8dde1c2 · 79c7d63 · 85bd282
@@ -330,7 +330,15 @@
adds `FORGE_URL` (the canonical public base URL, needed for OAuth callbacks),
`FORGE_ORIGIN_ALLOW` (hosts an operator vouches for on a LAN). Behind a
platform edge that signs people in for every app it serves, `FORGE_EDGE_TOKEN`
is the edge's secret: a request carrying it and `X-Plat-User` is that person,
signed in by the platform, with an account made on first sight. Mail out
signed in by the platform, with an account made on first sight. Setting
`signin.edge` to `off` (Settings → Capacity → "Sign in through the platform
edge", boot default `FORGE_SIGNIN_EDGE`, also `/api/v1/admin/capacity` and the
MCP `capacity` tool) makes the forge ignore `X-Plat-User` even when the secret
matches; people then sign in with a password or a passkey. An admin with
neither is refused, so no one locks themselves out. Accounts the edge made
cannot sign in while it is off until they add a passkey (a password-less
account cannot set a password: `/settings/password` asks for the current one).
Mail out
(the link that proves a newcomer's email) is SMTP submission over TLS,
configured by the forge-level secrets `MAIL_SMTP_URL`
(`smtps://user:pass@host:465`) and `MAIL_FROM`, set live under Settings →
@@ -132,7 +132,7 @@
How each part proves itself to the next, today.
| runner → forge | the run's scoped token (`FORGE_TOKEN`) and a few-minute passport (`FORGE_PASSPORT`) | `test/passport-edge.test.ts` |
| git hook → forge | per-boot secret in `x-forge-hook-secret` on the internal listener; a call without it is refused and counted | none yet |
| cell → proxy | the proxy's Unix socket bound into the cell's own network namespace; no credential, the namespace is the identity | `test/contain.test.ts` |
| edge → pod | `X-Plat-Edge-Token` equal to `FORGE_EDGE_TOKEN`, compared as fixed-width digests; without it `X-Plat-User` is ignored | `test/edge-auth.test.ts` |
| edge → pod | `X-Plat-Edge-Token` equal to `FORGE_EDGE_TOKEN`, compared as fixed-width digests; without it `X-Plat-User` is ignored; the `signin.edge` setting (admin, refused for an admin with no password or passkey) turns the edge's identity off on every door | `test/edge-auth.test.ts` |
| child → parent | none at call time: `parent.json` names the parent's address and the child pulls over public git; the claim link (sha256 kept, 24 hours, single use) hands the child to its person | `test/spawn-first-boot.test.ts` |
Gaps: edge → pod and runner → forge ride a shared secret, not a per-call
@@ -21,6 +21,7 @@
import {
  type CapacityChange,
  type CapacityKey,
} from "../core/capacity.ts";
import { passkeyIds } from "../core/passkeys.ts";
import type { User } from "../core/users.ts";
import { err, ok, type Result } from "../kernel/result.ts";
@@ -61,6 +62,17 @@
export function listCapacity(
  });
}
/**
 * Whether the account can sign in without the platform edge: a password or
 * a passkey. Turning the edge off for an admin who has neither locks them out.
 */
function hasOwnCredential(app: App, userId: string): boolean {
  const row = app.db
    .query<{ password_hash: string }, [string]>("SELECT password_hash FROM user WHERE id = ?1")
    .get(userId);
  return (row?.password_hash ?? "") !== "" || passkeyIds(app.db, userId).length > 0;
}
/** Set `key` to `value`; `null` or `""` goes back to the boot default. */
export function changeCapacity(
  app: App,
@@ -69,7 +81,7 @@
export function changeCapacity(
  value: string | null,
): Result<
  { key: CapacityKey; from: string; to: string },
  "not_found" | "no_such_setting" | "invalid_value"
  "not_found" | "no_such_setting" | "invalid_value" | "no_credential"
> {
  const who = admin(actor);
  if (!who.ok) return who;
@@ -77,6 +89,8 @@
export function changeCapacity(
  const next = value === null ? null : value.trim();
  if (next !== null && next !== "" && !validCapacity(key, next))
    return err("invalid_value");
  if (key === "signin.edge" && next === "off" && !hasOwnCredential(app, who.value.id))
      
        sentinelcrew
        25d ago
        
      
      Minor: this only checks next === "off". If the boot default (FORGE_SIGNIN_EDGE) is off, clearing the value to "" gets the same result and skips the guard. You could check the value that will actually be in force after the change. Not blocking, since only an operator can set that env var.
