fix: protect dAuth secret requests from replay

Author: aledefra

AGENTS.md

@@ -695,3 +695,12 @@ Entry format:
 - Details: `ThHfModelBase` keeps Transformers/PT as the default GPU and fallback path, but CPU-only `HF_RUNTIME=auto` now loads `artifact_manifest.json`, selects a declared ONNX Runtime artifact, downloads only safe allow-patterns, loads schema and contract decoder from HF artifacts, and exposes the decoded artifact contract through the existing text-classifier flow. Business API response shaping now passes through generic model/runtime metadata emitted by serving.
 - Verification: `python3 -m unittest extensions.serving.test_th_hf_model_base extensions.serving.test_th_text_classifier extensions.serving.test_th_privacy_filter extensions.business.edge_inference_api.test_text_classifier_inference_api extensions.business.edge_inference_api.test_privacy_filter_inference_api`; `python3 -m py_compile extensions/serving/default_inference/nlp/th_hf_model_base.py extensions/business/edge_inference_api/text_classifier_inference_api.py`; required serving gate `python3 -m unittest extensions.serving.model_testing.test_llm_servings` currently fails at import with `ImportError: cannot import name 'Logger' from 'naeural_core'`.
 - Links: `extensions/serving/default_inference/nlp/th_hf_model_base.py`, `extensions/business/edge_inference_api/text_classifier_inference_api.py`, `extensions/serving/test_th_hf_model_base.py`
+
+- ID: `ML-20260723-001`
+- Timestamp: `2026-07-23T13:45:20Z`
+- Type: `change`
+- Summary: dAuth job-secret requests now require signed 120-second timestamp nonces, and GET responses encrypt secret bundles to the authorized runner.
+- Criticality: Security protocol change preventing indefinite signed-request/response replay and removing plaintext job secrets from HTTP responses.
+- Details: `/add_secrets` and `/get_secrets` validate signed hex-millisecond timestamp nonces and echo them in successful signed responses. `/get_secrets` encrypts the serialized bundle to the signed requester address; clients must verify the response signer and echoed nonce before decrypting.
+- Verification: `python -m unittest discover -s extensions/business/dauth -p 'test_*.py'`; cross-repo SDK dAuth client tests.
+- Links: `extensions/business/dauth/dauth_mixin.py`, `extensions/business/dauth/dauth_manager.py`

extensions/business/dauth/dauth_manager.py

@@ -347,11 +347,16 @@ def get_auth_data(self, body: dict):
   # /add_secrets
   def add_secrets(self, body: dict):
     """
-    Store the full dAuth secret bundle for a job. Only protocol oracles can write.
+    Store a full job secret bundle from a protocol oracle.
+
+    The signed request must include a hex-millisecond timestamp nonce no older
+    than 120 seconds.
     """
+    request_nonce = body.get("nonce") if isinstance(body, dict) else None
     if not self._dauth_server_enabled:
       response = self.__get_response({
-        'error': 'dAuth server is not registered as a dAuth oracle'
+        'error': 'dAuth server is not registered as a dAuth oracle',
+        'nonce': request_nonce,
       })
       return response
 
@@ -364,6 +369,7 @@ def add_secrets(self, body: dict):
       }
 
     response = self.__get_response({
+      'nonce': request_nonce,
       **data
     })
     return response
@@ -372,12 +378,16 @@ def add_secrets(self, body: dict):
   # /get_secrets
   def get_secrets(self, body: dict):
     """
-    Return the full dAuth secret bundle for a job. Only nodes currently running the
-    job in the R1FS-stored pipeline can read.
+    Return an encrypted job secret bundle to a current R1FS job runner.
+
+    The signed request must include a hex-millisecond timestamp nonce no older
+    than 120 seconds. The signed response echoes that nonce.
     """
+    request_nonce = body.get("nonce") if isinstance(body, dict) else None
     if not self._dauth_server_enabled:
       response = self.__get_response({
-        'error': 'dAuth server is not registered as a dAuth oracle'
+        'error': 'dAuth server is not registered as a dAuth oracle',
+        'nonce': request_nonce,
       })
       return response
 
