config) Config {
+	c.OperatorPeers = append([]string{}, c.OperatorPeers...)
+	c.TrustedPeers = append([]string{}, c.TrustedPeers...)
+	c.ManagementPeers = append([]string{}, c.ManagementPeers...)
+	return c
+}
+func inNetworks(ip string, networks []string) bool {
+	a, err := netip.ParseAddr(ip)
+	if err != nil {
+		return false
+	}
+	a = a.Unmap()
+	for _, raw := range networks {
+		p, err := netip.ParsePrefix(raw)
+		if err == nil && p.Contains(a) {
+			return true
+		}
+	}
+	return false
+}

package/security/dashboard_test.go

@@ -0,0 +1,103 @@
+package security
+
+import (
+	"encoding/json"
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestNativeDashboardExtensionAndSnapshotAuthorization(t *testing.T) {
+	app, err := tests.NewTestApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer app.Cleanup()
+	if err := Register(app, DefaultConfig()); err != nil {
+		t.Fatal(err)
+	}
+	service := app.Store().Get("pb.security.service").(*Service)
+	defer service.Close()
+	r, err := apis.NewRouter(app)
+	if err != nil {
+		t.Fatal(err)
+	}
+	event := &core.ServeEvent{App: app, Router: r}
+	if err := app.OnServe().Trigger(event); err != nil {
+		t.Fatal(err)
+	}
+	if len(event.UIExtensions) != 1 || event.UIExtensions[0].Name != "security" {
+		t.Fatal("native extension missing")
+	}
+	h, err := r.BuildMux()
+	if err != nil {
+		t.Fatal(err)
+	}
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, httptest.NewRequest("GET", "/_/extensions.js", nil))
+	if w.Code != 200 || !strings.Contains(w.Body.String(), "superuserOnly('#/security'") {
+		t.Fatal("extension is not loadable")
+	}
+	w = httptest.NewRecorder()
+	h.ServeHTTP(w, httptest.NewRequest("GET", "/_security/", nil))
+	if w.Code != 307 || w.Header().Get("Location") != "/_/#/security" {
+		t.Fatal("legacy link not redirected")
+	}
+	admin, err := app.FindFirstRecordByData(core.CollectionNameSuperusers, "email", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	adminToken, _ := admin.NewAuthToken()
+	users, err := app.FindCollectionByNameOrId("users")
+	if err != nil {
+		t.Fatal(err)
+	}
+	user := core.NewRecord(users)
+	user.SetEmail("adapter@example.com")
+	user.SetPassword("fixture-password-123")
+	if err := app.Save(user); err != nil {
+		t.Fatal(err)
+	}
+	userToken, _ := user.NewAuthToken()
+	for _, tc := range []struct {
+		token, peer string
+		code        int
+	}{{"", "127.0.0.1:123", 401}, {userToken, "127.0.0.1:123", 403}, {adminToken, "192.0.2.1:123", 403}, {adminToken, "127.0.0.1:123", 200}} {
+		request := httptest.NewRequest("GET", "/api/security/policy/snapshot", nil)
+		request.Header.Set("Authorization", tc.token)
+		request.RemoteAddr = tc.peer
+		w := httptest.NewRecorder()
+		h.ServeHTTP(w, request)
+		if w.Code != tc.code {
+			t.Fatalf("snapshot returned %d want %d", w.Code, tc.code)
+		}
+		if w.Code == 200 {
+			var snapshot struct {
+				Revision uint64
+				Policy   Config
+			}
+			if json.Unmarshal(w.Body.Bytes(), &snapshot) != nil || snapshot.Revision != 1 || snapshot.Policy.Mode != "observe" {
+				t.Fatal("invalid snapshot")
+			}
+		}
+	}
+}
+func TestBoundedTrafficHistory(t *testing.T) {
+	s, err := New(DefaultConfig())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer s.Close()
+	now := time.Now()
+	for i := 0; i < 80; i++ {
+		s.observe("reads", true, 429, 0)
+		s.evaluate(now.Add(time.Duration(i) * 10 * time.Second))
+	}
+	if len(s.history) != 60 || s.history[59].Count != 1 || s.history[59].Rejected != 1 {
+		t.Fatal("invalid bounded traffic history")
+	}
+}

