fix: bound request bodies and validate UnifiedPush endpoints against SSRF

CLAUDE.md

@@ -10,7 +10,7 @@ For deeper context (data flow, components, ops): [docs/architecture.md](docs/arc
 - **Async runtime**: Tokio 1.35 (`full`).
 - **HTTP**: `actix-web 4.9`, `actix-rt 2.9`.
 - **Nostr**: `nostr-sdk 0.27`.
-- **HTTP client**: shared `reqwest::Client` with explicit timeouts (2 s connect, 5 s total).
+- **HTTP client**: shared `reqwest::Client` with explicit timeouts (2 s connect, 5 s total). UnifiedPush is the one exception: it builds its own via `UnifiedPushService::build_client()`, identical except that redirects are refused. Its endpoint URL is attacker-supplied, and the SSRF guard only inspects the first hop.
 - **Rate limiting**: `governor 0.6` (already approved, dual-keyed limiter).
 - **Privacy hash**: `blake3` (salted truncated keyed hash for log correlators).
 - **Other notable deps**: `jsonwebtoken` (FCM OAuth), `secp256k1`, `chacha20poly1305`, `hkdf`, `sha2` (gated `crypto` module reserved for future encrypted-token registration), `uuid` (UUIDv4 `x-request-id`).
@@ -74,6 +74,7 @@ src/
 ├── push/
 │   ├── mod.rs           # PushService trait
 │   ├── dispatcher.rs    # PushDispatcher (lock-free)
+│   ├── endpoint_guard.rs # SSRF guard for UnifiedPush endpoint URLs
 │   ├── fcm.rs           # FCM v1, OAuth2 service-account JWT
 │   └── unifiedpush.rs   # UnifiedPush backend, persistent endpoint store
 ├── store/mod.rs         # In-memory TokenStore + TTL cleanup

docs/api.md

@@ -77,7 +77,7 @@ Request:
 | Field           | Type   | Description                                                                                                            |
 |-----------------|--------|------------------------------------------------------------------------------------------------------------------------|
 | `trade_pubkey`  | string | 64 hex characters                                                                                                      |
-| `token`         | string | FCM device token, or UnifiedPush endpoint URL                                                                          |
+| `token`         | string | FCM device token, or UnifiedPush endpoint URL. Non-empty, at most 4096 bytes. If it parses as an `http`/`https` URL it must be `https` and point at a public address (see below). |
 | `platform`      | string | `"android"` or `"ios"`                                                                                                 |
 | `mostro_pubkey` | string | 64 hex characters. Optional on the wire; required when the trusted-instance whitelist is non-empty (see below). |
 
@@ -226,10 +226,86 @@ curl -i -X POST http://localhost:8080/api/notify \
 |--------|-------------------------------------------------------------------------------|
 | 200    | `/api/health`, `/api/info`, `/api/status`, `/api/register`, `/api/unregister` |
 | 202    | `/api/notify` on parse-valid input                                            |
-| 400    | Malformed body, invalid `trade_pubkey`, invalid `platform`, empty `token`     |
+| 400    | Malformed body, body over the size limit, invalid `trade_pubkey`, invalid `platform`, empty or oversized `token` |
 | 429    | `/api/register`, `/api/unregister`, `/api/notify` rate limits                 |
 | 500    | Rate-limited endpoints fail closed when the per-IP key cannot be extracted   |
 
