+4

migrations/postgres/20260707000000_add_revoked_at_to_space_credentials.sql

View file Reviewed

··· 1 1 + -- Add revocation support to space credentials (M3). 2 2 + -- A NULL revoked_at means active; a timestamp means the credential (and any 3 3 + -- other credential sharing the row) has been revoked and must be rejected. 4 4 + ALTER TABLE happyview_space_credentials ADD COLUMN revoked_at TEXT;

+4

migrations/sqlite/20260707000000_add_revoked_at_to_space_credentials.sql

View file Reviewed

··· 1 1 + -- Add revocation support to space credentials (M3). 2 2 + -- A NULL revoked_at means active; a timestamp means the credential (and any 3 3 + -- other credential sharing the row) has been revoked and must be rejected. 4 4 + ALTER TABLE happyview_space_credentials ADD COLUMN revoked_at TEXT;

+13 -1

packages/docs/content/docs/experimental/spaces/credentials.md

View file Reviewed

··· 197 197 | `sub` | The full `at://` space URI | 198 198 | `iat` | Issued at (Unix timestamp) | 199 199 | `exp` | Expiry (Unix timestamp) | 200 200 - | `jti` | Random nonce for replay protection | 200 200 + | `jti` | Random nonce making each issued credential unique | 201 201 + 202 202 + The credential is a bearer token: it is reused for the full 2-hour TTL and is not 203 203 + bound to a specific client or audience, so any service holding it can read the 204 204 + space's records. Containment relies on the short TTL and on revocation. 205 205 + 206 206 + ## Revocation 207 207 + 208 208 + A credential is invalidated before its TTL expires when its holder is removed 209 209 + from the space (`com.atproto.simplespace.removeMember`): HappyView records the 210 210 + revocation and rejects the credential on subsequent reads. Because a credential 211 211 + is an opaque bearer token, revocation is scoped to a member — removing (and, if 212 212 + needed, re-adding) a member revokes all of that member's outstanding credentials. 201 213 202 214 ## Using a credential 203 215

+40

src/spaces/db.rs

View file Reviewed

··· 307 307 Ok(result.rows_affected() > 0) 308 308 } 309 309 310 310 + /// Returns true if a space credential with the given token hash has been revoked. 311 311 + pub async fn is_space_credential_revoked( 312 312 + pool: &sqlx::AnyPool, 313 313 + backend: DatabaseBackend, 314 314 + token_hash: &str, 315 315 + ) -> Result<bool, AppError> { 316 316 + let sql = adapt_sql( 317 317 + "SELECT revoked_at FROM happyview_space_credentials WHERE token_hash = ? AND revoked_at IS NOT NULL LIMIT 1", 318 318 + backend, 319 319 + ); 320 320 + let row: Option<(String,)> = sqlx::query_as(&sql) 321 321 + .bind(token_hash) 322 322 + .fetch_optional(pool) 323 323 + .await 324 324 + .map_err(|e| AppError::Internal(format!("failed to check credential revocation: {e}")))?; 325 325 + Ok(row.is_some()) 326 326 + } 327 327 + 328 328 + /// Revoke all active space credentials issued to `did` within `space_id`. 329 329 + /// Returns the number of credentials revoked. 330 330 + pub async fn revoke_space_credentials_for_member( 331 331 + pool: &sqlx::AnyPool, 332 332 + backend: DatabaseBackend, 333 333 + space_id: &str, 334 334 + did: &str, 335 335 + ) -> Result<u64, AppError> { 336 336 + let sql = adapt_sql( 337 337 + "UPDATE happyview_space_credentials SET revoked_at = ? WHERE space_id = ? AND issued_to = ? AND revoked_at IS NULL", 338 338 + backend, 339 339 + ); 340 340 + let result = sqlx::query(&sql) 341 341 + .bind(now_rfc3339()) 342 342 + .bind(space_id) 343 343 + .bind(did) 344 344 + .execute(pool) 345 345 + .await 346 346 + .map_err(|e| AppError::Internal(format!("failed to revoke space credentials: {e}")))?; 347 347 + Ok(result.rows_affected()) 348 348 + } 349 349 + 310 350 pub async fn get_member( 311 351 pool: &sqlx::AnyPool, 312 352 backend: DatabaseBackend,

