Merge pull request #96 from mikeappsec/feat/analytics-policy-inspector

Feat/analytics policy inspector

Author: mikeappsec

cmd/lwauth-controlplane/main.go

@@ -90,6 +90,15 @@ func main() {
 	streamHub := streaming.NewHub(registry, aggregator)
 	streamHub.AllowedOrigin = cfg.ConsoleOrigin
 
+	// SECURITY: When auth is enabled, require a console origin to be
+	// set so WebSocket upgraders fail-closed on cross-origin connections.
+	// If the operator forgot to set CP_CONSOLE_ORIGIN, warn loudly and
+	// use the request's Host header as the default (same-origin only).
+	effectiveOrigin := cfg.ConsoleOrigin
+	if cfg.AuthEnabled && effectiveOrigin == "" {
+		logger.Error(nil, "CP_AUTH_ENABLED=true but CP_CONSOLE_ORIGIN is empty — WebSocket connections will accept any origin. Set CP_CONSOLE_ORIGIN to the console URL (e.g. https://lwauth.example.com).")
+	}
+
 	// Alerting engine (Phase 2). Pulls rule evaluations from
 	// Prometheus and Loki when configured; degrades to a readonly
 	// catalog with running rule definitions but no firings when the

deploy/helm/lightweightauth-controlplane/templates/deployment.yaml

@@ -37,6 +37,27 @@ spec:
               value: {{ .Values.defaultImage | quote }}
             - name: CP_LEADER_ELECT
               value: {{ .Values.leaderElection.enabled | quote }}
+            # Console authentication — enabled by default in the chart.
+            # Operators must supply a bcrypt password hash.
+            - name: CP_AUTH_ENABLED
+              value: {{ .Values.consoleAuth.enabled | quote }}
+            - name: CP_AUTH_USERNAME
+              value: {{ .Values.consoleAuth.username | quote }}
+            - name: CP_AUTH_COOKIE_SECURE
+              value: {{ .Values.consoleAuth.cookieSecure | quote }}
+            - name: CP_AUTH_SESSION_TTL
+              value: {{ .Values.consoleAuth.sessionTTL | quote }}
+            {{- if .Values.consoleAuth.passwordHash }}
+            - name: CP_AUTH_PASSWORD_HASH
+              value: {{ .Values.consoleAuth.passwordHash | quote }}
+            {{- end }}
+            {{- if .Values.consoleAuth.passwordHashFile }}
+            - name: CP_AUTH_PASSWORD_HASH_FILE
+              value: {{ .Values.consoleAuth.passwordHashFile | quote }}
+            {{- end }}
+            # RBAC enforcement — enabled by default in the chart.
+            - name: CP_RBAC_ENABLED
+              value: {{ .Values.consoleRBAC.enabled | quote }}
             {{- if .Values.alerting.enabled }}
             - name: PROMETHEUS_URL
               value: {{ .Values.alerting.prometheusURL | quote }}

deploy/helm/lightweightauth-controlplane/values.yaml

@@ -51,6 +51,29 @@ leaderElection:
 clusterName: "local"
 defaultImage: "ghcr.io/mikeappsec/lightweightauth:latest"
 
+# Console authentication — enabled by default in the Helm chart.
+# Operators MUST set CP_AUTH_PASSWORD_HASH (or CP_AUTH_PASSWORD_HASH_FILE)
+# to a bcrypt hash of the admin password. The deployment refuses to
+# serve logins without it (fail-closed). Set to false only for local
+# development with port-forwarding.
+consoleAuth:
+  enabled: true
+  username: "admin"
+  # passwordHash must be a bcrypt hash. Set via a Kubernetes secret and
+  # reference with passwordHashFile, or inline via passwordHash.
+  # Example: htpasswd -nbBC 10 "" 'mypassword' | cut -d: -f2
+  passwordHash: ""
+  passwordHashFile: ""
+  cookieSecure: true
+  sessionTTL: "12h"
+
+# RBAC enforcement — enabled by default in the Helm chart. When true,
+# API callers must present a bearer token, X-Forwarded-User header, or
+# mTLS client cert. Browser console users authenticate via the session
+# cookie (consoleAuth above).
+consoleRBAC:
+  enabled: true
+
 # consoleOrigin restricts WebSocket upgrades to a single trusted origin.
 # Set to the full scheme+host of the UI (e.g. https://lwauth.example.com).
 # Empty string disables the check (dev mode — any origin accepted).

