{"entries":[{"lastCommit":{"author":{"email":"me@xeiaso.net","name":"Xe Iaso","when":"2026-07-11T20:16:47.000000-04:00"},"committer":{"email":"noreply@github.com","name":"GitHub","when":"2026-07-11T20:16:47.000000-04:00"},"hash":"d2f2e00f8bddbe7b6bdd36a7354d5f96d8bbed13","message":"feat(sigv4): add AWS SigV4 request authentication and IAM daemon (#957)\n\n* feat(sigv4keygen): add crypto/rand key generator\n\nGenerates AWS-style access key id and secret access key pairs from\ncrypto/rand. The secret is an opaque random value with no dependence on\nthe access key id or the generation time, so it cannot be recovered by\nan attacker who observes the cleartext access key id in a signed request.\n\nAssisted-by: GLM 5.2 via Claude Code\nSigned-off-by: Xe Iaso \n\n* feat(sigv4client): add sigv4 request-signing round tripper\n\nAdds an http.RoundTripper that signs outgoing requests with AWS\nSignature Version 4 via the aws-sdk-go-v2 signer, derived from the\nPrometheus remote-write client (Apache-2.0). Clones the request before\nmutating it so the caller's request is left intact, and signs with the\nregion resolved from the full credentials chain rather than only the\nexplicit config value.\n\nAssisted-by: GLM 5.2 via Claude Code\nSigned-off-by: Xe Iaso \n\n* feat(sigv4): add aws sigv4 verification middleware\n\nAdds a net/http middleware that verifies incoming AWS Signature\nVersion 4 requests by recomputing the signature in constant time.\n\nSecurity properties baked in up front: requires host in SignedHeaders,\nrejects streaming payloads (per-chunk signatures are not verified),\nenforces MaxBodySize for unsigned payloads, resets the request body on\nevery return path, maps unrecognized errors to 500 instead of masking\nthem as 403, and falls back to the standard Date header when X-Amz-Date\nis absent. Canonicalization is verified byte-for-byte against the\naws-sdk-go-v2 signer in round-trip tests.\n\nAssisted-by: GLM 5.2 via Claude Code\nSigned-off-by: Xe Iaso \n\n* feat(useragent): annotate with /x/ version\n\nSigned-off-by: Xe Iaso \n\n* fix(web/sigv4): fix a few edge cases, make generically useful\n\nSigned-off-by: Xe Iaso \n\n* chore(go.mod): update gorm for generics\n\nSigned-off-by: Xe Iaso \n\n* feat(pb): add IAM service definitions\n\nSigned-off-by: Xe Iaso \n\n* fix(pb/iam): add IsAdmin field to User\n\nSigned-off-by: Xe Iaso \n\n* format(gen): goimports -w\n\nSigned-off-by: Xe Iaso \n\n* feat(sigv4): add authenticated-user context helpers\n\nWithUser/User carry the IAM user resolved for a verified caller through\nthe request context, so downstream handlers and interceptors can attribute\nand authorize calls without re-querying the backing store. It is the\nlocal-verification counterpart to iamsts.Caller.\n\nAssisted-by: GLM 5.2 via Claude Code\nSigned-off-by: Xe Iaso \n\n* feat(twirpslog): add twirp slog interceptor\n\nLogs each twirp RPC through slog, attributing the call to the\nsigv4-authenticated user (sigv4.User) when one is present in the request\ncontext.\n\nAssisted-by: GLM 5.2 via Claude Code\nSigned-off-by: Xe Iaso \n\n* feat(iamd): add IAM daemon with user, key, and STS services\n\nSigV4-protected twirp services over SQLite for managing identities and\ntheir signing keys, plus an STS service that validates forwarded\nsignatures and resolves the owning user without exposing secrets. The\nkey service enforces caller-based authorization (non-admins manage only\ntheir own keys; admins act across all users) and validates arguments\nwith protovalidate. Includes a DAO, request-context user middleware, and\nfirst-run bootstrap of an admin user.\n\nAssisted-by: GLM 5.2 via Claude Code\nSigned-off-by: Xe Iaso \n\n* feat(iam): add iam CLI client\n\nCobra-based client for the IAM daemon with config management and\nuser/signing-key CRUD (create, disable, list), signing every request\nwith sigv4.\n\nAssisted-by: GLM 5.2 via Claude Code\nSigned-off-by: Xe Iaso \n\n* docs: add sigv4 auth design plan\n\nRecords the design for AWS SigV4-based request authentication and the\nIAM daemon that backs it.\n\nAssisted-by: GLM 5.2 via Claude Code\nSigned-off-by: Xe Iaso \n\n* fix(sigv4): repair canonicalization and error handling found in review\n\nVerification diverged from the AWS SDK in three ways that rejected\nvalidly signed requests: canonical query sorting compared joined\n\"key=value\" strings instead of key then value, VerifySignature\nlowercased the case-sensitive UNSIGNED-PAYLOAD sentinel, and\nreconstructing the forwarded path with url.Parse mis-read \"//\"-prefixed\npaths as a scheme-relative authority. The client half also broke the\ncentral STS path by never declaring X-Amz-Content-Sha256, rewrote URLs\nwith path.Clean before signing, and ignored caller deadlines by signing\nunder a package-global context.TODO().\n\nMiddleware now returns Twirp errors without echoing internal lookup\nfailures to unauthenticated callers, logs rejections (the debug log\npreviously sat on the success path and never fired), and names the\nspecific client-correctable cause for invalid requests. Payload-hash\nsentinels are exported and shared with iamsts under one comparison\nrule, fixing verifyBody's lowercased comparison that could never match\nthem.\n\nNew regression tests sign with the real aws-sdk-go-v2 signer, and a new\nend-to-end test drives sigv4client through iamsts to a real verifier,\ncovering the previously untested central-validation chain.\n\nAssisted-by: Claude Fable 5 via Claude Code\nSigned-off-by: Xe Iaso \n\n* fix(twirpslog): use counters and stop logging request payloads\n\nThe invocation, error, and api-call metrics were gauges that were only\never incremented, which breaks rate() and increase(); they are now\ncounters with _total names, and invocations_total counts every call so\nan error ratio is errors_total / invocations_total. Latency is recorded\nin seconds with the default buckets instead of microseconds capped at\nabout two seconds. api_calls_total stays success-only on purpose: only\ncompleted calls are billed.