security(phase-0): canister gateway auth, timing-safe secrets, fail-closed webhook, attest auth
Emergency pre-launch security hardening (Phase 0):
- Canister auth: add gateway_auth_secret to stable storage (V6→V7 migration), gatewayAuthorized() check on all non-health HTTP routes, admin_set_gateway_auth_secret controller function. When configured, only requests bearing X-Gateway-Auth are accepted. Backward-compatible: empty secret (default) allows all requests until explicitly set.
- Gateway: inject X-Gateway-Auth on all canister-bound requests (proxyToCanister, gatewayProxyGetNotesList, gatewayProxyGetNoteOne, getNoteCountForUser, settings vault list, metadata-bulk-canister, mcp-hosted-server). Startup warning when CANISTER_AUTH_SECRET is unset.
- Remove X-Test-User header from canister userId() — production canister no longer accepts spoofed test identities. CORS allowed headers updated accordingly.
- POST /api/v1/attest now requires JWT authentication (was unauthenticated).
- hub/server.mjs verifyState: use crypto.timingSafeEqual for HMAC comparison instead of string equality.
- hub/server.mjs captureAuth: fail-closed when CAPTURE_WEBHOOK_SECRET is unset (returns 503 instead of silently allowing). Uses timingSafeEqual for comparison.
- mcp-hosted-server: canister fetch calls now include X-User-Id and X-Gateway-Auth (fixes pre-existing bug where canister calls had no user identity).
- 23 new unit tests covering all Phase 0 changes. - All 1270 existing tests pass with no regressions.
0 comments
muse hub commit comment sha256:da4268d0b2b0f7ea99aa27b2f84c4291feb117e38fac212835995df139648bfb --body "your comment"
No comments yet. Be the first to start the discussion.