fix: second review pass + remove brand references

- reject control characters in key label and display name (prevents newline
  injection into the plain-text authorized_keys output)
- map handle race on registration to 409 instead of 500
- explicit return after the cross-origin 403 in the CSRF hook
- reserved single-segment paths only return the SPA shell to HTML clients
- validate ?type filter against supported key types (shared isSupportedKeyType)
- extract shared noControlChars validator
- drop brand references from UI and docs

Author: MrOplus

apps/server/src/lib/validation.ts

@@ -0,0 +1,16 @@
+/**
+ * Shared input-validation helpers.
+ */
+
+/**
+ * True when the string contains no control characters (C0 range or DEL),
+ * including CR/LF. Used to keep newline-bearing input out of user-facing fields
+ * that are later rendered into line-oriented formats such as authorized_keys.
+ */
+export function noControlChars(value: string): boolean {
+  for (const char of value) {
+    const code = char.charCodeAt(0);
+    if (code < 0x20 || code === 0x7f) return false;
+  }
+  return true;
+}

apps/server/src/plugins/security.ts

@@ -47,7 +47,7 @@ export async function registerSecurity(app: FastifyInstance): Promise<void> {
     if (!UNSAFE.has(request.method)) return;
     const origin = request.headers.origin;
     if (origin && origin !== config.publicOrigin) {
-      await reply.code(403).send({ error: 'forbidden', message: 'Cross-origin request rejected.' });
+      return reply.code(403).send({ error: 'forbidden', message: 'Cross-origin request rejected.' });
     }
   });
 

apps/server/src/plugins/spa.ts

@@ -7,6 +7,7 @@ import { config } from '../config.js';
 import { logger } from '../logger.js';
 import { sshKeys, users } from '../db/repositories.js';
 import { handleSchema, isReservedHandle } from '../lib/handle.js';
+import { isSupportedKeyType } from '../lib/sshkey.js';
 
 const here = dirname(fileURLToPath(import.meta.url));
 
@@ -80,9 +81,12 @@ export async function registerSpa(app: FastifyInstance): Promise<void> {
 
     const valid = handleSchema.safeParse(handle);
 
-    // Reserved single-segment paths belong to the SPA router, unless plain text
-    // was explicitly requested (in which case there is simply no such handle).
-    if (isReservedHandle(handle) && !forceText) return sendApp(reply);
+    // Reserved single-segment paths belong to the SPA router — but only hand back
+    // the HTML shell to clients that actually asked for HTML. A non-browser
+    // client hitting a reserved path falls through to a plain 404.
+    if (isReservedHandle(handle)) {
+      return clientWantsHtml(request) ? sendApp(reply) : reply.code(404).type('text/plain; charset=utf-8').send('# Not found\n');
+    }
 
     const user = valid.success ? users.byHandle(valid.data) : undefined;
 
@@ -97,8 +101,10 @@ export async function registerSpa(app: FastifyInstance): Promise<void> {
       return reply.code(404).send(`# No SSHID found for ${safe}\n`);
     }
 
-    // Exact (case-insensitive) key-type match, validated against supported types.
-    const typeFilter = (request.query as { type?: string }).type?.toLowerCase();
+    // Exact (case-insensitive) key-type match. An unrecognised type is ignored
+    // rather than silently returning nothing.
+    const rawType = (request.query as { type?: string }).type?.toLowerCase();
+    const typeFilter = rawType && isSupportedKeyType(rawType) ? rawType : undefined;
     const lines = sshKeys
       .byUser(user.id)
       .filter((k) => !typeFilter || k.key_type.toLowerCase() === typeFilter)

apps/server/src/routes/auth.ts

@@ -3,6 +3,7 @@ import { z } from 'zod';
 import type { AuthenticationResponseJSON, RegistrationResponseJSON } from '@simplewebauthn/server';
 import { credentials, users } from '../db/repositories.js';
 import { handleSchema } from '../lib/handle.js';
+import { noControlChars } from '../lib/validation.js';
 import {
   clearChallenge,
   clearSession,
@@ -20,7 +21,13 @@ import { loadUser } from '../plugins/auth.js';
 
 const registerStartSchema = z.object({
   handle: handleSchema,
-  displayName: z.string().trim().max(80).optional().default(''),
+  displayName: z
+    .string()
+    .trim()
+    .max(80)
+    .refine(noControlChars, 'Display name cannot contain control characters.')
+    .optional()
+    .default(''),
 });
 
 const loginStartSchema = z.object({ handle: handleSchema });
@@ -104,8 +111,18 @@ export async function authRoutes(app: FastifyInstance): Promise<void> {
     }
 
     // Reuse the id encoded into the credential's userHandle so resident-key
-    // resolution maps back to this exact account.
-    const user = users.create(challenge.handle, challenge.displayName ?? '', challenge.userId);
+    // resolution maps back to this exact account. Guard against a handle claimed
+    // in the race between the two ceremony steps (UNIQUE violation -> 409).
+    let user;
+    try {
+      user = users.create(challenge.handle, challenge.displayName ?? '', challenge.userId);
+    } catch (err) {
+      if (err instanceof Error && /UNIQUE/i.test(err.message)) {
+        clearChallenge(reply);
+        return reply.code(409).send({ error: 'handle_taken', message: 'That handle is already registered.' });
+      }
+      throw err;
+    }
     credentials.create({
       id: verified.id,
       userId: user.id,

apps/server/src/routes/keys.ts

@@ -2,10 +2,20 @@ import type { FastifyInstance } from 'fastify';
 import { z } from 'zod';
 import { sshKeys, type SshKeyRow } from '../db/repositories.js';
 import { InvalidPublicKeyError, parsePublicKey } from '../lib/sshkey.js';
+import { noControlChars } from '../lib/validation.js';
 import { requireAuth } from '../plugins/auth.js';
 
 const addKeySchema = z.object({
-  label: z.string().trim().max(80).optional().default(''),
+  // The label is emitted verbatim as a comment in the plain-text
+  // authorized_keys output, so an embedded newline could forge a second key
+  // line. Disallow all control characters.
+  label: z
+    .string()
+    .trim()
+    .max(80)
+    .refine(noControlChars, 'Label cannot contain control characters.')
+    .optional()
+    .default(''),
   publicKey: z.string().min(1).max(16 * 1024),
 });
 

apps/server/src/routes/publicUser.ts

@@ -2,6 +2,7 @@ import type { FastifyInstance } from 'fastify';
 import { z } from 'zod';
 import { sshKeys, users } from '../db/repositories.js';
 import { handleSchema } from '../lib/handle.js';
+import { isSupportedKeyType } from '../lib/sshkey.js';
 
 /**
  * Public, unauthenticated profile data consumed by the SPA to render a user's
@@ -20,7 +21,8 @@ export async function publicUserRoutes(app: FastifyInstance): Promise<void> {
     }
 
     // Optional exact key-type filter, mirroring the plain-text resolver.
-    const typeFilter = (request.query as { type?: string }).type?.toLowerCase();
+    const rawType = (request.query as { type?: string }).type?.toLowerCase();
+    const typeFilter = rawType && isSupportedKeyType(rawType) ? rawType : undefined;
 
     return {
       handle: user.handle,