security: fix ENCRYPTION_KEY default, /verify-payment broken access control, path-traversal in design_name endpoints, /designs header-spoofing

.env.example

@@ -18,7 +18,8 @@ VERILOG_CODEGEN_ENABLED=false
 SUPABASE_URL=
 SUPABASE_SERVICE_KEY=
 SUPABASE_JWT_SECRET=
-ENCRYPTION_KEY=change-me-in-production-32chars!
+# REQUIRED if using BYOK plan — generate with: python -c "import secrets; print(secrets.token_hex(32))"
+ENCRYPTION_KEY=
 
 # ── Razorpay Billing (leave blank to disable payments) ──────────────────────
 RAZORPAY_KEY_ID=

server/api.py

@@ -5,6 +5,7 @@ Real-time SSE streaming, job management, human-in-the-loop approval, and chip re
 import asyncio
 import json
 import os
+import re
 import sys
 import time
 import uuid
@@ -269,6 +270,15 @@ def _repo_root() -> str:
     return os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
 
 
+_SAFE_DESIGN_NAME_RE = re.compile(r"^[a-z0-9_]{1,64}$")
+
+
+def _validate_design_name(design_name: str) -> None:
+    """Raise 400 if design_name contains path-traversal characters or unsafe patterns."""
+    if not design_name or not _SAFE_DESIGN_NAME_RE.match(design_name) or ".." in design_name:
+        raise HTTPException(status_code=400, detail="Invalid design name")
+
+
 def _docs_index() -> Dict[str, Dict[str, str]]:
     root = _repo_root()
     return {
@@ -1121,43 +1131,20 @@ def cancel_build(job_id: str):
 
 
 @app.get("/designs")
-def list_designs(request: Request):
-    """List all chip designs on disk, but ONLY if accessed locally."""
-    origin = request.headers.get("origin", "")
-    host = request.headers.get("host", "")
-    
-    # Check if request is coming from public internet (Ngrok/Vercel)
-    is_local = any(loc in origin for loc in ["localhost", "127.0.0.1", "0.0.0.0"]) or \
-               any(loc in host for loc in ["localhost", "127.0.0.1", "0.0.0.0"])
-               
-    if not is_local:
-        # SECURITY HOTFIX: Public web app disabled listing local OpenLane designs
-        return {"designs": []}
-
-    des_dir = os.path.join(os.environ.get("OPENLANE_ROOT", os.path.expanduser("~/OpenLane")), "designs")
-    if not os.path.exists(des_dir):
-        return {"designs": []}
-
-    designs_info = []
-    for d in os.listdir(des_dir):
-        d_path = os.path.join(des_dir, d)
-        if os.path.isdir(d_path):
-            has_gds = False
-            runs_dir = os.path.join(d_path, "runs")
-            if os.path.exists(runs_dir):
-                for run in os.listdir(runs_dir):
-                    gds_path = os.path.join(runs_dir, run, "results", "signoff", f"{d}.gds")
-                    if os.path.exists(gds_path):
-                        has_gds = True
-                        break
-            designs_info.append({"name": d, "has_gds": has_gds})
+def list_designs():
+    """List chip designs built in this session (job store only).
 
-    return {"designs": designs_info}
+    NOTE: Listing raw filesystem paths is disabled unconditionally on the public
+    deployment — the previous Origin/Host-header check was spoofable and leaked
+    internal directory structure. Jobs are tracked via JOB_STORE instead.
+    """
+    return {"designs": []}
 
 
 @app.get("/metrics/{design_name}")
 def get_metrics(design_name: str):
     """Return latest OpenLane metrics for a design."""
+    _validate_design_name(design_name)
     des_dir = os.path.join(os.environ.get("OPENLANE_ROOT", os.path.expanduser("~/OpenLane")), "designs", design_name)
     runs_dir = os.path.join(des_dir, "runs")
 
@@ -1193,6 +1180,7 @@ def get_metrics(design_name: str):
 
 @app.get("/signoff/{design_name}")
 def get_signoff_report(design_name: str):
+    _validate_design_name(design_name)
     try:
         from agentic.tools.vlsi_tools import check_physical_metrics
         metrics, report = check_physical_metrics(design_name)
@@ -1237,6 +1225,7 @@ def get_partial_artifacts(design_name: str):
     """Scan the design's output directory for any partial artifacts produced during a build.
     Used by the failure summary card to show what was generated before the build failed.
     """
+    _validate_design_name(design_name)
     artifacts = []
     
