Comparing changes

… env vars Resolves painful auth bootstrap UX where the admin token was only shown once on first start with no recovery path short of deleting the auth DB. - ARC_AUTH_BOOTSTRAP_TOKEN: use a known token value on first run instead of generating a random one — enables reproducible/automated deployments - ARC_AUTH_FORCE_BOOTSTRAP: wipe all tokens and recreate admin with the provided value — recovery path when admin token has been lost - Both values require minimum 32 characters; stored as bcrypt hash Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…all) Deleting all tokens on ARC_AUTH_FORCE_BOOTSTRAP was dangerous — a bad actor with env var access could lock out all legitimate admins. Changed to additive recovery: a new 'arc-recovery' admin token is added without touching existing tokens. Legitimate admins retain access and can revoke the recovery token if it was injected maliciously. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…otstrap methods - Fix TOCTOU race in EnsureInitialToken/EnsureInitialTokenWithValue: replace COUNT→INSERT two-step with a single atomic INSERT...WHERE NOT EXISTS, so concurrent node startups can never produce duplicate admin tokens - Extract insertToken private helper: CreateToken and CreateTokenWithValue shared ~90% identical DB insertion code; now both delegate to one place - Fix stale ForceBootstrap config comment (previously said "delete all tokens", now correctly says "add recovery token without removing existing ones") - Fix misleading comment in ForceAddRecoveryToken ("rotate it to new value" was not implemented; comment now reflects the actual no-op behavior) - Add 13 test cases covering CreateTokenWithValue, EnsureInitialTokenWithValue, and ForceAddRecoveryToken including concurrent safety and idempotency Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

… progress doc - insertToken signature had tokenValue as first arg but never used it; removed per Gemini review - docs/progress file still described ForceBootstrap as deleting all tokens; updated to reflect actual additive behavior Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat(auth): add ARC_AUTH_BOOTSTRAP_TOKEN and ARC_AUTH_FORCE_BOOTSTRAP for predictable deployments and recovery

…patibility RollingUpdate deadlocks with a single replica and a ReadWriteOnce PVC: the new pod can't attach the volume until the old pod terminates, but RollingUpdate waits for the new pod to be healthy first. Recreate terminates the old pod first, then starts the new one. Configurable via updateStrategy.type (default: Recreate). Override to RollingUpdate when using shared object storage with Arc Enterprise clustering. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Allows users who switch to RollingUpdate to also configure maxSurge and maxUnavailable via values, per Gemini review suggestion. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix(helm): default deployment strategy to Recreate for RWO volume compatibility

- chmod 0600 on CreateTemp files in restore, delete, and duckdb profiling to prevent world-readable parquet data and profile output (closes #362) - validate memory_limit with regex before SQL interpolation in compaction subprocess to prevent injection via config (closes #363) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Centralize memory_limit validation in config.Load() with a regex guard instead of at each call site. os.CreateTemp already creates 0600 files so chmod calls were redundant and have been removed. Addresses Gemini review feedback on #368. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix(security): restrict temp file permissions and validate memory_limit

Navigation Menu

Uh oh!

Comparing changes

Open a pull request

Commits on Apr 1, 2026

This comparison is taking too long to generate.

Uh oh!