* test: add failing tests for Discord signature validation and capabilities alias (Red phase)
TDD Red phase for #148. Adds 19 tests across 4 categories:
- Category 1: CredentialLocationSchema header_name alias (2 failing)
- Category 2: Ed25519 signature verification (3 failing)
- Category 3: Router signature key management (2 failing)
- Category 5: Discord capabilities public_key setup (1 failing)
All 8 failures are expected — stubs return false/None by design.
Implementation will follow in Green phase.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: add Discord Ed25519 signature verification and capabilities alias (#148)
Implement the Green phase for Discord channel security fixes:
- Add real Ed25519 signature verification in signature.rs using ed25519-dalek
- Add #[serde(alias = "header_name")] to CredentialLocationSchema::Header
for backward compatibility with external JSON files
- Add signature_keys storage to WasmChannelRouter (register/get/unregister)
- Add discord_public_key to discord.capabilities.json setup.required_secrets
- Add nested capabilities resolution to CapabilitiesFile for channel-level
JSON compatibility
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* style: address PR #372 review comments
- Fix invalid hex character in test fake_pub_key (router.rs)
- Simplify signature parsing with from_slice/try_from (signature.rs)
- Use idiomatic Option::or for nested capability merging (capabilities_schema.rs)
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: enforce signature verification, staleness check, key validation, recursive resolve
Address PR #372 review feedback:
- Wire verify_discord_signature() into webhook_handler with Ed25519
signature + timestamp staleness check (5s window via now_secs param)
- Validate Ed25519 keys in register_signature_key() (hex decode +
VerifyingKey::try_from) before storing, return Result<(), String>
- Recursively resolve nested capabilities in resolve_nested()
- Add 25 new tests: 8 staleness, 6 key validation, 7 webhook
integration (tower::oneshot), 4 resolve_nested edge cases
- Fix pre-existing clippy warning in signal.rs
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: wire register_signature_key() into all channel loading paths
The Ed25519 signature key registration was implemented and tested but
never called from production code. All three channel loading paths
(setup_wasm_channels, activate_wasm_channel, refresh_active_channel)
now read the public key from the secrets store and register it with
the webhook router, enabling Discord signature verification.
Adds `signature_key_secret_name` field to WebhookSchema so channels
can declare which secret contains their Ed25519 public key.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
