Merge commit from fork

Operator session tokens were stored verbatim in operator_sessions.token
(the primary key) — the same 32-byte hex value carried in the session
cookie. Anyone with read access to the database (backup, snapshot,
future SQL-injection sink) could lift every active session token and
hijack operator sessions with no further authentication.

Persist only SHA-256(token), mirroring the enrollment-token fix
(GHSA-ghmh-jhmj-wcmf) and operator_api_keys:

- models.HashSessionToken: at-rest representation of a raw token.
- Migration 019 renames operator_sessions.token -> token_hash. Existing
  rows hold raw values that can no longer match a hashed lookup, so they
  become unreachable and the operator re-authenticates — acceptable for
  a 24h-TTL session.
- The store hashes the token on insert and on every lookup
  (Get/GetPendingTwoFactor/Promote/Delete), so callers keep passing the
  raw cookie value; the raw token never touches disk.

Closes GHSA-q4vm-pq3q-8wgq.

Author: juev

internal/models/operator.go

@@ -58,6 +58,9 @@ const (
 // OperatorSession represents a UI session. A session in `pending_totp` state
 // is awaiting a second-factor verification and is not yet authenticated.
 type OperatorSession struct {
+	// Token is the raw session token carried in the operator's cookie. It is
+	// transient: the store persists only HashSessionToken(Token), never the
+	// raw value at rest (GHSA-q4vm-pq3q-8wgq).
 	Token      string
 	OperatorID string
 	State      SessionState

internal/models/token.go

@@ -28,3 +28,16 @@ func HashEnrollmentToken(raw string) string {
 	sum := sha256.Sum256([]byte(raw))
 	return hex.EncodeToString(sum[:])
 }
+
+// HashSessionToken produces the at-rest representation of a raw operator
+// session token. Closes GHSA-q4vm-pq3q-8wgq: previously the raw 32-byte hex
+// token was stored verbatim in operator_sessions.token and sent in the
+// session cookie, so anyone with read access to the DB (backup, snapshot,
+// future SQL-injection sink) could hijack every active operator session.
+//
+// Symmetric: same input → same hex → constant-time DB lookup. Mirrors the
+// enrollment-token and operator_api_keys hashing already done elsewhere.
+func HashSessionToken(raw string) string {
+	sum := sha256.Sum256([]byte(raw))
+	return hex.EncodeToString(sum[:])
+}

internal/store/migration_019_test.go

@@ -0,0 +1,64 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"testing"
+
+	_ "modernc.org/sqlite"
+)
+
+// migrations018 is the ordered up-migration set preceding 019.
+var migrations018 = append(append([]string{}, migrations017...),
+	"018_host_address_network_uniqueness.up.sql",
+)
+
+// TestMigration019_RenamesTokenToHash_AndDownRoundTrip verifies the
+// operator_sessions.token → token_hash rename (GHSA-q4vm-pq3q-8wgq) and the
+// down migration's reverse rename.
+func TestMigration019_RenamesTokenToHash_AndDownRoundTrip(t *testing.T) {
+	db, err := sql.Open("sqlite", ":memory:")
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	defer db.Close()
+
+	applyMigrationFiles(t, db, migrations018)
+
+	if !columnExistsInDB(t, db, "operator_sessions", "token") {
+		t.Fatal("token column should exist before 019")
+	}
+	if columnExistsInDB(t, db, "operator_sessions", "token_hash") {
+		t.Fatal("token_hash should not exist before 019")
+	}
+
+	if err := execMigrationFile(db, "019_session_token_hash.up.sql"); err != nil {
+		t.Fatalf("apply 019: %v", err)
+	}
+
+	if columnExistsInDB(t, db, "operator_sessions", "token") {
+		t.Error("token column should be gone after 019")
+	}
+	if !columnExistsInDB(t, db, "operator_sessions", "token_hash") {
+		t.Error("token_hash should exist after 019")
+	}
+
+	// token_hash must remain the primary key: a duplicate value is rejected.
+	mustExec(t, db, `INSERT INTO operators (id, username, display_name, password_hash) VALUES ('op1','u1','U1','h')`)
+	mustExec(t, db, `INSERT INTO operator_sessions (token_hash, operator_id, expires_at, created_at, state) VALUES ('h1','op1','2999-01-01','2000-01-01','authenticated')`)
+	if _, err := db.ExecContext(context.Background(),
+		`INSERT INTO operator_sessions (token_hash, operator_id, expires_at, created_at, state) VALUES ('h1','op1','2999-01-01','2000-01-01','authenticated')`); err == nil {
+		t.Error("token_hash should still be the primary key after rename (duplicate accepted)")
+	}
+
+	// Down round-trip: token_hash → token.
+	if err := execMigrationFile(db, "019_session_token_hash.down.sql"); err != nil {
+		t.Fatalf("apply 019 down: %v", err)
+	}
+	if !columnExistsInDB(t, db, "operator_sessions", "token") {
+		t.Error("token column should be back after 019 down")
+	}
+	if columnExistsInDB(t, db, "operator_sessions", "token_hash") {
+		t.Error("token_hash should be gone after 019 down")
+	}
+}

