fix(dgw): address Copilot review on CredSSP/provisioning refactor

Authorize CleanPath tokens before one-shot take, use a registry-wide generation counter, and replace bare clippy allow with expect. SPN remains association-token dst_hst for client-facing CredSSP.

Author: irvingoujAtDevolution

devolutions-gateway/src/credential_injection.rs

@@ -531,7 +531,8 @@ pub struct SyntheticKdcRegistry {
 #[derive(Debug, Default)]
 struct RegistryInner {
     live: HashMap<Uuid, PublishedSyntheticKdc>,
-    next_generation: HashMap<Uuid, u64>,
+    /// Registry-wide monotonic counter (not per-JTI) so generations stay unique without leaking map entries.
+    next_generation: u64,
 }
 
 #[derive(Debug, Clone)]
@@ -573,16 +574,15 @@ impl SyntheticKdcRegistry {
         }
     }
 
-    fn allocate_generation(inner: &mut RegistryInner, jti: Uuid) -> u64 {
-        let slot = inner.next_generation.entry(jti).or_insert(0);
-        *slot = slot.wrapping_add(1);
-        *slot
+    fn allocate_generation(inner: &mut RegistryInner) -> u64 {
+        inner.next_generation = inner.next_generation.wrapping_add(1);
+        inner.next_generation
     }
 
     pub(crate) fn register(&self, kdc: Arc<CredentialInjectionKdc>) -> SyntheticKdcRegistration {
         let jti = kdc.jti();
         let mut inner = self.inner.lock();
-        let generation = Self::allocate_generation(&mut inner, jti);
+        let generation = Self::allocate_generation(&mut inner);
         inner.live.insert(jti, PublishedSyntheticKdc { generation, kdc });
         debug!(%jti, generation, "published synthetic KDC");
         SyntheticKdcRegistration {

devolutions-gateway/src/provisioning.rs

@@ -129,6 +129,19 @@ impl ProvisioningStore {
         self.connection_options.lock().insert(jti, entry).is_some()
     }
 
+    /// True when the credentials half is live and carries an injection mapping.
+    ///
+    /// Does not consume the entry — use before auth when deciding whether to take the
+    /// credential-injection path.
+    pub(crate) fn has_mapping(&self, jti: Uuid) -> bool {
+        let now = time::OffsetDateTime::now_utc();
+        let entries = self.credentials.lock();
+        match entries.get(&jti) {
+            Some(entry) if now < entry.expires_at => entry.mapping.is_some(),
+            _ => false,
+        }
+    }
+
     /// Take the provisioned view for a session (one-shot).
     ///
     /// Removes the credentials half (required) and any live connection-options half for `jti`.

devolutions-gateway/src/rd_clean_path.rs

@@ -320,7 +320,8 @@ async fn handle_with_credential_injection(
     subscriber_tx: SubscriberSender,
     active_recordings: &ActiveRecordings,
     cleanpath_pdu: RDCleanPathPdu,
-    credential_injection: CredentialInjection,
+    provisioning: &ProvisioningStore,
+    synthetic_kdc_registry: &SyntheticKdcRegistry,
     agent_tunnel_handle: Option<Arc<agent_tunnel::AgentTunnelHandle>>,
 ) -> anyhow::Result<()> {
     let tls_conf = conf.credssp_tls.get().context("CredSSP TLS configuration")?;
@@ -364,6 +365,19 @@ async fn handle_with_credential_injection(
     .await
     .context("RDCleanPath authorization failed")?;
 
+    let token = cleanpath_pdu
+        .proxy_auth
+        .as_deref()
+        .context("missing token in RDCleanPath PDU")?;
+    let entry = provisioning
+        .take(claims.jti)
+        .context("provisioned credentials missing after authorization")?;
+    anyhow::ensure!(entry.mapping.is_some(), "provisioned entry has no credential mapping");
+    anyhow::ensure!(token == entry.token, "token mismatch");
+    let kerberos_enabled = conf.debug.enable_unstable && conf.debug.kerberos_credential_injection;
+    let credential_injection = CredentialInjection::from_provisioned(claims.jti, entry, kerberos_enabled)?
+        .register_if_kerberos(synthetic_kdc_registry);
+
     let ConnectedRdpServer {
         tls_stream: server_stream,
         server_addr,
@@ -532,20 +546,12 @@ pub async fn handle(
 
     // If a credential mapping has been pushed, we automatically switch to
     // proxy-based credential injection mode. Otherwise, we continue the usual
-    // clean path procedure. The credential store is keyed on the association token's JTI.
+    // clean path procedure. Peek only here — take after authorize_cleanpath so an
+    // unverified token cannot burn a victim JTI's one-shot groceries.
     if let Some(jti) = crate::token::extract_jti(token).ok()
-        && let Some(entry) = provisioning.take(jti)
-        && entry.mapping.is_some()
+        && provisioning.has_mapping(jti)
     {
-        anyhow::ensure!(token == entry.token, "token mismatch");
-        let kerberos_enabled = conf.debug.enable_unstable && conf.debug.kerberos_credential_injection;
-        let credential_injection = CredentialInjection::from_provisioned(jti, entry, kerberos_enabled)?
-            .register_if_kerberos(synthetic_kdc_registry);
-        debug!(
-            jti = %credential_injection.jti(),
-            kerberos = credential_injection.uses_kerberos(),
-            "Switching to RdpProxy for credential injection (WebSocket)"
-        );
+        debug!(%jti, "Switching to RdpProxy for credential injection (WebSocket)");
 
         return handle_with_credential_injection(
             client_stream,
@@ -557,7 +563,8 @@ pub async fn handle(
             subscriber_tx,
             active_recordings,
             cleanpath_pdu,
-            credential_injection,
+            provisioning,
+            synthetic_kdc_registry,
             agent_tunnel_handle.clone(),
         )
         .await;

devolutions-gateway/src/rdp_proxy/credssp.rs

@@ -402,7 +402,10 @@ where
 
     return result;
 
-    #[allow(clippy::too_many_arguments)]
+    #[expect(
+        clippy::too_many_arguments,
+        reason = "CredSSP loop needs framed IO, identity, optional synthetic KDC, and KdcConnector together",
+    )]
     async fn credssp_loop<S>(
         framed: &mut ironrdp_tokio::Framed<S>,
         buf: &mut ironrdp_pdu::WriteBuf,