8654c04b00
The ~500-char opc1_ fragment is retired from every production surface; a relay session now shares one 10-char Crockford code (1 region char + 9 random, 45 bits). The full invite is sealed with a blake3 encrypt-then-MAC under keys derived from the code and stored on the locator control plane under an independent code_id; guests claim from exactly the region the code names, so neither the id nor the bearer ticket reaches uninvolved regions. The store tombstones exhausted claim budgets (an id can never be re-published under a burned code), caps codes per device key, and keeps per-route ingress body limits. Connect failures now distinguish invalid, expired, and relay-not-configured across all 15 locales, and the threat model documents the operator-grindable 45-bit residual risk.
166 lines
6.5 KiB
YAML
166 lines
6.5 KiB
YAML
name: P2P collaboration security boundaries
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- 'Cargo.toml'
|
|
- 'Cargo.lock'
|
|
- '.dockerignore'
|
|
- '.gitignore'
|
|
- 'rust-toolchain.toml'
|
|
- 'crates/op-collab/**'
|
|
- 'crates/op-collab-smoke/**'
|
|
- 'crates/op-collab-transport/**'
|
|
- 'crates/op-collab-relay-protocol/**'
|
|
- 'crates/op-collab-relay-client/**'
|
|
- 'crates/op-collab-relay-server/**'
|
|
- 'crates/op-collab-relay-control-plane/**'
|
|
- 'crates/op-collab-policy-file/**'
|
|
- 'crates/op-collab-relay-locator-server/**'
|
|
- 'crates/op-auth-bridge/**'
|
|
- 'crates/op-util/**'
|
|
- 'crates/op-editor-core/**'
|
|
- 'crates/op-editor-host-core/**'
|
|
- 'crates/op-editor-ui/**'
|
|
- 'crates/op-host-native/**'
|
|
- 'crates/op-host-desktop/**'
|
|
- 'crates/op-host-services/**'
|
|
- 'crates/op-i18n/**'
|
|
- 'deploy/collab-relay/**'
|
|
- 'deploy/collab-relay-edge/**'
|
|
- 'deploy/collab-relay-locator/**'
|
|
- 'deploy/collab-relay-locator-edge/**'
|
|
- 'docs/security/p2p-collaboration-threat-model.md'
|
|
- 'docs/testing/p2p-collaboration-platform-acceptance.md'
|
|
- 'tools/check-collab-security-boundaries.sh'
|
|
- 'tools/check-collab-security-boundaries.test.sh'
|
|
- 'tools/check-collab-security-boundaries-cases.sh'
|
|
- 'tools/check-collab-deployment-boundaries.sh'
|
|
- 'tools/check-op-auth-prebuilt.sh'
|
|
- 'tools/check-op-auth-prebuilt.test.sh'
|
|
- 'tools/package-op-auth-prebuilt.sh'
|
|
- '.github/workflows/collab-security.yml'
|
|
- '.github/workflows/collab-platform-acceptance.yml'
|
|
push:
|
|
branches: ['**']
|
|
paths:
|
|
- 'Cargo.toml'
|
|
- 'Cargo.lock'
|
|
- '.dockerignore'
|
|
- '.gitignore'
|
|
- 'rust-toolchain.toml'
|
|
- 'crates/op-collab/**'
|
|
- 'crates/op-collab-smoke/**'
|
|
- 'crates/op-collab-transport/**'
|
|
- 'crates/op-collab-relay-protocol/**'
|
|
- 'crates/op-collab-relay-client/**'
|
|
- 'crates/op-collab-relay-server/**'
|
|
- 'crates/op-collab-relay-control-plane/**'
|
|
- 'crates/op-collab-policy-file/**'
|
|
- 'crates/op-collab-relay-locator-server/**'
|
|
- 'crates/op-auth-bridge/**'
|
|
- 'crates/op-util/**'
|
|
- 'crates/op-editor-core/**'
|
|
- 'crates/op-editor-host-core/**'
|
|
- 'crates/op-editor-ui/**'
|
|
- 'crates/op-host-native/**'
|
|
- 'crates/op-host-desktop/**'
|
|
- 'crates/op-host-services/**'
|
|
- 'crates/op-i18n/**'
|
|
- 'deploy/collab-relay/**'
|
|
- 'deploy/collab-relay-edge/**'
|
|
- 'deploy/collab-relay-locator/**'
|
|
- 'deploy/collab-relay-locator-edge/**'
|
|
- 'docs/security/p2p-collaboration-threat-model.md'
|
|
- 'docs/testing/p2p-collaboration-platform-acceptance.md'
