3 Commits

Author	SHA1	Message	Date
Dragan Spiridonov	c72bbc15dd	fix(auth): close /api/field bypass, two fail-opens, and a self-disarming test ... Findings from a qe-court adversarial round (4 prosecutors across 2 vendors). Each was verified against the code before being accepted; the ones below reproduced, the rest are reported in the PR thread rather than acted on. FATAL — `/api/field` was reachable with no credential, on both listeners. The gate protected `/api/v1/*` by prefix. `/api/field` is the REST sibling of `/ws/field` and serves the same signed FieldEvent stream — live presence, pose, vitals. `/ws/field` was gated in this PR; its twin one path segment over was not. Measured with RUVIEW_API_TOKEN set and no credential supplied: /api/v1/models 401 (control) /ws/field 401 (gated by this PR) /api/field 200 on :8080 AND :8765 Fixed by inverting the gate to deny-by-default with an explicit anonymous allowlist (`/`, `/ui`, `/health`, `/oauth/`). A route added at a new path is now gated because nobody exposed it, rather than exposed because nobody protected it — the same inversion already applied to the scope gate. FATAL — the wiring test disarmed itself exactly when it mattered. `Server::start` returned an Option that all five tests turned into `return`, so a server that failed to boot produced "5 passed" with zero assertions run, and cargo swallows the skip line without --nocapture. The one test that observes real wiring — the guard against both shipped bypasses — was silent for any change that breaks startup, including a boot panic in the auth path. It now panics with the child's stderr. MAJOR — a malformed client-id list silently disabled the audience check. An empty allowlist is the opt-out sentinel in verify.rs. `RUVIEW_OAUTH_CLIENT_IDS=","` is non-empty, passes the guard, then filters to an empty Vec — turning the audience boundary off with no log and admitting a token minted for any other Cognitum product. Only a literal `*` may opt out now; anything else that parses to nothing warns and falls back to the default. Same fail-open shape as the scope denylist this PR already had to invert. MAJOR — credentials were world-readable for a window on every refresh. `fs::write` creates at 0666 & !umask (0644 by default), and both writers chmodded afterwards. The existing permissions test asserted on the FINAL file and passed throughout. Affected the CLI refresh token (rotated with reuse detection — a thief who presents it first takes the session family) and the browser session secret (the HMAC key for every session; stealing it forges any account at any scope). Both now create with mode 0600 via OpenOptions. MAJOR — ui/sw.js cached authenticated API responses. Closing the /oauth/ leg left the /api/ leg open. `networkFirst` cached every successful response, keyed by URL alone, purged by nothing at sign-out: sign in as A, load sensing data, sign out, sign in as B, lose the network, and B is served A's data with no authorization check. API responses are now network-only — which is also the correct behaviour for a live sensing dashboard, where replaying a stale reading can show a room occupied after the person left — plus a cache purge on sign-out. CI — 40 of ruview-auth's 87 tests never ran. The workspace runs --no-default-features, which switches off the `login` and `pkce` features. Measured: 47 tests vs 87. The whole interactive sign-in path — credential storage, single-flight refresh, the file lock, the loopback callback — was green locally and never executed in CI. Added an --all-features step. (Checked the sensing-server for the same problem and did NOT find it: bearer_auth's 49 and browser_session's 15 do run under CI flags.) Tests: +2 wiring tests (one fails against the old gate with "http port served /api/field to an anonymous caller", passes after), +3 UI service-worker tests, +3 CLI scope tests, +1 temp-file permission test, +1 client-id parsing test. wifi-densepose-cli/src/auth.rs had zero tests and builds its own scope string, so the library's least-privilege test said nothing about what the CLI requests. Verified: ruview-auth 61+25+2 pass (--all-features), sensing-server bearer_auth 50, browser_session 15, auth_wiring 7, workspace 25 suites clean, UI 22. Co-Authored-By: Ruflo & AQE	2026-07-23 11:48:59 +02:00
