eIPC foundation: session & secrets hygiene (PR-EIPC-4)

cmd/eipc-client/main.go

@@ -158,12 +158,12 @@ func main() {
 	}
 
 	sessionToken := authRes.SessionToken
-	if len(sessionToken) >= 16 {
-		log.Printf("[3] Authenticated! token=%s...%s caps=%v",
-			sessionToken[:8], sessionToken[len(sessionToken)-8:], authRes.Capabilities)
-	} else {
-		log.Printf("[3] Authenticated! token=%s caps=%v", sessionToken, authRes.Capabilities)
-	}
+	// The session token is a credential: log only that auth succeeded
+	// and which capabilities were granted, never any part of the token
+	// itself. The old lines printed the token's first and last eight
+	// hex characters (long-token branch) and the whole token
+	// (short-token branch) into the log.
+	log.Printf("[3] Authenticated! caps=%v", authRes.Capabilities)
 
 	// Step 5: Send HMAC-protected intent
 	log.Println("[4] Sending intent: move_left (confidence=0.91)")

cmd/eipc-server/main.go

@@ -24,6 +24,11 @@ import (
 	"github.com/embeddedos-org/eipc/transport/tcp"
 )
 
+// postAuthIdleTimeout bounds how long an authenticated peer may stay
+// silent before the server drops its connection: without it, idle
+// connections hold a slot under the connection cap indefinitely.
+const postAuthIdleTimeout = 5 * time.Minute
+
 func main() {
 	addr := config.LoadListenAddr()
 	if len(os.Args) > 1 {
@@ -537,8 +542,11 @@ func handleConnection(
 
 	close(authDone) // Auth completed successfully
 
-	log.Printf("[AUTH] ACCEPTED: service=%s token=%s...%s caps=%v",
-		peer.ServiceID, peer.SessionToken[:8], peer.SessionToken[len(peer.SessionToken)-8:], peer.Capabilities)
+	// The session token is a credential: log only that auth succeeded
+	// and which capabilities were granted, never any part of the token
+	// itself. The old line printed the token's first and last eight
+	// hex characters into the log.
+	log.Printf("[AUTH] ACCEPTED: service=%s caps=%v", peer.ServiceID, peer.Capabilities)
 
 	if err := auditLogger.Log(audit.Entry{
 		RequestID: authMsg.RequestID,
@@ -584,8 +592,16 @@ func handleConnection(
 		return
 	}
 
-	// Message loop with idle timeout and capability enforcement
+	// Message loop with idle timeout and capability enforcement: the
+	// read deadline is re-armed before every Receive, so an
+	// authenticated peer that goes silent is dropped after
+	// postAuthIdleTimeout instead of holding its connection slot
+	// indefinitely.
 	for {
+		if err := endpoint.SetReadDeadline(time.Now().Add(postAuthIdleTimeout)); err != nil {
+			log.Printf("[CONN] failed to arm read deadline: %v", err)
+			return
+		}
 		msg, err := endpoint.Receive()
 		if err != nil {
 			log.Printf("[CONN] connection closed: %v", err)

core/endpoint.go

@@ -313,6 +313,14 @@ func (e *ServerEndpoint) Close() error {
 	return e.conn.Close()
 }
 
+// SetReadDeadline arms a read deadline on the underlying connection: the
+// next Receive fails once the deadline passes. The server's post-auth
+// loop re-arms it before every Receive, so an idle authenticated peer is
+// dropped instead of holding its connection slot indefinitely.
+func (e *ServerEndpoint) SetReadDeadline(deadline time.Time) error {
+	return e.conn.SetReadDeadline(deadline)
+}
+
 // RemoteAddr returns the remote address of the underlying connection.
 func (e *ServerEndpoint) RemoteAddr() string {
 	return e.conn.RemoteAddr()

core/endpoint_deadline_test.go

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 EoS Project
+
+package core
+
+import (
+	"errors"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/embeddedos-org/eipc/protocol"
+)
+
+func TestServerEndpointSetReadDeadline(t *testing.T) {
+	clientConn, serverConn := setupTCPPair(t)
+	defer clientConn.Close()
+	defer serverConn.Close()
+
+	serverEP := NewServerEndpoint(serverConn, protocol.DefaultCodec(), []byte("test-secret-key-for-hmac-256bit!"))
+
+	// A deadline already in the past: Receive must fail fast with a
+	// timeout instead of blocking until the peer speaks, so an idle
+	// authenticated peer cannot hold its connection slot forever.
+	if err := serverEP.SetReadDeadline(time.Now().Add(-time.Second)); err != nil {
+		t.Fatalf("SetReadDeadline: %v", err)
+	}
+	start := time.Now()
+	_, err := serverEP.Receive()
+	if err == nil {
+		t.Fatal("expected Receive to fail past its read deadline")
+	}
+	if time.Since(start) > 5*time.Second {
+		t.Errorf("Receive blocked %v past an expired deadline", time.Since(start))
+	}
+	var ne net.Error
+	if !errors.As(err, &ne) || !ne.Timeout() {
+		t.Errorf("expected a timeout error, got %T: %v", err, err)
+	}
+}

security/auth/identity.go

@@ -47,8 +47,15 @@ type Authenticator struct {
 	activeSessions    map[string]*PeerIdentity
 	pendingChallenges map[string]*Challenge // serviceID → pending challenge
 	sessionTTL        time.Duration
+	challengeTTL      time.Duration
+	allowLegacyAuth   bool
 }
 
