Files
ruvnet--RuView/v2/crates
Dragan Spiridonov 6ce50d5158 test(auth): cover browser sign-in; ADR-271/272 corrections and remediation plans
Browser sign-in was the newest security surface in this PR and had no
executable evidence behind it: browser_session.rs was 534 lines with 13 tests,
every one of which hit a private helper (sign, unsign, cookie, read_cookie,
is_live, has_scope). No test called issue, from_cookie_header, begin,
verifier_for_callback or is_configured, and no test anywhere presented a session
cookie to the gate.

+10 tests in browser_session, +6 in bearer_auth. Three mutants the adversarial
review named, each now verified dead by actually applying the mutation:

  (a) delete the `state` comparison in verifier_for_callback
      -> a_callback_whose_state_does_not_match_is_refused FAILED
      Without it the callback accepts a code from a flow the user never
      started: login CSRF, victim silently lands in the attacker's session.

  (b) `session.is_live().then_some(session)` -> `Some(session)`
      -> an_expired_session_cookie_does_not_authenticate FAILED
      -> an_expired_browser_session_is_refused FAILED
      `is_live` was already unit-tested; nothing asserted the CALLER consults
      it. Same "tested in isolation, call site untested" shape as the earlier
      refresh-never-invoked defect.

  (c) `session.has_scope(required)` -> `true`
      -> a_read_scoped_browser_session_cannot_delete_or_train FAILED
      Without it any browser session could delete models and start training.

Mutant (c) initially appeared to SURVIVE. It did not — there are two
has_scope call sites and the first substitution only hit one. Mutating the
one in `session_or_unauthorized` kills the test. That accident confirmed a
separate finding: the cookie branch inside require_bearer is unreachable when
an Authorization header is present, because the OAuth step returns on both
arms. It fails closed, so it is not a hole, but "try the next credential" is
what the code reads like. Pinned by
a_bad_bearer_beats_a_good_cookie_rather_than_falling_back.

Adds two crate-internal test seams (init_secret_for_tests, test_cookie_value).
test_cookie_value signs through the same path as `issue`, so tests presenting a
cookie exercise real verification rather than a test-only bypass.

ADR-271:
- The "browser cannot obtain an OAuth token" section asserted
  `grep -ril "oauth|cognitum|pkce" ui/` returns nothing. It now returns three
  files, invalidated by commits in this same PR. Marked superseded, original
  retained under a fold, replaced with what actually ships.
- Records the two deferred decisions with designs rather than patches: P1 the
  blocking JWKS fetch on a tokio worker (whose rate limiter is bypassed on
  exactly the stale path that matters, because fetched_at updates only on
  success — so after the TTL every request fetches, and a Pi that loses WAN
  stalls itself with no attacker present); P2 the 12-hour session from a
  15-minute token, with three costed options. Capping the session to
  sensing:read was considered and rejected: the dashboard genuinely issues
  DELETE /api/v1/models/{id}.
- P3 records that dropping `__Host-` costs origin-integrity, not just Secure —
  read_cookie takes the FIRST match and cookies are not port-scoped, so a
  same-host writer can shadow a session. Forgery was never the threat that
  prefix addresses.
- Documents redirect_uri's hardcoded default and the unconsumed CLI credential
  as known-incomplete, per decision to leave both as-is.

ADR-272: corrected a claim that would mislead users into a 401. It stated the
Python client DOES send Authorization: Bearer on the handshake; ws.py passes no
headers at all (zero occurrences of extra_headers or Authorization), so every
published client 401s once auth is enabled. Server-side decision unchanged.

Verified: sensing-server 566 + 179 + 7 + 5 + 8 + 4 + 16 pass under CI flags,
ruview-auth 61 + 25 + 2 with --all-features, auth_wiring 7.

Co-Authored-By: Ruflo & AQE
2026-07-23 12:08:13 +02:00
..

WiFi-DensePose Rust Crates

License: MIT OR Apache-2.0 Rust 1.85+ Workspace RuVector v2.0.4 Tests

See through walls with WiFi. No cameras. No wearables. Just radio waves.

A modular Rust workspace for WiFi-based human pose estimation, vital sign monitoring, and disaster response using Channel State Information (CSI). Built on RuVector graph algorithms and the WiFi-DensePose research platform by rUv.