Dragan Spiridonov	6d3fb88677	fix(cli): resolve scope from the token on read, and add whoami --refresh ... Two gaps that only appear with a credential file written by an earlier build — i.e. exactly the case a fresh-login test never exercises. 1. `whoami` printed "Scope: (not reported)" for an existing file. The previous commit resolved scope from the token claim at WRITE time only, so files written before it stayed blank forever. `effective_scope()` now falls back at READ time, which fixes existing files and any client that stored only what the token response carried. The token is authoritative either way; the stored field is a convenience copy. 2. `whoami` said the token "will refresh on next use" — a promise nothing kept, because no command called `ensure_fresh`. The refresh path was implemented and unit-tested but never actually run. `--refresh` exercises it, and goes through `Session::ensure_fresh` rather than reimplementing a second, subtly different refresh, so it inherits the single-flight guarantee and the persist-before-return ordering. It is a flag, not silent behaviour: refreshing rotates the stored refresh token — identity spends the old one — so it is a state change, not a read. VERIFIED AGAINST PRODUCTION, end to end: whoami on a pre-existing file -> Scope: sensing:read (was "not reported") whoami --refresh -> both tokens rotated refresh sha256[:12] 50cfa06b -> 2d37617a access sha256[:12] 61eebe8d -> 14d8e8de status: expired -> valid refreshed token GET /api/v1/models -> 200 refreshed token POST /api/v1/train/start -> 401 (still read-scoped) That exercises the rotating-refresh path against identity's real reuse detection — the one place a bug costs the user their session rather than a retry — and confirms the scope gate survives a refresh. Tests: 82 with --features login, 44 default, 501 sensing-server. Co-Authored-By: Ruflo & AQE	2026-07-22 18:21:49 +02:00
Dragan Spiridonov	31fb3d53f6	feat(cli): wifi-densepose login — Cognitum sign-in (ADR-271 phase 2) ... Phase 1 could verify a token and phase 3 could gate on one, but there was no way for a user to OBTAIN one. This closes that: sign in with a Cognitum account and get a token a RuView sensing server accepts, instead of everyone sharing one static RUVIEW_API_TOKEN string. Lives in `ruview-auth` behind a non-default `login` feature rather than in the CLI, so the Tauri desktop app can reuse it instead of growing a second copy. A server built with default features still gets the verifier and nothing else — no reqwest, no tokio net, no browser launcher. (This amends ADR-271's "no login flow in this crate" note; the reason for that line was to keep the server lean, and a feature gate achieves it without duplication.) Ported from meta-proxy's src/oauth/, cross-checked against musica's cognitum_provider.rs — two independent implementations against this same AS. Where they agree, this follows both: redirect path EXACTLY /oauth/callback, 60-second refresh skew, OOB fallback on SSH/CONTAINER//.dockerenv. Refresh is the part with teeth. Identity rotates refresh tokens with reuse detection, so presenting a spent one revokes the whole session family. Both obvious implementations are wrong: refreshing concurrently looks like replay, and retrying a failed refresh with the same token IS the replay. So `Session::ensure_fresh` holds an async mutex across the await, re-checks expiry after acquiring it (the waiter usually finds the work already done), persists the rotated token BEFORE returning it, and never retries. A missing expires_at counts as expired rather than being given a guessed default. Least scope by default: `login` requests `sensing:read`. `--admin` adds `sensing:admin` explicitly, and requests both because there is no scope hierarchy server-side. A session that streams poses should not casually hold the capability to delete the model it streams through. Credentials are written atomically and 0600 (temp file, chmod BEFORE rename) — the same discipline the seed applies to its cloud key. `logout` is local-only and says so: it makes this machine unable to act as you, but revoking the session everywhere is an account-level action. Also `whoami`, which reports whether the stored token is live — an expired-looking session is the most common reason a command starts 401ing, and it should be visible directly rather than inferred from a failure elsewhere. Verified against PRODUCTION, not just locally: authorize URLs built by this exact code path return HTTP 200 from auth.cognitum.one for both `sensing:read` and `sensing:read sensing:admin`, which exercises the real client_id, scope encoding, PKCE parameters and redirect_uri shape. Tests: 74 with --features login (51 unit + 21 verifier matrix + 2 doctests), including the RFC 7636 Appendix B vector, multi-scope URL encoding (a space that is hand-formatted rather than encoded silently truncates the request), a real TCP callback round-trip, callback timeout, 0600 permissions asserted on disk, atomic-save leaving no temp file, and refresh-window boundaries. Unchanged: 43 with default features, 501 in the sensing server. Co-Authored-By: Ruflo & AQE	2026-07-22 17:53:42 +02:00