    
    return err("no_credential");
  const changed = setCapacity(
    app.db,
    key,
@@ -21,7 +21,8 @@
export type CapacityKey =
  | "checks.shards"
  | "children.max"
  | "cells.egress"
  | "guard_new_accounts";
  | "guard_new_accounts"
  | "signin.edge";
interface Definition {
  /** What the settings page and the API call it. */
@@ -84,6 +85,13 @@
export const CAPACITY: Record<CapacityKey, Definition> = {
    fallback: "off",
    help: "on refuses repository creation and forks for accounts younger than 7 days (agents and admins are exempt); off leaves it to the usual permissions. Takes effect immediately. Replaces the hand-installed database trigger that used to do this with no toggle.",
  },
  "signin.edge": {
    label: "Sign in through the platform edge",
    env: "FORGE_SIGNIN_EDGE",
    kind: { type: "choice", values: ["on", "off"] },
    fallback: "on",
    help: "on reads the platform edge's identity headers (when the forge has an edge secret) and offers its sign-in; off ignores them on every door, so people sign in with the forge's own methods — password and passkey. Accounts the edge made keep their names but have no password until they set one. Takes effect on the next request.",
      
        sentinelcrew
        26d ago
        
      
      High: the help text says edge-made accounts "have no password until they set one", but nothing stops the admin who flips this from being one of them. They are signed out on the next request. The stored value then outranks FORGE_SIGNIN_EDGE, so a restart does not bring them back either. Guard the change in changeCapacity: refuse off when the actor has no password and no passkey, and test that refusal.
    
  },
};
export const CAPACITY_KEYS = Object.keys(CAPACITY) as CapacityKey[];
@@ -277,6 +285,11 @@
export function egressSetting(db: Database): "enforce" | "report" {
  return capacityValue(db, "cells.egress") === "report" ? "report" : "enforce";
}
/** Whether the platform edge's identity is read at all; on every request. */
export function edgeSigninOn(db: Database): boolean {
  return capacityValue(db, "signin.edge") !== "off";
}
/**
 * What a check's commands and a crew shell are told: the shard count in
 * force. An admin's value or the environment's is passed as it is; the
@@ -9,6 +9,17 @@
 */
import { createHash, timingSafeEqual } from "node:crypto";
import type { App } from "../app.ts";
import { edgeSigninOn } from "../core/capacity.ts";
/**
 * The edge secret in force: the configured one while the `signin.edge`
 * setting is on, nothing while it is off — so every door, the reading of
 * the headers and the buttons that lead to the edge, goes quiet together.
 */
export function activeEdgeToken(app: App): string | undefined {
      
        sentinelcrew
        26d ago
        
      
      Good: one choke point for every door. Two small asks. Mention this in docs/THREATS.md's edge → pod row. And if you add an env override for recovery, this is the place to apply it.
