2 Commits

Author	SHA1	Message	Date
Dragan Spiridonov	6ce50d5158	test(auth): cover browser sign-in; ADR-271/272 corrections and remediation plans ... Browser sign-in was the newest security surface in this PR and had no executable evidence behind it: browser_session.rs was 534 lines with 13 tests, every one of which hit a private helper (sign, unsign, cookie, read_cookie, is_live, has_scope). No test called issue, from_cookie_header, begin, verifier_for_callback or is_configured, and no test anywhere presented a session cookie to the gate. +10 tests in browser_session, +6 in bearer_auth. Three mutants the adversarial review named, each now verified dead by actually applying the mutation: (a) delete the `state` comparison in verifier_for_callback -> a_callback_whose_state_does_not_match_is_refused FAILED Without it the callback accepts a code from a flow the user never started: login CSRF, victim silently lands in the attacker's session. (b) `session.is_live().then_some(session)` -> `Some(session)` -> an_expired_session_cookie_does_not_authenticate FAILED -> an_expired_browser_session_is_refused FAILED `is_live` was already unit-tested; nothing asserted the CALLER consults it. Same "tested in isolation, call site untested" shape as the earlier refresh-never-invoked defect. (c) `session.has_scope(required)` -> `true` -> a_read_scoped_browser_session_cannot_delete_or_train FAILED Without it any browser session could delete models and start training. Mutant (c) initially appeared to SURVIVE. It did not — there are two has_scope call sites and the first substitution only hit one. Mutating the one in `session_or_unauthorized` kills the test. That accident confirmed a separate finding: the cookie branch inside require_bearer is unreachable when an Authorization header is present, because the OAuth step returns on both arms. It fails closed, so it is not a hole, but "try the next credential" is what the code reads like. Pinned by a_bad_bearer_beats_a_good_cookie_rather_than_falling_back. Adds two crate-internal test seams (init_secret_for_tests, test_cookie_value). test_cookie_value signs through the same path as `issue`, so tests presenting a cookie exercise real verification rather than a test-only bypass. ADR-271: - The "browser cannot obtain an OAuth token" section asserted `grep -ril "oauth|cognitum|pkce" ui/` returns nothing. It now returns three files, invalidated by commits in this same PR. Marked superseded, original retained under a fold, replaced with what actually ships. - Records the two deferred decisions with designs rather than patches: P1 the blocking JWKS fetch on a tokio worker (whose rate limiter is bypassed on exactly the stale path that matters, because fetched_at updates only on success — so after the TTL every request fetches, and a Pi that loses WAN stalls itself with no attacker present); P2 the 12-hour session from a 15-minute token, with three costed options. Capping the session to sensing:read was considered and rejected: the dashboard genuinely issues DELETE /api/v1/models/{id}. - P3 records that dropping `__Host-` costs origin-integrity, not just Secure — read_cookie takes the FIRST match and cookies are not port-scoped, so a same-host writer can shadow a session. Forgery was never the threat that prefix addresses. - Documents redirect_uri's hardcoded default and the unconsumed CLI credential as known-incomplete, per decision to leave both as-is. ADR-272: corrected a claim that would mislead users into a 401. It stated the Python client DOES send Authorization: Bearer on the handshake; ws.py passes no headers at all (zero occurrences of extra_headers or Authorization), so every published client 401s once auth is enabled. Server-side decision unchanged. Verified: sensing-server 566 + 179 + 7 + 5 + 8 + 4 + 16 pass under CI flags, ruview-auth 61 + 25 + 2 with --all-features, auth_wiring 7. Co-Authored-By: Ruflo & AQE	2026-07-23 12:08:13 +02:00
Dragan Spiridonov	eb68e07a2c	feat(ui): fetch WebSocket tickets, prefix-match WS paths, and write ADR-272 ... Completes ADR-272. Three parts. 1. PREFIX MATCHING, not an allowlist. Anything under `/ws/` is a WebSocket path, plus `/api/v1/stream/pose` which lives outside it. An allowlist means every WebSocket route added later ships ungated until someone remembers to extend it — the same bug reintroduced on a delay. Not hypothetical: `/ws/train/progress` (ADR-186, arriving with PR #1387) is ALREADY referenced by ui/services/training.service.js and would have shipped unauthenticated. Pinned by a test that asserts it is gated before it exists. 2. UI wiring. A shared `withWsTicket()` helper mints a ticket immediately before each connection attempt — never cached, because a ticket is single-use and expires in seconds, so reusing one across reconnects fails on the second attempt. Wired into the three sites that open gated sockets: sensing.service.js, websocket-client.js, observatory/js/main.js. It degrades in both directions on purpose: no stored token means auth is off and no ticket is needed; a 404 from /api/v1/ws-ticket means a server predating this ADR, which still exempts WebSockets, so connecting without a ticket is correct there. The same UI therefore works against old and new servers, which is what makes the escape hatch removable later rather than permanent. The long-lived bearer token is still never put in a URL — only the ticket is. 3. ADR-272 itself. Previously cited in five places without existing; the same dangling-reference mistake made with ADR-271 earlier today, so it is written before this lands rather than after someone notices. It records the measured before/after, why a credential in a URL is acceptable here specifically (single use, seconds-long, not the credential), why the escape hatch exists and why it is deliberately uncomfortable, and what is deliberately NOT done — including that /health/metrics stays ungated, with the caveat that this should be revisited if metrics ever carry occupancy-derived values, since that would make them sensing data wearing an ops label. Tests: 526 sensing-server (4 new path-matching), 82 ruview-auth. JS syntax-checked with `node --check`; there is no UI test suite to extend. Co-Authored-By: Ruflo & AQE	2026-07-22 19:15:20 +02:00