@wlfi-agent/cli 1.4.12 → 1.4.14

package/crates/vault-daemon/src/persistence.rs

@@ -0,0 +1,441 @@
+use std::collections::HashMap;
+use std::fs::OpenOptions;
+use std::io::{Read, Write};
+use std::path::{Path, PathBuf};
+
+use argon2::{Argon2, ParamsBuilder};
+use chacha20poly1305::aead::{Aead, KeyInit};
+use chacha20poly1305::XChaCha20Poly1305;
+use serde::{Deserialize, Serialize};
+use time::OffsetDateTime;
+use uuid::Uuid;
+use vault_domain::{
+    AgentKey, Lease, ManualApprovalRequest, NonceReservation, RelayConfig, SpendEvent,
+    SpendingPolicy, VaultKey,
+};
+use zeroize::{Zeroize, Zeroizing};
+
+#[cfg(unix)]
+#[cfg(unix)]
+use std::os::unix::fs::MetadataExt;
+#[cfg(unix)]
+use std::os::unix::fs::{OpenOptionsExt, PermissionsExt};
+
+/// Configuration for encrypted, persistent daemon state storage.
+#[derive(Debug, Clone)]
+pub struct PersistentStoreConfig {
+    /// Filesystem path to the encrypted state file.
+    pub path: PathBuf,
+}
+
+impl PersistentStoreConfig {
+    /// Creates a new persistent-store config for `path`.
+    pub fn new(path: PathBuf) -> Self {
+        Self { path }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[serde(default)]
+pub(crate) struct PersistedDaemonState {
+    pub leases: HashMap<Uuid, Lease>,
+    pub policies: HashMap<Uuid, SpendingPolicy>,
+    pub vault_keys: HashMap<Uuid, VaultKey>,
+    pub software_signer_private_keys: HashMap<Uuid, String>,
+    pub agent_keys: HashMap<Uuid, AgentKey>,
+    pub agent_auth_tokens: HashMap<Uuid, [u8; 32]>,
+    pub replay_ids: HashMap<Uuid, OffsetDateTime>,
+    pub nonce_heads: HashMap<Uuid, HashMap<u64, u64>>,
+    pub nonce_reservations: HashMap<Uuid, NonceReservation>,
+    pub spend_log: Vec<SpendEvent>,
+    pub manual_approval_requests: HashMap<Uuid, ManualApprovalRequest>,
+    pub relay_config: RelayConfig,
+    pub relay_private_key_hex: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct KdfParams {
+    memory_kib: u32,
+    time_cost: u32,
+    parallelism: u32,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct EncryptedStateEnvelope {
+    version: u8,
+    kdf: KdfParams,
+    salt_hex: String,
+    nonce_hex: String,
+    ciphertext_hex: String,
+}
+
+const ENVELOPE_VERSION: u8 = 1;
+const SALT_LEN: usize = 16;
+const KEY_LEN: usize = 32;
+const NONCE_LEN: usize = 24;
+
+pub(crate) struct EncryptedStateStore {
+    path: PathBuf,
+    key: [u8; KEY_LEN],
+    salt: [u8; SALT_LEN],
+    kdf: KdfParams,
+}
+
+impl Drop for EncryptedStateStore {
+    fn drop(&mut self) {
+        self.key.zeroize();
+    }
+}
+
+impl EncryptedStateStore {
+    pub(crate) fn open_or_initialize(
+        password: &str,
+        config: &crate::DaemonConfig,
+        store: PersistentStoreConfig,
+    ) -> Result<(Self, PersistedDaemonState), String> {
+        ensure_secure_path(&store.path)?;
+        if store.path.exists() {
+            let bytes = read_file_secure(&store.path)?;
+            let envelope: EncryptedStateEnvelope = serde_json::from_slice(&bytes)
+                .map_err(|err| format!("failed to parse state envelope: {err}"))?;
+            if envelope.version != ENVELOPE_VERSION {
+                return Err(format!(
+                    "unsupported state file version {}; expected {}",
+                    envelope.version, ENVELOPE_VERSION
+                ));
+            }
+            let kdf = envelope.kdf;
+            let salt_bytes = hex::decode(&envelope.salt_hex)
+                .map_err(|err| format!("invalid state salt encoding: {err}"))?;
+            if salt_bytes.len() != SALT_LEN {
+                return Err("invalid state salt length".to_string());
+            }