    
  return edgeSigninOn(app.db) ? app.config.edgeToken : undefined;
}
/** The account the edge vouches for on this request, if it does. */
export function edgeIdentity(
@@ -2566,13 +2566,13 @@
const TOOLS: readonly Tool[] = [
  {
    name: "capacity",
    description:
      "The forge's capacity and guards, live: crew runs at once (crew.concurrency), checks at once (checks.concurrency), test shards per check (checks.shards), whether a cell's undeclared egress is refused or reported (cells.egress), and whether new accounts may create repositories and forks (guard_new_accounts: on refuses accounts younger than 7 days, off is the default). Without `key`, each setting, its value and where it comes from, and the recent changes. With `key` and `value` (\"\" goes back to the boot default), the change it would make; with dryRun false, made, by a forge admin with an admin-scope token, never an agent. A change is honoured by the next run, check or cell, never by a restart. The same as Settings → Capacity and /api/v1/admin/capacity.",
      "The forge's capacity and guards, live: crew runs at once (crew.concurrency), checks at once (checks.concurrency), test shards per check (checks.shards), whether a cell's undeclared egress is refused or reported (cells.egress), and whether new accounts may create repositories and forks (guard_new_accounts: on refuses accounts younger than 7 days, off is the default), and whether the platform edge's sign-in is read (signin.edge: on is the default, off ignores the edge's identity on every door). Without `key`, each setting, its value and where it comes from, and the recent changes. With `key` and `value` (\"\" goes back to the boot default), the change it would make; with dryRun false, made, by a forge admin with an admin-scope token, never an agent. A change is honoured by the next run, check or cell, never by a restart. The same as Settings → Capacity and /api/v1/admin/capacity.",
    inputSchema: {
      type: "object",
      properties: {
        key: {
          type: "string",
          enum: ["crew.concurrency", "checks.concurrency", "checks.shards", "cells.egress", "guard_new_accounts"],
          enum: ["crew.concurrency", "checks.concurrency", "checks.shards", "cells.egress", "guard_new_accounts", "signin.edge"],
        },
        value: { type: "string", maxLength: 16 },
        dryRun: { type: "boolean", description: "Plan only (the default). Send false to change it." },
@@ -63,7 +63,7 @@
import {
  isActive,
  verifyPasswordThrottled,
} from "../core/users.ts";
import { edgeIdentity } from "./edge.ts";
import { activeEdgeToken, edgeIdentity } from "./edge.ts";
import { signupClosed } from "../actions/users.ts";
import { liveResponse, readyResponse } from "./health.ts";
import { running } from "../kernel/version.ts";
@@ -498,7 +498,7 @@
const NO_AUTH: Auth = { user: undefined, scope: undefined, via: "none" };
async function resolveAuth(app: App, request: Request): Promise<Auth> {
  // The platform edge, when there is one, has already signed this person
  // in; its word outranks a cookie of ours.
  const login = edgeIdentity(request, app.config.edgeToken);
  const login = edgeIdentity(request, activeEdgeToken(app));
  if (login !== undefined) {
    const existed = getUserByName(app.db, login) !== undefined;
    // Existing accounts sign in; a new one is made only while signup allows.
@@ -13,7 +13,7 @@
import { mayDirectCrew } from "../crew/direct.ts";
import { mayReadRuns } from "../actions/runs.ts";
import { getAppByRepo } from "../core/apps.ts";
import { audienceFacts, audienceOf } from "../core/audience.ts";
import { edgeLoginUrl } from "../http/edge.ts";
import { activeEdgeToken, edgeLoginUrl } from "../http/edge.ts";
import {
  canAdmin,
  canRead,
@@ -94,7 +94,7 @@
export function signInHref(ctx: Ctx): string {
  const next = ctx.url.pathname + ctx.url.search;
  // Behind a platform edge the edge is how people sign in; an account it
  // made has no password here, so the password form would only refuse them.
  if (ctx.app.config.edgeToken !== undefined) return edgeLoginUrl(next);
  if (activeEdgeToken(ctx.app) !== undefined) return edgeLoginUrl(next);
  return `/signin?next=${encodeURIComponent(next)}`;
}
@@ -13,7 +13,7 @@
import { appsForRepos } from "../core/apps.ts";
import { listReposVisibleTo } from "../core/repos.ts";
import type { User } from "../core/users.ts";
import type { Ctx } from "../http/context.ts";
import { edgeLoginUrl, edgeLogoutUrl } from "../http/edge.ts";
import { activeEdgeToken, edgeLoginUrl, edgeLogoutUrl } from "../http/edge.ts";
import { json } from "../http/respond.ts";
import { sha256 } from "../kernel/hash.ts";
import { secret } from "../kernel/id.ts";
@@ -485,7 +485,7 @@
function topbar(
              )}`
          : btn("Sign in", {
              href:
                ctx.app.config.edgeToken === undefined
                activeEdgeToken(ctx.app) === undefined
                  ? "/signin"
                  : edgeLoginUrl(ctx.url.pathname + ctx.url.search),
            })}
@@ -184,6 +184,8 @@
export function capacityPage(ctx: Ctx): Response {
const ERRORS: Record<string, string> = {
  no_such_setting: "There is no such setting.",
  invalid_value: "That value is outside what this setting takes.",
  no_credential:
    "Add a passkey (or a password) to your own account first: with the edge off, you would be signed out for good.",
};
// POST /settings/capacity
@@ -25,7 +25,7 @@
import { isThemeName } from "../../design/themes.ts";
import { cookieValue, crossOrigin, type Ctx } from "../../http/context.ts";
import { studioDoor, studioHome } from "../studio/home.ts";
import { homeTop } from "../studio/asks_page.ts";
import { edgeLoginUrl } from "../../http/edge.ts";
import { activeEdgeToken, edgeLoginUrl } from "../../http/edge.ts";
import { sshCommand } from "../../ssh/command.ts";
import { hostOf, pageHead, signInFirst } from "../chrome.ts";
import { SignupSlot, signupWindow } from "../../actions/signup-window.ts";
@@ -248,7 +248,7 @@
function authForm(
  // password form kept for the accounts that have one — an account the edge
  // made has none, and the note says so before anyone types.
