audit 2

Author: ehsan6sha

Cargo.lock

@@ -42,6 +42,8 @@ reqwest = { workspace = true, features = ["json", "multipart"] }
 axum = { workspace = true }
 base64 = { workspace = true }
 md-5 = { workspace = true }
+blake3 = { workspace = true }
+hex = { workspace = true }
 
 [[example]]
 name = "basic_usage"

Cargo.toml

@@ -262,6 +262,44 @@ cargo run --example flat_namespace_demo
 - Export/backup secret keys securely
 - Lost keys = lost data (no recovery possible)
 
+### Privacy Notice
+
+⚠️ **Important**: For private data, always use the **Encrypted Client SDK** (`EncryptedClient`).
+
+Raw S3 tools (AWS CLI, boto3) do NOT encrypt data - they upload plaintext that gateway operators can see.
+
+**What's encrypted** (with EncryptedClient):
+- ✅ File content
+- ✅ File names (FlatNamespace mode)
+- ✅ Directory structure
+- ✅ User IDs (hashed)
+
+**What remains visible**:
+- ⚠️ Bucket names
+- ⚠️ Approximate file sizes
+- ⚠️ Request timestamps
+
+See [docs/PRIVACY.md](docs/PRIVACY.md) for full privacy policy.
+
+## Production Deployment
+
+For production Ubuntu deployments with security hardening:
+
+```bash
+# Download and run the installer
+curl -fsSL https://raw.githubusercontent.com/functionland/fula-api/main/install.sh | sudo bash
+```
+
+The installer will:
+- Install Docker and dependencies
+- Configure nginx with TLS (Let's Encrypt)
+- Set up rate limiting and fail2ban
+- Configure firewall (UFW)
+- Create systemd service
+- Optionally set up local IPFS node
+
+See [install.sh](install.sh) for details.
+
 ## License
 
 Licensed under either of:

README.md

@@ -57,6 +57,7 @@ tracing-subscriber = { workspace = true }
 uuid = { workspace = true }
 base64 = { workspace = true }
 hex = { workspace = true }
+blake3 = { workspace = true }
 urlencoding = "2.1"
 url = "2.5"
 mime = "0.3"

crates/fula-cli/Cargo.toml

@@ -99,13 +99,11 @@ pub fn claims_to_session(claims: Claims) -> UserSession {
         .map(|s| s.to_string())
         .collect();
 
-    UserSession {
-        user_id: claims.sub,
-        display_name: claims.name,
-        scopes,
-        expires_at: DateTime::from_timestamp(claims.exp, 0)
-            .unwrap_or_else(|| Utc::now() + Duration::hours(1)),
-    }
+    let expires_at = DateTime::from_timestamp(claims.exp, 0)
+        .unwrap_or_else(|| Utc::now() + Duration::hours(1));
+
+    // Security audit fix A3: Use UserSession::new() to auto-hash user ID
+    UserSession::new(claims.sub, claims.name, scopes, expires_at)
 }
 
 /// Extract bearer token from Authorization header
@@ -129,12 +127,13 @@ pub fn anonymous_user_id() -> String {
 
 /// Create a development/test session
 pub fn dev_session() -> UserSession {
-    UserSession {
-        user_id: "dev-user".to_string(),
-        display_name: Some("Development User".to_string()),
-        scopes: vec!["storage:*".to_string()],
-        expires_at: Utc::now() + Duration::days(365),
-    }
+    // Security audit fix A3: Use UserSession::new() to auto-hash user ID
+    UserSession::new(
+        "dev-user".to_string(),
+        Some("Development User".to_string()),
+        vec!["storage:*".to_string()],
+        Utc::now() + Duration::days(365),
+    )
 }
 
 #[cfg(test)]

crates/fula-cli/src/auth.rs

@@ -22,8 +22,9 @@ pub async fn create_bucket(
         return Err(ApiError::s3(S3ErrorCode::AccessDenied, "Write access required"));
     }
 
-    let owner = Owner::new(&session.user_id)
-        .with_display_name(session.display_name.unwrap_or_default());
+    // Security audit fix A3: Use hashed user ID for privacy
+    let owner = Owner::new(&session.hashed_user_id)
+        .with_display_name(session.display_name.clone().unwrap_or_default());
 
     state.bucket_manager.create_bucket(bucket.clone(), owner).await?;
 
@@ -44,11 +45,11 @@ pub async fn delete_bucket(
         return Err(ApiError::s3(S3ErrorCode::AccessDenied, "Write access required"));
     }
 
-    // Check ownership
+    // Check ownership (Security audit fix A3: compare hashed IDs)
     let metadata = state.bucket_manager.get_bucket_metadata(&bucket)
         .ok_or_else(|| ApiError::s3(S3ErrorCode::NoSuchBucket, "Bucket not found"))?;
 
