fix(identity): derive the enrollment ID of a boolpolicy identity from its members

A policy identity's AuditInfo always reported an empty enrollment ID, so
policy-owned inputs and outputs reach the auditor with no enrollment
attribution and downstream eid-keyed accounting misbooks them.

Resolve each component's audit info through the parent multiplex
deserializer (same recursive pattern as htlc.NewAuditDeserializer) and
report the enrollment ID shared by all components. A component with no
enrollment ID of its own (e.g. a nested composite spanning enrollments)
or disagreeing components yield the legacy empty value. Malformed audit
info -- an unresolvable component or a component count mismatch -- is an
error rather than a silent empty value, and every component is resolved
before the result is declared so later corruption is never masked.

Add a fuzz target for the new recursive deserialization path and wire it
into the nightly fuzz workflow.

Signed-off-by: Evan <evanyan@sign.global>

Author: EvanYan1024

.github/workflows/nightly-fuzz.yml

@@ -60,6 +60,9 @@ jobs:
           - name: identity-idemixnym-audit-info-deserializer
             pkg: ./token/services/identity/idemixnym/nym
             func: FuzzDeserializeAuditInfoNoPanic
+          - name: identity-boolpolicy-audit-info-deserializer
+            pkg: ./token/services/identity/boolpolicy
+            func: FuzzDeserializeAuditInfoNoPanic
           - name: common-request-limits
             pkg: ./token/core/common
             func: FuzzRequestResourceLimits

docs/services/identity.md

@@ -325,6 +325,7 @@ Located in `token/services/identity/boolpolicy`.
     - `identities` (SEQUENCE OF OCTET STRING): ordered list of raw component identity bytes; `$N` indexes into this list.
 *   **Audit Info**: JSON-encoded `AuditInfo` structure.
     - `IdentityAuditInfos` (array of `IdentityAuditInfo`): per-component audit info blobs in the same order as `identities`.
+*   **Enrollment ID**: When the audit-info deserializer is built with the parent multiplex deserializer (`NewAuditInfoDeserializer`), the policy identity reports the enrollment ID shared by all component identities. Components with no enrollment ID of their own (e.g. a nested composite spanning enrollments) or disagreeing components yield an empty enrollment ID; an unresolvable component or a component count mismatch is an error.
 *   **Encoding**:
     - `TypedIdentity` payload: ASN.1 DER.
     - Audit Info: JSON.

token/core/fabtoken/v1/driver/deserializer.go

@@ -52,7 +52,7 @@ func NewEIDRHDeserializer() *EIDRHDeserializer {
 	d.AddDeserializer(x509.IdentityType, &x509.AuditInfoDeserializer{})
 	d.AddDeserializer(htlc2.ScriptType, htlc.NewAuditDeserializer(d))
 	d.AddDeserializer(multisig.Multisig, &multisig.AuditInfoDeserializer{})
-	d.AddDeserializer(boolpolicy.Policy, &boolpolicy.AuditInfoDeserializer{})
+	d.AddDeserializer(boolpolicy.Policy, boolpolicy.NewAuditInfoDeserializer(d))
 
 	return d
 }

token/core/zkatdlog/nogh/v1/driver/deserializer.go

@@ -94,7 +94,7 @@ func NewEIDRHDeserializer() *EIDRHDeserializer {
 	d.AddDeserializer(x509.IdentityType, &x509.AuditInfoDeserializer{})
 	d.AddDeserializer(htlc2.ScriptType, htlc.NewAuditDeserializer(d))
 	d.AddDeserializer(multisig.Multisig, &multisig.AuditInfoDeserializer{})
-	d.AddDeserializer(boolpolicy.Policy, &boolpolicy.AuditInfoDeserializer{})
+	d.AddDeserializer(boolpolicy.Policy, boolpolicy.NewAuditInfoDeserializer(d))
 
