fix(errors)!: forbid interpolated details in wire-facing internal errors #101

Open

CleverWild wants to merge 101 commits from error-handling-hardening into main

pull from: error-handling-hardening

merge into: MarketTakers:main

MarketTakers:main

MarketTakers:cleverwild/sznwsuou

MarketTakers:feat-shamir-custody

MarketTakers:feat-shamir

MarketTakers:feat-shamir-v2

MarketTakers:push-zvwxtnqkumlx

MarketTakers:terminate-VaultGate-connection-after-vault-lockout

MarketTakers:hashable-integrable-macro

MarketTakers:zeroized-bootstrap-token

MarketTakers:feat-auto-fix-lints

MarketTakers:enforcing-integrity

MarketTakers:push-wxnlsulvnrpz

MarketTakers:check-uac-cerf

MarketTakers:impl-useragent_delete_grant

MarketTakers:Client-key-replacement-attack

MarketTakers:critical-fix-CI-check-all-features

MarketTakers:win-service

MarketTakers:fix-proto-build-script

MarketTakers:terrors-refactor

MarketTakers:PoC-terrors

MarketTakers:push-lspnytwuyulm

MarketTakers:key-alternative

MarketTakers:push-yyxvkwvyspxv

MarketTakers:security-breaktrougth

Conversation 0 Commits 101 Files Changed 246 +22265 -5537

101 Commits

Author	SHA1	Message	Date
CleverWild	e79fc055d4	fix(errors)!: forbid interpolated details in wire-facing internal errors	2026-08-09 00:11:03 +02:00
Stas	357726bc5d	Merge pull request 'security: batch of fixes' (#95) from zeroized-bootstrap-token into main ... Reviewed-on: #95	2026-06-29 18:00:14 +00:00
Clippy Bot	23827c613e	test(client-auth): update metadata test to reflect frozen-metadata behavior	2026-06-28 12:06:06 +02:00
Clippy Bot	8381b68a52	Merge branch 'main' into zeroized-bootstrap-token	2026-06-27 13:25:27 +02:00
Clippy Bot	022003ac5e	fix: lints	2026-06-25 20:09:18 +02:00
CleverWild	00ddf99d77	fix!: protect evm_wallet integrity and bind key ciphertext to wallet address ... Three independent failures allowed an offline attacker with DB write access to sign transactions using a different wallet's private key: 1. evm_wallet had no HMAC envelope — aead_encrypted_id could be swapped silently. 2. AEAD used a static tag as AAD — any valid ciphertext decrypted as any wallet key. 3. No post-decryption check that the derived address matched the requested wallet. Fix: sign_entity covers (address, aead_encrypted_id) in a single transaction; CreateNew/Decrypt take caller-provided AAD (wallet address bytes); after decryption signer.address() is verified against the requested wallet address.	2026-06-22 17:53:34 +02:00
CleverWild	b7ab5c79b7	fix(client-auth): freeze client metadata after initial operator approval	2026-06-22 16:07:58 +02:00
CleverWild	b8e092b9d7	fix(operator): bind sign-transaction to operator-approved client set	2026-06-22 15:58:40 +02:00
CleverWild	9c9dc1fbb5	fix(integrity): return AttestationStatus::Unavailable for key version mismatch	2026-06-22 15:50:43 +02:00
CleverWild	77bf19f99e	fix(wallet): delete access entries by entry ID instead of wallet ID	2026-06-22 14:55:32 +02:00
CleverWild	f0456157d5	security(bootstrap): use SafeCell for token storage instead of zeroize	2026-06-19 22:53:28 +02:00
CleverWild	c12c12d73e	fix(UA): signing endpoint accepts arbitrary client_id	2026-06-19 22:21:48 +02:00
CleverWild	670448292a	security: feat unseal and bootstrap handshake brute-force protection	2026-06-18 21:16:38 +02:00
CleverWild	85f27d8f09	fix(bootstrap): token persists on disk with weak file permissions #59	2026-06-18 20:59:24 +02:00
