Skip to content

Fix incident authorization and swap request signing - #1282

Merged
fejilaup-cloud merged 5 commits into
AtomicIP:mainfrom
Sundriveauto:fix/incident-and-swap-request-auth
Oct 21, 2026
Merged

fejilaup-cloud merged 5 commits into
AtomicIP:mainfrom
Sundriveauto:fix/incident-and-swap-request-auth

Conversation

@Sundriveauto

@Sundriveauto Sundriveauto commented Oct 17, 2026 •

Copy link
Copy Markdown
Contributor

Closes #1195
Closes #1196
Closes #1197
Closes #1198

Summary

  • Bind postmortem authors to the authenticated JWT subject, require incident-administration access, and prevent replacement submissions.
  • Authenticate Alertmanager webhooks and validate status and alert identity fields before updating incidents.
  • Remove duplicate unsigned legacy swap routes and enforce request signatures.
  • Apply signature verification to all versioned swap write routes, with regression coverage.

Commits

This PR contains four focused commits, one per reported issue.

Validation

  • git diff --check passed.
  • Rust tests and formatting checks could not run because cargo is not installed in this environment.

Sundriveauto and others added 4 commits October 17, 2026 18:59
Require authenticated access to incident administration, derive postmortem authors from the JWT subject, and reject replacement submissions.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Require a configured bearer token, validate Alertmanager statuses and alert identity fields before applying updates, and document the shared-secret wiring.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Remove duplicate unsigned swap registrations and apply request-signature middleware to batch initiation and cancel-expired routes. Preserve signed commit/transfer routes while resolving router construction.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Apply request-signature verification to initiate, batch and bulk initiation, and cancel-expired on the v1 router. Add regression coverage for unsigned requests and complete the rate-limiter state in test routers.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@drips-wave

drips-wave Bot commented Oct 18, 2026

Copy link
Copy Markdown

@Sundriveauto Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@fejilaup-cloud
fejilaup-cloud merged commit 527ac6c into AtomicIP:main Oct 21, 2026
0 of 3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

2 participants