feat(telemetry): sign requests with HMAC-SHA256

.github/workflows/ci.yml

@@ -26,8 +26,12 @@ jobs:
         run: cargo fmt --check
       - name: Clippy
         run: cargo clippy -- -D warnings
+        env:
+          FERRFLOW_HMAC_SECRET: ${{ secrets.FERRFLOW_HMAC_SECRET }}
       - name: Tests
         run: cargo test
+        env:
+          FERRFLOW_HMAC_SECRET: ${{ secrets.FERRFLOW_HMAC_SECRET }}
 
   coverage:
     name: Coverage
@@ -40,6 +44,8 @@ jobs:
         run: cargo install cargo-tarpaulin
       - name: Generate coverage
         run: cargo tarpaulin --out xml --skip-clean
+        env:
+          FERRFLOW_HMAC_SECRET: ${{ secrets.FERRFLOW_HMAC_SECRET }}
       - uses: codecov/codecov-action@v6
         with:
           files: cobertura.xml

.github/workflows/release.yml

@@ -59,9 +59,13 @@ jobs:
       - name: Build (Linux)
         if: matrix.os == 'ubuntu-latest'
         run: cross build --release --target ${{ matrix.target }}
+        env:
+          FERRFLOW_HMAC_SECRET: ${{ secrets.FERRFLOW_HMAC_SECRET }}
       - name: Build (macOS / Windows)
         if: matrix.os != 'ubuntu-latest'
         run: cargo build --release --target ${{ matrix.target }}
+        env:
+          FERRFLOW_HMAC_SECRET: ${{ secrets.FERRFLOW_HMAC_SECRET }}
       - name: Package (Unix)
         if: matrix.os != 'windows-latest'
         run: |

Cargo.toml

@@ -28,7 +28,7 @@ path = "src/lib.rs"
 
 [features]
 default = ["cli"]
-cli = ["dep:git2", "dep:ureq", "dep:clap", "dep:colored"]
+cli = ["dep:git2", "dep:ureq", "dep:clap", "dep:colored", "dep:hmac"]
 
 [dependencies]
 serde = { version = "1", features = ["derive"] }
@@ -47,6 +47,7 @@ git2 = { version = "0.20", features = ["vendored-libgit2", "vendored-openssl"],
 ureq = { version = "3", features = ["json"], optional = true }
 sha2 = "0.11.0"
 hex = "0.4.3"
+hmac = { version = "0.13", optional = true }
 
 [dev-dependencies]
 cargo-husky = { version = "1", default-features = false, features = ["user-hooks"] }

src/telemetry.rs

@@ -1,8 +1,16 @@
+use hmac::{Hmac, KeyInit, Mac};
 use serde::Serialize;
 use sha2::Digest;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+type HmacSha256 = Hmac<sha2::Sha256>;
 
 const DEFAULT_API_URL: &str = "https://api.ferrflow.com";
 
+fn hmac_secret() -> &'static str {
+    option_env!("FERRFLOW_HMAC_SECRET").unwrap_or(env!("FERRFLOW_HMAC_SECRET"))
+}
+
 #[derive(Debug, Clone, Copy, Serialize)]
 #[serde(rename_all = "snake_case")]
 #[allow(dead_code)]
@@ -83,11 +91,30 @@ pub fn send_event(
     let url = format!("{}/events", api_url());
 
     std::thread::spawn(move || {
+        let body = match serde_json::to_string(&payload) {
+            Ok(b) => b,
+            Err(_) => return,
+        };
+
+        let timestamp = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap()
+            .as_secs()
+            .to_string();
+
+        let message = format!("{timestamp}.{body}");
+        let mut mac = HmacSha256::new_from_slice(hmac_secret().as_bytes())
+            .expect("HMAC accepts any key length");
+        mac.update(message.as_bytes());
+        let signature = hex::encode(mac.finalize().into_bytes());
+
         let agent = ureq::Agent::new_with_defaults();
         let _ = agent
             .post(&url)
             .header("Content-Type", "application/json")
-            .send_json(&payload);
+            .header("X-Timestamp", &timestamp)
+            .header("X-Signature", &signature)
+            .send(body.as_bytes());
     });
 }