fix(test-auth-generator): canonical JWT payload field order + auth-failure logging - #58
Closed
somasekimoto wants to merge 1 commit into
Closed
somasekimoto wants to merge 1 commit into
somasekimoto wants to merge 1 commit into
Conversation
… order; log redacted auth failures generate-share-token built its JWT payload with serde_json::json!, whose map keys serialize alphabetically (att, aud, exp, iat, iss, jti). The state node verifies JWT signatures by re-serializing the parsed AuthTokenPayload struct (field order iss, aud, exp, iat, jti, att), so every token the tool minted failed signature verification — which is also why the delegated-JWT read path had never been exercised end to end. The payload is now a serde struct matching monas-account's DelegationClaims field order, verified against a live 4-node mesh: recipient reads with a delegated JWT succeed on both member and non-member (relay) nodes. Also logs the detailed reason (tracing::warn) when an authentication failure is redacted to the generic HTTP "Authentication failed" body — without it, diagnosing JWT verification failures on a running node is guesswork. Note for a follow-up: verifying JWTs by re-serializing parsed structs is brittle (field order, whitespace, unknown fields all break genuine tokens). Verification should use the original wire segments captured in from_jwt instead. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PKq6ZoPVmhTZfv4oBeRF8J
This was referenced Jul 25, 2026
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要
generate-share-tokenがserde_json::json!で JWT payload を組んでいたため、キーがアルファベット順 (att, aud, exp, iat, iss, jti) にシリアライズされ、state node の JWT 署名検証と必ず不一致になっていた。state node は署名検証時にパース済みAuthTokenPayload構造体を再シリアライズして署名対象を再構築する (signing_message()) ため、発行側のフィールド順が構造体宣言順 (iss, aud, exp, iat, jti, att) と一致しない限り検証が通らない。payload を monas-account の
DelegationClaimsと同一フィールド順の serde 構造体に変更。実機検証 (4ノード mesh)
この修正の上で、委譲 JWT による share 受信者 read を実機検証済み:
併せて
認証失敗が HTTP 応答で "Authentication failed" に redact される箇所で、詳細理由を
tracing::warnに出すようにした。これがないと稼働ノードでの JWT 検証失敗の診断ができない(今回の調査でも必要だった)。Follow-up (別issue化予定)
パース済み構造体の再シリアライズによる JWT 検証は brittle (フィールド順・空白・未知フィールドで正規トークンが壊れる)。
from_jwtが保持しているワイヤ上のセグメントで検証すべき。🤖 Generated with Claude Code
https://claude.ai/code/session_01PKq6ZoPVmhTZfv4oBeRF8J