Conversation
Implement full RBAC auth with JWT tokens, argon2id password hashing, and Raft-replicated state. Includes 15+ security hardening fixes from multi-pass review. Components: - proto/auth.proto: Auth service definitions with ResponseHeader - src/auth/: User, Role, Permission, TokenValidator, AuthCache, AuthInterceptor - src/api/auth.rs: AuthService gRPC implementation (17 RPCs) - src/raft/state_machine.rs: Auth apply logic with bootstrap flag - Permission checks integrated into KV, Watch, Lease, Cluster services Security hardening: - Random JWT signing key with 0600 permissions, persisted to .signing_key - Bootstrap flag prevents unauthenticated auth_enable after auth_disable - Password max length (1024 bytes) prevents argon2 CPU exhaustion - User/role name validation (null bytes, length, _aether_ prefix) - Rate limiting on authenticate and auth_enable endpoints - Constant-time error messages prevent username enumeration - AuthStatus requires authentication when auth is enabled - Watch streams detect auth re-enable and reject stale credentials - auth_disable is idempotent - Error messages redact key values
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| #[test] | ||
| fn test_hash_and_verify() { | ||
| let hash = User::hash_password(b"secret123").unwrap(); |
|
|
||
| #[test] | ||
| fn test_different_hashes_for_same_password() { | ||
| let h1 = User::hash_password(b"same").unwrap(); |
| #[test] | ||
| fn test_different_hashes_for_same_password() { | ||
| let h1 = User::hash_password(b"same").unwrap(); | ||
| let h2 = User::hash_password(b"same").unwrap(); |
| let validator = TokenValidator::new("test-secret", 24); | ||
|
|
||
| // 2. Create root user | ||
| let root_hash = User::hash_password(b"root-password-123").unwrap(); |
| cache.insert_role(app_role); | ||
|
|
||
| // 4. Create a user and grant the role | ||
| let alice_hash = User::hash_password(b"alice-password").unwrap(); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add full RBAC authentication and authorization system with JWT tokens, argon2id password hashing, and Raft-replicated state. Integrates permission checks into KV, Watch, Lease, and Cluster services.
Changes
Security hardening
How to verify
cargo build cargo test --all-targets cargo clippy -- -D warnings cargo fmt -- --checkRefs #80