-    if metadata.owner_id != session.user_id && !session.has_scope("admin") {
+    if !session.can_access_bucket(&metadata.owner_id) {
         return Err(ApiError::s3(S3ErrorCode::AccessDenied, "Not bucket owner"));
     }
 

crates/fula-cli/src/handlers/bucket.rs

@@ -57,10 +57,11 @@ pub async fn create_multipart_upload(
         }
     }
 
+    // Security audit fix A3: Use hashed user ID
     let upload = state.multipart_manager.create_upload_with_metadata(
         bucket.clone(),
         key.clone(),
-        session.user_id.clone(),
+        session.hashed_user_id.clone(),
         content_type,
         metadata,
     );

crates/fula-cli/src/handlers/multipart.rs

@@ -378,9 +378,10 @@ pub async fn copy_object(
         ))?;
 
     // Copy to destination
+    // Security audit fix A3: Use hashed user ID
     let mut dest_metadata = source_metadata.clone();
     dest_metadata.last_modified = chrono::Utc::now();
-    dest_metadata.owner_id = Some(session.user_id.clone());
+    dest_metadata.owner_id = Some(session.hashed_user_id.clone());
 
     let mut dest_bucket_handle = state.bucket_manager.open_bucket(&dest_bucket).await?;
 

crates/fula-cli/src/handlers/object.rs

@@ -18,15 +18,17 @@ pub async fn list_buckets(
     let buckets = state.bucket_manager.list_buckets();
 
     // Filter to buckets owned by this user (or show all for admin)
+    // Security audit fix A3: Compare using hashed user IDs
     let user_buckets: Vec<_> = buckets
         .into_iter()
-        .filter(|b| b.owner_id == session.user_id || session.has_scope("admin"))
+        .filter(|b| session.can_access_bucket(&b.owner_id))
         .map(|b| (b.name, b.created_at))
         .collect();
 
+    // Return hashed user ID in XML for privacy (Security audit fix A3)
     let xml_response = xml::list_all_my_buckets_result(
-        &session.user_id,
-        session.display_name.as_deref().unwrap_or(&session.user_id),
+        &session.hashed_user_id,
+        session.display_name.as_deref().unwrap_or("User"),
         &user_buckets,
     );
 

crates/fula-cli/src/handlers/service.rs

@@ -2,6 +2,7 @@
 
 use crate::config::GatewayConfig;
 use crate::multipart::MultipartManager;
+use blake3::Hasher;
 use dashmap::DashMap;
 use fula_blockstore::{
     FlexibleBlockStore, IpfsPinningBlockStore, IpfsPinningConfig, MemoryBlockStore,
@@ -10,6 +11,17 @@ use fula_core::BucketManager;
 use std::sync::Arc;
 use tracing::{info, warn};
 
+/// Hash a user ID for privacy (Security audit fix A3)
+/// This prevents exposing raw user IDs (e.g., email addresses) in stored metadata
+pub fn hash_user_id(user_id: &str) -> String {
+    let mut hasher = Hasher::new();
+    hasher.update(b"fula:user_id:");  // Domain separation
+    hasher.update(user_id.as_bytes());
+    let hash = hasher.finalize();
+    // Use first 16 bytes (128 bits) encoded as hex for reasonable uniqueness
+    hex::encode(&hash.as_bytes()[..16])
+}
+
 /// Application state shared across handlers
 pub struct AppState {
     /// Gateway configuration
@@ -95,6 +107,8 @@ impl AppState {
 pub struct UserSession {
     /// User ID (from JWT sub claim)
     pub user_id: String,
+    /// Hashed user ID for storage (Security audit fix A3)
+    pub hashed_user_id: String,
     /// Display name
     pub display_name: Option<String>,
     /// Scopes
@@ -104,6 +118,18 @@ pub struct UserSession {
 }
 
 impl UserSession {
+    /// Create a new user session with automatic ID hashing
+    pub fn new(user_id: String, display_name: Option<String>, scopes: Vec<String>, expires_at: chrono::DateTime<chrono::Utc>) -> Self {
+        let hashed_user_id = hash_user_id(&user_id);
+        Self {
+            user_id,
+            hashed_user_id,
+            display_name,
+            scopes,
+            expires_at,
+        }
+    }
+
     /// Check if the session has expired
     pub fn is_expired(&self) -> bool {
         chrono::Utc::now() > self.expires_at
@@ -130,7 +156,8 @@ impl UserSession {
     }
 
     /// Check if user can access a bucket (owner or admin)
+    /// Security audit fix A3: Uses hashed user ID for comparison
     pub fn can_access_bucket(&self, bucket_owner_id: &str) -> bool {
-        self.user_id == bucket_owner_id || self.is_admin()
+        self.hashed_user_id == bucket_owner_id || self.is_admin()
     }
 }