security(server): bind grant revocation state (revoked_at) to integrity hash #83

Open
CleverWild wants to merge 8 commits from security-hash-revoke_at into main
5 changed files with 19 additions and 6 deletions
Showing only changes of commit 4bb2c062dc - Show all commits

View File

@@ -90,6 +90,7 @@ message EvmGrantCreateResponse {
message EvmGrantDeleteRequest {
int32 grant_id = 1;
int32 wallet_access_id = 2;
}
message EvmGrantDeleteResponse {

View File

@@ -158,9 +158,13 @@ impl EvmActor {
}
#[message]
pub async fn useragent_delete_grant(&mut self, grant_id: i32) -> Result<(), Error> {
pub async fn useragent_delete_grant(
&mut self,
grant_id: i32,
wallet_access_id: i32,
) -> Result<(), Error> {
self.engine
.revoke_grant(grant_id)
.revoke_grant(grant_id, wallet_access_id)
.await
.map_err(Error::from)
}

View File

@@ -360,12 +360,13 @@ impl UserAgentSession {
pub(crate) async fn handle_grant_delete(
&mut self,
grant_id: i32,
wallet_access_id: i32,
) -> Result<(), GrantMutationError> {
// match self
// .props
// .actors
// .evm
// .ask(UseragentDeleteGrant { grant_id })
// .ask(UseragentDeleteGrant { grant_id, wallet_access_id })
// .await
// {
// Ok(()) => Ok(()),
@@ -374,7 +375,7 @@ impl UserAgentSession {
// Err(GrantMutationError::Internal)
// }
// }
let _ = grant_id;
let _ = (grant_id, wallet_access_id);
todo!()
}

View File

@@ -276,7 +276,11 @@ impl Engine {
Ok(id)
}
pub async fn revoke_grant(&self, basic_grant_id: i32) -> Result<(), DatabaseError> {
pub async fn revoke_grant(
&self,
basic_grant_id: i32,
wallet_access_id: i32,
) -> Result<(), DatabaseError> {
let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
let keyholder = self.keyholder.clone();
@@ -290,12 +294,14 @@ impl Engine {
update(evm_basic_grant::table)
.filter(evm_basic_grant::id.eq(basic_grant_id))
.filter(evm_basic_grant::wallet_access_id.eq(wallet_access_id))
.set(evm_basic_grant::revoked_at.eq(SqliteTimestamp(Utc::now())))
.execute(conn)
.await?;
let basic_grant: EvmBasicGrant = evm_basic_grant::table
.filter(evm_basic_grant::id.eq(basic_grant_id))
.filter(evm_basic_grant::wallet_access_id.eq(wallet_access_id))
.select(EvmBasicGrant::as_select())
.first(conn)
.await?;
@@ -799,7 +805,7 @@ mod tests {
.await
.unwrap();
engine.revoke_grant(grant_id).await.unwrap();
engine.revoke_grant(grant_id, WALLET_ACCESS_ID).await.unwrap();
let mut conn = db.get().await.unwrap();
diesel::update(evm_basic_grant::table)

View File

@@ -170,6 +170,7 @@ async fn handle_grant_delete(
let result = match actor
.ask(HandleGrantDelete {
grant_id: req.grant_id,
wallet_access_id: req.wallet_access_id,
})
.await
{