\n\nRequest payloads are no longer logged at debug level: on the IAM\nservices they carry forwarded Authorization material that would let a\nlog reader replay a signed request within the clock-skew window.\n\ngo.mod picks up prometheus testutil's indirect dependency for the new\ninterceptor test.\n\nAssisted-by: Claude Fable 5 via Claude Code\nSigned-off-by: Xe Iaso \n\n* feat(slog): add context-attributes handler wired into Init\n\nContextWithAttrs attaches slog attributes to a context; ContextHandler\nemits them on every record logged through the *Context call variants.\nAttributes always land at the top level of the record, even when a\nderived logger has opened groups, and accumulate across nested calls\nwithout leaking between sibling contexts. Init wraps the default JSON\nhandler so every binary using internal.HandleStartup gets this for\nfree; source locations are unchanged because the record produced at the\ncall site passes through untouched, which a dedicated AddSource test\npins down.\n\ntwirpslog becomes the first producer: the interceptor stores the call's\npackage, service, method, and verified user_id in the context, so any\ndownstream code logging with slog.*Context carries caller attribution\nwith no plumbing.\n\nAssisted-by: Claude Fable 5 via Claude Code\nAssisted-by: Claude Opus 4.8 via Claude Code\nSigned-off-by: Xe Iaso \n\n* chore(lint): enforce context-aware slog calls with sloglint\n\nAdds a minimal golangci-lint v2 config that enables only sloglint with\ncontext checking in scope mode: a plain slog call is flagged only when\na context is actually available to the enclosing function. Generated\ncode (gen/, *.pb.go, *_templ.go) is excluded. VS Code is pointed at\ngolangci-lint-v2 with --fast-only so the editor surfaces findings\nwithout freezing.\n\nAssisted-by: Claude Fable 5 via Claude Code\nAssisted-by: Claude Sonnet 4.6 via Claude Code\nAssisted-by: Claude Haiku 4.5 via Claude Code\nSigned-off-by: Xe Iaso \n\n* refactor: use context-aware slog call variants where a context exists\n\nMigrates ~300 logging calls across 68 files to slog.*Context /\nLogger.*Context, using the enclosing function's context.Context or\nr.Context() from an *http.Request. With the ContextHandler installed,\nthese lines now carry request-scoped attributes such as the twirpslog\ncaller attribution. Calls in startup paths with no context available\nare deliberately unchanged, matching sloglint's scope mode, which now\npasses over the whole repo with zero findings.\n\nThe one semantic judgment call: twitchevents' delayed resubscribe\ngoroutine detaches with context.WithoutCancel so it keeps the request's\nlog attributes without inheriting its cancellation.\n\nAssisted-by: Claude Fable 5 via Claude Code\nAssisted-by: Claude Haiku 4.5 via Claude Code\nSigned-off-by: Xe Iaso \n\n* fix: address slog-context review findings\n\ntwirpslog attached the request attributes to both its derived logger\nand the context, so under the production ContextHandler wiring every\n\"started/ended request\" line emitted each key twice — duplicate JSON\nkeys that strict log pipelines reject. The attributes now live only on\nthe context, the attrsToArgs helper that fed the duplicate path is\ngone, and the interceptor test asserts each key appears exactly once\nin the raw output.\n\nDAO.Backup in cmd/mi logged \"backup done\" even when the backup failed\nbecause the error branch did not return, masking silently failing\nbackups from anything watching for the success marker.\n\nAssisted-by: Claude Fable 5 via Claude Code\nSigned-off-by: Xe Iaso \n\n* style(pb/iam): apply buf format to IAM and STS protos\n\nStrip inner spaces around single field options ([ (x) ] -> [(x)]) and\nexpand one-line messages, as enforced by buf format in CI.\n\nSigned-off-by: Xe Iaso \n\n* feat(sigv4): support verification from a derived signing key\n\nSigned-off-by: Xe Iaso \n\n* feat(iamd): add DAO lookup that distinguishes disabled keys from unknown\n\nSigned-off-by: Xe Iaso \n\n* feat(pb/iam): add SigningKeyService for derived signing key distribution\n\nSigned-off-by: Xe Iaso \n\n* feat(iamd): serve SigV4 derived signing keys via SigningKeyService\n\nSigned-off-by: Xe Iaso \n\n* feat(iamsts)!: verify locally with cached derived signing keys\n\nReplaces per-request STS GetCallerIdentity RPCs with local SigV4\nverification against derived signing keys fetched once per credential\nscope from SigningKeyService and cached per the server-advised TTL.\n\nBREAKING CHANGE: iamsts.NewVerifier is replaced by iamsts.New(Config);\niamsts.Identity now carries TokenIdentity fields (PrincipalID) instead\nof an iamv1.User.\n\nSigned-off-by: Xe Iaso \n\n* test(iamd): cover the signing-key local-verification chain end to end\n\nSigned-off-by: Xe Iaso \n\n* refactor(iam)!: delete the per-request STS verification flow\n\nRemoves STSService/GetCallerIdentity (proto, generated stubs, iamd\nhandler, and sigv4.VerifySignature) now that downstream services verify\nlocally with cached derived signing keys.\n\nThe deleted double-slash-path test guarded VerifySignature's synthetic\nrequest construction, which is removed with it; the local path reads\nr.URL from net/http's own parser.\n\nBREAKING CHANGE: the STSService Twirp/gRPC/Connect APIs no longer\nexist; downstream verifiers must upgrade to iamsts.New + SigningKeyService.