fix: disable pod creation in single-user mode - #258
Conversation
Returns 403 when POST /.pods is called with --single-user enabled. Closes #257
There was a problem hiding this comment.
Pull request overview
This PR updates the server’s pod-creation endpoint to enforce --single-user semantics by rejecting new pod creation requests when single-user mode is enabled, addressing Issue #257’s security expectation for single-user deployments.
Changes:
- Return HTTP 403 for
POST /.podswhensingleUseris enabled. - Keep existing per-IP rate limiting and pod creation handling for non-single-user mode.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| keyGenerator: (request) => request.ip | ||
| // Disabled in single-user mode | ||
| if (singleUser) { | ||
| fastify.post('/.pods', async (request, reply) => { |
There was a problem hiding this comment.
In single-user mode this route no longer has the per-IP rate limit (1/day) that exists in the non-single-user branch. Even though it always returns 403, removing the limiter is a behavior regression that makes it easier to spam the endpoint (CPU/log noise). Consider keeping the same rateLimit config on the single-user handler as well.
| fastify.post('/.pods', async (request, reply) => { | |
| fastify.post('/.pods', { | |
| config: { | |
| rateLimit: { | |
| max: 1, | |
| timeWindow: '1 day', | |
| keyGenerator: (request) => request.ip | |
| } | |
| } | |
| }, async (request, reply) => { |
| // Disabled in single-user mode | ||
| if (singleUser) { | ||
| fastify.post('/.pods', async (request, reply) => { | ||
| return reply.code(403).send({ error: 'Pod creation disabled in single-user mode' }); |
There was a problem hiding this comment.
The 403 response body here uses { error: 'Pod creation disabled in single-user mode' }, which is inconsistent with other 403 JSON responses (typically { error: 'Forbidden', message: ... }, e.g. auth middleware). Aligning the shape/fields would make error handling more consistent for API clients.
| return reply.code(403).send({ error: 'Pod creation disabled in single-user mode' }); | |
| return reply.code(403).send({ | |
| error: 'Forbidden', | |
| message: 'Pod creation disabled in single-user mode' | |
| }); |
| // Disabled in single-user mode | ||
| if (singleUser) { | ||
| fastify.post('/.pods', async (request, reply) => { | ||
| return reply.code(403).send({ error: 'Pod creation disabled in single-user mode' }); | ||
| }); | ||
| } else { |
There was a problem hiding this comment.
This change introduces new single-user-specific behavior (POST /.pods must return 403), but there doesn’t appear to be a corresponding automated test covering single-user mode in the existing pod lifecycle tests. Adding a test case would prevent regressions and ensure the behavior stays enforced.
Summary
POST /.podsnow returns 403 when--single-useris enabledCloses #257
Test plan