João Salavisa
dccff23cc0
* feat(backend): per-launch authentication for agentctl Add nonce-based handshake protocol to secure all agentctl HTTP/WS endpoints. On launch, the parent (backend) passes a one-time bootstrap nonce via AGENTCTL_BOOTSTRAP_NONCE env var. agentctl generates its own auth token, enables Bearer auth immediately, and returns the token to the parent via POST /auth/handshake (validated by nonce). Standalone, Docker, and Sprites executors all use the same handshake flow. Removes the old AGENTCTL_AUTH_TOKEN env var approach. For Docker/Sprites, the retrieved token is persisted encrypted in SecretStore (AES-256-GCM) for crash recovery. Security properties: - Auth enabled from boot (no unprotected window) - Token never in env vars (only the burned nonce) - Nonce is one-shot (replay impossible) - Constant-time token comparison (timing-safe) * fix: check fmt.Sscanf return value in integration test * fix: address review feedback - constant-time nonce comparison, safe ID truncation * fix(backend): exempt MCP routes from agentctl auth middleware The agent subprocess connects to agentctl's MCP endpoints (/sse, /message, /mcp) to use kandev tools (create_task, ask_user_question, etc.). These endpoints run on the same HTTP server as the authenticated API, but the agent process doesn't possess the auth token — it was only exchanged between the backend and agentctl during the handshake. Exempt /sse, /message, and /mcp from the Bearer auth middleware since the agent process runs in the same trust boundary as agentctl. * refactor(backend): remove query param token fallback and document SetAuthToken constraint Remove the ?token= query parameter fallback from extractBearerToken — tokens in URLs leak via access logs, referer headers, and browser history. All WS callers already use Authorization headers via wsAuthHeaders(). Document SetAuthToken's concurrency constraint: it must not be called concurrently with HTTP requests on the same client. * fix(backend): enforce mutex in ControlClient/Launcher auth, fix Start() lock scope - Add sync.Mutex to ControlClient; protect SetAuthToken and AuthToken() reads - Guard Launcher.AuthToken() with l.mu (written under lock in Start, read unprotected) - Extract buildAndStartProcess and performHandshake from Start() (was 106 lines, over 80-line limit) - Release l.mu before blocking health/handshake calls so monitorExit() can close l.exited — previously the fast-fail path in waitForHealthy was unreachable - Update stale executor_backend.go comment (standalone no longer uses env var auth) Co-authored-by: João Salavisa <undefined@users.noreply.github.com> --------- Co-authored-by: Kandev Agent <agent@kandev.dev> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: João Salavisa <undefined@users.noreply.github.com>
78 lines
1.8 KiB
Go
78 lines
1.8 KiB
Go
package config
|
|
|
|
import "testing"
|
|
|
|
func TestConsumeNonce(t *testing.T) {
|
|
t.Run("valid nonce returns token and burns nonce", func(t *testing.T) {
|
|
cfg := &Config{
|
|
AuthToken: "test-token-123",
|
|
BootstrapNonce: "nonce-abc",
|
|
}
|
|
|
|
token := cfg.ConsumeNonce("nonce-abc")
|
|
if token != "test-token-123" {
|
|
t.Fatalf("expected test-token-123, got %q", token)
|
|
}
|
|
|
|
// Second call should fail (nonce burned)
|
|
token2 := cfg.ConsumeNonce("nonce-abc")
|
|
if token2 != "" {
|
|
t.Fatalf("expected empty after nonce burn, got %q", token2)
|
|
}
|
|
})
|
|
|
|
t.Run("wrong nonce returns empty", func(t *testing.T) {
|
|
cfg := &Config{
|
|
AuthToken: "test-token",
|
|
BootstrapNonce: "correct-nonce",
|
|
}
|
|
|
|
token := cfg.ConsumeNonce("wrong-nonce")
|
|
if token != "" {
|
|
t.Fatalf("expected empty for wrong nonce, got %q", token)
|
|
}
|
|
|
|
// Original nonce should still work
|
|
token2 := cfg.ConsumeNonce("correct-nonce")
|
|
if token2 != "test-token" {
|
|
t.Fatalf("expected test-token, got %q", token2)
|
|
}
|
|
})
|
|
|
|
t.Run("empty nonce returns empty", func(t *testing.T) {
|
|
cfg := &Config{
|
|
AuthToken: "test-token",
|
|
BootstrapNonce: "some-nonce",
|
|
}
|
|
|
|
token := cfg.ConsumeNonce("")
|
|
if token != "" {
|
|
t.Fatalf("expected empty for empty nonce, got %q", token)
|
|
}
|
|
})
|
|
|
|
t.Run("no bootstrap nonce configured returns empty", func(t *testing.T) {
|
|
cfg := &Config{
|
|
AuthToken: "test-token",
|
|
}
|
|
|
|
token := cfg.ConsumeNonce("any-nonce")
|
|
if token != "" {
|
|
t.Fatalf("expected empty when no nonce configured, got %q", token)
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestGenerateSelfToken(t *testing.T) {
|
|
token := generateSelfToken()
|
|
if len(token) != 64 { // 32 bytes hex-encoded = 64 chars
|
|
t.Fatalf("expected 64-char hex token, got %d chars: %q", len(token), token)
|
|
}
|
|
|
|
// Tokens should be unique
|
|
token2 := generateSelfToken()
|
|
if token == token2 {
|
|
t.Fatal("expected unique tokens, got identical")
|
|
}
|
|
}
|