\n\nSigned-off-by: Xe Iaso \n\n* docs: remove stale references to the deleted central STS verify flow\n\nSigned-off-by: Xe Iaso \n\n* docs(sigv4): record the move to derived signing key caching\n\nSigned-off-by: Xe Iaso \n\n* fix(iamsts): detach signing-key fetch from the caller's request context\n\nThe singleflight leader in entry() ran the GetSigningKey RPC on the\nfirst caller's request context, so a client disconnecting mid-RPC for\nan uncached scope canceled the fetch and failed every request\ncollapsed onto it with a 500 — an attacker could trigger this burst\ndeliberately by opening a request and dropping the connection. The\nfetch now runs on a context detached from the caller via\ncontext.WithoutCancel (keeping trace/log values) with its own\n10s timeout replacing the dropped deadline.\n\nSigned-off-by: Xe Iaso \n\n* fix(iamd): reject non-positive -signing-key-cache-ttl at startup\n\nA zero or negative TTL makes every GetSigningKey response effectively\nuse-once, silently degrading downstream verifiers from a cached\nwarm-path lookup to an RPC on every request. Fail startup instead of\nletting this misconfiguration degrade quietly under load.\n\nSigned-off-by: Xe Iaso \n\n* docs(sigv4): record signing-key distribution trust model and current iamd role\n\nUpdate the components table to reflect that iamd now serves the\nsigning-key distribution server rather than a planned STS validation\nserver, mark the superseded forwarded-material security-model section\nas historical, and record the trust trade-off the final review\nsurfaced: any authenticated IAM principal can currently fetch any\nprincipal's derived signing key for the fleet scope, attributed by\ncaller in logs/metrics, with a verifier allowlist noted as a follow-up\nif trust tiers diverge.\n\nSigned-off-by: Xe Iaso \n\n* build(iamd): add docker bake target and Dockerfile\n\nTwo-stage build matching the repo's existing service images\n(golang:1.25 build with cache mounts, debian:bookworm runtime).\nThe SQLite database lives on a /data volume so state survives\ncontainer replacement; built for amd64 and arm64 since the\nncruces SQLite driver is CGO-free. Added to the default bake\ngroup.\n\nAssisted-by: Fable 5 via Claude Code\nSigned-off-by: Xe Iaso \n\n* docs(iamsts): add twirp integration guide\n\nShows how to wire the caching verifier into a Twirp API mux:\nsigned transport for the key fetches, one shared verifier per\nprocess, per-route middleware wrapping, reading the caller\nidentity, and the operational behaviors (error mapping, outage\nsemantics, revocation latency, midnight rollover).\n\nAssisted-by: Fable 5 via Claude Code\nSigned-off-by: Xe Iaso \n\n* chore: commit stuff\n\nSigned-off-by: Xe Iaso \n\n* refactor(sigv4): extract shared signing internals into awssig\n\nSigned-off-by: Xe Iaso \n\n* feat(sigv4a): add ecdsa p-256 key derivation with aws test vectors\n\nSigned-off-by: Xe Iaso \n\n* feat(sigv4a): add x-amz-region-set matching\n\nSigned-off-by: Xe Iaso \n\n* fix(awssig): match aws canonicalization for quoted spaces and raw utf-8 paths\n\ncollapseSpaces preserved runs of spaces inside double-quoted header\nvalues, but neither aws-sdk-go-v2's v4 signer nor the aws-c-auth v4a\ntest vectors special-case quotes; both collapse whitespace runs\nunconditionally.\n\nCanonicalURI re-percent-encoded r.URL.EscapedPath(), which reproduces\nAWS's double-encoding correctly when the wire path is already\npercent-encoded ASCII, but fabricates a fresh single-encoded path for\nraw, unescaped UTF-8 wire bytes -- encoding that a second time\ndouble-encodes it. Canonicalize the literal wire path (r.RequestURI)\ninstead, falling back to EscapedPath() for client-constructed\nrequests that never went through the wire.\n\nCaught by the sigv4a vector suite (get-header-value-trim, get-utf8);\nsigv4's SDK round-trip tests and iamd's integration tests pass\nunchanged, confirming classic SigV4 compatibility holds.\n\nSigned-off-by: Xe Iaso \n\n* feat(sigv4a): add request verifier middleware\n\nSigned-off-by: Xe Iaso \n\n* fix(sigv4a): treat nil public key from lookup as unknown key\n\nA PublicKeyLookuper returning (nil, nil) left pub == nil, err == nil,\nreaching ecdsa.VerifyASN1(nil, ...), which panics because it\ndereferences pub.Curve unconditionally -- a DoS of this auth\nmiddleware once a real KeyLookup is wired in. Treat a nil key as\nErrUnknownKey instead.\n\nAdds coverage for the KeyLookup branch (previously untested) and for\na malformed-hex Signature= value.\n\nSigned-off-by: Xe Iaso \n\n* feat(sigv4a): add request signer and sigv4aclient transport\n\nSigned-off-by: Xe Iaso \n\n* feat(iamd): serve sigv4a public verification keys via GetPublicKey\n\nSigned-off-by: Xe Iaso \n\n* chore: exempt sigv4a test vectors from prettier\n\nnpm run format was reformatting the aws-c-auth vector fixtures, which\nmust stay byte-identical to upstream.\n\nSigned-off-by: Xe Iaso \n\n* feat(sigv4a): add iamsts public-key caching verifier\n\nSigned-off-by: Xe Iaso \n\n* test(sigv4a/iamsts): make TTL-sweep test table-driven\n\nRestructure the fresh (non-ported) TTL-expiry sweep test into a\ntable of ordered steps per the repo's go-table-driven-tests\nconventions, since it wasn't inherited from the classic package.\n\nSigned-off-by: Xe Iaso \n\n* feat(iamd)!: authenticate callers with sigv4a\n\nBREAKING CHANGE: iamd's middleware now accepts only\nAWS4-ECDSA-P256-SHA256 signatures; clients must sign with sigv4aclient\n(or sigv4a.Signer) instead of sigv4client.\n\nSigned-off-by: Xe Iaso \n\n* docs(sigv4a): record public-key trust model and add iamsts guide\n\nSigned-off-by: Xe Iaso \n\n* fix(twirpslog): restore caller attribution for sigv4a-authenticated services\n\niamd's UserMiddleware now stores the verified caller via\nsigv4a.WithUser, a different context key than the classic\nsigv4.WithUser the interceptor checked. Twirp logs and the per-user\nbilling counter silently lost attribution for every sigv4a-verified\ncall. Check the sigv4a sources first, falling back to the classic\nsigv4/sigv4a.iamsts pair kept for the retained classic chain.