mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
npub17jjz49l9jjmhhk7cac63j8yt9z555n9cw8vk7v5jz4vzw4ppld5qgj57ccandTyler Longwell
3df6179d03
Two adversarially-proven multi-tenant fences for the auth lane on the frozen Lane 0 SHA:
1. NIP-98 verifier: drop loopback aliasing unconditionally.
normalize_url() collapsed localhost / ::1 -> 127.0.0.1 — a testing convenience that
becomes a row-zero side door under multi-tenant. The u-tag host is the community
binding (docs/multi-tenant-conformance.md, NIP-98 row); collapsing the three would
let an event signed for localhost pass against a 127.0.0.1-resolved community (or
vice versa). Inverted the localhost test to bite the new strict rule: signed-for-one
vs expected-other now REJECTS, identity still passes. Adversarial: re-introduced
the aliasing -> test goes red -> restored.
2. ChannelAccessChecker: thread &TenantContext through every method.
Frozen 0001 has channels PK (community_id, id), so the same UUID legitimately
co-exists across communities. A bare WHERE id = implementation would be a
cross-community existence oracle. Mirror of buzz-db rule 4a.1 on the auth side.
MockAccessChecker keyed on (community, pubkey, channel_id); new test
access_does_not_cross_communities bites the bare-id direction. Adversarial:
dropped the community filter from the mock -> test goes red -> restored.
No external impl of ChannelAccessChecker in-tree (DB uses a separate free function
under Mari's lane), so the trait signature change is contained.
cargo test -p buzz-auth: 45 passed / 0 failed.
Lane: auth (buzz-auth). Base: e349d7649 (frozen Lane 0).
Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>