security: add identity and nonce properties

Author: farhan-syah

nodedb-wal/src/crypto.rs

@@ -504,6 +504,59 @@ mod tests {
         assert_ne!(ct1, ct2);
     }
 
+    #[test]
+    fn nonce_construction_is_injective_for_bounded_generated_wal_pairs() {
+        use std::collections::HashSet;
+
+        const GENERATED_PAIR_BUDGET: usize = 4_096;
+
+        // Exercise the endpoints and the 32-bit transition in the LSN space,
+        // then add a fixed-size deterministic corpus. The production domain is
+        // the full u64 LSN space; this bounded test corpus makes the injective
+        // [epoch || lsn.to_le_bytes()] construction executable in unit tests.
+        let mut pairs = vec![
+            ([0x00; 4], 0),
+            ([0x00; 4], 1),
+            ([0x00; 4], u32::MAX as u64),
+            ([0x00; 4], u32::MAX as u64 + 1),
+            ([0x00; 4], u64::MAX),
+            ([0xff; 4], 0),
+            ([0xff; 4], u64::MAX),
+            ([0x01, 0x00, 0x00, 0x00], 0),
+            ([0x00, 0x01, 0x00, 0x00], 0),
+        ];
+        let mut state = 0xD1B5_4A32_D192_ED03u64;
+        for _ in 0..GENERATED_PAIR_BUDGET {
+            // A fixed arithmetic/xorshift sequence produces a deterministic,
+            // well-distributed corpus; pair uniqueness is asserted below rather
+            // than assumed.
+            state = state.wrapping_add(0x9E37_79B9_7F4A_7C15);
+            let epoch = (state ^ (state >> 32)).to_le_bytes()[..4]
+                .try_into()
+                .expect("four-byte epoch");
+            state = state.wrapping_add(0x9E37_79B9_7F4A_7C15);
+            let lsn = state ^ (state >> 30);
+            pairs.push((epoch, lsn));
+        }
+
+        let mut distinct_pairs = HashSet::with_capacity(pairs.len());
+        let mut distinct_nonces = HashSet::with_capacity(pairs.len());
+        for (epoch, lsn) in pairs {
+            assert!(
+                distinct_pairs.insert((epoch, lsn)),
+                "generated corpus must contain only distinct (epoch, LSN) pairs"
+            );
+            let nonce = lsn_to_nonce(&epoch, lsn);
+            let mut nonce_bytes = [0u8; 12];
+            nonce_bytes.copy_from_slice(&nonce);
+            assert!(
+                distinct_nonces.insert(nonce_bytes),
+                "distinct (epoch, LSN) pairs must not share a 96-bit nonce"
+            );
+        }
+        assert_eq!(distinct_nonces.len(), distinct_pairs.len());
+    }
+
     #[test]
     #[cfg(unix)]
     fn from_file_0o600_accepted() {

nodedb-wal/src/segment_envelope.rs

@@ -94,6 +94,11 @@ impl OneShotDataKey {
 }
 
 /// Encrypt a segment using a full random seed and a one-use derived data key.
+///
+/// Every public call obtains a fresh 128-bit salt and 96-bit nonce from the OS
+/// RNG. Those values are serialized in the authenticated preamble and feed the
+/// HKDF derivation, so each envelope receives a distinct data-key derivation
+/// context. The data key is intentionally internal and is never exposed.
 pub fn encrypt_segment_envelope(
     key: &WalEncryptionKey,
     magic: &[u8; 4],
@@ -337,14 +342,50 @@ mod tests {
     }
 
     #[test]
-    fn data_key_budget_rejects_second_encryption() {
+    fn data_key_budget_rejects_second_encryption_without_ciphertext() {
         let key = key(0x42);
         let derived =
             derive_data_key(&key, &MAGIC, &[1; SALT_SIZE], &[2; NONCE_SIZE]).expect("derive");
         let mut one_shot = OneShotDataKey::new(&derived);
         let nonce = [2; NONCE_SIZE];
-        assert!(one_shot.encrypt(&nonce, b"aad", b"one").is_ok());
-        assert!(one_shot.encrypt(&nonce, b"aad", b"two").is_err());
+        let first = one_shot
+            .encrypt(&nonce, b"aad", b"one")
+            .expect("the one permitted encryption succeeds");
+        assert!(
+            !first.is_empty(),
+            "successful encryption returns ciphertext"
+        );
+
+        // A second call has no cipher to invoke: the budget check returns the
+        // typed encryption error before AES-GCM can produce any ciphertext.
+        let second = one_shot.encrypt(&nonce, b"aad", b"two");
+        assert!(
+            matches!(
+                second,
+                Err(WalError::EncryptionError { ref detail })
+                    if detail == "segment data-key encryption budget exhausted"
+            ),
+            "second encryption must return the typed budget-exhausted error"
+        );
+    }
+
+    #[test]
+    fn public_envelopes_use_fresh_random_salt_and_nonce_per_call() {
+        let key = key(0x42);
+        let first = encrypt_segment_envelope(&key, &MAGIC, b"same plaintext")
+            .expect("first public envelope encryption");
+        let second = encrypt_segment_envelope(&key, &MAGIC, b"same plaintext")
+            .expect("second public envelope encryption");
+
+        // The serialized salt and nonce are the public, authenticated inputs
+        // to HKDF; unequal seeds therefore mean different data-key derivation
+        // contexts. Roundtrip and tamper rejection remain covered above by the
+        // existing current-format and authenticated-region tests.
+        assert_ne!(
+            &first[SALT_START..SEGMENT_ENVELOPE_PREAMBLE_SIZE],
+            &second[SALT_START..SEGMENT_ENVELOPE_PREAMBLE_SIZE],
+            "each public envelope must receive a fresh random salt and nonce"
+        );
     }
 