\n\nSigned-off-by: Xe Iaso \n\n* docs(sigv4a): note twirpslog attribution works for sigv4a callers\n\nSigned-off-by: Xe Iaso \n\n* fix(sigv4aclient): set GetBody so redirects and retries can rewind the body\n\nSigned-off-by: Xe Iaso \n\n* fix(iamd): read the caller from the sigv4a context in KeyService\n\nThe SigV4A cutover left KeyService reading the caller from the classic\nsigv4 context key that UserMiddleware no longer populates, so every\nKeyService RPC failed closed with an unauthenticated caller.\n\nSigned-off-by: Xe Iaso \n\n* feat(iamd): accept both sigv4 and sigv4a signatures\n\nDispatch on the Authorization header's algorithm token so classic\nSigV4 and SigV4A callers both authenticate through the same DAO-backed\ncredentials; classic traffic stays observable via\niamd_auth_requests_total while it drains.\n\nSigned-off-by: Xe Iaso \n\n* refactor(middleware): unify caller identity context in authctx\n\nTwo real bugs (a KeyService handler failing closed on the wrong family's key, and a twirpslog attribution regression) came from sigv4 and sigv4a each keeping their own unexported context keys for the same caller identity; this introduces web/middleware/authctx as the single canonical storage that all four packages delegate to, with no exported API changes.\n\nSigned-off-by: Xe Iaso \n\n* feat(sigv4any): add dual-algorithm dispatch middleware\n\nLift the Authorization-header dispatch pattern (classic SigV4 vs SigV4A)\ninto a reusable middleware so any service can accept either algorithm\nwithout hand-rolling the switch, while keeping metric wiring pluggable\nvia an Observe hook instead of a hard prometheus dependency.\n\nSigned-off-by: Xe Iaso \n\n* refactor(iamd): use sigv4any for dual-algorithm auth\n\nReplace iamd's hand-rolled Authorization-header dispatch with the new\nsigv4any.Verifier, keeping the iamd_auth_requests_total counter wired\nthrough Observe. cmd/iamd/integration_test.go is the equivalence proof\nand passes unchanged.\n\nSigned-off-by: Xe Iaso \n\n* fix(iam): wrap errors from DisableKey and ListKeys\n\nThe disable command returned the raw DisableKey error and had a\nduplicated dead err check left over from a copy-paste; the list\ncommand never checked the ListKeys error at all. Wrap both so\nfailures surface a descriptive message.\n\nAssisted-by: Claude Opus 4.8 via Claude Code\nSigned-off-by: Xe Iaso \n\n* fix(iam): wrap error from ListUsers\n\nThe user list command ignored the ListUsers error and proceeded\nto render an empty result. Check and wrap it so failures surface\na descriptive message, matching the keys command.\n\nAssisted-by: Claude Opus 4.8 via Claude Code\nSigned-off-by: Xe Iaso \n\n* chore(saga): add iamd and route53 dyndns manifests plus sigv4a plan\n\nDeploy iamd to the saga cluster with sigv4a signing-key cache\nconfig, add a route53 dynamic DNS deployment, and check in the\nsigv4a migration plan doc.\n\nAssisted-by: Claude Opus 4.8 via Claude Code\nSigned-off-by: Xe Iaso \n\n* fix(saga): remove invalid value on AWS_SECRET_ACCESS_KEY env var\n\nThe env var set both valueFrom.secretKeyRef and a literal\nvalue, which Kubernetes rejects. Drop the leftover placeholder\nvalue so the manifest applies.\n\nAssisted-by: Claude Opus 4.8 via Claude Code\nSigned-off-by: Xe Iaso \n\n* chore: nuke sins\n\nSigned-off-by: Xe Iaso \n\n---------\n\nSigned-off-by: Xe Iaso ","tree":"47169bf9b2b9e85e467f0f7ec8275b449034eb70"},"mode":"0040000","name":"authctx","size":0},{"lastCommit":{"author":{"email":"me@xeiaso.net","name":"Xe Iaso","when":"2026-07-21T19:47:29.000000-04:00"},"committer":{"email":"me@xeiaso.net","name":"Xe Iaso","when":"2026-07-21T19:47:29.000000-04:00"},"hash":"6a03ae8753031eada628fd608d9c879d817043b6","message":"fix(awssig): make collapseSpaces match documented strings.Fields contract\n\ncollapseSpaces had a doc comment claiming equivalence to\nstrings.Join(strings.Fields(v), \" \"), but the implementation only\ncollapsed ASCII space (0x20). Tabs, newlines, and other whitespace\nsurvived unchanged, contradicting the documented contract and risking\ncanonicalization mismatches with reference AWS signers that fold all\nwhitespace per unicode.IsSpace.\n\nReplace the hand-rolled byte loop with the documented one-liner. Add a\ntable-driven equivalence test covering empty input, leading/trailing\nwhitespace, internal tabs, and unicode whitespace.\n\nAssisted-by: GLM 5.2 via opencode\nSigned-off-by: Xe Iaso \n","tree":"ff79adcaa088c66666eac67e35ecb12538949bf9"},"mode":"0040000","name":"internal","size":0},{"lastCommit":{"author":{"email":"me@xeiaso.net","name":"Xe Iaso","when":"2026-07-21T19:48:49.000000-04:00"},"committer":{"email":"me@xeiaso.net","name":"Xe Iaso","when":"2026-07-21T19:48:49.000000-04:00"},"hash":"6b6fb45eda910ce7af7719fdc82734707b31dc33","message":"feat(sigv4,sigv4a): reject duplicate auth fields and add ErrMalformedAuth\n\nThe Authorization header parser used last-write-wins for Credential,\nSignedHeaders, and Signature. A malformed header with duplicate keys\nwould not be rejected explicitly; the parser silently overwrote earlier\nvalues. While not directly exploitable (signature verification still\nfails), the pattern is fragile and invites future security bugs.\n\nReject duplicate keys explicitly. While here, split the error surface:\nErrMissingAuth is now reserved for headers that are absent or use the\nwrong algorithm prefix, and a new ErrMalformedAuth sentinel covers\nstructurally invalid headers (empty fields, duplicates, unknown keys,\nbad credential scope). TwirpError maps ErrMalformedAuth to\nInvalidArgument (400) so clients see a clear 'you sent garbage' signal\ndistinct from the Unauthenticated (401) used for missing headers.\nErrUnknownKey and ErrUnauthorized continue to collapse to\nPermissionDenied to avoid user-enumeration oracles.