v0.0.41 - Fix activity log label for index whitelist denials — shows 'DENIED:index-not-approved' instead of 'DENIED:no-match'

src/main.c

@@ -412,6 +412,9 @@ typedef struct {
 } caller_identity_t;
 
 /* Server context */
+#define INDEX_WHITELIST_MAX 256
+#define INDEX_WHITELIST_BITMAP_SIZE (INDEX_WHITELIST_MAX / 8)
+
 typedef struct {
     char socket_name[SERVER_SOCKET_NAME_MAX]; /* abstract namespace name (without \0 prefix) */
     char last_error[256];
@@ -424,6 +427,9 @@ typedef struct {
     int socket_name_explicit;
     int auth_mode;
     int auth_skew_seconds;
+    int bridge_source_trusted;
+    int index_whitelist_active;
+    unsigned char index_whitelist[INDEX_WHITELIST_BITMAP_SIZE];
 } server_ctx_t;
 
 /* Initialize server context. socket_name is the abstract namespace name (e.g. "nsigner").
@@ -457,6 +463,9 @@ void server_set_prompt_always_allow(int enabled);
 /* Mark the unix listener as a trusted bridge socket (qrexec source preamble) */
 void server_set_bridge_source_trusted(server_ctx_t *ctx, int enabled);
 
+/* Set the nostr_index whitelist from a spec string ("all", "1,3,4", "0-3", "0-3,7,9") */
+int server_set_index_whitelist(server_ctx_t *ctx, const char *spec);
+
 /* Configure non-interactive prompt fallback: -1 disabled, POLICY_ALLOW, or POLICY_DENY */
 void server_set_noninteractive_prompt_default(int decision);
 
@@ -494,8 +503,8 @@ int socket_name_random(char *out, size_t out_len);
 /* Version information (auto-updated by build/version tooling) */
 #define NSIGNER_VERSION_MAJOR 0
 #define NSIGNER_VERSION_MINOR 0
-#define NSIGNER_VERSION_PATCH 37
-#define NSIGNER_VERSION "v0.0.37"
+#define NSIGNER_VERSION_PATCH 41
+#define NSIGNER_VERSION "v0.0.41"
 
 
 /* NSIGNER_HEADERLESS_DECLS_END */
@@ -799,6 +808,8 @@ static void print_usage(const char *program_name) {
     tui_print("  --mnemonic-fd N     Read mnemonic from inherited fd N (one line) at startup");
     tui_print("  --allow-all, -A     Allow all policy prompts for this server session");
     tui_print("  --bridge-source-trusted  Accept qrexec_source preamble on unix connections (bridge mode)");
+    tui_print("  --allow-index SPEC  Restrict which nostr_index values this session can access");
+    tui_print("                      SPEC: 'all' (default), '1,3,4', '0-3', or '0-3,7,9'");
 }
 
 static int extract_nsigner_socket_from_proc_line(const char *line,
@@ -1615,9 +1626,7 @@ static int prompt_transport_selection(void) {
                (selected & TRANSPORT_QREXEC_BRIDGE) ? "x" : " ");
         printf("  [%s] 3. TCP listener (FIPS mesh or local network)\n",
                (selected & TRANSPORT_TCP) ? "x" : " ");
-        printf("  [%s] 4. Qrexec one-shot (legacy, one request per invocation)\n",
-               (selected & TRANSPORT_QREXEC_ONESHOT) ? "x" : " ");
-        printf("\n  [a] select all (except 4)    Enter = confirm\n");
+        printf("\n  [a] select all    Enter = confirm\n");
         printf("> ");
         fflush(stdout);
 
@@ -1640,15 +1649,6 @@ static int prompt_transport_selection(void) {
                 printf("At least one transport must be selected.\n");
                 continue;
             }
-            /* Qrexec one-shot is mutually exclusive with persistent listeners */
-            if ((selected & TRANSPORT_QREXEC_ONESHOT) && (selected & ~TRANSPORT_QREXEC_ONESHOT)) {
-                printf("Qrexec one-shot cannot combine with other transports. Deselecting it.\n");
-                selected &= ~TRANSPORT_QREXEC_ONESHOT;
-                if (selected == 0) {
-                    selected = TRANSPORT_UNIX;
-                }
-                continue;
-            }
             break;
         }
 
