V1 and V2 use the same field sets (only hash algorithm differs).
The AWS documentation explicitly shows that SigningCertURL and
SignatureVersion are metadata fields, not part of the signed content.
Changes:
- Remove V2-specific field lists (SigningCertURL, SignatureVersion)
- Simplify build-string-to-sign to use unified field sets
- Fix resource leak in fetch-certificate (close stream on non-200)
- Fix missing Message field returning 200 instead of 400
- Stub fetch-certificate in network-dependent test
- Update V2 test to reflect correct field sets
Reference: https://docs.aws.amazon.com/sns/latest/dg/sns-verify-signature-of-message-verify-message-signature.html
AI-assisted-by: qwen3.7-plus
Address code review findings:
- Restrict URL validation to sns.<region>.amazonaws.com only
(prevents attacker-controlled S3 buckets from being accepted)
- Add support for SignatureVersion 2 (SHA256withRSA)
- Fix resource leak by wrapping certificate stream in with-open
- Return proper HTTP status codes (4xx for invalid messages,
5xx for transient failures)
- Add comprehensive tests for URL validation, signature versions,
and HTTP response codes
Closes#11092
AI-assisted-by: qwen3.7-plus
The /webhooks/sns endpoint was accepting bounce and complaint
notifications without verifying the AWS SNS cryptographic signature.
This allowed any authenticated user to forge reports for arbitrary
email addresses using their own valid :profile-identity token.
The fix adds:
- AWS SNS signature verification using RSA-SHA1
- URL validation for SigningCertURL and SubscribeURL (must be from
amazonaws.com domain)
- Proper logging of all verification failures with context fields
- Rejection of unverified messages before any processing
Closes#11092
AI-assisted-by: qwen3.7-plus
Mainly make it receive the whol cfg/system instead only props. This
makes the api more flexible for a future extending without the need
to change the api again.
- makes the profile access more efficient (replace in-app joins to a
simple select query on profile table
- add partial support for access-tokens (still missing some RPC methods)
- move router definitions to specific modules and simplify the main http
module definitions to simple includes
- simplifiy authentication code related to access-tokens and sessions
- normalize db parameters with proper namespaced props
- more work on convert all modules initialization to use proper specs
with fully-qualified keyword config props