  const edge =
    ctx.app.config.edgeToken === undefined
    activeEdgeToken(ctx.app) === undefined
      ? undefined
      : (ctx.app.config.edgeName ?? "the platform");
  const throughEdge = when(
@@ -503,7 +503,7 @@
export async function signinSubmit(ctx: Ctx): Promise<Response> {
          values: { username },
          errors: {
            password:
              ctx.app.config.edgeToken === undefined
              activeEdgeToken(ctx.app) === undefined
                ? "That username and password don't match."
                : `That username and password don't match. An account made through ${ctx.app.config.edgeName ?? "the platform"} has no password here — use the button above.`,
          },
@@ -22,7 +22,7 @@
import { LOOK_SIZES } from "../../core/looks.ts";
import { canRead, getRepo, type Repo } from "../../core/repos.ts";
import { type User } from "../../core/users.ts";
import type { Ctx } from "../../http/context.ts";
import { edgeLoginUrl } from "../../http/edge.ts";
import { activeEdgeToken, edgeLoginUrl } from "../../http/edge.ts";
import { sshCommand } from "../../ssh/command.ts";
import { repoBase, signInFirst } from "../chrome.ts";
import { field, readForm, type Form } from "../form.ts";
@@ -488,7 +488,7 @@
export function studioDoor(ctx: Ctx): Response {
      <div class="bar">
        ${ctx.auth.user !== undefined
          ? null
          : ctx.app.config.edgeToken === undefined
          : activeEdgeToken(ctx.app) === undefined
            ? html`${btn("Create an account", {
                href: `/signup${nextQuery}`,
                variant: "primary",
@@ -0,0 +1,96 @@
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { changeCapacity } from "../src/actions/capacity.ts";
import { capacityChanges, capacityValue } from "../src/core/capacity.ts";
import { serve, type Servers } from "../src/http/server.ts";
import type { User } from "../src/core/users.ts";
import { seedAdmin } from "./helpers/admin.ts";
const TOKEN = "edge-secret-0123456789";
describe("signin.edge", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let olive: User;
  const asAda = { "x-plat-user": "ada", "x-plat-edge-token": TOKEN };
  const asOlive = { "x-plat-user": "olive", "x-plat-edge-token": TOKEN };
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-signin-edge-"));
    app = createApp({ dataDir, port: 0, url: "https://forge.example", edgeToken: TOKEN });
    servers = await serve(app);
    base = servers.url;
    const made = await seedAdmin(app, {
      username: "olive",
      email: "[email protected]",
      password: "correct horse battery",
    });
    if (!made.ok) throw new Error(made.error);
    olive = made.value;
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  const who = (headers: Record<string, string>) =>
    fetch(`${base}/api/v1/user`, { headers });
  test("on by default; the edge makes an account and signs it in", async () => {
    expect(capacityValue(app.db, "signin.edge")).toBe("on");
    expect((await who(asAda)).status).toBe(200);
    const page = await fetch(`${base}/`).then((r) => r.text());
    expect(page).toContain("/_plat/login");
  });
  test("an admin with no password or passkey cannot turn it off", () => {
    const ada = app.db.query<{ id: string }, []>("SELECT id FROM user WHERE username = 'ada'").get();
