mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
DuncanandWill Pfleger
feaeb32f57
Two defects from the kalvin-agent security review of the admin moderation API. Replay-before-authorization: authorize_nip98 claimed the deployment-scoped replay ID immediately after crypto verification, before resolve_admin_principal ran the roster check. Any validly-signing but unrostered key (every WARP-admitted laptop) could allocate replay slots at request rate. Split the NIP-98 path into verify-only (authorize_nip98, returns pubkey + event id) and a separate claim_nip98_replay called only after principal resolution succeeds, so an unrostered signer never consumes a slot. Fail-closed Redis behavior and the deployment-scoped key format are unchanged. Cancel actor trail: cancel_report discarded the resolved principal and cancel_action persisted nothing about who cancelled — the one mutation with no actor attribution while BUZZ_AUDIT_ENABLED=false. Add a cancelled_by column to relay_admin_actions (mirroring moderation_reports.resolved_by), stamped in the cancel UPDATE and surfaced through AdminActionDto.cancelledBy. Migration 0033 is branch-local and unshipped, so the column is added in place with matching schema.sql; the pgschema parity test round-trips it through bin/pgschema. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>