Verify that the request is from a gateway with the same app_id (mTLS verification)
(state: &Proxy, cert: Option<Certificate<'_>>)
| 72 | |
| 73 | /// Verify that the request is from a gateway with the same app_id (mTLS verification) |
| 74 | fn verify_gateway_peer(state: &Proxy, cert: Option<Certificate<'_>>) -> Result<(), Status> { |
| 75 | // Skip verification if not running in dstack (test mode) |
| 76 | if state.config.debug.insecure_skip_attestation { |
| 77 | return Ok(()); |
| 78 | } |
| 79 | |
| 80 | let Some(cert) = cert else { |
| 81 | warn!("WaveKV sync: client certificate required but not provided"); |
| 82 | return Err(Status::Unauthorized); |
| 83 | }; |
| 84 | |
| 85 | let remote_app_id = RocketCert(&cert).get_app_id().map_err(|e| { |
| 86 | warn!("WaveKV sync: failed to extract app_id from certificate: {e}"); |
| 87 | Status::Unauthorized |
| 88 | })?; |
| 89 | |
| 90 | let Some(remote_app_id) = remote_app_id else { |
| 91 | warn!("WaveKV sync: certificate does not contain app_id"); |
| 92 | return Err(Status::Unauthorized); |
| 93 | }; |
| 94 | |
| 95 | if state.my_app_id() != Some(remote_app_id.as_slice()) { |
| 96 | warn!( |
| 97 | "WaveKV sync: app_id mismatch, expected {:?}, got {:?}", |
| 98 | state.my_app_id(), |
| 99 | remote_app_id |
| 100 | ); |
| 101 | return Err(Status::Forbidden); |
| 102 | } |
| 103 | |
| 104 | Ok(()) |
| 105 | } |
| 106 | |
| 107 | /// Handle sync request (msgpack + gzip encoded) |
| 108 | #[post("/wavekv/sync/<store>", data = "<data>")] |
no test coverage detected