 	return d
 }

token/services/identity/boolpolicy/audit_fuzz_test.go

@@ -0,0 +1,77 @@
+/*
+Copyright IBM Corp. All Rights Reserved.
+
+SPDX-License-Identifier: Apache-2.0
+*/
+
+package boolpolicy
+
+import (
+	"testing"
+
+	"github.com/LFDT-Panurus/panurus/token/services/identity"
+	"github.com/LFDT-Panurus/panurus/token/services/identity/x509"
+	"github.com/stretchr/testify/require"
+)
+
+// fuzzMember returns a typed x509 member identity and its audit info bytes.
+func fuzzMember(f *testing.F, name, eid string) ([]byte, []byte) {
+	f.Helper()
+	member, err := identity.WrapWithType(x509.IdentityType, []byte(name))
+	require.NoError(f, err)
+	auditInfo, err := (&x509.AuditInfo{EID: eid, RH: []byte("rh-" + eid)}).Bytes()
+	require.NoError(f, err)
+
+	return member, auditInfo
+}
+
+// fuzzPolicy wraps members into a policy identity (inner DER and typed
+// envelope) and the matching composite audit info blob.
+func fuzzPolicy(f *testing.F, policy string, members, auditInfos [][]byte) (inner, envelope, wrapped []byte) {
+	f.Helper()
+	inner, err := (&PolicyIdentity{Policy: policy, Identities: members}).Serialize()
+	require.NoError(f, err)
+	envelope, err = identity.WrapWithType(Policy, inner)
+	require.NoError(f, err)
+	wrapped, err = WrapAuditInfo(auditInfos)
+	require.NoError(f, err)
+
+	return inner, envelope, wrapped
+}
+
+func FuzzDeserializeAuditInfoNoPanic(f *testing.F) {
+	m0, ai0 := fuzzMember(f, "cert-zero", "wallet-42")
+	m1, ai1 := fuzzMember(f, "cert-one", "wallet-43")
+
+	// valid single- and two-member policies, both identity encodings
+	inner1, envelope1, wrapped1 := fuzzPolicy(f, "$0", [][]byte{m0}, [][]byte{ai0})
+	f.Add(inner1, wrapped1)
+	f.Add(envelope1, wrapped1)
+	inner2, _, wrapped2 := fuzzPolicy(f, "$0 OR $1", [][]byte{m0, m1}, [][]byte{ai0, ai1})
+	f.Add(inner2, wrapped2)
+	// empty and truncated inputs
+	f.Add([]byte{}, []byte{})
+	f.Add(inner2[:len(inner2)/2], wrapped2[:len(wrapped2)/2])
+	f.Add(inner2, []byte(`{"IdentityAuditInfos":`))
+	// member count mismatch
+	innerMismatch, _, wrappedOne := fuzzPolicy(f, "$0 OR $1", [][]byte{m0, m1}, [][]byte{ai0})
+	f.Add(innerMismatch, wrappedOne)
+	// unknown member identity type
+	unknown, err := identity.WrapWithType(identity.Type(99), []byte("cert-x"))
+	require.NoError(f, err)
+	innerUnknown, _, wrappedUnknown := fuzzPolicy(f, "$0", [][]byte{unknown}, [][]byte{ai0})
+	f.Add(innerUnknown, wrappedUnknown)
+	// nested and deeply nested policies
+	nestedID, nestedInfo := m0, ai0
+	for range 5 {
+		_, nestedID, nestedInfo = fuzzPolicy(f, "$0", [][]byte{nestedID}, [][]byte{nestedInfo})
+	}
+	innerDeep, _, wrappedDeep := fuzzPolicy(f, "$0", [][]byte{nestedID}, [][]byte{nestedInfo})
+	f.Add(innerDeep, wrappedDeep)
+
+	f.Fuzz(func(t *testing.T, rawID, rawInfo []byte) {
+		require.NotPanics(t, func() {
+			_, _ = NewAuditInfoDeserializer(newEIDRHDeserializer()).DeserializeAuditInfo(t.Context(), rawID, rawInfo)
+		})
+	})
+}

