3 Commits

Include renames

Author	SHA1	Message	Date
zeekay	6f4b0d52bb	fix: remove all tenant-specific data from MPC infrastructure ... MPC is generic infrastructure — no hardcoded tenant URLs. - Remove pars.network, zoo.network from OIDC issuers, ingress, TLS - Remove redacted.com, redacted from CORS, WebAuthn, tests - CORS/WebAuthn origins now env-driven: MPC_CORS_ORIGINS, MPC_WEBAUTHN_ORIGINS - Ingress: mpc.lux.network only — tenants route through their own ingress - Tests updated to match infrastructure-only origin lists	2025-12-28 02:19:39 -08:00
zeekay	3764f7cd60	feat: configurable WebAuthn RP ID and origins for Liquidity exchange ... Add MPC_WEBAUTHN_RP_ID and MPC_WEBAUTHN_ORIGINS env vars to make WebAuthn relying party and origin allowlist configurable. Adds Liquidity exchange origins (exchange.{dev,test,main}.redacted.com, redacted) to WebAuthn origin checks, CORS, and security tests.	2025-12-28 01:13:26 -08:00
zeekay	4e915d77c3	security: fix 15 custody audit findings, add regression + fuzz tests ... Fixes all findings from the Blue Team defensive security review of the redacted → redacted custody architecture transition. HIGH: - S-1: Implement P-256 ECDH + AES-256-GCM encryption of passkey backup shards - W-2: Reject unparseable WebAuthn public keys (was silently skipping verification) - O-1: Add Ed25519 binary signature verification package (pkg/integrity) MEDIUM: - W-1: Validate attestation is a real P-256 curve point, not raw attestation object - W-3: Add origin validation to all WebAuthn flows (register, verify, trade approve) - N-2: Remove plaintext TCP fallback from MPC node transport (TLS mandatory) - K-1: Fail-closed on empty/whitespace orgID (prevents cross-tenant key leakage) - A-1: Make AuditEntry immutable (Update/Delete return error) - A-2: Add MPC-level signing audit log (wallet, message hash, intent, trigger) - O-3: Invalidate backup shards after key reshare (stale shares are useless) - O-2: Reject env/file password providers in production (require cloud HSM) LOW: - T-1: Add error handling + MarkSignFailed to signing goroutine - T-2: Verify caller authorization in handleTradeSubmit - K-2: Secret erasure stub now calls runtime.GC() instead of no-op - N-1: Add VerifyConnection callback to reject peers without TLS certs Tests: 69 unit + 7 fuzz targets, ~900K fuzz executions, 19/19 packages green. Makefile: add -tags json1 for SQLite JSON function support in ORM tests.	2025-12-28 01:00:12 -08:00