    if (ada === null) throw new Error("ada was not made");
    const edgeAdmin: User = { ...olive, id: ada.id, username: "ada" };
    const refused = changeCapacity(app, edgeAdmin, "signin.edge", "off");
    expect(refused).toEqual({ ok: false, error: "no_credential" });
    expect(capacityValue(app.db, "signin.edge")).toBe("on");
    expect(changeCapacity(app, edgeAdmin, "signin.edge", "on").ok).toBe(true);
  });
  test("off: the edge's identity is ignored, even for an account it made", async () => {
    const changed = changeCapacity(app, olive, "signin.edge", "off");
    expect(changed.ok).toBe(true);
    expect(capacityChanges(app.db, 1)[0]).toMatchObject({ key: "signin.edge", from: "on", to: "off" });
    expect((await who(asAda)).status).toBe(401);
    expect((await who(asOlive)).status).toBe(401);
    const page = await fetch(`${base}/`, { headers: asAda }).then((r) => r.text());
    expect(page).not.toContain("Sign out");
    expect(page).not.toContain("/_plat/login");
    expect(page).toContain('href="/signin"');
    const gate = await fetch(`${base}/new`, { redirect: "manual", headers: asAda });
    expect(gate.headers.get("location") ?? "").not.toContain("/_plat/");
  });
  test("off: password and passkey sign-in still work", async () => {
    const token = await fetch(`${base}/api/v1/tokens`, {
      method: "POST",
      body: JSON.stringify({ adminConfirm: true, username: "olive", password: "correct horse battery", name: "t", scope: "rw" }),
    });
    expect(token.status).toBe(201);
    const options = await fetch(`${base}/signin/passkey/options`, {
      method: "POST",
      headers: { origin: "https://forge.example", "content-type": "application/json" },
      body: "{}",
    });
    expect(options.status).toBe(200);
  });
  test("back on: the edge is read again", async () => {
    expect(changeCapacity(app, olive, "signin.edge", "on").ok).toBe(true);
    expect((await who(asAda)).status).toBe(200);
  });
});
		@@ -330,7 +330,15 @@ adds `FORGE_URL` (the canonical public base URL, needed for OAuth callbacks),
330	330	`FORGE_ORIGIN_ALLOW` (hosts an operator vouches for on a LAN). Behind a
331	331	platform edge that signs people in for every app it serves, `FORGE_EDGE_TOKEN`
332	332	is the edge's secret: a request carrying it and `X-Plat-User` is that person,
333		signed in by the platform, with an account made on first sight. Mail out
	333	signed in by the platform, with an account made on first sight. Setting
	334	`signin.edge` to `off` (Settings → Capacity → "Sign in through the platform
	335	edge", boot default `FORGE_SIGNIN_EDGE`, also `/api/v1/admin/capacity` and the
	336	MCP `capacity` tool) makes the forge ignore `X-Plat-User` even when the secret
	337	matches; people then sign in with a password or a passkey. An admin with
	338	neither is refused, so no one locks themselves out. Accounts the edge made
	339	cannot sign in while it is off until they add a passkey (a password-less
	340	account cannot set a password: `/settings/password` asks for the current one).
	341	Mail out
334	342	(the link that proves a newcomer's email) is SMTP submission over TLS,
335	343	configured by the forge-level secrets `MAIL_SMTP_URL`
336	344	(`smtps://user:pass@host:465`) and `MAIL_FROM`, set live under Settings →
		@@ -132,7 +132,7 @@ How each part proves itself to the next, today.
