fix: allow access to devices only by public ID

Device ID should never be allowed to use as access key,
because it can be guessed.

Author: coderbyheart

cdk/BackendStack.ts

@@ -71,6 +71,11 @@ export class BackendStack extends Stack {
 			description: 'name of the public devices table',
 			value: publicDevices.publicDevicesTable.tableName,
 		})
+		new CfnOutput(this, 'publicDevicesTableIdIndexName', {
+			exportName: `${this.stackName}:publicDevicesTableIdIndexName`,
+			description: 'name of the public devices table id index',
+			value: publicDevices.idIndex,
+		})
 
 		const api = new API(this)
 		api.addRoute(
@@ -192,6 +197,7 @@ export type StackOutputs = {
 	 */
 	gatewayDomainName?: string
 	publicDevicesTableName: string
+	publicDevicesTableIdIndexName: string
 	/**
 	 * Role ARN to use in the deploy GitHub Actions Workflow
 	 */

cdk/resources/CustomDevicesAPI.ts

@@ -66,6 +66,7 @@ export class CustomDevicesAPI extends Construct {
 				BACKEND_STACK_NAME: STACK_NAME,
 				OPENSSL_LAMBDA_FUNCTION_NAME: openSSLFn.functionName,
 				PUBLIC_DEVICES_TABLE_NAME: publicDevices.publicDevicesTable.tableName,
+				PUBLIC_DEVICES_ID_INDEX_NAME: publicDevices.idIndex,
 			},
 			...new LambdaLogGroup(this, 'createCredentialsFnLogs'),
 			initialPolicy: [SettingsPermissions(Stack.of(this))],

cdk/resources/DevicesAPI.ts

@@ -34,6 +34,7 @@ export class DevicesAPI extends Construct {
 			environment: {
 				VERSION: this.node.getContext('version'),
 				PUBLIC_DEVICES_TABLE_NAME: publicDevices.publicDevicesTable.tableName,
+				PUBLIC_DEVICES_ID_INDEX_NAME: publicDevices.idIndex,
 				PUBLIC_DEVICES_TABLE_MODEL_OWNER_CONFIRMED_INDEX_NAME:
 					publicDevices.publicDevicesTableModelOwnerConfirmedIndex,
 				NODE_NO_WARNINGS: '1',

cdk/resources/LwM2MShadow.ts

@@ -43,6 +43,7 @@ export class LwM2MShadow extends Construct {
 			environment: {
 				VERSION: this.node.getContext('version'),
 				PUBLIC_DEVICES_TABLE_NAME: publicDevices.publicDevicesTable.tableName,
+				PUBLIC_DEVICES_ID_INDEX_NAME: publicDevices.idIndex,
 			},
 			initialPolicy: [
 				new IAM.PolicyStatement({

cdk/resources/SenMLMessage.ts

@@ -61,6 +61,7 @@ export class SenMLMessages extends Construct {
 			environment: {
 				VERSION: this.node.getContext('version'),
 				PUBLIC_DEVICES_TABLE_NAME: publicDevices.publicDevicesTable.tableName,
+				PUBLIC_DEVICES_ID_INDEX_NAME: publicDevices.idIndex,
 				IMPORT_LOGS_TABLE_NAME: importLogs.tableName,
 			},
 			initialPolicy: [

cdk/resources/ShareAPI.ts

@@ -45,6 +45,7 @@ export class ShareAPI extends Construct {
 			environment: {
 				VERSION: this.node.getContext('version'),
 				PUBLIC_DEVICES_TABLE_NAME: publicDevices.publicDevicesTable.tableName,
+				PUBLIC_DEVICES_ID_INDEX_NAME: publicDevices.idIndex,
 				FROM_EMAIL: `notification@${domain}`,
 				NODE_NO_WARNINGS: '1',
 				IS_TEST: this.node.getContext('isTest') === true ? '1' : '0',
@@ -83,6 +84,7 @@ export class ShareAPI extends Construct {
 			environment: {
 				VERSION: this.node.getContext('version'),
 				PUBLIC_DEVICES_TABLE_NAME: publicDevices.publicDevicesTable.tableName,
+				PUBLIC_DEVICES_ID_INDEX_NAME: publicDevices.idIndex,
 				NODE_NO_WARNINGS: '1',
 			},
 			...new LambdaLogGroup(this, 'confirmOwnershipFnLogs'),
@@ -101,6 +103,7 @@ export class ShareAPI extends Construct {
 			environment: {
 				VERSION: this.node.getContext('version'),
 				PUBLIC_DEVICES_TABLE_NAME: publicDevices.publicDevicesTable.tableName,
+				PUBLIC_DEVICES_ID_INDEX_NAME: publicDevices.idIndex,
 				NODE_NO_WARNINGS: '1',
 			},
 			...new LambdaLogGroup(this, 'sharingStatusFnLogs'),

