fix(protocol): harden gateway contract validation

tools/generate.py

@@ -125,6 +125,8 @@ def go_validation(definition: dict[str, Any]) -> list[str]:
                 lines.append(f"\tif len(v.{field}) < {prop['minLength']} && v.{field} != \"\" {{ violations = append(violations, FieldViolation{{Field: \"{prop_name}\", Code: \"min_length\"}}) }}")
             if "maxLength" in prop:
                 lines.append(f"\tif len(v.{field}) > {prop['maxLength']} {{ violations = append(violations, FieldViolation{{Field: \"{prop_name}\", Code: \"max_length\"}}) }}")
+            if "x-max-bytes" in prop:
+                lines.append(f"\tif len(v.{field}) > {prop['x-max-bytes']} {{ violations = append(violations, FieldViolation{{Field: \"{prop_name}\", Code: \"max_bytes\"}}) }}")
             if "const" in prop:
                 lines.append(f"\tif v.{field} != \"{prop['const']}\" && v.{field} != \"\" {{ violations = append(violations, FieldViolation{{Field: \"{prop_name}\", Code: \"invalid_value\"}}) }}")
             if "enum" in prop:
@@ -135,6 +137,8 @@ def go_validation(definition: dict[str, Any]) -> list[str]:
                     '\tif v.%s != "" { if parsed, err := time.Parse(time.RFC3339Nano, v.%s); err != nil || parsed.UTC().Format(time.RFC3339Nano) != v.%s { violations = append(violations, FieldViolation{Field: "%s", Code: "invalid_time"}) } }'
                     % (field, field, field, prop_name)
                 )
+            if prop.get("format") == "base64url":
+                lines.append(f"\tif v.{field} != \"\" {{ if _, err := base64.RawURLEncoding.Strict().DecodeString(v.{field}); err != nil {{ violations = append(violations, FieldViolation{{Field: \"{prop_name}\", Code: \"invalid_format\"}}) }} }}")
         if prop.get("type") == "integer":
             if "minimum" in prop:
                 lines.append(f"\tif v.{field} != 0 && v.{field} < {prop['minimum']} {{ violations = append(violations, FieldViolation{{Field: \"{prop_name}\", Code: \"minimum\"}}) }}")
@@ -167,6 +171,7 @@ def generate_go(defs: dict[str, dict[str, Any]], schema_hash: str, version: str,
         "",
         "import (",
         "\"bytes\"",
+        "\"encoding/base64\"",
         "\"encoding/json\"",
         "\"errors\"",
         "\"fmt\"",
@@ -223,7 +228,7 @@ def generate_go(defs: dict[str, dict[str, Any]], schema_hash: str, version: str,
                 % (prop_name, prop_name)
             )
         for prop_name, prop in defs[name].get("properties", {}).items():
-            if "x-max-bytes" in prop:
+            if "x-max-bytes" in prop and prop.get("type") != "string":
                 out.append(
                     '\tif raw, ok := fields["%s"]; ok && len(raw) > %d { return value, ValidationError{Violations: []FieldViolation{{Field: "%s", Code: "max_bytes"}}} }'
                     % (prop_name, prop["x-max-bytes"], prop_name)
@@ -322,11 +327,15 @@ def rust_validation(definition: dict[str, Any]) -> list[str]:
                 lines.append(f"        {prefix}if !{value}.is_empty() && {value}.len() < {prop['minLength']} {{ return Err(ValidationError::new(\"{prop_name}\", \"min_length\")); }}")
             if "maxLength" in prop:
                 lines.append(f"        {prefix}if {value}.len() > {prop['maxLength']} {{ return Err(ValidationError::new(\"{prop_name}\", \"max_length\")); }}")
+            if "x-max-bytes" in prop:
+                lines.append(f"        {prefix}if {value}.as_bytes().len() > {prop['x-max-bytes']} {{ return Err(ValidationError::new(\"{prop_name}\", \"max_bytes\")); }}")
             if "const" in prop:
                 lines.append(f"        {prefix}if {value} != \"{prop['const']}\" {{ return Err(ValidationError::new(\"{prop_name}\", \"invalid_value\")); }}")
             if "enum" in prop:
                 allowed = " && ".join(f'{value} != \"{item}\"' for item in prop["enum"])
                 lines.append(f"        {prefix}if {allowed} {{ return Err(ValidationError::new(\"{prop_name}\", \"invalid_value\")); }}")
+            if prop.get("format") == "base64url":
+                lines.append(f"        {prefix}if !valid_base64_url({value}.as_str()) {{ return Err(ValidationError::new(\"{prop_name}\", \"invalid_format\")); }}")
         if prop.get("type") == "integer":
             if "minimum" in prop:
                 lines.append(f"        {prefix}if {value} < {prop['minimum']} {{ return Err(ValidationError::new(\"{prop_name}\", \"minimum\")); }}")
@@ -369,6 +378,27 @@ def generate_rust(defs: dict[str, dict[str, Any]], schema_hash: str, compatibili