CleverWild	32ceb27d77	security(server): use SysRng directly for bootstrap token generation ... Replace make_rng()/StdRng with UnwrapErr(SysRng) to eliminate the PRNG intermediate layer and make OS entropy derivation explicit and unambiguous. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-18 19:30:31 +02:00
CleverWild	dc03923c24	security(memory): zeroization of bootstrap token	2026-06-18 17:16:06 +02:00
CleverWild	b843105533	fix(user-agent): zombie sessions #74	2026-06-18 16:29:43 +02:00
Stas	a8e4a710f1	Merge pull request 'security(server): bind grant revocation state (revoked_at) to integrity hash' (#83) from security-hash-revoke_at into main ... Reviewed-on: #83	2026-06-11 09:44:28 +00:00
CleverWild	d99c87c473	fix: lints	2026-06-09 21:07:01 +02:00
CleverWild	303120c9ac	Merge branch 'main' into security-hash-revoke_at	2026-06-09 20:58:20 +02:00
CleverWild	32f317384d	security(evm): remove client-controlled wallet_access_id from grant revocation	2026-06-09 19:36:44 +02:00
CleverWild	4bb2c062dc	feat(evm): add wallet_access_id to grant deletion requests and revocation logic	2026-06-09 19:16:21 +02:00
CleverWild	b0a3f37cea	refactor(evm): implement revoke_grant method for grant revocation	2026-06-09 19:11:39 +02:00
CleverWild	58a72da46c	Merge branch 'security-hash-revoke_at' of ssh://git.markettakers.org:22222/MarketTakers/arbiter into security-hash-revoke_at	2026-06-09 19:10:57 +02:00
CleverWild	e287459b10	revert(server): bind grant revocation state (revoked_at) to integrity hash	2026-06-09 18:45:30 +02:00
CleverWild	3c482da917	fix(smlang::statemachine): macro invocation requires inner types to be public	2026-06-08 18:00:52 +02:00
Skipper	3f801abdff	housekeeping(server): deps upgrade + diesel migration to AsyncFnOnce	2026-05-01 11:22:40 +02:00
Skipper	2b44570ab4	fix(server): MacOS build version	2026-04-19 13:47:47 +02:00
Skipper	1f9b253433	housekeeping(server): removed unused deps	2026-04-19 13:46:49 +02:00
Skipper	a1c3ffd2d1	refactor: rename to to better reflect meaning	2026-04-19 13:41:50 +02:00
Skipper	fd25de32a1	docs: move to folder and update to new challenge payload	2026-04-18 15:17:18 +02:00
Skipper	9ab074170b	merge: feat-lints into main	2026-04-18 15:04:33 +02:00
Stas	18b8a3bbf5	Merge pull request 'refactor-integrity-check' (#90) from refactor-integrity-check into main ... Reviewed-on: #90	2026-04-18 11:54:30 +00:00
Skipper	38cf1b98b9	housekeeping(server): clippy warns fix	2026-04-18 13:53:11 +02:00
Skipper	9cf87b2058	merge: refactor-integrity-check into main	2026-04-18 13:46:28 +02:00
Skipper	929d50b589	housekeeping(server): clean too-broad visibility markers and organize imports	2026-04-18 13:30:09 +02:00
Skipper	70acfc99b5	merge: refactor-integrity-check into main	2026-04-18 13:19:13 +02:00
Stas	28f84d03ab	Merge pull request 'housekeeping(server): dependencies upgrade' (#89) from push-zmvtzuwrnyyv into main ... Reviewed-on: #89	2026-04-17 19:20:50 +00:00
Skipper	4a8e51ef32	docs: updated to new auth challenge format and removed stale TOCTOU race condition note	2026-04-17 18:25:55 +02:00
Skipper	9ee86afc19	fix(useragent): now using new challenge format	2026-04-17 18:19:51 +02:00
Skipper	790026e93b	fix(server::tests): api surface of auth challenge changed	2026-04-17 17:58:22 +02:00
Skipper	0e09afda5d	refactor(server::{useragent::auth, client::auth}): use random based + timestamp nonce instead of monotonic counter in database	2026-04-17 17:44:42 +02:00
