fix(control-panel): sign strict goal approvals via oidc

infra/local-prod/idp/mock_idp.py

@@ -1,5 +1,6 @@
 #!/usr/bin/env python3
 import json
+import hmac
 import os
 import time
 import uuid
@@ -18,6 +19,7 @@ DEFAULT_GROUPS = [g for g in os.environ.get("CASAN_IDP_GROUPS", "casan-org-admin
 KID = "casan-local-prod-idp"
 KEY = rsa.generate_private_key(public_exponent=65537, key_size=2048)
 CODES = {}
+APPROVAL_SIGNER_TOKEN = os.environ.get("CASAN_APPROVAL_SIGNER_TOKEN", "")
 
 
 def b64u_int(value: int) -> str:
@@ -122,6 +124,10 @@ class Handler(BaseHTTPRequestHandler):
         raw = self.rfile.read(size) or b"{}"
         ctype = self.headers.get("Content-Type", "")
         if "application/json" in ctype:
+            supplied_token = self.headers.get("X-CASAN-Approval-Signer-Token", "")
+            if not APPROVAL_SIGNER_TOKEN or not hmac.compare_digest(supplied_token, APPROVAL_SIGNER_TOKEN):
+                self.send_json(401, {"error": "approval_signer_unauthorized"})
+                return
             try:
                 payload = json.loads(raw)
             except json.JSONDecodeError:
@@ -136,6 +142,7 @@ class Handler(BaseHTTPRequestHandler):
                 "action": payload.get("action", "deploy"),
                 "actor": payload.get("actor", "alice"),
                 "input_sha256": payload.get("input_sha256", ""),
+                "jti": uuid.uuid4().hex,
                 "iat": now,
                 "exp": now + int(payload.get("ttl_s", 300)),
             }