Performance

Operation Python v1 Rust v2 Speedup
CSI Preprocessing ~5 ms 5.19 us ~1000x
Phase Sanitization ~3 ms 3.84 us ~780x
Feature Extraction ~8 ms 9.03 us ~890x
Motion Detection ~1 ms 186 ns ~5400x
Full Pipeline ~15 ms 18.47 us ~810x
Vital Signs N/A 86 us (11,665 fps) --

Crate Overview

Core Foundation

Crate Description crates.io
wifi-densepose-core Types, traits, and utilities (CsiFrame, PoseEstimate, SignalProcessor) crates.io
wifi-densepose-config Configuration management (env, TOML, YAML) crates.io
wifi-densepose-db Database persistence (PostgreSQL, SQLite, Redis) crates.io

Signal Processing & Sensing

Crate Description RuVector Integration crates.io
wifi-densepose-signal SOTA CSI signal processing (6 algorithms from SpotFi, FarSense, Widar 3.0) ruvector-mincut, ruvector-attn-mincut, ruvector-attention, ruvector-solver crates.io
wifi-densepose-vitals Vital sign extraction: breathing (6-30 BPM) and heart rate (40-120 BPM) -- crates.io
wifi-densepose-wifiscan Multi-BSSID WiFi scanning for Windows-enhanced sensing -- crates.io

Neural Network & Training

Crate Description RuVector Integration crates.io
wifi-densepose-nn Multi-backend inference (ONNX, PyTorch, Candle) with DensePose head (24 body parts) -- crates.io
wifi-densepose-train Training pipeline with MM-Fi dataset, 114->56 subcarrier interpolation All 5 crates crates.io

Disaster Response

Crate Description RuVector Integration crates.io
wifi-densepose-mat Mass Casualty Assessment Tool -- survivor detection, triage, multi-AP localization ruvector-solver, ruvector-temporal-tensor crates.io

Hardware & Deployment

Crate Description crates.io
wifi-densepose-hardware ESP32, Intel 5300, Atheros CSI sensor interfaces (pure Rust, no FFI) crates.io
wifi-densepose-wasm WebAssembly bindings for browser-based disaster dashboard crates.io
wifi-densepose-sensing-server Axum server: ESP32 UDP ingestion, WebSocket broadcast, sensing UI crates.io

Applications

Crate Description crates.io
wifi-densepose-api REST + WebSocket API layer crates.io
wifi-densepose-cli Command-line tool for MAT disaster scanning crates.io

Architecture

                          wifi-densepose-core
                         (types, traits, errors)
                                  |
              +-------------------+-------------------+
              |                   |                   |
    wifi-densepose-signal   wifi-densepose-nn   wifi-densepose-hardware
    (CSI processing)        (inference)         (ESP32, Intel 5300)
    + ruvector-mincut       + ONNX Runtime          |
    + ruvector-attn-mincut  + PyTorch (tch)   wifi-densepose-vitals
    + ruvector-attention    + Candle          (breathing, heart rate)
    + ruvector-solver            |
              |                  |             wifi-densepose-wifiscan
              +--------+---------+            (BSSID scanning)
                       |
          +------------+------------+
          |                         |
  wifi-densepose-train    wifi-densepose-mat
  (training pipeline)     (disaster response)
  + ALL 5 ruvector        + ruvector-solver
                          + ruvector-temporal-tensor
                                |
              +-----------------+-----------------+
              |                 |                 |
    wifi-densepose-api  wifi-densepose-wasm  wifi-densepose-cli
    (REST/WS)           (browser WASM)       (CLI tool)
              |
    wifi-densepose-sensing-server
    (Axum + WebSocket)

RuVector Integration

All RuVector crates at v2.0.4 from crates.io:

RuVector Crate Used In Purpose
ruvector-mincut signal, train Dynamic min-cut for subcarrier selection & person matching
ruvector-attn-mincut signal, train Attention-weighted min-cut for antenna gating & spectrograms
ruvector-temporal-tensor train, mat Tiered temporal compression (4-10x memory reduction)
ruvector-solver signal, train, mat Sparse Neumann solver for interpolation & triangulation
ruvector-attention signal, train Scaled dot-product attention for spatial features & BVP

Signal Processing Algorithms

Six state-of-the-art algorithms implemented in wifi-densepose-signal:

Algorithm Paper Year Module
Conjugate Multiplication SpotFi (SIGCOMM) 2015 csi_ratio.rs
Hampel Filter WiGest 2015 hampel.rs
Fresnel Zone Model FarSense (MobiCom) 2019 fresnel.rs
CSI Spectrogram Standard STFT 2018+ spectrogram.rs
Subcarrier Selection WiDance (MobiCom) 2017 subcarrier_selection.rs
Body Velocity Profile Widar 3.0 (MobiSys) 2019 bvp.rs

Quick Start

As a Library

use wifi_densepose_core::{CsiFrame, CsiMetadata, SignalProcessor};
use wifi_densepose_signal::{CsiProcessor, CsiProcessorConfig};

// Configure the CSI processor
let config = CsiProcessorConfig::default();
let processor = CsiProcessor::new(config);

// Process a CSI frame
let frame = CsiFrame { /* ... */ };
let processed = processor.process(&frame)?;