+            let nonce_bytes = hex::decode(&envelope.nonce_hex)
+                .map_err(|err| format!("invalid state nonce encoding: {err}"))?;
+            if nonce_bytes.len() != NONCE_LEN {
+                return Err("invalid state nonce length".to_string());
+            }
+            let ciphertext = hex::decode(&envelope.ciphertext_hex)
+                .map_err(|err| format!("invalid state ciphertext encoding: {err}"))?;
+            let mut salt = [0u8; SALT_LEN];
+            salt.copy_from_slice(&salt_bytes);
+            let mut nonce = [0u8; NONCE_LEN];
+            nonce.copy_from_slice(&nonce_bytes);
+            let key = derive_key(password, &salt, &kdf)?;
+            let cipher = XChaCha20Poly1305::new((&key).into());
+            let plaintext = Zeroizing::new(
+                cipher
+                    .decrypt((&nonce).into(), ciphertext.as_ref())
+                    .map_err(|_| {
+                        "failed to decrypt state (wrong password or tampered file)".to_string()
+                    })?,
+            );
+            let state: PersistedDaemonState = serde_json::from_slice(&plaintext)
+                .map_err(|err| format!("failed to deserialize state payload: {err}"))?;
+            Ok((
+                Self {
+                    path: store.path,
+                    key,
+                    salt,
+                    kdf,
+                },
+                state,
+            ))
+        } else {
+            let kdf = KdfParams {
+                memory_kib: config.argon2_memory_kib,
+                time_cost: config.argon2_time_cost,
+                parallelism: config.argon2_parallelism,
+            };
+            let salt = rand::random::<[u8; SALT_LEN]>();
+            let key = derive_key(password, &salt, &kdf)?;
+            Ok((
+                Self {
+                    path: store.path,
+                    key,
+                    salt,
+                    kdf,
+                },
+                PersistedDaemonState::default(),
+            ))
+        }
+    }
+
+    pub(crate) fn save(&self, state: &PersistedDaemonState) -> Result<(), String> {
+        ensure_secure_path(&self.path)?;
+        let plaintext = Zeroizing::new(
+            serde_json::to_vec(state)
+                .map_err(|err| format!("failed to serialize daemon state: {err}"))?,
+        );
+        let nonce = rand::random::<[u8; NONCE_LEN]>();
+        let cipher = XChaCha20Poly1305::new((&self.key).into());
+        let ciphertext = cipher
+            .encrypt((&nonce).into(), plaintext.as_ref())
+            .map_err(|err| format!("failed to encrypt daemon state: {err}"))?;
+        let envelope = EncryptedStateEnvelope {
+            version: ENVELOPE_VERSION,
+            kdf: self.kdf.clone(),
+            salt_hex: hex::encode(self.salt),
+            nonce_hex: hex::encode(nonce),
+            ciphertext_hex: hex::encode(ciphertext),
+        };
+        let bytes = serde_json::to_vec(&envelope)
+            .map_err(|err| format!("failed to serialize state envelope: {err}"))?;
+        atomic_write_secure(&self.path, &bytes)
+    }
+}
+
+fn derive_key(
+    password: &str,
+    salt: &[u8; SALT_LEN],
+    kdf: &KdfParams,
+) -> Result<[u8; KEY_LEN], String> {
+    let params = ParamsBuilder::new()
+        .m_cost(kdf.memory_kib)
+        .t_cost(kdf.time_cost)
+        .p_cost(kdf.parallelism)
+        .build()
+        .map_err(|err| format!("invalid state kdf params: {err}"))?;
+    let argon = Argon2::new(argon2::Algorithm::Argon2id, argon2::Version::V0x13, params);
+    let mut key = [0u8; KEY_LEN];
+    argon
+        .hash_password_into(password.as_bytes(), salt, &mut key)
