fix(node): address review findings on Arweave anchoring and cert chain (#26)

- Use configured gateway's data URL (/tx_id) instead of bundler API for verify
- Bound untrusted response to 1 MiB on public verify route
- Bind each anchor to its own ref update certificate (not repo-wide latest)
- Make certificate storage append-only with unique (repo_id, seq) constraint
- Add migration v13 to drop old unique index and add sequence uniqueness
- Allocate chain sequence numbers atomically using per-repo advisory lock
- Fail closed on missing predecessor cert during verification
- Persist full RFC 9421 HTTP Signature context (signature-input, content-digest, path)
- Verify pusher authorization proof in verify_anchor
- Add legacy GITLAWB_IRYS_URL fallback for GITLAWB_BUNDLER_URL
- Expose seq, prev, pusher_sig through certificate API list/get responses

Author: Gravirei

Cargo.lock

@@ -52,6 +52,9 @@ pub async fn list_certs(
                 "node_did":   c.node_did,
                 "signature":  c.signature,
                 "issued_at":  c.issued_at,
+                "seq":        c.seq,
+                "prev":       c.prev,
+                "pusher_sig": c.pusher_sig,
             })
         })
         .collect();
@@ -92,5 +95,8 @@ pub async fn get_cert(
         "node_did":   cert.node_did,
         "signature":  cert.signature,
         "issued_at":  cert.issued_at,
+        "seq":        cert.seq,
+        "prev":       cert.prev,
+        "pusher_sig": cert.pusher_sig,
     })))
 }

crates/gitlawb-node/src/api/certs.rs

@@ -440,6 +440,9 @@ mod ref_updates_feed_tests {
             seq: 1,
             prev: "0".repeat(64),
             pusher_sig: None,
+            signature_input: None,
+            content_digest: None,
+            request_path: None,
         }
     }
 

crates/gitlawb-node/src/api/events.rs

@@ -5,7 +5,7 @@ use axum::Json;
 use bytes::Bytes;
 use std::sync::Arc;
 
-use crate::auth::{caller_authorized_to_push, AuthenticatedDid, PusherSignature};
+use crate::auth::{caller_authorized_to_push, AuthenticatedDid, PusherProof, PusherSignature};
 use crate::db::RepoRecord;
 use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
@@ -856,6 +856,7 @@ pub async fn git_receive_pack(
     Path((owner, repo)): Path<(String, String)>,
     Extension(auth): Extension<AuthenticatedDid>,
     Extension(pusher_sig): Extension<PusherSignature>,
+    Extension(pusher_proof): Extension<PusherProof>,
     body: Bytes,
 ) -> Result<Response> {
     let name = smart_http_repo_name(&repo)?;
@@ -972,6 +973,10 @@ pub async fn git_receive_pack(
     // The route is behind `require_signature`, so the verified pusher identity is
     // always present; use it directly rather than re-parsing the headers.
     let did = auth.0.as_str();
+    // Collect certs keyed by ref_name so the anchoring loop below uses
+    // the correct per-update certificate rather than a repo-wide latest.
+    let mut ref_certs: std::collections::HashMap<String, crate::db::RefCertificate> =
+        std::collections::HashMap::new();
     {
         // Use the first new commit hash we parsed, fall back to timestamp
         let commit_hash = ref_updates
@@ -999,11 +1004,15 @@ pub async fn git_receive_pack(
                 &update.new_sha,
                 did,
                 Some(pusher_sig.0.clone()),
+                Some(pusher_proof.signature_input.clone()),
+                Some(pusher_proof.content_digest.clone()),
+                Some(pusher_proof.request_path.clone()),
             )
             .await
             {
                 Ok(c) => {
-                    tracing::info!(cert_id = %c.id, repo = %record.name, ref_name = %update.ref_name, pusher = %did, "issued ref certificate")
+                    tracing::info!(cert_id = %c.id, repo = %record.name, ref_name = %update.ref_name, pusher = %did, "issued ref certificate");
+                    ref_certs.insert(update.ref_name.clone(), c);
                 }
                 Err(e) => {
                     tracing::warn!(err = %e, ref_name = %update.ref_name, "failed to issue ref certificate")
@@ -1210,7 +1219,6 @@ pub async fn git_receive_pack(
         let db_clone = state.db.clone();
         let http_client = Arc::clone(&state.http_client);
         let node_did_str = state.node_did.to_string();
-        let repo_id_clone = record.id.clone();
         let repo_slug = format!(
             "{}/{}",
             crate::db::normalize_owner_key(&record.owner_did),
@@ -1220,6 +1228,7 @@ pub async fn git_receive_pack(
             .iter()
             .map(|u| (u.ref_name.clone(), u.old_sha.clone(), u.new_sha.clone()))
             .collect::<Vec<_>>();
+        let ref_certs_clone = ref_certs.clone();
         let p2p_handle = state.p2p.clone();
         let pusher_did_clone = did.to_string();
         let db_for_peers = state.db.clone();
@@ -1311,11 +1320,10 @@ pub async fn git_receive_pack(
             if announce && !bundler_url.is_empty() {
                 for (ref_name, old_sha, new_sha) in &ref_updates_clone {
                     let cid = cid_map.get(new_sha).cloned();
-                    let cert = db_clone
-                        .get_most_recent_cert(&repo_id_clone)
-                        .await
-                        .ok()
-                        .flatten();
+                    // Use the per-update certificate issued above, not a
+                    // repo-wide latest, so each anchor embeds the exact
+                    // certificate for its own ref transition.
+                    let cert = ref_certs_clone.get(ref_name).cloned();
                     let anchor = crate::arweave::RefAnchor {
                         repo: repo_slug.clone(),
                         owner_did: owner_did_for_arweave.clone(),

