remove useless slop stuff

server/src/services/setupService/index.js

@@ -1,34 +1,38 @@
 // First-Run Setup Service
-// Purpose: Allows an empty data directory to create its first lockdown administrator or import legacy YAML safely.
+// Purpose: Allows an empty data directory to create its first lockdown administrator or import an explicitly uploaded YAML file.
 // Scope: Exposes setup-only socket operations and permanently closes them once a lockdown administrator exists.
 const crypto = require('crypto');
 const bcrypt = require('bcrypt');
 const io = require('../../globals/io');
 const logger = require('../../globals/logger').child('setupService');
 const { getConfigurationDatabase } = require('../../configuration');
-const { importLegacyConfiguration } = require('../../configuration/legacyImporter');
+const { importConfigurationFile } = require('../../configuration/configurationFileImporter');
+const { createSetupCodeFile } = require('./setupCodeFile');
 
-const MAX_LEGACY_YAML_BYTES = 1024 * 1024;
+const MAX_CONFIGURATION_FILE_BYTES = 1024 * 1024;
 const database = getConfigurationDatabase();
-let setupCode = null;
+const setupCodeFile = createSetupCodeFile();
+let setupNoticeLogged = false;
 
 function isSetupRequired() {
   return !database.isSetupComplete();
 }
 
 function ensureSetupCode() {
-  if (!isSetupRequired()) return null;
-  if (!setupCode) {
-    setupCode = crypto.randomBytes(6).toString('hex');
-    /*
-      The code is intentionally logged only on a server that has no lockdown
-      administrator. It lives in process memory, changes on restart, and is
-      permanently irrelevant as soon as setup succeeds, so it cannot become a
-      recurring environment-variable authentication bypass.
-    */
-    logger.warn('First-run setup is required', { setupCode });
+  if (!isSetupRequired()) {
+    // Setup authorization permanently closes when the first lockdown account
+    // exists. Remove a stale credential left by an interrupted final response.
+    setupCodeFile.remove();
+    return null;
   }
-  return setupCode;
+  const code = setupCodeFile.ensure();
+  // Logs may be retained or shipped elsewhere, so they identify the local file
+  // containing the credential without ever including the credential itself.
+  if (!setupNoticeLogged) {
+    logger.warn('First-run setup is required', { setupCodePath: setupCodeFile.filePath });
+    setupNoticeLogged = true;
+  }
+  return code;
 }
 
 function requireOpenSetup(candidateCode) {
@@ -73,25 +77,25 @@ io.on('connection', (socket) => {
         discordId: payload.discordId,
         role: 'lockdown',
       }, 'first-run-setup');
-      setupCode = null;
+      setupCodeFile.remove();
       return { administrator };
     });
   });
 
-  socket.on('setup:importLegacy', (payload = {}, cb = () => {}) => {
+  socket.on('setup:importConfigurationFile', (payload = {}, cb = () => {}) => {
     respond(cb, () => {
       requireOpenSetup(payload.setupCode);
       const yamlText = String(payload.yaml || '');
-      if (!yamlText || Buffer.byteLength(yamlText, 'utf8') > MAX_LEGACY_YAML_BYTES) {
-        throw new Error('Legacy YAML must be present and no larger than 1 MiB.');
+      if (!yamlText || Buffer.byteLength(yamlText, 'utf8') > MAX_CONFIGURATION_FILE_BYTES) {
+        throw new Error('The YAML configuration file must be present and no larger than 1 MiB.');
       }
-      const result = importLegacyConfiguration({
+      const result = importConfigurationFile({
         text: yamlText,
         database,
         actor: 'first-run-setup',
         source: String(payload.fileName || 'uploaded-config.yaml').slice(0, 255),
       });
-      setupCode = null;
+      setupCodeFile.remove();
       return result;
     });
   });

