fix(security): propagate directory ACL unverified into management auth

assertSafeDirectory soft-continues were discarded, so /api/settings could under-report. OR directory status into aclUnverified and cover dir-timeout vs file-ok with and without the opt-in.

Author: Wibias

src/server/management-auth.ts

@@ -53,7 +53,8 @@ function fail(reason: string): ManagementAuthState {
   return { available: false, reason };
 }
 
-function assertSafeDirectory(path: string): void {
+/** Returns true when the directory was accepted without verified NTFS ACL harden. */
+function assertSafeDirectory(path: string): boolean {
   mkdirSync(path, { recursive: true, mode: 0o700 });
   const stat = lstatSync(path);
   if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error("management token directory is not a regular directory");
@@ -62,10 +63,11 @@ function assertSafeDirectory(path: string): void {
   if (!hardened.ok) {
     if (allowUnverifiedAdminTokenAcl() && /timed out|ETIMEDOUT|budget exhausted|previous attempt timed out/i.test(hardened.diagnostics ?? "")) {
       console.warn(`[opencodex] management token directory ACL unverified (${hardened.diagnostics}); continuing because OPENCODEX_ALLOW_UNVERIFIED_ADMIN_TOKEN_ACL is set`);
-      return;
+      return true;
     }
     throw new Error("management token directory ACL hardening did not complete");
   }
+  return false;
 }
 
 function readExistingToken(path: string): { token: string; aclUnverified: boolean } {
@@ -177,16 +179,17 @@ export function initializeManagementAuthState(config: OcxConfig): ManagementAuth
   }
   try {
     const path = adminApiTokenFilePath();
-    assertSafeDirectory(dirname(path));
+    const directoryUnverified = assertSafeDirectory(dirname(path));
     let loaded: { token: string; aclUnverified: boolean };
     try {
       loaded = readExistingToken(path);
     } catch (error) {
       if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
       loaded = createTokenFile(path);
     }
-    lastManagementAuthAclUnverified = loaded.aclUnverified === true;
-    return ready(loaded.token, "file", config, { aclUnverified: loaded.aclUnverified });
+    const aclUnverified = directoryUnverified || loaded.aclUnverified === true;
+    lastManagementAuthAclUnverified = aclUnverified;
+    return ready(loaded.token, "file", config, { aclUnverified });
   } catch (error) {
     lastManagementAuthAclUnverified = false;
     return fail(error instanceof Error ? error.message : "management token initialization failed");

tests/server-management-auth.test.ts

@@ -475,4 +475,73 @@ describe("management and data-plane credential separation", () => {
       await server.stop(true);
     }
   });
+
+  test("directory ACL timeout without opt-in keeps management unavailable even when the token file hardens", async () => {
+    delete process.env.OPENCODEX_ADMIN_AUTH_TOKEN;
+    delete process.env.OPENCODEX_ALLOW_UNVERIFIED_ADMIN_TOKEN_ACL;
+    saveConfig(remoteConfig());
+    const adminToken = `ocx_admin_${"d".repeat(43)}`;
+    writeFileSync(join(testHome, "admin-api-token"), `${adminToken}\n`, { mode: 0o600 });
+    process.env.USERNAME ??= "tester";
+    setPlatformForTests("win32");
+    setIcaclsRunnerForTests(args => {
+      const target = args[0] ?? "";
+      // Directory harden times out; token-file harden succeeds.
+      if (target.endsWith("admin-api-token")) {
+        return { success: true, exitCode: 0, timedOut: false, stdout: "" };
+      }
+      return { success: false, exitCode: null, timedOut: true, stdout: "" };
+    });
+    // Drop any directory cache left by saveConfig so this case actually re-hardens.
+    resetHardenedStateForTests();
+    const state = initializeManagementAuthState(remoteConfig());
+    expect(state.available).toBe(false);
+    expect(managementAuthAclUnverified()).toBe(false);
+
+    const server = startServer(0);
+    try {
+      const settings = await fetch(new URL("/api/settings", server.url), {
+        headers: { "x-opencodex-api-key": adminToken },
+      });
+      expect(settings.status).toBe(503);
+      expect((await fetch(new URL("/healthz", server.url))).status).toBe(200);
+    } finally {
+      await server.stop(true);
+    }
+  });
+
+  test("directory ACL timeout with opt-in surfaces aclUnverified when the token file hardens", async () => {
+    delete process.env.OPENCODEX_ADMIN_AUTH_TOKEN;
+    process.env.OPENCODEX_ALLOW_UNVERIFIED_ADMIN_TOKEN_ACL = "1";
+    saveConfig(remoteConfig());
+    const adminToken = `ocx_admin_${"e".repeat(43)}`;
+    writeFileSync(join(testHome, "admin-api-token"), `${adminToken}\n`, { mode: 0o600 });
+    process.env.USERNAME ??= "tester";
+    setPlatformForTests("win32");
+    setIcaclsRunnerForTests(args => {
+      const target = args[0] ?? "";
+      if (target.endsWith("admin-api-token")) {
+        return { success: true, exitCode: 0, timedOut: false, stdout: "" };
+      }
+      return { success: false, exitCode: null, timedOut: true, stdout: "" };
+    });
+    resetHardenedStateForTests();
+    const state = initializeManagementAuthState(remoteConfig());
+    expect(state.available).toBe(true);
+    if (!state.available) return;
+    expect(state.aclUnverified).toBe(true);
+    expect(managementAuthAclUnverified()).toBe(true);
+
+    const server = startServer(0);
+    try {
+      const settings = await fetch(new URL("/api/settings", server.url), {
+        headers: { "x-opencodex-api-key": adminToken },
+      });
+      expect(settings.status).toBe(200);
+      const body = await settings.json() as { managementAuthAclUnverified?: boolean };
+      expect(body.managementAuthAclUnverified).toBe(true);
+    } finally {
+      await server.stop(true);
+    }
+  });
 });