Security fixes and updates

.github/workflows/release.yml

@@ -25,7 +25,7 @@ jobs:
           version: 10
       - uses: actions/setup-go@v6
         with:
-          go-version: 1.26.3
+          go-version: 1.26.4
       - name: Install nfpm
         run: |
           echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | sudo tee /etc/apt/sources.list.d/goreleaser.list

.github/workflows/snapshot.yml

@@ -55,7 +55,7 @@ jobs:
           version: 10
       - uses: actions/setup-go@v6
         with:
-          go-version: 1.26.3
+          go-version: 1.26.4
       - name: Unit tests
         env:
           TEST_POSTGRES_HOST: runner.local
@@ -90,7 +90,7 @@ jobs:
           version: 10
       - uses: actions/setup-go@v6
         with:
-          go-version: 1.26.3
+          go-version: 1.26.4
       - name: Install nfpm
         run: |
           echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | sudo tee /etc/apt/sources.list.d/goreleaser.list

CHANGELOG.md

@@ -1,8 +1,11 @@
 # CHANGELOG
 
-## 2.42.0
+## 2.41.1
 
-- Minor fixes and improvements
+- Fix for the scenario where multiple admin users could be created during the onboarding flow under a race condition
+  (thanks @tikket1 [for the report](https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-pxcx-fv34-x9p5)!)
+- Upgrade of the nginx version from 1.31.1 to 1.31.2 (mainline)
+- Other minor fixes and improvements
 
 ## 2.41.0
 

Dockerfile

@@ -1,4 +1,4 @@
-FROM nginx:1.31.1-alpine AS builder
+FROM nginx:1.31.2-alpine AS builder
 
 RUN apk add --no-cache \
       gcc \

Makefile

@@ -209,6 +209,7 @@ update-dependencies: .backend-prerequisites .frontend-prerequisites .update-ngin
 	cd integration/docker && go get -u ./...
 	cd integration/truenas && go get -u ./...
 	cd tools && go get -u ./...
+	cd i18n && go get -u ./...
 	cd vpn/netbird && go get -u ./...
 	cd vpn/tailscale && go get -u ./...
 	go work sync

api/go.mod

@@ -1,19 +1,19 @@
 module dillmann.com.br/nginx-ignition/api
 
-go 1.26.3
+go 1.26.4
 
 require (
 	github.com/gin-gonic/gin v1.12.0
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/uuid v1.6.0
 	github.com/stretchr/testify v1.11.1
 	go.uber.org/mock v0.6.0
-	golang.org/x/text v0.37.0
+	golang.org/x/text v0.38.0
 )
 
 require (
 	github.com/bytedance/gopkg v0.1.4 // indirect
-	github.com/bytedance/sonic v1.15.1 // indirect
+	github.com/bytedance/sonic v1.15.2 // indirect
 	github.com/bytedance/sonic/loader v0.5.1 // indirect
 	github.com/cloudwego/base64x v0.1.7 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
@@ -30,18 +30,18 @@ require (
 	github.com/mattn/go-isatty v0.0.22 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
-	github.com/pelletier/go-toml/v2 v2.3.1 // indirect
+	github.com/pelletier/go-toml/v2 v2.4.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/quic-go/qpack v0.6.0 // indirect
-	github.com/quic-go/quic-go v0.59.1 // indirect
+	github.com/quic-go/quic-go v0.60.0 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.3.1 // indirect
-	go.mongodb.org/mongo-driver/v2 v2.6.0 // indirect
-	golang.org/x/arch v0.27.0 // indirect
-	golang.org/x/crypto v0.52.0 // indirect
-	golang.org/x/net v0.55.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
+	go.mongodb.org/mongo-driver/v2 v2.7.0 // indirect
+	golang.org/x/arch v0.28.0 // indirect
+	golang.org/x/crypto v0.53.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