docs/cookbook/dpop-sender-binding.md

@@ -198,15 +198,13 @@ No extra configuration needed — as long as your proxy sets
 ## 6. Replay prevention
 
 The `jti` claim prevents token replay. lwauth maintains a cache of
-recently seen jti values — but there's no `replayCache:` config block
-on the `dpop` identifier (`pkg/identity/dpop/dpop.go`'s `knownKeys`
-only has `replayCacheSize`, and that field is parsed but never
-actually read anywhere in the package — it's presently dead). The
-cache handle instead comes from the shared, named cache-pool
-infrastructure: `deps.CacheProvider().Cache("replay")` requests a
-pool named `"replay"` from the top-level `caches:` block. If you
-don't declare one, lwauth synthesizes an implicit in-memory default
-pool so existing configs keep working:
+recently seen jti values — but there's no per-identifier `replayCache:`
+or `replayCacheSize:` config block on the `dpop` identifier. The cache
+handle instead comes from the shared, named cache-pool infrastructure:
+`deps.CacheProvider().Cache("replay")` requests a pool named `"replay"`
+from the top-level `caches:` block. If you don't declare one, lwauth
+synthesizes an implicit in-memory default pool so existing configs
+keep working:
 
 ```yaml
 identifiers:

docs/modules/dpop.md

@@ -24,7 +24,9 @@ identifiers:
       proofHeader:  DPoP             # default
       bearerHeader: Authorization    # default
       skew: 30s                      # iat tolerance; jti replay TTL = 2·skew
-      replayCacheSize: 10000         # in-process; switches to valkey if AuthConfig.cache.backend = valkey
+      # replay cache is sized via the top-level `caches:` block
+      # (pool name "replay"), not a per-identifier field — see
+      # docs/cookbook/dpop-sender-binding.md #6.
 
       inner:
         type: jwt                    # any registered Identifier

docs/operations/dpop-key-rotation-runbook.md

@@ -58,7 +58,6 @@ config:
         config:
           required: true
           skew: 30s
-          replayCacheSize: 10000
 
           # Pinned proof keys with rotation metadata
           pinnedKeys:

go.mod

@@ -6,6 +6,7 @@ require (
 	github.com/alicebob/miniredis/v2 v2.38.0
 	github.com/authzed/authzed-go v1.10.0
 	github.com/authzed/grpcutil v0.0.0-20260105210157-e237581949c2
+	github.com/beevik/etree v1.6.0
 	github.com/coder/websocket v1.8.15
 	github.com/envoyproxy/go-control-plane/envoy v1.37.0
 	github.com/fsnotify/fsnotify v1.10.1
@@ -16,6 +17,7 @@ require (
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/prometheus/client_golang v1.23.2
+	github.com/russellhaering/goxmldsig v1.6.0
 	github.com/tetratelabs/wazero v1.11.0
 	github.com/valkey-io/valkey-go v1.0.74
 	go.opentelemetry.io/otel v1.43.0
@@ -75,6 +77,7 @@ require (
 	github.com/google/gnostic-models v0.7.1 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
+	github.com/jonboulle/clockwork v0.5.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/jzelinskie/stringz v0.0.3 // indirect
 	github.com/lestrrat-go/blackmagic v1.0.4 // indirect

go.sum

@@ -22,6 +22,8 @@ github.com/authzed/authzed-go v1.10.0 h1:GUPzYFnStk1PIBZOkQzqcYA3iHaOlVYVl1UnHIR
 github.com/authzed/authzed-go v1.10.0/go.mod h1:2DL7pg4iqMltwWOSw+wvbEzAK7uRt3545+bkcGYD8D8=
 github.com/authzed/grpcutil v0.0.0-20260105210157-e237581949c2 h1:ymPD1ugBsXVUpLIG/lnRn1ndgOrsrki/0ZX7uP/S1GI=
