Files
ruvnet--RuView/v2/crates
Dragan Spiridonov 89cceaf835 fix(auth): close P1/P2/P3 — JWKS stall, 12h session, cookie shadowing
All three deferred findings from the qe-court round. Each fix is guarded by a
test confirmed to FAIL against the old behaviour.

P1 — JWKS: self-inflicted stall, and a blocking fetch on a tokio worker.

`fetched_at` advances only on SUCCESS, and the only rate limiter sat behind
`if fresh`. So once the TTL elapsed after the last successful fetch, `fresh`
was permanently false, the limiter was never consulted, and EVERY request
performed its own blocking 3s-timeout fetch. A Pi that loses WAN stalled
itself 300s later with no attacker present; an attacker could force the same
state by flooding tokens with an unknown `kid`.

Now: `last_attempt_at` is recorded BEFORE every fetch regardless of outcome,
and gates the stale path too; a stale-but-present key is served rather than
erroring, which is the offline tolerance this module always claimed.
Measured by the new test: 26 outbound fetches before, 1 after.

Kept as TWO independent limiters. Merging them looks tidy and is wrong — a
routine refetch would then suppress the unknown-`kid` path for 30s and delay
pickup of a key rotation inside the TTL. I made that mistake first; two
existing tests caught it.

The blocking call also now runs in `spawn_blocking` at the verify boundary,
matching what `main.rs` already does for the token exchange, where the comment
reads "the same mistake this codebase had to fix in jwks.rs". The hot
verification path had never been given the same treatment. A panicked task
fails closed.

P2 — session lifetime, per decision: 1 hour, plus step-up.

SESSION_TTL_SECS 12h -> 1h, and privileged (`sensing:admin`) actions now
require the user to have authenticated within ADMIN_REVERIFY_SECS (5 min),
tracked by a new `auth_time` claim. Reads ride the full session; only the
routes where a stale session does damage are re-verified, so a dashboard whose
main use is watching a live stream does not re-auth hourly.

`auth_time` is `#[serde(default)]`, so a cookie issued before the field existed
reads as 0 — infinitely stale. Such a session keeps working for reads and
cannot perform privileged actions. Fail-closed and self-healing on next sign-in.

The refusal carries an RFC 6750 `WWW-Authenticate` error code, because the
client's correct response differs from a plain 401: the user IS signed in and
needs to prove it again. `api.service.js` acts on that and redirects through
`/oauth/start` — otherwise a stale-session delete surfaces as a generic
"Request failed" with no hint that signing in again fixes it.

P3 — cookie shadowing.

`read_cookie` returned the FIRST match, and RFC 6265 §5.4 sends longer-`Path`
cookies first. Cookies are not isolated by port or scheme, so any other service
on the host — or a plain-HTTP MITM injecting Set-Cookie — could plant
`ruview_session=<their own validly signed session>; Path=/ui`. The victim sent
both, the attacker's first, and it verified because it genuinely was signed:
silent session takeover, with `/oauth/status` reporting the attacker's account.

The signature was doing its job throughout, which is why "it's signed" never
answered this. `__Host-` would, but requires `Secure`, and RuView is routinely
reached over plain HTTP on a LAN.

So both credential paths now accept only when EXACTLY ONE candidate verifies.
An attacker can still cause a refusal by planting a second valid cookie — a
nuisance — but no longer a takeover. Planting junk changes nothing, so this
does not become a trivial DoS.

Tests: +1 jwks (26-vs-1 fetch amplification), +4 step-up, +4 shadowing, +1
duplicate-name reader. Mutation-verified: reverting the stale-path guard gives
26 fetches; reverting to first-match cookie reads fails
`a_shadowing_cookie_cannot_silently_take_over_the_session`.

Verified: workspace 176 suites clean under CI flags, ruview-auth 62+25+2 with
--all-features, UI 22.

ADR-271: P1/P2/P3 marked RESOLVED with the analysis retained, since it explains
why each fix has the shape it does.

Co-Authored-By: Ruflo & AQE
2026-07-23 13:13:42 +02:00
..

WiFi-DensePose Rust Crates

License: MIT OR Apache-2.0 Rust 1.85+ Workspace RuVector v2.0.4 Tests

See through walls with WiFi. No cameras. No wearables. Just radio waves.

A modular Rust workspace for WiFi-based human pose estimation, vital sign monitoring, and disaster response using Channel State Information (CSI). Built on RuVector graph algorithms and the WiFi-DensePose research platform by rUv.


