[koabula]

Problem

A contact share link names the user who shared it: the link carries that user's user_id, which is the fingerprint of their root key. When the client imported from the link, it fetched the identity bundle from the host behind the link and checked only that the bundle was consistent with itself. So the host, or anyone serving that URL, could return its own validly signed bundle, and the client would pin that root key as the contact.

Change

• contact_share::contact_share_url_user_id reads the user_id from both link forms:

  • the userId in a /v1/contact-share/{token} payload;
  • the {user_id} segment of /v1/shared-state/{user_id}/identity-bundle.

  It rejects malformed tokens and payloads, payloads for a service other than contact_share, and links that name no user. The token's HMAC is still checked only by the host.

• contact_workflows::fetch_identity_bundle_from_url is the single path for every import from a link: the desktop and Tauri share-link commands, and accepting a message request. It now reads the user_id before sending any request, and rejects a bundle whose user_id differs from it.

• Removed DesktopTransport::fetch_identity_bundle. It was unused, and it fetched a bundle with no URL rules and no verification.

Network behaviour is unchanged, except that a link naming no user is now rejected before any request. contracts/ and generated files are untouched.

Other ways a bundle arrives

I checked the other paths by which a bundle reaches the client; none needed a change:

• Lane rotations and announced bundles must match the peer's user_id.
• A refetch from identity_bundle_ref is checked against the requested user in the engine. The existing test fetched_identity_bundle_must_match_requested_user covers this.
• Within one user_id, the root key cannot change without a second preimage of the 128-bit fingerprint.

Tests

New unit tests:

• contact_share: user_id extraction from both link forms, plus the malformed, wrong-service and missing-user cases.
• contact_workflows, three async tests against a local server with real signed bundles:
  • a valid bundle of a different user is rejected, for both link forms;
  • the bundle of the named user is accepted;
  • a link that names no user fails before any request.

These were not built locally; CI is the first build.

🤖 Generated with Claude Code