crates/gitlawb-node/src/api/repos.rs

@@ -22,6 +22,7 @@ use base64::Engine as _;
 use serde::Serialize;
 use serde_json::json;
 use sha2::Digest;
+use std::collections::HashMap;
 use std::str::FromStr;
 
 /// Data describing a ref-update event to be anchored.
@@ -261,22 +262,32 @@ pub async fn verify_anchor(
     tx_id: &str,
     db: &crate::db::Db,
 ) -> Result<VerifyResult> {
-    // Fetch the data item from the bundler gateway.
-    let url = format!("{}/v1/tx/{}", gateway_url.trim_end_matches('/'), tx_id);
+    // Fetch the data item from the Arweave gateway's data path.
+    // Gateways serve data at /{tx_id}, not /v1/tx/{id} (which is the bundler API).
+    let url = format!("{}/{}", gateway_url.trim_end_matches('/'), tx_id);
     let resp = client
         .get(&url)
         .send()
         .await
-        .map_err(|e| anyhow::anyhow!("failed to fetch data from bundler gateway: {e}"))?;
+        .map_err(|e| anyhow::anyhow!("failed to fetch data from Arweave gateway: {e}"))?;
     if !resp.status().is_success() {
         return Ok(VerifyResult {
             valid: false,
             anchor: serde_json::Value::Null,
             certificate: None,
-            errors: vec![format!("bundler gateway returned {}", resp.status())],
+            errors: vec![format!("Arweave gateway returned {}", resp.status())],
         });
     }
+    // Bound the untrusted response to 1 MiB to prevent memory exhaustion.
     let body_bytes = resp.bytes().await?;
+    if body_bytes.len() > 1_048_576 {
+        return Ok(VerifyResult {
+            valid: false,
+            anchor: serde_json::Value::Null,
+            certificate: None,
+            errors: vec!["response body exceeds 1 MiB limit".to_string()],
+        });
+    }
 
     // Parse the payload — could be JSON or raw bytes depending on gateway
     let anchor: serde_json::Value = serde_json::from_slice(&body_bytes)?;
@@ -341,26 +352,132 @@ pub async fn verify_anchor(
             errors.push(format!("certificate signature verification failed: {e}"));
         }
 
