Ilia Denisov
91e34a0929
ARCHITECTURE.md §15 "Verification order" specifies signature verification (step 4) before payload_hash (step 5), but the authenticated-edge decorator chain wrapped the payload-hash gate outside the signature gate, so the hash was checked first. gateway/README.md and gateway/docs/flows.md had drifted to match the code (hash-first), leaving ARCHITECTURE.md as the lone source describing the intended order. Swap the two decorators in server.go so the signature gate runs first, and align README + flows.md to ARCHITECTURE.md. Signature-first is the cryptographically sound order: the signature covers the payload_hash field, so the request is authenticated before any of its content is processed. Observable side effect: a request carrying a tampered payload_hash whose signature was computed over the original hash is now rejected at the signature gate (UNAUTHENTICATED "invalid request signature") instead of the hash gate (INVALID_ARGUMENT). Security is unchanged — both refusals happen before the payload is handled. The four payload-hash unit tests re-sign over the tampered hash so they keep exercising the hash gate; the cross-service integration test signs over the overridden hash and already accepts both codes. Refs #39 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
120 lines
4.8 KiB
Go
120 lines
4.8 KiB
Go
package grpcapi
|
|
|
|
import (
|
|
"context"
|
|
"crypto/sha256"
|
|
"testing"
|
|
|
|
"galaxy/gateway/internal/session"
|
|
|
|
"connectrpc.com/connect"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestExecuteCommandRejectsPayloadHashWithInvalidLength(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
delegate := &recordingGatewayService{}
|
|
server, runGateway := newTestGateway(t, ServerDependencies{
|
|
Service: delegate,
|
|
SessionCache: staticSessionCache{lookupFunc: func(context.Context, string) (session.Record, error) { return newActiveSessionRecord(), nil }},
|
|
})
|
|
defer runGateway.stop(t)
|
|
|
|
addr := waitForListenAddr(t, server)
|
|
client := newEdgeClient(t, addr)
|
|
|
|
req := newValidExecuteCommandRequest()
|
|
req.PayloadHash = []byte("short")
|
|
// Signature verification now precedes the payload-hash gate, so re-sign
|
|
// over the tampered hash to keep the signature valid and exercise the gate.
|
|
req.Signature = signRequest(req.GetProtocolVersion(), req.GetDeviceSessionId(), req.GetMessageType(), req.GetTimestampMs(), req.GetRequestId(), req.GetPayloadHash())
|
|
|
|
_, err := client.ExecuteCommand(context.Background(), connect.NewRequest(req))
|
|
require.Error(t, err)
|
|
assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err))
|
|
assert.Equal(t, "payload_hash must be a 32-byte SHA-256 digest", connectErrorMessage(t, err))
|
|
assert.Zero(t, delegate.executeCalls)
|
|
}
|
|
|
|
func TestExecuteCommandRejectsPayloadHashMismatch(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
delegate := &recordingGatewayService{}
|
|
server, runGateway := newTestGateway(t, ServerDependencies{
|
|
Service: delegate,
|
|
SessionCache: staticSessionCache{lookupFunc: func(context.Context, string) (session.Record, error) { return newActiveSessionRecord(), nil }},
|
|
})
|
|
defer runGateway.stop(t)
|
|
|
|
addr := waitForListenAddr(t, server)
|
|
client := newEdgeClient(t, addr)
|
|
|
|
req := newValidExecuteCommandRequest()
|
|
sum := sha256.Sum256([]byte("other"))
|
|
req.PayloadHash = sum[:]
|
|
// Signature verification now precedes the payload-hash gate, so re-sign
|
|
// over the tampered hash to keep the signature valid and exercise the gate.
|
|
req.Signature = signRequest(req.GetProtocolVersion(), req.GetDeviceSessionId(), req.GetMessageType(), req.GetTimestampMs(), req.GetRequestId(), req.GetPayloadHash())
|
|
|
|
_, err := client.ExecuteCommand(context.Background(), connect.NewRequest(req))
|
|
require.Error(t, err)
|
|
assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err))
|
|
assert.Equal(t, "payload_hash does not match payload_bytes", connectErrorMessage(t, err))
|
|
assert.Zero(t, delegate.executeCalls)
|
|
}
|
|
|
|
func TestSubscribeEventsRejectsPayloadHashWithInvalidLength(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
delegate := &recordingGatewayService{}
|
|
server, runGateway := newTestGateway(t, ServerDependencies{
|
|
Service: delegate,
|
|
SessionCache: staticSessionCache{lookupFunc: func(context.Context, string) (session.Record, error) { return newActiveSessionRecord(), nil }},
|
|
})
|
|
defer runGateway.stop(t)
|
|
|
|
addr := waitForListenAddr(t, server)
|
|
client := newEdgeClient(t, addr)
|
|
|
|
req := newValidSubscribeEventsRequest()
|
|
req.PayloadHash = []byte("short")
|
|
// Signature verification now precedes the payload-hash gate, so re-sign
|
|
// over the tampered hash to keep the signature valid and exercise the gate.
|
|
req.Signature = signRequest(req.GetProtocolVersion(), req.GetDeviceSessionId(), req.GetMessageType(), req.GetTimestampMs(), req.GetRequestId(), req.GetPayloadHash())
|
|
|
|
err := subscribeEventsError(t, context.Background(), client, req)
|
|
require.Error(t, err)
|
|
assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err))
|
|
assert.Equal(t, "payload_hash must be a 32-byte SHA-256 digest", connectErrorMessage(t, err))
|
|
assert.Zero(t, delegate.subscribeCalls)
|
|
}
|
|
|
|
func TestSubscribeEventsRejectsPayloadHashMismatch(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
delegate := &recordingGatewayService{}
|
|
server, runGateway := newTestGateway(t, ServerDependencies{
|
|
Service: delegate,
|
|
SessionCache: staticSessionCache{lookupFunc: func(context.Context, string) (session.Record, error) { return newActiveSessionRecord(), nil }},
|
|
})
|
|
defer runGateway.stop(t)
|
|
|
|
addr := waitForListenAddr(t, server)
|
|
client := newEdgeClient(t, addr)
|
|
|
|
req := newValidSubscribeEventsRequest()
|
|
sum := sha256.Sum256([]byte("other"))
|
|
req.PayloadHash = sum[:]
|
|
// Signature verification now precedes the payload-hash gate, so re-sign
|
|
// over the tampered hash to keep the signature valid and exercise the gate.
|
|
req.Signature = signRequest(req.GetProtocolVersion(), req.GetDeviceSessionId(), req.GetMessageType(), req.GetTimestampMs(), req.GetRequestId(), req.GetPayloadHash())
|
|
|
|
err := subscribeEventsError(t, context.Background(), client, req)
|
|
require.Error(t, err)
|
|
assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err))
|
|
assert.Equal(t, "payload_hash does not match payload_bytes", connectErrorMessage(t, err))
|
|
assert.Zero(t, delegate.subscribeCalls)
|
|
}
|