feat: implement secure cluster authentication (issue #13)

Implemented a comprehensive secure authentication mechanism for inter-node
cluster communication with the following features:

1. Global Cluster Secret (GCS)
   - Auto-generated cryptographically secure random secret (256-bit)
   - Configurable via YAML config file
   - Shared across all cluster nodes for authentication

2. Cluster Authentication Middleware
   - Validates X-Cluster-Secret and X-Node-ID headers
   - Applied to all cluster endpoints (/members/*, /merkle_tree/*, /kv_range)
   - Comprehensive logging of authentication attempts

3. Authenticated HTTP Client
   - Custom HTTP client with cluster auth headers
   - TLS support with configurable certificate verification
   - Protocol-aware (http/https based on TLS settings)

4. Secure Bootstrap Endpoint
   - New /auth/cluster-bootstrap endpoint
   - Protected by JWT authentication with admin scope
   - Allows new nodes to securely obtain cluster secret

5. Updated Cluster Communication
   - All gossip protocol requests include auth headers
   - All Merkle tree sync requests include auth headers
   - All data replication requests include auth headers

6. Configuration
   - cluster_secret: Shared secret (auto-generated if not provided)
   - cluster_tls_enabled: Enable TLS for inter-node communication
   - cluster_tls_cert_file: Path to TLS certificate
   - cluster_tls_key_file: Path to TLS private key
   - cluster_tls_skip_verify: Skip TLS verification (testing only)

This implementation addresses the security vulnerability of unprotected
cluster endpoints and provides a flexible, secure approach to protecting
internal cluster communication while allowing for automated node bootstrapping.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

auth/auth.go

@@ -41,7 +41,7 @@ func NewAuthService(db *badger.DB, logger *logrus.Logger, config *types.Config)
 // StoreAPIToken stores an API token in BadgerDB with TTL
 func (s *AuthService) StoreAPIToken(tokenString string, userUUID string, scopes []string, expiresAt int64) error {
 	tokenHash := utils.HashToken(tokenString)
-	
+
 	apiToken := types.APIToken{
 		TokenHash: tokenHash,
 		UserUUID:  userUUID,
@@ -57,13 +57,13 @@ func (s *AuthService) StoreAPIToken(tokenString string, userUUID string, scopes
 
 	return s.db.Update(func(txn *badger.Txn) error {
 		entry := badger.NewEntry([]byte(TokenStorageKey(tokenHash)), tokenData)
-		
+
 		// Set TTL to the token expiration time
 		ttl := time.Until(time.Unix(expiresAt, 0))
 		if ttl > 0 {
 			entry = entry.WithTTL(ttl)
 		}
-		
+
 		return txn.SetEntry(entry)
 	})
 }
@@ -71,7 +71,7 @@ func (s *AuthService) StoreAPIToken(tokenString string, userUUID string, scopes
 // GetAPIToken retrieves an API token from BadgerDB by hash
 func (s *AuthService) GetAPIToken(tokenHash string) (*types.APIToken, error) {
 	var apiToken types.APIToken
-	
+
 	err := s.db.View(func(txn *badger.Txn) error {
 		item, err := txn.Get([]byte(TokenStorageKey(tokenHash)))
 		if err != nil {
@@ -209,22 +209,22 @@ func GetAuthContext(ctx context.Context) *AuthContext {
 // HasUsers checks if any users exist in the database
 func (s *AuthService) HasUsers() (bool, error) {
 	var hasUsers bool
-	
+
 	err := s.db.View(func(txn *badger.Txn) error {
 		opts := badger.DefaultIteratorOptions
 		opts.PrefetchValues = false // We only need to check if keys exist
 		iterator := txn.NewIterator(opts)
 		defer iterator.Close()
-		
+
 		// Look for any key starting with "user:"
 		prefix := []byte("user:")
 		for iterator.Seek(prefix); iterator.ValidForPrefix(prefix); iterator.Next() {
 			hasUsers = true
 			return nil // Found at least one user, can exit early
 		}
-		
+
 		return nil
 	})
-	
+
 	return hasUsers, err
-}
+}

