relay: enforce pre-hook secret restrictions from signed WorkflowExecution (PRIV-537)#23203
Closed
nadahalli wants to merge 1 commit into
Closed
relay: enforce pre-hook secret restrictions from signed WorkflowExecution (PRIV-537)#23203nadahalli wants to merge 1 commit into
nadahalli wants to merge 1 commit into
Conversation
…tion (PRIV-537) The Workflow-DON-signed PublicData carries the workflow's pre-hook Restrictions. After the PRIV-433 quorum check, filter the requested secrets against the signed restriction membership (exact and prefix rules, vault namespace normalization), and bind the quorum to the request's execution_id so a breached enclave cannot replay an older execution's looser restrictions. Counting budgets stay enclave-side; the relay serves each request statelessly and enforces membership only.
Contributor
|
✅ No conflicts with other open PRs targeting |
Contributor
|
I see you updated files related to
|
nolag
reviewed
Jul 22, 2026
Comment on lines
+276
to
+285
| execution, err := h.verifyWorkflowAuthorization(localNode.WorkflowDON, params) | ||
| if err != nil { | ||
| return h.errorResponse(ctx, gatewayID, req, jsonrpc.ErrInvalidParams, err) | ||
| } | ||
|
|
||
| // Filter the requested secrets against the workflow's pre-hook restrictions carried in | ||
| // the same signed WorkflowExecution (PRIV-537). The enclave enforces these itself, so a | ||
| // violation reaching the relay implies a breached TEE: reject the whole request rather | ||
| // than serving a partial result. | ||
| if err = enforceSecretsRestrictions(execution.GetRestrictions(), params.Secrets); err != nil { |
Contributor
There was a problem hiding this comment.
It's already done by the execution handler :)
nolag
reviewed
Jul 22, 2026
| return h.errorResponse(ctx, gatewayID, req, jsonrpc.ErrInvalidParams, err) | ||
| } | ||
|
|
||
| handler, ok := h.executionHandlers.GetExecution(params.WorkflowID, params.ExecutionID) |
Contributor
There was a problem hiding this comment.
The execution handler here already imposes the restrictions.
nolag
requested changes
Jul 22, 2026
nolag
left a comment
nolag
left a comment
Contributor
There was a problem hiding this comment.
No need, work was already done wired into the execution handler.
|
Contributor
Author
|
Withdrawn: the relay already enforces the pre-hook restrictions through the execution helper registered by ConfidentialModule (restriction-wrapped node-side, with working budgets, for both secrets and capability calls). See discussion with Ryan. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Workflow-DON-signed PublicData carries the workflow's pre-hook Restrictions (chainlink-protos #441). After the PRIV-433 quorum check, the relay now filters the requested secrets against the signed restriction membership (exact and prefix rules, vault ""->"main" namespace normalization on both sides) and binds the quorum to the request's execution_id, so a breached enclave cannot replay an older execution's looser restriction set.
Membership only: counting budgets (max_secrets, per-prefix budgets) stay enclave-side, since the relay serves each request statelessly. Semantics mirror chainlink-common's in-TEE executionRestrictions wrapper, including zero-budget denials.
Capability-path filtering is out of scope: CapabilityRequestParams has no SignedComputeRequests carrier yet.