Vital Sign Monitoring

use wifi_densepose_vitals::{
    CsiVitalPreprocessor, BreathingExtractor, HeartRateExtractor,
    VitalAnomalyDetector,
};

let mut preprocessor = CsiVitalPreprocessor::new(56); // 56 subcarriers
let mut breathing = BreathingExtractor::new(100.0);    // 100 Hz sample rate
let mut heartrate = HeartRateExtractor::new(100.0);

// Feed CSI frames and extract vitals
for frame in csi_stream {
    let residuals = preprocessor.update(&frame.amplitudes);
    if let Some(bpm) = breathing.push_residuals(&residuals) {
        println!("Breathing: {:.1} BPM", bpm);
    }
}

Disaster Response (MAT)

use wifi_densepose_mat::{DisasterResponse, DisasterConfig, DisasterType};

let config = DisasterConfig {
    disaster_type: DisasterType::Earthquake,
    max_scan_zones: 16,
    ..Default::default()
};

let mut responder = DisasterResponse::new(config);
responder.add_scan_zone(zone)?;
responder.start_continuous_scan().await?;

Hardware (ESP32)

use wifi_densepose_hardware::{Esp32CsiParser, CsiFrame};

let parser = Esp32CsiParser::new();
let raw_bytes: &[u8] = /* UDP packet from ESP32 */;
let frame: CsiFrame = parser.parse(raw_bytes)?;
println!("RSSI: {} dBm, {} subcarriers", frame.metadata.rssi, frame.subcarriers.len());

Training

# Check training crate (no GPU needed)
cargo check -p wifi-densepose-train --no-default-features

# Run training with GPU (requires tch/libtorch)
cargo run -p wifi-densepose-train --features tch-backend --bin train -- \
    --config training.toml --dataset /path/to/mmfi

# Verify deterministic training proof
cargo run -p wifi-densepose-train --features tch-backend --bin verify-training

Building

# Clone the repository
git clone https://github.com/ruvnet/wifi-densepose.git
cd wifi-densepose/v2

# Check workspace (no GPU dependencies)
cargo check --workspace --no-default-features

# Run all tests
cargo test --workspace --no-default-features

# Build release
cargo build --release --workspace

Feature Flags

Crate Feature Description
wifi-densepose-nn onnx (default) ONNX Runtime backend
wifi-densepose-nn tch-backend PyTorch (libtorch) backend
wifi-densepose-nn candle-backend Candle (pure Rust) backend
wifi-densepose-nn cuda CUDA GPU acceleration
wifi-densepose-train tch-backend Enable GPU training modules
wifi-densepose-mat ruvector (default) RuVector graph algorithms
wifi-densepose-mat api (default) REST + WebSocket API
wifi-densepose-mat distributed Multi-node coordination
wifi-densepose-mat drone Drone-mounted scanning
wifi-densepose-hardware esp32 ESP32 protocol support
wifi-densepose-hardware intel5300 Intel 5300 CSI Tool
wifi-densepose-hardware linux-wifi Linux commodity WiFi
wifi-densepose-wifiscan wlanapi Windows WLAN API async scanning
wifi-densepose-core serde Serialization support
wifi-densepose-core async Async trait support

Testing

# Unit tests (all crates)
cargo test --workspace --no-default-features

# Signal processing benchmarks
cargo bench -p wifi-densepose-signal

# Training benchmarks
cargo bench -p wifi-densepose-train --no-default-features

# Detection benchmarks
cargo bench -p wifi-densepose-mat

Supported Hardware

Hardware Crate Feature CSI Subcarriers Cost
ESP32-S3 Mesh (3-6 nodes) hardware/esp32 52-56 ~$54
Intel 5300 NIC hardware/intel5300 30 ~$50
Atheros AR9580 hardware/linux-wifi 56 ~$100
Any WiFi (Windows/Linux) wifiscan RSSI-only $0

Architecture Decision Records

Key design decisions documented in docs/adr/:

ADR Title Status
ADR-014 SOTA Signal Processing Accepted
ADR-015 MM-Fi + Wi-Pose Training Datasets Accepted
ADR-016 RuVector Training Pipeline Accepted (Complete)
ADR-017 RuVector Signal + MAT Integration Accepted
ADR-021 Vital Sign Detection Pipeline Accepted
ADR-022 Windows WiFi Enhanced Sensing Accepted
ADR-024 Contrastive CSI Embedding Model Accepted
  • WiFi-DensePose -- Main repository (Python v1 + Rust v2)
  • RuVector -- Graph algorithms for neural networks (5 crates, v2.0.4)
  • rUv -- Creator and maintainer

License

All crates are dual-licensed under MIT OR Apache-2.0.

Copyright (c) 2024 rUv