maaz519
dd6a4cd4fa
A valid actor token is no longer enough. This adds the trust-layer core so IIOS can require a signed CONTEXT ATTESTATION from an authorized parent (AppShell etc.) before a privileged request — defeating a hacked app replaying a stolen token. - prisma: IiosClientRegistry (registered clients allowed to attest, per app) + IiosAttestationNonce (single-use replay ledger). Migration applied. - ContextAttestationVerifier + ports (ClientRegistryPort, NonceStorePort) + a dev signer. Verifies: registered+active client, signature, aud=iios, app_id matches the token AND is allowed for the client, freshness, single-use nonce. Fail-closed. - Prisma-backed stores; nonce reserve is atomic via the unique PK (P2002 = replay). - Tests (9 pass): happy path + the five rejection cases the CEO named (unknown client, wrong audience, expired, replayed nonce, app-mismatch) + forged-signature + disabled-client; a DB atomicity test (skips if engine offline). Decoupled from the request path on purpose — wiring it into the messaging guard (the three-proof gate) + demoting be-crm to an attestation forwarder is the next step. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
25 lines
914 B
SQL
25 lines
914 B
SQL
-- Trust plane (July 12): context attestation client registry + nonce replay ledger.
|
|
CREATE TABLE "IiosClientRegistry" (
|
|
"clientId" TEXT NOT NULL,
|
|
"clientType" TEXT NOT NULL,
|
|
"ownerService" TEXT,
|
|
"allowedAppIds" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[],
|
|
"attestSecret" TEXT,
|
|
"jwksUri" TEXT,
|
|
"spiffeId" TEXT,
|
|
"status" TEXT NOT NULL DEFAULT 'ACTIVE',
|
|
"createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
"updatedAt" TIMESTAMP(3) NOT NULL,
|
|
CONSTRAINT "IiosClientRegistry_pkey" PRIMARY KEY ("clientId")
|
|
);
|
|
|
|
CREATE TABLE "IiosAttestationNonce" (
|
|
"nonce" TEXT NOT NULL,
|
|
"clientId" TEXT NOT NULL,
|
|
"expiresAt" TIMESTAMP(3) NOT NULL,
|
|
"firstSeenAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
CONSTRAINT "IiosAttestationNonce_pkey" PRIMARY KEY ("nonce")
|
|
);
|
|
|
|
CREATE INDEX "IiosAttestationNonce_expiresAt_idx" ON "IiosAttestationNonce"("expiresAt");
|