envelope: a signed value names its swarm

Review 3.1, part of finding 12: a signed value's payload bound path,
user, time and prev, but not the swarm. A user with the same name and
key in two swarms could have an envelope replayed from one into the
other, wherever the path holds no envelope yet (prev "").

The payload now names the swarm (`swarm`), and a node takes an envelope
only for its own. /auth/whoami says the swarm, and continuum-signed and
the example in api.md sign it. Wire version 44: nodes before this
refuse such envelopes, and those after refuse the old ones.

1 files changed, 24 insertions, 1 deletions

diff --git a/src/access/envelope.rs b/src/access/envelope.rs
index 1804b98..e0c8909 100644
--- a/src/access/envelope.rs
+++ b/src/access/envelope.rs
@@ -108,6 +108,9 @@ fn agree(pattern: &[String], path: &[String]) -> bool {
 /// A signed value's payload.
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 pub(crate) struct Payload {
+    /// The swarm it is for: one user, with the same name and key in two swarms, signs
+    /// for one only.
+    pub(crate) swarm: String,
     pub(crate) path: Vec<String>,
     pub(crate) value: JsonValue,
     pub(crate) user: String,
@@ -170,7 +173,7 @@ pub(crate) fn read(envelope: &str) -> Result<Payload, String> {
 
 /// Checks `envelope` as the value at `path`, replacing `previous` (the envelope there
 /// before, if any), against the user registry `doc` holds (as the writer saw it): for
-/// that path, naming what it replaces, signed by one of its user's keys, a user who may
+/// its swarm, that path, naming what it replaces, signed by one of its user's keys, a user who may
 /// write there.
 pub(crate) fn check(
     doc: &impl ReadDoc,
@@ -179,6 +182,15 @@ pub(crate) fn check(
     previous: Option<&str>,
 ) -> Result<Signed, String> {
     let (bytes, payload, signature) = open(envelope)?;
+    let swarm = store::read_path(
+        doc,
+        &crate::document::meta::path(&[crate::document::meta::SWARM]),
+    )
+    .ok()
+    .flatten();
+    if swarm.as_ref().and_then(JsonValue::as_str) != Some(payload.swarm.as_str()) {
+        return Err(format!("signed for swarm {}, not this one", payload.swarm));
+    }
     if payload.path != path {
         return Err(format!(
             "signed for /{}, not /{}",
@@ -223,6 +235,7 @@ mod tests {
         let line = sshsig::PublicKey(key.verifying_key().to_bytes()).line();
         let mut doc = Document::new();
         change(&mut doc, |doc| {
+            store::write_path(doc, &path("_continuum/swarm"), &json!("s")).unwrap();
             let mut alice = registry::entry("root", 1, &[(path("config"), &[Right::Write][..])]);
             alice["keys"] = json!({ "laptop": line });
             store::write_path(doc, &registry::user_path("alice"), &alice).unwrap();
@@ -240,6 +253,7 @@ mod tests {
 
     fn payload(user: &str, at: &str, value: JsonValue, prev: &str) -> Payload {
         Payload {
+            swarm: "s".to_owned(),
             path: path(at),
             value,
             user: user.to_owned(),
@@ -282,6 +296,15 @@ mod tests {
         let tampered = first.replacen("cv1.", "cv1.e30", 1);
         assert!(check(&doc, &tampered, &path("config"), None).is_err());
         assert!(check(&doc, "plain", &path("config"), None).is_err());
+        // For another swarm.
+        let elsewhere = signed(
+            &key,
+            &Payload {
+                swarm: "t".to_owned(),
+                ..payload("alice", "config", json!({"mode": "fast"}), "")
+            },
+        );
+        assert!(check(&doc, &elsewhere, &path("config"), None).is_err());
     }
 
     #[test]