token/services/identity/boolpolicy/audit_test.go

@@ -0,0 +1,188 @@
+/*
+Copyright IBM Corp. All Rights Reserved.
+
+SPDX-License-Identifier: Apache-2.0
+*/
+
+package boolpolicy
+
+import (
+	"testing"
+
+	"github.com/LFDT-Panurus/panurus/token"
+	"github.com/LFDT-Panurus/panurus/token/services/identity"
+	"github.com/LFDT-Panurus/panurus/token/services/identity/deserializer"
+	"github.com/LFDT-Panurus/panurus/token/services/identity/x509"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// newX509Member returns a typed x509 member identity and its audit info bytes.
+func newX509Member(t *testing.T, name, eid string) ([]byte, []byte) {
+	t.Helper()
+	member, err := identity.WrapWithType(x509.IdentityType, []byte(name))
+	require.NoError(t, err)
+	auditInfo, err := (&x509.AuditInfo{EID: eid, RH: []byte("rh-" + eid)}).Bytes()
+	require.NoError(t, err)
+
+	return member, auditInfo
+}
+
+// newPolicyIdentity wraps the members into a typed policy identity and the
+// matching composite audit info blob.
+func newPolicyIdentity(t *testing.T, policy string, members [][]byte, auditInfos [][]byte) (token.Identity, []byte) {
+	t.Helper()
+	inner, err := (&PolicyIdentity{Policy: policy, Identities: members}).Serialize()
+	require.NoError(t, err)
+	policyID, err := identity.WrapWithType(Policy, inner)
+	require.NoError(t, err)
+	wrapped, err := WrapAuditInfo(auditInfos)
+	require.NoError(t, err)
+
+	return policyID, wrapped
+}
+
+// newEIDRHDeserializer mirrors the driver wiring: x509 plus a recursive
+// boolpolicy audit-info deserializer.
+func newEIDRHDeserializer() *deserializer.EIDRHDeserializer {
+	d := deserializer.NewEIDRHDeserializer()
+	d.AddDeserializer(x509.IdentityType, &x509.AuditInfoDeserializer{})
+	d.AddDeserializer(Policy, NewAuditInfoDeserializer(d))
+
+	return d
+}
+
+func TestPolicyEnrollmentIDCommonMembers(t *testing.T) {
+	m0, ai0 := newX509Member(t, "cert-zero", "wallet-42")
+	m1, ai1 := newX509Member(t, "cert-one", "wallet-42")
+	policyID, wrapped := newPolicyIdentity(t, "$0 OR $1", [][]byte{m0, m1}, [][]byte{ai0, ai1})
+
+	eid, rh, err := newEIDRHDeserializer().GetEIDAndRH(t.Context(), policyID, wrapped)
+	require.NoError(t, err)
+	assert.Equal(t, "wallet-42", eid)
+	assert.Empty(t, rh)
+}
+
+func TestPolicyEnrollmentIDSingleMember(t *testing.T) {
+	m0, ai0 := newX509Member(t, "cert-zero", "wallet-7")
+	policyID, wrapped := newPolicyIdentity(t, "$0", [][]byte{m0}, [][]byte{ai0})
+
+	eid, _, err := newEIDRHDeserializer().GetEIDAndRH(t.Context(), policyID, wrapped)
+	require.NoError(t, err)
+	assert.Equal(t, "wallet-7", eid)
+}
+
+func TestPolicyEnrollmentIDConflictingMembers(t *testing.T) {
+	m0, ai0 := newX509Member(t, "cert-zero", "wallet-42")
+	m1, ai1 := newX509Member(t, "cert-one", "wallet-43")
+	policyID, wrapped := newPolicyIdentity(t, "$0 OR $1", [][]byte{m0, m1}, [][]byte{ai0, ai1})
+
+	eid, _, err := newEIDRHDeserializer().GetEIDAndRH(t.Context(), policyID, wrapped)
+	require.NoError(t, err)
+	assert.Empty(t, eid)
+}
+
+func TestPolicyEnrollmentIDEmptyMemberEID(t *testing.T) {
+	// a member with no enrollment ID of its own: no common EID, not an error
+	// (a nested composite spanning enrollments reports the same way)
+	m0, ai0 := newX509Member(t, "cert-zero", "")
+	policyID, wrapped := newPolicyIdentity(t, "$0", [][]byte{m0}, [][]byte{ai0})
+
+	eid, _, err := newEIDRHDeserializer().GetEIDAndRH(t.Context(), policyID, wrapped)
+	require.NoError(t, err)
+	assert.Empty(t, eid)
+}
+
+func TestPolicyEnrollmentIDNestedPolicy(t *testing.T) {
+	// a member may itself be a policy identity, resolved recursively through
+	// the parent multiplex deserializer
+	cases := []struct {
+		name     string