 github.com/authzed/grpcutil v0.0.0-20260105210157-e237581949c2/go.mod h1:FLssYBs1DrwuItfI411kzqcV8QSqGb/B7PC6snNhjvU=
+github.com/beevik/etree v1.6.0 h1:u8Kwy8pp9D9XeITj2Z0XtA5qqZEmtJtuXZRQi+j03eE=
+github.com/beevik/etree v1.6.0/go.mod h1:bh4zJxiIr62SOf9pRzN7UUYaEDa9HEKafK25+sLc0Gc=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
@@ -154,6 +156,8 @@ github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDa
 github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs=
+github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I=
+github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/jzelinskie/stringz v0.0.3 h1:0GhG3lVMYrYtIvRbxvQI6zqRTT1P1xyQlpa0FhfUXas=
@@ -236,6 +240,8 @@ github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 h1:bsUq1dX0N8A
 github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/russellhaering/goxmldsig v1.6.0 h1:8fdWXEPh2k/NZNQBPFNoVfS3JmzS4ZprY/sAOpKQLks=
+github.com/russellhaering/goxmldsig v1.6.0/go.mod h1:TrnaquDcYxWXfJrOjeMBTX4mLBeYAqaHEyUeWPxZlBM=
 github.com/segmentio/asm v1.2.1 h1:DTNbBqs57ioxAD4PrArqftgypG4/qNpXoJx8TVXxPR0=
 github.com/segmentio/asm v1.2.1/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
 github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=

internal/controlplane/api/endpoints_alerts.go

@@ -160,7 +160,18 @@ func (s *Server) handlePutRules(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	// Validate the override set before persisting: each rule must have
-	// a unique name and a sane (positive) For/Window when Enabled.
+	// a unique name. The Query and Source fields are rejected —
+	// operators can only override Threshold, For, Window, Enabled,
+	// and Severity on existing built-in rules. This prevents
+	// PromQL/LogQL injection via the API: the built-in catalog's
+	// queries are operator-reviewed at compile time and cannot be
+	// replaced at runtime.
+	knownRules := map[string]bool{}
+	if s.AlertEngine != nil {
+		for _, r := range s.AlertEngine.Rules() {
+			knownRules[r.Name] = true
+		}
+	}
 	seen := map[string]bool{}
 	for i, r := range req.Overrides {
 		if r.Name == "" {
@@ -172,6 +183,25 @@ func (s *Server) handlePutRules(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 		seen[r.Name] = true
+		// Reject custom rules (name not in the built-in catalog) —
+		// only overrides of existing defaults are allowed via the
+		// API. New custom rules must be added to the ConfigMap
+		// directly by the operator.
+		if !knownRules[r.Name] {
+			writeError(w, http.StatusBadRequest, "override["+strconv.Itoa(i)+"]: unknown rule name "+strconv.Quote(r.Name)+" — only overrides of built-in rules are allowed via the API")
+			return
+		}
+		// Reject Query and Source overrides — these are the
+		// PromQL/LogQL injection vectors. Operators who need to
+		// change a query must edit the ConfigMap directly.
+		if r.Query != "" {
+			writeError(w, http.StatusBadRequest, "override["+strconv.Itoa(i)+"]: query field cannot be set via the API — edit the ConfigMap directly")
+			return
+		}
+		if r.Source != "" {
+			writeError(w, http.StatusBadRequest, "override["+strconv.Itoa(i)+"]: source field cannot be set via the API — edit the ConfigMap directly")
+			return
+		}
 	}
 	if err := s.RulesLoader.PutRules(r.Context(), req.Overrides); err != nil {
 		writeError(w, http.StatusInternalServerError, err.Error())

internal/controlplane/api/probe.go

@@ -20,9 +20,18 @@ import (
