re-add token auth (#73)

cpp/module_proxy.cpp

@@ -1,8 +1,11 @@
 #include "module_proxy.h"
 #include "logos_provider_object.h"
+#include "token_manager.h"
 #include <QDebug>
+#include <QByteArray>
 #include <QJsonObject>
 #include <QJsonValue>
+#include <algorithm>
 
 ModuleProxy::ModuleProxy(LogosProviderObject* provider, QObject* parent)
     : QObject(parent)
@@ -75,6 +78,18 @@ QVariant ModuleProxy::callRemoteMethod(const QString& authToken, const QString&
     if (methodName == "getPluginInterface" && args.isEmpty()) {
         return QVariant(getPluginInterface());
     }
+    // NOTE: the three getPlugin* introspection calls above intentionally stay
+    // ungated. They expose only the method/event signatures (no business logic
+    // or state) and are needed before any token exists — a caller discovers a
+    // module's interface as part of the connection handshake, ahead of the
+    // capability_module token exchange. Everything past this point is a real
+    // business-method dispatch and MUST be authorized.
+
+    if (!isAuthorized(authToken)) {
+        qWarning() << "ModuleProxy: rejecting unauthorized call to" << methodName
+                   << "- auth token not recognized";
+        return QVariant();
+    }
 
     qDebug() << "ModuleProxy: callRemoteMethod" << methodName << "args:" << args;
     return m_provider->callMethod(methodName, args);
@@ -92,6 +107,55 @@ bool ModuleProxy::informModuleToken(const QString& authToken, const QString& mod
     return m_provider->informModuleToken(moduleName, token);
 }
 
+namespace {
+// note: this is to ensure comparison is constant time to prevent timing attacks
+// Length-independent constant-time comparison of two tokens. Returns true only
+// when both byte sequences are identical. We compare over the longer of the two
+// lengths (folding any length difference into the result) so the running time
+// does not reveal a correct prefix or the secret's length.
+bool constantTimeEquals(const QString& a, const QString& b)
+{
+    const QByteArray ba = a.toUtf8();
+    const QByteArray bb = b.toUtf8();
+    const int n = std::max(ba.size(), bb.size());
+    // A different length is a mismatch, but keep scanning to stay constant-time.
+    int diff = ba.size() ^ bb.size();
+    for (int i = 0; i < n; ++i) {
+        const unsigned char ca = i < ba.size() ? static_cast<unsigned char>(ba[i]) : 0;
+        const unsigned char cb = i < bb.size() ? static_cast<unsigned char>(bb[i]) : 0;
+        diff |= (ca ^ cb);
+    }
+    return diff == 0;
+}
+} // namespace
+
+bool ModuleProxy::isAuthorized(const QString& authToken) const
+{
+    // Fail closed: an empty token is never valid, even if some empty value
+    // somehow ended up in a token store.
+    if (authToken.isEmpty()) {
+        return false;
+    }
+
+    // A token is valid only if THIS module actually issued it to some caller.
+    // Two stores hold issued tokens:
+    //   * m_tokens          — legacy per-proxy store (LogosAPIProvider::saveToken)
+    //   * TokenManager      — the capability-flow store that informModuleToken
+    //                         writes when capability_module mints a token for a
+    //                         (caller, target) pair.
+    // We scan every issued token with a constant-time compare and never early
+    // out, so neither a match position nor the number of issued tokens leaks
+    // through timing.
+    bool authorized = false;
+    for (auto it = m_tokens.constBegin(); it != m_tokens.constEnd(); ++it) {
+        authorized |= constantTimeEquals(authToken, it.value());
+    }
+    for (const QString& key : TokenManager::instance().getTokenKeys()) {
+        authorized |= constantTimeEquals(authToken, TokenManager::instance().getToken(key));
+    }
+    return authorized;
+}
+
 namespace {
 // getMethods() returns the module's full interface — both methods and events,
 // each tagged with a "type" ("method"/"event"). Split it back out. An entry