JavaScriptSolidServer
diff --git a/‎markets/guard.js‎
Lines changed: 17 additions & 0 deletions b/‎markets/guard.js‎
Lines changed: 17 additions & 0 deletions
diff --git a/‎markets/plugin.js‎
Lines changed: 20 additions & 6 deletions b/‎markets/plugin.js‎
Lines changed: 20 additions & 6 deletions
diff --git a/‎markets/store.js‎
Lines changed: 13 additions & 1 deletion b/‎markets/store.js‎
Lines changed: 13 additions & 1 deletion
diff --git a/‎markets/ui.js‎
Lines changed: 8 additions & 3 deletions b/‎markets/ui.js‎
Lines changed: 8 additions & 3 deletions
@@ -40,6 +40,16 @@ const b64url = (buf) => Buffer.from(buf).toString('base64url');
  * only this plugin verifies them, so a stolen session token buys markets
  * access and nothing else on the pod.
  */
+// A session-signing key that was committed to this repo's history by a
+// test writing into the source tree. Removing the file from the working
+// tree is NOT remediation: the blob is still `git show`-able, so anyone
+// with the repo could forge a session token for any agent on any
+// deployment whose pluginDir was seeded from those commits. Refusing to
+// boot on it is the only mitigation a plugin can enforce by itself.
+const BURNED_SECRETS = new Set([
+  'c59b6df7144548b73d07746635c6774828bf8cc74af8febb8d2ce5db2699d277',
+]);
+
 export function createSessions({ dir, ttlMs }) {
   const secretFile = path.join(dir, 'session.secret');
   let secret;
@@ -49,6 +59,13 @@ export function createSessions({ dir, ttlMs }) {
     secret = crypto.randomBytes(32);
     fs.writeFileSync(secretFile, secret, { mode: 0o600 });
   }
+  if (BURNED_SECRETS.has(crypto.createHash('sha256').update(secret).digest('hex'))) {
+    throw new Error(
+      `markets: ${secretFile} is a key that leaked into git history — anyone with the repository `
+      + 'can forge session tokens for any agent. Delete the file (a fresh key is generated on the '
+      + 'next boot; every existing session is invalidated, which is the point).',
+    );
+  }
 
   const sign = (payload) => crypto.createHmac('sha256', secret).update(payload).digest();
 
 
@@ -261,18 +261,32 @@ export async function activate(api) {
     return claims.agent;
   }
 
-  async function resolveAgent(request) {
+  /**
+   * @returns {Promise<{agent:string|null, ambient:boolean}>} `ambient` is
+   * true when the credential is one a browser attaches by itself — a
+   * cookie, or a WebID-TLS client certificate — i.e. one a cross-origin
+   * page could borrow without knowing it.
+   */
+  async function resolveAgentFull(request) {
     const cookie = cookieToken(request);
     if (cookie) {
       const agent = liveSession(cookie);
-      if (agent) return agent;
+      if (agent) return { agent, ambient: true };
     }
     const auth = request.headers.authorization;
     if (auth && auth.startsWith('Bearer v1.')) {
       const agent = liveSession(auth.slice(7));
-      if (agent) return agent;
+      if (agent) return { agent, ambient: false };
     }
-    return api.auth.getAgent(request);
+    const agent = await api.auth.getAgent(request);
+    // getAgent may have authenticated from an ambient TLS client
+    // certificate; only an explicit Authorization header proves the
+    // caller actually held a secret.
+    return { agent, ambient: agent ? !auth : false };
+  }
+
+  async function resolveAgent(request) {
+    return (await resolveAgentFull(request)).agent;
   }
 
   // ------------------------------------------------------------ replies
@@ -309,9 +323,9 @@ export async function activate(api) {
   async function authed(request, reply, { mutating = true } = {}) {
     // Resolve first so an anonymous caller gets a 401 rather than a
     // confusing 403; nothing is acted on before the CSRF check below.
-    const agent = await resolveAgent(request);
+    const { agent, ambient } = await resolveAgentFull(request);
     if (!agent) { err(reply, 401, 'authentication required'); return null; }
-    if (mutating && !csrfOk(request)) {
+    if (mutating && ambient && !isSameOrigin(request, originFor(request))) {
       err(reply, 403, 'cross-origin request refused — this endpoint is same-origin only');
       return null;
     }
 
