CRITICAL: - A-001: SQL injection in snapshot — escape single quotes in backup path - A-002: Timing attack — always verify against dummy hash when user not found, preventing username enumeration - A-003: Notebook ownership — all authenticated endpoints now verify user_id before loading notebook data - A-004: Point data bounds — decodePoints returns error on misaligned data, >4MB payloads, and NaN/Inf values HIGH: - A-005: Error messages — generic errors in HTTP responses, no err.Error() - A-006: Share link authz — RevokeShareLink verifies notebook ownership - A-007: Scan errors — return 500 instead of silently continuing MEDIUM: - A-008: Web server TLS — optional TLS support (HTTPS when configured) - A-009: Input validation — page_size, stroke count, point_data alignment checked in SyncNotebook RPC - A-010: Graceful shutdown — 30s drain on SIGINT/SIGTERM, all servers shut down properly Added AUDIT.md with all 17 findings, status, and rationale for accepted risks. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
164 lines
5.0 KiB
Go
164 lines
5.0 KiB
Go
package grpcserver
|
|
|
|
import (
|
|
"context"
|
|
"database/sql"
|
|
"time"
|
|
|
|
pb "git.wntrmute.dev/kyle/eng-pad-server/gen/engpad/v1"
|
|
"google.golang.org/grpc/codes"
|
|
"google.golang.org/grpc/status"
|
|
"google.golang.org/protobuf/types/known/timestamppb"
|
|
)
|
|
|
|
type SyncService struct {
|
|
pb.UnimplementedEngPadSyncServer
|
|
DB *sql.DB
|
|
BaseURL string
|
|
}
|
|
|
|
const maxTotalStrokes = 100000
|
|
|
|
func (s *SyncService) SyncNotebook(ctx context.Context, req *pb.SyncNotebookRequest) (*pb.SyncNotebookResponse, error) {
|
|
userID, ok := UserIDFromContext(ctx)
|
|
if !ok {
|
|
return nil, status.Error(codes.Internal, "missing user context")
|
|
}
|
|
|
|
// Validate page_size
|
|
if req.PageSize != "REGULAR" && req.PageSize != "LARGE" {
|
|
return nil, status.Errorf(codes.InvalidArgument, "invalid page_size: must be REGULAR or LARGE")
|
|
}
|
|
|
|
// Validate total stroke count and point_data alignment
|
|
totalStrokes := 0
|
|
for _, page := range req.Pages {
|
|
totalStrokes += len(page.Strokes)
|
|
if totalStrokes > maxTotalStrokes {
|
|
return nil, status.Errorf(codes.InvalidArgument, "total stroke count exceeds maximum of %d", maxTotalStrokes)
|
|
}
|
|
for _, stroke := range page.Strokes {
|
|
if len(stroke.PointData)%4 != 0 {
|
|
return nil, status.Errorf(codes.InvalidArgument, "point_data length must be a multiple of 4")
|
|
}
|
|
}
|
|
}
|
|
|
|
tx, err := s.DB.BeginTx(ctx, nil)
|
|
if err != nil {
|
|
return nil, status.Errorf(codes.Internal, "begin tx: %v", err)
|
|
}
|
|
defer func() { _ = tx.Rollback() }()
|
|
|
|
now := time.Now().UnixMilli()
|
|
|
|
// Upsert notebook
|
|
var notebookID int64
|
|
err = tx.QueryRowContext(ctx,
|
|
"SELECT id FROM notebooks WHERE user_id = ? AND remote_id = ?",
|
|
userID, req.NotebookId,
|
|
).Scan(¬ebookID)
|
|
|
|
if err == sql.ErrNoRows {
|
|
res, err := tx.ExecContext(ctx,
|
|
"INSERT INTO notebooks (user_id, remote_id, title, page_size, synced_at) VALUES (?, ?, ?, ?, ?)",
|
|
userID, req.NotebookId, req.Title, req.PageSize, now,
|
|
)
|
|
if err != nil {
|
|
return nil, status.Errorf(codes.Internal, "insert notebook: %v", err)
|
|
}
|
|
notebookID, _ = res.LastInsertId()
|
|
} else if err != nil {
|
|
