fix(sns_aggregator): restrict reconfigure to controllers and clamp short intervals

[yhabib]

Motivation

The reconfigure update method took a new Config from any principal, including the anonymous principal. It exists only in the development build (sns_aggregator_dev.wasm.gz), but any test deployment built from that wasm was open to it. An attacker could halt data refresh or set a 0 ms interval and burn cycles until the canister freezes.

Changes

• Added a controller check that runs before reconfigure touches any state.
• Added apply_config, which stores a Config and raises any interval below 100 ms to that minimum.
• Applied apply_config in setup, so init, post_upgrade, and a config left in stable memory all get the same clamp.
• Added test doubles for the caller and the controllers, since the real system API only works inside a canister.
• Added unit tests for the controller check, the clamp, and reconfigure itself.
• Added a changelog entry under CHANGELOG-Sns_Aggregator.md.

Tests

• cargo test --package sns_aggregator: 13 passed, 0 failed, 2 ignored (both ignored before this change).
• cargo test --workspace: all tests pass, 0 failed.
• ./scripts/lint-rs: no warning, run with --all-features.
• ./scripts/fmt-rs: no change.
• Mutation check: removing the controller check made both reconfigure tests fail. Removing the clamp made both apply_config clamp tests fail. Restoring both brought all 13 tests back to passing.

Todos

• Accessibility (a11y) – no impact. The change touches only a canister backend method.
• Changelog – added to CHANGELOG-Sns_Aggregator.md under Unreleased / Security.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 3d8cf11.

Security Overview

• 🔎 Scanned files: 7 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/c216d0ec-7005-4385-92fb-ac6c6dd345b7?scanId=67d84213-bc8a-4586-9153-d1c94d7173ea&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► rs/sns_aggregator/src/lib.rs     Enable reconfiguration and auth module when applicable ► rs/sns_aggregator/src/state.rs     Add MIN_INTERVAL_MS constant and raise_short_intervals method ► rs/sns_aggregator/src/state/tests.rs     Add tests for raise_short_intervals behavior ► rs/sns_aggregator/src/auth.rs     Add controller-only call checks (reconfiguration guard)
Enhancement	► rs/sns_aggregator/src/auth/test_api.rs     Add test doubles for controller tests
Enhancement	► rs/sns_aggregator/src/tests.rs     Add tests for assert_caller_is_controller and reconfigure behavior and apply_config interactions

[Copilot]

🟢 Approved

The changes address the stated security risk with clear, centralized logic and targeted unit tests covering the new behavior.

Pull request overview

This PR hardens the SNS aggregator canister’s (dev-only) reconfigure update method by restricting it to canister controllers and preventing cycle-burning configurations via a minimum interval clamp, with accompanying unit tests and a security changelog entry.

Changes:

• Enforced a controller-only guard for reconfigure via a dedicated auth module.
• Centralized config persistence + interval clamping in apply_config, applied during setup (covering init, post_upgrade, and stable-memory-restored configs).
• Added unit tests (including test doubles for system APIs) and documented the security fix in the changelog.

File summaries

File	Description
rs/sns_aggregator/src/lib.rs	Adds controller check for reconfigure and introduces apply_config to clamp intervals during setup.
rs/sns_aggregator/src/state.rs	Adds Config::MIN_INTERVAL_MS and raise_short_intervals helper for interval clamping.
rs/sns_aggregator/src/auth.rs	Implements controller-only authorization check with trap/panic behavior depending on build context.
rs/sns_aggregator/src/auth/test_api.rs	Provides test doubles for caller/controllers and trap behavior to enable unit testing outside a canister.
rs/sns_aggregator/src/tests.rs	Adds unit tests covering controller gating, reconfigure rejection behavior, and config clamping via apply_config.
rs/sns_aggregator/src/state/tests.rs	Adds unit tests for Config::raise_short_intervals.
CHANGELOG-Sns_Aggregator.md	Documents the controller restriction and minimum interval clamp under Unreleased/Security.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.