Skipper	51e6571d80	refactor(server): now keeps track of useragents, instead of	2026-04-17 00:00:43 +02:00
Skipper	3b828d5874	refactor(server::grpc::vault_gate): standard approach using / traits	2026-04-16 22:15:18 +02:00
Skipper	a6f94e3115	fix(server): sending fixed vault state when on stage	2026-04-16 19:36:41 +02:00
hdbg	f49e995c2f	WIP: kameo::messages wiring for transport generalization	2026-04-16 17:18:46 +02:00
Skipper	e88df432fb	housekeeping(server): dependencies upgrade	2026-04-14 19:10:07 +02:00
hdbg	87ee0fe87b	feat(user-agent): add VaultGate for sealed vault authentication	2026-04-12 11:53:05 +02:00
CleverWild	41b3fc5d39	fix(lints): remove unstable ones	2026-04-10 01:00:21 +02:00
CleverWild	f6a0c32b9d	feat: rustc and clippy linting	2026-04-10 00:42:43 +02:00
hdbg	205227a3df	fix(server::integrity): vault now differentias between expected/unexpected states for commands more granularly	2026-04-08 18:21:48 +02:00
hdbg	a4070e7df7	fix(useragent): unsafe, but working implementation of ml-dsa	2026-04-08 17:43:51 +02:00
hdbg	6b8da567dd	fix(server::user_agent): useragents now self-sign themselves on bootstrap	2026-04-08 17:40:45 +02:00
hdbg	1585f90cae	refactor(server): reorganized client/user_agent actors into separate module peers and added event MessageBus	2026-04-08 12:34:16 +02:00
CleverWild	5a34463228	security(server): bind grant revocation state (revoked_at) to integrity hash	2026-04-08 12:09:54 +02:00
Stas	62dff3f810	Merge pull request 'refactor(hashing): introduce Hashable derive macro and migrate server types' (#82) from hashing-proc-macro into main ... Reviewed-on: #82 Reviewed-by: Stas <business@jexter.tech>	2026-04-08 00:18:40 +00:00
CleverWild	6e22f368c9	refactor(hashing): introduce Hashable derive macro and migrate server types	2026-04-08 01:32:59 +02:00
Stas	f3cf6a9438	Merge pull request 'Post-quantum crypto and better useragent security' (#80) from push-xrxykvkuxpsv into main ... Reviewed-on: #80	2026-04-07 19:26:54 +00:00
hdbg	a9f9fc2a9d	housekeeping(server): fixed clippy warns	2026-04-07 16:28:47 +02:00
hdbg	d22ab49e3d	refactor(server): moved shared module crypto into arbiter-crypto	2026-04-07 16:24:51 +02:00
hdbg	a845181ef6	docs: ml-dsa scheme everywhere	2026-04-07 15:02:32 +02:00
hdbg	0d424f3afc	refactor(server): migrated auth to ml-dsa	2026-04-07 14:55:31 +02:00
hdbg	1497884ce6	fix(server::bootsrapper): token compare is now constant-time	2026-04-06 18:33:47 +02:00
hdbg	b3464cf8a6	tests(server::client::auth): integrity envelope insertion for valid paths	2026-04-06 18:24:13 +02:00
hdbg	46d1318b6f	feat(server): add integrity verification for client keys	2026-04-06 18:13:11 +02:00
Stas	9c80d51d45	Merge pull request 'fix(server): replaced postcard-based integrity fingerprint with custom trait providing order-independent hashing' (#77) from push-opwuyuwxknyo into main ... Reviewed-on: #77	2026-04-06 15:42:47 +00:00
hdbg	33456a644d	tests(server): property-based testing for ordering independency for hash	2026-04-06 17:40:41 +02:00
hdbg	5bc0c42cc7	fix(server): replaced postcard-based integrity fingerprint with custom trait providing order-independent hashing	2026-04-06 16:25:32 +02:00
hdbg	f6b62ab884	fix(server): added chain_id check and covered check_shared_constraints with unit tests	2026-04-06 12:57:18 +02:00
hdbg	2dd5a3f32f	tests(server): initial cargo-mutants	2026-04-06 12:03:56 +02:00
hdbg	1aca9d4007	fix(server): simplify hash function for debug profile	2026-04-05 22:50:28 +02:00