         "pub struct ValidationError { pub field: &'static str, pub code: &'static str }",
         "impl ValidationError { pub const fn new(field: &'static str, code: &'static str) -> Self { Self { field, code } } }",
         "",
+        "fn base64url_value(value: u8) -> Option<u8> {",
+        "    match value {",
+        "        b'A'..=b'Z' => Some(value - b'A'),",
+        "        b'a'..=b'z' => Some(value - b'a' + 26),",
+        "        b'0'..=b'9' => Some(value - b'0' + 52),",
+        "        b'-' => Some(62),",
+        "        b'_' => Some(63),",
+        "        _ => None,",
+        "    }",
+        "}",
+        "fn valid_base64_url(value: &str) -> bool {",
+        "    let bytes = value.as_bytes();",
+        "    if bytes.is_empty() || bytes.iter().any(|byte| base64url_value(*byte).is_none()) { return false; }",
+        "    match bytes.len() % 4 {",
+        "        0 => true,",
+        "        2 => base64url_value(*bytes.last().unwrap()).unwrap() & 0x0f == 0,",
+        "        3 => base64url_value(*bytes.last().unwrap()).unwrap() & 0x03 == 0,",
+        "        _ => false,",
+        "    }",
+        "}",
+        "",
     ]
     for name in sorted(defs):
         definition = defs[name]
@@ -451,6 +481,8 @@ def swift_validation(definition: dict[str, Any]) -> list[str]:
                 lines.append(f"        {prefix}if !{value}.isEmpty && {value}.utf8.count < {prop['minLength']} {{ throw ContractValidationError(field: \"{prop_name}\", code: \"min_length\") }}")
             if "maxLength" in prop:
                 lines.append(f"        {prefix}if {value}.utf8.count > {prop['maxLength']} {{ throw ContractValidationError(field: \"{prop_name}\", code: \"max_length\") }}")
+            if "x-max-bytes" in prop:
+                lines.append(f"        {prefix}if {value}.utf8.count > {prop['x-max-bytes']} {{ throw ContractValidationError(field: \"{prop_name}\", code: \"max_bytes\") }}")
             if "const" in prop:
                 lines.append(f"        {prefix}if {value} != \"{prop['const']}\" {{ throw ContractValidationError(field: \"{prop_name}\", code: \"invalid_value\") }}")
             if "enum" in prop:
@@ -458,6 +490,8 @@ def swift_validation(definition: dict[str, Any]) -> list[str]:
                 lines.append(f"        {prefix}if ![{allowed}].contains({value}) {{ throw ContractValidationError(field: \"{prop_name}\", code: \"invalid_value\") }}")
             if prop.get("format") == "date-time":
                 lines.append(f"        {prefix}if ISO8601DateFormatter().date(from: {value}) == nil {{ throw ContractValidationError(field: \"{prop_name}\", code: \"invalid_time\") }}")
+            if prop.get("format") == "base64url":
+                lines.append(f"        {prefix}if !validBase64URL({value}) {{ throw ContractValidationError(field: \"{prop_name}\", code: \"invalid_format\") }}")
         if prop.get("type") == "integer":
             if "minimum" in prop:
                 lines.append(f"        {prefix}if {value} < {prop['minimum']} {{ throw ContractValidationError(field: \"{prop_name}\", code: \"minimum\") }}")
@@ -497,6 +531,15 @@ def generate_swift(defs: dict[str, dict[str, Any]], schema_hash: str, compatibil
         f'public let nMinus2WireVersion = "{compatibility["n_minus_2"]}"',
         "public struct ContractValidationError: Error, Equatable { public let field: String; public let code: String }",
         "private struct AnyCodingKey: CodingKey { let stringValue: String; let intValue: Int?; init?(stringValue: String) { self.stringValue = stringValue; self.intValue = nil }; init?(intValue: Int) { self.stringValue = String(intValue); self.intValue = intValue } }",
+        "private func validBase64URL(_ value: String) -> Bool {",
+        "    guard !value.isEmpty, value.utf8.allSatisfy({ byte in",
+        "        (byte >= 65 && byte <= 90) || (byte >= 97 && byte <= 122) || (byte >= 48 && byte <= 57) || byte == 45 || byte == 95",
+        "    }) else { return false }",
+        "    let padding = String(repeating: \"=\", count: (4 - value.utf8.count % 4) % 4)",
+        "    let standard = value.replacingOccurrences(of: \"-\", with: \"+\").replacingOccurrences(of: \"_\", with: \"/\") + padding",
+        "    guard let decoded = Data(base64Encoded: standard) else { return false }",
+        "    return decoded.base64EncodedString().replacingOccurrences(of: \"+\", with: \"-\").replacingOccurrences(of: \"/\", with: \"_\").replacingOccurrences(of: \"=\", with: \"\") == value",
+        "}",
         "",
     ]
     for name in sorted(defs):