+        .map_err(|err| format!("failed to derive state key: {err}"))?;
+    Ok(key)
+}
+
+fn ensure_secure_path(path: &Path) -> Result<(), String> {
+    if is_symlink(path)? {
+        return Err(format!(
+            "state path '{}' must not be a symlink",
+            path.display()
+        ));
+    }
+
+    if let Some(parent) = path.parent() {
+        if !parent.as_os_str().is_empty() {
+            std::fs::create_dir_all(parent).map_err(|err| {
+                format!(
+                    "failed to create state directory '{}': {err}",
+                    parent.display()
+                )
+            })?;
+            if is_symlink(parent)? {
+                return Err(format!(
+                    "state directory '{}' must not be a symlink",
+                    parent.display()
+                ));
+            }
+            ensure_secure_directory(parent)?;
+        }
+    }
+
+    if path.exists() {
+        let metadata = std::fs::metadata(path)
+            .map_err(|err| format!("failed to inspect state file '{}': {err}", path.display()))?;
+        validate_private_state_file(path, &metadata)?;
+    }
+
+    Ok(())
+}
+
+#[cfg(unix)]
+fn ensure_secure_directory(path: &Path) -> Result<(), String> {
+    const STICKY_BIT_MODE: u32 = 0o1000;
+
+    fn validate_directory(
+        path: &Path,
+        metadata: &std::fs::Metadata,
+        allow_sticky_group_other_write: bool,
+    ) -> Result<(), String> {
+        if !metadata.is_dir() {
+            return Err(format!(
+                "state directory '{}' is not a directory",
+                path.display()
+            ));
+        }
+
+        validate_root_owned(path, metadata, "state directory")?;
+
+        let mode = metadata.mode() & 0o7777;
+        if mode & 0o022 != 0 && !(allow_sticky_group_other_write && mode & STICKY_BIT_MODE != 0) {
+            return Err(format!(
+                "state directory '{}' must not be writable by group/other",
+                path.display()
+            ));
+        }
+
+        Ok(())
+    }
+
+    let metadata = std::fs::metadata(path).map_err(|err| {
+        format!(
+            "failed to inspect state directory '{}': {err}",
+            path.display()
+        )
+    })?;
+    validate_directory(path, &metadata, false)?;
+
+    let canonical = std::fs::canonicalize(path).map_err(|err| {
+        format!(
+            "failed to canonicalize state directory '{}': {err}",
+            path.display()
+        )
+    })?;
+    for ancestor in canonical.ancestors().skip(1) {
+        let metadata = std::fs::metadata(ancestor).map_err(|err| {
+            format!(
+                "failed to inspect ancestor state directory '{}': {err}",
+                ancestor.display()
+            )
+        })?;
+        validate_directory(ancestor, &metadata, true)?;
+    }
+
+    Ok(())
+}
+
+#[cfg(not(unix))]
+fn ensure_secure_directory(_path: &Path) -> Result<(), String> {
+    Ok(())
+}
+
+#[cfg(unix)]
+fn validate_root_owned(
+    path: &Path,
+    metadata: &std::fs::Metadata,
+    label: &str,
+) -> Result<(), String> {
+    let uid = metadata.uid();
+    if uid == 0 {
+        return Ok(());
+    }
+
+    Err(format!(
+        "{label} '{}' must be owned by root; found uid {uid}",
+        path.display()
+    ))
+}
+
+#[cfg(not(unix))]
+fn validate_root_owned(
+    _path: &Path,
+    _metadata: &std::fs::Metadata,
+    _label: &str,
+) -> Result<(), String> {
+    Ok(())
+}
+
+fn validate_private_state_file(path: &Path, metadata: &std::fs::Metadata) -> Result<(), String> {
+    if !metadata.is_file() {
+        return Err(format!(