     #[test]

nodedb/src/control/security/identity/external_authority.rs

@@ -114,6 +114,8 @@ fn parse_role_infallible(name: &str) -> Role {
 
 #[cfg(test)]
 mod tests {
+    use proptest::prelude::*;
+
     use super::*;
 
     #[test]
@@ -135,4 +137,45 @@ mod tests {
         assert!(identity.roles.contains(&Role::ReadWrite));
         assert!(identity.roles.contains(&Role::Custom("custom".into())));
     }
+
+    proptest! {
+        #![proptest_config(ProptestConfig::with_cases(128))]
+
+        #[test]
+        fn external_claims_never_control_superuser_or_tenant(
+            role_names in prop::collection::vec(
+                prop::string::string_regex("[A-Za-z0-9_-]{0,24}")
+                    .expect("bounded role-name regex must be valid"),
+                0..16,
+            ),
+            asserted_superuser in any::<bool>(),
+            claim_tenant in 0_u64..=1_000_000,
+            provider_tenant in 0_u64..=1_000_000,
+        ) {
+            // `claim_tenant` represents the legacy tenant assertion decoded
+            // before this conversion boundary. It is deliberately absent from
+            // `ExternalClaims`; include it in an otherwise untrusted claim
+            // field to exercise arbitrary claim values without giving it
+            // tenant authority.
+            let subject = format!("external-{claim_tenant}");
+            let identity = identity_from_external_claims(
+                ExternalClaims {
+                    user_id: 7,
+                    subject: &subject,
+                    role_names: &role_names,
+                    asserted_superuser,
+                },
+                ExternalProviderBinding::default_database(TenantId::new(provider_tenant)),
+            );
+
+            prop_assert!(!identity.is_superuser());
+            prop_assert!(!identity.roles.contains(&Role::Superuser));
+            prop_assert_eq!(
+                identity.tenant_id,
+                TenantId::new(provider_tenant),
+                "claim tenant {} must not control the identity tenant",
+                claim_tenant
+            );
+        }
+    }
 }

nodedb/src/control/security/jwt.rs

@@ -643,6 +643,45 @@ mod tests {
         );
     }
 
+    #[test]
+    fn signed_hs256_token_without_expiration_is_rejected() {
+        use hmac::{Hmac, Mac};
+        use sha2::Sha256;
+
+        let secret = b"shared-secret";
+        let issued_at = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .expect("test clock must be after epoch")
+            .as_secs();
+        let header = base64_url_encode(br#"{"alg":"HS256","typ":"JWT"}"#);
+        let payload = base64_url_encode(
+            format!(
+                r#"{{"sub":"alice","iss":"https://issuer.example/","aud":"nodedb-api","iat":{issued_at},"user_id":7}}"#
+            )
+            .as_bytes(),
+        );
+        let signing_input = format!("{header}.{payload}");
+        let mut mac = Hmac::<Sha256>::new_from_slice(secret).expect("valid HMAC fixture key");
+        mac.update(signing_input.as_bytes());
+        let token = format!(
+            "{signing_input}.{}",
+            base64_url_encode(&mac.finalize().into_bytes())
+        );
+        let validator = JwtValidator::new(JwtConfig {
+            algorithm: Some(JwtAlgorithm::Hs256),
+            hmac_secret: secret.to_vec(),
+            expected_issuer: "https://issuer.example/".into(),
+            expected_audience: "nodedb-api".into(),
+            tenant_id: Some(42),
+            ..Default::default()
+        });
+
+        assert_eq!(
+            validator.validate(&token).err(),
+            Some(JwtError::MissingExpiration)
+        );
+    }
+
     #[test]
     fn none_algorithm_rejected() {
         let header = base64_url_encode(br#"{"alg":"none"}"#);