internal/store/migrations/019_session_token_hash.down.sql

@@ -0,0 +1,5 @@
+-- Down migration: revert column name. The application-layer application of
+-- SHA-256 cannot be reversed; the column will simply contain hex hashes that
+-- the (old) lookup-by-raw-token logic cannot match. Operators must
+-- re-authenticate after downgrade.
+ALTER TABLE operator_sessions RENAME COLUMN token_hash TO token;

internal/store/migrations/019_session_token_hash.up.sql

@@ -0,0 +1,14 @@
+-- GHSA-q4vm-pq3q-8wgq: store SHA-256 of operator session tokens at rest.
+--
+-- The old column held the raw 32-byte hex token verbatim — the same value
+-- sent in the session cookie — so anyone with read access to the DB (backup,
+-- snapshot, future SQL-injection sink) could hijack every active session. The
+-- application layer now writes SHA-256 hex and looks sessions up by that hash,
+-- mirroring the enrollment-token fix (016) and operator_api_keys.
+--
+-- Existing rows are kept in place: their column now nominally holds a "hash"
+-- but actually contains a raw token, so it can never match the hash computed
+-- from an incoming cookie and the session becomes unreachable. Operators simply
+-- re-authenticate — the same outcome as a brief restart, acceptable for a
+-- 24h-TTL session token.
+ALTER TABLE operator_sessions RENAME COLUMN token TO token_hash;

internal/store/sqlite.go

@@ -126,6 +126,7 @@ func (s *SQLiteStore) Migrate(ctx context.Context) error {
 		"016_enrollment_token_hash.up.sql",
 		"017_pop_nonces.up.sql",
 		"018_host_address_network_uniqueness.up.sql",
+		"019_session_token_hash.up.sql",
 	}
 
 	// Tracking table. Created once; idempotent on subsequent starts.

internal/store/sqlite_operators.go

@@ -585,9 +585,11 @@ func (s *SQLiteStore) CreateOperatorSession(ctx context.Context, sess *models.Op
 	if state == "" {
 		state = models.SessionStateAuthenticated
 	}
+	// GHSA-q4vm-pq3q-8wgq: persist only the SHA-256 of the token. The raw
+	// value lives solely in the operator's cookie, never at rest.
 	_, err := s.db.ExecContext(ctx,
-		`INSERT INTO operator_sessions (token, operator_id, expires_at, created_at, state) VALUES (?, ?, ?, ?, ?)`,
-		sess.Token, sess.OperatorID, sess.ExpiresAt, sess.CreatedAt, state,
+		`INSERT INTO operator_sessions (token_hash, operator_id, expires_at, created_at, state) VALUES (?, ?, ?, ?, ?)`,
+		models.HashSessionToken(sess.Token), sess.OperatorID, sess.ExpiresAt, sess.CreatedAt, state,
 	)
 	if err != nil {
 		return fmt.Errorf("insert session: %w", err)
@@ -600,8 +602,8 @@ func (s *SQLiteStore) CreateOperatorSession(ctx context.Context, sess *models.Op
 // pending_totp state are NOT returned here.
 func (s *SQLiteStore) GetOperatorBySession(ctx context.Context, token string) (*models.Operator, error) {
 	row := s.db.QueryRowContext(ctx,
-		`SELECT operator_id, expires_at, state FROM operator_sessions WHERE token=?`,
-		token,
+		`SELECT operator_id, expires_at, state FROM operator_sessions WHERE token_hash=?`,
+		models.HashSessionToken(token),
 	)
 	var (
 		operatorID string
@@ -639,8 +641,8 @@ func (s *SQLiteStore) GetOperatorBySession(ctx context.Context, token string) (*
 // be active. Sessions already authenticated are not returned.
 func (s *SQLiteStore) GetPendingTwoFactorOperator(ctx context.Context, token string) (*models.Operator, error) {
 	row := s.db.QueryRowContext(ctx,
-		`SELECT operator_id, expires_at, state FROM operator_sessions WHERE token=?`,
-		token,
+		`SELECT operator_id, expires_at, state FROM operator_sessions WHERE token_hash=?`,
+		models.HashSessionToken(token),
 	)
 	var (
 		operatorID string
@@ -678,8 +680,8 @@ func (s *SQLiteStore) GetPendingTwoFactorOperator(ctx context.Context, token str
 // does not exist or is not pending.
 func (s *SQLiteStore) PromoteOperatorSession(ctx context.Context, token string, newExpiry time.Time) error {
 	result, err := s.db.ExecContext(ctx,
-		`UPDATE operator_sessions SET state=?, expires_at=? WHERE token=? AND state=?`,
-		models.SessionStateAuthenticated, newExpiry, token, models.SessionStatePendingTOTP,
+		`UPDATE operator_sessions SET state=?, expires_at=? WHERE token_hash=? AND state=?`,
+		models.SessionStateAuthenticated, newExpiry, models.HashSessionToken(token), models.SessionStatePendingTOTP,
 	)
 	if err != nil {
 		return fmt.Errorf("promote session: %w", err)
@@ -695,7 +697,7 @@ func (s *SQLiteStore) PromoteOperatorSession(ctx context.Context, token string,
 }
 
