iggy_binary_protocol 0.11.1-edge.2

// Licensed to the Apache Software Foundation (ASF) under one
// or more contributor license agreements.  See the NOTICE file
// distributed with this work for additional information
// regarding copyright ownership.  The ASF licenses this file
// to you under the Apache License, Version 2.0 (the
// "License"); you may not use this file except in compliance
// with the License.  You may obtain a copy of the License at
//
//   http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing,
// software distributed under the License is distributed on an
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
// KIND, either express or implied.  See the License for the
// specific language governing permissions and limitations
// under the License.

use crate::WireError;
use crate::codec::{
    WireDecode, WireEncode, read_bytes, read_str, read_u8, read_u32_le, read_u64_le,
};
use crate::primitives::identifier::WireName;
use crate::version::ClientVersionInfo;
use bytes::{BufMut, BytesMut};
use secrecy::{ExposeSecret, SecretBox, SecretString};

pub const BIND_SECRET_BYTES: usize = 32;
pub const REGISTER_REQUEST_BYTES: usize = BIND_SECRET_BYTES + size_of::<u64>();

/// Server-verified account identity and binding proof replicated by Register.
/// The timestamp prevents a delayed login from registering a reused user ID.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct RegisterRequest {
    pub user_created_at: u64,
    pub bind_verifier: [u8; BIND_SECRET_BYTES],
}

impl WireEncode for RegisterRequest {
    fn encoded_size(&self) -> usize {
        REGISTER_REQUEST_BYTES
    }

    fn encode(&self, buf: &mut BytesMut) {
        buf.put_u64_le(self.user_created_at);
        buf.put_slice(&self.bind_verifier);
    }
}

impl WireDecode for RegisterRequest {
    fn decode(buf: &[u8]) -> Result<(Self, usize), WireError> {
        let user_created_at = read_u64_le(buf, 0)?;
        let mut bind_verifier = [0; BIND_SECRET_BYTES];
        bind_verifier.copy_from_slice(read_bytes(buf, size_of::<u64>(), BIND_SECRET_BYTES)?);
        Ok((
            Self {
                user_created_at,
                bind_verifier,
            },
            REGISTER_REQUEST_BYTES,
        ))
    }
}

/// A connection-binding credential retained for one logical session.
#[derive(Debug)]
pub struct BindSecret(SecretBox<[u8; BIND_SECRET_BYTES]>);

impl BindSecret {
    #[must_use]
    pub fn new(secret: Box<[u8; BIND_SECRET_BYTES]>) -> Self {
        Self(SecretBox::new(secret))
    }
}

impl WireDecode for BindSecret {
    fn decode(buf: &[u8]) -> Result<(Self, usize), WireError> {
        let mut secret = Box::new([0; BIND_SECRET_BYTES]);
        secret.copy_from_slice(read_bytes(buf, 0, BIND_SECRET_BYTES)?);
        Ok((Self::new(secret), BIND_SECRET_BYTES))
    }
}

impl Clone for BindSecret {
    fn clone(&self) -> Self {
        Self::new(Box::new(*self.expose_secret()))
    }
}

impl ExposeSecret<[u8; BIND_SECRET_BYTES]> for BindSecret {
    fn expose_secret(&self) -> &[u8; BIND_SECRET_BYTES] {
        self.0.expose_secret()
    }
}

