fix(security): enforce gateway S2S verification (gateway#377 parity) - #49
Open
asachs01 wants to merge 1 commit into
Open
fix(security): enforce gateway S2S verification (gateway#377 parity)#49asachs01 wants to merge 1 commit into
asachs01 wants to merge 1 commit into
Conversation
Ports conduit gateway#377's confused-deputy fix to this vendor sidecar (fleet-wide rollout, mechanical wave — pattern already live-validated on blumira-mcp#37/threatlocker-mcp#41). Near-verbatim port of conduit src/proxy/s2s.ts verifyS2sHeader. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Mechanical-wave port of the conduit gateway S2S verification middleware (gateway#377 confused-deputy fix) into this vendor sidecar. Pattern already live-validated end-to-end on blumira-mcp#37 and threatlocker-mcp#41; this is a mechanical replication, not a fresh design.
src/s2s-verify.ts(byte-for-byte port of conduit's verifyS2sHeader)src/http.ts, right after the inverted 404 guard, before credential extraction (this repo's http.ts has no method check; credential extraction begins immediately after the guard)src/__tests__/s2s-verify.test.ts) covering accept/reject/skew/tamper/empty-secret + recipient-binding casesTest results
npx tsc --noEmit: clean, no errorsnpm run build(tsup): clean, build successnpm test(vitest run): 17/17 passing (8 pre-existing + 9 new).github/workflows/test.yml— it triggers onpull_requesttomain(andnext/next-major/beta/alpha) and runsnpm run lint,npm run build, andnpm testas required job steps.Review
Do not merge without Walter + boss review — auth surface, heightened-review-and-narrate tier.