132	132	\| runner → forge \| the run's scoped token (`FORGE_TOKEN`) and a few-minute passport (`FORGE_PASSPORT`) \| `test/passport-edge.test.ts` \|
133	133	\| git hook → forge \| per-boot secret in `x-forge-hook-secret` on the internal listener; a call without it is refused and counted \| none yet \|
134	134	\| cell → proxy \| the proxy's Unix socket bound into the cell's own network namespace; no credential, the namespace is the identity \| `test/contain.test.ts` \|
135		\| edge → pod \| `X-Plat-Edge-Token` equal to `FORGE_EDGE_TOKEN`, compared as fixed-width digests; without it `X-Plat-User` is ignored \| `test/edge-auth.test.ts` \|
	135	\| edge → pod \| `X-Plat-Edge-Token` equal to `FORGE_EDGE_TOKEN`, compared as fixed-width digests; without it `X-Plat-User` is ignored; the `signin.edge` setting (admin, refused for an admin with no password or passkey) turns the edge's identity off on every door \| `test/edge-auth.test.ts` \|
136	136	\| child → parent \| none at call time: `parent.json` names the parent's address and the child pulls over public git; the claim link (sha256 kept, 24 hours, single use) hands the child to its person \| `test/spawn-first-boot.test.ts` \|
137	137
138	138	Gaps: edge → pod and runner → forge ride a shared secret, not a per-call
		@@ -21,6 +21,7 @@ import {
21	21	type CapacityChange,
22	22	type CapacityKey,
23	23	} from "../core/capacity.ts";
	24	import { passkeyIds } from "../core/passkeys.ts";
24	25	import type { User } from "../core/users.ts";
25	26	import { err, ok, type Result } from "../kernel/result.ts";
26	27
		@@ -61,6 +62,17 @@ export function listCapacity(
61	62	});
62	63	}
63	64
	65	/**
	66	* Whether the account can sign in without the platform edge: a password or
	67	* a passkey. Turning the edge off for an admin who has neither locks them out.
	68	*/
	69	function hasOwnCredential(app: App, userId: string): boolean {
	70	const row = app.db
	71	.query<{ password_hash: string }, [string]>("SELECT password_hash FROM user WHERE id = ?1")
	72	.get(userId);
	73	return (row?.password_hash ?? "") !== "" \|\| passkeyIds(app.db, userId).length > 0;
	74	}
	75
64	76	/** Set `key` to `value`; `null` or `""` goes back to the boot default. */
65	77	export function changeCapacity(
66	78	app: App,
		@@ -69,7 +81,7 @@ export function changeCapacity(
69	81	value: string \| null,
70	82	): Result<
71	83	{ key: CapacityKey; from: string; to: string },
72		"not_found" \| "no_such_setting" \| "invalid_value"
	84	"not_found" \| "no_such_setting" \| "invalid_value" \| "no_credential"
73	85	> {
74	86	const who = admin(actor);
75	87	if (!who.ok) return who;
		@@ -77,6 +89,8 @@ export function changeCapacity(
77	89	const next = value === null ? null : value.trim();
78	90	if (next !== null && next !== "" && !validCapacity(key, next))
79	91	return err("invalid_value");
	92	if (key === "signin.edge" && next === "off" && !hasOwnCredential(app, who.value.id))
		sentinelcrew 25d ago Minor: this only checks `next === "off"`. If the boot default (`FORGE_SIGNIN_EDGE`) is `off`, clearing the value to `""` gets the same result and skips the guard. You could check the value that will actually be in force after the change. Not blocking, since only an operator can set that env var.
	93	return err("no_credential");
80	94	const changed = setCapacity(
81	95	app.db,
82	96	key,
		@@ -21,7 +21,8 @@ export type CapacityKey =
21	21	\| "checks.shards"
22	22	\| "children.max"
23	23	\| "cells.egress"
24		\| "guard_new_accounts";
	24	\| "guard_new_accounts"
	25	\| "signin.edge";
25	26
26	27	interface Definition {
27	28	/** What the settings page and the API call it. */
		@@ -84,6 +85,13 @@ export const CAPACITY: Record<CapacityKey, Definition> = {
84	85	fallback: "off",
85	86	help: "on refuses repository creation and forks for accounts younger than 7 days (agents and admins are exempt); off leaves it to the usual permissions. Takes effect immediately. Replaces the hand-installed database trigger that used to do this with no toggle.",
86	87	},
	88	"signin.edge": {
	89	label: "Sign in through the platform edge",
	90	env: "FORGE_SIGNIN_EDGE",
	91	kind: { type: "choice", values: ["on", "off"] },
	92	fallback: "on",
	93	help: "on reads the platform edge's identity headers (when the forge has an edge secret) and offers its sign-in; off ignores them on every door, so people sign in with the forge's own methods — password and passkey. Accounts the edge made keep their names but have no password until they set one. Takes effect on the next request.",
		sentinelcrew 26d ago High: the help text says edge-made accounts "have no password until they set one", but nothing stops the admin who flips this from being one of them. They are signed out on the next request. The stored value then outranks `FORGE_SIGNIN_EDGE`, so a restart does not bring them back either. Guard the change in `changeCapacity`: refuse `off` when the actor has no password and no passkey, and test that refusal.
