feat: updated saas platform

app/controllers/auth/sso_controller.py

@@ -27,7 +27,8 @@ class SSOController:
         db: Session,
         payload: SSOExchangeRequest,
         x_module_signature: Optional[str] = None,
-        x_module_key: Optional[str] = None
+        x_module_key: Optional[str] = None,
+        raw_headers: Optional[Dict[str, str]] = None,
     ):
         module = db.query(Module).filter(Module.module_id == payload.module_id).first()
         if not module:
@@ -46,24 +47,33 @@ class SSOController:
             headers["X-Module-Signature"] = x_module_signature
         if x_module_key:
             headers["X-Module-Key"] = x_module_key
+        # Optional today. A module that sends them gets replay protection; one
+        # that does not is accepted and logged, until
+        # MODULE_TRUST_REQUIRE_REPLAY_CONTROLS is turned on.
+        for header in (
+            "X-Module-Signature-Version",
+            "X-Module-Timestamp",
+            "X-Module-Nonce",
+        ):
+            value = (raw_headers or {}).get(header.lower())
+            if value:
+                headers[header] = value
             
         actual_body = payload.model_dump_json()
-        try:
-            TrustService.validate_module_trust(
-                environment=env,
-                request_headers=headers,
-                request_body=actual_body
-            )
-        except HTTPException:
-            logger.warning(
-                "HMAC verify with body failed for %s, trying empty fallback (DEPRECATED)",
-                payload.module_id,
-            )
-            TrustService.validate_module_trust(
-                environment=env,
-                request_headers=headers,
-                request_body=""
-            )
+
+        # There is deliberately no fallback here.
+        #
+        # This used to retry verification with an empty body when verification
+        # over the real body failed. The HMAC of the empty string is a constant
+        # per module environment, so anyone who ever observed that one signature
+        # could sign any grant-exchange body, forever — the check reported as
+        # protected while being permanently forgeable. A compatibility shim that
+        # disables the control it is shimming is worse than no control.
+        TrustService.validate_module_trust(
+            environment=env,
+            request_headers=headers,
+            request_body=actual_body,
+        )
         
         return SSOService.exchange_grant(
             db=db,