mirror of
https://github.com/ruvnet/RuView
synced 2026-06-23 12:33:18 +00:00
ruv
9d52d49c0b
A1 (CRITICAL): the /api/websocket handshake accepted any non-empty token, ignoring the LongLivedTokenStore whitelist the REST path enforces — a full WS auth bypass. Now validates via state.tokens().is_valid() before auth_ok; wrong tokens get auth_invalid + close. A2 (HIGH): WS command replies were pushed into an mpsc whose only consumer logged and discarded them — no result/pong/event reached the client. Split the socket with futures StreamExt::split; a dedicated writer task drains the response channel onto the wire. A8 (HIGH): the homecore-api dev bin bound 0.0.0.0 with unconditional allow-any auth and no env path. Wired the HOMECORE_TOKENS env path (dev fallback warn-logged when unset) and defaulted the bind to 127.0.0.1 (HOMECORE_BIND to opt into LAN). Tests (fail on old source): - ws_handshake::wrong_token_is_rejected (old → auth_ok) - ws_handshake::result_reply_is_received / ping_pong_reply_is_received (old → timeout) - server_bin_auth::provisioned_bin_rejects_wrong_bearer / from_env_path_enforces_whitelist Co-Authored-By: claude-flow <ruv@ruv.net>
45 lines
1.3 KiB
TOML
45 lines
1.3 KiB
TOML
[package]
|
|
name = "homecore-api"
|
|
version = "0.1.0-alpha.0"
|
|
edition = "2021"
|
|
license = "MIT"
|
|
authors = ["rUv <ruv@ruv.net>", "HOMECORE Contributors"]
|
|
description = "Wire-compatible Axum REST + WebSocket port of Home Assistant's API (ADR-130)"
|
|
repository = "https://github.com/ruvnet/RuView"
|
|
|
|
[lib]
|
|
name = "homecore_api"
|
|
path = "src/lib.rs"
|
|
|
|
[[bin]]
|
|
name = "homecore-api-server"
|
|
path = "src/bin/server.rs"
|
|
|
|
[dependencies]
|
|
homecore = { path = "../homecore", version = "0.1.0-alpha.0" }
|
|
|
|
axum = { version = "0.7", features = ["ws", "json", "macros"] }
|
|
tokio = { version = "1", features = ["full"] }
|
|
tower = "0.5"
|
|
tower-http = { version = "0.6", features = ["cors", "trace"] }
|
|
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
|
|
thiserror = "1"
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
chrono = { version = "0.4", features = ["serde"] }
|
|
|
|
uuid = { version = "1", features = ["v4", "serde"] }
|
|
dashmap = "6"
|
|
futures-util = { version = "0.3", default-features = false, features = ["sink"] }
|
|
|
|
[dev-dependencies]
|
|
tower = { version = "0.5", features = ["util"] }
|
|
hyper = "1"
|
|
http-body-util = "0.1"
|
|
# End-to-end WS handshake + reply tests (HC-WS-01/02, ADR-161).
|
|
tokio-tungstenite = "0.24"
|
|
futures-util = { version = "0.3", default-features = false }
|