aiolabs/bitspire
9
0
Fork 0
Code Issues 52 Pull requests 2 Projects Releases Packages Wiki Activity Actions

fix(access): dev unlock defaults OFF

Browse source 
ACCESS_DEV_UNLOCK was opt-out (anything but 'false' enabled it) and
access.example.json shipped it on, so a gated production machine would
render a visible gate-bypass button on the lock screen by default. Flip
to opt-in (=== 'true'), update the example file and the provisioning
schema comment to match.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Padreug 2026-09-20 14:11:38 +02:00
commit 04767080a1
4 changed files with 8 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

6
apps/machine/.env.example
View file

@ -108,9 +108,9 @@ VITE_SPIRE_SEED=
# Turn OFF once a real allow-list (/var/lib/bitspire/access.json) is provisioned.
# ACCESS_OPEN_ENROLLMENT=true
# Allow the on-screen runtime dev/operator unlock button (default: allowed when
# the gate is on). Set to 'false' to hide it on a locked-down deployment.
# ACCESS_DEV_UNLOCK=false
# Show the on-screen runtime dev/operator unlock button on the locked screen.
# Default OFF — it bypasses the gate, so enable only on a bench/dev machine.
# ACCESS_DEV_UNLOCK=true
# Per-machine salt for hashing credentials/PINs. Provision a real value in
# production (or in access.json); a fixed default is used if unset.

5
apps/machine/electron/main.ts
View file

@ -181,8 +181,9 @@ function loadAccessControl() {
// deployed machine by dropping a file + restarting the service, with no image
// rebuild. Defaults OFF.
let enabled = process.env.ACCESS_CONTROL_ENABLED === 'true'
// Dev unlock allowed by default when the gate is on; opt out explicitly.
let devUnlock = process.env.ACCESS_DEV_UNLOCK !== 'false'
// Dev unlock is OFF unless explicitly enabled: a gated machine must not ship
// a visible bypass button by default.
let devUnlock = process.env.ACCESS_DEV_UNLOCK === 'true'
let openEnrollment = process.env.ACCESS_OPEN_ENROLLMENT === 'true'
let salt = process.env.ACCESS_SALT || ''
let allowList: AccessAllowListEntry[] = []