+            "state file '{}' must be a regular file",
+            path.display()
+        ));
+    }
+
+    validate_root_owned(path, metadata, "state file")?;
+
+    #[cfg(unix)]
+    {
+        if metadata.mode() & 0o077 != 0 {
+            return Err(format!(
+                "state file '{}' must not grant group/other permissions",
+                path.display()
+            ));
+        }
+    }
+
+    Ok(())
+}
+
+fn is_symlink(path: &Path) -> Result<bool, String> {
+    match std::fs::symlink_metadata(path) {
+        Ok(metadata) => Ok(metadata.file_type().is_symlink()),
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => Ok(false),
+        Err(err) => Err(format!(
+            "failed to inspect metadata for '{}': {err}",
+            path.display()
+        )),
+    }
+}
+
+fn read_file_secure(path: &Path) -> Result<Vec<u8>, String> {
+    let mut options = OpenOptions::new();
+    options.read(true);
+    #[cfg(unix)]
+    {
+        options.custom_flags(libc::O_NOFOLLOW);
+    }
+    let mut file = options
+        .open(path)
+        .map_err(|err| format!("failed to open state file '{}': {err}", path.display()))?;
+    let metadata = file
+        .metadata()
+        .map_err(|err| format!("failed to inspect state file '{}': {err}", path.display()))?;
+    validate_private_state_file(path, &metadata)?;
+    let mut bytes = Vec::new();
+    file.read_to_end(&mut bytes)
+        .map_err(|err| format!("failed to read state file '{}': {err}", path.display()))?;
+    Ok(bytes)
+}
+
+fn atomic_write_secure(path: &Path, bytes: &[u8]) -> Result<(), String> {
+    let temp_name = format!(
+        ".{}.tmp.{}",
+        path.file_name()
+            .and_then(|value| value.to_str())
+            .unwrap_or("wlfi-state"),
+        Uuid::new_v4().simple()
+    );
+    let temp_path = path.with_file_name(temp_name);
+
+    let mut options = OpenOptions::new();
+    options.write(true).create_new(true).truncate(true);
+    #[cfg(unix)]
+    {
+        options.mode(0o600);
+        options.custom_flags(libc::O_NOFOLLOW);
+    }
+
+    let mut file = options.open(&temp_path).map_err(|err| {
+        format!(
+            "failed to create temp state file '{}': {err}",
+            temp_path.display()
+        )
+    })?;
+    file.write_all(bytes).map_err(|err| {
+        format!(
+            "failed to write temp state file '{}': {err}",
+            temp_path.display()
+        )
+    })?;
+    file.sync_all().map_err(|err| {
+        format!(
+            "failed to sync temp state file '{}': {err}",
+            temp_path.display()
+        )
+    })?;
+    drop(file);
+
+    #[cfg(unix)]
+    {
+        std::fs::set_permissions(&temp_path, std::fs::Permissions::from_mode(0o600)).map_err(
+            |err| {
+                format!(
+                    "failed to set state file permissions '{}': {err}",
+                    temp_path.display()
+                )
+            },
+        )?;
+    }
+
+    std::fs::rename(&temp_path, path).map_err(|err| {
+        format!(
+            "failed to atomically replace state file '{}' from '{}': {err}",
+            path.display(),
+            temp_path.display()
+        )
+    })?;
+    Ok(())
+}

package/crates/vault-daemon/src/tests.rs

@@ -0,0 +1,237 @@
+use std::collections::BTreeSet;
+use std::sync::Arc;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use alloy_primitives::keccak256;
+use k256::ecdsa::{RecoveryId, Signature as K256Signature, VerifyingKey};
+use serde_json::to_vec;
+use uuid::Uuid;
+use vault_domain::{
+    AgentAction, AgentCredentials, AssetId, BroadcastTx, EntityScope, EvmAddress, KeySource, Lease,
