From f7270b4dce7186520d8b839f6e784a976d08b871 Mon Sep 17 00:00:00 2001 From: KodeStar Date: Thu, 15 Oct 2026 16:06:24 +0100 Subject: [PATCH] Bridge: a 401 stops the Bridge, it doesn't make it forget its token The Bridge keeps a refused token and retries it every 5 minutes; the CLAUDE.md bullet and a test comment still said it forgets it. --- CLAUDE.md | 2 +- internal/api/bridge_test.go | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index d4dc9a7c..cb3e91a3 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -1558,7 +1558,7 @@ future metadata site can attach enrichment without reshaping the schema. The and forgets the row (`UnpairBridge`). **The bridge token is narrow**: routes opt in to token kinds and only the Bridge's own list `auth.KindBridge` (`requireBridge` = `authenticate` with `bridgeKinds`, `/api/v1/bridge/*`, Authorization header only, never `?token=`; only a missing or refused token is a 401, - which makes the Bridge forget its token, so a failure to check one is a 503); `resolve` refuses it once its admin is + which stops the Bridge calling in until its 5-minute retry, so a failure to check one is a 503); `resolve` refuses it once its admin is demoted (lookupToken already refuses a disabled one); it is never a device, and never touched (its calls are not its admin's activity, the newest `last_seen` of their tokens). "Paired" has ONE statement, `auth.BridgeLiveSQL` (a live bridge token of an enabled admin, partial index `idx_tokens_bridge`), which diff --git a/internal/api/bridge_test.go b/internal/api/bridge_test.go index 991021b6..feaeb6e9 100644 --- a/internal/api/bridge_test.go +++ b/internal/api/bridge_test.go @@ -672,8 +672,8 @@ func TestServerInfoWithoutBridge(t *testing.T) { } } -// Security-critical: the Bridge forgets its token at the first 401, so only a -// refused token is one; a token the server can't check (its database failing) +// Security-critical: a 401 stops the Bridge calling in (it retries every few +// minutes), so only a refused token is one; a token the server can't check (its database failing) // is a 503 the Bridge retries. func TestBridgeTokenCheckFailureIsNotUnauthorized(t *testing.T) { t.Parallel()