api/go.sum

@@ -1,7 +1,7 @@
 github.com/bytedance/gopkg v0.1.4 h1:oZnQwnX82KAIWb7033bEwtxvTqXcYMxDBaQxo5JJHWM=
 github.com/bytedance/gopkg v0.1.4/go.mod h1:v1zWfPm21Fb+OsyXN2VAHdL6TBb2L88anLQgdyje6R4=
-github.com/bytedance/sonic v1.15.1 h1:nJD5PmM0vY7J8CT6MxoqbVAAMhkSmV2HgRAUrrpLoOw=
-github.com/bytedance/sonic v1.15.1/go.mod h1:mT2NbXunuaEbnZ+mRIX/vYqKISmgEuHFDI4UzmKx2SA=
+github.com/bytedance/sonic v1.15.2 h1:90H+rcF/FwLXwfB1cudOLq/je83n683Utf4Cbp0xHCo=
+github.com/bytedance/sonic v1.15.2/go.mod h1:mT2NbXunuaEbnZ+mRIX/vYqKISmgEuHFDI4UzmKx2SA=
 github.com/bytedance/sonic/loader v0.5.1 h1:Ygpfa9zwRCCKSlrp5bBP/b/Xzc3VxsAW+5NIYXrOOpI=
 github.com/bytedance/sonic/loader v0.5.1/go.mod h1:AR4NYCk5DdzZizZ5djGqQ92eEhCCcdf5x77udYiSJRo=
 github.com/cloudwego/base64x v0.1.7 h1:NppS+Fgzg5ovhn4NkUXaDT3x9jldgH5ToMCqzBSi2zI=
@@ -49,15 +49,16 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJ
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
 github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/pelletier/go-toml/v2 v2.3.1 h1:MYEvvGnQjeNkRF1qUuGolNtNExTDwct51yp7olPtrEc=
-github.com/pelletier/go-toml/v2 v2.3.1/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pelletier/go-toml/v2 v2.4.0 h1:Mwu0mAkUKbittDs3/ADDWXqMmq3EOK2VHiuCkV00Row=
+github.com/pelletier/go-toml/v2 v2.4.0/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/quic-go/go-ossfuzz-seeds v0.1.0 h1:APacT+iIaNF6fd8AGEiN3bT/Jtkd2jz4v4TzM7MFjy0=
 github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
 github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
-github.com/quic-go/quic-go v0.59.1 h1:0Gmua0HW1Tv7ANR7hUYwRyD0MG5OJfgvYSZasGZzBic=
-github.com/quic-go/quic-go v0.59.1/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
+github.com/quic-go/quic-go v0.60.0 h1:xcQioE8OM66UQLeUMHltK1CCcOu3JbVB4JAQdDQSB+0=
+github.com/quic-go/quic-go v0.60.0/go.mod h1:wpKpjmPpftl30sL6pFh7REVpjbcCVy4zt2vDyK1TuJk=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -74,20 +75,20 @@ github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY=
 github.com/ugorji/go/codec v1.3.1/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
-go.mongodb.org/mongo-driver/v2 v2.6.0 h1:b9sJOYrkmt4l8bY43ZenFBcPlhYIjaOfYHLtbB/5qi8=
-go.mongodb.org/mongo-driver/v2 v2.6.0/go.mod h1:yOI9kBsufol30iFsl1slpdq1I0eHPzybRWdyYUs8K/0=
+go.mongodb.org/mongo-driver/v2 v2.7.0 h1:RO+zqavD2/GCL3cxOMyZhx6R9Irzr8/6gsoqx5tcY/c=
+go.mongodb.org/mongo-driver/v2 v2.7.0/go.mod h1:yOI9kBsufol30iFsl1slpdq1I0eHPzybRWdyYUs8K/0=
 go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
 go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
-golang.org/x/arch v0.27.0 h1:0WNVcR8u9yFz8j5FvdHpgwNp3FS5U4guYdzHwEiGjoU=
-golang.org/x/arch v0.27.0/go.mod h1:0X+GdSIP+kL5wPmpK7sdkEVTt2XoYP0cSjQSbZBwOi8=
-golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
-golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
-golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
-golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/arch v0.28.0 h1:wVwVdqsTuUbJvhYVCspQYwZXHNYeLSoZnmHD+ggddpQ=
+golang.org/x/arch v0.28.0/go.mod h1:0X+GdSIP+kL5wPmpK7sdkEVTt2XoYP0cSjQSbZBwOi8=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
+golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

api/user/onboarding_finish_handler.go

@@ -1,6 +1,7 @@
 package user
 
 import (
+	"errors"
 	"net/http"
 
 	"github.com/gin-gonic/gin"
@@ -51,7 +52,12 @@ func (h onboardingFinishHandler) handle(ctx *gin.Context) {
 		TrafficStats: user.ReadOnlyAccessLevel,
 	}
 
-	if err = h.commands.Save(ctx.Request.Context(), domainModel, nil); err != nil {
+	if err = h.commands.FinishOnboarding(ctx.Request.Context(), domainModel); err != nil {
+		if errors.Is(err, user.ErrOnboardingAlreadyCompleted) {
+			ctx.Status(http.StatusForbidden)
+			return
+		}
+
 		panic(err)
 	}
 

api/user/onboarding_finish_handler_test.go

@@ -33,7 +33,7 @@ func Test_onboardingFinishHandler(t *testing.T) {
 				OnboardingCompleted(gomock.Any()).
 				Return(false, nil)
 			commands.EXPECT().
-				Save(gomock.Any(), gomock.Any(), gomock.Any()).
+				FinishOnboarding(gomock.Any(), gomock.Any()).
 				Return(nil)
 			commands.EXPECT().
 				Authenticate(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).
@@ -65,7 +65,40 @@ func Test_onboardingFinishHandler(t *testing.T) {
 			assert.Equal(t, http.StatusOK, recorder.Code)
 		})
 
