0.9: revert Lambda@Edge auth changes to dodge cross-region export deadlock

The auth Lambda hardening (timing-safe compare, Max-Age 30d, safeRedirectPath, security headers on 403) is sound, but ANY code change to the Lambda@Edge function publishes a new version, which forces the CDK CrossRegionExportWriter to update an SSM export that's still in use by GoodHabitTracker. The export update is rejected and the cert stack rolls back to UPDATE_ROLLBACK_FAILED.

Recovered the cert stack with: aws cloudformation continue-update-rollback --stack-name GoodHabitTrackerCert --region us-east-1 --resources-to-skip ExportsWriteruswest209BD44F0A7CF058B

All other v0.9 hardening (CloudFront response headers, /api/* query-forwarding off, 64KB body cap, generic errors, sprint numeric validation, escapeHtml on data-id, log retention, memorySize 256, DDB PITR, S3 versioning, backup scripts rewritten, UX/a11y) is unchanged and will ship on the next attempt. The auth Lambda work is documented as deferred to v0.10 - it needs a re-architecture of the cross-region reference (Lambda alias ARN with stable cross-region SSM key, or a 2-step deploy workflow that handles the in-use export gracefully).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: StevenEmelander

CHANGELOG.md

@@ -15,17 +15,27 @@ and `ddb-meta-20260519-122914.json` are the immediately-pre-wipe snapshots).
 ### Security
 
 - **CloudFront `ResponseHeadersPolicy` on the default behavior.** Adds `Strict-Transport-Security: max-age=63072000; includeSubDomains; preload`, a tight `Content-Security-Policy` (`default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`), `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, `Referrer-Policy: no-referrer`. The `/api/*` behavior uses the lighter AWS-managed `SECURITY_HEADERS` policy.
-- **Timing-safe cookie compare** in the Lambda@Edge auth function. Switched both `htok` and `unlock`-querystring hash comparisons from `===` to `crypto.timingSafeEqual` on equal-length hex buffers.
-- **`htok` cookie Max-Age dropped from 365 days to 30 days.** Bounds the impact of a leaked cookie; the user re-unlocks via bookmark or email URL after expiry.
-- **Open-redirect defense** on the unlock-success branch — `request.uri` passes through a `safeRedirectPath` helper that rejects anything not starting with a single `/`.
-- **Security headers on the 403 "private" auth response** (`X-Content-Type-Options`, `X-Frame-Options`, `Referrer-Policy`).
 - **CloudFront API origin: `QueryStringBehavior.none()`** (was `.all()`). No `/api/*` route reads query strings, so dropping them shrinks attack surface — an `unlock=` param can't accidentally reach the API origin if edge auth is ever bypassed.
 - **64 KiB request-body cap** in `getBody`. Returns 413 before any handler sees an oversized payload; previously the 6 MB Function URL ceiling was the only limit.
 - **Generic 500 error responses.** The catch-all in `index.js` no longer echoes SDK error messages (which could leak table names / ARNs / AWS error codes). Errors are `console.error`-logged server-side; the response body is `{ "error": "internal" }`.
 - **Server-side validation of sprint numeric fields.** New `safeLengthDays`, `safeGoalPoints`, `safePointStep` helpers in `sprints.js` clamp/validate `lengthDays` (1..365 integer), `goalPoints` (0..10000 finite), and `pointStep` (must be one of `[0.1, 0.25, 0.5, 1]`). Defends against `NaN`/non-numeric values from a buggy or hostile client.
 - **`Array.isArray` checks on `body.categories` and `body.habitDefinitions`** in both POST and PUT handlers — previously `body.categories || []` would have happily accepted a non-array value.
 - **`escapeHtml(id)` on every `data-id` attribute** in `plan-ui.js` and `entry-ui.js`. IDs come from `uid()` today so this is hygiene, but the layered defense protects against a future direct-API write of a crafted id.
 
+### Deferred to v0.10 (Lambda@Edge auth hardening)
+
+The security engineer's findings on the auth Lambda — **timing-safe cookie
+compare** (`crypto.timingSafeEqual`), **`htok` Max-Age dropped to 30 days**,
+**`safeRedirectPath` open-redirect guard**, **`nosniff`/`X-Frame-Options`/
+`Referrer-Policy` on the 403 response** — were implemented but **reverted before
+shipping** because any change to the Lambda@Edge code triggers the CDK
+cross-region SSM export deadlock (`ExportsWriteruswest209BD44F0A7CF058B` rejects
+the update because the main stack still imports the old version ARN). Shipping
+them safely requires either the documented 3-step `temp_drop_edge_auth` deploy
+(removed in v0.7 because the user disliked the auth gap) OR a re-architecture
+of the cross-region reference. Tracking as v0.10 work — the CloudFront default
+HSTS+CSP headers already cover the most important client-side guarantees.
+
 ### Cost / observability
 
