dsh-auth-gate

LIMITATIONS

Known limitations

The short list; the full version, including the mechanisms and the ADRs behind them, is in `docs/deployed/known-limitations.md`. - Disabling a user only stops **new** logins; sessions already issued are revoked by the periodic sweep (`revokeSweepMs`, 5 s by default - with `0` they stay valid until they expire). - Login rate limiting and the TOTP replay guard reset when the server restarts. - Behind a reverse proxy, set `clientIpHeader` (and `trustedProxyCidrs`): otherwise all clients share one lockout bucket, and login plus the self-service change each have their own, so both are affected. - A password change reports success even if revoking the old sessions fails; the failure is logged at error level and the old cookie stays valid until its session TTL. - The `Origin` check covers the two authenticated state-changing POSTs only: `POST /auth/login` keeps `SameSite=Lax` as its only cross-site defence, and a reset whose session revocation fails still answers `200` with `sessionsRevoked:false` (plus an error log), so a stale cookie can survive until the session TTL expires. - A reset never touches the target's TOTP secret, and resetting a disabled account does not let it sign in (the login path rejects disabled users), so run `dsh-auth user enable <name>` first. - An administrator without TOTP makes the admin endpoints single-factor; enable TOTP for administrators in production. - The first-run wizard is a one-time window: its bootstrap session lasts at most one hour, can only reach `/auth/*`, and closes as soon as a token or a user exists. Removing that token (or the last user) and restarting dsh opens it again. - The wizard assumes a single dsh process, because each process mints its own launch token; behind several replicas without sticky routing the request can land on a process that does not know the token and falls back to the login page. A credentials service that caches values may need a restart before the token saved in the wizard becomes the only credential, and dsh versions without `connection.authenticatedUrl` have no wizard at all. - The plugin protects dsh's web surface only. Keep the OS user and the config files private.