Harden access control on a backend endpoint

[dobby-coder]

Access-control hardening is needed on one of the backend HTTP endpoints. Details, reproduction, and the suggested fix are in the private draft security advisory (maintainer-only):

https://github.com/encryption4all/cryptify/security/advisories/GHSA-5rhx-xgvv-h78h

Scope: enforce authentication/ownership on the affected endpoint so it can no longer be queried anonymously for arbitrary inputs. A small secondary hardening item (constant-time token comparison) is noted in the advisory. Please keep specifics in the advisory thread, not in this public issue.

[dobby-coder]

/dobby fix — resolve the access-control issue detailed in the linked draft security advisory GHSA-5rhx-xgvv-h78h. Read that private advisory first for the exact endpoint, root cause, reproduction steps, and the suggested fix (do not restate specifics in this public thread).

Implementation:

• Enforce authentication/ownership on the affected endpoint: the default-tier (no validated API key) path must be rejected with 401 Unauthorized instead of accepting an arbitrary caller-supplied value. Consider a dedicated request-guard type that fails on NoCredentials/Rejected so the "authenticated" intent is enforced by the type system rather than by a guard that always succeeds.
• Apply the secondary hardening noted in the advisory: make the cryptify_token comparison constant-time (use subtle::ConstantTimeEq, mirroring recovery_tokens_match).
• Add a regression test covering the unauthenticated-access rejection.
• Run cargo fmt --all -- --check, cargo clippy --all-targets -- -D warnings, and cargo test --all-targets (tests touching Store need #[rocket::async_test]).
• Open a draft PR referencing the advisory by GHSA id; keep vulnerability specifics out of the public PR description.

[dobby-coder]

Dobby hit a rate limit mid-task and had to pause. Resets 02 Jul 2026, 05:29 CEST. I'll automatically resume where I left off — no work lost!

[dobby-coder]

On it! I'm picking up the security vulnerability fix for #182 and will open a draft PR with the patch.

[dobby-coder]

Dobby hit a rate limit mid-task and had to pause. Resets 02 Jul 2026, 08:29 CEST. I'll automatically resume where I left off — no work lost!

[dobby-coder]

Dobby hit a rate limit mid-task and had to pause. Resets 02 Jul 2026, 09:30 CEST. I'll automatically resume where I left off — no work lost!