Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Repository: luvs01/opencodex/.coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
✅ Deterministic PR hygiene checks passed. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| self.authenticate_target().await?; | ||
| let token = self.auth.token().ok_or(ProxyError::Unauthorized)?; | ||
| let response = self.send(&method, path, Some(token)).await?; |
There was a problem hiding this comment.
🔍 Explicit security review is required before merge
This PR changes admin-token handling and an authentication boundary. Repository policy requires explicit security review and maintainer sponsorship before merge.
Was this helpful? React with 👍 or 👎 to provide feedback.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
The server signs proofs with createHmac("sha256", secret), which keys the
MAC with the Base64URL text's UTF-8 bytes. The desktop verifier decoded
the secret to its raw 32 bytes first, so every genuine proof failed and
authenticated tray, widget, and stop requests fell over. Use
identity.attestation_secret.as_bytes() and refresh the unit vector with
the proof the TypeScript primitive produces for the same inputs.
Co-Authored-By: Epinephrine <luvs01@hanmail.net>
|
Fixed in 614ce62 — |
|
Fixed in 614ce62 — the verifier now uses |
This branch has not been deployed
1 participant
Motivation
Description
Auth::runtime_identity()that loads the protectedruntime-port.json(pid/port/attestation secret) and validate its shape before use in the desktop client (desktop/src-tauri/src/auth.rs).401with the admin token, callauthenticate_target()to issue anx-opencodex-attestation-challengeto/healthzand verify the returned HMAC proof,service,pid,port, and that the runtime record remains unchanged (desktop/src-tauri/src/proxy.rs).hmac+sha2and Base64URL decoding to match the server attestation primitive and map request errors cleanly (desktop/src-tauri/src/proxy.rs).desktop/src-tauri/Cargo.toml(base64,hmac,sha2).Testing
bun run typecheck, which passed.cargo fmt --manifest-path desktop/src-tauri/Cargo.toml -- --checkandgit diff --check, which passed, and committed the changes.bun run privacy:scan, which passed.cargo check --manifest-path desktop/src-tauri/Cargo.toml, which was blocked by the environment missingglib-2.0.pcrequired by Tauri on this CI container (external system dependency), so desktopcargo checkcould not complete here.bun run testuntil environment-driven server-test expectations diverged (existing unrelated failures where some fixtures returned 403 vs expected 401); many test cases executed and passed earlier in the run but the full suite was not completed in this environment.Codex Task