\n\nAdd table-driven parseAuthHeader tests for duplicate-field rejection in\nboth packages and a TestTwirpErrorMapping that pins the twirp code each\nsentinel lands on.\n\nAssisted-by: GLM 5.2 via opencode\nSigned-off-by: Xe Iaso \n","tree":"eefa88b3b65c07d43fcd090da7b554f8bff30d9e"},"mode":"0040000","name":"sigv4","size":0},{"lastCommit":{"author":{"email":"me@xeiaso.net","name":"Xe Iaso","when":"2026-07-21T19:49:33.000000-04:00"},"committer":{"email":"me@xeiaso.net","name":"Xe Iaso","when":"2026-07-21T19:49:33.000000-04:00"},"hash":"cc010dc6214c10de5ded8c9324a67bd5a344b6ae","message":"docs(sigv4a): document that SigV4A does not prevent replay\n\nSigV4A authenticates the sender by proving possession of the signing\nkey, but it does not prevent replay of a captured request within the\nMaxClockSkew window (15 minutes by default). Consumers that assume\nrequest freshness from a verified signature will be surprised by replay\nattacks.\n\nExpand the Verifier doc comment and add a Replay protection section to\niamsts/integration.md so the limitation is visible at the two places a\ncaller is most likely to look. Suggest nonce, sequence number, or\nsingle-use challenge as the standard mitigations.\n\nAssisted-by: GLM 5.2 via opencode\nSigned-off-by: Xe Iaso \n","tree":"0a4d0e8728e1b1ec9bc96244b857c3048983ff4e"},"mode":"0040000","name":"sigv4a","size":0},{"lastCommit":{"author":{"email":"me@xeiaso.net","name":"Xe Iaso","when":"2026-07-11T20:16:47.000000-04:00"},"committer":{"email":"noreply@github.com","name":"GitHub","when":"2026-07-11T20:16:47.000000-04:00"},"hash":"d2f2e00f8bddbe7b6bdd36a7354d5f96d8bbed13","message":"feat(sigv4): add AWS SigV4 request authentication and IAM daemon (#957)\n\n* feat(sigv4keygen): add crypto/rand key generator\n\nGenerates AWS-style access key id and secret access key pairs from\ncrypto/rand. The secret is an opaque random value with no dependence on\nthe access key id or the generation time, so it cannot be recovered by\nan attacker who observes the cleartext access key id in a signed request.\n\nAssisted-by: GLM 5.2 via Claude Code\nSigned-off-by: Xe Iaso \n\n* feat(sigv4client): add sigv4 request-signing round tripper\n\nAdds an http.RoundTripper that signs outgoing requests with AWS\nSignature Version 4 via the aws-sdk-go-v2 signer, derived from the\nPrometheus remote-write client (Apache-2.0). Clones the request before\nmutating it so the caller's request is left intact, and signs with the\nregion resolved from the full credentials chain rather than only the\nexplicit config value.\n\nAssisted-by: GLM 5.2 via Claude Code\nSigned-off-by: Xe Iaso \n\n* feat(sigv4): add aws sigv4 verification middleware\n\nAdds a net/http middleware that verifies incoming AWS Signature\nVersion 4 requests by recomputing the signature in constant time.\n\nSecurity properties baked in up front: requires host in SignedHeaders,\nrejects streaming payloads (per-chunk signatures are not verified),\nenforces MaxBodySize for unsigned payloads, resets the request body on\nevery return path, maps unrecognized errors to 500 instead of masking\nthem as 403, and falls back to the standard Date header when X-Amz-Date\nis absent. Canonicalization is verified byte-for-byte against the\naws-sdk-go-v2 signer in round-trip tests.\n\nAssisted-by: GLM 5.2 via Claude Code\nSigned-off-by: Xe Iaso \n\n* feat(useragent): annotate with /x/ version\n\nSigned-off-by: Xe Iaso \n\n* fix(web/sigv4): fix a few edge cases, make generically useful\n\nSigned-off-by: Xe Iaso \n\n* chore(go.mod): update gorm for generics\n\nSigned-off-by: Xe Iaso \n\n* feat(pb): add IAM service definitions\n\nSigned-off-by: Xe Iaso \n\n* fix(pb/iam): add IsAdmin field to User\n\nSigned-off-by: Xe Iaso \n\n* format(gen): goimports -w\n\nSigned-off-by: Xe Iaso \n\n* feat(sigv4): add authenticated-user context helpers\n\nWithUser/User carry the IAM user resolved for a verified caller through\nthe request context, so downstream handlers and interceptors can attribute\nand authorize calls without re-querying the backing store. It is the\nlocal-verification counterpart to iamsts.Caller.\n\nAssisted-by: GLM 5.2 via Claude Code\nSigned-off-by: Xe Iaso \n\n* feat(twirpslog): add twirp slog interceptor\n\nLogs each twirp RPC through slog, attributing the call to the\nsigv4-authenticated user (sigv4.User) when one is present in the request\ncontext.\n\nAssisted-by: GLM 5.2 via Claude Code\nSigned-off-by: Xe Iaso \n\n* feat(iamd): add IAM daemon with user, key, and STS services\n\nSigV4-protected twirp services over SQLite for managing identities and\ntheir signing keys, plus an STS service that validates forwarded\nsignatures and resolves the owning user without exposing secrets. The\nkey service enforces caller-based authorization (non-admins manage only\ntheir own keys; admins act across all users) and validates arguments\nwith protovalidate. Includes a DAO, request-context user middleware, and\nfirst-run bootstrap of an admin user.\n\nAssisted-by: GLM 5.2 via Claude Code\nSigned-off-by: Xe Iaso \n\n* feat(iam): add iam CLI client\n\nCobra-based client for the IAM daemon with config management and\nuser/signing-key CRUD (create, disable, list), signing every request\nwith sigv4.\n\nAssisted-by: GLM 5.2 via Claude Code\nSigned-off-by: Xe Iaso \n\n* docs: add sigv4 auth design plan\n\nRecords the design for AWS SigV4-based request authentication and the\nIAM daemon that backs it.\n\nAssisted-by: GLM 5.2 via Claude Code\nSigned-off-by: Xe Iaso \n\n* fix(sigv4): repair canonicalization and error handling found in review\n\nVerification diverged from the AWS SDK in three ways that rejected\nvalidly signed requests: canonical query sorting compared joined\n\"key=value\" strings instead of key then value, VerifySignature\nlowercased the case-sensitive UNSIGNED-PAYLOAD sentinel, and\nreconstructing the forwarded path with url.Parse mis-read \"//\"-prefixed\npaths as a scheme-relative authority. The client half also broke the\ncentral STS path by never declaring X-Amz-Content-Sha256, rewrote URLs\nwith path.Clean before signing, and ignored caller deadlines by signing\nunder a package-global context.TODO().