Merge pull request #389 from intendednull/audit/agent-sec

fix(agent): const-time bearer + scope gates

Author: intendednull

Cargo.lock

@@ -32,6 +32,7 @@ tracing-subscriber = { workspace = true }
 anyhow = { workspace = true }
 rand = "0.8"
 dirs = "6"
+subtle = "2"
 
 [dev-dependencies]
 willow-client = { path = "../client", features = ["test-utils"] }

crates/agent/Cargo.toml

@@ -4,7 +4,8 @@
 //! notifications to AI agents, bots, and scripts. The agent binary is a
 //! first-class Willow peer with its own Ed25519 identity.
 
-use clap::Parser;
+use clap::{Parser, ValueEnum};
+use willow_agent::scopes::TokenScope;
 use willow_agent::{auth, server};
 use willow_client::{ClientConfig, ClientHandle};
 use willow_identity::Identity;
@@ -57,6 +58,10 @@ struct Cli {
     #[arg(long, default_value = "info")]
     log_level: String,
 
+    /// Token scope for HTTP transport (least-privilege default).
+    #[arg(long, value_enum, default_value_t = ScopeArg::Messaging)]
+    scope: ScopeArg,
+
     /// Generate a new identity and exit.
     #[arg(long)]
     generate_identity: bool,
@@ -66,6 +71,27 @@ struct Cli {
     print_peer_id: bool,
 }
 
+/// CLI-friendly enum for `--scope`. Maps to `TokenScope`.
+#[derive(Copy, Clone, Debug, ValueEnum)]
+enum ScopeArg {
+    /// Messaging tools only (least-privilege default).
+    Messaging,
+    /// Read-only: no tools, all resources.
+    Read,
+    /// Full access: all tools, all resources.
+    Full,
+}
+
+impl From<ScopeArg> for TokenScope {
+    fn from(s: ScopeArg) -> Self {
+        match s {
+            ScopeArg::Messaging => TokenScope::Messaging,
+            ScopeArg::Read => TokenScope::ReadOnly,
+            ScopeArg::Full => TokenScope::Full,
+        }
+    }
+}
+
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
     let cli = Cli::parse();
@@ -148,7 +174,7 @@ async fn main() -> anyhow::Result<()> {
         }
         "http" => {
             tracing::info!("starting MCP HTTP server on {}", cli.bind);
-            server::serve_http(client, &cli.bind, Default::default(), token).await?;
+            server::serve_http(client, &cli.bind, cli.scope.into(), token).await?;
         }
         other => {
             anyhow::bail!("unsupported transport: {other} (supported: 'stdio', 'http')");

crates/agent/src/main.rs

@@ -163,7 +163,16 @@ impl<N: Network> ServerHandler for WillowMcpServer<N> {
         request: ReadResourceRequestParams,
         _context: RequestContext<RoleServer>,
     ) -> impl Future<Output = Result<ReadResourceResult, ErrorData>> + Send + '_ {
-        async move { resources::read_resource(&self.client, &request.uri).await }
+        async move {
+            if !self.scope.allows_resource(&request.uri) {
+                return Err(ErrorData::new(
+                    ErrorCode::INVALID_REQUEST,
+                    format!("resource '{}' not allowed by token scope", request.uri),
+                    None,
+                ));
+            }
+            resources::read_resource(&self.client, &request.uri).await
+        }
     }
 }
 
@@ -232,7 +241,7 @@ async fn bearer_auth_middleware(
     match auth_header {
         Some(value) if value.starts_with("Bearer ") => {
             let provided = &value["Bearer ".len()..];
-            if provided == expected_token {
+            if tokens_eq_ct(provided.as_bytes(), expected_token.as_bytes()) {
                 next.run(req).await
             } else {
                 (StatusCode::FORBIDDEN, "invalid bearer token").into_response()
@@ -242,6 +251,20 @@ async fn bearer_auth_middleware(
     }
 }
 
+/// Constant-time equality check for bearer tokens.
+///
+/// Length is compared first to avoid leaking the expected length via timing,
+/// then `subtle::ConstantTimeEq` performs a branch-free byte-wise comparison.
+/// This prevents timing side-channel attacks where an attacker measures
+/// response latency to recover the token byte by byte (issues #301, #304).
+fn tokens_eq_ct(provided: &[u8], expected: &[u8]) -> bool {
+    use subtle::ConstantTimeEq;
+    if provided.len() != expected.len() {
+        return false;
+    }
+    provided.ct_eq(expected).into()
+}
+
 use axum::response::IntoResponse;
 
 #[cfg(test)]