@@ -390,6 +400,7 @@ def get_secrets(self, body: dict):
       }
 
     response = self.__get_response({
+      'nonce': request_nonce,
       **data
     })
     return response

extensions/business/dauth/dauth_mixin.py

@@ -17,6 +17,7 @@
 
 DAUTH_JOB_SECRETS_CSTORE_HKEY = "DAUTH_JOB_SECRETS"
 DEEPLOY_JOBS_CSTORE_HKEY = "DEEPLOY_DEPLOYED_JOBS"
+DAUTH_SECRET_REQUEST_MAX_AGE_SECONDS = 120
 
 
 def version_to_int(version):
@@ -192,6 +193,23 @@ def _is_protocol_oracle_eth(self, node_address_eth):
       raise ValueError("No oracles found - this is a critical issue!")
     return node_address_eth.lower() in [addr.lower() for addr in eth_oracles]
 
+  def _validate_dauth_secret_request_nonce(self, body):
+    """Validate the signed hex-millisecond timestamp nonce."""
+    nonce = body.get(self.const.BASE_CT.dAuth.DAUTH_NONCE)
+    if not isinstance(nonce, str) or not nonce:
+      raise ValueError("dAuth request nonce is required.")
+    try:
+      request_time = int(nonce, 16) / 1000
+    except (TypeError, ValueError) as exc:
+      raise ValueError("dAuth request nonce is invalid.") from exc
+
+    request_age = self.time() - request_time
+    if request_age < 0:
+      raise ValueError("dAuth request nonce is from the future.")
+    if request_age > DAUTH_SECRET_REQUEST_MAX_AGE_SECONDS:
+      raise ValueError("dAuth request nonce is expired.")
+    return nonce
+
   def _normalize_dauth_job_id(self, job_id):
     if job_id in [None, ""]:
       raise ValueError("Job ID is required.")
@@ -262,6 +280,7 @@ def _is_node_running_dauth_job(self, job_id, node_address):
 
   def process_dauth_add_secrets_request(self, body):
     requester, requester_eth = self._verify_signed_dauth_body(body)
+    request_nonce = self._validate_dauth_secret_request_nonce(body)
     if not self._is_protocol_oracle_eth(requester_eth):
       raise ValueError(f"Sender {requester_eth} is not an oracle.")
 
@@ -272,10 +291,12 @@ def process_dauth_add_secrets_request(self, body):
     return {
       "status": "success",
       "job_id": job_id,
+      self.const.BASE_CT.dAuth.DAUTH_NONCE: request_nonce,
     }
 
   def process_dauth_get_secret_request(self, body):
     requester, _ = self._verify_signed_dauth_body(body)
+    request_nonce = self._validate_dauth_secret_request_nonce(body)
     job_id = self._normalize_dauth_job_id(body.get("job_id"))
 
     if not self._is_node_running_dauth_job(job_id, requester):
@@ -284,11 +305,18 @@ def process_dauth_get_secret_request(self, body):
     secret_bundle = self._load_dauth_job_secret_bundle(job_id)
     if not isinstance(secret_bundle, dict):
       raise ValueError(f"No dAuth secret bundle found for job {job_id}.")
+    encrypted_secret_bundle = self.bc.encrypt_str(
+      str_data=self.json_dumps(secret_bundle),
+      str_recipient=requester,
+    )
+    if not isinstance(encrypted_secret_bundle, str) or not encrypted_secret_bundle:
+      raise ValueError(f"Failed to encrypt dAuth secrets for job {job_id}.")
 
     return {
       "status": "success",
       "job_id": job_id,
-      "secret_bundle": secret_bundle,
+      self.const.BASE_CT.dAuth.DAUTH_NONCE: request_nonce,
+      "encrypted_secret_bundle": encrypted_secret_bundle,
     }
 
   def chainstore_store_dauth_request(

extensions/business/dauth/test_dauth_registry_gating.py

@@ -1,4 +1,5 @@
 from collections import deque
+import json
 import queue
 import threading
 import unittest
@@ -13,6 +14,8 @@
 
 
 ROOT = Path(__file__).resolve().parents[3]
+REQUEST_TIME = 1_700_000_000
+REQUEST_NONCE = hex(REQUEST_TIME * 1000)
 
 
 class _FakeProcess:
@@ -139,6 +142,7 @@ def _load_dauth_manager_class():
 
 
 class _FakeDauthConst:
+  DAUTH_NONCE = "nonce"
   DAUTH_ENV_KEYS_PREFIX = "EE_"
   DAUTH_WHITELIST = "DAUTH_WHITELIST"
 