@@ -1663,16 +1663,67 @@ static int prompt_transport_selection(void) {
             selected ^= TRANSPORT_QREXEC_BRIDGE;
         } else if (input[0] == '3') {
             selected ^= TRANSPORT_TCP;
-        } else if (input[0] == '4') {
-            selected ^= TRANSPORT_QREXEC_ONESHOT;
         } else {
-            printf("Invalid input. Type 1-4, 'a', or Enter to confirm.\n");
+            printf("Invalid input. Type 1-3, 'a', or Enter to confirm.\n");
         }
     }
 
     return selected;
 }
 
+/*
+ * Interactive index whitelist prompt.
+ * Shown after transport selection when no --allow-index flag was given.
+ * Returns a malloc'd spec string (caller must free), or NULL for "all".
+ */
+static char *prompt_index_whitelist(void) {
+    char input[256];
+
+    for (;;) {
+        tui_render_content_screen(NULL, "Index whitelist — restrict which nostr_index values this session can access");
+        printf("Enter allowed indices, or press Enter for 'all' (no restriction):\n\n");
+        printf("  Examples:\n");
+        printf("    all          (default — allow all indices)\n");
+        printf("    0            (only index 0)\n");
+        printf("    0,1,3        (specific indices)\n");
+        printf("    0-3          (range 0 through 3)\n");
+        printf("    0,2-3,7      (mixed list and ranges)\n");
+        printf("\n  Enter = all\n");
+        printf("> ");
+        fflush(stdout);
+
+        if (read_line_stdin(input, sizeof(input)) != 0) {
+            return NULL;
+        }
+
+        /* Trim trailing whitespace */
+        {
+            size_t len = strlen(input);
+            while (len > 0 && (input[len-1] == '\n' || input[len-1] == '\r' ||
+                               input[len-1] == ' ' || input[len-1] == '\t')) {
+                input[--len] = '\0';
+            }
+        }
+
+        if (input[0] == '\0') {
+            /* Enter pressed — default to "all" */
+            return NULL;
+        }
+
+        /* Validate by parsing into a temp whitelist */
+        {
+            server_ctx_t tmp;
+            memset(&tmp, 0, sizeof(tmp));
+            if (server_set_index_whitelist(&tmp, input) != 0) {
+                printf("Invalid spec: '%s'. Try again or press Enter for 'all'.\n", input);
+                continue;
+            }
+        }
+
+        return strdup(input);
+    }
+}
+
 int main(int argc, char *argv[]) {
     mnemonic_state_t mnemonic;
     role_table_t role_table;
@@ -1696,6 +1747,7 @@ int main(int argc, char *argv[]) {
     int auth_skew_seconds = AUTH_DEFAULT_SKEW_SECONDS;
     int allow_all = 0;
     int bridge_source_trusted = 0;
+    const char *allow_index_spec = NULL;
     mnemonic_source_t mnemonic_source = { MNEMONIC_SOURCE_TUI, -1 };
 
     while (argi < argc) {
@@ -1806,6 +1858,15 @@ int main(int argc, char *argv[]) {
             argi += 1;
             continue;
         }
+        if (strcmp(argv[argi], "--allow-index") == 0) {
+            if (argi + 1 >= argc) {
+                fprintf(stderr, "Missing value for %s\n", argv[argi]);
+                return 1;
+            }
+            allow_index_spec = argv[argi + 1];
+            argi += 2;
+            continue;
+        }
         break;
     }
 
@@ -1961,31 +2022,33 @@ int main(int argc, char *argv[]) {
             return 1;
         }
 
