fix(security): enforce signature verification for Kafka, MongoDB, and Redis proxy actions

[blue4209211]

Description

This PR fixes an authorization and signature verification bypass vulnerability in pkg/ws/handler.go where proxy actions across Kafka, MongoDB, and Redis were missing from signedActions, allowing unauthenticated / unsigned messages from the WebSocket relay to be dispatched without cryptographic signature verification.

Key Changes

1. Registered 21 Missing Proxy Actions in signedActions:
   • Kafka: kafka_consumer_lag, kafka_consumer_groups, kafka_consumer_group_describe, kafka_topics, kafka_topic_describe, kafka_brokers, kafka_topic_offsets
   • MongoDB: mongo_server_status, mongo_repl_status, mongo_collection_stats, mongo_current_ops, mongo_db_stats, mongo_list_databases, mongo_list_collections
   • Redis: redis_info, redis_info_section, redis_slowlog, redis_client_list, redis_memory_stats, redis_cluster_info, redis_keyspace_stats
2. Fail-Secure Signature Enforcement:
   • Updated HandleMessage in pkg/ws/handler.go to enforce verification whenever signing is enabled (h.verifier.Enabled()), ensuring unknown or unlisted actions cannot fail open.
3. Comprehensive Unit & Wire Tests:
   • Added unit test suite in pkg/ws/handler_test.go (TestHandler_SignatureEnforcement) verifying rejection (HTTP 403) for unsigned messages and acceptance (HTTP 200) for validly signed messages across Kafka, MongoDB, and Redis.
   • Updated pkg/ws/discovery_wire_test.go (TestActionsThatTouchRemoteSystemsAreSigned) to assert that all actions require signatures.
4. Security Journal Entry:
   • Recorded vulnerability analysis, root cause, and defense-in-depth prevention in .jules/sentinel.md.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Enhancement (non-breaking change which improves existing functionality)
• Refactor (non-breaking change which improves code structure)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation
• CI/CD

How Has This Been Tested?

• Unit tests
• Manual testing

Checklist

• CLA signed (the CLA bot will prompt on your first PR)
• make validate passes (fmt + lint + test)
• Docs updated if the wire shape, config surface, or proxy module behavior changed

[gemini-code-assist]

Code Review

This pull request introduces performance optimizations and security enhancements across the proxy and WebSocket handler. Specifically, it replaces a static map literal with a switch statement in osFamily to achieve zero-allocation lookups, optimizes signature line parsing in ParseAndVerify, and significantly expands the signedActions map to enforce signature verification across 21 previously omitted Kafka, MongoDB, and Redis proxy actions. Additionally, signature verification is now enforced globally when enabled as a defense-in-depth measure. Feedback on the changes focuses on improving test robustness in pkg/ws/handler_test.go by explicitly checking errors returned from secrets.NewCloudPushStore and json.Unmarshal instead of ignoring them.

[blue4209211]

/gemini review

[gemini-code-assist]

Code Review

This pull request addresses a security vulnerability by registering 21 previously omitted proxy actions across Kafka, MongoDB, and Redis in the signedActions map to enforce complete cryptographic signature verification. It also updates the message handler to enforce signature verification for all actions whenever the verifier is enabled as a defense-in-depth measure, backed by comprehensive unit tests. The review feedback suggests adding a nil check for h.verifier before calling its methods to prevent potential nil pointer dereference panics.

[blue4209211]

/gemini review

[gemini-code-assist]

Code Review

This pull request enforces complete signature verification on WebSocket proxy actions by explicitly registering 21 previously omitted actions across Kafka, MongoDB, and Redis in the signedActions map. It also updates the verification logic in HandleMessage to enforce signature checks whenever verification is enabled, improves error handling in tests, and adds comprehensive test coverage for signature enforcement. No review comments were provided, so there is no additional feedback.