	94	},
87	95	};
88	96
89	97	export const CAPACITY_KEYS = Object.keys(CAPACITY) as CapacityKey[];
		@@ -277,6 +285,11 @@ export function egressSetting(db: Database): "enforce" \| "report" {
277	285	return capacityValue(db, "cells.egress") === "report" ? "report" : "enforce";
278	286	}
279	287
	288	/** Whether the platform edge's identity is read at all; on every request. */
	289	export function edgeSigninOn(db: Database): boolean {
	290	return capacityValue(db, "signin.edge") !== "off";
	291	}
	292
280	293	/**
281	294	* What a check's commands and a crew shell are told: the shard count in
282	295	* force. An admin's value or the environment's is passed as it is; the
		@@ -9,6 +9,17 @@
9	9	*/
10	10
11	11	import { createHash, timingSafeEqual } from "node:crypto";
	12	import type { App } from "../app.ts";
	13	import { edgeSigninOn } from "../core/capacity.ts";
	14
	15	/**
	16	* The edge secret in force: the configured one while the `signin.edge`
	17	* setting is on, nothing while it is off — so every door, the reading of
	18	* the headers and the buttons that lead to the edge, goes quiet together.
	19	*/
	20	export function activeEdgeToken(app: App): string \| undefined {
		sentinelcrew 26d ago Good: one choke point for every door. Two small asks. Mention this in docs/THREATS.md's edge → pod row. And if you add an env override for recovery, this is the place to apply it.
	21	return edgeSigninOn(app.db) ? app.config.edgeToken : undefined;
	22	}
12	23
13	24	/** The account the edge vouches for on this request, if it does. */
14	25	export function edgeIdentity(
		@@ -2566,13 +2566,13 @@ const TOOLS: readonly Tool[] = [
2566	2566	{
2567	2567	name: "capacity",
2568	2568	description:
2569		"The forge's capacity and guards, live: crew runs at once (crew.concurrency), checks at once (checks.concurrency), test shards per check (checks.shards), whether a cell's undeclared egress is refused or reported (cells.egress), and whether new accounts may create repositories and forks (guard_new_accounts: on refuses accounts younger than 7 days, off is the default). Without `key`, each setting, its value and where it comes from, and the recent changes. With `key` and `value` (\"\" goes back to the boot default), the change it would make; with dryRun false, made, by a forge admin with an admin-scope token, never an agent. A change is honoured by the next run, check or cell, never by a restart. The same as Settings → Capacity and /api/v1/admin/capacity.",
	2569	"The forge's capacity and guards, live: crew runs at once (crew.concurrency), checks at once (checks.concurrency), test shards per check (checks.shards), whether a cell's undeclared egress is refused or reported (cells.egress), and whether new accounts may create repositories and forks (guard_new_accounts: on refuses accounts younger than 7 days, off is the default), and whether the platform edge's sign-in is read (signin.edge: on is the default, off ignores the edge's identity on every door). Without `key`, each setting, its value and where it comes from, and the recent changes. With `key` and `value` (\"\" goes back to the boot default), the change it would make; with dryRun false, made, by a forge admin with an admin-scope token, never an agent. A change is honoured by the next run, check or cell, never by a restart. The same as Settings → Capacity and /api/v1/admin/capacity.",
2570	2570	inputSchema: {
2571	2571	type: "object",
2572	2572	properties: {
2573	2573	key: {
2574	2574	type: "string",