+### Push endpoint validation
+
+The `token` field is overloaded: for FCM it is an opaque registration token,
+for UnifiedPush it is the URL the server will POST to. The request carries no
+field saying which, so the server inspects the value instead.
+
+A token that parses as an `http` or `https` URL is treated as a push endpoint
+and must satisfy all of:
+
+- scheme is `https`
+- the host is not a private, loopback, link-local, CGNAT, or otherwise
+  non-routable address, including the IPv4-mapped IPv6 spellings of those
+  (`https://[::ffff:169.254.169.254]/`)
+
+Anything that does not parse as an `http`/`https` URL is treated as an opaque
+backend token and passed through untouched, so FCM registrations are
+unaffected. A short list of clearly unusable schemes (`file`, `ftp`, `gopher`,
+`data`, `dict`, `ldap`) is refused outright.
+
+Rejection — `400 Bad Request`:
+
+```json
+{
+  "success": false,
+  "message": "Invalid push endpoint"
+}
+```
+
+The message is identical for every rejection reason on purpose. A caller must
+not be able to use the response to distinguish "unsupported scheme" from
+"internal address" and map the server's network.
+
+Registration performs the checks above without touching the network. The
+authoritative check runs again immediately before the outbound POST and
+additionally resolves domain hosts, refusing the endpoint if any resolved
+address is non-public.
+
+## Request size limits
+
+Every endpoint that accepts a body caps it. Actix's own default is 2 MB, which
+on unauthenticated endpoints is a free memory-amplification primitive.
+
+| Endpoint          | Max body | Notes                                                        |
+|-------------------|----------|--------------------------------------------------------------|
+| `/api/register`   | 8 KiB    | Sized to fit a 4096-byte `token` plus the other fields        |
+| `/api/unregister` | 1 KiB    | Body carries a single 64-char hex pubkey                      |
+| `/api/notify`     | 1 KiB    | Body carries a single 64-char hex pubkey                      |
+
+The `token` field of a registration is bounded separately at **4096 bytes**. The
+body cap stops an enormous request; the field cap stops a merely large one from
+being retained in the in-memory token store for its whole TTL.
+
+Exceeding either limit is reported as `400 Bad Request`, **not** `413 Payload
+Too Large`:
+
+```json
+{
+  "success": false,
+  "message": "Request body too large"
+}
+```
+
+```json
+{
+  "success": false,
+  "message": "Token exceeds maximum length"
+}
+```
+
+Returning `400` rather than `413` is deliberate. The response bodies of
+`/api/register` and `/api/unregister` are frozen against pre-1.1 fixtures, and
+`/api/notify` is contractually restricted to a single failure status, so the
+size cap reuses the shape those endpoints already emit instead of introducing a
+new one. Only the payload-overflow case is remapped; every other body-parsing
+failure keeps its previous behaviour.
+
 ## Rate limiting
 