/// Combined login + register request for the server.
///
/// The server gates on `version_info.protocol_version` (see
/// [`crate::version::is_protocol_compatible`]), verifies credentials
/// locally, then submits `Operation::Register` through consensus. The
/// response carries `user_id` + `session` (commit op number) plus the
/// server's own protocol version and build version. The `client_id` is
/// carried in the VSR `RequestHeader.client` field (populated by the SDK
/// at encode time); the body no longer duplicates it.
///
/// Wire format:
/// ```text
/// [ClientVersionInfo]
/// [bind_secret:32]
/// [username_len:u8][username:N][password_len:u8][password:N]
/// [context_len:u32_le][context:N?]
/// ```
///
/// `ClientVersionInfo` is encoded first so the server can always parse the
/// version prefix and reject incompatible clients (with an
/// `EvictionReason::IncompatibleProtocol` frame carrying the accepted
/// range) before touching the rest of the body.
///
/// # Cross-version compatibility
///
/// This wire shape is gated by the `vsr` cargo feature and lives under
/// `LOGIN_REGISTER_CODE`. The legacy `LOGIN_USER_CODE` shape (still in use
/// by non-`vsr` builds against the legacy `iggy-server`) is untouched.
/// The server speaks VSR framing only; a non-`vsr` SDK cannot log in to
/// the server. Foreign-language SDKs (C++, C#, Python, Go, Java) adopt this
/// shape, with their own `sdk_name`, when they wire VSR framing. Maintain
/// [`crate::version::IGGY_PROTOCOL_VERSION`] and its minimum for stable
/// releases according to [`crate::version`]. Intermediate edge builds may
/// share a protocol number without compatible layouts.
#[derive(Debug, Clone)]
pub struct LoginRegisterRequest {
    pub version_info: ClientVersionInfo,
    pub bind_secret: BindSecret,
    pub username: WireName,
    pub password: SecretString,
    pub client_context: Option<String>,
}

impl WireEncode for LoginRegisterRequest {
    fn encoded_size(&self) -> usize {
        self.version_info.encoded_size()
            + BIND_SECRET_BYTES
            + self.username.encoded_size()
            + 1
            + self.password.expose_secret().len()
            + 4
            + self.client_context.as_ref().map_or(0, String::len)
    }

    fn encode(&self, buf: &mut BytesMut) {
        self.version_info.encode(buf);
        buf.put_slice(self.bind_secret.expose_secret());
        self.username.encode(buf);
        let password = self.password.expose_secret();
        debug_assert!(
            u8::try_from(password.len()).is_ok(),
            "password exceeds u8 length prefix; callers must validate before encoding"
        );
        #[allow(clippy::cast_possible_truncation)]
        buf.put_u8(password.len() as u8);
        buf.put_slice(password.as_bytes());
        match &self.client_context {
            Some(c) => {
                #[allow(clippy::cast_possible_truncation)]
                buf.put_u32_le(c.len() as u32);
                buf.put_slice(c.as_bytes());
            }
            None => buf.put_u32_le(0),
        }
    }
}

impl LoginRegisterRequest {
    /// Decode the body after the [`ClientVersionInfo`] prefix has already
    /// been consumed; the server-side login gate decodes the prefix once
    /// for both login-register shapes. Returns the bytes consumed from
    /// `tail`.
    ///
    /// # Errors
    /// [`WireError`] when `tail` is truncated or a field is malformed.
    pub fn decode_after_prefix(
        version_info: ClientVersionInfo,
        tail: &[u8],
    ) -> Result<(Self, usize), WireError> {
        let (bind_secret, _) = BindSecret::decode(tail)?;
        let (username, name_len) = WireName::decode(&tail[BIND_SECRET_BYTES..])?;
        let mut pos = BIND_SECRET_BYTES + name_len;

        let password_len = read_u8(tail, pos)? as usize;
        pos += 1;
        let password = SecretString::from(read_str(tail, pos, password_len)?);
        pos += password_len;

        let client_context_len = read_u32_le(tail, pos)? as usize;
        pos += 4;
        let client_context = if client_context_len > 0 {
            let c = read_str(tail, pos, client_context_len)?;
            pos += client_context_len;
            Some(c)
        } else {
            None
        };

        Ok((
            Self {
                version_info,
                bind_secret,
                username,
                password,
                client_context,
            },
            pos,
        ))
    }
}

impl WireDecode for LoginRegisterRequest {
    fn decode(buf: &[u8]) -> Result<(Self, usize), WireError> {
        let (version_info, prefix_len) = ClientVersionInfo::decode(buf)?;
        let (request, body_len) = Self::decode_after_prefix(version_info, &buf[prefix_len..])?;
        Ok((request, prefix_len + body_len))
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn register_preserves_account_identity_and_rejects_truncated_bodies() {
        let request = RegisterRequest {
            user_created_at: 0x0102_0304_0506_0708,
            bind_verifier: [0x5a; BIND_SECRET_BYTES],
        };
        let bytes = request.to_bytes();
        assert_eq!(bytes.len(), REGISTER_REQUEST_BYTES);
        assert_eq!(
            &bytes[..size_of::<u64>()],
            &request.user_created_at.to_le_bytes()
        );
        assert_eq!(&bytes[size_of::<u64>()..], &request.bind_verifier);
        assert_eq!(RegisterRequest::decode_from(&bytes).unwrap(), request);
        for length in 0..bytes.len() {
            assert!(RegisterRequest::decode_from(&bytes[..length]).is_err());
        }
    }