@@ -407,9 +407,17 @@ export function createStore({ dir, log, prices }) {
    * ledger ahead of the durable one (the old design mutated first and
    * 500'd after, leaving memory and disk permanently divergent).
    */
+  function reopenJournal() {
+    jfd = fs.openSync(journalFile, 'a');
+  }
+
   function commit(ev) {
     ev.seq = state.seq + 1;
     ev.t = ev.t || Date.now();
+    // A descriptor lost during rotation (or by anything else) must not
+    // wedge the ledger forever: recover it here rather than failing
+    // every trade and settlement from now on.
+    if (jfd === null) reopenJournal();
     const line = Buffer.from(`${JSON.stringify(ev)}\n`, 'utf8');
     let off = 0;
     while (off < line.length) off += fs.writeSync(jfd, line, off, line.length - off);
@@ -443,7 +451,11 @@ export function createStore({ dir, log, prices }) {
           // forever. Always get a working descriptor back.
           log.error(`markets: journal rotation failed: ${err.message}`);
         } finally {
-          jfd = fs.openSync(journalFile, 'a');
+          // If THIS throws, jfd stays null and commit() reopens lazily.
+          jfd = null;
+          try { reopenJournal(); } catch (err) {
+            log.error(`markets: could not reopen the journal after rotation: ${err.message}`);
+          }
         }
         log.info(`markets: rotated journal at seq ${state.seq} (prior segment retained for audit)`);
       }
 
@@ -59,6 +59,7 @@ export function renderUi(prefix) {
   .status{font-size:.7rem;font-weight:700;text-transform:uppercase;letter-spacing:.06em}
   .status.open{color:var(--up)} .status.closed{color:var(--ink3)}
   .status.resolving{color:var(--down)} .status.disputed{color:var(--bad)}
+  .status.voiding{color:var(--down)}
   .status.resolved{color:var(--accent)} .status.void{color:var(--bad)}
   table{width:100%;border-collapse:collapse;font-size:.85rem}
   td,th{padding:.45rem .4rem;border-bottom:1px solid var(--line);text-align:left}
@@ -530,6 +531,8 @@ export function renderUi(prefix) {
     $('d-meta').innerHTML = '<span class="status ' + esc(m.status) + '">' + esc(m.status) + '</span>'
       + (m.status === 'resolved' && m.resolvedOutcome != null ? ' → <b>' + esc(m.outcomes[m.resolvedOutcome]) + '</b>' : '')
       + (m.status === 'resolving' ? ' → <b>' + esc(m.outcomes[m.resolvedOutcome]) + '</b> · settles ' + new Date(m.settleAt).toLocaleTimeString() + ' (disputable)' : '')
+      + (m.status === 'voiding' ? ' → <b>void proposed</b> · settles ' + new Date(m.settleAt).toLocaleTimeString()
+        + ' — everyone is refunded at most what they paid, nobody wins (disputable)' : '')
       + ' · <span id="d-countdown">' + (m.tradable ? countdown(m.closesAt)
         : 'closed ' + new Date(m.closesAt).toLocaleString()) + '</span>'
       + ' · pool ' + cr(m.liquidity) + ' · ' + m.trades + ' trades'
@@ -590,13 +593,15 @@ export function renderUi(prefix) {
     const isOracle = me && (me.agent === m.oracle);
     $('oracle-row').classList.toggle('hidden', !(isOracle && m.canResolve));
     $('o-outcome').innerHTML = m.outcomes.map((o, i) => '<option value="' + i + '">' + esc(o) + '</option>').join('');
-    const canDispute = m.status === 'resolving' && pos;
+    const canDispute = (m.status === 'resolving' || m.status === 'voiding') && pos;
     $('dispute-row').classList.toggle('hidden', !canDispute);
     if (canDispute) {
       // State the bond, the stakes and the deadline BEFORE taking money.
       const bond = Math.max(25, pos.totalCost * 0.2);
-      $('dispute-copy').innerHTML = 'This market resolved as <b>' + esc(m.outcomes[m.resolvedOutcome])
-        + '</b>. Disputing stakes a bond of about <b>' + cr(bond) + ' credits</b>, which you '
+      $('dispute-copy').innerHTML = (m.status === 'voiding'
+        ? 'The oracle has proposed to <b>void</b> this market — nobody wins and you get back at most what you paid. '
+        : 'This market resolved as <b>' + esc(m.outcomes[m.resolvedOutcome]) + '</b>. ')
+        + 'Disputing stakes a bond of about <b>' + cr(bond) + ' credits</b>, which you '
         + '<b>lose</b> unless an operator agrees with you. '
         + (m.disputes ? m.disputes + ' dispute(s) already filed. ' : '')
         + 'If nobody adjudicates in time, the resolution stands.';