\n\nMiddleware now returns Twirp errors without echoing internal lookup\nfailures to unauthenticated callers, logs rejections (the debug log\npreviously sat on the success path and never fired), and names the\nspecific client-correctable cause for invalid requests. Payload-hash\nsentinels are exported and shared with iamsts under one comparison\nrule, fixing verifyBody's lowercased comparison that could never match\nthem.\n\nNew regression tests sign with the real aws-sdk-go-v2 signer, and a new\nend-to-end test drives sigv4client through iamsts to a real verifier,\ncovering the previously untested central-validation chain.\n\nAssisted-by: Claude Fable 5 via Claude Code\nSigned-off-by: Xe Iaso \n\n* fix(twirpslog): use counters and stop logging request payloads\n\nThe invocation, error, and api-call metrics were gauges that were only\never incremented, which breaks rate() and increase(); they are now\ncounters with _total names, and invocations_total counts every call so\nan error ratio is errors_total / invocations_total. Latency is recorded\nin seconds with the default buckets instead of microseconds capped at\nabout two seconds. api_calls_total stays success-only on purpose: only\ncompleted calls are billed.\n\nRequest payloads are no longer logged at debug level: on the IAM\nservices they carry forwarded Authorization material that would let a\nlog reader replay a signed request within the clock-skew window.\n\ngo.mod picks up prometheus testutil's indirect dependency for the new\ninterceptor test.\n\nAssisted-by: Claude Fable 5 via Claude Code\nSigned-off-by: Xe Iaso \n\n* feat(slog): add context-attributes handler wired into Init\n\nContextWithAttrs attaches slog attributes to a context; ContextHandler\nemits them on every record logged through the *Context call variants.\nAttributes always land at the top level of the record, even when a\nderived logger has opened groups, and accumulate across nested calls\nwithout leaking between sibling contexts. Init wraps the default JSON\nhandler so every binary using internal.HandleStartup gets this for\nfree; source locations are unchanged because the record produced at the\ncall site passes through untouched, which a dedicated AddSource test\npins down.\n\ntwirpslog becomes the first producer: the interceptor stores the call's\npackage, service, method, and verified user_id in the context, so any\ndownstream code logging with slog.*Context carries caller attribution\nwith no plumbing.\n\nAssisted-by: Claude Fable 5 via Claude Code\nAssisted-by: Claude Opus 4.8 via Claude Code\nSigned-off-by: Xe Iaso \n\n* chore(lint): enforce context-aware slog calls with sloglint\n\nAdds a minimal golangci-lint v2 config that enables only sloglint with\ncontext checking in scope mode: a plain slog call is flagged only when\na context is actually available to the enclosing function. Generated\ncode (gen/, *.pb.go, *_templ.go) is excluded. VS Code is pointed at\ngolangci-lint-v2 with --fast-only so the editor surfaces findings\nwithout freezing.\n\nAssisted-by: Claude Fable 5 via Claude Code\nAssisted-by: Claude Sonnet 4.6 via Claude Code\nAssisted-by: Claude Haiku 4.5 via Claude Code\nSigned-off-by: Xe Iaso \n\n* refactor: use context-aware slog call variants where a context exists\n\nMigrates ~300 logging calls across 68 files to slog.*Context /\nLogger.*Context, using the enclosing function's context.Context or\nr.Context() from an *http.Request. With the ContextHandler installed,\nthese lines now carry request-scoped attributes such as the twirpslog\ncaller attribution. Calls in startup paths with no context available\nare deliberately unchanged, matching sloglint's scope mode, which now\npasses over the whole repo with zero findings.\n\nThe one semantic judgment call: twitchevents' delayed resubscribe\ngoroutine detaches with context.WithoutCancel so it keeps the request's\nlog attributes without inheriting its cancellation.\n\nAssisted-by: Claude Fable 5 via Claude Code\nAssisted-by: Claude Haiku 4.5 via Claude Code\nSigned-off-by: Xe Iaso \n\n* fix: address slog-context review findings\n\ntwirpslog attached the request attributes to both its derived logger\nand the context, so under the production ContextHandler wiring every\n\"started/ended request\" line emitted each key twice — duplicate JSON\nkeys that strict log pipelines reject. The attributes now live only on\nthe context, the attrsToArgs helper that fed the duplicate path is\ngone, and the interceptor test asserts each key appears exactly once\nin the raw output.\n\nDAO.Backup in cmd/mi logged \"backup done\" even when the backup failed\nbecause the error branch did not return, masking silently failing\nbackups from anything watching for the success marker.\n\nAssisted-by: Claude Fable 5 via Claude Code\nSigned-off-by: Xe Iaso \n\n* style(pb/iam): apply buf format to IAM and STS protos\n\nStrip inner spaces around single field options ([ (x) ] -> [(x)]) and\nexpand one-line messages, as enforced by buf format in CI.\n\nSigned-off-by: Xe Iaso \n\n* feat(sigv4): support verification from a derived signing key\n\nSigned-off-by: Xe Iaso \n\n* feat(iamd): add DAO lookup that distinguishes disabled keys from unknown\n\nSigned-off-by: Xe Iaso \n\n* feat(pb/iam): add SigningKeyService for derived signing key distribution\n\nSigned-off-by: Xe Iaso \n\n* feat(iamd): serve SigV4 derived signing keys via SigningKeyService\n\nSigned-off-by: Xe Iaso \n\n* feat(iamsts)!: verify locally with cached derived signing keys\n\nReplaces per-request STS GetCallerIdentity RPCs with local SigV4\nverification against derived signing keys fetched once per credential\nscope from SigningKeyService and cached per the server-advised TTL.