Merge remote-tracking branch 'origin/main' into fix/ci-39457380049

Author: dormouse-bot

.github/audit/canaries/passkey-removal-keeps-sessions.patch

@@ -0,0 +1,69 @@
+Domain: hosted
+Rule: S100 — or a removed passkey's sessions survive its removal
+Expect: hosted/server/relay-api.ts
+Source: synthetic; a session no longer names the passkey that signed it in, so removing that passkey on the account page leaves its sessions live
+
+diff --git a/hosted/server/relay-api.ts b/hosted/server/relay-api.ts
+index b227f87c4..918689c6e 100644
+--- a/hosted/server/relay-api.ts
++++ b/hosted/server/relay-api.ts
+@@ -754,17 +754,14 @@ export async function admit(
+   });
+ }
+ 
+-/**
+- * A fresh session for `userId`, within its account's cap, signed in by
+- * `credentialId`: removing that passkey ends it.
+- */
+-async function mintSession(db: Client, userId: string, credentialId: string) {
++/** A fresh session for `userId`, within its account's cap. */
++async function mintSession(db: Client, userId: string, _credentialId: string) {
+   const sessionToken = randomBase64Url(RELAY_BEARER_BYTE_LENGTH);
+   const expiresAt = await admit(
+     db,
+     SESSIONS,
+     userId,
+-    { tokenHash: digest(sessionToken), userId, credentialId },
++    { tokenHash: digest(sessionToken), userId },
+     RELAY_SESSION_TTL_MS,
+   );
+   return { sessionToken, expiresAt: expiresAt! };
+diff --git a/hosted/server/tests/relay.test.ts b/hosted/server/tests/relay.test.ts
+index f26bd4613..6f64d96af 100644
+--- a/hosted/server/tests/relay.test.ts
++++ b/hosted/server/tests/relay.test.ts
+@@ -454,32 +454,20 @@ test("a passkey names the computer whose code registered it and outlives it; rem
+   expect(await minter(phone)).toEqual([{ burrowId: null }]);
+   expect((await f.call("GET", API_ROUTES.burrows, { bearer: setupSession })).status).toBe(200);
+ 
+-  // Every session a passkey signed in, setup's included, names it.
+   const signedIn = (await f.session(phone)).sessionToken;
+   const other = (await f.session(tablet)).sessionToken;
+-  expect(
+-    await f.sql(`SELECT "credentialId" FROM dormouse_relay_sessions WHERE "tokenHash" = ANY($1) ORDER BY 1`, [
+-      [digest(setupSession), digest(signedIn)],
+-    ]),
+-  ).toEqual([{ credentialId: phone.credentialId }, { credentialId: phone.credentialId }]);
+   const pending = await f.call("POST", API_ROUTES.reauthBegin, {
+     bearer: signedIn,
+     body: { binding: f.pairing(desktop.burrowId, phone) },
+   });
+   expect(pending.status).toBe(200);
+ 
+-  // Removing the passkey, as the account page does, ends its sessions and
+-  // their nonces, and it signs in to nothing again; the other passkey's stand.
++  // Removing the passkey, as the account page does, and it signs in to
++  // nothing again; the other passkey's sessions stand.
+   await f.sql(`DELETE FROM dormouse_relay_passkeys WHERE "credentialId" = $1 AND "userId" = $2`, [
+     phone.credentialId,
+     owner,
+   ]);
+-  for (const bearer of [setupSession, signedIn])
+-    expect(await f.call("GET", API_ROUTES.burrows, { bearer })).toMatchObject({
+-      status: 401,
+-      json: { error: UNAUTHORIZED_ERROR },
+-    });
+-  expect(await f.sql(`SELECT nonce FROM dormouse_relay_presence_nonces`)).toEqual([]);
+   expect((await f.signin(phone)).status).toBe(404);
+   expect((await f.call("GET", API_ROUTES.burrows, { bearer: other })).status).toBe(200);
+ });