-		t.Run("panics on command error", func(t *testing.T) {
+		t.Run("returns 403 when onboarding already completed", func(t *testing.T) {
+			controller := gomock.NewController(t)
+			defer controller.Finish()
+
+			payload := newUserRequest()
+			commands := user.NewMockedCommands(controller)
+			commands.EXPECT().
+				OnboardingCompleted(gomock.Any()).
+				Return(true, nil)
+
+			cfg := configuration.NewWithOverrides(map[string]string{
+				"nginx-ignition.security.jwt.secret": "1234567890123456789012345678901234567890123456789012345678901234",
+			})
+			authorizer, _ := authorization.New(cfg, commands)
+			handler := onboardingFinishHandler{
+				commands:   commands,
+				authorizer: authorizer,
+			}
+			engine := gin.New()
+			engine.POST("/api/users/onboarding/finish", handler.handle)
+
+			body, _ := json.Marshal(payload)
+			recorder := httptest.NewRecorder()
+			request := httptest.NewRequest(
+				"POST",
+				"/api/users/onboarding/finish",
+				bytes.NewBuffer(body),
+			)
+			engine.ServeHTTP(recorder, request)
+
+			assert.Equal(t, http.StatusForbidden, recorder.Code)
+		})
+
+		t.Run("returns 403 when FinishOnboarding reports already completed", func(t *testing.T) {
 			controller := gomock.NewController(t)
 			defer controller.Finish()
 
@@ -74,10 +107,46 @@ func Test_onboardingFinishHandler(t *testing.T) {
 			commands.EXPECT().
 				OnboardingCompleted(gomock.Any()).
 				Return(false, nil)
+			commands.EXPECT().
+				FinishOnboarding(gomock.Any(), gomock.Any()).
+				Return(user.ErrOnboardingAlreadyCompleted)
+
+			cfg := configuration.NewWithOverrides(map[string]string{
+				"nginx-ignition.security.jwt.secret": "1234567890123456789012345678901234567890123456789012345678901234",
+			})
+			authorizer, _ := authorization.New(cfg, commands)
+			handler := onboardingFinishHandler{
+				commands:   commands,
+				authorizer: authorizer,
+			}
+			engine := gin.New()
+			engine.POST("/api/users/onboarding/finish", handler.handle)
+
+			body, _ := json.Marshal(payload)
+			recorder := httptest.NewRecorder()
+			request := httptest.NewRequest(
+				"POST",
+				"/api/users/onboarding/finish",
+				bytes.NewBuffer(body),
+			)
+			engine.ServeHTTP(recorder, request)
+
+			assert.Equal(t, http.StatusForbidden, recorder.Code)
+		})
+
+		t.Run("panics on command error", func(t *testing.T) {
+			controller := gomock.NewController(t)
+			defer controller.Finish()
+
+			payload := newUserRequest()
+			commands := user.NewMockedCommands(controller)
 
 			expectedErr := assert.AnError
 			commands.EXPECT().
-				Save(gomock.Any(), gomock.Any(), gomock.Any()).
+				OnboardingCompleted(gomock.Any()).
+				Return(false, nil)
+			commands.EXPECT().
+				FinishOnboarding(gomock.Any(), gomock.Any()).
 				Return(expectedErr)
 
 			cfg := configuration.NewWithOverrides(map[string]string{

application/go.mod

@@ -1,3 +1,3 @@
 module dillmann.com.br/nginx-ignition/application
 
-go 1.26.3
+go 1.26.4

certificate/commons/go.mod

@@ -1,5 +1,5 @@
 module dillmann.com.br/nginx-ignition/certificate/commons
 
-go 1.26.3
+go 1.26.4
 
 require go.uber.org/mock v0.6.0

certificate/commons/go.sum

@@ -1,2 +1 @@
 go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
-go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=

certificate/custom/go.mod

@@ -1,5 +1,5 @@
 module dillmann.com.br/nginx-ignition/certificate/custom
 
-go 1.26.3
+go 1.26.4
 
 require github.com/google/uuid v1.6.0

certificate/external/go.mod

@@ -1,5 +1,5 @@
 module dillmann.com.br/nginx-ignition/certificate/external
 
-go 1.26.3
+go 1.26.4
 
 require github.com/google/uuid v1.6.0