\n\nBREAKING CHANGE: iamsts.NewVerifier is replaced by iamsts.New(Config);\niamsts.Identity now carries TokenIdentity fields (PrincipalID) instead\nof an iamv1.User.\n\nSigned-off-by: Xe Iaso \n\n* test(iamd): cover the signing-key local-verification chain end to end\n\nSigned-off-by: Xe Iaso \n\n* refactor(iam)!: delete the per-request STS verification flow\n\nRemoves STSService/GetCallerIdentity (proto, generated stubs, iamd\nhandler, and sigv4.VerifySignature) now that downstream services verify\nlocally with cached derived signing keys.\n\nThe deleted double-slash-path test guarded VerifySignature's synthetic\nrequest construction, which is removed with it; the local path reads\nr.URL from net/http's own parser.\n\nBREAKING CHANGE: the STSService Twirp/gRPC/Connect APIs no longer\nexist; downstream verifiers must upgrade to iamsts.New + SigningKeyService.\n\nSigned-off-by: Xe Iaso \n\n* docs: remove stale references to the deleted central STS verify flow\n\nSigned-off-by: Xe Iaso \n\n* docs(sigv4): record the move to derived signing key caching\n\nSigned-off-by: Xe Iaso \n\n* fix(iamsts): detach signing-key fetch from the caller's request context\n\nThe singleflight leader in entry() ran the GetSigningKey RPC on the\nfirst caller's request context, so a client disconnecting mid-RPC for\nan uncached scope canceled the fetch and failed every request\ncollapsed onto it with a 500 — an attacker could trigger this burst\ndeliberately by opening a request and dropping the connection. The\nfetch now runs on a context detached from the caller via\ncontext.WithoutCancel (keeping trace/log values) with its own\n10s timeout replacing the dropped deadline.\n\nSigned-off-by: Xe Iaso \n\n* fix(iamd): reject non-positive -signing-key-cache-ttl at startup\n\nA zero or negative TTL makes every GetSigningKey response effectively\nuse-once, silently degrading downstream verifiers from a cached\nwarm-path lookup to an RPC on every request. Fail startup instead of\nletting this misconfiguration degrade quietly under load.\n\nSigned-off-by: Xe Iaso \n\n* docs(sigv4): record signing-key distribution trust model and current iamd role\n\nUpdate the components table to reflect that iamd now serves the\nsigning-key distribution server rather than a planned STS validation\nserver, mark the superseded forwarded-material security-model section\nas historical, and record the trust trade-off the final review\nsurfaced: any authenticated IAM principal can currently fetch any\nprincipal's derived signing key for the fleet scope, attributed by\ncaller in logs/metrics, with a verifier allowlist noted as a follow-up\nif trust tiers diverge.\n\nSigned-off-by: Xe Iaso \n\n* build(iamd): add docker bake target and Dockerfile\n\nTwo-stage build matching the repo's existing service images\n(golang:1.25 build with cache mounts, debian:bookworm runtime).\nThe SQLite database lives on a /data volume so state survives\ncontainer replacement; built for amd64 and arm64 since the\nncruces SQLite driver is CGO-free. Added to the default bake\ngroup.\n\nAssisted-by: Fable 5 via Claude Code\nSigned-off-by: Xe Iaso \n\n* docs(iamsts): add twirp integration guide\n\nShows how to wire the caching verifier into a Twirp API mux:\nsigned transport for the key fetches, one shared verifier per\nprocess, per-route middleware wrapping, reading the caller\nidentity, and the operational behaviors (error mapping, outage\nsemantics, revocation latency, midnight rollover).\n\nAssisted-by: Fable 5 via Claude Code\nSigned-off-by: Xe Iaso \n\n* chore: commit stuff\n\nSigned-off-by: Xe Iaso \n\n* refactor(sigv4): extract shared signing internals into awssig\n\nSigned-off-by: Xe Iaso \n\n* feat(sigv4a): add ecdsa p-256 key derivation with aws test vectors\n\nSigned-off-by: Xe Iaso \n\n* feat(sigv4a): add x-amz-region-set matching\n\nSigned-off-by: Xe Iaso \n\n* fix(awssig): match aws canonicalization for quoted spaces and raw utf-8 paths\n\ncollapseSpaces preserved runs of spaces inside double-quoted header\nvalues, but neither aws-sdk-go-v2's v4 signer nor the aws-c-auth v4a\ntest vectors special-case quotes; both collapse whitespace runs\nunconditionally.\n\nCanonicalURI re-percent-encoded r.URL.EscapedPath(), which reproduces\nAWS's double-encoding correctly when the wire path is already\npercent-encoded ASCII, but fabricates a fresh single-encoded path for\nraw, unescaped UTF-8 wire bytes -- encoding that a second time\ndouble-encodes it. Canonicalize the literal wire path (r.RequestURI)\ninstead, falling back to EscapedPath() for client-constructed\nrequests that never went through the wire.\n\nCaught by the sigv4a vector suite (get-header-value-trim, get-utf8);\nsigv4's SDK round-trip tests and iamd's integration tests pass\nunchanged, confirming classic SigV4 compatibility holds.\n\nSigned-off-by: Xe Iaso \n\n* feat(sigv4a): add request verifier middleware\n\nSigned-off-by: Xe Iaso \n\n* fix(sigv4a): treat nil public key from lookup as unknown key\n\nA PublicKeyLookuper returning (nil, nil) left pub == nil, err == nil,\nreaching ecdsa.VerifyASN1(nil, ...), which panics because it\ndereferences pub.Curve unconditionally -- a DoS of this auth\nmiddleware once a real KeyLookup is wired in. Treat a nil key as\nErrUnknownKey instead.\n\nAdds coverage for the KeyLookup branch (previously untested) and for\na malformed-hex Signature= value.\n\nSigned-off-by: Xe Iaso \n\n* feat(sigv4a): add request signer and sigv4aclient transport\n\nSigned-off-by: Xe Iaso \n\n* feat(iamd): serve sigv4a public verification keys via GetPublicKey\n\nSigned-off-by: Xe Iaso \n\n* chore: exempt sigv4a test vectors from prettier\n\nnpm run format was reformatting the aws-c-auth vector fixtures, which\nmust stay byte-identical to upstream.