.github/audit/canaries/pocket-presence-challenge-unchecked.patch

@@ -4,43 +4,18 @@ Expect: lib/src/remote/client/pocket-client.ts
 Source: reverses part of #1223 (Pocket signed the challenge the Relay's `begin` answered instead of deriving its own)
 
 diff --git a/lib/src/remote/client/pocket-client.test.ts b/lib/src/remote/client/pocket-client.test.ts
-index bb9c28ef3..d560251d5 100644
+index b7a91c6..25d98e3 100644
 --- a/lib/src/remote/client/pocket-client.test.ts
 +++ b/lib/src/remote/client/pocket-client.test.ts
-@@ -31,7 +31,6 @@ import {
-   generateNoiseKeyPair,
-   hashPasskeyPublicKey,
-   parsePairingInvitationUrl,
--  presenceChallenge,
-   pushEndpointFingerprint,
-   randomBase64Url,
-   toBase64Url,
-@@ -49,7 +48,6 @@ import {
+@@ -51,7 +51,6 @@ import {
    BurrowIdentityMismatchError,
    PAIRING_DENIAL_MESSAGES,
    PASSKEY_UNAVAILABLE_MESSAGE,
 -  PRESENCE_CHALLENGE_MISMATCH_MESSAGE,
    PocketClient,
    SessionExpiredError,
    SessionSupersededError,
-@@ -73,15 +71,7 @@ import {
- } from '../direct/test-fake-peer';
- import type { DirectPeerLike } from '../direct/direct-peer';
- import type { RemoteTimer } from '../ws';
--import {
--  createTestAuthenticator,
--  openConnectionSession,
--  readOutcome,
--  sendE2eFrame,
--  settle,
--  testRoutingId,
--  type TestAuthenticator,
--} from '../test-e2e-client';
-+import { createTestAuthenticator, settle, type TestAuthenticator } from '../test-e2e-client';
- import { PasskeyAlreadyRegisteredError, type WebAuthnClient } from './webauthn';
- import {
-   ACCOUNT_ID,
-@@ -2003,99 +1993,6 @@ describe('the presence proof', () => {
+@@ -2005,12 +2004,6 @@ describe('the presence proof', () => {
      return { client, prompts, finished };
    }
 
