security: Signing replay window too wide at 300 seconds

[deucebucket]

Problem

The request signing protocol in library_manager/signing.py uses a 300-second (5-minute) timestamp tolerance. This means a captured signed request can be replayed for up to 5 minutes. While the HMAC prevents tampering, it doesn't prevent replay attacks within the window.

Additionally:

• No nonce mechanism to prevent exact replays
• The signing salt is static (skaldleita-lm-2024) — rotating it requires coordinated updates
• Secret derivation depends solely on version string — if an attacker knows the version (it's in User-Agent), they only need to reverse the salt

Fix

• Add an optional request nonce (UUID) to signed headers — BookDB can track seen nonces within the 300s window
• Consider reducing timestamp tolerance to 60 seconds (most clocks are within this)
• Document the threat model: what signing protects against (unauthorized API use) vs what it doesn't (replay within window)

Note: This is a coordinated change — both LM and BookDB need to agree on the protocol. The nonce is additive (backwards compatible) so it can be rolled out incrementally.

Files

• library_manager/signing.py — add nonce generation
• library_manager/providers/bookdb.py — include nonce in signed headers