 `/api/register` and `/api/unregister` share a per-IP limit to protect the

docs/configuration.md

@@ -158,6 +158,27 @@ NOTIFY_TRUST_PROXY_HEADERS=true
 RUST_LOG=info
 ```
 
+## UnifiedPush endpoint policy
+
+When UnifiedPush is enabled, the registered device token *is* the URL the
+server POSTs to, which makes it a request-forgery surface reachable from the
+unauthenticated `/api/register` and `/api/notify` pair. `src/push/endpoint_guard.rs`
+refuses any endpoint that is not `https`, or whose host is (or resolves to) a
+non-routable address: loopback, RFC1918, link-local, CGNAT, unique-local and
+the rest.
+
+There is no configuration knob to relax this. Two consequences for operators:
+
+- **A UnifiedPush distributor on a private range is not reachable.** Front it
+  with a public hostname and a TLS certificate. This is deliberate: the blast
+  radius of accidentally reaching a cloud metadata service or a container-local
+  admin port is far worse than that of an operator having to publish a name.
+- **Local mock servers cannot be used to exercise the dispatch path**, since
+  they bind to loopback.
+
+Full detail, including the known DNS-rebinding limitation, is in
+[unifiedpush.md](./unifiedpush.md#endpoint-validation).
+
 ## Generating a Firebase service account
 
 1. [Firebase Console](https://console.firebase.google.com/) → your project → Project Settings → Service accounts.

docs/unifiedpush.md

@@ -38,11 +38,39 @@ The endpoint store is loaded once at startup. Failures to read or parse the file
 
 If `UNIFIEDPUSH_ENABLED=false`, the service is not added to the dispatcher slice. Existing entries in `data/unifiedpush_endpoints.json` are ignored at runtime but not deleted.
 
+## Endpoint validation
+
+The registered device token *is* the URL the server POSTs to, which makes it a
+request-forgery surface reachable from the unauthenticated `/api/register` and
+`/api/notify` pair. `src/push/endpoint_guard.rs` is the single place that
+decides whether an endpoint may be contacted.
+
+Two passes:
+
+1. **Registration** — static, no network. Refuses non-`https` schemes and hosts
+   that are IP literals outside the public internet.
+2. **Dispatch** — runs immediately before the outbound POST, repeats the static
+   checks, and resolves domain hosts, refusing if *any* resolved address is
+   non-public. This is the authoritative gate; registration is defence in
+   depth and fast feedback.
+
+The guard only ever inspects the **first hop**, which is why this backend does
+not use the shared HTTP client. `reqwest` follows up to 10 redirects by
+default, so a registered endpoint answering `302 Location: http://169.254.169.254/`
+would walk the request past the guard entirely. `UnifiedPushService::build_client`
+refuses redirects outright: a push endpoint has no legitimate reason to issue
+one. A regression test asserts the second hop is never requested.
+
+Known limitation: `reqwest` resolves the host again when it connects, so a DNS
+record with a very short TTL can change between validation and connection.
+Closing that race requires pinning the validated address into the connection;
+tracked in [#39](https://github.com/MostroP2P/mostro-push-server/issues/39).
+
 ## Operational notes
 
 - UnifiedPush has no per-payload distinction between silent and visible push. `send_silent_to_token` falls back to `send_to_token`, which is the same code path the Nostr listener uses.
 - There is no rate limiting on outbound UnifiedPush calls beyond what the server-wide `reqwest::Client` timeouts provide (2 s connect, 5 s total).
-- The endpoint URL is fully attacker-controlled in the sense that the distributor can be any HTTP server. The shared `reqwest::Client` enforces TLS and the timeouts; the server does not pin certificates or restrict hostnames.
+- The endpoint URL is fully attacker-controlled in the sense that the distributor can be any HTTP server. A dedicated `reqwest::Client` (`UnifiedPushService::build_client`) enforces TLS, the timeouts, and a no-redirect policy; the server does not pin certificates.
 
 ## Reference
 

src/api/notify.rs

@@ -1,9 +1,10 @@
 use actix_web::{
     body::MessageBody,
     dev::{ServiceRequest, ServiceResponse},
+    error::{InternalError, JsonPayloadError},
     http::header::{HeaderName, HeaderValue},
     middleware::Next,
-    web, Error, HttpResponse, Responder,
+    web, Error, HttpRequest, HttpResponse, Responder,
 };
 use log::{info, warn};
 use serde::{Deserialize, Serialize};
@@ -27,6 +28,42 @@ pub struct NotifyRequest {
     pub trade_pubkey: String,
 }
 
+/// Upper bound on the JSON body accepted by /api/notify.
+///
+/// The body is a fixed shape carrying one 64-char hex pubkey, so a kilobyte is
+/// already generous. Actix defaults to 2 MB, which on an unauthenticated
+/// endpoint is a free memory-amplification primitive.
+const MAX_BODY_BYTES: usize = 1024;
+
+/// JSON extractor config for /api/notify.
+///
+/// Two jobs: cap the body, and keep the response contract intact while doing
+/// it. D-12 / hard constraint 2 allow exactly two failure statuses on this
+/// endpoint — 400 for a parse failure and 400 for a bad pubkey — so an
+/// oversized body is reported as the same 400, not as actix's default 413.
+/// Every other `JsonPayloadError` variant falls through to actix's own
+/// handling, leaving the existing malformed-JSON behaviour untouched.
+///
+/// The 400 carries no information about the pubkey, so it cannot be used to
+/// distinguish a registered from an unregistered one.
+pub fn json_config() -> web::JsonConfig {
+    web::JsonConfig::default()
+        .limit(MAX_BODY_BYTES)
+        .error_handler(|err, _req: &HttpRequest| -> Error {
+            if matches!(
+                err,
+                JsonPayloadError::Overflow { .. } | JsonPayloadError::OverflowKnownLength { .. }
+            ) {
+                let response = HttpResponse::BadRequest().json(NotifyError {
+                    success: false,
+                    message: "Request body too large".to_string(),
+                });
+                return InternalError::from_response(err, response).into();
+            }
+            err.into()
+        })
+}
+
 /// 400-only response shape for /api/notify.
 ///
 /// Defined locally (NOT a re-import of routes::RegisterResponse) per
@@ -303,4 +340,29 @@ mod tests {
             .unwrap();
         assert!(Uuid::parse_str(id_value).is_ok());
     }
+    /// Hard constraint 2 allows exactly one failure status on this endpoint.
+    /// An oversized body must therefore be a 400 in the endpoint's own shape,
+    /// not actix's default 413, and it must carry nothing about the pubkey.
+    #[actix_web::test]
+    async fn notify_oversized_body_returns_400_not_413() {
+        let c = make_test_components();
+        let app = test::init_service(build_test_actix_app(c)).await;
+
+        let req = test::TestRequest::post()
+            .uri("/api/notify")
+            .insert_header(("Fly-Client-IP", "8.8.8.8"))
+            .set_json(serde_json::json!({
+                "trade_pubkey": TEST_PUBKEY,
+                "padding": "a".repeat(super::MAX_BODY_BYTES * 2)
+            }))
+            .to_request();
+        let resp = test::call_service(&app, req).await;
+
+        assert_eq!(resp.status(), StatusCode::BAD_REQUEST);
+        let body = test::read_body(resp).await;
+        assert_eq!(
+            std::str::from_utf8(&body).unwrap(),
+            r#"{"success":false,"message":"Request body too large"}"#
+        );
+    }
 }