WEB: Base Path: security + reload coverage fixes&tests

src/web/manager/credentials.rs

@@ -9,9 +9,7 @@ use super::state::{
     Bootstrap, CarrierChainPhase, allow_rate, evict_oldest_unused_bootstrap, matching_profile,
     new_unique_token, profile_key, remove_expired_locked,
 };
-use super::{
-    BootstrapResult, ManagerError, TOKEN_BYTES, TokenHash, TokenKind, WebProcessRuntime,
-};
+use super::{BootstrapResult, ManagerError, TOKEN_BYTES, TokenHash, TokenKind, WebProcessRuntime};
 use crate::config::WebRuntimeProfile;
 use crate::maestro::generation::RuntimeGeneration;
 use crate::web::session::{SessionCloseReason, WebSession};

src/web/manager/state.rs

@@ -7,9 +7,7 @@ use base64::Engine as _;
 use sha2::{Digest, Sha256};
 use zeroize::Zeroizing;
 
-use super::{
-    CarrierRequest, ProfileKey, TokenAuthenticator, TokenHash, TokenKind,
-};
+use super::{CarrierRequest, ProfileKey, TokenAuthenticator, TokenHash, TokenKind};
 use crate::config::{WebCarrier, WebRuntimeConfig, WebRuntimeProfile, WebTimeoutsConfig};
 use crate::maestro::generation::RuntimeGeneration;
 use crate::proxy::user_admission::UserSessionRegistration;

src/web/manager/token_authenticator_tests.rs

@@ -0,0 +1,30 @@
+use super::*;
+
+fn authenticator(key: u8) -> TokenAuthenticator {
+    TokenAuthenticator {
+        key: Zeroizing::new([key; 32]),
+    }
+}
+
+#[test]
+fn process_tokens_are_domain_separated_and_fail_closed_after_mutation() {
+    let issuer = authenticator(0x11);
+    let other_process = authenticator(0x22);
+    let nonce = [0x33; TOKEN_NONCE_BYTES];
+    let bootstrap = issuer.issue(TokenKind::Bootstrap, nonce);
+    let session = issuer.issue(TokenKind::Session, nonce);
+
+    assert_ne!(bootstrap, session);
+    assert!(issuer.authentic(&bootstrap));
+    assert!(issuer.authentic(&session));
+    assert!(!other_process.authentic(&bootstrap));
+    assert!(!other_process.authentic(&session));
+
+    for token in [bootstrap, session] {
+        for index in 0..TOKEN_BYTES {
+            let mut mutated = token;
+            mutated[index] ^= 1;
+            assert!(!issuer.authentic(&mutated), "mutation at byte {index}");
+        }
+    }
+}