@@ -50,78 +25,30 @@ index bb9c28ef3..d560251d5 100644
 -    challenge: await presenceChallenge({ ...binding, handshakeHash: randomBase64Url(32) }, answer.relayNonce),
 -  });
 -
+   /**
+    * A paired phone, past the window its pairing opened, and another connection
+    * on that phone's own paired static which the phone never opened: the binding
+@@ -2078,38 +2071,6 @@ describe('the presence proof', () => {
+     return { harness, binding, nonce, present };
+   }
+ 
 -  it('refuses a challenge bound to another connection before any prompt, so that one gains no presence', async () => {
--    let burrowClock = Date.now();
--    const harness = await makeE2eHarness({ burrowNow: () => burrowClock });
--    const { burrowId, relay, noiseStatic, authenticator } = harness;
--    await harness.pairAndApprove(await harness.mintInvitation());
--    // Past the window the pairing opened, so the connection needs a proof.
--    burrowClock += PRESENCE_WINDOW_MAX_MS + 1;
--
--    // Another connection on this phone's own paired static, which this phone never opened.
--    const record = harness.knownBurrows.records.get(burrowId)!;
--    const clientStatic = {
--      privateKey: record.clientStaticKeyPair.privateKey,
--      publicKey: fromBase64Url(record.clientStaticKeyPair.publicKeyRaw),
--    };
--    const open = (clientId: string, connectionId: string) =>
--      openConnectionSession({
--        socket: relay.burrowSocket,
--        burrowId,
--        clientId,
--        connectionId,
--        clientStatic,
--        burrowStaticPublicKey: noiseStatic.publicKey,
--      });
--    const other = { clientId: testRoutingId(), connectionId: testRoutingId() };
--    const otherSession = await open(other.clientId, other.connectionId);
--    const otherBinding: PresenceBinding = {
--      kind: 'connection',
--      burrowId,
--      connectionId: other.connectionId,
--      burrowChallenge: otherSession.burrowChallenge,
--      handshakeHash: toBase64Url(otherSession.session.handshakeHash),
--      passkeyCredentialId: authenticator.credentialId,
--    };
--    const otherNonce = randomBase64Url(32);
+-    const { harness, binding, nonce, present } = await anotherConnectionOnThePairedStatic();
 -    const phone = await behindRelay(harness, async (answer) => ({
 -      ...answer,
--      challenge: await presenceChallenge(otherBinding, otherNonce),
+-      challenge: await presenceChallenge(binding, nonce),
 -    }));
 -
--    await expect(phone.client.connect(burrowId)).rejects.toThrow(PRESENCE_CHALLENGE_MISMATCH_MESSAGE);
+-    await expect(phone.client.connect(harness.burrowId)).rejects.toThrow(PRESENCE_CHALLENGE_MISMATCH_MESSAGE);
 -    expect(phone.prompts).toEqual([]);
 -    expect(phone.finished).toEqual([]);
 -
--    // The other connection presents whatever reached `finish`: with no tap, the
--    // Burrow admits it to nothing and opens no window for the static.
--    sendE2eFrame(relay.burrowSocket, {
--      clientId: other.clientId,
--      burrowId,
--      kind: 'connection',
--      id: other.connectionId,
--      step: 'transport',
--      ct: toBase64Url(
--        otherSession.session.sendControl({
--          presence: {
--            binding: otherBinding,
--            relayNonce: otherNonce,
--            accountId: ACCOUNT_ID,
--            passkeyCredentialId: authenticator.credentialId,
--            passkeyPublicKey: authenticator.publicKey,
--            assertion: phone.finished[0],
--          },
--        }),
--      ),
--    });
--    expect(
--      await readOutcome(relay.burrowSocket, otherSession.session, 'connection', other.connectionId),
--    ).toMatchObject({ ok: false });
--    expect((await open(testRoutingId(), testRoutingId())).offer).toBe('none');
+-    // The other connection presents whatever reached `finish`: with no tap, it gains nothing.
+-    await present(phone.finished[0]);
 -
 -    // An honest `begin` still connects, with the one prompt it needs.
 -    const honest = await behindRelay(harness, async (answer) => answer);
--    expect(await honest.client.connect(burrowId)).toEqual({ ok: true, burrowLabel: BURROW_LABEL });
+-    expect(await honest.client.connect(harness.burrowId)).toEqual({ ok: true, burrowLabel: BURROW_LABEL });
 -    expect(honest.prompts).toHaveLength(1);
 -  });
 -
@@ -141,7 +68,7 @@ index bb9c28ef3..d560251d5 100644
      const harness = await makeE2eHarness();
      const phone = await behindRelay(
 diff --git a/lib/src/remote/client/pocket-client.ts b/lib/src/remote/client/pocket-client.ts
-index 79f5c541b..e65c42a3d 100644
+index 33381cf..352a714 100644
 --- a/lib/src/remote/client/pocket-client.ts
 +++ b/lib/src/remote/client/pocket-client.ts
 @@ -38,7 +38,6 @@ import {
@@ -152,7 +79,7 @@ index 79f5c541b..e65c42a3d 100644
    pushEndpointFingerprint,
    pushSubscriptionDeletePath,
    randomBase64Url,
-@@ -354,14 +353,6 @@ export const CONNECTION_DENIAL_MESSAGES: Record<ConnectionDenialCode, string> =
+@@ -356,14 +355,6 @@ export const CONNECTION_DENIAL_MESSAGES: Record<ConnectionDenialCode, string> =
    'burrow-error': 'The computer could not finish the connection.',
  };
 
@@ -167,7 +94,7 @@ index 79f5c541b..e65c42a3d 100644
  /**
   * What a ceremony that simply never answered reports.
   *
-@@ -1160,12 +1151,6 @@ export class PocketClient {
+@@ -1170,12 +1161,6 @@ export class PocketClient {
     * authenticates no other pairing or connection; the Relay's `finish` proves
     * nothing to the Burrow, which recomputes the challenge and verifies the same
     * assertion itself.
@@ -180,7 +107,7 @@ index 79f5c541b..e65c42a3d 100644
     */
    async #provePresence(binding: PresenceBinding): Promise<PresenceProofV1> {
      const auth = this.#auth();
-@@ -1174,13 +1159,7 @@ export class PocketClient {
+@@ -1184,13 +1169,7 @@ export class PocketClient {
        { binding },
        auth,
      );

