Verify #458: document ALLOW_ZERO_RATE_LIMITS opt-out #992

2026-06-30T22:19:12Z

PlasticDigits commented

2026-06-30 22:19:12 +00:00

(Migrated from gitlab.com)

Summary

Verification of GitLab #458 found the startup guard and unit tests already merged on main (from !983), but operator docs did not yet document ALLOW_ZERO_RATE_LIMITS=1 or the non-loopback bind rule. This MR adds that documentation to docs/operator-secrets.md, docs/indexer-invariants.md, and skills/AGENTS_INDEXER_API_LCD_SECURITY.md.

Verification checklist (#458)

Acceptance item	Result	How verified
Startup check: non-loopback bind + both rate limits 0 causes startup failure or explicit opt-out	PASS	`indexer/src/config.rs` lines 196–215: `ConfigError::ZeroRateLimitNonLoopbackBind` when dual-zero, non-loopback, non-prod, and `ALLOW_ZERO_RATE_LIMITS` unset
Test: config load with both limits 0 and non-loopback bind triggers error	PASS	`cargo test --lib config::` — 14/14 pass, including `dev_dual_zero_rate_limits_nonloopback_bind_rejected`, `dev_dual_zero_rate_limits_nonloopback_bind_allowed_with_optout`, `dev_dual_zero_rate_limits_loopback_bind_loads`, `prod_dual_zero_nonloopback_bind_loads_via_clamp`
`docs/operator-secrets.md` documents `ALLOW_ZERO_RATE_LIMITS=1` opt-out	PASS (this MR)	Added `ALLOW_ZERO_RATE_LIMITS` and `API_BIND` rows; cross-linked #458 in rate-limit and `RUN_MODE=prod` sections
Existing Playwright / local-dev env unaffected (loopback bind)	PASS	`deploy-dex-local.sh` writes `API_BIND=127.0.0.1`, `RATE_LIMIT_RPS=0`, `RATE_LIMIT_LCD_HEAVY_RPS=10` (not dual-zero); `dev_dual_zero_rate_limits_still_loads` and `dev_dual_zero_rate_limits_loopback_bind_loads` pass

Test plan

cd indexer && cargo test --lib config:: (14 passed)
Grep docs for ALLOW_ZERO_RATE_LIMITS and #458 cross-links

## Summary Verification of GitLab #458 found the startup guard and unit tests already merged on `main` (from !983), but operator docs did not yet document `ALLOW_ZERO_RATE_LIMITS=1` or the non-loopback bind rule. This MR adds that documentation to `docs/operator-secrets.md`, `docs/indexer-invariants.md`, and `skills/AGENTS_INDEXER_API_LCD_SECURITY.md`. ## Verification checklist (#458) | Acceptance item | Result | How verified | |-----------------|--------|--------------| | Startup check: non-loopback bind + both rate limits 0 causes startup failure or explicit opt-out | **PASS** | `indexer/src/config.rs` lines 196–215: `ConfigError::ZeroRateLimitNonLoopbackBind` when dual-zero, non-loopback, non-prod, and `ALLOW_ZERO_RATE_LIMITS` unset | | Test: config load with both limits 0 and non-loopback bind triggers error | **PASS** | `cargo test --lib config::` — 14/14 pass, including `dev_dual_zero_rate_limits_nonloopback_bind_rejected`, `dev_dual_zero_rate_limits_nonloopback_bind_allowed_with_optout`, `dev_dual_zero_rate_limits_loopback_bind_loads`, `prod_dual_zero_nonloopback_bind_loads_via_clamp` | | `docs/operator-secrets.md` documents `ALLOW_ZERO_RATE_LIMITS=1` opt-out | **PASS** (this MR) | Added `ALLOW_ZERO_RATE_LIMITS` and `API_BIND` rows; cross-linked #458 in rate-limit and `RUN_MODE=prod` sections | | Existing Playwright / local-dev env unaffected (loopback bind) | **PASS** | `deploy-dex-local.sh` writes `API_BIND=127.0.0.1`, `RATE_LIMIT_RPS=0`, `RATE_LIMIT_LCD_HEAVY_RPS=10` (not dual-zero); `dev_dual_zero_rate_limits_still_loads` and `dev_dual_zero_rate_limits_loopback_bind_loads` pass | ## Test plan - [x] `cd indexer && cargo test --lib config::` (14 passed) - [x] Grep docs for `ALLOW_ZERO_RATE_LIMITS` and #458 cross-links