@@ -170,6 +174,7 @@ def __init__(self, *, dauth_oracle=True, protocol_oracles=None, valid_signature=
     self.dauth_oracle = dauth_oracle
     self.protocol_oracles = protocol_oracles or ["node-oracle"]
     self.valid_signature = valid_signature
+    self.encrypt_calls = []
     self.node_eth = {
       "node-oracle": "0xORACLE",
       "node-runner": "0xRUNNER",
@@ -211,6 +216,10 @@ def maybe_add_prefix(self, node_address):
       return node_address
     return "0xai_" + node_address
 
+  def encrypt_str(self, str_data, str_recipient):
+    self.encrypt_calls.append((str_data, str_recipient))
+    return "encrypted-secret-bundle"
+
 
 class _FakeR1FS:
 
@@ -234,6 +243,8 @@ def _make_dauth_harness(*, dauth_oracle=True, protocol_oracles=None, valid_signa
     valid_signature=valid_signature,
   )
   plugin.deepcopy = deepcopy
+  plugin.json_dumps = json.dumps
+  plugin.time = lambda: REQUEST_TIME
   plugin._chainstore = {}
   plugin._r1fs_data = {}
   plugin.r1fs = _FakeR1FS(plugin._r1fs_data)
@@ -334,6 +345,30 @@ def test_dauth_token_fails_closed_when_dauth_registry_check_fails(self):
 
 class DauthJobSecretEndpointTests(unittest.TestCase):
 
+  def test_secret_request_nonce_accepts_only_last_120_seconds(self):
+    plugin = _make_dauth_harness()
+
+    self.assertEqual(
+      plugin._validate_dauth_secret_request_nonce({"nonce": REQUEST_NONCE}),
+      REQUEST_NONCE,
+    )
+    boundary_nonce = hex(int((REQUEST_TIME - 120) * 1000))
+    self.assertEqual(
+      plugin._validate_dauth_secret_request_nonce({"nonce": boundary_nonce}),
+      boundary_nonce,
+    )
+
+    invalid_nonces = (
+      ({}, "required"),
+      ({"nonce": "not-hex"}, "invalid"),
+      ({"nonce": hex(int((REQUEST_TIME + 1) * 1000))}, "future"),
+      ({"nonce": hex(int((REQUEST_TIME - 121) * 1000))}, "expired"),
+    )
+    for body, message in invalid_nonces:
+      with self.subTest(body=body):
+        with self.assertRaisesRegex(ValueError, message):
+          plugin._validate_dauth_secret_request_nonce(body)
+
   def test_add_secrets_allows_protocol_oracle_and_overwrites_bundle(self):
     plugin = _make_dauth_harness(protocol_oracles=["node-oracle"])
     plugin._chainstore[(DAUTH_JOB_SECRETS_CSTORE_HKEY, "7")] = {
@@ -343,6 +378,7 @@ def test_add_secrets_allows_protocol_oracle_and_overwrites_bundle(self):
     body = {
       "EE_SENDER": "node-oracle",
       "EE_ETH_SENDER": "0xORACLE",
+      "nonce": REQUEST_NONCE,
       "job_id": 7,
       "job_secrets": {
         "plugins": {
@@ -361,6 +397,7 @@ def test_add_secrets_allows_protocol_oracle_and_overwrites_bundle(self):
 
     self.assertEqual(response["status"], "success")
     self.assertEqual(response["job_id"], "7")
+    self.assertEqual(response["nonce"], REQUEST_NONCE)
     self.assertEqual(
       plugin._chainstore[(DAUTH_JOB_SECRETS_CSTORE_HKEY, "7")],
       {
@@ -374,6 +411,7 @@ def test_add_secrets_rejects_non_oracle_writer(self):
     body = {
       "EE_SENDER": "node-runner",
       "EE_ETH_SENDER": "0xRUNNER",
+      "nonce": REQUEST_NONCE,
       "job_id": "7",
       "job_secrets": {"plugins": {}},
     }
@@ -383,11 +421,27 @@ def test_add_secrets_rejects_non_oracle_writer(self):
 
     self.assertNotIn((DAUTH_JOB_SECRETS_CSTORE_HKEY, "7"), plugin._chainstore)
 