|
|
- 'tools/check-collab-security-boundaries.sh'
|
|
- 'tools/check-collab-security-boundaries.test.sh'
|
|
- 'tools/check-collab-security-boundaries-cases.sh'
|
|
- 'tools/check-collab-deployment-boundaries.sh'
|
|
- 'tools/check-op-auth-prebuilt.sh'
|
|
- 'tools/check-op-auth-prebuilt.test.sh'
|
|
- 'tools/package-op-auth-prebuilt.sh'
|
|
- '.github/workflows/collab-security.yml'
|
|
- '.github/workflows/collab-platform-acceptance.yml'
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
collaboration-security:
|
|
name: Static boundaries and targeted tests
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
with:
|
|
submodules: recursive
|
|
persist-credentials: false
|
|
- uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable, pinned 2026-07-28
|
|
with:
|
|
toolchain: '1.94'
|
|
targets: wasm32-unknown-unknown
|
|
- uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
|
|
with:
|
|
shared-key: collab-security
|
|
|
|
- name: Check boundary-script syntax
|
|
run: |
|
|
bash -n tools/check-collab-security-boundaries.sh
|
|
bash -n tools/check-collab-security-boundaries.test.sh
|
|
bash -n tools/check-collab-security-boundaries-cases.sh
|
|
bash -n tools/check-collab-deployment-boundaries.sh
|
|
bash -n tools/check-op-auth-prebuilt.sh
|
|
bash -n tools/check-op-auth-prebuilt.test.sh
|
|
bash -n tools/package-op-auth-prebuilt.sh
|
|
|
|
- name: Mutation-test the boundary gate
|
|
run: |
|
|
bash tools/check-collab-security-boundaries.test.sh
|
|
bash tools/check-op-auth-prebuilt.test.sh
|
|
|
|
- name: Verify public/private and secret boundaries
|
|
run: |
|
|
bash tools/check-collab-security-boundaries.sh
|
|
bash tools/check-op-auth-prebuilt.sh
|
|
bash deploy/collab-relay-edge/validate.sh
|
|
bash deploy/collab-relay-locator/validate.sh
|
|
bash deploy/collab-relay-locator-edge/validate.sh
|
|
|
|
- name: Compile the public protocol core for wasm
|
|
run: |
|
|
cargo check --locked --target wasm32-unknown-unknown \
|
|
-p op-collab --no-default-features
|
|
cargo check --locked --target wasm32-unknown-unknown \
|
|
-p op-collab-relay-protocol --no-default-features
|
|
|
|
- name: Test protocol state machines, properties, and resource limits
|
|
run: |
|
|
cargo test --locked -p op-collab
|
|
cargo test --locked -p op-collab-transport
|
|
cargo test --locked -p op-collab-transport config::tests
|
|
cargo test --locked -p op-collab-transport frame::tests
|
|
cargo test --locked -p op-collab-relay-protocol --all-features
|
|
cargo test --locked -p op-collab-relay-client
|
|
cargo test --locked -p op-collab-relay-server
|
|
cargo test --locked -p op-collab-relay-control-plane
|
|
cargo test --locked -p op-collab-policy-file
|
|
cargo test --locked -p op-collab-relay-locator-server
|
|
|
|
- name: Test production/test trust-root isolation
|
|
run: |
|
|
cargo test --locked -p op-auth-bridge --features test-issuer \
|
|
verifies_the_frozen_go_production_root_fixture
|
|
cargo test --locked -p op-auth-bridge --features test-issuer \
|
|
production_signed_policy_path_never_falls_back_to_raw_jwks
|
|
cargo test --locked -p op-auth-bridge --features test-issuer \
|
|
--test collab_verifier
|
|
|
|
- name: Verify every committed authentication archive
|
|
run: cargo test --locked -p op-auth-bridge --test prebuilt_provenance
|
|
|
|
- name: Exercise two-process authenticated collaboration
|
|
run: |
|
|
cargo run --locked -p op-collab-smoke --features test-issuer -- run
|