zeekayandHanzo Dev 81d75daf83 cel: a check that cannot compile must refuse the endpoint, not disarm it ...

api.lux.network, api.hanzo.network, api.zoo.network, api.spc.network and
api.pars.network all serve info.peers — the full peer list, node IDs,
cluster addresses, staking port and the exact luxd version — from behind
a rule that names the four info methods it means to permit. The rule has
never been applied. Three independent defects, each sufficient on its
own:

1. `req_body` was not a declared CEL variable. Every JSON-RPC method the
   edge multiplexes over one path lives in the body, so without it no
   policy over methods is expressible at all — which is what both gateway
   configs in the estate were written to express.

2. `parseByKey` treated ErrorChecking — the error for naming an
   undeclared variable — as a Debug line and `continue`, returning zero
   programs and a NIL error. One mistyped variable was the whole distance
   between a policy and no policy, reported nowhere above Debug.

3. `ProxyFactory` answered a parse failure with two Warnings and `return
   next, nil` — the pipe WITHOUT the check. The endpoint stayed in the
   config, read as guarded, and served everything.

So the config was wrong in a way the code was built to swallow. The
expression itself does not compile either, and cannot be made to:
`has()` is a macro over a field selection, so `has(req_body)` on a bare
identifier is rejected by the parser whatever the environment declares.
It is also unnecessary — req_body is a string and is "" when absent, so
an allowlist refuses an empty body on its own. Correcting the configs is
a separate change; this one makes the gateway say so instead of
pretending.

Bodies read for evaluation are replayed to the backend, and only on
endpoints that actually declare a check. Reading is capped at 1 MiB and
an oversize body is REFUSED rather than truncated — matching a prefix and
passing the remainder would make the cap itself the bypass.

Tests are the estate's own expression, not a tidy stand-in: the
production rule is asserted to be refused, the corrected form to block
info.peers and pass info.isBootstrapped. Each of the three fixes was
reverted individually and the suite fails without it. `go build ./...`
and `go build -tags legacy ./...` both clean; full unit suite green.

Co-authored-by: Hanzo Dev <[email protected]>

2026-08-07 04:24:24 -07:00

..

cel.go

cel: a check that cannot compile must refuse the endpoint, not disarm it

2026-08-07 04:24:24 -07:00