npub17jjz49l9jjmhhk7cac63j8yt9z555n9cw8vk7v5jz4vzw4ppld5qgj57ccandTyler Longwell 3df6179d03 fence(auth): host-binding side door + access-checker community fence ...

Two adversarially-proven multi-tenant fences for the auth lane on the frozen Lane 0 SHA:

1. NIP-98 verifier: drop loopback aliasing unconditionally.
   normalize_url() collapsed localhost / ::1 -> 127.0.0.1 — a testing convenience that
   becomes a row-zero side door under multi-tenant. The u-tag host is the community
   binding (docs/multi-tenant-conformance.md, NIP-98 row); collapsing the three would
   let an event signed for localhost pass against a 127.0.0.1-resolved community (or
   vice versa). Inverted the localhost test to bite the new strict rule: signed-for-one
   vs expected-other now REJECTS, identity still passes. Adversarial: re-introduced
   the aliasing -> test goes red -> restored.

2. ChannelAccessChecker: thread &TenantContext through every method.
   Frozen 0001 has channels PK (community_id, id), so the same UUID legitimately
   co-exists across communities. A bare WHERE id =  implementation would be a
   cross-community existence oracle. Mirror of buzz-db rule 4a.1 on the auth side.
   MockAccessChecker keyed on (community, pubkey, channel_id); new test
   access_does_not_cross_communities bites the bare-id direction. Adversarial:
   dropped the community filter from the mock -> test goes red -> restored.

No external impl of ChannelAccessChecker in-tree (DB uses a separate free function
under Mari's lane), so the trait signature change is contained.

cargo test -p buzz-auth: 45 passed / 0 failed.

Lane: auth (buzz-auth). Base: e349d7649 (frozen Lane 0).
Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>

2026-06-26 16:46:04 -04:00

..

src

fence(auth): host-binding side door + access-checker community fence

2026-06-26 16:46:04 -04:00

Cargo.toml

…