+		innerEID [2]string
+		want     string
+	}{
+		{"inner members share an enrollment", [2]string{"wallet-42", "wallet-42"}, "wallet-42"},
+		{"inner members span enrollments", [2]string{"wallet-42", "wallet-43"}, ""},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			m0, ai0 := newX509Member(t, "cert-zero", tc.innerEID[0])
+			m1, ai1 := newX509Member(t, "cert-one", tc.innerEID[1])
+			innerID, innerInfo := newPolicyIdentity(t, "$0 OR $1", [][]byte{m0, m1}, [][]byte{ai0, ai1})
+			outerID, wrapped := newPolicyIdentity(t, "$0", [][]byte{innerID}, [][]byte{innerInfo})
+
+			eid, _, err := newEIDRHDeserializer().GetEIDAndRH(t.Context(), outerID, wrapped)
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, eid)
+		})
+	}
+}
+
+func TestPolicyEnrollmentIDUnresolvableMember(t *testing.T) {
+	// malformed: member typed with an identity type that has no registered
+	// deserializer
+	m0, err := identity.WrapWithType(identity.Type(99), []byte("cert-zero"))
+	require.NoError(t, err)
+	ai0, err := (&x509.AuditInfo{EID: "wallet-42"}).Bytes()
+	require.NoError(t, err)
+	policyID, wrapped := newPolicyIdentity(t, "$0", [][]byte{m0}, [][]byte{ai0})
+
+	_, _, err = newEIDRHDeserializer().GetEIDAndRH(t.Context(), policyID, wrapped)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to deserialize audit info of component")
+}
+
+func TestPolicyEnrollmentIDMemberCountMismatch(t *testing.T) {
+	// malformed: two members but a single component audit info
+	m0, ai0 := newX509Member(t, "cert-zero", "wallet-42")
+	m1, _ := newX509Member(t, "cert-one", "wallet-42")
+	policyID, wrapped := newPolicyIdentity(t, "$0 OR $1", [][]byte{m0, m1}, [][]byte{ai0})
+
+	_, _, err := newEIDRHDeserializer().GetEIDAndRH(t.Context(), policyID, wrapped)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "component audit infos")
+}
+
+func TestPolicyEnrollmentIDZeroValueDeserializer(t *testing.T) {
+	// zero-value deserializer (no inner): legacy behavior, empty enrollment ID
+	m0, ai0 := newX509Member(t, "cert-zero", "wallet-42")
+	policyID, wrapped := newPolicyIdentity(t, "$0", [][]byte{m0}, [][]byte{ai0})
+
+	d := deserializer.NewEIDRHDeserializer()
+	d.AddDeserializer(Policy, &AuditInfoDeserializer{})
+
+	eid, rh, err := d.GetEIDAndRH(t.Context(), policyID, wrapped)
+	require.NoError(t, err)
+	assert.Empty(t, eid)
+	assert.Empty(t, rh)
+}
+
+func TestPolicyAuditInfoGarbageStillErrors(t *testing.T) {
+	m0, _ := newX509Member(t, "cert-zero", "wallet-42")
+	inner, err := (&PolicyIdentity{Policy: "$0", Identities: [][]byte{m0}}).Serialize()
+	require.NoError(t, err)
+	policyID, err := identity.WrapWithType(Policy, inner)
+	require.NoError(t, err)
+
+	_, _, err = newEIDRHDeserializer().GetEIDAndRH(t.Context(), policyID, []byte("not-json"))
+	require.Error(t, err)
+}
+
+func TestPolicyEnrollmentIDCrossEIDThenMalformedMember(t *testing.T) {
+	// members legitimately span enrollments, but a later member is malformed:
+	// the corruption must surface as an error, not be masked by the
+	// cross-enrollment "" result
+	unresolvable, err := identity.WrapWithType(identity.Type(99), []byte("cert-two"))
+	require.NoError(t, err)
+	unresolvableInfo, err := (&x509.AuditInfo{EID: "wallet-44"}).Bytes()
+	require.NoError(t, err)
+
+	m0, ai0 := newX509Member(t, "cert-zero", "wallet-42")
+	m1, ai1 := newX509Member(t, "cert-one", "wallet-43")
+	policyID, wrapped := newPolicyIdentity(t, "$0 OR $1 OR $2",
+		[][]byte{m0, m1, unresolvable}, [][]byte{ai0, ai1, unresolvableInfo})
+
+	_, _, err = newEIDRHDeserializer().GetEIDAndRH(t.Context(), policyID, wrapped)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to deserialize audit info of component")
+}