+    NonceReleaseRequest, NonceReservationRequest, PolicyAttachment, PolicyType, SignRequest,
+    SpendingPolicy,
+};
+use vault_signer::SoftwareSignerBackend;
+
+use super::{
+    validate_loaded_state, AdminSession, DaemonConfig, DaemonError, DaemonRpcRequest,
+    DaemonRpcResponse, InMemoryDaemon, KeyCreateRequest, KeyManagerDaemonApi,
+    PersistentStoreConfig, PolicyError,
+};
+
+fn policy_all_per_tx(max: u128) -> SpendingPolicy {
+    SpendingPolicy::new(
+        1,
+        PolicyType::PerTxMaxSpending,
+        max,
+        EntityScope::All,
+        EntityScope::All,
+        EntityScope::All,
+    )
+    .expect("policy")
+}
+
+fn policy_per_chain_gas(chain_id: u64, max_gas_wei: u128) -> SpendingPolicy {
+    SpendingPolicy::new(
+        2,
+        PolicyType::PerChainMaxGasSpend,
+        max_gas_wei,
+        EntityScope::All,
+        EntityScope::All,
+        EntityScope::Set(BTreeSet::from([chain_id])),
+    )
+    .expect("policy")
+}
+
+fn sign_request(credentials: &AgentCredentials, action: AgentAction) -> SignRequest {
+    let now = time::OffsetDateTime::now_utc();
+    SignRequest {
+        request_id: Uuid::new_v4(),
+        agent_key_id: credentials.agent_key.id,
+        agent_auth_token: credentials.auth_token.clone(),
+        payload: to_vec(&action).expect("action payload"),
+        action,
+        requested_at: now,
+        expires_at: now + time::Duration::minutes(2),
+    }
+}
+
+async fn reserve_nonce_for_agent(
+    daemon: &InMemoryDaemon<SoftwareSignerBackend>,
+    credentials: &AgentCredentials,
+    chain_id: u64,
+    nonce: u64,
+) {
+    let now = time::OffsetDateTime::now_utc();
+    daemon
+        .reserve_nonce(NonceReservationRequest {
+            request_id: Uuid::new_v4(),
+            agent_key_id: credentials.agent_key.id,
+            agent_auth_token: credentials.auth_token.clone(),
+            chain_id,
+            min_nonce: nonce,
+            requested_at: now,
+            expires_at: now + time::Duration::minutes(2),
+        })
+        .await
+        .expect("nonce reservation");
+}
+
+fn unique_state_path(test_name: &str) -> std::path::PathBuf {
+    let unique = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .expect("time")
+        .as_nanos();
+    std::env::temp_dir().join(format!(
+        "wlfi-daemon-{test_name}-{}-{}.state",
+        std::process::id(),
+        unique
+    ))
+}
+
+#[test]
+fn daemon_rpc_request_debug_redacts_vault_password() {
+    let rendered = format!(
+        "{:?}",
+        DaemonRpcRequest::IssueLease {
+            vault_password: "super-secret-password".to_string(),
+        }
+    );
+
+    assert!(rendered.contains("<redacted>"));
+    assert!(!rendered.contains("super-secret-password"));
+}
+
+#[test]
+fn daemon_rpc_response_debug_redacts_auth_token() {
+    let rendered = format!(
+        "{:?}",
+        DaemonRpcResponse::AuthToken("super-secret-token".to_string())
+    );
+
+    assert!(rendered.contains("<redacted>"));
+    assert!(!rendered.contains("super-secret-token"));
+}
+
+#[test]
+fn daemon_rpc_request_zeroize_secrets_clears_nested_secret_material() {
+    let now = time::OffsetDateTime::now_utc();
+    let mut admin_request = DaemonRpcRequest::CreateAgentKey {
+        session: AdminSession {
+            vault_password: "super-secret-password".to_string(),
+            lease: Lease {
+                lease_id: Uuid::new_v4(),
+                issued_at: now,
+                expires_at: now + time::Duration::minutes(1),
+            },
+        },
+        vault_key_id: Uuid::new_v4(),
+        attachment: PolicyAttachment::AllPolicies,
+    };
+    admin_request.zeroize_secrets();
+    match &admin_request {