Performance

Operation Python v1 Rust v2 Speedup
CSI Preprocessing ~5 ms 5.19 us ~1000x
Phase Sanitization ~3 ms 3.84 us ~780x
Feature Extraction ~8 ms 9.03 us ~890x
Motion Detection ~1 ms 186 ns ~5400x
Full Pipeline ~15 ms 18.47 us ~810x
Vital Signs N/A 86 us (11,665 fps) --

Crate Overview

Core Foundation

Crate Description crates.io
wifi-densepose-core Types, traits, and utilities (CsiFrame, PoseEstimate, SignalProcessor) crates.io
wifi-densepose-config Configuration management (env, TOML, YAML) crates.io
wifi-densepose-db Database persistence (PostgreSQL, SQLite, Redis) crates.io

Signal Processing & Sensing

Crate Description RuVector Integration crates.io
wifi-densepose-signal SOTA CSI signal processing (6 algorithms from SpotFi, FarSense, Widar 3.0) ruvector-mincut, ruvector-attn-mincut, ruvector-attention, ruvector-solver crates.io
wifi-densepose-vitals Vital sign extraction: breathing (6-30 BPM) and heart rate (40-120 BPM) -- crates.io
wifi-densepose-wifiscan Multi-BSSID WiFi scanning for Windows-enhanced sensing -- crates.io

Neural Network & Training

Crate Description RuVector Integration crates.io
wifi-densepose-nn Multi-backend inference (ONNX, PyTorch, Candle) with DensePose head (24 body parts) -- crates.io
wifi-densepose-train Training pipeline with MM-Fi dataset, 114->56 subcarrier interpolation All 5 crates crates.io

Disaster Response

Crate Description RuVector Integration crates.io
wifi-densepose-mat Mass Casualty Assessment Tool -- survivor detection, triage, multi-AP localization ruvector-solver, ruvector-temporal-tensor crates.io

Hardware & Deployment

Crate Description crates.io
wifi-densepose-hardware ESP32, Intel 5300, Atheros CSI sensor interfaces (pure Rust, no FFI) crates.io
wifi-densepose-wasm WebAssembly bindings for browser-based disaster dashboard crates.io
wifi-densepose-sensing-server Axum server: ESP32 UDP ingestion, WebSocket broadcast, sensing UI crates.io

Applications

Crate Description crates.io
wifi-densepose-api REST + WebSocket API layer crates.io
wifi-densepose-cli Command-line tool for MAT disaster scanning crates.io

Architecture

                          wifi-densepose-core
                         (types, traits, errors)
                                  |
              +-------------------+-------------------+
              |                   |                   |
    wifi-densepose-signal   wifi-densepose-nn   wifi-densepose-hardware
    (CSI processing)        (inference)         (ESP32, Intel 5300)
    + ruvector-mincut       + ONNX Runtime          |
    + ruvector-attn-mincut  + PyTorch (tch)   wifi-densepose-vitals
    + ruvector-attention    + Candle          (breathing, heart rate)
    + ruvector-solver            |
              |                  |             wifi-densepose-wifiscan
              +--------+---------+            (BSSID scanning)
                       |
          +------------+------------+
          |                         |
  wifi-densepose-train    wifi-densepose-mat
  (training pipeline)     (disaster response)
  + ALL 5 ruvector        + ruvector-solver
                          + ruvector-temporal-tensor
                                |
              +-----------------+-----------------+
              |                 |                 |
    wifi-densepose-api  wifi-densepose-wasm  wifi-densepose-cli
    (REST/WS)           (browser WASM)       (CLI tool)
              |
    wifi-densepose-sensing-server
    (Axum + WebSocket)

RuVector Integration

All RuVector crates at v2.0.4 from crates.io:

RuVector Crate Used In Purpose
ruvector-mincut signal, train Dynamic min-cut for subcarrier selection & person matching
ruvector-attn-mincut signal, train Attention-weighted min-cut for antenna gating & spectrograms
ruvector-temporal-tensor train, mat Tiered temporal compression (4-10x memory reduction)
ruvector-solver signal, train, mat Sparse Neumann solver for interpolation & triangulation
ruvector-attention signal, train Scaled dot-product attention for spatial features & BVP

Signal Processing Algorithms

Six state-of-the-art algorithms implemented in wifi-densepose-signal:

Algorithm Paper Year Module
Conjugate Multiplication SpotFi (SIGCOMM) 2015 csi_ratio.rs
Hampel Filter WiGest 2015 hampel.rs
Fresnel Zone Model FarSense (MobiCom) 2019 fresnel.rs
CSI Spectrogram Standard STFT 2018+ spectrogram.rs
Subcarrier Selection WiDance (MobiCom) 2017 subcarrier_selection.rs
Body Velocity Profile Widar 3.0 (MobiSys) 2019 bvp.rs

Quick Start

As a Library

use wifi_densepose_core::{CsiFrame, CsiMetadata, SignalProcessor};
use wifi_densepose_signal::{CsiProcessor, CsiProcessorConfig};

// Configure the CSI processor
let config = CsiProcessorConfig::default();
let processor = CsiProcessor::new(config);

