fix: 4 security issues from code audit (#334)

HIGH: handle_intro filter logic (AND→OR) — events with mismatched
kind/type combos could slip through validation.

MEDIUM:
- Invite tokens: 3 bytes → 8 bytes (48-bit → 64-bit keyspace)
- responder_health_set: add is_valid_slot_id() before path construction
- Macaroon verify: constant-time sig comparison (prevent timing leak)

Co-authored-by: Herman Sherman <herman@hermans.mac.mini.lan>

Author: HermanShermanBot

src/macaroon.rs

@@ -59,7 +59,7 @@ impl Macaroon {
 
     pub fn verify(&self, root_key: &[u8], context: &VerifyContext) -> Result<()> {
         let expected = compute_signature(root_key, &self.identifier, &self.caveats)?;
-        if self.signature != expected {
+        if !constant_time_eq(self.signature.as_bytes(), expected.as_bytes()) {
             bail!("macaroon signature mismatch");
         }
         for caveat in &self.caveats {
@@ -121,3 +121,15 @@ fn parse_rfc3339(s: &str) -> Result<time::OffsetDateTime> {
     time::OffsetDateTime::parse(s, &time::format_description::well_known::Rfc3339)
         .map_err(|e| anyhow!("invalid RFC3339 timestamp {s:?}: {e}"))
 }
+
+/// Constant-time comparison to avoid timing side-channels on signature checks.
+fn constant_time_eq(a: &[u8], b: &[u8]) -> bool {
+    if a.len() != b.len() {
+        return false;
+    }
+    let mut acc = 0u8;
+    for (x, y) in a.iter().zip(b.iter()) {
+        acc |= x ^ y;
+    }
+    acc == 0
+}

src/relay_server.rs

@@ -1544,9 +1544,8 @@ async fn invite_register(
         .duration_since(UNIX_EPOCH)
         .map(|d| d.as_secs())
         .unwrap_or(0);
-    // 6-hex token → 16.7M space. Collision probability negligible at v0.5
-    // scale; if a collision happens (1 in 16M) we 409 and the caller retries.
-    let token = random_hex(3);
+    // 16-hex token → 2^64 space. Brute-force infeasible.
+    let token = random_hex(8);
     let rec = InviteRecord {
         token: token.clone(),
         invite_url: req.invite_url,
@@ -1864,7 +1863,7 @@ async fn handle_intro(
     // to the standard /v1/events/:slot_id with bearer auth.
     let kind = req.event.get("kind").and_then(Value::as_u64).unwrap_or(0);
     let type_str = req.event.get("type").and_then(Value::as_str).unwrap_or("");
-    if kind != 1100 && type_str != "pair_drop" && type_str != "agent_card" {
+    if kind != 1100 || (type_str != "pair_drop" && type_str != "agent_card") {
         return (
             StatusCode::BAD_REQUEST,
             Json(json!({
@@ -2204,6 +2203,13 @@ async fn responder_health_set(
     if let Err(resp) = check_token(&relay, &headers, &slot_id).await {
         return resp;
     }
+    if !is_valid_slot_id(&slot_id) {
+        return (
+            StatusCode::BAD_REQUEST,
+            Json(json!({"error": "invalid slot_id format"})),
+        )
+            .into_response();
+    }
     let path = relay
         .state_dir
         .join("responder-health")