Enforce caller identity in wh_Auth_BaseUserGet

[yosuke-wolfssl]

Problem

wh_Auth_BaseUserGet took no caller identity and performed no authorization
check, while its three sibling handlers (BaseUserDelete,
BaseUserSetPermissions, BaseUserSetCredentials) all take current_user_id
and gate on WH_AUTH_IS_ADMIN. Any session holding the AUTH group +
USER_GET action bit could read any account's full authorization profile —
admin flag, per-group/per-action bitmaps, and the keyIds array — since
wh_Server_HandleAuthRequest flattens it straight to the wire. Returning
WH_ERROR_NOTFOUND vs WH_ERROR_OK additionally gave any such caller a free
account-enumeration oracle.
Addressed by F-4237.

Fix (src/wh_auth_base.c)

Added current_user_id to the backend function and the whAuthCb.UserGet
vtable slot; wh_Auth_UserGet now forwards context->user.user_id.

• Non-admin may read only its own record; any other lookup returns
  WH_ERROR_ACCESS.
• Admin may read any record.
• A denied lookup and a missing name both return WH_ERROR_ACCESS to a
  non-admin, so the response is not an existence oracle.
• The added user_id == WH_USER_ID_INVALID guard also closes a latent bug where
  an empty username matched a zeroed user slot.

Signature change touches the vtable; the three in-tree whAuthCb initializers
compile unchanged. Closes F-4237.

Tests (test-refactor/client-server/wh_test_auth.c)

New whTest_AuthUserGet covering: non-admin reads another user (denied, no id
leaked), non-admin reads self (allowed, perms verified), non-admin reads unknown
name (denied, same error as above), admin reads any user (allowed, perms
verified), admin reads unknown (WH_ERROR_NOTFOUND).

Verification

• Functional: whTest_AuthUserGet + all 9 auth tests pass — 20 passed, 0 failed
  (NOCRYPTO=1 AUTH=1).
• Compile-clean under -std=c90 -Werror for AUTH, AUTH THREADSAFE, and the
  legacy test/ harness.
• Test-only negative control confirmed: pre-fix the non-admin-reads-other
  assertion fails; post-fix it passes.

[Copilot]

Pull request overview

Note

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Tightens authorization for wh_Auth_BaseUserGet by requiring caller identity and enforcing admin/self-only access, preventing user-profile disclosure and account enumeration.

Changes:

• Updated UserGet backend + callback/vtable signatures to include current_user_id, and forwarded it from wh_Auth_UserGet.
• Enforced access rules in wh_Auth_BaseUserGet (admin can read any; non-admin can read only self; non-admin gets WH_ERROR_ACCESS for denied/missing).
• Added a new client-server test (whTest_AuthUserGet) and registered it in the test list.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
wolfhsm/wh_auth_base.h	Updates wh_Auth_BaseUserGet API and documents new access rules.
wolfhsm/wh_auth.h	Extends auth callback vtable UserGet signature and updates docs for caller-gated behavior.
src/wh_auth_base.c	Implements authorization checks and non-admin result masking in wh_Auth_BaseUserGet.
src/wh_auth.c	Forwards context->user.user_id into the UserGet callback.
test-refactor/client-server/wh_test_auth.c	Adds whTest_AuthUserGet covering admin/non-admin access and oracle behavior.
test-refactor/wh_test_list.c	Registers the new auth test in the client test suite.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #480

Scan targets checked: wolfhsm-core-bugs, wolfhsm-crypto-bugs, wolfhsm-src

No new issues found in the changed files. ✅

[Frauschi]

LGTM