-        // 2. Verify prev hash linkage against the predecessor at seq - 1
+        // 2. Verify prev hash linkage against the predecessor at seq - 1.
+        //    Fail closed: a missing declared predecessor is treated as invalid.
         if c.seq > 1 {
-            if let Ok(Some(pred)) = db.get_cert_by_seq(&c.repo_id, c.seq - 1).await {
-                let prev_payload = serde_json::json!({
-                    "repo_id":    pred.repo_id,
-                    "ref":        pred.ref_name,
-                    "old":        pred.old_sha,
-                    "new":        pred.new_sha,
-                    "pusher":     pred.pusher_did,
-                    "node":       pred.node_did,
-                    "ts":         pred.issued_at,
-                });
-                let prev_bytes = serde_json::to_vec(&prev_payload)?;
-                let expected_prev = hex::encode(sha2::Sha256::digest(&prev_bytes));
-                if c.prev != expected_prev {
+            match db.get_cert_by_seq(&c.repo_id, c.seq - 1).await {
+                Ok(Some(pred)) => {
+                    let prev_payload = serde_json::json!({
+                        "repo_id":    pred.repo_id,
+                        "ref":        pred.ref_name,
+                        "old":        pred.old_sha,
+                        "new":        pred.new_sha,
+                        "pusher":     pred.pusher_did,
+                        "node":       pred.node_did,
+                        "ts":         pred.issued_at,
+                    });
+                    let prev_bytes = serde_json::to_vec(&prev_payload)?;
+                    let expected_prev = hex::encode(sha2::Sha256::digest(&prev_bytes));
+                    if c.prev != expected_prev {
+                        errors.push(format!(
+                            "prev hash mismatch: claimed {} expected {}",
+                            c.prev, expected_prev
+                        ));
+                    }
+                }
+                Ok(None) => {
                     errors.push(format!(
-                        "prev hash mismatch: claimed {} expected {}",
-                        c.prev, expected_prev
+                        "predecessor cert seq {} not found for repo {}",
+                        c.seq - 1,
+                        c.repo_id
                     ));
                 }
+                Err(e) => {
+                    errors.push(format!(
+                        "error looking up predecessor seq {}: {e}",
+                        c.seq - 1
+                    ));
+                }
+            }
+        }
+
+        // 3. Verify the pusher authorization proof (RFC 9421 HTTP Signature)
+        //    when all required context is available.
+        if let (Some(pusher_sig), Some(sig_input), Some(content_digest), Some(request_path)) = (
+            &c.pusher_sig,
+            &c.signature_input,
+            &c.content_digest,
+            &c.request_path,
+        ) {
+            match gitlawb_core::http_sig::HttpSignature::parse(
+                sig_input,
+                &format!("sig1=:{pusher_sig}:"),
+            ) {
+                Ok(http_sig) => {
+                    let mut request_values: HashMap<String, String> = HashMap::new();
+                    request_values.insert("@method".to_string(), "POST".to_string());
+                    request_values.insert("@path".to_string(), request_path.clone());
+                    request_values.insert("content-digest".to_string(), content_digest.clone());
+
+                    let sig_params_value = sig_input.strip_prefix("sig1=").unwrap_or(sig_input);
+                    let components_ref: Vec<&str> =
+                        http_sig.components.iter().map(String::as_str).collect();
+
+                    match gitlawb_core::http_sig::build_signing_string(
+                        &components_ref,
+                        sig_params_value,
+                        &request_values,
+                    ) {
+                        Ok(signing_string) => {
+                            let pusher_did = gitlawb_core::did::Did::from_str(&c.pusher_did);
+                            let pusher_vk = pusher_did.and_then(|d| d.to_verifying_key());
+                            match pusher_vk {
+                                Ok(vk) => {
+                                    let sig_bytes: [u8; 64] =
+                                        match base64::engine::general_purpose::STANDARD
+                                            .decode(pusher_sig)
+                                        {
+                                            Ok(bytes) => match bytes.as_slice().try_into() {
+                                                Ok(a) => a,
+                                                Err(_) => {
+                                                    errors.push(
+                                                        "pusher signature is not 64 bytes"
+                                                            .to_string(),
+                                                    );
+                                                    return Ok(VerifyResult {
+                                                        valid: false,
+                                                        anchor,
+                                                        certificate: cert,
+                                                        errors,
+                                                    });
+                                                }
+                                            },
+                                            Err(_) => {
+                                                errors.push(
+                                                    "pusher signature is not valid base64"
+                                                        .to_string(),
+                                                );
+                                                return Ok(VerifyResult {
+                                                    valid: false,
+                                                    anchor,
+                                                    certificate: cert,
+                                                    errors,
+                                                });
+                                            }
+                                        };
+                                    if let Err(e) = gitlawb_core::identity::verify(
+                                        &vk,
+                                        signing_string.as_bytes(),
+                                        &sig_bytes,
+                                    ) {
+                                        errors.push(format!(
+                                            "pusher signature verification failed: {e}"
+                                        ));
+                                    }
+                                }
+                                Err(e) => {
+                                    errors.push(format!("unresolvable pusher DID: {e}"));
+                                }
+                            }
+                        }
+                        Err(e) => {
+                            errors.push(format!("failed to build signing string: {e}"));
+                        }
+                    }
+                }
+                Err(e) => {
+                    errors.push(format!("failed to parse pusher Signature-Input: {e}"));
+                }
             }
         }
     } else {
@@ -564,16 +681,14 @@ mod tests {
     #[tokio::test]
     async fn test_verify_anchor_uses_correct_gateway_url() {
         let mut server = mockito::Server::new_async().await;
+        // Gateways serve data at /{tx_id}, not /v1/tx/{id}.
         let _mock = server
-            .mock("GET", "/v1/tx/does-not-exist")
+            .mock("GET", "/does-not-exist")
             .with_status(404)
             .create_async()
             .await;
 
         let client = reqwest::Client::new();
-        // verify_anchor needs a real PgPool; this test only exercises that
-        // the function correctly formats the gateway URL and handles a 404.
-        // It will error on the pool access which is expected without a test DB.
         let pool = sqlx::postgres::PgPoolOptions::new()
             .connect_lazy("postgres://localhost/gitlawb_test_placeholder")
             .expect("lazy pool creation should not fail");
@@ -582,13 +697,9 @@ mod tests {
 
         match result {
             Ok(r) => {
-                // With a lazy unconnected pool, get_most_recent_cert will fail,
-                // but the function still returns Ok(VerifyResult) with errors.
                 assert!(!r.valid);
             }
             Err(e) => {
-                // On some systems the POSTGRES connection attempt may abort
-                // rather than fail gracefully.
                 let msg = e.to_string();
                 assert!(
                     msg.contains("pool") || msg.contains("error"),