v1.7.2

What's changed in v1.7.2

• fix: trust gRPC metadata over payload session vars; mask internal errors (#79) (by @patrickleet)

  The gRPC transport let the request payload session_variables override
  transport metadata when building the Session. Behind a trusted gateway
  that injects authenticated identity headers as gRPC metadata, a client
  could spoof identity by putting x-hasura-user-id / x-hasura-role in
  the request body (e.g. claim role admin or impersonate another user) —
  the payload silently won. This is an identity-spoofing hole.

  Trust model (now documented loudly on Session, the HTTP/gRPC entry
  points, and the README "Security / Trust Boundary" section): the
  framework does NOT authenticate. A trusted proxy must strip
  client-supplied x-hasura-* headers and inject only authenticated ones.
  Transport metadata/headers are trusted; the request payload is not.

  Changes:

  • gRPC build_session: apply payload vars first, then let trusted
    metadata overwrite colliding keys. Metadata now wins. Payload-only
    keys still pass through (preserves the Hasura-action path where
    verified claims arrive in the payload with no metadata injected).
  • gRPC errors: route the response body through a shared
    HandlerError::client_facing_message(), masking internal (5xx)
    detail to "Internal server error" and logging the original
    server-side. Previously gRPC returned raw e.to_string(), which
    could leak SQL/driver detail — HTTP already masked. The masking
    policy now lives in one place (error.rs) and both transports reuse
    it (no duplicated logic).
  • Docs: rustdoc trust-boundary notes on Session,
    session_from_headers, and build_session; README HTTP/gRPC
    transport notes plus a dedicated "Security / Trust Boundary" section.
  • Tests: gRPC metadata-wins-over-payload (anti-spoof) and
    payload-applies-when-metadata-absent; HTTP client-supplied identity
    header trusted verbatim (documents why the proxy is required).

  Implements [[tasks/grpc-session-metadata-precedence]]
  Also covers the gRPC error-masking item from
  [[tasks/transport-ingress-security-hardening]]

  Co-authored-by: Claude Fable 5 noreply@anthropic.com

See full diff: v1.7.1...v1.7.2