 //   - Only HTTPS URLs are accepted (no http://, no file://, etc.).
 //   - Timeout: 5 s.
 //   - Maximum 2 redirects followed.
-//   - Private / link-local / loopback IP ranges are not blocked here because
-//     IdPs may legitimately be in-cluster (they are reachable from the CP pod
-//     via ClusterIP); the operator is responsible for network policy.
+//   - The target host is validated via validateHost (ssrf.go), which
+//     resolves the hostname and checks every returned IP against
+//     loopback, link-local, and cloud-metadata ranges — not just a
+//     static hostname list — on the initial URL AND on every redirect
+//     target (SSRF redirect bypass defence). A hostname that isn't an
+//     IP literal and isn't a known metadata host would otherwise pass
+//     a naive string-only check even when it resolves to an internal
+//     or metadata address.
+//   - In-cluster service hostnames (.svc.cluster.local) are allowed
+//     because operators may run their IdP inside the cluster, so
+//     private RFC1918 ranges are permitted here (allowPrivate=true) —
+//     unlike handleRegisterInstance, which blocks them.
 //
 // Route: GET /v1/controlplane/probe/url?url=<encoded>
 func (s *Server) handleProbeURL(w http.ResponseWriter, r *http.Request) {
@@ -37,9 +46,11 @@ func (s *Server) handleProbeURL(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "only https:// URLs are allowed")
 		return
 	}
-	// Reject bare hostnames that look like private/metadata endpoints typically
-	// exploited in SSRF, while still allowing in-cluster HTTPS IdPs.
-	if isBlockedHost(parsed.Hostname()) {
+	// Reject SSRF pivot targets (loopback, link-local, cloud metadata).
+	// allowPrivate=true: in-cluster IdP hostnames commonly resolve to
+	// RFC1918 addresses, and that's an intentional, documented use case
+	// for this endpoint (unlike instance registration).
+	if err := validateHost(parsed.Hostname(), true); err != nil {
 		writeError(w, http.StatusBadRequest, "target host is not allowed")
 		return
 	}
@@ -57,6 +68,14 @@ func (s *Server) handleProbeURL(w http.ResponseWriter, r *http.Request) {
 			if !strings.EqualFold(req.URL.Scheme, "https") {
 				return http.ErrUseLastResponse
 			}
+			// SECURITY: Re-validate the redirect target host with the
+			// same check applied to the initial URL. Without this an
+			// attacker can redirect from a safe host to a cloud
+			// metadata or internal endpoint, bypassing the initial
+			// check.
+			if validateHost(req.URL.Hostname(), true) != nil {
+				return http.ErrUseLastResponse
+			}
 			return nil
 		},
 	}
@@ -93,25 +112,3 @@ func (s *Server) handleProbeURL(w http.ResponseWriter, r *http.Request) {
 		"statusCode": resp.StatusCode,
 	})
 }
-
-// isBlockedHost blocks a small list of well-known SSRF pivot targets.
-// In-cluster service hostnames (.svc.cluster.local) are intentionally allowed
-// because operators may run their IdP inside the cluster.
-func isBlockedHost(host string) bool {
-	// Strip port if present.
-	if i := strings.LastIndex(host, ":"); i != -1 && strings.Count(host, ":") == 1 {
-		host = host[:i]
-	}
-	blocked := []string{
-		"169.254.169.254", // AWS/GCP/OCI IMDS
-		"metadata.google.internal",
-		"instance-data",
-	}
-	lower := strings.ToLower(host)
-	for _, b := range blocked {
-		if lower == b {
-			return true
-		}
-	}
-	return false
-}