Files
eng-pad-server/internal/grpcserver/sync.go
Kyle Isom ea9375b6ae Security hardening: fix critical, high, and medium issues from audit
CRITICAL:
- A-001: SQL injection in snapshot — escape single quotes in backup path
- A-002: Timing attack — always verify against dummy hash when user not
  found, preventing username enumeration
- A-003: Notebook ownership — all authenticated endpoints now verify
  user_id before loading notebook data
- A-004: Point data bounds — decodePoints returns error on misaligned
  data, >4MB payloads, and NaN/Inf values

HIGH:
- A-005: Error messages — generic errors in HTTP responses, no err.Error()
- A-006: Share link authz — RevokeShareLink verifies notebook ownership
- A-007: Scan errors — return 500 instead of silently continuing

MEDIUM:
- A-008: Web server TLS — optional TLS support (HTTPS when configured)
- A-009: Input validation — page_size, stroke count, point_data alignment
  checked in SyncNotebook RPC
- A-010: Graceful shutdown — 30s drain on SIGINT/SIGTERM, all servers
  shut down properly

Added AUDIT.md with all 17 findings, status, and rationale for
accepted risks.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-24 20:16:26 -07:00

164 lines
5.0 KiB
Go

package grpcserver
import (
"context"
"database/sql"
"time"
pb "git.wntrmute.dev/kyle/eng-pad-server/gen/engpad/v1"
"google.golang.org/grpc/codes"
"google.golang.org/grpc/status"
"google.golang.org/protobuf/types/known/timestamppb"
)
type SyncService struct {
pb.UnimplementedEngPadSyncServer
DB *sql.DB
BaseURL string
}
const maxTotalStrokes = 100000
func (s *SyncService) SyncNotebook(ctx context.Context, req *pb.SyncNotebookRequest) (*pb.SyncNotebookResponse, error) {
userID, ok := UserIDFromContext(ctx)
if !ok {
return nil, status.Error(codes.Internal, "missing user context")
}
// Validate page_size
if req.PageSize != "REGULAR" && req.PageSize != "LARGE" {
return nil, status.Errorf(codes.InvalidArgument, "invalid page_size: must be REGULAR or LARGE")
}
// Validate total stroke count and point_data alignment
totalStrokes := 0
for _, page := range req.Pages {
totalStrokes += len(page.Strokes)
if totalStrokes > maxTotalStrokes {
return nil, status.Errorf(codes.InvalidArgument, "total stroke count exceeds maximum of %d", maxTotalStrokes)
}
for _, stroke := range page.Strokes {
if len(stroke.PointData)%4 != 0 {
return nil, status.Errorf(codes.InvalidArgument, "point_data length must be a multiple of 4")
}
}
}
tx, err := s.DB.BeginTx(ctx, nil)
if err != nil {
return nil, status.Errorf(codes.Internal, "begin tx: %v", err)
}
defer func() { _ = tx.Rollback() }()
now := time.Now().UnixMilli()
// Upsert notebook
var notebookID int64
err = tx.QueryRowContext(ctx,
"SELECT id FROM notebooks WHERE user_id = ? AND remote_id = ?",
userID, req.NotebookId,
).Scan(&notebookID)
if err == sql.ErrNoRows {
res, err := tx.ExecContext(ctx,
"INSERT INTO notebooks (user_id, remote_id, title, page_size, synced_at) VALUES (?, ?, ?, ?, ?)",
userID, req.NotebookId, req.Title, req.PageSize, now,
)
if err != nil {
return nil, status.Errorf(codes.Internal, "insert notebook: %v", err)
}
notebookID, _ = res.LastInsertId()
} else if err != nil {
return nil, status.Errorf(codes.Internal, "query notebook: %v", err)
} else {
// Update existing — delete all pages (cascade deletes strokes)
if _, err := tx.ExecContext(ctx, "DELETE FROM pages WHERE notebook_id = ?", notebookID); err != nil {
return nil, status.Errorf(codes.Internal, "delete pages: %v", err)
}
if _, err := tx.ExecContext(ctx,
"UPDATE notebooks SET title = ?, page_size = ?, synced_at = ? WHERE id = ?",
req.Title, req.PageSize, now, notebookID,
); err != nil {
return nil, status.Errorf(codes.Internal, "update notebook: %v", err)
}
}
// Insert pages and strokes
for _, page := range req.Pages {
res, err := tx.ExecContext(ctx,
"INSERT INTO pages (notebook_id, remote_id, page_number) VALUES (?, ?, ?)",
notebookID, page.PageId, page.PageNumber,
)
if err != nil {
return nil, status.Errorf(codes.Internal, "insert page: %v", err)
}
pageID, _ := res.LastInsertId()
for _, stroke := range page.Strokes {
if _, err := tx.ExecContext(ctx,
"INSERT INTO strokes (page_id, pen_size, color, style, point_data, stroke_order) VALUES (?, ?, ?, ?, ?, ?)",
pageID, stroke.PenSize, stroke.Color, stroke.Style, stroke.PointData, stroke.StrokeOrder,
); err != nil {
return nil, status.Errorf(codes.Internal, "insert stroke: %v", err)
}
}
}
if err := tx.Commit(); err != nil {
return nil, status.Errorf(codes.Internal, "commit: %v", err)
}
return &pb.SyncNotebookResponse{
ServerNotebookId: notebookID,
SyncedAt: timestamppb.Now(),
}, nil
}
func (s *SyncService) DeleteNotebook(ctx context.Context, req *pb.DeleteNotebookRequest) (*pb.DeleteNotebookResponse, error) {
userID, ok := UserIDFromContext(ctx)
if !ok {
return nil, status.Error(codes.Internal, "missing user context")
}
_, err := s.DB.ExecContext(ctx,
"DELETE FROM notebooks WHERE user_id = ? AND remote_id = ?",
userID, req.NotebookId,
)
if err != nil {
return nil, status.Errorf(codes.Internal, "delete: %v", err)
}
return &pb.DeleteNotebookResponse{}, nil
}
func (s *SyncService) ListNotebooks(ctx context.Context, req *pb.ListNotebooksRequest) (*pb.ListNotebooksResponse, error) {
userID, ok := UserIDFromContext(ctx)
if !ok {
return nil, status.Error(codes.Internal, "missing user context")
}
rows, err := s.DB.QueryContext(ctx,
`SELECT n.id, n.remote_id, n.title, n.page_size, n.synced_at,
(SELECT COUNT(*) FROM pages WHERE notebook_id = n.id) as page_count
FROM notebooks n WHERE n.user_id = ? ORDER BY n.synced_at DESC`,
userID,
)
if err != nil {
return nil, status.Errorf(codes.Internal, "query: %v", err)
}
defer func() { _ = rows.Close() }()
var notebooks []*pb.NotebookSummary
for rows.Next() {
var nb pb.NotebookSummary
var syncedAt int64
if err := rows.Scan(&nb.ServerId, &nb.RemoteId, &nb.Title, &nb.PageSize, &syncedAt, &nb.PageCount); err != nil {
return nil, status.Errorf(codes.Internal, "scan: %v", err)
}
nb.SyncedAt = timestamppb.New(time.UnixMilli(syncedAt))
notebooks = append(notebooks, &nb)
}
return &pb.ListNotebooksResponse{Notebooks: notebooks}, nil
}