fix(auth): SigV4 sends derived ApiKey for uploads; auth verify uses gated endpoint

- auth.GetAuthHeader now returns the derived ApiKey (ApiKey <org>:<hmac>) for
  SigV4 instead of an empty header, and the upload client uses it directly
  (dropping the fragile cross-service JWT exchange).
- 'auth verify' now validates against an authenticated VDB endpoint (same as
  login) instead of /uploads/verify, which is served by a different service.

Author: 0x73746F66

cmd/auth.go

@@ -602,9 +602,9 @@ func runAuthVerify(cmd *cobra.Command) error {
 	progress.Update(1, fmt.Sprintf("Loaded credentials for org %s", creds.OrgID))
 
 	progress.SetStage("Verifying credentials with Vulnetix API")
-	client := upload.NewClient(verifyBaseURL, creds)
-	result, err := client.VerifyAuth()
-	if err != nil {
+	// Validate against an authenticated VDB endpoint (same path as login), not
+	// the /uploads/* service.
+	if err := testAuth(ctx, creds); err != nil {
 		progress.Fail("verification failed")
 		return fmt.Errorf("verification failed: %w", err)
 	}
@@ -613,7 +613,7 @@ func runAuthVerify(cmd *cobra.Command) error {
 
 	ctx.Logger.Info(display.CheckMark(t) + " Authentication verified successfully")
 	ctx.Logger.Result(display.KeyValue(t, []display.KVPair{
-		{Key: "Organization", Value: result.OrgID},
+		{Key: "Organization", Value: creds.OrgID},
 	}))
 	return nil
 }

internal/upload/client.go

@@ -51,10 +51,6 @@ type Client struct {
 	HTTPClient    *http.Client
 	GitHubContext *GitHubActionsContext
 	CliEnv        *vdb.CliEnv
-
-	// sigv4Client is a lazily-created vdb client used only to perform the
-	// SigV4 -> Bearer token exchange (GetAuthHeader returns "" for SigV4).
-	sigv4Client *vdb.Client
 }
 
 // ProgressFunc reports upload stage progress against a fixed per-file goal.
@@ -430,17 +426,8 @@ func (c *Client) addAuth(req *http.Request) {
 	if c.Creds == nil {
 		return
 	}
-	// SigV4 needs a token exchange (auth.GetAuthHeader returns "" for it). The
-	// vdb client performs the SigV4 -> Bearer exchange and caches the token.
-	if c.Creds.Method == auth.SigV4 {
-		if c.sigv4Client == nil {
-			c.sigv4Client = vdb.NewClientFromCredentials(c.Creds)
-		}
-		if tok, err := c.sigv4Client.GetToken(); err == nil && tok != "" {
-			req.Header.Set("Authorization", "Bearer "+tok)
-		}
-		return
-	}
+	// GetAuthHeader handles all methods: Token -> Bearer, DirectAPIKey/SigV4 ->
+	// ApiKey <org>:<hmac>. The /uploads/* endpoints (vdb-site) accept ApiKey.
 	if header := auth.GetAuthHeader(c.Creds); header != "" {
 		req.Header.Set("Authorization", header)
 	}

pkg/auth/auth.go

@@ -1,6 +1,11 @@
 package auth
 
-import "fmt"
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+)
 
 // AuthMethod represents the authentication method to use
 type AuthMethod string
@@ -80,9 +85,11 @@ func GetAuthHeader(creds *Credentials) string {
 	case DirectAPIKey:
 		return fmt.Sprintf("ApiKey %s:%s", creds.OrgID, creds.APIKey)
 	case SigV4:
-		// SigV4 uses Bearer tokens obtained from the token exchange flow.
-		// The caller must obtain the token separately and use it as Bearer.
-		return ""
+		// The upload endpoints (vdb-site) accept the derived ApiKey; send that
+		// instead of exchanging a cross-service JWT. ApiKey = HMAC-SHA256(secret, org).
+		mac := hmac.New(sha256.New, []byte(creds.Secret))
+		mac.Write([]byte(creds.OrgID))
+		return fmt.Sprintf("ApiKey %s:%s", creds.OrgID, hex.EncodeToString(mac.Sum(nil)))
 	default:
 		return ""
 	}

pkg/auth/auth_test.go

@@ -1,6 +1,9 @@
 package auth
 
 import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
 	"testing"
 )
 
@@ -88,9 +91,13 @@ func TestGetAuthHeader_SigV4(t *testing.T) {
 		Secret: "secret",
 		Method: SigV4,
 	}
-	header := GetAuthHeader(creds)
-	if header != "" {
-		t.Errorf("expected empty header for SigV4, got %q", header)
+	// SigV4 sends the derived ApiKey for endpoints that accept ApiKey (uploads):
+	// ApiKey <org>:<HMAC-SHA256(secret, org)>.
+	mac := hmac.New(sha256.New, []byte("secret"))
+	mac.Write([]byte("test-org"))
+	want := "ApiKey test-org:" + hex.EncodeToString(mac.Sum(nil))
+	if header := GetAuthHeader(creds); header != want {
+		t.Errorf("expected %q for SigV4, got %q", want, header)
 	}
 }