token/services/identity/boolpolicy/deserializer.go

@@ -154,13 +154,65 @@ func (d *TypedIdentityDeserializer) Recipients(id driver.Identity, typ identity.
 
 // AuditInfoDeserializer deserialises raw audit info bytes into the AuditInfo
 // struct for the enrollment-ID / revocation-handle path.
-type AuditInfoDeserializer struct{}
+// It derives the policy identity's enrollment ID from its components.
+type AuditInfoDeserializer struct {
+	inner driver2.AuditInfoDeserializer
+}
+
+// NewAuditInfoDeserializer constructs an AuditInfoDeserializer resolving
+// per-component audit infos through inner, typically the parent multiplex
+// deserializer.
+func NewAuditInfoDeserializer(inner driver2.AuditInfoDeserializer) *AuditInfoDeserializer {
+	return &AuditInfoDeserializer{inner: inner}
+}
 
-func (a *AuditInfoDeserializer) DeserializeAuditInfo(_ context.Context, _ driver.Identity, raw []byte) (driver2.AuditInfo, error) {
+// DeserializeAuditInfo decodes raw policy audit info and derives its enrollment ID.
+func (a *AuditInfoDeserializer) DeserializeAuditInfo(ctx context.Context, id driver.Identity, raw []byte) (driver2.AuditInfo, error) {
 	ei := &AuditInfo{}
 	if err := json.Unmarshal(raw, ei); err != nil {
 		return nil, err
 	}
+	eid, err := a.commonEnrollmentID(ctx, id, ei)
+	if err != nil {
+		return nil, errors.WithMessagef(err, "failed deriving policy enrollment ID")
+	}
+	ei.eid = eid
 
 	return ei, nil
 }
+
+// commonEnrollmentID returns the enrollment ID shared by all components:
+// "" when a component has none (e.g. a nested composite) or they disagree,
+// an error on unresolvable audit info or a component count mismatch.
+func (a *AuditInfoDeserializer) commonEnrollmentID(ctx context.Context, id driver.Identity, ei *AuditInfo) (string, error) {
+	if a.inner == nil || len(ei.IdentityAuditInfos) == 0 {
+		return "", nil
+	}
+	pi := PolicyIdentity{}
+	if err := pi.Deserialize(id); err != nil {
+		return "", errors.Wrapf(err, "failed to deserialize policy identity")
+	}
+	if len(pi.Identities) != len(ei.IdentityAuditInfos) {
+		return "", errors.Errorf("expected %d component audit infos but received %d",
+			len(pi.Identities), len(ei.IdentityAuditInfos))
+	}
+	// resolve every component before declaring a result so corruption in a
+	// later component is not masked by an earlier "no common EID" outcome
+	eids := make([]string, len(ei.IdentityAuditInfos))
+	for k, info := range ei.IdentityAuditInfos {
+		memberAuditInfo, err := a.inner.DeserializeAuditInfo(ctx, pi.Identities[k], info.AuditInfo)
+		if err != nil {
+			return "", errors.Wrapf(err, "failed to deserialize audit info of component [%d]", k)
+		}
+		eids[k] = memberAuditInfo.EnrollmentID()
+	}
+	for _, memberEID := range eids {
+		if memberEID == "" || memberEID != eids[0] {
+			// no common EID: a member has none (e.g. a nested composite
+			// spanning enrollments) or members belong to different ones
+			return "", nil
+		}
+	}
+
+	return eids[0], nil
+}

token/services/identity/boolpolicy/identity.go

@@ -95,11 +95,21 @@ type IdentityAuditInfo struct {
 // It is a sequence of per-component audit infos in the same order as Identities.
 type AuditInfo struct {
 	IdentityAuditInfos []IdentityAuditInfo
+	// eid is the enrollment ID shared by all component identities;
+	// empty when they span enrollments.
+	eid string
 }
 
-func (a *AuditInfo) EnrollmentID() string     { return "" }
+// EnrollmentID returns the enrollment ID shared by all component identities,
+// or "" when there is none.
+func (a *AuditInfo) EnrollmentID() string { return a.eid }
+
+// RevocationHandle returns "": a policy identity has no revocation handle of
+// its own.
 func (a *AuditInfo) RevocationHandle() string { return "" }
-func (a *AuditInfo) Bytes() ([]byte, error)   { return json.Marshal(a) }
+
+// Bytes returns the JSON encoding of the AuditInfo.
+func (a *AuditInfo) Bytes() ([]byte, error) { return json.Marshal(a) }
 
 // WrapAuditInfo packs per-component audit info bytes into a single blob.
 func WrapAuditInfo(recipients [][]byte) ([]byte, error) {