    fn version_info() -> ClientVersionInfo {
        ClientVersionInfo {
            protocol_version: 1,
            sdk_name: WireName::new("rust-sdk").unwrap(),
            sdk_version: WireName::new("1.0.0").unwrap(),
        }
    }

    fn assert_req_eq(a: &LoginRegisterRequest, b: &LoginRegisterRequest) {
        assert_eq!(a.version_info, b.version_info);
        assert_eq!(a.bind_secret.expose_secret(), b.bind_secret.expose_secret());
        assert_eq!(a.username, b.username);
        assert_eq!(a.password.expose_secret(), b.password.expose_secret());
        assert_eq!(a.client_context, b.client_context);
    }

    #[test]
    fn roundtrip_full() {
        let req = LoginRegisterRequest {
            version_info: version_info(),
            bind_secret: BindSecret::new(Box::new([0x5a; BIND_SECRET_BYTES])),
            username: WireName::new("admin").unwrap(),
            password: SecretString::from("secret"),
            client_context: Some("rust-sdk".to_string()),
        };
        let bytes = req.to_bytes();
        let (decoded, consumed) = LoginRegisterRequest::decode(&bytes).unwrap();
        assert_eq!(consumed, bytes.len());
        assert_req_eq(&decoded, &req);
    }

    #[test]
    fn roundtrip_no_context() {
        let req = LoginRegisterRequest {
            version_info: version_info(),
            bind_secret: BindSecret::new(Box::new([0x5a; BIND_SECRET_BYTES])),
            username: WireName::new("user").unwrap(),
            password: SecretString::from("pass"),
            client_context: None,
        };
        let bytes = req.to_bytes();
        let (decoded, consumed) = LoginRegisterRequest::decode(&bytes).unwrap();
        assert_eq!(consumed, bytes.len());
        assert_req_eq(&decoded, &req);
    }

    #[test]
    fn encoded_size_matches_output() {
        let req = LoginRegisterRequest {
            version_info: version_info(),
            bind_secret: BindSecret::new(Box::new([0x5a; BIND_SECRET_BYTES])),
            username: WireName::new("admin").unwrap(),
            password: SecretString::from("p"),
            client_context: Some("ctx".to_string()),
        };
        assert_eq!(req.encoded_size(), req.to_bytes().len());
    }

    #[test]
    fn truncated_returns_error() {
        let req = LoginRegisterRequest {
            version_info: version_info(),
            bind_secret: BindSecret::new(Box::new([0x5a; BIND_SECRET_BYTES])),
            username: WireName::new("u").unwrap(),
            password: SecretString::from("p"),
            client_context: Some("c".to_string()),
        };
        let bytes = req.to_bytes();
        for i in 0..bytes.len() {
            assert!(
                LoginRegisterRequest::decode(&bytes[..i]).is_err(),
                "expected error for truncation at byte {i}"
            );
        }
    }

    #[test]
    fn wire_layout_version_info_first() {
        let req = LoginRegisterRequest {
            version_info: version_info(),
            bind_secret: BindSecret::new(Box::new([0x5a; BIND_SECRET_BYTES])),
            username: WireName::new("u").unwrap(),
            password: SecretString::from("p"),
            client_context: None,
        };
        let bytes = req.to_bytes();
        // protocol_version u32 LE, then sdk_name [8, b"rust-sdk"].
        assert_eq!(u32::from_le_bytes(bytes[..4].try_into().unwrap()), 1);
        assert_eq!(bytes[4], 8);
        assert_eq!(&bytes[5..13], b"rust-sdk");
        // The version prefix alone must decode even when the rest is garbage.
        let prefix_len = req.version_info.encoded_size();
        let (prefix, consumed) = ClientVersionInfo::decode(&bytes).unwrap();
        assert_eq!(consumed, prefix_len);
        assert_eq!(prefix, req.version_info);
    }
}