2575		enum: ["crew.concurrency", "checks.concurrency", "checks.shards", "cells.egress", "guard_new_accounts"],
	2575	enum: ["crew.concurrency", "checks.concurrency", "checks.shards", "cells.egress", "guard_new_accounts", "signin.edge"],
2576	2576	},
2577	2577	value: { type: "string", maxLength: 16 },
2578	2578	dryRun: { type: "boolean", description: "Plan only (the default). Send false to change it." },
		@@ -63,7 +63,7 @@ import {
63	63	isActive,
64	64	verifyPasswordThrottled,
65	65	} from "../core/users.ts";
66		import { edgeIdentity } from "./edge.ts";
	66	import { activeEdgeToken, edgeIdentity } from "./edge.ts";
67	67	import { signupClosed } from "../actions/users.ts";
68	68	import { liveResponse, readyResponse } from "./health.ts";
69	69	import { running } from "../kernel/version.ts";
		@@ -498,7 +498,7 @@ const NO_AUTH: Auth = { user: undefined, scope: undefined, via: "none" };
498	498	async function resolveAuth(app: App, request: Request): Promise<Auth> {
499	499	// The platform edge, when there is one, has already signed this person
500	500	// in; its word outranks a cookie of ours.
501		const login = edgeIdentity(request, app.config.edgeToken);
	501	const login = edgeIdentity(request, activeEdgeToken(app));
502	502	if (login !== undefined) {
503	503	const existed = getUserByName(app.db, login) !== undefined;
504	504	// Existing accounts sign in; a new one is made only while signup allows.
		@@ -13,7 +13,7 @@ import { mayDirectCrew } from "../crew/direct.ts";
13	13	import { mayReadRuns } from "../actions/runs.ts";
14	14	import { getAppByRepo } from "../core/apps.ts";
15	15	import { audienceFacts, audienceOf } from "../core/audience.ts";
16		import { edgeLoginUrl } from "../http/edge.ts";
	16	import { activeEdgeToken, edgeLoginUrl } from "../http/edge.ts";
17	17	import {
18	18	canAdmin,
19	19	canRead,
		@@ -94,7 +94,7 @@ export function signInHref(ctx: Ctx): string {
94	94	const next = ctx.url.pathname + ctx.url.search;
95	95	// Behind a platform edge the edge is how people sign in; an account it
96	96	// made has no password here, so the password form would only refuse them.
97		if (ctx.app.config.edgeToken !== undefined) return edgeLoginUrl(next);
	97	if (activeEdgeToken(ctx.app) !== undefined) return edgeLoginUrl(next);
98	98	return `/signin?next=${encodeURIComponent(next)}`;
99	99	}
100	100
		@@ -13,7 +13,7 @@ import { appsForRepos } from "../core/apps.ts";
13	13	import { listReposVisibleTo } from "../core/repos.ts";
14	14	import type { User } from "../core/users.ts";
15	15	import type { Ctx } from "../http/context.ts";
16		import { edgeLoginUrl, edgeLogoutUrl } from "../http/edge.ts";
	16	import { activeEdgeToken, edgeLoginUrl, edgeLogoutUrl } from "../http/edge.ts";
17	17	import { json } from "../http/respond.ts";
18	18	import { sha256 } from "../kernel/hash.ts";
19	19	import { secret } from "../kernel/id.ts";
		@@ -485,7 +485,7 @@ function topbar(
485	485	)}`
486	486	: btn("Sign in", {
487	487	href:
488		ctx.app.config.edgeToken === undefined
	488	activeEdgeToken(ctx.app) === undefined
489	489	? "/signin"
490	490	: edgeLoginUrl(ctx.url.pathname + ctx.url.search),
491	491	})}
		@@ -184,6 +184,8 @@ export function capacityPage(ctx: Ctx): Response {
184	184	const ERRORS: Record<string, string> = {
185	185	no_such_setting: "There is no such setting.",
186	186	invalid_value: "That value is outside what this setting takes.",
	187	no_credential:
	188	"Add a passkey (or a password) to your own account first: with the edge off, you would be signed out for good.",
187	189	};
188	190
189	191	// POST /settings/capacity