 func (s *SQLiteStore) DeleteOperatorSession(ctx context.Context, token string) error {
-	_, err := s.db.ExecContext(ctx, `DELETE FROM operator_sessions WHERE token=?`, token)
+	_, err := s.db.ExecContext(ctx, `DELETE FROM operator_sessions WHERE token_hash=?`, models.HashSessionToken(token))
 	if err != nil {
 		return fmt.Errorf("delete session: %w", err)
 	}

internal/store/sqlite_session_hash_test.go

@@ -0,0 +1,66 @@
+package store
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/forgekeep/nebula-mesh/internal/models"
+)
+
+// TestCreateOperatorSession_StoresHashNotRaw covers GHSA-q4vm-pq3q-8wgq: the
+// session token must be persisted as its SHA-256 hash, never as the raw value
+// that travels in the cookie. A DB read (backup/snapshot) must not yield a
+// usable session token.
+func TestCreateOperatorSession_StoresHashNotRaw(t *testing.T) {
+	s := newTestStore(t)
+	ctx := context.Background()
+	op := newTestOperator(t, s, "dave")
+
+	const raw = "raw-session-token-deadbeef"
+	if err := s.CreateOperatorSession(ctx, &models.OperatorSession{
+		Token:      raw,
+		OperatorID: op.ID,
+		ExpiresAt:  time.Now().Add(time.Hour),
+	}); err != nil {
+		t.Fatalf("create session: %v", err)
+	}
+
+	// At rest the column holds the hash, not the raw token.
+	var stored string
+	if err := s.db.QueryRowContext(ctx,
+		`SELECT token_hash FROM operator_sessions WHERE operator_id=?`, op.ID).Scan(&stored); err != nil {
+		t.Fatalf("read token_hash: %v", err)
+	}
+	if want := models.HashSessionToken(raw); stored != want {
+		t.Errorf("stored token_hash = %q, want %q", stored, want)
+	}
+	if stored == raw {
+		t.Error("raw session token persisted verbatim at rest")
+	}
+
+	// No row anywhere holds the raw token value.
+	var rawRows int
+	if err := s.db.QueryRowContext(ctx,
+		`SELECT COUNT(*) FROM operator_sessions WHERE token_hash=?`, raw).Scan(&rawRows); err != nil {
+		t.Fatalf("count raw rows: %v", err)
+	}
+	if rawRows != 0 {
+		t.Errorf("found %d rows storing the raw token", rawRows)
+	}
+
+	// Lookup by the raw token (as carried in the cookie) still works.
+	got, err := s.GetOperatorBySession(ctx, raw)
+	if err != nil {
+		t.Fatalf("lookup by raw token: %v", err)
+	}
+	if got.ID != op.ID {
+		t.Errorf("session resolved to %q, want %q", got.ID, op.ID)
+	}
+
+	// A wrong token does not resolve.
+	if _, err := s.GetOperatorBySession(ctx, "not-the-token"); !errors.Is(err, ErrNotFound) {
+		t.Errorf("wrong token err = %v, want ErrNotFound", err)
+	}
+}