// Process a CSI frame
let frame = CsiFrame { /* ... */ };
let processed = processor.process(&frame)?;

Vital Sign Monitoring

use wifi_densepose_vitals::{
    CsiVitalPreprocessor, BreathingExtractor, HeartRateExtractor,
    VitalAnomalyDetector,
};

let mut preprocessor = CsiVitalPreprocessor::new(56); // 56 subcarriers
let mut breathing = BreathingExtractor::new(100.0);    // 100 Hz sample rate
let mut heartrate = HeartRateExtractor::new(100.0);

// Feed CSI frames and extract vitals
for frame in csi_stream {
    let residuals = preprocessor.update(&frame.amplitudes);
    if let Some(bpm) = breathing.push_residuals(&residuals) {
        println!("Breathing: {:.1} BPM", bpm);
    }
}

Disaster Response (MAT)

use wifi_densepose_mat::{DisasterResponse, DisasterConfig, DisasterType};

let config = DisasterConfig {
    disaster_type: DisasterType::Earthquake,
    max_scan_zones: 16,
    ..Default::default()
};

let mut responder = DisasterResponse::new(config);
responder.add_scan_zone(zone)?;
responder.start_continuous_scan().await?;

Hardware (ESP32)

use wifi_densepose_hardware::{Esp32CsiParser, CsiFrame};

let parser = Esp32CsiParser::new();
let raw_bytes: &[u8] = /* UDP packet from ESP32 */;
let frame: CsiFrame = parser.parse(raw_bytes)?;
println!("RSSI: {} dBm, {} subcarriers", frame.metadata.rssi, frame.subcarriers.len());

Training

# Check training crate (no GPU needed)
cargo check -p wifi-densepose-train --no-default-features

# Run training with GPU (requires tch/libtorch)
cargo run -p wifi-densepose-train --features tch-backend --bin train -- \
    --config training.toml --dataset /path/to/mmfi

# Verify deterministic training proof
cargo run -p wifi-densepose-train --features tch-backend --bin verify-training

Building

# Clone the repository
git clone https://github.com/ruvnet/wifi-densepose.git
cd wifi-densepose/v2

# Check workspace (no GPU dependencies)
cargo check --workspace --no-default-features

# Run all tests
cargo test --workspace --no-default-features

# Build release
cargo build --release --workspace

Feature Flags

Crate Feature Description
wifi-densepose-nn onnx (default) ONNX Runtime backend
wifi-densepose-nn tch-backend PyTorch (libtorch) backend
wifi-densepose-nn candle-backend Candle (pure Rust) backend
wifi-densepose-nn cuda CUDA GPU acceleration
wifi-densepose-train tch-backend Enable GPU training modules
wifi-densepose-mat ruvector (default) RuVector graph algorithms
wifi-densepose-mat api (default) REST + WebSocket API
wifi-densepose-mat distributed Multi-node coordination
wifi-densepose-mat drone Drone-mounted scanning
wifi-densepose-hardware esp32 ESP32 protocol support
wifi-densepose-hardware intel5300 Intel 5300 CSI Tool
wifi-densepose-hardware linux-wifi Linux commodity WiFi
wifi-densepose-wifiscan wlanapi Windows WLAN API async scanning
wifi-densepose-core serde Serialization support
wifi-densepose-core async Async trait support

Testing

# Unit tests (all crates)
cargo test --workspace --no-default-features

# Signal processing benchmarks
cargo bench -p wifi-densepose-signal

# Training benchmarks
cargo bench -p wifi-densepose-train --no-default-features

# Detection benchmarks
cargo bench -p wifi-densepose-mat

Supported Hardware

Hardware Crate Feature CSI Subcarriers Cost
ESP32-S3 Mesh (3-6 nodes) hardware/esp32 52-56 ~$54
Intel 5300 NIC hardware/intel5300 30 ~$50
Atheros AR9580 hardware/linux-wifi 56 ~$100
Any WiFi (Windows/Linux) wifiscan RSSI-only $0

Architecture Decision Records

Key design decisions documented in docs/adr/:

ADR Title Status
ADR-014 SOTA Signal Processing Accepted
ADR-015 MM-Fi + Wi-Pose Training Datasets Accepted
ADR-016 RuVector Training Pipeline Accepted (Complete)
ADR-017 RuVector Signal + MAT Integration Accepted
ADR-021 Vital Sign Detection Pipeline Accepted
ADR-022 Windows WiFi Enhanced Sensing Accepted
ADR-024 Contrastive CSI Embedding Model Accepted
  • WiFi-DensePose -- Main repository (Python v1 + Rust v2)
  • RuVector -- Graph algorithms for neural networks (5 crates, v2.0.4)
  • rUv -- Creator and maintainer

License

All crates are dual-licensed under MIT OR Apache-2.0.

Copyright (c) 2024 rUv