+19 -3

src/spaces/routes.rs

View file Reviewed

··· 357 357 /// Like `require_auth`, but also accepts a verified space credential as an 358 358 /// identity source. Use this in space endpoints that support `Bearer 359 359 /// <space_credential>` in addition to DPoP auth. 360 360 + /// Whether a verified space credential has been revoked (e.g. its holder was 361 361 + /// removed from the space). Consulted after signature/exp verification so a 362 362 + /// leaked or stale credential can be invalidated before its TTL expires (M3). 363 363 + async fn space_credential_revoked(state: &AppState, token: &str) -> Result<bool, AppError> { 364 364 + let token_hash = hex::encode(Sha256::digest(token.as_bytes())); 365 365 + db::is_space_credential_revoked(&state.db, state.db_backend, &token_hash).await 366 366 + } 367 367 + 360 368 async fn require_auth_or_credential( 361 369 state: &AppState, 362 370 claims: &XrpcClaims, ··· 372 380 &state.config.plc_url, 373 381 ) 374 382 .await?; 383 383 + if space_credential_revoked(state, token).await? { 384 384 + return Err(AppError::Auth("space credential has been revoked".into())); 385 385 + } 375 386 return Ok(verified.sub); 376 387 } 377 388 ··· 450 461 .await 451 462 { 452 463 Ok(claims) if claims.sub == space_uri => { 453 453 - // External credential grants read access; write is not supported via space credential 454 454 - if require_write { 464 464 + // A revoked credential is treated as invalid — fall through to 465 465 + // the local membership check rather than granting access. 466 466 + if space_credential_revoked(state, token).await? { 467 467 + // fall through 468 468 + } else if require_write { 469 469 + // External credential grants read access only. 455 470 return Err(AppError::Forbidden( 456 471 "Write access is required for this action".into(), 457 472 )); 473 473 + } else { 474 474 + return Ok(SpaceAccess::Read); 458 475 } 459 459 - return Ok(SpaceAccess::Read); 460 476 } 461 477 Ok(_) => { 462 478 // Credential is valid but for a different space — fall through

+6

src/spaces/simplespace.rs

View file Reviewed

··· 422 422 return Err(AppError::NotFound("Member not found in this space".into())); 423 423 } 424 424 425 425 + // Revoke any outstanding space credentials the removed member holds so their 426 426 + // cross-service access ends immediately rather than lingering for the 427 427 + // credential's 2h TTL (M3). 428 428 + db::revoke_space_credentials_for_member(&state.db, state.db_backend, &space.id, &input.did) 429 429 + .await?; 430 430 + 425 431 Ok(Json(serde_json::json!({ "success": true }))) 426 432 } 427 433

+136

tests/spaces_credential_revocation.rs

View file Reviewed

··· 1 1 + mod common; 2 2 + 3 3 + use axum::body::Body; 4 4 + use axum::http::{Request, StatusCode}; 5 5 + use happyview::db::now_rfc3339; 6 6 + use happyview::spaces::db as spaces_db; 7 7 + use happyview::spaces::types::*; 8 8 + use serde_json::json; 9 9 + use serial_test::serial; 10 10 + use tower::ServiceExt; 11 11 + use uuid::Uuid; 12 12 + 13 13 + use common::app::TestApp; 14 14 + 15 15 + const AUTHORITY: &str = "did:plc:cred-authority"; 16 16 + const MEMBER: &str = "did:plc:cred-holder"; 17 17 + 18 18 + fn space_uri() -> String { 19 19 + format!("at://{AUTHORITY}/space/com.example.cred/main") 20 20 + } 21 21 + 22 22 + async fn enable_spaces(app: &TestApp) { 23 23 + let (name, value) = app.admin_cookie(); 24 24 + let req = Request::builder() 25 25 + .method("PUT") 26 26 + .uri("/admin/settings/feature.spaces_enabled") 27 27 + .header(name, value) 28 28 + .header("content-type", "application/json") 29 29 + .body(Body::from(json!({ "value": "true" }).to_string())) 30 30 + .unwrap(); 31 31 + assert!( 32 32 + app.router 33 33 + .clone() 34 34 + .oneshot(req) 35 35 + .await 36 36 + .unwrap() 37 37 + .status() 38 38 + .is_success(), 39 39 + "failed to enable spaces" 40 40 + ); 41 41 + } 42 42 + 43 43 + /// Removing a member from a space revokes their outstanding space credentials. 44 44 + /// Before the fix, removeMember left the credential active for its full TTL. 45 45 + #[tokio::test] 46 46 + #[serial] 47 47 + async fn remove_member_revokes_credentials() { 48 48 + common::require_db!(); 49 49 + let app = TestApp::new().await; 50 50 + enable_spaces(&app).await; 51 51 + 52 52 + // Create a space and a member. 53 53 + let space_id = Uuid::new_v4().to_string(); 54 54 + let now = now_rfc3339(); 55 55 + let space = Space { 56 56 + id: space_id.clone(), 57 57 + did: AUTHORITY.to_string(), 58 58 + authority_did: AUTHORITY.to_string(), 59 59 + creator_did: AUTHORITY.to_string(), 60 60 + type_nsid: "com.example.cred".to_string(), 61 61 + skey: "main".to_string(), 62 62 + display_name: None, 63 63 + description: None, 64 64 + mint_policy: MintPolicy::MemberList, 65 65 + app_access: AppAccess::Open, 66 66 + managing_app_did: None, 67 67 + config: SpaceConfig::default(), 68 68 + revision: None, 69 69 + created_at: now.clone(), 70 70 + updated_at: now.clone(), 71 71 + }; 72 72 + spaces_db::create_space(&app.state.db, app.state.db_backend, &space) 73 73 + .await 74 74 + .unwrap(); 75 75 + spaces_db::add_member( 76 76 + &app.state.db, 77 77 + app.state.db_backend, 78 78 + &SpaceMember { 79 79 + id: Uuid::new_v4().to_string(), 80 80 + space_id: space_id.clone(), 81 81 + did: MEMBER.to_string(), 82 82 + access: SpaceAccess::Read, 83 83 + is_delegation: false, 84 84 + granted_by: Some(AUTHORITY.to_string()), 85 85 + created_at: now.clone(), 86 86 + }, 87 87 + ) 88 88 + .await 89 89 + .unwrap(); 90 90 + 91 91 + // The member holds an outstanding credential (represented by its hash). 92 92 + let token_hash = "member-credential-hash"; 93 93 + let sql = happyview::db::adapt_sql( 94 94 + "INSERT INTO happyview_space_credentials (id, space_id, issued_to, token_hash, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?)", 95 95 + app.state.db_backend, 96 96 + ); 97 97 + sqlx::query(&sql) 98 98 + .bind(Uuid::new_v4().to_string()) 99 99 + .bind(&space_id) 100 100 + .bind(MEMBER) 101 101 + .bind(token_hash) 102 102 + .bind(&now) 103 103 + .bind(&now) 104 104 + .execute(&app.state.db) 105 105 + .await 106 106 + .unwrap(); 107 107 + 108 108 + assert!( 109 109 + !spaces_db::is_space_credential_revoked(&app.state.db, app.state.db_backend, token_hash) 110 110 + .await 111 111 + .unwrap() 112 112 + ); 113 113 + 114 114 + // The authority removes the member. 115 115 + let (cookie_name, cookie_val) = 116 116 + common::auth::admin_cookie_header(AUTHORITY, &app.state.cookie_key); 117 117 + let req = Request::builder() 118 118 + .method("POST") 119 119 + .uri("/xrpc/com.atproto.simplespace.removeMember") 120 120 + .header(cookie_name, cookie_val) 121 121 + .header("content-type", "application/json") 122 122 + .body(Body::from( 123 123 + json!({ "space": space_uri(), "did": MEMBER }).to_string(), 124 124 + )) 125 125 + .unwrap(); 126 126 + let resp = app.router.clone().oneshot(req).await.unwrap(); 127 127 + assert_eq!(resp.status(), StatusCode::OK); 128 128 + 129 129 + // The credential is now revoked. 130 130 + assert!( 131 131 + spaces_db::is_space_credential_revoked(&app.state.db, app.state.db_backend, token_hash) 132 132 + .await 133 133 + .unwrap(), 134 134 + "removing a member must revoke their outstanding credentials" 135 135 + ); 136 136 + }