Stas	5ee1b49c43	Merge pull request 'feat(server): integrity envelope engine for EVM grants with HMAC verification' (#51) from integrity-envelope into main ... Reviewed-on: #51	2026-04-05 16:26:51 +00:00
hdbg	00745bb381	tests(server): fixed for new integrity checks	2026-04-05 14:49:02 +02:00
hdbg	b122aa464c	refactor(server): rework envelopes and integrity check	2026-04-05 14:17:00 +02:00
hdbg	9fab945a00	fix(server): remove stale mentions of miette	2026-04-05 10:45:24 +02:00
CleverWild	aeed664e9a	chore: inline integrity proto types	2026-04-05 10:44:21 +02:00
CleverWild	4057c1fc12	feat(server): integrity envelope engine for EVM grants with HMAC verification	2026-04-05 10:44:21 +02:00
hdbg	f5eb51978d	docs: add recovery operators and multi-operator details	2026-04-05 08:27:24 +00:00
hdbg	d997e0f843	docs: add multi-operator governance section	2026-04-05 08:27:24 +00:00
hdbg	7aca281a81	merge: @main into client-integrity-verification	2026-04-05 10:25:46 +02:00
hdbg	01b12515bd	housekeeping(server): fixed clippy warns	2026-04-04 14:33:48 +02:00
hdbg	4a50daa7ea	refactor(user-agent): remove backfill pubkey integrity tags	2026-04-04 14:32:00 +02:00
hdbg	352ee3ee63	fix(server): previously, user agent auth accepted invalid signatures	2026-04-04 14:28:07 +02:00
hdbg	dd51d756da	refactor(server): separate crypto by purpose and moved outside of actor into separate module	2026-04-04 14:21:52 +02:00
CleverWild	0bb6e596ac	feat(auth): implement attestation status verification for public keys	2026-04-04 12:10:45 +02:00
CleverWild	881f16bb1a	fix(keyholder): comment drift	2026-04-04 12:02:50 +02:00
CleverWild	78895bca5b	refactor(keyholder): generalize derive_useragent_integrity_key and compute_useragent_pubkey_integrity_tag corespondenly to derive_integrity_key and compute_integrity_tag	2026-04-04 12:00:39 +02:00
CleverWild	a02ef68a70	feat(auth): add seal-key-derived pubkey integrity tags with auth enforcement and unseal backfill	2026-03-30 00:17:04 +02:00
hdbg	e5be55e141	style(dashboard): format code and add title margin	2026-03-29 10:54:02 +02:00
hdbg	8f0eb7130b	feat(grants-create): add configurable grant authorization fields	2026-03-29 00:37:58 +01:00
hdbg	94fe04a6a4	refactor(useragent::evm::grants): split into more files & flutter_form_builder usage	2026-03-29 00:37:58 +01:00
hdbg	976c11902c	fix(useragent::dashboard): screen pushed twice due to improper listen hook	2026-03-29 00:37:58 +01:00
hdbg	c8d2662a36	refactor(grants): wrap grant list in SingleChildScrollView	2026-03-29 00:37:58 +01:00
hdbg	ac5fedddd1	style(dashboard): remove const from _CalloutBell and add title to nav rail	2026-03-29 00:37:58 +01:00
hdbg	0c2d4986a2	refactor(useragent): moved shared CreamPanel and StatePanel into generic widgets	2026-03-29 00:37:58 +01:00
hdbg	a3203936d2	feat(evm): add EVM grants screen with create UI and list	2026-03-29 00:37:58 +01:00
hdbg	fb1c0ec130	refactor(proto): restructure wallet access messages for improved data organization	2026-03-29 00:37:58 +01:00
hdbg	2a21758369	refactor(server::evm): removed repetetive errors and error variants	2026-03-29 00:37:58 +01:00
hdbg	1abb5fa006	refactor(useragent::evm::table): broke down into more widgets	2026-03-29 00:37:58 +01:00
hdbg	e1b1c857fa	refactor(useragent::evm): moved out header into general widget	2026-03-29 00:37:58 +01:00
hdbg	4216007af3	feat(useragent): vibe-coded access list	2026-03-29 00:37:58 +01:00