+// DefaultChallengeTTL bounds how long a challenge-response round trip may
+// take. A challenge older than this is rejected, so a captured nonce
+// cannot be answered later.
+const DefaultChallengeTTL = 5 * time.Minute
+
 // NewAuthenticator creates an authenticator with the given shared secret.
 // knownServices maps service IDs to their allowed capability sets.
 func NewAuthenticator(sharedSecret []byte, knownServices map[string][]string) *Authenticator {
@@ -64,6 +71,7 @@ func NewAuthenticator(sharedSecret []byte, knownServices map[string][]string) *A
 		activeSessions:    make(map[string]*PeerIdentity),
 		pendingChallenges: make(map[string]*Challenge),
 		sessionTTL:        1 * time.Hour,
+		challengeTTL:      DefaultChallengeTTL,
 	}
 }
 
@@ -74,6 +82,25 @@ func (a *Authenticator) SetSessionTTL(ttl time.Duration) {
 	a.sessionTTL = ttl
 }
 
+// SetChallengeTTL configures how long a challenge stays valid for
+// VerifyResponse. A zero or negative TTL disables expiry checking; the
+// default is DefaultChallengeTTL.
+func (a *Authenticator) SetChallengeTTL(ttl time.Duration) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	a.challengeTTL = ttl
+}
+
+// SetAllowLegacyAuth opts in to the legacy no-secret Authenticate path.
+// It is off by default: Authenticate issues a session token on a service
+// ID alone, with no proof of the shared secret. Enable it only while
+// migrating an existing consumer to CreateChallenge/VerifyResponse.
+func (a *Authenticator) SetAllowLegacyAuth(enabled bool) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	a.allowLegacyAuth = enabled
+}
+
 // CreateChallenge generates a 32-byte nonce challenge for the given service ID.
 // Returns error if the service is unknown.
 func (a *Authenticator) CreateChallenge(serviceID string) (*Challenge, error) {
@@ -110,6 +137,13 @@ func (a *Authenticator) VerifyResponse(serviceID string, response []byte) (*Peer
 	}
 	delete(a.pendingChallenges, serviceID)
 
+	// Challenges are one-shot (deleted above before verifying) and
+	// time-bound: an old challenge is rejected even with a correct
+	// response, so a captured nonce cannot be answered later.
+	if a.challengeTTL > 0 && time.Since(challenge.CreatedAt) > a.challengeTTL {
+		return nil, fmt.Errorf("%w: challenge expired for %q", core.ErrAuth, serviceID)
+	}
+
 	// Compute expected response: HMAC-SHA256(sharedSecret, nonce)
 	mac := hmac.New(sha256.New, a.sharedSecret)
 	mac.Write(challenge.Nonce)
@@ -140,11 +174,22 @@ func (a *Authenticator) VerifyResponse(serviceID string, response []byte) (*Peer
 }
 
 // Authenticate validates a peer's service ID and returns a PeerIdentity
-// with a fresh session token. (Legacy simple auth, kept for backward compat.)
+// with a fresh session token.
+//
+// Legacy no-secret auth, kept only for migration: it issues a session on
+// a service ID alone, with no proof of the shared secret, so anyone who
+// knows (or guesses) a service ID can impersonate it. It is DISABLED by
+// default and must be opted into per authenticator with
+// SetAllowLegacyAuth(true). New consumers must use
+// CreateChallenge/VerifyResponse.
 func (a *Authenticator) Authenticate(serviceID string) (*PeerIdentity, error) {
 	a.mu.Lock()
 	defer a.mu.Unlock()
 
+	if !a.allowLegacyAuth {
+		return nil, fmt.Errorf("%w: legacy no-secret authentication is disabled for %q; use CreateChallenge/VerifyResponse", core.ErrAuth, serviceID)
+	}
+
 	capsSrc, ok := a.knownServices[serviceID]
 	if !ok {
 		return nil, fmt.Errorf("%w: unknown service %q", core.ErrAuth, serviceID)

security/auth/identity_binding_test.go

@@ -10,14 +10,12 @@ import (
 )
 
 func TestPeerIdentityBoundPeer_RoundTrip(t *testing.T) {
-	authenticator := NewAuthenticator([]byte("test-key-32-bytes-long-enough!!"), map[string][]string{
+	secret := []byte("test-key-32-bytes-long-enough!!")
+	authenticator := NewAuthenticator(secret, map[string][]string{
 		"ebot.client": {"ai:chat"},
 	})
 
-	peer, err := authenticator.Authenticate("ebot.client")
-	if err != nil {
-		t.Fatalf("Authenticate: %v", err)
-	}
+	peer := challengeAuth(t, authenticator, secret, "ebot.client")
 
 	bound := peer.BoundPeer()
 	if bound == nil {