Two security improvements to redbear-notifications:
1. InvokeAction sender + ID + action_key validation.
Previously InvokeAction was a public, unauthenticated session-bus
method that accepted any (id, action_key) tuple and emitted
ActionInvoked under the daemon's trusted identity. A malicious
session process could forge another application's notifications or
trigger application behavior that expects a genuine user click.
Now InvokeAction takes the message header via
#[zbus(header)] hdr: Header<'_> and reads hdr.sender(). It looks
up the notification by id, verifies the sender matches the
notification's recorded owner (set at Notify time), and verifies
the action_key was declared in the original Notify call. Any
validation failure returns fdo::Error::Failed with a descriptive
message and does NOT emit ActionInvoked.
2. Active-notification tracking.
Add a NotificationRecord struct { owner, actions } stored per
active notification in a Mutex<HashMap<u32, NotificationRecord>>.
Notify() now inserts the record and tracks the sender. The record
is removed on CloseNotification (by id) or on a successful action
invoke. Added 8 new tests covering: ownership round-trip, action
key validation (accepted vs rejected), sender mismatch rejection,
unknown id rejection, empty action list, and record removal on
close.
Verified: 16/16 notifications tests pass (8 new + 8 existing).
vasilito
1dc5b0dcb0