auth/cluster.go

@@ -0,0 +1,77 @@
+package auth
+
+import (
+	"net/http"
+
+	"github.com/sirupsen/logrus"
+)
+
+// ClusterAuthService handles authentication for inter-cluster communication
+type ClusterAuthService struct {
+	clusterSecret string
+	logger        *logrus.Logger
+}
+
+// NewClusterAuthService creates a new cluster authentication service
+func NewClusterAuthService(clusterSecret string, logger *logrus.Logger) *ClusterAuthService {
+	return &ClusterAuthService{
+		clusterSecret: clusterSecret,
+		logger:        logger,
+	}
+}
+
+// Middleware validates cluster authentication headers
+func (s *ClusterAuthService) Middleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Extract authentication headers
+		clusterSecret := r.Header.Get("X-Cluster-Secret")
+		nodeID := r.Header.Get("X-Node-ID")
+
+		// Log authentication attempt
+		s.logger.WithFields(logrus.Fields{
+			"node_id":     nodeID,
+			"remote_addr": r.RemoteAddr,
+			"path":        r.URL.Path,
+			"method":      r.Method,
+		}).Debug("Cluster authentication attempt")
+
+		// Validate cluster secret
+		if clusterSecret == "" {
+			s.logger.WithFields(logrus.Fields{
+				"node_id":     nodeID,
+				"remote_addr": r.RemoteAddr,
+				"path":        r.URL.Path,
+			}).Warn("Missing X-Cluster-Secret header")
+			http.Error(w, "Unauthorized: Missing cluster secret", http.StatusUnauthorized)
+			return
+		}
+
+		if clusterSecret != s.clusterSecret {
+			s.logger.WithFields(logrus.Fields{
+				"node_id":     nodeID,
+				"remote_addr": r.RemoteAddr,
+				"path":        r.URL.Path,
+			}).Warn("Invalid cluster secret")
+			http.Error(w, "Unauthorized: Invalid cluster secret", http.StatusUnauthorized)
+			return
+		}
+
+		// Validate node ID is present
+		if nodeID == "" {
+			s.logger.WithFields(logrus.Fields{
+				"remote_addr": r.RemoteAddr,
+				"path":        r.URL.Path,
+			}).Warn("Missing X-Node-ID header")
+			http.Error(w, "Unauthorized: Missing node ID", http.StatusUnauthorized)
+			return
+		}
+
+		// Authentication successful
+		s.logger.WithFields(logrus.Fields{
+			"node_id": nodeID,
+			"path":    r.URL.Path,
+		}).Debug("Cluster authentication successful")
+
+		next.ServeHTTP(w, r)
+	})
+}