PlasticDigits commented

2026-06-30 22:20:40 +00:00

(Migrated from gitlab.com)

Security review — MR !992

Commit reviewed: 1c7f9b1c82cfde1f58beb4040f9b105bb51b0f07
Scope: Documentation-only diff — docs/indexer-invariants.md, docs/operator-secrets.md, skills/AGENTS_INDEXER_API_LCD_SECURITY.md (GitLab #458 ALLOW_ZERO_RATE_LIMITS opt-out and non-loopback bind rule).

Method: Inspected full MR diff; traced documented controls against existing implementation in indexer/src/config.rs (bind_is_loopback, ConfigError::ZeroRateLimitNonLoopbackBind, prod rate-limit clamp at lines 196–215 and 248–282). No attacker-controlled input paths or executable code changed in this MR.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

The MR adds operator/agent documentation for an already-merged startup guard (!983). Documented behavior matches code:

Non-prod dual-zero (RATE_LIMIT_RPS=0 + RATE_LIMIT_LCD_HEAVY_RPS=0) on a non-loopback API_BIND refuses startup unless ALLOW_ZERO_RATE_LIMITS=1.
Loopback binds (127.0.0.1, localhost, ::1) are exempt.
RUN_MODE=prod clamps both limits to 60/10 regardless; the #458 guard does not apply in prod.

No injection, authz bypass, secret leakage, SSRF/XSS, or supply-chain changes introduced. Documenting the intentional opt-out does not expand runtime attack surface (requires operator env access).

Inline threads: none (no findings to anchor).

## Security review — MR !992 **Commit reviewed:** `1c7f9b1c82cfde1f58beb4040f9b105bb51b0f07` **Scope:** Documentation-only diff — `docs/indexer-invariants.md`, `docs/operator-secrets.md`, `skills/AGENTS_INDEXER_API_LCD_SECURITY.md` (GitLab #458 `ALLOW_ZERO_RATE_LIMITS` opt-out and non-loopback bind rule). **Method:** Inspected full MR diff; traced documented controls against existing implementation in `indexer/src/config.rs` (`bind_is_loopback`, `ConfigError::ZeroRateLimitNonLoopbackBind`, prod rate-limit clamp at lines 196–215 and 248–282). No attacker-controlled input paths or executable code changed in this MR. **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. The MR adds operator/agent documentation for an already-merged startup guard (!983). Documented behavior matches code: - Non-prod dual-zero (`RATE_LIMIT_RPS=0` + `RATE_LIMIT_LCD_HEAVY_RPS=0`) on a non-loopback `API_BIND` refuses startup unless `ALLOW_ZERO_RATE_LIMITS=1`. - Loopback binds (`127.0.0.1`, `localhost`, `::1`) are exempt. - `RUN_MODE=prod` clamps both limits to 60/10 regardless; the #458 guard does not apply in prod. No injection, authz bypass, secret leakage, SSRF/XSS, or supply-chain changes introduced. Documenting the intentional opt-out does not expand runtime attack surface (requires operator env access). **Inline threads:** none (no findings to anchor).

PlasticDigits commented

2026-07-01 00:06:28 +00:00

(Migrated from gitlab.com)

mentioned in commit b1407f63d0

mentioned in commit b1407f63d0bac164d2b02f03c542c80c375db076