gateway: one JWT verifier, guard the new deps, email hardening

- internal/webjwt is now the ONE verifier for platform-signed inbound
  webhook tokens: RS256 via golang-jwt against a JWKS (direct URL or
  resolved through OpenID metadata), iss/aud/exp enforced, cached keys
  with one bounded refresh per unknown kid. Teams and Google Chat both
  use it — the hand-rolled Google Chat verifier is gone, and two
  divergent JWT implementations can't drift apart. Both adapters' JWT
  accept/reject test matrices now exercise the shared code from both
  configurations (metadata path and direct-JWKS path).
- Guard map actually gains the new deps this time (the previous edit
  silently missed its anchor): golang-jwt→webjwt,
  gorilla/websocket→mattermost, x/oauth2→googlechat.
- Email: attachment spooling uses bytes.NewReader (no 25 MiB string
  copy); reply threading headers and To are CRLF-stripped as defense in
  depth on top of mail.ReadMessage's parsing (injection test added).
- SMS: comment documents that duplicate form keys would fail closed
  (signature mismatch), never bypass.

Author: timothyerwin

internal/channels/email/compose.go

@@ -22,14 +22,17 @@ func composeReply(from, to string, th threadInfo, body string) []byte {
 	}
 	var b strings.Builder
 	fmt.Fprintf(&b, "From: %s\r\n", from)
-	fmt.Fprintf(&b, "To: %s\r\n", to)
+	fmt.Fprintf(&b, "To: %s\r\n", stripCRLF(to))
 	fmt.Fprintf(&b, "Subject: %s\r\n", mime.QEncoding.Encode("utf-8", subject))
 	fmt.Fprintf(&b, "Date: %s\r\n", time.Now().Format(time.RFC1123Z))
 	fmt.Fprintf(&b, "Message-Id: %s\r\n", newMessageID(from))
-	if th.last != "" {
-		fmt.Fprintf(&b, "In-Reply-To: %s\r\n", th.last)
+	// Threading ids came from inbound mail. mail.ReadMessage already rejects
+	// CRLF-bearing headers, but strip line breaks anyway (defense in depth): a
+	// Message-ID must never be able to smuggle extra headers into our reply.
+	if last := stripCRLF(th.last); last != "" {
+		fmt.Fprintf(&b, "In-Reply-To: %s\r\n", last)
 	}
-	if refs := threadReferences(th); refs != "" {
+	if refs := stripCRLF(threadReferences(th)); refs != "" {
 		fmt.Fprintf(&b, "References: %s\r\n", refs)
 	}
 	b.WriteString("MIME-Version: 1.0\r\n")
@@ -42,6 +45,18 @@ func composeReply(from, to string, th threadInfo, body string) []byte {
 	return []byte(b.String())
 }
 
+// stripCRLF removes line breaks from a header value (header-injection guard).
+// mail.ReadMessage already rejects CRLF-bearing inbound headers; this is the
+// cheap second layer so no future caller can regress it.
+func stripCRLF(s string) string {
+	return strings.Map(func(r rune) rune {
+		if r == '\r' || r == '\n' {
+			return -1
+		}
+		return r
+	}, s)
+}
+
 func threadReferences(th threadInfo) string {
 	switch {
 	case th.root == "" && th.last == "":

internal/channels/email/email.go

@@ -20,6 +20,7 @@
 package email
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"strings"
@@ -200,7 +201,7 @@ func (c *Channel) toInbound(msg parsedMessage, uidValidity uint32, uid imap.UID)
 func (c *Channel) spoolAttachments(msg parsedMessage) []channels.Attachment {
 	var out []channels.Attachment
 	for _, a := range msg.attachments {
-		att, err := channels.SaveToSpool(c.mediaDir, strings.NewReader(string(a.data)), a.mime, a.name)
+		att, err := channels.SaveToSpool(c.mediaDir, bytes.NewReader(a.data), a.mime, a.name)
 		if err != nil {
 			continue
 		}

internal/channels/email/email_test.go

@@ -195,3 +195,18 @@ func TestSendUsesThread(t *testing.T) {
 		t.Errorf("subject wrong:\n%s", sentRaw)
 	}
 }
+
+// Threading headers are injection-proof even if a hostile Message-ID slipped
+// past inbound parsing.
+func TestComposeReplyStripsCRLF(t *testing.T) {
+	th := threadInfo{last: "<m9@b.com>\r\nBcc: victim@x.com", subject: "hi"}
+	raw := string(composeReply("bot@x.com", "tim@b.com", th, "ok"))
+	// The CRLF is stripped, so "Bcc:" can only survive INSIDE the In-Reply-To
+	// value (inert) — never as its own header line.
+	if strings.Contains(raw, "\r\nBcc:") {
+		t.Fatalf("injected header line survived:\n%s", raw)
+	}
+	if !strings.Contains(raw, "In-Reply-To: <m9@b.com>Bcc: victim@x.com\r\n") {
+		t.Fatalf("strip changed more than line breaks:\n%s", raw)
+	}
+}

internal/channels/msteams/msteams.go

@@ -11,21 +11,18 @@ package msteams
 import (
 	"bytes"
 	"context"
-	"crypto/rsa"
-	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
-	"math/big"
 	"net/http"
 	"net/url"
 	"strings"
 	"sync"
 	"time"
 