-        /* Qrexec one-shot: use existing single-listener path */
-        if (transport_mask & TRANSPORT_QREXEC_ONESHOT) {
-            listen_mode = NSIGNER_LISTEN_QREXEC;
-            listen_mode_explicit = 1;
-        } else {
-            /* Persistent listeners — configure from menu selection */
-            multi_listen = 1;
-
-            /* Unix socket (with or without bridge-source-trusted) */
-            if (transport_mask & (TRANSPORT_UNIX | TRANSPORT_QREXEC_BRIDGE)) {
-                /* Use fixed name "nsigner" for scripted access */
-                socket_name = "nsigner";
-                socket_name_explicit = 1;
-                listen_mode = NSIGNER_LISTEN_UNIX;
-                listen_target = socket_name;
-                if (transport_mask & TRANSPORT_QREXEC_BRIDGE) {
-                    bridge_source_trusted = 1;
-                }
+        /* Index whitelist prompt (only if --allow-index wasn't given on CLI) */
+        if (allow_index_spec == NULL) {
+            char *wl_spec = prompt_index_whitelist();
+            if (wl_spec != NULL) {
+                allow_index_spec = wl_spec;  /* will be freed at program exit */
             }
+        }
 
-            /* TCP listener */
-            if (transport_mask & TRANSPORT_TCP) {
-                /* Will be started as a second listener */
+        /* Persistent listeners — configure from menu selection */
+        multi_listen = 1;
+
+        /* Unix socket (with or without bridge-source-trusted) */
+        if (transport_mask & (TRANSPORT_UNIX | TRANSPORT_QREXEC_BRIDGE)) {
+            /* Use fixed name "nsigner" for scripted access */
+            socket_name = "nsigner";
+            socket_name_explicit = 1;
+            listen_mode = NSIGNER_LISTEN_UNIX;
+            listen_target = socket_name;
+            if (transport_mask & TRANSPORT_QREXEC_BRIDGE) {
+                bridge_source_trusted = 1;
             }
         }
+
+        /* TCP listener */
+        if (transport_mask & TRANSPORT_TCP) {
+            /* Will be started as a second listener */
+        }
     }
 
     if (listen_mode == NSIGNER_LISTEN_UNIX && !socket_name_explicit) {
@@ -2033,6 +2096,16 @@ int main(int argc, char *argv[]) {
    if (bridge_source_trusted) {
        server_set_bridge_source_trusted(&server, 1);
    }
+   if (allow_index_spec != NULL) {
+       if (server_set_index_whitelist(&server, allow_index_spec) != 0) {
+           fprintf(stderr, "Invalid --allow-index spec: %s\n", allow_index_spec);
+           fprintf(stderr, "Expected: 'all', '1,3,4', '0-3', or '0-3,7,9'\n");
+           crypto_wipe(&key_store);
+           nostr_cleanup();
+           mnemonic_unload(&mnemonic);
+           return 1;
+       }
+   }
    if (server_start(&server) != 0) {
         if (listen_mode == NSIGNER_LISTEN_UNIX) {
             fprintf(stderr, "Failed to start server on @%s: %s\n", socket_name, server_last_error(&server));
@@ -2065,6 +2138,9 @@ int main(int argc, char *argv[]) {
                     auth_skew_seconds,
                     &dispatcher,
                     &policy);
+        if (allow_index_spec != NULL) {
+            server_set_index_whitelist(&servers[tcp_server_idx], allow_index_spec);
+        }
         if (server_start(&servers[tcp_server_idx]) != 0) {
             fprintf(stderr, "Failed to start TCP server on %s: %s\n",
                     tcp_target, server_last_error(&servers[tcp_server_idx]));

src/server.c

@@ -415,6 +415,9 @@ typedef struct {
 } caller_identity_t;
 
 /* Server context */
+#define INDEX_WHITELIST_MAX 256  /* nostr_index range 0-255 */
+#define INDEX_WHITELIST_BITMAP_SIZE (INDEX_WHITELIST_MAX / 8)  /* 32 bytes */
+
 typedef struct {
     char socket_name[SERVER_SOCKET_NAME_MAX]; /* abstract namespace name (without \0 prefix) */
     char last_error[256];
@@ -428,6 +431,8 @@ typedef struct {
     int auth_mode;
     int auth_skew_seconds;
     int bridge_source_trusted;  /* when set, unix connections send a qrexec_source preamble */
+    int index_whitelist_active;  /* 1 if index whitelist is set (not "all") */
+    unsigned char index_whitelist[INDEX_WHITELIST_BITMAP_SIZE];  /* bitmap of allowed nostr_index values */
 } server_ctx_t;
 