+49

tests/spaces_db.rs

View file Reviewed

··· 559 559 560 560 #[tokio::test] 561 561 #[serial] 562 562 + async fn space_credential_revocation_round_trip() { 563 563 + common::require_db!(); 564 564 + let pool = test_db::test_pool().await; 565 565 + let backend = test_db::test_backend(); 566 566 + test_db::truncate_all(&pool).await; 567 567 + 568 568 + let space_id = new_id(); 569 569 + let space = make_space(&space_id, "did:plc:cred-owner", "com.example.cred", "cred"); 570 570 + spaces_db::create_space(&pool, backend, &space) 571 571 + .await 572 572 + .expect("create_space failed"); 573 573 + 574 574 + let member = "did:plc:cred-member"; 575 575 + let token_hash = "abc123hash"; 576 576 + let sql = happyview::db::adapt_sql( 577 577 + "INSERT INTO happyview_space_credentials (id, space_id, issued_to, token_hash, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?)", 578 578 + backend, 579 579 + ); 580 580 + sqlx::query(&sql) 581 581 + .bind(new_id()) 582 582 + .bind(&space_id) 583 583 + .bind(member) 584 584 + .bind(token_hash) 585 585 + .bind(now_rfc3339()) 586 586 + .bind(now_rfc3339()) 587 587 + .execute(&pool) 588 588 + .await 589 589 + .expect("insert credential row"); 590 590 + 591 591 + assert!( 592 592 + !spaces_db::is_space_credential_revoked(&pool, backend, token_hash) 593 593 + .await 594 594 + .unwrap() 595 595 + ); 596 596 + 597 597 + let revoked = spaces_db::revoke_space_credentials_for_member(&pool, backend, &space_id, member) 598 598 + .await 599 599 + .unwrap(); 600 600 + assert_eq!(revoked, 1); 601 601 + 602 602 + assert!( 603 603 + spaces_db::is_space_credential_revoked(&pool, backend, token_hash) 604 604 + .await 605 605 + .unwrap() 606 606 + ); 607 607 + } 608 608 + 609 609 + #[tokio::test] 610 610 + #[serial] 562 611 async fn remove_member() { 563 612 common::require_db!(); 564 613 let pool = test_db::test_pool().await;