mirror of
https://github.com/openai/codex.git
synced 2026-10-19 17:28:46 +00:00
riley-oai
b7ad941b1f
## What changed - Introduce `codex-user-verification` with a provider interface for credential status, creation, deletion, and challenge signing. Include typed errors, shared cancellation guards, and hashed account-user key namespaces. - Add P-256 public-key encoding as unpadded base64url SPKI DER, derive credential IDs from its SHA-256 digest, and redact proof fields in debug output. - Add app-server helpers to validate challenge and display-text bounds and map provider errors to typed RPC errors without exposing provider diagnostics. The platform implementation reports verification as unsupported. App-server requests still return typed unavailability, with the message updated to mention build or account availability. ## Testing Add tests for credential encoding and signature verification, invalid curve points, cancellation across guard clones, stable and distinct account namespaces, and invalid challenge or display values. Update the app-server unavailability test for the revised message. GitOrigin-RevId: fe4a4eb37c68d7fdc547704e76aa257abf3e9c81
44 lines
1.6 KiB
Rust
44 lines
1.6 KiB
Rust
//! Checks that the exported credential interoperates with DER-based service verification.
|
|
|
|
use super::*;
|
|
use p256::ecdsa::Signature;
|
|
use p256::ecdsa::SigningKey;
|
|
use p256::ecdsa::VerifyingKey;
|
|
use p256::ecdsa::signature::Signer as _;
|
|
use p256::ecdsa::signature::Verifier as _;
|
|
use p256::pkcs8::DecodePublicKey as _;
|
|
use pretty_assertions::assert_eq;
|
|
|
|
#[test]
|
|
fn exported_spki_verifies_the_exact_challenge_signature() {
|
|
let key = SigningKey::from_bytes((&[7_u8; 32]).into()).expect("valid signing key");
|
|
let info = UserVerificationKeyInfo::from_sec1_public_key(
|
|
key.verifying_key()
|
|
.to_encoded_point(/*compress*/ false)
|
|
.as_bytes(),
|
|
)
|
|
.expect("encode public key");
|
|
let der = URL_SAFE_NO_PAD.decode(&info.public_key).expect("base64url");
|
|
let verifier = VerifyingKey::from_public_key_der(&der).expect("valid SPKI DER");
|
|
let challenge = b"the exact server-issued challenge";
|
|
let signature: Signature = key.sign(challenge);
|
|
let signature = Signature::from_der(signature.to_der().as_bytes()).expect("DER signature");
|
|
verifier
|
|
.verify(challenge, &signature)
|
|
.expect("valid signature");
|
|
assert!(verifier.verify(b"different challenge", &signature).is_err());
|
|
assert_eq!(
|
|
info,
|
|
UserVerificationKeyInfo {
|
|
credential_id: URL_SAFE_NO_PAD.encode(Sha256::digest(&der)),
|
|
algorithm: "ecdsaP256Sha256X962".to_string(),
|
|
public_key: URL_SAFE_NO_PAD.encode(der),
|
|
}
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn invalid_curve_point_is_rejected() {
|
|
assert!(UserVerificationKeyInfo::from_sec1_public_key(&[4_u8; 65]).is_err());
|
|
}
|