[ahma]

Summary

A seed user's configured password now follows the account the seed entry created, never a later account that reuses
its username; the sign-in cooldown counts an attempt from the start of its password check, so a concurrent burst
gets no more guesses checked than sequential attempts; the current-password check of /password runs behind the
same cooldown; and revocations can be kept in a file, so a restart still refuses a revoked token.

Why

Findings of the security review of this fix stack (#35 to #39) at 8f37696:

• With users.updateSeedPasswords, the start-time seed pass matched accounts by username only (medium, pre-existing
  on main). After an admin deleted a seed account and the same username was registered by someone else, the next
  start put the seed password on the new account and the owner's own password stopped working. Seed entries are now
  bound to their account by ID and username together.
• The cooldown was checked before the password and counted after it (low). A concurrent burst of wrong passwords
  for one username got 8 to 20 of 20 checked against 5 sequentially, and a right password inside the burst signed
  in. An attempt is now reserved under the limiter's lock before the check.
• POST /password verified the current password with no cooldown and no log (low). A holder of a stolen session
  could guess the password at the hashing gate's pace, even while the account was in sign-in cooldown, and a hit
  replaced the password. The check now runs behind the same cooldown, keyed by the account's username.
• Revocations lived only in memory while the signing key is persisted (low). After a restart, /oidc/userinfo
  accepted a revoked access token again until its exp. With revocations.filePath set they are written at every
  revocation and reloaded at start; without it the server warns at start and the README says what a restart does.

What changed

• fix(user): bind a seed entry's password to its account by ID.
• fix(throttle): reserve a sign-in attempt before its password check.
• fix(routes): put the /password current-password check behind cooldown.
• fix(tokenstore): keep revocations across a restart with a file.
• docs: describe seed IDs, burst cooldown and kept revocations.
• fix(tokenstore): refuse a null or unbounded revocations file (16 MiB bound at load; null root or null timestamps fail the start).
• fix(tokenstore): never write a revocations file the next start refuses (the writer applies the same bound, keeps the previous file and logs).
• test(tokenstore), test(routes), test(user): write-failure seams and overlapping writers; burst tests count derivations, not admissions, on /login, the /oidc/auth form and /password; seed identity rows.
• docs(user), docs(throttle), style: the seed migration must verify the original principal; the limiter's capacity exception stated as is; why-only comments.
• docs(readme): the seed example shows a default-parameter argon2id hash with an ID, and the timing paragraph names the seed exception: under updateSeedPasswords a new password is undone at the next start, so the configured hash itself must be default argon2id.

Test plan

• just verify, just test-race, just test-e2e (25 tests, Linux container) green on 186d2e5; the last commit is documentation only.
• New tests, each shown failing before its fix: TestSeedPasswordFollowsTheAccountNotTheName,
  TestSeedPasswordsRequireAnID, TestLimiterBurst, TestLimiterSucceedWithAttemptsInFlight,
  TestLimiterEvictionKeepsAttemptsInFlight, TestLogin_CooldownBurst,
  TestLogin_CooldownBurstRefusesTheRightPassword, TestLogin_BusyIsNotAFailure, TestChangePassword_Cooldown,
  TestOpenKeepsRevocationsAcrossARestart, TestOpenDropsRevocationsOlderThanTheTokenLifetime,
  TestOpenRefusesWhatItCannotUse, TestRevokeKeepsARevocationItCannotWrite, TestRevocationSurvivesARestart,
  TestRevokeKeepsTheOldFileWhenAWriteFails, TestRevokeOnlyWarnsWhenTheDirectoryCannotBeSynced,
  TestOverlappingWritesKeepEveryRevocation, TestOidcRevoke_WriteFails, TestCooldownBurst_EveryDoor,
  TestSeedPasswordNeedsTheIDAndTheName, and the at-bound writer tests.
• Mutations checked, each killed by the new tests: seed match by username again; no in-flight reservation in Begin; a
  wrong current password not counted at /password; revocations not reloaded at start; Succeed dropping an entry with
  attempts in flight (run against the final head by the reviewer); the password check moved before the reservation;
  os.WriteFile in place of the atomic write; the write lock removed; the writer's bound removed (run and recorded by
  the author while adding the corresponding tests).

Compatibility

• With users.updateSeedPasswords: true, every entry of users.users needs an ID; the server refuses to start
  otherwise. Before upgrading, copy each seed user's "ID" from users.filePath into its seed entry (README,
  "Seeding the user database").
• New optional revocations.filePath. Without it, behaviour is as before and the start logs a warning; the chart
  should set it on the persistent volume in a follow-up.
• /password answers 429 Too Many Requests with Retry-After while the account's username is in cooldown.

Residuals carried on purpose

• When every tracked limiter key has an attempt in flight (10 000 keys), a new key is admitted untracked; in-flight
  entries are never evicted or dropped. Documented in the README.
• A directory-sync failure after the rename is logged as a warning, not an error: the file is replaced, its durability
  across a crash in that instant is not guaranteed.
• The revocations file belongs to one process; it is not a shared store between replicas.

Not in this PR

• The timing difference between bcrypt or non-default argon2id accounts and the default stays in the code (documented residual); this PR corrects the README's advice for seed accounts and its example hash.
• The email_verified claim, the publish credential scope and limits on self-registration (deployment decisions).

Stacked on #39 (fix/http-and-login-hardening-on-chain). Draft until the stack is merged.

[Copilot]

🟡 Changes recommended

The throttle test returns without draining five pending requests, allowing password checks and logging to spill into subsequent tests and potentially race with replacement of the package-wide KDF gate.

1 open issue

• Drain wrong requests before returning from test · New

What changed in this PR

This PR strengthens the identity provider’s seed-account handling, password-guess throttling, and token revocation persistence, building on the earlier HTTP and sign-in hardening.

Changes:

• Bind seed password updates to both account ID and username, with migration guidance.
• Reserve password-check attempts before verification and share the cooldown with /password.
• Add optional file-backed revocations with bounded loading, atomic writes, and regression tests.

File	Description
README.md	Documents configuration, migration steps, and security limits.
pkg/​user/​user.go	Enforces seed identity matching and exposes a password-error sentinel.
pkg/​user/​setpassword_test.go	Checks the password-error sentinel.
pkg/​user/​seed_test.go	Tests seed identity matching and required IDs.
pkg/​user/​persist_test.go	Adds stable IDs to seed persistence fixtures.
main.go	Validates seed IDs and configures revocation persistence.
main_test.go	Tests revocations across restarts and seed configuration validation.
internal/​tokenstore/​tokenstore.go	Adds bounded file loading and atomic revocation persistence.
internal/​tokenstore/​tokenstore_test.go	Tests persistence, write failures, size limits, and concurrent writes.
internal/​throttle/​throttle.go	Reserves attempts and preserves entries with checks in progress.
internal/​throttle/​throttle_test.go	Tests burst limits, success handling, and eviction.
internal/​routes/​throttle.go	Updates cooldown logging and centralizes retry headers.
internal/​routes/​throttle_test.go	Tests shared cooldowns, concurrent bursts, and busy refusals.
internal/​routes/​routes.go	Adds password-check hooks for concurrency tests.
internal/​routes/​root.go	Reserves login attempts before password verification.
internal/​routes/​password.go	Applies the shared cooldown to current-password checks.
internal/​routes/​oidc_test.go	Tests revocation behavior when persistence fails.
CLAUDE.md	Updates contributor documentation for the security changes.

_{Review effort: Balanced}