AdminModule treats from == 0 as a local client, skipping the admin_key and
session-passkey checks. That trust rested entirely on every ingress path
dropping from == 0 (RadioLibInterface, MQTT downlink, UDP multicast and
frame injection all do). Make the handler check it itself:
- MeshModule gains a static currentRequestSource, set by callModules()
alongside currentRequest, so modules can see the RxSource of the packet
they are handling.
- AdminModule drops a from == 0 payload unless callModules() is dispatching
that exact packet with RX_SRC_USER or RX_SRC_LOCAL. It fails closed for a
radio source, for no dispatch context, and for a context that belongs to
another packet. The drop is silent (no NAK to a forged sender).
Tests: AdminModuleTestShim::handleReceivedProtobuf now runs the handler
inside a dispatch context (default RX_SRC_USER, the phone client existing
suites stand in for), plus handleWithDispatchContext() for the negative
cases. test_admin_session_repro adds six cases: from == 0 via RX_SRC_RADIO,
with no context, and with another packet's context are rejected, both
directly and through MeshModule::callModules(); the phone-client controls
still apply the setter. With the gate removed, the four rejection cases fail.
Claude-Session: https://claude.ai/code/session_01Y1BYe4ahUHxyhw3nGTX67D
Co-authored-by: Claude <noreply@anthropic.com>