-	"github.com/golang-jwt/jwt/v5"
 	"github.com/memcode-ai/memcode/internal/channels"
+	"github.com/memcode-ai/memcode/internal/webjwt"
 )
 
 // botFrameworkIssuer is the issuer every Bot Framework connector token carries.
@@ -54,15 +51,9 @@ type Channel struct {
 	appPassword string
 	tenantID    string
 	mediaDir    string // media spool; "" disables inbound media downloads
-	metadataURL string // Bot Framework OpenID metadata; overridable in tests
 	tokenBase   string // Azure AD token endpoint base; overridable in tests
 	client      *http.Client
-
-	// keysMu guards the JWKS cache. Keys are fetched lazily and refreshed at
-	// most once per request when an unknown kid arrives (Microsoft rotates
-	// signing keys), so a flood of bad tokens can't hammer the metadata host.
-	keysMu sync.Mutex
-	keys   map[string]*rsa.PublicKey
+	verify      *webjwt.Verifier // the shared inbound-JWT verifier; tests point its MetadataURL at a fake
 
 	// tokMu guards the cached outbound bearer; refreshed ~60s before expiry so
 	// an in-flight Send never races the token's edge.
@@ -75,14 +66,20 @@ type Channel struct {
 // the AAD tenant the bot is registered in. mediaDir is the gateway media spool
 // inbound attachments are downloaded into; "" disables media handling.
 func New(appID, appPassword, tenantID, mediaDir string) *Channel {
+	client := &http.Client{Timeout: 30 * time.Second}
 	return &Channel{
 		appID:       appID,
 		appPassword: appPassword,
 		tenantID:    tenantID,
 		mediaDir:    mediaDir,
-		metadataURL: defaultMetadataURL,
 		tokenBase:   defaultTokenBase,
-		client:      &http.Client{Timeout: 30 * time.Second},
+		client:      client,
+		verify: &webjwt.Verifier{
+			MetadataURL: defaultMetadataURL,
+			Issuer:      botFrameworkIssuer,
+			Audience:    appID,
+			Client:      client,
+		},
 	}
 }
 
@@ -129,7 +126,7 @@ func (c *Channel) Handler(sink channels.Sink) http.Handler {
 			return
 		}
 		raw, ok := strings.CutPrefix(r.Header.Get("Authorization"), "Bearer ")
-		if !ok || c.validateJWT(r.Context(), raw) != nil {
+		if !ok || c.verify.Verify(r.Context(), raw) != nil {
 			// Unauthenticated caller: nothing is delivered. 401, not 503 — a
 			// forged request must not be invited to retry.
 			http.Error(w, "invalid token", http.StatusUnauthorized)
@@ -264,122 +261,6 @@ func (c *Channel) fetch(ctx context.Context, u, bearer string) (*http.Response,
 	return c.client.Do(req)
 }
 
