keisei/KeiSeiKit-1.0
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
KeiSeiKit-1.0/_primitives/_rust
History
Parfii-bot f47c087646 feat(auth): JWT verification + OAuth CSRF + PKCE + secret redaction 
Group B — auth-crate security hardening (post-audit Sonnet test-retest 2026-05-02).

kei-auth-apple:
- jwt.rs: full ES256 JWKS signature verification (jsonwebtoken crate);
          validates iss == https://appleid.apple.com, aud == client_id, exp, iat;
          decode_id_token_unverified is now cfg(test)-only.
          Module docstring promised this since v0.1 — now actually implemented.
- claims.rs (new): IdTokenClaims + AudClaim extracted from jwt.rs.
- error.rs: JwtVerify, JwtDecode, MissingClaim variants.
- client.rs: client_secret_jwt: SecretString (was String); exchange_code accepts
              code_verifier: Option<&str> for PKCE.
- provider.rs: verify() does CSRF expected_state ConstantTimeEq + JWT verification;
                build_auth_url accepts state + verifier and emits PKCE code_challenge.
- tests/apple_smoke.rs + helpers/: 6 tests including malformed-JWT + non-Apple OAuth +
                                     400-mapping + provider_verify_csrf_mismatch_rejected.

kei-auth-google:
- pkce.rs (new): pkce_challenge + url_encode (RFC 7636 §B.1 test vector covered).
- client.rs: client_secret: SecretString; exchange_code accepts code_verifier.
- provider.rs: verify() rejects on state mismatch; build_auth_url emits S256 challenge.
- tests/google_smoke.rs: 7 tests including CSRF mismatch.

kei-auth:
- main.rs: resolve_token() supports stdin (-) and KEI_AUTH_TOKEN env. Token positional
            arg leaked via /proc/<pid>/cmdline + shell history; same fix that v0.14.1
            applied to --key.
- main.rs::key(): hard fail if KEI_AUTH_KEY len < 32 bytes (mirror of magiclink).
- tokens.rs::verify(): query_row(...).optional()? instead of .ok() — DB errors now
                        propagate instead of being swallowed as "token unknown".

kei-runtime-core:
- secrets.rs (new, 81 LOC): SecretString newtype with redacted Debug + zeroize-on-Drop.
                              Required by every auth crate that holds secret material.
- traits/auth.rs: AuthChallenge::Password.password is now SecretString;
                   OAuthCode { state, expected_state }.
- error.rs: CsrfStateMismatch variant.

Test results: 48 passed; 0 failed across kei-auth, kei-auth-apple, kei-auth-google,
kei-auth-magiclink, kei-runtime-core. cargo check --workspace clean.

Findings consensus: Apple JWT unverified + OAuth state CSRF appeared in all 3
audit waves (Wave-1 + Wave-A + Wave-B); PKCE absence + secret-derive-Debug appeared
only in Wave-A retest, would have been missed by single-pass audit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-02 21:39:18 +08:00
..
firewall-diff KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
frustration-matrix KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-agent-runtime KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-artifact KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-atom-discovery KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-auth feat(auth): JWT verification + OAuth CSRF + PKCE + secret redaction 2026-05-02 21:39:18 +08:00
kei-auth-apple feat(auth): JWT verification + OAuth CSRF + PKCE + secret redaction 2026-05-02 21:39:18 +08:00
kei-auth-google feat(auth): JWT verification + OAuth CSRF + PKCE + secret redaction 2026-05-02 21:39:18 +08:00
kei-auth-magiclink feat(auth): JWT verification + OAuth CSRF + PKCE + secret redaction 2026-05-02 21:39:18 +08:00
kei-auth-webauthn feat(auth): JWT verification + OAuth CSRF + PKCE + secret redaction 2026-05-02 21:39:18 +08:00
kei-backend-daytona KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-brain-view KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-cache KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-capability KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-changelog KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-chat-store KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-compute-baremetal KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-compute-digitalocean KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-compute-linode KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-compute-vultr KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-conflict-scan KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-content-store KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-cortex KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-cron-scheduler KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-crossdomain KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-curator KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-db-contract feat(frontend-loop): kei-db-contract primitive + frontend-validator agent + auto-dev-guard hook 2026-05-01 15:34:39 +08:00
kei-decision KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-decompose KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-diff KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-discover KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-dna-index KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-entity-store KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-export-trajectories KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-forge KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-fork KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-frustration-loop KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-gateway KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-gdrive-import KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-git-bitbucket KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-git-forgejo KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-git-gitea KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-git-gitlab KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-graph-check KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-graph-export feat(graph): live runtime DNA viewer — kei-graph-export + lbm-graph-viz adapter 2026-05-02 13:07:21 +08:00
kei-graph-stream feat(live-graph): WebSocket activity stream — orchestrator-centric live view 2026-05-02 13:30:24 +08:00
kei-hibernate KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-import-project KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-leak-matrix KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-ledger feat(tracking): close 3 last observability gaps — toolStats + skill-record + numeric-claims journal 2026-05-02 03:42:09 +08:00
kei-ledger-sign KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-llm-bridge-mlx KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-llm-llamacpp KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-llm-mlx KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-llm-ollama KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-llm-router KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-machine-probe KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-mcp KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-memory chore(kit): wire kei-db-contract into installer + drop final #[path] hack 2026-05-01 17:55:52 +08:00
kei-memory-postgres KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-memory-redis KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-memory-sled KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-memory-sqlite KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-migrate KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-model feat(secrets+catalog): orphan-detector for env vars + image/video/voice models 2026-05-02 00:06:16 +08:00
kei-model-router KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-net-ipsec KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-net-openvpn KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-net-wireguard KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-notify-discord KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-notify-slack KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-notify-sms KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-notify-telegram KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-pet KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-ping KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-pipe KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-projects-index KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-projects-watcher KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-provision KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-prune KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-refactor-engine KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-registry feat(secrets+catalog): orphan-detector for env vars + image/video/voice models 2026-05-02 00:06:16 +08:00
kei-replay KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-router KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-runtime KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-runtime-core feat(auth): JWT verification + OAuth CSRF + PKCE + secret redaction 2026-05-02 21:39:18 +08:00
kei-sage KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-scheduler KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-search-core KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-shared KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-skill-importer KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-skills KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-social-store KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-spawn KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-store KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-svc-systemd KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-task KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-tlog KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-token-tracker KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-tty KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-watch KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
keisei KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
mock-render KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
ssh-check KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
tokens-sync KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
visual-diff KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
.gitignore KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
Cargo.lock feat(live-graph): WebSocket activity stream — orchestrator-centric live view 2026-05-02 13:30:24 +08:00
Cargo.toml feat(live-graph): WebSocket activity stream — orchestrator-centric live view 2026-05-02 13:30:24 +08:00