feat(security): require setup token for admin init and restore [BE-13029] (#2770)

api/http/handler/users/admin_init.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security/setuptoken"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
@@ -31,17 +32,23 @@ func (payload *adminInitPayload) Validate(r *http.Request) error {
 // @id UserAdminInit
 // @summary Initialize administrator account
 // @description Initialize the 'admin' user account.
-// @description **Access policy**: public
+// @description **Access policy**: public (requires the X-Setup-Token header on an uninitialized instance unless --no-setup-token is set)
 // @tags users
 // @accept json
 // @produce json
+// @param X-Setup-Token header string false "Setup token (required when instance is uninitialized and --no-setup-token is not set)"
 // @param body body adminInitPayload true "User details"
 // @success 200 {object} portainer.User "Success"
 // @failure 400 "Invalid request"
+// @failure 403 "Access denied - invalid or missing setup token"
 // @failure 409 "Admin user already initialized"
 // @failure 500 "Server error"
 // @router /users/admin/init [post]
 func (handler *Handler) adminInit(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	if err := setuptoken.Validate(r, handler.SetupToken); err != nil {
+		return err
+	}
+
 	var payload adminInitPayload
 	err := request.DecodeAndValidateJSONPayload(r, &payload)
 	if err != nil {

api/http/handler/users/admin_init_test.go

@@ -0,0 +1,65 @@
+package users
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/portainer/portainer/api/apikey"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/http/security/setuptoken"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newAdminInitHandler(t *testing.T) *Handler {
+	t.Helper()
+	_, store := datastore.MustNewTestStore(t, true, false)
+	rateLimiter := security.NewRateLimiter(10, 1*time.Second, 1*time.Hour)
+	apiKeyService := apikey.NewAPIKeyService(store.APIKeyRepository(), store.User())
+	h := NewHandler(testhelpers.NewTestRequestBouncer(), rateLimiter, apiKeyService, mockPasswordStrengthChecker{})
+	h.DataStore = store
+	h.CryptoService = testhelpers.NewCryptoService()
+	h.AdminCreationDone = make(chan struct{}, 1)
+	return h
+}
+
+func Test_adminInit_setupTokenGate(t *testing.T) {
+	t.Parallel()
+
+	t.Run("403 without token header", func(t *testing.T) {
+		handler := newAdminInitHandler(t)
+		handler.SetupToken = "secret-token"
+		body := strings.NewReader(`{"Username":"admin","Password":"abcdefgh12"}`)
+		r := httptest.NewRequest(http.MethodPost, "/users/admin/init", body)
+		err := handler.adminInit(httptest.NewRecorder(), r)
+		require.NotNil(t, err)
+		assert.Equal(t, http.StatusForbidden, err.StatusCode)
+	})
+
+	t.Run("403 with wrong token", func(t *testing.T) {
+		handler := newAdminInitHandler(t)
+		handler.SetupToken = "secret-token"
+		body := strings.NewReader(`{"Username":"admin","Password":"abcdefgh12"}`)
+		r := httptest.NewRequest(http.MethodPost, "/users/admin/init", body)
+		r.Header.Set(setuptoken.HeaderName, "wrong")
+		err := handler.adminInit(httptest.NewRecorder(), r)
+		require.NotNil(t, err)
+		assert.Equal(t, http.StatusForbidden, err.StatusCode)
+	})
+
+	t.Run("succeeds with correct token", func(t *testing.T) {
+		handler := newAdminInitHandler(t)
+		handler.SetupToken = "secret-token"
+		body := strings.NewReader(`{"Username":"admin","Password":"abcdefgh12"}`)
+		r := httptest.NewRequest(http.MethodPost, "/users/admin/init", body)
+		r.Header.Set(setuptoken.HeaderName, "secret-token")
+		err := handler.adminInit(httptest.NewRecorder(), r)
+		assert.Nil(t, err)
+	})
+}

api/http/handler/users/handler.go

@@ -35,6 +35,7 @@ type Handler struct {
 	passwordStrengthChecker security.PasswordStrengthChecker
 	AdminCreationDone       chan<- struct{}
 	FileService             portainer.FileService
+	SetupToken              string
 }
 
 // NewHandler creates a handler to manage user operations.