 /* Initialize server context. socket_name is the abstract namespace name (e.g. "nsigner").
@@ -444,6 +449,15 @@ void server_init(server_ctx_t *ctx, const char *socket_name, int socket_name_exp
  * identity is composed as qubes:<vm>. */
 void server_set_bridge_source_trusted(server_ctx_t *ctx, int enabled);
 
+/* Set the nostr_index whitelist from a parsed spec string.
+ * Spec format: "all" (no restriction), or comma-separated list of
+ * indices and ranges, e.g. "1,3,4" or "0-3" or "0-3,7,9".
+ * Returns 0 on success, -1 on parse error. */
+int server_set_index_whitelist(server_ctx_t *ctx, const char *spec);
+
+/* Check if a nostr_index is in the whitelist. Returns 1 if allowed, 0 if not. */
+int server_index_whitelist_allows(const server_ctx_t *ctx, int nostr_index);
+
 /* Start listening. Returns 0 on success, -1 on error. */
 int server_start(server_ctx_t *ctx);
 
@@ -1058,6 +1072,8 @@ void server_init(server_ctx_t *ctx, const char *socket_name, int socket_name_exp
     ctx->auth_mode = auth_mode;
     ctx->auth_skew_seconds = (auth_skew_seconds > 0) ? auth_skew_seconds : AUTH_DEFAULT_SKEW_SECONDS;
     ctx->bridge_source_trusted = 0;
+    ctx->index_whitelist_active = 0;
+    memset(ctx->index_whitelist, 0, sizeof(ctx->index_whitelist));
     if (!g_auth_nonce_cache_inited) {
         auth_nonce_cache_init(&g_auth_nonce_cache);
         g_auth_nonce_cache_inited = 1;
@@ -1071,6 +1087,87 @@ void server_set_bridge_source_trusted(server_ctx_t *ctx, int enabled) {
     ctx->bridge_source_trusted = enabled ? 1 : 0;
 }
 
+static void whitelist_set_bit(unsigned char *bitmap, int index) {
+    if (index >= 0 && index < INDEX_WHITELIST_MAX) {
+        bitmap[index / 8] |= (1 << (index % 8));
+    }
+}
+
+static int whitelist_get_bit(const unsigned char *bitmap, int index) {
+    if (index < 0 || index >= INDEX_WHITELIST_MAX) {
+        return 0;
+    }
+    return (bitmap[index / 8] >> (index % 8)) & 1;
+}
+
+int server_set_index_whitelist(server_ctx_t *ctx, const char *spec) {
+    char buf[256];
+    char *p;
+    char *token;
+
+    if (ctx == NULL || spec == NULL) {
+        return -1;
+    }
+
+    /* "all" means no restriction */
+    if (strcmp(spec, "all") == 0) {
+        ctx->index_whitelist_active = 0;
+        memset(ctx->index_whitelist, 0, sizeof(ctx->index_whitelist));
+        return 0;
+    }
+
+    strncpy(buf, spec, sizeof(buf) - 1);
+    buf[sizeof(buf) - 1] = '\0';
+
+    /* Parse comma-separated entries: "1,3,4" or "0-3" or "0-3,7,9" */
+    memset(ctx->index_whitelist, 0, sizeof(ctx->index_whitelist));
+    p = buf;
+    while (p != NULL && *p != '\0') {
+        char *comma = strchr(p, ',');
+        if (comma != NULL) {
+            *comma = '\0';
+        }
+
+        /* Parse token: either "N" or "N-M" (range) */
+        char *dash = strchr(p, '-');
+        if (dash != NULL) {
+            *dash = '\0';
+            char *endptr1 = NULL, *endptr2 = NULL;
+            long lo = strtol(p, &endptr1, 10);
+            long hi = strtol(dash + 1, &endptr2, 10);
+            if (*endptr1 != '\0' || *endptr2 != '\0' || lo < 0 || hi < 0 ||
+                lo >= INDEX_WHITELIST_MAX || hi >= INDEX_WHITELIST_MAX || lo > hi) {
+                return -1;
+            }
+            for (long i = lo; i <= hi; i++) {
+                whitelist_set_bit(ctx->index_whitelist, (int)i);
+            }
+        } else {
+            char *endptr = NULL;
+            long idx = strtol(p, &endptr, 10);
+            if (*endptr != '\0' || idx < 0 || idx >= INDEX_WHITELIST_MAX) {
+                return -1;
+            }
+            whitelist_set_bit(ctx->index_whitelist, (int)idx);
+        }
+
+        p = (comma != NULL) ? comma + 1 : NULL;
+    }
+
+    ctx->index_whitelist_active = 1;
+    return 0;
+}
+
+int server_index_whitelist_allows(const server_ctx_t *ctx, int nostr_index) {
+    if (ctx == NULL) {
+        return 1;  /* no ctx = allow (shouldn't happen) */
+    }
+    if (!ctx->index_whitelist_active) {
+        return 1;  /* "all" mode = no restriction */
+    }
+    return whitelist_get_bit(ctx->index_whitelist, nostr_index);
+}
+
 int server_start(server_ctx_t *ctx) {
     int fd;
     struct sockaddr_un addr;
@@ -1569,6 +1666,24 @@ int server_handle_one(server_ctx_t *ctx, server_activity_cb cb, void *cb_data) {
         }
     }
 