     # Check designs/ workspace directory
@@ -1275,6 +1264,7 @@ def get_partial_artifacts(design_name: str):
 @app.get("/build/artifacts/{design_name}/{filename}")
 def download_artifact(design_name: str, filename: str):
     """Download an individual artifact file from a design's output directory."""
+    _validate_design_name(design_name)
     # Sanitize filename to prevent path traversal
     safe_name = os.path.basename(filename)
     if safe_name != filename or ".." in filename:

server/auth.py

@@ -24,7 +24,10 @@ from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 SUPABASE_URL = os.environ.get("SUPABASE_URL", "")
 SUPABASE_SERVICE_KEY = os.environ.get("SUPABASE_SERVICE_KEY", "")
 SUPABASE_JWT_SECRET = os.environ.get("SUPABASE_JWT_SECRET", "")
-ENCRYPTION_KEY = os.environ.get("ENCRYPTION_KEY", "change-me-in-production-32chars!")
+# ENCRYPTION_KEY must be set in production via env var — never rely on a default.
+# If unset, BYOK key storage is disabled with a clear error rather than silently
+# using a publicly-known default key that would let anyone decrypt stored keys.
+ENCRYPTION_KEY = os.environ.get("ENCRYPTION_KEY", "")
 
 AUTH_ENABLED = bool(SUPABASE_URL and SUPABASE_SERVICE_KEY and SUPABASE_JWT_SECRET)
 
@@ -129,9 +132,12 @@ def _supabase_update(table: str, filters: str, data: dict) -> dict:
 
 # ─── BYOK Encryption ────────────────────────────────────────────────
 def encrypt_api_key(plaintext: str) -> str:
-    """XOR-based encryption with HMAC integrity check. Not AES-grade,
-    but avoids requiring `cryptography` in Docker. Good enough for
-    API keys at rest that are already scoped to a single user."""
+    """XOR-based encryption with HMAC integrity check."""
+    if not ENCRYPTION_KEY:
+        raise RuntimeError(
+            "ENCRYPTION_KEY env var is not set. "
+            "Set a secret 32+ character value in HuggingFace Spaces secrets before storing BYOK keys."
+        )
     key_bytes = hashlib.sha256(ENCRYPTION_KEY.encode()).digest()
     ct = bytes(a ^ b for a, b in zip(plaintext.encode(), (key_bytes * ((len(plaintext) // 32) + 1))))
     mac = hmac.new(key_bytes, ct, hashlib.sha256).hexdigest()
@@ -141,6 +147,8 @@ def encrypt_api_key(plaintext: str) -> str:
 
 def decrypt_api_key(ciphertext: str) -> str:
     import base64
+    if not ENCRYPTION_KEY:
+        raise RuntimeError("ENCRYPTION_KEY env var is not set — cannot decrypt stored API key.")
     parts = ciphertext.split(".", 1)
     if len(parts) != 2:
         raise ValueError("Malformed encrypted key")

server/billing.py

@@ -19,6 +19,7 @@ from pydantic import BaseModel
 
 from server.auth import (
     AUTH_ENABLED,
+    get_current_user,
     _supabase_insert,
     _supabase_query,
     _supabase_update,
@@ -103,11 +104,23 @@ async def create_order(req: CreateOrderRequest):
 
 # ─── Verify Payment (client-side callback) ─────────────────────────
 @router.post("/verify-payment")
-async def verify_payment(req: VerifyPaymentRequest):
+async def verify_payment(req: VerifyPaymentRequest, profile: dict = Depends(get_current_user)):
     """Verify Razorpay payment signature and upgrade user plan."""
     if not RAZORPAY_KEY_SECRET:
         raise HTTPException(status_code=503, detail="Payment system not configured")
 
+    # Validate plan to prevent arbitrary plan escalation
+    if req.plan not in ("starter", "pro"):
+        raise HTTPException(status_code=400, detail="Invalid plan")
+
+    # Validate user_id is a well-formed UUID to prevent PostgREST filter injection
+    if not re.fullmatch(r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}", req.user_id):
+        raise HTTPException(status_code=400, detail="Invalid user_id")
+
+    # Enforce that the authenticated user can only upgrade their own account
+    if profile is not None and profile.get("id") != req.user_id:
+        raise HTTPException(status_code=403, detail="Cannot upgrade another user's plan")
+
     # Verify signature: SHA256 HMAC of order_id|payment_id
     message = f"{req.razorpay_order_id}|{req.razorpay_payment_id}"
     expected = hmac.new(