 - **`logRetention: ONE_MONTH` on the sync Lambda** (was infinite — CloudWatch storage was accruing forever).

infrastructure/lambdas/auth/index.js

@@ -3,27 +3,6 @@ const crypto = require('node:crypto');
 // Unlock hash is injected by CDK at deploy time (see infrastructure/lib/cert-stack.ts).
 const UNLOCK_HASH = '__UNLOCK_HASH__';
 
-// Constant-time hex-string compare. We're comparing 64-char SHA-256 hex outputs,
-// so length is always equal and `crypto.timingSafeEqual` is well-defined.
-// Network jitter dwarfs any timing signal in practice, but this is the right
-// primitive and costs nothing.
-function safeEqualHex(a, b) {
-  if (typeof a !== 'string' || typeof b !== 'string') return false;
-  if (a.length !== b.length) return false;
-  return crypto.timingSafeEqual(Buffer.from(a, 'utf8'), Buffer.from(b, 'utf8'));
-}
-
-// Reject anything that isn't a safe same-origin redirect target. CloudFront
-// normalises `request.uri`, but defense-in-depth: only accept paths starting
-// with a single `/`, no protocol-relative `//evil.com`.
-function safeRedirectPath(uri) {
-  if (typeof uri !== 'string') return '/';
-  if (!uri.startsWith('/')) return '/';
-  if (uri.startsWith('//')) return '/';
-  if (uri.startsWith('/\\')) return '/';
-  return uri;
-}
-
 function getCookies(request) {
   const raw = (request.headers.cookie || []).map((h) => h.value).join('; ');
   const result = {};
@@ -66,16 +45,12 @@ function removeUnlockParam(querystring) {
     .join('&');
 }
 
-// Cookie lifetime: 30 days (was 365). Shorter window bounds the impact of a
-// leaked cookie; the user re-unlocks via bookmark/email URL after expiry.
-const COOKIE_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
-
 exports.handler = async (event) => {
   const request = event.Records[0].cf.request;
   const cookies = getCookies(request);
 
-  // Valid auth cookie — pass through (constant-time compare)
-  if (safeEqualHex(cookies.htok, UNLOCK_HASH)) {
+  // Valid auth cookie — pass through
+  if (cookies.htok === UNLOCK_HASH) {
     if (request.querystring?.includes('unlock=')) {
       request.querystring = removeUnlockParam(request.querystring);
     }
@@ -86,9 +61,9 @@ exports.handler = async (event) => {
   const tok = getUnlockTokenRaw(request.querystring || '');
   if (tok) {
     const tokHash = crypto.createHash('sha256').update(tok).digest('hex');
-    if (safeEqualHex(tokHash, UNLOCK_HASH)) {
+    if (tokHash === UNLOCK_HASH) {
       const qs = removeUnlockParam(request.querystring || '');
-      const dest = safeRedirectPath(request.uri) + (qs ? '?' + qs : '');
+      const dest = request.uri + (qs ? '?' + qs : '');
       return {
         status: '302',
         statusDescription: 'Found',
@@ -97,12 +72,7 @@ exports.handler = async (event) => {
           'set-cookie': [
             {
               key: 'Set-Cookie',
-              value:
-                'htok=' +
-                UNLOCK_HASH +
-                '; Path=/; Max-Age=' +
-                COOKIE_MAX_AGE_SECONDS +
-                '; HttpOnly; Secure; SameSite=Lax',
+              value: 'htok=' + UNLOCK_HASH + '; Path=/; Max-Age=31536000; HttpOnly; Secure; SameSite=Lax',
             },
           ],
           'cache-control': [{ key: 'Cache-Control', value: 'no-store, no-cache' }],
@@ -117,9 +87,6 @@ exports.handler = async (event) => {
     headers: {
       'content-type': [{ key: 'Content-Type', value: 'text/html; charset=utf-8' }],
       'cache-control': [{ key: 'Cache-Control', value: 'no-store, no-cache, private' }],
-      'x-content-type-options': [{ key: 'X-Content-Type-Options', value: 'nosniff' }],
-      'x-frame-options': [{ key: 'X-Frame-Options', value: 'DENY' }],
-      'referrer-policy': [{ key: 'Referrer-Policy', value: 'no-referrer' }],
     },
     body: '<!DOCTYPE html><html><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>private</title><style>body{background:#0a0a0b;color:#4a4a55;font-family:ui-monospace,monospace;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;font-size:13px;letter-spacing:0.1em}</style></head><body>private</body></html>',
   };