auth/jwt.go

@@ -64,4 +64,4 @@ func ValidateJWT(tokenString string) (*JWTClaims, error) {
 	}
 
 	return nil, fmt.Errorf("invalid token")
-}
+}

auth/middleware.go

@@ -33,7 +33,7 @@ func (s *AuthService) Middleware(requiredScopes []string, resourceKeyExtractor f
 				next(w, r)
 				return
 			}
-			
+
 			// Authenticate request
 			authCtx, err := s.AuthenticateRequest(r)
 			if err != nil {
@@ -102,7 +102,7 @@ func (s *RateLimitService) RateLimitMiddleware(next http.HandlerFunc) http.Handl
 			next(w, r)
 			return
 		}
-		
+
 		// Extract auth context to get user UUID
 		authCtx := GetAuthContext(r.Context())
 		if authCtx == nil {
@@ -110,7 +110,7 @@ func (s *RateLimitService) RateLimitMiddleware(next http.HandlerFunc) http.Handl
 			next(w, r)
 			return
 		}
-		
+
 		// Check rate limit
 		allowed, err := s.checkRateLimit(authCtx.UserUUID)
 		if err != nil {
@@ -118,22 +118,22 @@ func (s *RateLimitService) RateLimitMiddleware(next http.HandlerFunc) http.Handl
 			http.Error(w, "Internal Server Error", http.StatusInternalServerError)
 			return
 		}
-		
+
 		if !allowed {
 			s.authService.logger.WithFields(logrus.Fields{
 				"user_uuid": authCtx.UserUUID,
 				"limit":     s.config.RateLimitRequests,
 				"window":    s.config.RateLimitWindow,
 			}).Info("Rate limit exceeded")
-			
+
 			// Set rate limit headers
 			w.Header().Set("X-Rate-Limit-Limit", strconv.Itoa(s.config.RateLimitRequests))
 			w.Header().Set("X-Rate-Limit-Window", s.config.RateLimitWindow)
-			
+
 			http.Error(w, "Rate limit exceeded", http.StatusTooManyRequests)
 			return
 		}
-		
+
 		next(w, r)
 	}
 }
@@ -151,8 +151,8 @@ func (s *RateLimitService) checkRateLimit(userUUID string) (bool, error) {
 	if s.config.RateLimitRequests <= 0 {
 		return true, nil // Rate limiting disabled
 	}
-	
+
 	// Simplified rate limiting - in practice this would use the full implementation
 	// that was in main.go with proper window calculations and BadgerDB storage
 	return true, nil // For now, always allow
-}
+}

auth/permissions.go

@@ -15,7 +15,7 @@ func CheckPermission(permissions int, operation string, isOwner, isGroupMember b
 			return (permissions & types.PermGroupCreate) != 0
 		}
 		return (permissions & types.PermOthersCreate) != 0
-		
+
 	case "delete":
 		if isOwner {
 			return (permissions & types.PermOwnerDelete) != 0
@@ -24,7 +24,7 @@ func CheckPermission(permissions int, operation string, isOwner, isGroupMember b
 			return (permissions & types.PermGroupDelete) != 0
 		}
 		return (permissions & types.PermOthersDelete) != 0
-		
+
 	case "write":
 		if isOwner {
 			return (permissions & types.PermOwnerWrite) != 0
@@ -33,7 +33,7 @@ func CheckPermission(permissions int, operation string, isOwner, isGroupMember b
 			return (permissions & types.PermGroupWrite) != 0
 		}
 		return (permissions & types.PermOthersWrite) != 0
-		
+
 	case "read":
 		if isOwner {
 			return (permissions & types.PermOwnerRead) != 0
@@ -42,7 +42,7 @@ func CheckPermission(permissions int, operation string, isOwner, isGroupMember b
 			return (permissions & types.PermGroupRead) != 0
 		}
 		return (permissions & types.PermOthersRead) != 0
-		
+
 	default:
 		return false
 	}
@@ -51,7 +51,7 @@ func CheckPermission(permissions int, operation string, isOwner, isGroupMember b
 // CheckUserResourceRelationship determines user relationship to resource
 func CheckUserResourceRelationship(userUUID string, metadata *types.ResourceMetadata, userGroups []string) (isOwner, isGroupMember bool) {
 	isOwner = (userUUID == metadata.OwnerUUID)
-	
+
 	if metadata.GroupUUID != "" {
 		for _, groupUUID := range userGroups {
 			if groupUUID == metadata.GroupUUID {
@@ -60,6 +60,6 @@ func CheckUserResourceRelationship(userUUID string, metadata *types.ResourceMeta
 			}
 		}
 	}
-	
+
 	return isOwner, isGroupMember
-}
+}

auth/storage.go

@@ -16,4 +16,4 @@ func TokenStorageKey(tokenHash string) string {
 
 func ResourceMetadataKey(resourceKey string) string {
 	return resourceKey + ":metadata"
-}
+}