distributed 1.7.2

CQRS/ES framework for Rust using Plain Old Rust Structs — append-only events, replay, snapshots, outbox, service bus, and pluggable infrastructure
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

### What's changed in v1.7.2

* fix: trust gRPC metadata over payload session vars; mask internal errors (#79) (by @patrickleet)

  The gRPC transport let the request payload `session_variables` override
  transport metadata when building the `Session`. Behind a trusted gateway
  that injects authenticated identity headers as gRPC metadata, a client
  could spoof identity by putting `x-hasura-user-id` / `x-hasura-role` in
  the request body (e.g. claim role `admin` or impersonate another user) —
  the payload silently won. This is an identity-spoofing hole.

  Trust model (now documented loudly on `Session`, the HTTP/gRPC entry
  points, and the README "Security / Trust Boundary" section): the
  framework does NOT authenticate. A trusted proxy must strip
  client-supplied `x-hasura-*` headers and inject only authenticated ones.
  Transport metadata/headers are trusted; the request payload is not.

  Changes:
  - gRPC `build_session`: apply payload vars first, then let trusted
    metadata overwrite colliding keys. Metadata now wins. Payload-only
    keys still pass through (preserves the Hasura-action path where
    verified claims arrive in the payload with no metadata injected).
  - gRPC errors: route the response body through a shared
    `HandlerError::client_facing_message()`, masking internal (5xx)
    detail to "Internal server error" and logging the original
    server-side. Previously gRPC returned raw `e.to_string()`, which
    could leak SQL/driver detail — HTTP already masked. The masking
    policy now lives in one place (error.rs) and both transports reuse
    it (no duplicated logic).
  - Docs: rustdoc trust-boundary notes on `Session`,
    `session_from_headers`, and `build_session`; README HTTP/gRPC
    transport notes plus a dedicated "Security / Trust Boundary" section.
  - Tests: gRPC metadata-wins-over-payload (anti-spoof) and
    payload-applies-when-metadata-absent; HTTP client-supplied identity
    header trusted verbatim (documents why the proxy is required).

  Implements [[tasks/grpc-session-metadata-precedence]]
  Also covers the gRPC error-masking item from
  [[tasks/transport-ingress-security-hardening]]

  Co-authored-by: Claude Fable 5 <noreply@anthropic.com>


See full diff: [v1.7.1...v1.7.2](https://github.com/hops-ops/distributed/compare/v1.7.1...v1.7.2)