fix(api): stop embedding phone ID in adapter notification JWT claims

Address PR review: the token used phoneID as both the readable sub claim and the HS256 signing secret, so anyone who saw one token could read the secret and forge further ones. The sub claim is unnecessary since the adapter already knows which phone ID to verify against from its own gateway registration, so it is removed; the phone ID remains the signing secret only.

- http_notification_sender.go: getAuthToken no longer sets Subject.
- adapter-emulator/notification_handler.go: verifyNotificationAuth no longer checks claims.Subject.
- Updated tests in api/pkg/services and tests/ to assert sub is empty instead of equal to the phone ID.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 45ed9de9-a3ad-41cf-ad32-ebec28d9771c

Author: AchoArnold

api/pkg/services/http_notification_sender.go

@@ -103,7 +103,11 @@ func (sender *HTTPNotificationSender) Send(
 }
 
 // getAuthToken generates a JWT bearer token for the HTTPS adapter, signed with the phone ID
-// the same way webhook requests are signed with the webhook signing key.
+// the same way webhook requests are signed with the webhook signing key. The phone ID is only
+// used as the HMAC secret and is intentionally not embedded in any claim: the adapter already
+// knows which phone ID to verify against from its own gateway registration, and putting the
+// phone ID in a readable claim would let anyone who intercepts one token read the signing
+// secret and forge further tokens.
 func (sender *HTTPNotificationSender) getAuthToken(endpoint *url.URL, phoneID uuid.UUID) (string, error) {
 	audience := *endpoint
 	audience.User = nil
@@ -115,7 +119,6 @@ func (sender *HTTPNotificationSender) getAuthToken(endpoint *url.URL, phoneID uu
 		IssuedAt:  jwt.NewNumericDate(now),
 		Issuer:    notificationJWTIssuer,
 		NotBefore: jwt.NewNumericDate(now.Add(-notificationJWTValidity)),
-		Subject:   phoneID.String(),
 	})
 	return token.SignedString([]byte(phoneID.String()))
 }

api/pkg/services/http_notification_sender_test.go

@@ -69,7 +69,8 @@ func TestHTTPNotificationSenderSendsFCMCompatiblePayload(t *testing.T) {
 		assert.True(t, token.Valid)
 		claims, ok := token.Claims.(jwt.MapClaims)
 		require.True(t, ok)
-		assert.Equal(t, testNotificationPhoneID.String(), claims["sub"])
+		assert.Empty(t, claims["sub"], "phone ID must not be embedded in a claim since it is also the signing secret")
+		assert.Equal(t, "api.httpsms.com", claims["iss"])
 
 		return response(http.StatusNoContent, http.NoBody), nil
 	}))

tests/adapter-emulator/emulator_test.go

@@ -487,7 +487,6 @@ func validNotificationToken(t *testing.T, phoneID string) string {
 		IssuedAt:  jwt.NewNumericDate(now),
 		Issuer:    notificationJWTIssuer,
 		NotBefore: jwt.NewNumericDate(now.Add(-10 * time.Minute)),
-		Subject:   phoneID,
 	})
 	signed, err := token.SignedString([]byte(phoneID))
 	if err != nil {

tests/adapter-emulator/notification_handler.go

@@ -111,7 +111,9 @@ func notificationKind(data map[string]string) (kind string, messageID string, er
 
 // verifyNotificationAuth validates the JWT the httpSMS API signs notification requests with,
 // using the gateway's phone ID as the HMAC-SHA256 secret (see
-// api/pkg/services/http_notification_sender.go getAuthToken).
+// api/pkg/services/http_notification_sender.go getAuthToken). The phone ID is never carried in
+// a token claim, only used as the secret, so verification relies on the gateway's own
+// registration to know which phone ID to check against rather than trusting a claim.
 func verifyNotificationAuth(authorization string, phoneID string) error {
 	tokenString, ok := strings.CutPrefix(authorization, "Bearer ")
 	if !ok || strings.TrimSpace(tokenString) == "" {
@@ -131,9 +133,6 @@ func verifyNotificationAuth(authorization string, phoneID string) error {
 	if !token.Valid {
 		return fmt.Errorf("token is not valid")
 	}
-	if claims.Subject != phoneID {
-		return fmt.Errorf("subject mismatch")
-	}
 	if claims.Issuer != notificationJWTIssuer {
 		return fmt.Errorf("issuer mismatch")
 	}

tests/helpers_test.go

@@ -587,10 +587,9 @@ func assertWebhookJWT(t *testing.T, request wmJournal.Request, signingKey string
 
 // assertAdapterNotificationJWT validates the JWT the API signs adapter notification requests
 // with, using the receiving phone's ID as the HMAC-SHA256 secret (see
-// api/pkg/services/http_notification_sender.go getAuthToken). The adapter emulator itself
-// rejects notifications with an invalid token (401), so a processed record with this header
-// recorded is already proof the signature validated; this assertion additionally checks the
-// claim shape from the test side.
+// api/pkg/services/http_notification_sender.go getAuthToken). The phone ID is only used as the
+// secret and is never embedded in a claim, so this only checks the signature and issuer, not a
+// subject; the adapter emulator itself rejects notifications with an invalid signature (401).
 func assertAdapterNotificationJWT(t *testing.T, record notificationRecord, phoneID string) {
 	t.Helper()
 
@@ -608,7 +607,7 @@ func assertAdapterNotificationJWT(t *testing.T, record notificationRecord, phone
 	claims, ok := token.Claims.(jwt.MapClaims)
 	require.True(t, ok, "cannot parse claims")
 	require.Equal(t, "api.httpsms.com", claims["iss"], "issuer mismatch")
-	require.Equal(t, phoneID, claims["sub"], "subject must be the receiving phone's ID")
+	require.Empty(t, claims["sub"], "phone ID must not be embedded in a claim since it is also the signing secret")
 
 	exp, err := claims.GetExpirationTime()
 	require.NoError(t, err)