+  def test_add_secrets_rejects_expired_nonce_before_write(self):
+    plugin = _make_dauth_harness()
+    body = {
+      "EE_SENDER": "node-oracle",
+      "EE_ETH_SENDER": "0xORACLE",
+      "nonce": hex(int((REQUEST_TIME - 121) * 1000)),
+      "job_id": "7",
+      "job_secrets": {"plugins": {}},
+    }
+
+    with self.assertRaisesRegex(ValueError, "nonce is expired"):
+      plugin.process_dauth_add_secrets_request(body)
+
+    self.assertNotIn((DAUTH_JOB_SECRETS_CSTORE_HKEY, "7"), plugin._chainstore)
+
   def test_add_secrets_rejects_invalid_signature(self):
     plugin = _make_dauth_harness(valid_signature=False)
     body = {
       "EE_SENDER": "node-oracle",
       "EE_ETH_SENDER": "0xORACLE",
+      "nonce": REQUEST_NONCE,
       "job_id": "7",
       "job_secrets": {"plugins": {}},
     }
@@ -402,6 +456,7 @@ def test_add_secrets_rejects_legacy_plugin_secrets_shape(self):
     body = {
       "EE_SENDER": "node-oracle",
       "EE_ETH_SENDER": "0xORACLE",
+      "nonce": REQUEST_NONCE,
       "job_id": "7",
       "plugin_secrets": {"plugins": {}},
     }
@@ -437,14 +492,24 @@ def test_get_secrets_returns_bundle_for_node_running_job_from_r1fs_pipeline(self
     body = {
       "EE_SENDER": "node-runner",
       "EE_ETH_SENDER": "0xRUNNER",
+      "nonce": REQUEST_NONCE,
       "job_id": "7",
     }
 
     response = plugin.process_dauth_get_secret_request(body)
 
     self.assertEqual(response["status"], "success")
     self.assertEqual(response["job_id"], "7")
-    self.assertEqual(response["secret_bundle"], bundle)
+    self.assertEqual(response["nonce"], REQUEST_NONCE)
+    self.assertEqual(
+      response["encrypted_secret_bundle"],
+      "encrypted-secret-bundle",
+    )
+    self.assertNotIn("secret_bundle", response)
+    self.assertEqual(
+      plugin.bc.encrypt_calls,
+      [(json.dumps(bundle), "node-runner")],
+    )
 
   def test_get_secrets_rejects_node_not_running_job(self):
     plugin = _make_dauth_harness()
@@ -461,6 +526,7 @@ def test_get_secrets_rejects_node_not_running_job(self):
     body = {
       "EE_SENDER": "node-other",
       "EE_ETH_SENDER": "0xOTHER",
+      "nonce": REQUEST_NONCE,
       "job_id": "7",
     }
 
@@ -500,8 +566,28 @@ def is_dauth_oracle(self):
     plugin._init_request_tracking = lambda: None
     plugin.bc.address = "node-address"
     plugin.bc.eth_address = "0xNODE"
+    plugin._DauthManagerPlugin__get_response = lambda data: data
     return plugin
 
+  def test_secret_endpoint_errors_echo_request_nonce(self):
+    plugin = self._make_manager(dauth_oracle=True)
+    plugin._dauth_server_enabled = True
+    plugin.process_dauth_add_secrets_request = lambda body: (_ for _ in ()).throw(
+      ValueError("add failed")
+    )
+    plugin.process_dauth_get_secret_request = lambda body: (_ for _ in ()).throw(
+      ValueError("get failed")
+    )
+    body = {"nonce": REQUEST_NONCE}
+
+    add_response = plugin.add_secrets(body)
+    get_response = plugin.get_secrets(body)
+
+    self.assertEqual(add_response["nonce"], REQUEST_NONCE)
+    self.assertEqual(add_response["error"], "add failed")
+    self.assertEqual(get_response["nonce"], REQUEST_NONCE)
+    self.assertEqual(get_response["error"], "get failed")
+
   def test_startup_lookup_is_cached_across_repeated_lifecycle_predicates(self):
     plugin = self._make_manager(dauth_oracle=True)