Ilia Denisov
91e34a0929
ARCHITECTURE.md §15 "Verification order" specifies signature verification (step 4) before payload_hash (step 5), but the authenticated-edge decorator chain wrapped the payload-hash gate outside the signature gate, so the hash was checked first. gateway/README.md and gateway/docs/flows.md had drifted to match the code (hash-first), leaving ARCHITECTURE.md as the lone source describing the intended order. Swap the two decorators in server.go so the signature gate runs first, and align README + flows.md to ARCHITECTURE.md. Signature-first is the cryptographically sound order: the signature covers the payload_hash field, so the request is authenticated before any of its content is processed. Observable side effect: a request carrying a tampered payload_hash whose signature was computed over the original hash is now rejected at the signature gate (UNAUTHENTICATED "invalid request signature") instead of the hash gate (INVALID_ARGUMENT). Security is unchanged — both refusals happen before the payload is handled. The four payload-hash unit tests re-sign over the tampered hash so they keep exercising the hash gate; the cross-service integration test signs over the overridden hash and already accepts both codes. Refs #39 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
81 lines
2.6 KiB
Go
81 lines
2.6 KiB
Go
package grpcapi
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
|
|
"galaxy/gateway/authn"
|
|
edgev1 "galaxy/gateway/proto/edge/v1"
|
|
|
|
"google.golang.org/grpc"
|
|
"google.golang.org/grpc/codes"
|
|
"google.golang.org/grpc/status"
|
|
)
|
|
|
|
// signatureVerifyingService applies client-signature verification after session
|
|
// lookup and before payload-hash verification and later routing steps run.
|
|
type signatureVerifyingService struct {
|
|
edgev1.UnimplementedGatewayServer
|
|
|
|
delegate edgev1.GatewayServer
|
|
}
|
|
|
|
// ExecuteCommand verifies req client signature before delegating to the
|
|
// configured service implementation.
|
|
func (s signatureVerifyingService) ExecuteCommand(ctx context.Context, req *edgev1.ExecuteCommandRequest) (*edgev1.ExecuteCommandResponse, error) {
|
|
if err := verifyRequestSignature(ctx); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return s.delegate.ExecuteCommand(ctx, req)
|
|
}
|
|
|
|
// SubscribeEvents verifies req client signature before delegating to the
|
|
// configured service implementation.
|
|
func (s signatureVerifyingService) SubscribeEvents(req *edgev1.SubscribeEventsRequest, stream grpc.ServerStreamingServer[edgev1.GatewayEvent]) error {
|
|
if err := verifyRequestSignature(stream.Context()); err != nil {
|
|
return err
|
|
}
|
|
|
|
return s.delegate.SubscribeEvents(req, stream)
|
|
}
|
|
|
|
// newSignatureVerifyingService wraps delegate with the client-signature
|
|
// verification gate.
|
|
func newSignatureVerifyingService(delegate edgev1.GatewayServer) edgev1.GatewayServer {
|
|
return signatureVerifyingService{delegate: delegate}
|
|
}
|
|
|
|
func verifyRequestSignature(ctx context.Context) error {
|
|
envelope, ok := parsedEnvelopeFromContext(ctx)
|
|
if !ok {
|
|
return status.Error(codes.Internal, "authenticated request context is incomplete")
|
|
}
|
|
|
|
record, ok := resolvedSessionFromContext(ctx)
|
|
if !ok {
|
|
return status.Error(codes.Internal, "authenticated request context is incomplete")
|
|
}
|
|
|
|
err := authn.VerifyRequestSignature(record.ClientPublicKey, envelope.Signature, authn.RequestSigningFields{
|
|
ProtocolVersion: envelope.ProtocolVersion,
|
|
DeviceSessionID: envelope.DeviceSessionID,
|
|
MessageType: envelope.MessageType,
|
|
TimestampMS: envelope.TimestampMS,
|
|
RequestID: envelope.RequestID,
|
|
PayloadHash: envelope.PayloadHash,
|
|
})
|
|
switch {
|
|
case err == nil:
|
|
return nil
|
|
case errors.Is(err, authn.ErrInvalidClientPublicKey):
|
|
return status.Error(codes.Unavailable, "session cache is unavailable")
|
|
case errors.Is(err, authn.ErrInvalidRequestSignature):
|
|
return status.Error(codes.Unauthenticated, "invalid request signature")
|
|
default:
|
|
return status.Error(codes.Internal, "request signature verification failed")
|
|
}
|
|
}
|
|
|
|
var _ edgev1.GatewayServer = signatureVerifyingService{}
|