stacklok / toolhive / 24185238500

65%

Build Type

push

github

Committed by web-flow

Commit Message

Add RestoreHijackPrevention and RestoreSession interface stub (#4405)

* Add RestoreHijackPrevention and RestoreSession interface stub (RC-15, #4216)

Add the infrastructure needed to reconstruct hijack-prevention state from
Redis-persisted metadata, enabling cross-pod token validation in horizontal
scaling scenarios.

- security.go: Add RestoreHijackPrevention(), the restore counterpart to
  PreventSessionHijacking(). Rebuilds a hijackPreventionDecorator from
  persisted tokenHash + tokenSaltHex + hmacSecret without re-hashing a
  live token. Returns errors for nil session, missing salt on authenticated
  sessions, and invalid hex salt.

- factory.go: Add RestoreSession() to the MultiSessionFactory interface with
  full doc comment (backend ID parsing, session hint lookup, routing-table
  rebuild, hijack-prevention re-application). Add a stub implementation on
  defaultMultiSessionFactory (returns "not yet implemented"); full
  reconnection logic is deferred. Document the cross-replica HMAC secret
  consistency requirement on defaultHMACSecret.

- decorating_factory.go: Forward RestoreSession() to the base factory;
  decorators are not re-applied during restore.

- mocks/mock_factory.go: Regenerate mock to include RestoreSession().

- restore_test.go: Unit tests covering nil session, missing salt, invalid
  hex, anonymous session round-trip, authenticated store→restore→validate
  round-trip, and cross-replica secret mismatch.

Closes #4216.

* changes from rebase

---------

Co-authored-by: taskbot <taskbot@users.noreply.github.com>

Coverage Stats

13 of 13 new or added lines in 3 files covered. (100.0%)

45 existing lines in 7 files now uncovered.

55580 of 85523 relevant lines covered (64.99%)

62.82 hits per line