\n\nSigned-off-by: Xe Iaso \n\n* feat(sigv4a): add iamsts public-key caching verifier\n\nSigned-off-by: Xe Iaso \n\n* test(sigv4a/iamsts): make TTL-sweep test table-driven\n\nRestructure the fresh (non-ported) TTL-expiry sweep test into a\ntable of ordered steps per the repo's go-table-driven-tests\nconventions, since it wasn't inherited from the classic package.\n\nSigned-off-by: Xe Iaso \n\n* feat(iamd)!: authenticate callers with sigv4a\n\nBREAKING CHANGE: iamd's middleware now accepts only\nAWS4-ECDSA-P256-SHA256 signatures; clients must sign with sigv4aclient\n(or sigv4a.Signer) instead of sigv4client.\n\nSigned-off-by: Xe Iaso \n\n* docs(sigv4a): record public-key trust model and add iamsts guide\n\nSigned-off-by: Xe Iaso \n\n* fix(twirpslog): restore caller attribution for sigv4a-authenticated services\n\niamd's UserMiddleware now stores the verified caller via\nsigv4a.WithUser, a different context key than the classic\nsigv4.WithUser the interceptor checked. Twirp logs and the per-user\nbilling counter silently lost attribution for every sigv4a-verified\ncall. Check the sigv4a sources first, falling back to the classic\nsigv4/sigv4a.iamsts pair kept for the retained classic chain.\n\nSigned-off-by: Xe Iaso \n\n* docs(sigv4a): note twirpslog attribution works for sigv4a callers\n\nSigned-off-by: Xe Iaso \n\n* fix(sigv4aclient): set GetBody so redirects and retries can rewind the body\n\nSigned-off-by: Xe Iaso \n\n* fix(iamd): read the caller from the sigv4a context in KeyService\n\nThe SigV4A cutover left KeyService reading the caller from the classic\nsigv4 context key that UserMiddleware no longer populates, so every\nKeyService RPC failed closed with an unauthenticated caller.\n\nSigned-off-by: Xe Iaso \n\n* feat(iamd): accept both sigv4 and sigv4a signatures\n\nDispatch on the Authorization header's algorithm token so classic\nSigV4 and SigV4A callers both authenticate through the same DAO-backed\ncredentials; classic traffic stays observable via\niamd_auth_requests_total while it drains.\n\nSigned-off-by: Xe Iaso \n\n* refactor(middleware): unify caller identity context in authctx\n\nTwo real bugs (a KeyService handler failing closed on the wrong family's key, and a twirpslog attribution regression) came from sigv4 and sigv4a each keeping their own unexported context keys for the same caller identity; this introduces web/middleware/authctx as the single canonical storage that all four packages delegate to, with no exported API changes.\n\nSigned-off-by: Xe Iaso \n\n* feat(sigv4any): add dual-algorithm dispatch middleware\n\nLift the Authorization-header dispatch pattern (classic SigV4 vs SigV4A)\ninto a reusable middleware so any service can accept either algorithm\nwithout hand-rolling the switch, while keeping metric wiring pluggable\nvia an Observe hook instead of a hard prometheus dependency.\n\nSigned-off-by: Xe Iaso \n\n* refactor(iamd): use sigv4any for dual-algorithm auth\n\nReplace iamd's hand-rolled Authorization-header dispatch with the new\nsigv4any.Verifier, keeping the iamd_auth_requests_total counter wired\nthrough Observe. cmd/iamd/integration_test.go is the equivalence proof\nand passes unchanged.\n\nSigned-off-by: Xe Iaso \n\n* fix(iam): wrap errors from DisableKey and ListKeys\n\nThe disable command returned the raw DisableKey error and had a\nduplicated dead err check left over from a copy-paste; the list\ncommand never checked the ListKeys error at all. Wrap both so\nfailures surface a descriptive message.\n\nAssisted-by: Claude Opus 4.8 via Claude Code\nSigned-off-by: Xe Iaso \n\n* fix(iam): wrap error from ListUsers\n\nThe user list command ignored the ListUsers error and proceeded\nto render an empty result. Check and wrap it so failures surface\na descriptive message, matching the keys command.\n\nAssisted-by: Claude Opus 4.8 via Claude Code\nSigned-off-by: Xe Iaso \n\n* chore(saga): add iamd and route53 dyndns manifests plus sigv4a plan\n\nDeploy iamd to the saga cluster with sigv4a signing-key cache\nconfig, add a route53 dynamic DNS deployment, and check in the\nsigv4a migration plan doc.\n\nAssisted-by: Claude Opus 4.8 via Claude Code\nSigned-off-by: Xe Iaso \n\n* fix(saga): remove invalid value on AWS_SECRET_ACCESS_KEY env var\n\nThe env var set both valueFrom.secretKeyRef and a literal\nvalue, which Kubernetes rejects. Drop the leftover placeholder\nvalue so the manifest applies.\n\nAssisted-by: Claude Opus 4.8 via Claude Code\nSigned-off-by: Xe Iaso \n\n* chore: nuke sins\n\nSigned-off-by: Xe Iaso \n\n---------\n\nSigned-off-by: Xe Iaso ","tree":"47169bf9b2b9e85e467f0f7ec8275b449034eb70"},"mode":"0040000","name":"sigv4any","size":0}],"lastCommit":{"author":{"email":"me@xeiaso.net","name":"Xe Iaso","when":"2026-07-21T19:49:33.000000-04:00"},"committer":{"email":"me@xeiaso.net","name":"Xe Iaso","when":"2026-07-21T19:49:33.000000-04:00"},"hash":"cc010dc6214c10de5ded8c9324a67bd5a344b6ae","message":"docs(sigv4a): document that SigV4A does not prevent replay\n\nSigV4A authenticates the sender by proving possession of the signing\nkey, but it does not prevent replay of a captured request within the\nMaxClockSkew window (15 minutes by default). Consumers that assume\nrequest freshness from a verified signature will be surprised by replay\nattacks.\n\nExpand the Verifier doc comment and add a Replay protection section to\niamsts/integration.md so the limitation is visible at the two places a\ncaller is most likely to look. Suggest nonce, sequence number, or\nsingle-use challenge as the standard mitigations.\n\nAssisted-by: GLM 5.2 via opencode\nSigned-off-by: Xe Iaso \n","tree":"0a4d0e8728e1b1ec9bc96244b857c3048983ff4e"}}