zjncs opened a new pull request, #5706:
URL: https://github.com/apache/rocketmq-dashboard/pull/5706
### What
`McpAuthenticator` — the verifier of the `rmq-hmac-sha256` credential and
signature pair of an MCP request — had no test. This adds
`McpAuthenticatorTest` with 11 tests pinning the verification contract.
### Why
This is the authentication boundary of the MCP entry point. Its javadoc
documents several deliberate security postures that nothing guarded: the single
opaque 401 (no oracle about which part failed), the
unknown-instance-is-auth-failure rule (no instance-name enumeration), the
500-vs-401 split between outages and configuration problems, and the
five-minute skew window a signer's retry loop depends on.
### What is pinned
- a validly signed request authenticates as its access key;
- **the query string is signed material**: a request whose query differs
from the one the signer used is rejected — parameters cannot be appended to a
captured request;
- a missing Authorization header is its own failure (`MCP authentication is
required.`), distinct from every verification failure's single opaque `MCP
authentication failed.`;
- a malformed header, a wrong secret, and a wrong access key are all
rejected;
- **the clock-skew window is the documented five minutes and inclusive at
the edge** — pinned as a literal, not derived from the constant, so a silent
window change cannot pass unnoticed;
- the instance-id header is required;
- **an unknown instance is an authentication failure, not a 404** — the
entry point must not confirm which instance names exist;
- every "this instance has no usable credential" outcome collapses into the
same opaque failure as a bad signature (leaking which part of the chain is
missing would be an oracle);
- **a non-configuration outage inside the credential chain propagates
untouched**, so the filter can answer 500 instead of blaming the caller's
credentials.
### Verification
- New tests on unmodified code: **11/11 green** (`mvn test
-Dtest=McpAuthenticatorTest`).
- Discriminating mutations on `McpAuthenticator`, build result verified red
each time:
1. the skew window shrunk from five to four minutes — red, caught by the
literal edge test (an earlier draft of the test that derived the edge from the
constant stayed green under this mutation, which is exactly the trap the
literal guards against — noted for transparency);
2. the request target dropped from the canonical string — red;
3. the opaque-failure collapse removed so a `BusinessException` escapes —
red.
- Restored: 11/11 green. Test-only change; no product code touched.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
