[sembrestels]

Summary

The setup wizard currently allows unauthenticated callers to read saved provider keys and overwrite configuration. The API and deriver source that configuration as shell code, so unrestricted writes also create an injection path.

Require a wizard password chosen through Dappnode's installation form or package Config. Users unlock the existing internal wizard URL with that password; SSH credential retrieval is not required.

Changes

• Add a required, masked HONCHO_WIZARD_PASSWORD setup field supplied only to setup-wizard. Missing or invalid passwords fail startup with Config instructions; there is no default password or first-visitor registration.
• Exchange the password for random eight-hour sessions held only in tab memory. Lock requests session revocation; restart invalidates all sessions. Limit login attempts to ten per minute per wizard and retain at most 32 sessions. Remove the token-file bootstrap and auth volume.
• Authenticate configuration, health and discovery routes. Enforce exact host/origin checks, remove wildcard CORS and stop publishing wizard port 8080. Probe the Honcho-specific API hostname to avoid the shared Docker api alias.
• Return only public configuration and secret-presence flags. Preserve omitted/blank/masked keys; require explicit replacement or clearing when changing endpoints.
• Bound JSON to 16 KiB, validate fields/model/URLs, write shell-safe env literals and escaped TOML, and render provider response strings as text.
• Use Node 22.23.4 and CA packages >=20261020. Correct the malformed manifest author value and document setup, upgrades and password recovery.

Upgrade and recovery

For existing installations, set HONCHO_WIZARD_PASSWORD for setup-wizard in Honcho's Config and restart that service. Change or recover the password through the same Dappnode UI. Provider keys are preserved. Earlier development-build SSH tokens are no longer accepted.

Validation and scope

• 28 regression tests pass in the built Node 22 image: 22 backend and 6 DOM UI cases, including password validation/login, rate limits, expiry, logout, rotation, restart invalidation, credential redaction, safe edits and injection rejection.
• The built amd64 image passes isolated HTTP/restart/CA smoke tests. Missing password fails closed; the configured password is absent from shared provider config and logs. SDK 0.3.55 validates the package, password-field constraints and service isolation; syntax and diff checks pass.
• The password is a Dappnode-managed environment setting, visible to trusted host administrators. Use trusted VPN or HTTPS transport. ARM64 and a real-browser test of this revised password flow remain untested; DOM UI tests use jsdom.
• The separate memory API on port 8000 still has authentication disabled and requires its own access-control review. Each config file is replaced atomically, but the two-file write is not a transaction. Platform SSO remains separate work.