mirror of
https://github.com/ModernRelay/omnigraph.git
synced 2026-06-24 02:38:06 +02:00
c338e80180
Fixes two live authz bugs in omnigraph-server: - Bearer-token lookup previously used HashMap::get, which compares keys with Eq and short-circuits on the first differing byte — a network-observable timing oracle for brute-forcing tokens. Tokens are now stored as SHA-256 digests and compared with subtle::ConstantTimeEq, iterating every entry unconditionally so total work is independent of which slot matches. Raw token bytes no longer live in server memory after startup. - authorize_request now overwrites PolicyRequest.actor_id from the authenticated session instead of trusting the handler-supplied field, which previously defaulted to "" via unwrap_or_default(). The empty string can no longer reach Cedar as a policy subject even if a future refactor drops the None check. External API of AppState constructors is unchanged — tokens still enter as Vec<(String, String)> and are hashed on the way in. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
38 lines
1.1 KiB
TOML
38 lines
1.1 KiB
TOML
[package]
|
|
name = "omnigraph-server"
|
|
version = "0.2.2"
|
|
edition = "2024"
|
|
description = "HTTP server for the Omnigraph graph database."
|
|
license = "MIT"
|
|
repository = "https://github.com/ModernRelay/omnigraph"
|
|
homepage = "https://github.com/ModernRelay/omnigraph"
|
|
documentation = "https://docs.rs/omnigraph-server"
|
|
|
|
[[bin]]
|
|
name = "omnigraph-server"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
omnigraph = { package = "omnigraph-engine", path = "../omnigraph", version = "0.2.2" }
|
|
omnigraph-compiler = { path = "../omnigraph-compiler", version = "0.2.2" }
|
|
axum = { workspace = true }
|
|
clap = { workspace = true }
|
|
color-eyre = { workspace = true }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
tokio = { workspace = true }
|
|
serde_yaml = { workspace = true }
|
|
tracing = { workspace = true }
|
|
tracing-subscriber = { workspace = true }
|
|
tower-http = { workspace = true }
|
|
utoipa = { workspace = true }
|
|
cedar-policy = { workspace = true }
|
|
futures = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
subtle = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
tempfile = { workspace = true }
|
|
tower = { workspace = true }
|
|
serial_test = "3"
|
|
lance-index = { workspace = true }
|