package/security/management.go

@@ -0,0 +1,169 @@
+package security
+
+import (
+	"maps"
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/router"
+)
+
+func (s *Service) bindManagement(r *router.Router[*core.RequestEvent]) {
+	g := r.Group("/api/security").Bind(apis.RequireSuperuserAuth()).BindFunc(func(e *core.RequestEvent) error {
+		s.mu.Lock()
+		allowed := inNetworks(e.RemoteIP(), s.config.ManagementPeers)
+		s.mu.Unlock()
+		if !allowed {
+			return e.ForbiddenError("Management network required", nil)
+		}
+		return e.Next()
+	})
+	g.GET("/status", func(e *core.RequestEvent) error {
+		s.mu.Lock()
+		result := map[string]any{"mode": s.config.Mode, "revision": s.revision, "identities": len(s.identities), "active": maps.Clone(s.active), "observed": s.total, "rejected": s.rejected, "subscriptions": s.totalSubscriptions, "storageDegraded": s.storageError, "detector": "heuristic-v1", "actions": currentActions(s.actions, time.Now()), "startedAt": s.startedAt, "lastEvaluated": s.lastEvaluated, "traffic": append([]TrafficWindow{}, s.history...), "checkpointEnabled": s.config.StatePath != ""}
+		s.mu.Unlock()
+		return e.JSON(http.StatusOK, result)
+	})
+	g.GET("/incidents", func(e *core.RequestEvent) error {
+		s.mu.Lock()
+		items := append([]Incident{}, s.incidents...)
+		s.mu.Unlock()
+		limit := 50
+		if raw := e.Request.URL.Query().Get("limit"); raw != "" {
+			n, err := strconv.Atoi(raw)
+			if err != nil || n < 1 || n > 100 {
+				return e.BadRequestError("Limit must be 1 to 100", nil)
+			}
+			limit = n
+		}
+		after := uint64(0)
+		if raw := e.Request.URL.Query().Get("after"); raw != "" {
+			var err error
+			after, err = strconv.ParseUint(raw, 10, 64)
+			if err != nil {
+				return e.BadRequestError("Invalid cursor", nil)
+			}
+		}
+		page := []Incident{}
+		next := uint64(0)
+		for _, item := range items {
+			if item.ID <= after {
+				continue
+			}
+			if len(page) == limit {
+				next = page[len(page)-1].ID
+				break
+			}
+			page = append(page, item)
+		}
+		return e.JSON(http.StatusOK, map[string]any{"items": page, "nextCursor": next})
+	})
+	g.GET("/policy/snapshot", func(e *core.RequestEvent) error {
+		s.mu.Lock()
+		result := struct {
+			Policy   Config `json:"policy"`
+			Revision uint64 `json:"revision"`
+		}{cloneConfig(s.config), s.revision}
+		s.mu.Unlock()
+		return e.JSON(200, result)
+	})
+	g.GET("/policy", func(e *core.RequestEvent) error {
+		s.mu.Lock()
+		c, revision := cloneConfig(s.config), s.revision
+		s.mu.Unlock()
+		e.Response.Header().Set("ETag", strconv.FormatUint(revision, 10))
+		return e.JSON(http.StatusOK, c)
+	})
+	g.PUT("/policy", func(e *core.RequestEvent) error {
+		c := Config{}
+		if err := e.BindBody(&c); err != nil {
+			return e.BadRequestError("Invalid policy", err)
+		}
+		if err := c.Validate(); err != nil {
+			return e.BadRequestError("Invalid policy", err)
+		}
+		s.mu.Lock()
+		if e.Request.Header.Get("If-Match") != strconv.FormatUint(s.revision, 10) {
+			s.mu.Unlock()
+			return router.NewApiError(409, "Policy revision conflict", nil)
+		}
+		if c.MaxIdentities < len(s.identities) {
+			s.mu.Unlock()
+			return e.BadRequestError("Cannot shrink below current identity count", nil)
+		}
+		c.OperatorPeers = s.config.OperatorPeers
+		c.StatePath = s.config.StatePath
+		s.config = cloneConfig(c)
+		s.revision++
+		revision := s.revision
+		s.mu.Unlock()
+		s.persist()
+		e.App.Logger().Info("Security policy updated", "revision", revision, "operator", e.Auth.Id)
+		return e.JSON(http.StatusOK, map[string]any{"revision": revision})
+	})
+	g.POST("/incidents/{id}/acknowledge", func(e *core.RequestEvent) error {
+		id, err := strconv.ParseUint(e.Request.PathValue("id"), 10, 64)
+		if err != nil {
+			return e.BadRequestError("Invalid incident", nil)
+		}
+		s.mu.Lock()
+		for i := range s.incidents {
+			if s.incidents[i].ID == id {
+				s.incidents[i].Acknowledged = true
+				s.mu.Unlock()
+				s.persist()
+				e.App.Logger().Info("Security incident acknowledged", "incident", id, "operator", e.Auth.Id)
+				return e.NoContent(204)
+			}
+		}
+		s.mu.Unlock()
+		return e.NotFoundError("Incident not found", nil)
+	})
+	g.POST("/actions", func(e *core.RequestEvent) error {
+		var a Action
+		if err := e.BindBody(&a); err != nil {
+			return e.BadRequestError("Invalid action", err)
+		}
+		switch a.Family {
+		case "auth", "reads", "writes", "files", "realtime", "other":
+		default:
+			return e.BadRequestError("Invalid action family", nil)
+		}
+		if len(a.Reason) < 1 || len(a.Reason) > 200 || !a.ExpiresAt.After(time.Now()) || a.ExpiresAt.After(time.Now().Add(15*time.Minute)) {
+			return e.BadRequestError("Reason and expiry within 15 minutes required", nil)
+		}
+		s.mu.Lock()
+		s.actions[a.Family] = a
+		s.mu.Unlock()
+		s.persist()
+		e.App.Logger().Info("Temporary security action set", "family", a.Family, "expiresAt", a.ExpiresAt, "operator", e.Auth.Id)
+		return e.JSON(http.StatusOK, a)
+	})
+	g.DELETE("/actions/{family}", func(e *core.RequestEvent) error {
+		family := e.Request.PathValue("family")
+		s.mu.Lock()
+		_, exists := s.actions[family]
+		delete(s.actions, family)
+		s.mu.Unlock()
+		if !exists {
+			return e.NotFoundError("Action not found", nil)
+		}
+		s.persist()
+		e.App.Logger().Info("Security action cancelled", "family", family, "operator", e.Auth.Id)
+		return e.NoContent(204)
+	})
+
+}
+
+func currentActions(actions map[string]Action, now time.Time) map[string]Action {
+	result := maps.Clone(actions)
+	for family, action := range result {
+		if !action.ExpiresAt.After(now) {
+			delete(result, family)
+		}
+	}
+	return result
+}