.github/audit/canaries/pocket-signin-challenge-underived.patch

@@ -0,0 +1,99 @@
+Domain: remote
+Rule: S271 — `signin` must sign `signinChallenge` of the Relay's challenge, never its bytes
+Expect: lib/src/remote/client/pocket-client.ts
+Source: reverses part of #1243 (Pocket signed the challenge the Relay's sign-in `begin` answered as given)
+
+diff --git a/lib/src/remote/client/pocket-client.test.ts b/lib/src/remote/client/pocket-client.test.ts
+index b7a91c6..5a2ab8e 100644
+--- a/lib/src/remote/client/pocket-client.test.ts
++++ b/lib/src/remote/client/pocket-client.test.ts
+@@ -34,12 +34,10 @@ import {
+   presenceChallenge,
+   pushEndpointFingerprint,
+   randomBase64Url,
+-  signinChallenge,
+   toBase64Url,
+   type PasskeyAssertion,
+   type PresenceBinding,
+   type ReauthBeginResponse,
+-  type SigninFinishRequest,
+   type TerminalDataEvent,
+ } from 'remote-lib-common';
+ 
+@@ -2125,44 +2123,6 @@ describe('the presence proof', () => {
+     await pairing;
+     expect(phone.prompts.map((prompt) => prompt.allowCredentials)).toEqual([[harness.authenticator.credentialId]]);
+   });
+-
+-  it('signs only a sign-in challenge it derived, so a sign-in tap is never presence for another connection', async () => {
+-    const { harness, binding, nonce, present } = await anotherConnectionOnThePairedStatic();
+-    const relayChosen = await presenceChallenge(binding, nonce);
+-
+-    // A Relay that answers sign-in's `begin` with that connection's presence challenge.
+-    const prompts: string[] = [];
+-    const finishes: SigninFinishRequest[] = [];
+-    const fetch = (async (url: string, init?: RequestInit) => {
+-      const path = new URL(url, 'http://test').pathname;
+-      if (path === '/api/signin/begin') {
+-        return { ok: true, status: 200, json: async () => ({ challenge: relayChosen, rpId: RP_ID }) } as Response;
+-      }
+-      if (path === '/api/signin/finish') finishes.push(JSON.parse(init!.body as string) as SigninFinishRequest);
+-      return harness.fetch(url, init);
+-    }) as typeof globalThis.fetch;
+-    const phone = new PocketClient({
+-      wsBase: 'ws://test',
+-      fetch,
+-      webauthn: {
+-        ...fakeWebAuthn,
+-        getAssertion: (challenge) => {
+-          prompts.push(challenge);
+-          return harness.authenticator.assert(challenge, ORIGIN);
+-        },
+-      },
+-      createWebSocket: () => harness.relay.openClientSocket(),
+-      knownBurrows: memoryKnownBurrows(),
+-      pendingDeletions: memoryPendingDeletions(),
+-      storage: memoryStorage(),
+-    });
+-    await phone.signin();
+-    expect(prompts).toEqual([await signinChallenge(relayChosen)]);
+-    expect(finishes.map((finish) => finish.challenge)).toEqual([relayChosen]);
+-
+-    // That connection presents the sign-in assertion as its presence proof.
+-    await present(finishes[0]!.assertion);
+-  });
+ });
+ 
+ /**
+diff --git a/lib/src/remote/client/pocket-client.ts b/lib/src/remote/client/pocket-client.ts
+index 33381cf..3a96c14 100644
+--- a/lib/src/remote/client/pocket-client.ts
++++ b/lib/src/remote/client/pocket-client.ts
+@@ -43,7 +43,6 @@ import {
+   pushSubscriptionDeletePath,
+   randomBase64Url,
+   samplePairingCode,
+-  signinChallenge,
+   toBase64Url,
+   type ConnectionDenialCode,
+   type ConnectionRequestV1,
+@@ -606,17 +605,10 @@ export class PocketClient {
+     }
+   }
+ 
+-  /**
+-   * Sign in with a discoverable passkey; the session is kept across launches.
+-   *
+-   * **The authenticator signs `signinChallenge(begin.challenge)`, never
+-   * `begin`'s bytes**, so a Relay cannot pass off a presence challenge for a
+-   * connection of its own as a sign-in and present the tap to a Burrow.
+-   */
++  /** Sign in with a discoverable passkey; the session is kept across launches. */
+   async signin(): Promise<SigninFinishResponse> {
+     const begin = await this.#api<SigninBeginResponse>(API_ROUTES.signinBegin, {});
+-    const challenge = await signinChallenge(begin.challenge);
+-    const assertion = await this.#webauthn.getAssertion(challenge, begin.rpId);
++    const assertion = await this.#webauthn.getAssertion(begin.challenge, begin.rpId);
+     const request: SigninFinishRequest = { challenge: begin.challenge, assertion };
+     const finish = await this.#api<SigninFinishResponse>(API_ROUTES.signinFinish, request);
+     this.#setSession({

