From d476346ef4ded684cca3e91192cfe9c2d0fdc2b6 Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Mon, 8 Jun 2026 10:09:50 +0200
Subject: [PATCH] fix(users): postinst also chowns auth.toml (ref #498)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

After Phase 7.D consolidation, the aggregator runs as user `secubox`.
secubox_core.user_store reads BOTH /etc/secubox/users.json and (as
fallback) /etc/secubox/auth.toml. The secubox-users postinst chowned
users.json to root:secubox 0640, but auth.toml had NEVER been touched
by any postinst — left at the package default 0600 root:root since the
secubox-auth 0.1.0 install in May 2026.

Live symptom : every admin login returned "Identifiants incorrects"
no matter what password was typed. The aggregator log showed :

  user_store: fallback to auth.toml for get_user(admin)
  user_store: auth.toml unreadable ([Errno 13] Permission denied:
              '/etc/secubox/auth.toml')

The fallback path was the only reason auth.toml mattered at all (the
canonical store is users.json) — but with users.json reset to root:root
by an earlier intervention, the fallback became the active path and
its permission denial took down the entire auth chain.

This commit ensures both files are root:secubox 0640 after every
package install / upgrade.
---
 packages/secubox-users/debian/changelog | 13 +++++++++++++
 packages/secubox-users/debian/postinst  | 13 +++++++++++--
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/packages/secubox-users/debian/changelog b/packages/secubox-users/debian/changelog
index b9074015..0ae5242f 100644
--- a/packages/secubox-users/debian/changelog
+++ b/packages/secubox-users/debian/changelog
@@ -1,3 +1,16 @@
+secubox-users (1.4.2-1~bookworm1) bookworm; urgency=medium
+
+  * Fix (#498) : postinst now also chowns /etc/secubox/auth.toml to
+    root:secubox 0640 (only users.json was covered before). Without
+    this both files were unreadable by the aggregator user (secubox)
+    after Phase 7.D consolidation : user_store.get_user(admin) fell
+    through to auth.toml fallback which was ALSO unreadable, and
+    every login returned 'Identifiants incorrects' regardless of
+    password. Live diagnostic on gk2 surfaced two stacked permission
+    denials — auth.toml has never had its perms set by any postinst.
+
+ -- Gérald Kerma <devel@cybermind.fr>  lun., 08 juin 2026 08:09:50 +0000
+
 secubox-users (1.4.1-1~bookworm1) bookworm; urgency=low
 
   * Rewrite Description to identify this as local-account management
diff --git a/packages/secubox-users/debian/postinst b/packages/secubox-users/debian/postinst
index 9ee5d10b..5e97383d 100755
--- a/packages/secubox-users/debian/postinst
+++ b/packages/secubox-users/debian/postinst
@@ -42,10 +42,19 @@ if not any(u['username'] == username for u in doc['users']):
 PYEOF
         done
 
-        # Ownership + permissions on users.json
+        # Ownership + permissions on users.json + auth.toml (Phase 7 #498).
+        # Both files are read by the aggregator (running as `secubox`) via
+        # secubox_core.user_store. Without root:secubox 0640 they're
+        # invisible to non-root services and every login returns
+        # "Identifiants incorrects" because user_store falls through to
+        # the auth.toml fallback which is then ALSO unreadable.
         if [ -f /etc/secubox/users.json ]; then
-            chmod 660 /etc/secubox/users.json
             chown root:secubox /etc/secubox/users.json
+            chmod 0640 /etc/secubox/users.json
+        fi
+        if [ -f /etc/secubox/auth.toml ]; then
+            chown root:secubox /etc/secubox/auth.toml
+            chmod 0640 /etc/secubox/auth.toml
         fi
 
         # Restart the service so it picks up the new users.json