fix(auth): authenticate producer-signed decisions before authorization

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

verifier/main.go

@@ -0,0 +1,52 @@
+// Decision verification uses the unchanged Access Engine producer implementation.
+package main
+
+import (
+	"bytes"
+	"crypto/ed25519"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"github.com/netkingdom/access-engine/internal/sign"
+	"github.com/netkingdom/access-engine/pkg/api"
+	"io"
+	"os"
+)
+
+type input struct {
+	Envelope json.RawMessage   `json:"envelope"`
+	Keys     map[string]string `json:"keys"`
+}
+
+func run() error {
+	var in input
+	if err := json.NewDecoder(io.LimitReader(os.Stdin, 1048577)).Decode(&in); err != nil {
+		return err
+	}
+	var envelope api.DecisionEnvelope
+	decoder := json.NewDecoder(bytes.NewReader(in.Envelope))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&envelope); err != nil {
+		return err
+	}
+	keys := map[string]ed25519.PublicKey{}
+	for kid, encoded := range in.Keys {
+		raw, err := base64.RawURLEncoding.Strict().DecodeString(encoded)
+		if err != nil || len(raw) != ed25519.PublicKeySize || kid == "" {
+			return fmt.Errorf("invalid admitted key")
+		}
+		keys[kid] = ed25519.PublicKey(raw)
+	}
+	if err := sign.Verify(envelope, keys); err != nil {
+		return err
+	}
+	// Return the exact typed interpretation authenticated by the producer; Python
+	// must never act on a second interpretation of unverified response fields.
+	return json.NewEncoder(os.Stdout).Encode(envelope)
+}
+func main() {
+	if run() != nil {
+		fmt.Fprintln(os.Stderr, "decision signature verification refused")
+		os.Exit(1)
+	}
+}