server/src/services/setupService/setupCodeFile.js

@@ -0,0 +1,74 @@
+// Setup Code File
+// Purpose: Persists the one-time first-run credential inside the server data directory.
+// Scope: Owns secure file creation, validation, reuse, and removal without knowing whether setup is complete.
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const { resolveDataPath } = require('../../helpers/dataPaths');
+
+const DEFAULT_SETUP_CODE_PATH = resolveDataPath('setup-code.txt');
+const SETUP_CODE_PATTERN = /^[0-9a-f]{12}$/;
+
+function createSetupCodeFile({ filePath = DEFAULT_SETUP_CODE_PATH } = {}) {
+  function read() {
+    const fileStats = fs.lstatSync(filePath);
+    if (!fileStats.isFile()) {
+      // In particular, reject symbolic links before chmod or read operations so
+      // a writable data directory cannot redirect setup handling to another file.
+      throw new Error(`Setup code path is not a regular file: ${filePath}`);
+    }
+    fs.chmodSync(filePath, 0o600);
+    const code = fs.readFileSync(filePath, 'utf8').trim().toLowerCase();
+    if (!SETUP_CODE_PATTERN.test(code)) {
+      /*
+        Never silently replace a malformed credential. An operator may already
+        be reading that file, and changing it behind their back would make setup
+        failures mysterious while concealing possible filesystem corruption.
+      */
+      throw new Error(`Setup code file is invalid: ${filePath}`);
+    }
+    return code;
+  }
+
+  function ensure() {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    if (fs.existsSync(filePath)) {
+      return read();
+    }
+
+    const code = crypto.randomBytes(6).toString('hex');
+    try {
+      /*
+        Exclusive creation prevents two accidentally overlapping server starts
+        from overwriting one another's setup credential. The file is the source
+        an operator reads, so the accepted code must always match its contents.
+      */
+      fs.writeFileSync(filePath, `${code}\n`, {
+        encoding: 'utf8',
+        flag: 'wx',
+        mode: 0o600,
+      });
+      return code;
+    } catch (error) {
+      if (error.code !== 'EEXIST') throw error;
+      return read();
+    }
+  }
+
+  function remove() {
+    fs.rmSync(filePath, { force: true });
+  }
+
+  return {
+    filePath,
+    ensure,
+    read,
+    remove,
+  };
+}
+
+module.exports = {
+  DEFAULT_SETUP_CODE_PATH,
+  SETUP_CODE_PATTERN,
+  createSetupCodeFile,
+};

server/src/services/setupService/setupCodeFile.test.js

@@ -0,0 +1,61 @@
+// Setup Code File Tests
+// Purpose: Verifies the first-run credential remains private, stable, and removable.
+// Scope: Uses an isolated operating-system temporary directory and never touches development server data.
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const test = require('node:test');
+
+const { SETUP_CODE_PATTERN, createSetupCodeFile } = require('./setupCodeFile');
+
+const temporaryRoots = [];
+
+function createTestStore() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'multirover-setup-code-'));
+  temporaryRoots.push(root);
+  return createSetupCodeFile({ filePath: path.join(root, 'setup-code.txt') });
+}
+
+test.after(() => {
+  temporaryRoots.forEach((root) => fs.rmSync(root, { recursive: true, force: true }));
+});
+
+test('creates one owner-readable code and reuses it across startup initialization', () => {
+  const store = createTestStore();
+  const firstCode = store.ensure();
+  const secondCode = store.ensure();
+
+  assert.match(firstCode, SETUP_CODE_PATTERN);
+  assert.equal(secondCode, firstCode);
+  assert.equal(fs.readFileSync(store.filePath, 'utf8'), `${firstCode}\n`);
+  // Mask off file-type bits so this assertion checks only Unix permissions.
+  assert.equal(fs.statSync(store.filePath).mode & 0o777, 0o600);
+});
+
+test('rejects a malformed existing credential instead of replacing it', () => {
+  const store = createTestStore();
+  fs.writeFileSync(store.filePath, 'not-a-valid-code\n', { mode: 0o600 });
+
+  assert.throws(() => store.ensure(), /Setup code file is invalid/);
+  assert.equal(fs.readFileSync(store.filePath, 'utf8'), 'not-a-valid-code\n');
+});
+
+test('rejects a setup-code symlink without reading or changing its target', () => {
+  const store = createTestStore();
+  const targetPath = path.join(path.dirname(store.filePath), 'unrelated.txt');
+  fs.writeFileSync(targetPath, 'unrelated-content\n', { mode: 0o644 });
+  fs.symlinkSync(targetPath, store.filePath);
+
+  assert.throws(() => store.ensure(), /not a regular file/);
+  assert.equal(fs.readFileSync(targetPath, 'utf8'), 'unrelated-content\n');
+  assert.equal(fs.statSync(targetPath).mode & 0o777, 0o644);
+});
+
+test('removes the credential after setup completes', () => {
+  const store = createTestStore();
+  store.ensure();
+  store.remove();
+
+  assert.equal(fs.existsSync(store.filePath), false);
+});