return nil, status.Errorf(codes.Internal, "query notebook: %v", err)
|
|
} else {
|
|
// Update existing — delete all pages (cascade deletes strokes)
|
|
if _, err := tx.ExecContext(ctx, "DELETE FROM pages WHERE notebook_id = ?", notebookID); err != nil {
|
|
return nil, status.Errorf(codes.Internal, "delete pages: %v", err)
|
|
}
|
|
if _, err := tx.ExecContext(ctx,
|
|
"UPDATE notebooks SET title = ?, page_size = ?, synced_at = ? WHERE id = ?",
|
|
req.Title, req.PageSize, now, notebookID,
|
|
); err != nil {
|
|
return nil, status.Errorf(codes.Internal, "update notebook: %v", err)
|
|
}
|
|
}
|
|
|
|
// Insert pages and strokes
|
|
for _, page := range req.Pages {
|
|
res, err := tx.ExecContext(ctx,
|
|
"INSERT INTO pages (notebook_id, remote_id, page_number) VALUES (?, ?, ?)",
|
|
notebookID, page.PageId, page.PageNumber,
|
|
)
|
|
if err != nil {
|
|
return nil, status.Errorf(codes.Internal, "insert page: %v", err)
|
|
}
|
|
pageID, _ := res.LastInsertId()
|
|
|
|
for _, stroke := range page.Strokes {
|
|
if _, err := tx.ExecContext(ctx,
|
|
"INSERT INTO strokes (page_id, pen_size, color, style, point_data, stroke_order) VALUES (?, ?, ?, ?, ?, ?)",
|
|
pageID, stroke.PenSize, stroke.Color, stroke.Style, stroke.PointData, stroke.StrokeOrder,
|
|
); err != nil {
|
|
return nil, status.Errorf(codes.Internal, "insert stroke: %v", err)
|
|
}
|
|
}
|
|
}
|
|
|
|
if err := tx.Commit(); err != nil {
|
|
return nil, status.Errorf(codes.Internal, "commit: %v", err)
|
|
}
|
|
|
|
return &pb.SyncNotebookResponse{
|
|
ServerNotebookId: notebookID,
|
|
SyncedAt: timestamppb.Now(),
|
|
}, nil
|
|
}
|
|
|
|
func (s *SyncService) DeleteNotebook(ctx context.Context, req *pb.DeleteNotebookRequest) (*pb.DeleteNotebookResponse, error) {
|
|
userID, ok := UserIDFromContext(ctx)
|
|
if !ok {
|
|
return nil, status.Error(codes.Internal, "missing user context")
|
|
}
|
|
|
|
_, err := s.DB.ExecContext(ctx,
|
|
"DELETE FROM notebooks WHERE user_id = ? AND remote_id = ?",
|
|
userID, req.NotebookId,
|
|
)
|
|
if err != nil {
|
|
return nil, status.Errorf(codes.Internal, "delete: %v", err)
|
|
}
|
|
|
|
return &pb.DeleteNotebookResponse{}, nil
|
|
}
|
|
|
|
func (s *SyncService) ListNotebooks(ctx context.Context, req *pb.ListNotebooksRequest) (*pb.ListNotebooksResponse, error) {
|
|
userID, ok := UserIDFromContext(ctx)
|
|
if !ok {
|
|
return nil, status.Error(codes.Internal, "missing user context")
|
|
}
|
|
|
|
rows, err := s.DB.QueryContext(ctx,
|
|
`SELECT n.id, n.remote_id, n.title, n.page_size, n.synced_at,
|
|
(SELECT COUNT(*) FROM pages WHERE notebook_id = n.id) as page_count
|
|
FROM notebooks n WHERE n.user_id = ? ORDER BY n.synced_at DESC`,
|
|
userID,
|
|
)
|
|
if err != nil {
|
|
return nil, status.Errorf(codes.Internal, "query: %v", err)
|
|
}
|
|
defer func() { _ = rows.Close() }()
|
|
|
|
var notebooks []*pb.NotebookSummary
|
|
for rows.Next() {
|
|
var nb pb.NotebookSummary
|
|
var syncedAt int64
|
|
if err := rows.Scan(&nb.ServerId, &nb.RemoteId, &nb.Title, &nb.PageSize, &syncedAt, &nb.PageCount); err != nil {
|
|
return nil, status.Errorf(codes.Internal, "scan: %v", err)
|
|
}
|
|
nb.SyncedAt = timestamppb.New(time.UnixMilli(syncedAt))
|
|
notebooks = append(notebooks, &nb)
|
|
}
|
|
|
|
return &pb.ListNotebooksResponse{Notebooks: notebooks}, nil
|
|
}
|