+        DaemonRpcRequest::CreateAgentKey { session, .. } => {
+            assert!(session
+                .vault_password
+                .as_bytes()
+                .iter()
+                .all(|byte| *byte == 0));
+        }
+        other => panic!("unexpected request variant: {other:?}"),
+    }
+
+    let mut sign_request = DaemonRpcRequest::SignForAgent {
+        request: SignRequest {
+            request_id: Uuid::new_v4(),
+            agent_key_id: Uuid::new_v4(),
+            agent_auth_token: "agent-secret-token".to_string(),
+            payload: vec![1, 2, 3, 4],
+            action: AgentAction::Approve {
+                token: "0x1111111111111111111111111111111111111111"
+                    .parse()
+                    .expect("token"),
+                spender: "0x2222222222222222222222222222222222222222"
+                    .parse()
+                    .expect("spender"),
+                amount_wei: 42,
+                chain_id: 1,
+            },
+            requested_at: now,
+            expires_at: now + time::Duration::minutes(2),
+        },
+    };
+    sign_request.zeroize_secrets();
+    match &sign_request {
+        DaemonRpcRequest::SignForAgent { request } => {
+            assert!(request
+                .agent_auth_token
+                .as_bytes()
+                .iter()
+                .all(|byte| *byte == 0));
+            assert!(request.payload.iter().all(|byte| *byte == 0));
+        }
+        other => panic!("unexpected request variant: {other:?}"),
+    }
+
+    let mut reserve_nonce = DaemonRpcRequest::ReserveNonce {
+        request: NonceReservationRequest {
+            request_id: Uuid::new_v4(),
+            agent_key_id: Uuid::new_v4(),
+            agent_auth_token: "nonce-secret".to_string(),
+            chain_id: 1,
+            min_nonce: 7,
+            requested_at: now,
+            expires_at: now + time::Duration::minutes(2),
+        },
+    };
+    reserve_nonce.zeroize_secrets();
+    match &reserve_nonce {
+        DaemonRpcRequest::ReserveNonce { request } => {
+            assert!(request
+                .agent_auth_token
+                .as_bytes()
+                .iter()
+                .all(|byte| *byte == 0));
+        }
+        other => panic!("unexpected request variant: {other:?}"),
+    }
+}
+
+#[test]
+fn daemon_rpc_response_zeroize_secrets_clears_auth_tokens() {
+    let now = time::OffsetDateTime::now_utc();
+    let mut response = DaemonRpcResponse::AgentCredentials(AgentCredentials {
+        agent_key: vault_domain::AgentKey {
+            id: Uuid::new_v4(),
+            vault_key_id: Uuid::new_v4(),
+            policies: PolicyAttachment::AllPolicies,
+            created_at: now,
+        },
+        auth_token: "agent-secret-token".to_string(),
+    });
+    response.zeroize_secrets();
+    match &response {
+        DaemonRpcResponse::AgentCredentials(credentials) => {
+            assert!(credentials
+                .auth_token
+                .as_bytes()
+                .iter()
+                .all(|byte| *byte == 0));
+        }
+        other => panic!("unexpected response variant: {other:?}"),
+    }
+
+    let mut rotated = DaemonRpcResponse::AuthToken("rotated-secret-token".to_string());
+    rotated.zeroize_secrets();
+    match &rotated {
+        DaemonRpcResponse::AuthToken(token) => {
+            assert!(token.as_bytes().iter().all(|byte| *byte == 0));
+        }
+        other => panic!("unexpected response variant: {other:?}"),
+    }
+}
+
+include!("tests_parts/part1.rs");
+include!("tests_parts/part2.rs");
+include!("tests_parts/part3.rs");
+include!("tests_parts/part4.rs");