fix(mesh): Batch B review fixes — bounded store read, cache poison guard, test hardening

2026-08-06 04:10:03 -04:00
parent 68a416e4fc
commit 24e55d3395
7 changed files with 314 additions and 68 deletions
@@ -30,10 +30,17 @@ public sealed class CentralCommandAuthInterceptorTests

    private static ServerCallContext CreateContext(
        string method, string? authorizationHeader, string? clusterHeader)
+        => CreateContext(
+            method,
+            authorizationHeader is null ? [] : [authorizationHeader],
+            clusterHeader);
+
+    private static ServerCallContext CreateContext(
+        string method, string[] authorizationHeaders, string? clusterHeader)
    {
        var headers = new Metadata();
-        if (authorizationHeader is not null)
-            headers.Add("authorization", authorizationHeader);
+        foreach (var value in authorizationHeaders)
+            headers.Add("authorization", value);
        if (clusterHeader is not null)
            headers.Add("x-otopcua-cluster", clusterHeader);

@@ -143,6 +150,47 @@ public sealed class CentralCommandAuthInterceptorTests
        ex.StatusCode.ShouldBe(StatusCode.PermissionDenied);
    }

+    [Fact]
+    public async Task ReportApply_WithAJunkAuthorizationHeaderBeforeTheRealOne_IsDenied()
+    {
+        // First entry wins, and it must parse. Scanning past a non-Bearer header for a later one
+        // would let a caller smuggle its credential behind a header an intermediary may have
+        // inspected or rewritten, and would make WHICH credential is checked depend on ordering
+        // nothing guarantees. Pinned identically on MeshCommandAuthInterceptor.
+        var interceptor = CreateInterceptor(("SITE-A", "psk-site-a"));
+        var context = CreateContext(
+            ReportApplyMethod, ["junk", "Bearer psk-site-a"], "SITE-A");
+
+        var ex = await Should.ThrowAsync<RpcException>(() => Invoke(interceptor, context));
+        ex.StatusCode.ShouldBe(StatusCode.PermissionDenied);
+    }
+
+    [Fact]
+    public async Task EveryDenialArm_ReturnsAnIdenticalDetail()
+    {
+        // The anti-enumeration mechanism IS this identity: the caller supplies the cluster id, so a
+        // reply distinguishing "no key for that cluster" from "wrong key" would let an
+        // unauthenticated caller read central's cluster set off the wire. Asserting only StatusCode
+        // would let a well-meaning "more helpful message" edit break it silently.
+        // (Content-level only — the class remark records the timing oracle that survives until the
+        // Phase 1A known-cluster-set gate.)
+        var interceptor = CreateInterceptor(("SITE-A", "psk-site-a"));
+
+        var noHeader = await Should.ThrowAsync<RpcException>(() => Invoke(
+            interceptor, CreateContext(ReportApplyMethod, "Bearer psk-site-a", clusterHeader: null)));
+        var unknownCluster = await Should.ThrowAsync<RpcException>(() => Invoke(
+            interceptor, CreateContext(ReportApplyMethod, "Bearer psk-site-a", "SITE-Z")));
+        var wrongToken = await Should.ThrowAsync<RpcException>(() => Invoke(
+            interceptor, CreateContext(ReportApplyMethod, "Bearer wrong", "SITE-A")));
+        var noToken = await Should.ThrowAsync<RpcException>(() => Invoke(
+            interceptor, CreateContext(ReportApplyMethod, authorizationHeader: null, clusterHeader: "SITE-A")));
+
+        unknownCluster.Status.Detail.ShouldBe(noHeader.Status.Detail);
+        wrongToken.Status.Detail.ShouldBe(noHeader.Status.Detail);
+        noToken.Status.Detail.ShouldBe(noHeader.Status.Detail);
+        noHeader.Status.Detail.ShouldNotBeNullOrWhiteSpace();
+    }
+
    [Fact]
    public async Task ServerStreamingPath_IsAlsoGated()
    {