cli/cli.ts

@@ -64,18 +64,20 @@ const CLI = async ({ isCI }: { isCI: boolean }) => {
 		console.error('Running on CI...')
 	} else {
 		try {
-			const mapOutputs = await stackOutput(cf)<StackOutputs>(STACK_NAME)
+			const backendOutputs = await stackOutput(cf)<StackOutputs>(STACK_NAME)
 			commands.push(
 				registerCustomMapDevice({
 					db,
-					publicDevicesTableName: mapOutputs.publicDevicesTableName,
+					publicDevicesTableName: backendOutputs.publicDevicesTableName,
+					idIndex: backendOutputs.publicDevicesTableIdIndexName,
 					ssm,
 					env: accountEnv,
 					stackName: STACK_NAME,
 				}),
 				shareDevice({
 					db,
-					publicDevicesTableName: mapOutputs.publicDevicesTableName,
+					publicDevicesTableName: backendOutputs.publicDevicesTableName,
+					idIndex: backendOutputs.publicDevicesTableIdIndexName,
 				}),
 			)
 		} catch (error) {

cli/commands/register-custom-device.ts

@@ -6,7 +6,7 @@ import chalk from 'chalk'
 import { randomUUID } from 'node:crypto'
 import fs from 'node:fs/promises'
 import path from 'node:path'
-import { publicDevicesRepo } from '../../sharing/publicDevicesRepo.js'
+import { publicDevicesRepo } from '../../devices/publicDevicesRepo.js'
 import { createCA } from '@hello.nrfcloud.com/certificate-helpers/ca'
 import { createDeviceCertificate } from '@hello.nrfcloud.com/certificate-helpers/device'
 import type { CommandDefinition } from './CommandDefinition.js'
@@ -21,12 +21,14 @@ export const registerCustomMapDevice = ({
 	stackName,
 	db,
 	publicDevicesTableName,
+	idIndex,
 	env,
 }: {
 	ssm: SSMClient
 	stackName: string
 	db: DynamoDBClient
 	publicDevicesTableName: string
+	idIndex: string
 	env: Required<Environment>
 }): CommandDefinition => ({
 	command: 'register-custom-map-device <model> <email>',
@@ -43,6 +45,7 @@ export const registerCustomMapDevice = ({
 		const publicDevice = publicDevicesRepo({
 			db,
 			TableName: publicDevicesTableName,
+			idIndex,
 		})
 		const maybePublished = await publicDevice.share({
 			deviceId,

cli/commands/share-device.ts

@@ -1,17 +1,19 @@
 import type { DynamoDBClient } from '@aws-sdk/client-dynamodb'
 import { models } from '@hello.nrfcloud.com/proto-map'
 import chalk from 'chalk'
-import { publicDevicesRepo } from '../../sharing/publicDevicesRepo.js'
+import { publicDevicesRepo } from '../../devices/publicDevicesRepo.js'
 import type { CommandDefinition } from './CommandDefinition.js'
 
 const modelIDs = Object.keys(models)
 
 export const shareDevice = ({
 	db,
 	publicDevicesTableName,
+	idIndex,
 }: {
 	db: DynamoDBClient
 	publicDevicesTableName: string
+	idIndex: string
 }): CommandDefinition => ({
 	command: `share-device <deviceId> <model> <email>`,
 	action: async (deviceId, model, email) => {
@@ -27,6 +29,7 @@ export const shareDevice = ({
 		const publicDevice = publicDevicesRepo({
 			db,
 			TableName: publicDevicesTableName,
+			idIndex,
 		})
 		const maybePublished = await publicDevice.share({
 			deviceId,