2 Commits

Author	SHA1	Message	Date
Alejandro Gutiérrez	0c4a9591fa	feat(broker): invite signature verification + atomic one-time-use ... Completes the v0.1.0 security model. Every /join is now gated by a signed invite that the broker re-verifies against the mesh owner's ed25519 pubkey, plus an atomic single-use counter. schema (migrations/0001_demonic_karnak.sql): - mesh.mesh.owner_pubkey: ed25519 hex of the invite signer - mesh.invite.token_bytes: canonical signed bytes (for re-verification) Both nullable; required for new meshes going forward. canonical invite format (signed bytes): `${v}|${mesh_id}|${mesh_slug}|${broker_url}|${expires_at}| ${mesh_root_key}|${role}|${owner_pubkey}` wire format — invite payload in ic://join/<base64url(JSON)> now has: owner_pubkey: "<64 hex>" signature: "<128 hex>" broker joinMesh() (apps/broker/src/broker.ts): 1. verify ed25519 signature over canonical bytes using payload's owner_pubkey → else invite_bad_signature 2. load mesh, ensure mesh.owner_pubkey matches payload's owner_pubkey → else invite_owner_mismatch (prevents a malicious admin from substituting their own owner key) 3. load invite row by token, verify mesh_id matches → else invite_mesh_mismatch 4. expiry check → else invite_expired 5. revoked check → else invite_revoked 6. idempotency: if pubkey is already a member, return existing id WITHOUT burning an invite use 7. atomic CAS: UPDATE used_count = used_count + 1 WHERE used_count < max_uses → if 0 rows affected, return invite_exhausted 8. insert member with role from payload cli side: - apps/cli/src/invite/parse.ts: zod-validated owner_pubkey + signature fields; client verifies signature immediately and rejects tampered links (fail-fast before even touching the broker) - buildSignedInvite() helper: owners sign invites client-side - enrollWithBroker sends {invite_token, invite_payload, peer_pubkey, display_name} (was: {mesh_id, peer_pubkey, display_name, role}) - parseInviteLink is now async (libsodium ready + verify) seed-test-mesh.ts generates an owner keypair, sets mesh.owner_pubkey, builds + signs an invite, stores the invite row, emits ownerPubkey + ownerSecretKey + inviteToken + inviteLink in the output JSON. tests — invite-signature.test.ts (9 new): - valid signed invite → join succeeds - tampered payload → invite_bad_signature - signer not the mesh owner → invite_owner_mismatch - expired invite → invite_expired - revoked invite → invite_revoked - exhausted (maxUses=2, 3rd join) → invite_exhausted - idempotent re-join doesn't burn a use - atomic single-use: 5 concurrent joins → exactly 1 success, 4 exhausted - mesh_id payload vs DB row mismatch → invite_mesh_mismatch verified live: tampered link blocked client-side with a clear error. Unmodified link joins cleanly end-to-end (roundtrip.ts + join-roundtrip.ts both pass). 64/64 tests green. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-04 23:02:12 +01:00
Alejandro Gutiérrez	9d3dbcecaf	feat(broker): verify ed25519 hello signature against member pubkey ... WS handshake is now authenticated end-to-end. The broker proves that every connected peer actually holds the secret key for the pubkey they claim as identity — not just that they know the pubkey. wire format change: {type:"hello", meshId, memberId, pubkey, sessionId, pid, cwd, timestamp, signature} where signature = ed25519_sign(canonical, secretKey) and canonical = `${meshId}|${memberId}|${pubkey}|${timestamp}` broker verifies on every hello: 1. timestamp within ±60s of broker clock → else close(1008, timestamp_skew) 2. pubkey is 64 hex chars, signature is 128 hex chars → else malformed 3. crypto_sign_verify_detached(signature, canonical, pubkey) → else bad_signature 4. (existing) mesh.member row exists for (meshId, pubkey) → else unauthorized All rejection paths close the WS with code 1008 + structured error message + metrics counter increment (connections_rejected_total by reason). new modules: - apps/broker/src/crypto.ts: canonicalHello, verifyHelloSignature, HELLO_SKEW_MS constant - apps/cli/src/crypto/hello-sig.ts: matching signHello helper clients updated: - apps/cli/src/ws/client.ts: signs hello before send - apps/broker/scripts/{peer-a,peer-b}.ts (smoke-test): sign hellos with seed-provided secret keys new regression tests — tests/hello-signature.test.ts (7): - valid signature accepted - bad signature (signed with wrong key) rejected - timestamp too old rejected (>60s) - timestamp too far in future rejected (>60s) - tampered canonical field (different meshId at verify time) rejected - malformed hex pubkey rejected - malformed signature length rejected verified live: - apps/broker/scripts/smoke-test.sh: full hello+ack+send+push flow - apps/cli/scripts/roundtrip.ts: signed hello + encrypted message - 55/55 tests pass Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-04 22:53:40 +01:00