feat: support encrypted CDN resolver state#428
Draft
nicklasl wants to merge 20 commits into
Draft
Conversation
nicklasl
changed the title
nicklasl
force-pushed
the
nicklasl/encrypted-cdn-state
branch
3 times, most recently
from
c98377a to
99d4ff2
Compare
Add AES-256-GCM decryption support for encrypted CDN state blobs. WASM layer: - New `set_encrypted_resolver_state` guest function - Decrypts AES-256-GCM (Tink NO_PREFIX) and sets resolver state - Uses `aes-gcm` crate (~42K binary increase) JS provider: - New `encryptionKey` option in `ProviderOptions` - Detects encrypted responses via `x-goog-meta-encrypted` header - Informative error when state is encrypted but no key is provided Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add `encryptionKey` to `LocalProviderConfig` builder - Detect encrypted CDN responses via `x-goog-meta-encrypted` header - Add `setEncryptedResolverState` through all resolver layers - Informative error when state is encrypted but no key is provided Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add `EncryptionKey` to `ProviderConfig` - Detect encrypted CDN responses via `x-goog-meta-encrypted` header - Add `SetEncryptedResolverState` through all resolver layers - Informative error when state is encrypted but no key is provided Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add `encryption_key` parameter to `ConfidenceProvider` - Detect encrypted CDN responses via `x-goog-meta-encrypted` header - Add `set_encrypted_resolver_state` through resolver layers - Informative error when state is encrypted but no key is provided Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace nil stores into atomic.Value with atomic.Bool flags in both RecoveringResolver and FlagsAdminStateFetcher. atomic.Value panics when storing nil after a typed value was previously stored. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Use atomic.Bool to track encrypted state instead of storing nil into rawCdnBytes atomic.Value. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Match the error string expected by TestLocalResolverProvider_Init_EmptyAccountID. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
nicklasl
force-pushed
the
nicklasl/encrypted-cdn-state
branch
from
7285e4f to
280e9aa
Compare
The deployer now detects encrypted CDN responses via the x-goog-meta-encrypted header and decrypts using Node.js crypto (already available for Wrangler) before embedding in the Worker. Requires STATE_ENCRYPTION_KEY env var (hex-encoded AES-256 key) when the CDN state is encrypted. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Move AES-256-GCM decryption to decrypt_state.js so it can be called manually: node decrypt_state.js <file> <hex_key> [output_file] Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The CDN serves GCS metadata with x-amz-meta-* prefix, not x-goog-meta-*. Updated all providers and the deployer. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Check x-amz-meta-encrypted header first, then fall back to protobuf decode — if parsing fails, treat the state as encrypted. Covers CDN configurations that don't forward metadata headers. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Generated from wasm/resolver_state.pb wrapped as SetResolverStateRequest with account_id "confidence-test", encrypted with AES-256-GCM. Key is deterministic (sha256 of "confidence-test-encryption-key") and stored alongside the fixture — not secret. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Each provider loads the encrypted fixture from data/, decrypts via the WASM set_encrypted_resolver_state function, and verifies flag resolution works. Also tests wrong-key rejection. - JS: 2 tests in WasmResolver.test.ts - Java: 2 tests in EncryptedStateTest.java - Go: 2 tests in encrypted_state_test.go - Python: 3 tests in test_encrypted_state.py Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The Rust provider uses the native resolver (no WASM), so decryption is implemented directly in StateFetcher::fetch(). - Add `encryption_key` to `ProviderOptions` with builder method - Detect encrypted responses via x-amz-meta-encrypted header - Fall back to protobuf parse failure detection - 3 tests: decrypt+resolve, wrong key rejection, missing key Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Derive the wrong key by flipping a bit of the real test key instead of using a zero-filled byte array, which CodeQL flags as a hardcoded cryptographic key. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
x-goog-meta-encryptedCDN header, with a clear error when no key is configuredChanges
WASM layer
SetEncryptedResolverStateRequest(encrypted blob + raw key + SDK metadata)wasm_msg_guest_set_encrypted_resolver_state— decrypts AES-256-GCM (Tink NO_PREFIX: 12-byte nonce ∥ ciphertext+tag), then parses and sets stateaes-gcmcrate added (~42K WASM binary increase)JS provider
ProviderOptions.encryptionKey— hex-encoded AES-256 keyupdateState()checksx-goog-meta-encryptedheader and routes to the encrypted or plain pathWasmResolver) caches encrypted state for instance reloadJava provider
LocalProviderConfig.builder().encryptionKey()— hex-encoded AES-256 keyFlagsAdminStateFetcherdetects encrypted responses and stores raw CDN bytessetEncryptedResolverStatepropagated through all resolver layers (Pooled, Recovering, Materializing)Go provider
ProviderConfig.EncryptionKey— hex-encoded AES-256 keyFlagsAdminStateFetcherdetects encrypted responses and stores raw CDN bytesSetEncryptedResolverStatepropagated through all resolver layers (Pool, Recovering, Materialization)Python provider
ConfidenceProvider(encryption_key=...)— hex-encoded AES-256 keyStateFetcherdetects encrypted responses and stores raw CDN bytesset_encrypted_resolver_statepropagated through resolver layersTest plan
wasm-objdump🤖 Generated with Claude Code