fix(security): require admin auth for QR code validation bypass flag

[failsafesecurity]

Security Fix: Operator QR Code Validation Bypass via Unguarded CLI Flag (-o)

Severity: Medium
Finding ID: cmsdegzmm003sob01zv0pkewz

Problem

The orb-core operator CLI flag -o (--operator-qr-code) allows providing a custom operator QR code that completely bypasses backend QR code validation. When this flag is set:

1. The operator QR code is not scanned from the camera — it is injected directly from the CLI argument
2. In verify_operator_qr_code(), when operator_qr_code_override.is_some(), backend verification is skipped entirely, returning dummy "DEV" location data
3. No authentication or authorization check is performed before allowing this bypass

This means any operator with CLI access can submit invalid or manipulated QR codes through the orb device flow, bypassing the operator identity verification that the backend normally performs.

Code Location

// src/plans/mod.rs — verify_operator_qr_code()
if qr_code.signup_extension() || self.operator_qr_code_override.is_some() {
    // Bypass: returns Ok with dummy DEV data, no auth check
    return Ok(Some((0, backend::operator_status::LocationData {
        team_operating_country: "DEV".to_string(),
        ...
    })));
}

Fix

Gate the -o bypass behind the stage feature flag (development builds only):

• Production builds: The bypass is rejected with an error log (SECURITY: Operator QR code validation bypass via CLI -o flag is only permitted in stage builds) and a failure metric increment
• Stage builds: The bypass works but logs a warning (SECURITY: Operator QR code validation bypass is active (stage build))
• The signup_extension() path is unchanged (it has its own validation logic)

This ensures the bypass can only be used in development/testing environments, not in production where it could be abused.

Testing

• In production builds: using -o with any QR code will now fail operator validation instead of bypassing it
• In stage builds: using -o will work as before but with a warning log
• The normal QR scanning flow (without -o) is unaffected

---

Submitted by FailSafe Security Research