-// validateJWT verifies an inbound Bot Framework token: RS256 signature against
-// the published JWKS, the Bot Framework issuer, our app id as audience, and an
-// unexpired lifetime. An unknown kid triggers at most ONE JWKS refresh for
-// this request — key rotation is handled, a forged-kid flood is not amplified.
-func (c *Channel) validateJWT(ctx context.Context, raw string) error {
-	refreshed := false
-	keyfunc := func(t *jwt.Token) (any, error) {
-		kid, _ := t.Header["kid"].(string)
-		if kid == "" {
-			return nil, errors.New("token missing kid")
-		}
-		if k := c.cachedKey(kid); k != nil {
-			return k, nil
-		}
-		if !refreshed {
-			refreshed = true
-			if err := c.refreshKeys(ctx); err != nil {
-				return nil, err
-			}
-			if k := c.cachedKey(kid); k != nil {
-				return k, nil
-			}
-		}
-		return nil, fmt.Errorf("unknown signing key %q", kid)
-	}
-	_, err := jwt.Parse(raw, keyfunc,
-		jwt.WithValidMethods([]string{"RS256"}),
-		jwt.WithIssuer(botFrameworkIssuer),
-		jwt.WithAudience(c.appID),
-		jwt.WithExpirationRequired(),
-	)
-	return err
-}
-
-func (c *Channel) cachedKey(kid string) *rsa.PublicKey {
-	c.keysMu.Lock()
-	defer c.keysMu.Unlock()
-	return c.keys[kid]
-}
-
-// refreshKeys fetches the OpenID metadata, follows jwks_uri, and replaces the
-// key cache. Replacing (not merging) means revoked keys actually leave.
-func (c *Channel) refreshKeys(ctx context.Context) error {
-	var meta struct {
-		JWKSURI string `json:"jwks_uri"`
-	}
-	if err := c.getJSON(ctx, c.metadataURL, &meta); err != nil {
-		return fmt.Errorf("openid metadata: %w", err)
-	}
-	if meta.JWKSURI == "" {
-		return errors.New("openid metadata has no jwks_uri")
-	}
-	var set struct {
-		Keys []struct {
-			Kty string `json:"kty"`
-			Kid string `json:"kid"`
-			N   string `json:"n"`
-			E   string `json:"e"`
-		} `json:"keys"`
-	}
-	if err := c.getJSON(ctx, meta.JWKSURI, &set); err != nil {
-		return fmt.Errorf("jwks fetch: %w", err)
-	}
-	keys := make(map[string]*rsa.PublicKey, len(set.Keys))
-	for _, k := range set.Keys {
-		if k.Kty != "RSA" || k.Kid == "" {
-			continue
-		}
-		pub, err := rsaFromJWK(k.N, k.E)
-		if err != nil {
-			continue // one malformed key must not poison the whole set
-		}
-		keys[k.Kid] = pub
-	}
-	if len(keys) == 0 {
-		return errors.New("jwks contained no usable rsa keys")
-	}
-	c.keysMu.Lock()
-	c.keys = keys
-	c.keysMu.Unlock()
-	return nil
-}
-
-// rsaFromJWK builds an RSA public key from base64url modulus and exponent.
-func rsaFromJWK(n64, e64 string) (*rsa.PublicKey, error) {
-	nb, err := base64.RawURLEncoding.DecodeString(n64)
-	if err != nil {
-		return nil, err
-	}
-	eb, err := base64.RawURLEncoding.DecodeString(e64)
-	if err != nil {
-		return nil, err
-	}
-	e := new(big.Int).SetBytes(eb)
-	if !e.IsInt64() || e.Int64() <= 0 {
-		return nil, errors.New("bad rsa exponent")
-	}
-	return &rsa.PublicKey{N: new(big.Int).SetBytes(nb), E: int(e.Int64())}, nil
-}
-
-func (c *Channel) getJSON(ctx context.Context, u string, v any) error {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u, nil)
-	if err != nil {
-		return err
-	}
-	resp, err := c.client.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode/100 != 2 {
-		return fmt.Errorf("get %s: status %d", u, resp.StatusCode)
-	}
-	return json.NewDecoder(io.LimitReader(resp.Body, maxBody)).Decode(v)
-}
-
 // token returns a valid outbound connector bearer, minting one via the Azure
 // AD client-credentials grant when the cache is empty or within 60s of expiry
 // (the margin keeps a token from expiring mid-Send).

internal/channels/msteams/msteams_test.go

@@ -37,7 +37,7 @@ func (s *recordingSink) Deliver(_ context.Context, inb channels.Inbound) error {
 }
 
 // jwksServer serves a fake Bot Framework OpenID config + JWKS for key. Returns
-// the metadata URL to plug into Channel.metadataURL.
+// the metadata URL to plug into the verifier.
 func jwksServer(t *testing.T, kid string, key *rsa.PrivateKey) string {
 	t.Helper()
 	mux := http.NewServeMux()
@@ -80,7 +80,7 @@ func signToken(t *testing.T, key *rsa.PrivateKey, kid, iss, aud string) string {
 func newTestChannel(t *testing.T, metadataURL string) *Channel {
 	t.Helper()
 	c := New(testAppID, "secret", "tenant", "")
-	c.metadataURL = metadataURL
+	c.verify.MetadataURL = metadataURL
 	return c
 }
 

internal/guard/guard_test.go

@@ -89,6 +89,9 @@ var vendorSDKs = map[string]string{
 	"github.com/emersion/go-imap":            modulePrefix + "/internal/channels/email",
 	"github.com/bwmarrin/discordgo":          modulePrefix + "/internal/channels/discord",
 	"github.com/slack-go/slack":              modulePrefix + "/internal/channels/slack",
+	"github.com/golang-jwt/jwt":              modulePrefix + "/internal/webjwt",
+	"github.com/gorilla/websocket":           modulePrefix + "/internal/channels/mattermost",
+	"golang.org/x/oauth2":                    modulePrefix + "/internal/triggers/googlechat",
 }
 
 func directImports(t *testing.T, pkg string) []string {