.github/audit/hosted.md

@@ -12,7 +12,7 @@ Read `docs/specs/hosted.md`, `docs/specs/one-time.md` (its "Wire contract", "Hos
 
 Check the installed `pgstencil` and `@pgstencil/auth` packages against "Deployment boundary" by reading each `dist/provenance.json`, `pnpm-lock.yaml` and `pnpm-workspace.yaml` (no `.npmrc` is tracked, so the registry is npm's default), and Hosted's runtime imports. Audit no package code, except that the `FAIL IF`s which name the packed adapter (CSRF and CORS, cookie attributes and JSON scrubbing, the revoked-login callback) may read `@pgstencil/auth`'s `dist/` to verify how Hosted configures it.
 
-Verify npm's signed SLSA provenance for each installed package/version. Use a temporary npm consumer of the exact locked versions and `npm audit signatures --json --include-attestations` (npm does not audit a pnpm-only install). A package counts only from `verified`, never from `invalid` or `missing`. Decode the verified SLSA DSSE payload and the Fulcio certificate in that bundle and judge every clause of S119 against them, the payload's `externalParameters.workflow` and `resolvedDependencies` included. npm verifies the signature and subject digest, but the payload's workflow claim alone is not the signer identity. Then check the commit against pgstencil `main` and its audit:
+Verify npm's signed SLSA provenance for each installed package/version. Run `npm audit signatures --json --include-attestations` in `hosted/`, as the production `verify` job does. A package counts only from `verified`, never from `invalid` or `missing`. Decode the verified SLSA DSSE payload and the Fulcio certificate in that bundle and judge S119's certificate and payload clauses against them, and its job clause against that step, the payload's `externalParameters.workflow` and `resolvedDependencies` included. npm verifies the signature and subject digest, but the payload's workflow claim alone is not the signer identity. Then check the commit against pgstencil `main` and its audit:
 
 ```sh
 gh api repos/diffplug/pgstencil/compare/<commit>...main --jq .status

.github/workflows/hosted-production.yml

@@ -30,6 +30,14 @@ jobs:
       - run: pnpm build:hosted
       - name: Require accepted package provenance
         run: node --input-type=module -e 'import { verifyPackages } from "./hosted/scripts/production.mjs"; await verifyPackages();'
+      # npm exits nonzero for a failure anywhere in Hosted's tree; only pgstencil's packages gate here.
+      - name: Require npm's registry signature and provenance attestation on each pgstencil package
+        working-directory: hosted
+        run: |
+          npm audit signatures --json --include-attestations > "$RUNNER_TEMP/signatures.json" || true
+          jq -e '[.invalid[], .missing[] | select(.name == "pgstencil" or .name == "@pgstencil/auth")] == []
+            and (["pgstencil", "@pgstencil/auth"] - [.verified[] | select(.attestations.provenance) | .name] == [])' \
+            "$RUNNER_TEMP/signatures.json"
       # Every Worker's static files, each under its own `dist/<worker>/`.
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: