Skip to content

[codex] Structure relay publish signature errors #3335

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
juliusmarminge merged 1 commit into from
Jun 20, 2026
Merged

[codex] Structure relay publish signature errors #3335

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 58 additions & 0 deletions infra/relay/src/environments/EnvironmentPublishSignatures.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ import * as Effect from "effect/Effect";
import * as Layer from "effect/Layer";
import * as Redacted from "effect/Redacted";
import * as Result from "effect/Result";
import * as Schema from "effect/Schema";

import * as DpopProofs from "../auth/DpopProofs.ts";
import * as RelayConfiguration from "../Config.ts";
Expand Down Expand Up @@ -51,6 +52,9 @@ const state: RelayAgentActivityState = {
updatedAt: "2026-05-25T00:00:00.000Z",
deepLink: "/threads/env/thread",
};
const isEnvironmentPublishSignatureInvalid = Schema.is(
EnvironmentPublishSignatures.EnvironmentPublishSignatureInvalid,
);

function signTestJwt(payload: object, privateKey: string): string {
const header = Buffer.from(
Expand Down Expand Up @@ -145,6 +149,49 @@ describe("EnvironmentPublishSignatures", () => {
}),
);
expect(Result.isFailure(result)).toBe(true);
if (Result.isFailure(result)) {
expect(isEnvironmentPublishSignatureInvalid(result.failure)).toBe(true);
if (isEnvironmentPublishSignatureInvalid(result.failure)) {
expect(result.failure).toMatchObject({
environmentId: state.environmentId,
threadId: state.threadId,
reason: "invalid_signature_or_payload",
stage: "validate_claims",
});
}
}
}).pipe(Effect.provide(layer())),
);

it.effect("preserves the JWT verification failure", () =>
Effect.gen(function* () {
const request = yield* freshRequest;
const segments = request.proof.split(".");
const signature = segments[2]!;
segments[2] = `${signature.startsWith("A") ? "B" : "A"}${signature.slice(1)}`;
const signatures = yield* EnvironmentPublishSignatures.EnvironmentPublishSignatures;
const result = yield* Effect.result(
signatures.verify({
environmentId: state.environmentId,
environmentPublicKey: keyPair.publicKey,
threadId: state.threadId,
request: { ...request, proof: segments.join(".") },
}),
);

expect(Result.isFailure(result)).toBe(true);
if (Result.isFailure(result)) {
expect(isEnvironmentPublishSignatureInvalid(result.failure)).toBe(true);
if (isEnvironmentPublishSignatureInvalid(result.failure)) {
expect(result.failure).toMatchObject({
environmentId: state.environmentId,
threadId: state.threadId,
reason: "invalid_signature_or_payload",
stage: "verify_proof",
cause: { _tag: "RelayJwtError" },
});
}
}
}).pipe(Effect.provide(layer())),
);

Expand All @@ -161,6 +208,17 @@ describe("EnvironmentPublishSignatures", () => {
}),
);
expect(Result.isFailure(result)).toBe(true);
if (Result.isFailure(result)) {
expect(isEnvironmentPublishSignatureInvalid(result.failure)).toBe(true);
if (isEnvironmentPublishSignatureInvalid(result.failure)) {
expect(result.failure).toMatchObject({
environmentId: state.environmentId,
threadId: state.threadId,
reason: "replayed_nonce",
stage: "consume_nonce",
});
}
}
}).pipe(Effect.provide(layer({ consume: () => Effect.succeed(false) }))),
);
});
56 changes: 51 additions & 5 deletions infra/relay/src/environments/EnvironmentPublishSignatures.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
import {
RelayAgentActivityPublishProofPayload,
RelayAgentActivityPublishProofInvalidReason,
type RelayAgentActivityPublishRequest,
} from "@t3tools/contracts/relay";
import {
Expand All @@ -23,22 +24,35 @@ import * as RelayConfiguration from "../Config.ts";
export class EnvironmentPublishSignatureExpired extends Schema.TaggedErrorClass<EnvironmentPublishSignatureExpired>()(
"EnvironmentPublishSignatureExpired",
{
environmentId: Schema.String,
threadId: Schema.String,
expiresAt: Schema.String,
},
) {
override get message(): string {
return `Environment publish signature expired at ${this.expiresAt}`;
return `Environment '${this.environmentId}' publish signature for thread '${this.threadId}' expired at ${this.expiresAt}`;
}
}

export class EnvironmentPublishSignatureInvalid extends Schema.TaggedErrorClass<EnvironmentPublishSignatureInvalid>()(
"EnvironmentPublishSignatureInvalid",
{
environmentId: Schema.String,
threadId: Schema.String,
reason: RelayAgentActivityPublishProofInvalidReason,
stage: Schema.Literals([
"decode_token",
"verify_proof",
"validate_claims",
"validate_expiration",
"generate_replay_thumbprint",
"consume_nonce",
]),
cause: Schema.optional(Schema.Defect()),
},
) {
override get message(): string {
return `Environment '${this.environmentId}' publish signature is invalid`;
return `Environment '${this.environmentId}' publish signature for thread '${this.threadId}' is invalid during ${this.stage}: ${this.reason}`;
}
}

Expand Down Expand Up @@ -102,13 +116,22 @@ const make = Effect.gen(function* () {
const now = yield* DateTime.now;
const decoded = yield* Effect.try({
try: () => decodeRelayJwt(input.request.proof),
catch: () => new EnvironmentPublishSignatureInvalid({ environmentId: input.environmentId }),
catch: (cause) =>
new EnvironmentPublishSignatureInvalid({
environmentId: input.environmentId,
threadId: input.threadId,
reason: "invalid_signature_or_payload",
stage: "decode_token",
cause,
}),
});
if (
typeof decoded.exp === "number" &&
decoded.exp <= Math.floor(now.epochMilliseconds / 1_000)
) {
return yield* new EnvironmentPublishSignatureExpired({
environmentId: input.environmentId,
threadId: input.threadId,
expiresAt: DateTime.formatIso(DateTime.makeUnsafe(decoded.exp * 1_000)),
});
}
Expand All @@ -122,7 +145,14 @@ const make = Effect.gen(function* () {
}).pipe(
Effect.flatMap(decodeProof),
Effect.mapError(
() => new EnvironmentPublishSignatureInvalid({ environmentId: input.environmentId }),
(cause) =>
new EnvironmentPublishSignatureInvalid({
environmentId: input.environmentId,
threadId: input.threadId,
reason: "invalid_signature_or_payload",
stage: "verify_proof",
cause,
}),
),
);
if (
Expand All @@ -136,12 +166,18 @@ const make = Effect.gen(function* () {
) {
return yield* new EnvironmentPublishSignatureInvalid({
environmentId: input.environmentId,
threadId: input.threadId,
reason: "invalid_signature_or_payload",
stage: "validate_claims",
});
}
const expiresAt = DateTime.make(proof.exp * 1_000);
if (expiresAt._tag === "None") {
return yield* new EnvironmentPublishSignatureInvalid({
environmentId: input.environmentId,
threadId: input.threadId,
reason: "invalid_signature_or_payload",
stage: "validate_expiration",
});
}
const thumbprint = yield* crypto
Expand All @@ -155,7 +191,14 @@ const make = Effect.gen(function* () {
.pipe(
Effect.map(formatEnvironmentPublishReplayThumbprint),
Effect.mapError(
() => new EnvironmentPublishSignatureInvalid({ environmentId: input.environmentId }),
(cause) =>
new EnvironmentPublishSignatureInvalid({
environmentId: input.environmentId,
threadId: input.threadId,
reason: "invalid_signature_or_payload",
stage: "generate_replay_thumbprint",
cause,
}),
),
);
const consumedNonce = yield* proofReplay.consume({
Expand All @@ -167,6 +210,9 @@ const make = Effect.gen(function* () {
if (!consumedNonce) {
return yield* new EnvironmentPublishSignatureInvalid({
environmentId: input.environmentId,
threadId: input.threadId,
reason: "replayed_nonce",
stage: "consume_nonce",
});
}
}),
Expand Down
Loading