+    /*
+     * Index whitelist enforcement: if the request specifies a nostr_index
+     * and the whitelist is active (not "all"), check that the index is
+     * allowed. This is a hard deny — it happens before policy/approval,
+     * so even an approved caller cannot access a non-whitelisted index.
+     * We set hard_selector_error to a sentinel so the policy_check branch
+     * is skipped.
+     */
+    if (hard_selector_error == 0 && selector_req.has_nostr_index &&
+        !server_index_whitelist_allows(ctx, selector_req.nostr_index)) {
+        (void)snprintf(role_name, sizeof(role_name), "nostr_idx_%d", selector_req.nostr_index);
+        response = strdup("{\"id\":\"null\",\"error\":{\"code\":2002,\"message\":\"index_not_allowed\"}}");
+        pchk = POLICY_DENY;
+        verdict = "DENIED";
+        source_label = "index-not-approved";
+        hard_selector_error = -100;  /* sentinel: skip policy_check */
+    }
+
     if (hard_selector_error == SELECTOR_ERR_AMBIGUOUS) {
         response = strdup("{\"id\":\"null\",\"error\":{\"code\":1001,\"message\":\"ambiguous_role_selector\"}}");
         pchk = POLICY_DENY;
@@ -1578,9 +1693,11 @@ int server_handle_one(server_ctx_t *ctx, server_activity_cb cb, void *cb_data) {
     } else if (hard_selector_error == SELECTOR_ERR_NOT_FOUND) {
         response = strdup("{\"id\":\"null\",\"error\":{\"code\":1002,\"message\":\"unknown_role\"}}");
         pchk = POLICY_DENY;
-    } else {
+    } else if (hard_selector_error == 0) {
+        /* Normal path: run policy_check (skip if whitelist already denied) */
         pchk = policy_check(ctx->policy, caller.caller_id, method, role_name, purpose, &policy_src);
     }
+    /* else: hard_selector_error == -100 (whitelist deny) — keep pchk=POLICY_DENY */
 
     if (pchk == POLICY_PROMPT) {
         pchk = prompt_for_policy_decision(&caller, method, role_name, purpose, pending_derivation);
@@ -1661,6 +1778,9 @@ int server_handle_one(server_ctx_t *ctx, server_activity_cb cb, void *cb_data) {
         source_label = "session-grant";
     } else if (pchk == POLICY_ALLOW) {
         source_label = "prompt";
+    } else if (hard_selector_error == -100) {
+        /* Index whitelist denial — keep the label set by the whitelist check */
+        /* source_label already set to "index-not-approved" above */
     } else {
         source_label = "no-match";
     }