From b539df8e48867cf271606efb80dabb8ea45a660b Mon Sep 17 00:00:00 2001 From: Ravi Khadiwala Date: Thu, 9 Jul 2026 15:15:54 -0500 Subject: [PATCH] Add some missing authentication specifiers --- service/src/main/proto/org/signal/chat/account.proto | 4 ++++ service/src/main/proto/org/signal/chat/call_quality.proto | 3 +++ service/src/main/proto/org/signal/chat/calling.proto | 3 +++ service/src/main/proto/org/signal/chat/credentials.proto | 2 ++ service/src/main/proto/org/signal/chat/device.proto | 2 ++ service/src/main/proto/org/signal/chat/keys.proto | 2 ++ service/src/main/proto/org/signal/chat/payments.proto | 6 +++++- service/src/main/proto/org/signal/chat/profile.proto | 4 ++++ 8 files changed, 25 insertions(+), 1 deletion(-) diff --git a/service/src/main/proto/org/signal/chat/account.proto b/service/src/main/proto/org/signal/chat/account.proto index c300b8597..0eeeca55a 100644 --- a/service/src/main/proto/org/signal/chat/account.proto +++ b/service/src/main/proto/org/signal/chat/account.proto @@ -11,6 +11,8 @@ import "org/signal/chat/tag.proto"; // Provides methods for working with Signal accounts. service Accounts { + option (require.auth) = AUTH_ONLY_AUTHENTICATED; + // Returns basic identifiers for the authenticated account. rpc GetAccountIdentity(GetAccountIdentityRequest) returns (GetAccountIdentityResponse) {} @@ -68,6 +70,8 @@ service Accounts { // Provides methods for looking up Signal accounts. Callers must not provide // identifying credentials when calling methods in this service. service AccountsAnonymous { + option (require.auth) = AUTH_ONLY_ANONYMOUS; + // Checks whether an account with the given service identifier exists. rpc CheckAccountExistence(CheckAccountExistenceRequest) returns (CheckAccountExistenceResponse) {} diff --git a/service/src/main/proto/org/signal/chat/call_quality.proto b/service/src/main/proto/org/signal/chat/call_quality.proto index c8ba55db2..4438c5f55 100644 --- a/service/src/main/proto/org/signal/chat/call_quality.proto +++ b/service/src/main/proto/org/signal/chat/call_quality.proto @@ -9,8 +9,11 @@ option java_multiple_files = true; package org.signal.chat.calling.quality; +import "org/signal/chat/require.proto"; + // Provides methods for submitting call quality surveys service CallQuality { + option (require.auth) = AUTH_ONLY_ANONYMOUS; // Submits a call quality survey response. rpc SubmitCallQualitySurvey(SubmitCallQualitySurveyRequest) returns (SubmitCallQualitySurveyResponse) {} diff --git a/service/src/main/proto/org/signal/chat/calling.proto b/service/src/main/proto/org/signal/chat/calling.proto index 0079f322e..afe6972c6 100644 --- a/service/src/main/proto/org/signal/chat/calling.proto +++ b/service/src/main/proto/org/signal/chat/calling.proto @@ -9,9 +9,12 @@ option java_multiple_files = true; package org.signal.chat.calling; +import "org/signal/chat/require.proto"; + // Provides methods for getting credentials and relay options for one-on-one // calls. service Calling { + option (require.auth) = AUTH_ONLY_AUTHENTICATED; // Retrieves TURN credentials and relay options for one-on-one calls. rpc GetCallingRelays(GetCallingRelaysRequest) returns (GetCallingRelaysResponse) {} diff --git a/service/src/main/proto/org/signal/chat/credentials.proto b/service/src/main/proto/org/signal/chat/credentials.proto index 3b0d4dc06..644f7a514 100644 --- a/service/src/main/proto/org/signal/chat/credentials.proto +++ b/service/src/main/proto/org/signal/chat/credentials.proto @@ -15,6 +15,7 @@ package org.signal.chat.credentials; // authenticated user to authenticate in another service or context without // revealing their identity. service Credentials { + option (require.auth) = AUTH_ONLY_AUTHENTICATED; // Generates and returns an external service credentials for the caller. rpc GetExternalServiceCredentials(GetExternalServiceCredentialsRequest) @@ -40,6 +41,7 @@ service Credentials { // revealing an association between the credentials and the caller's identity to // the server. service CredentialsAnonymous { + option (require.auth) = AUTH_ONLY_ANONYMOUS; // Given a list of secure value recovery (SVR) service credentials and a phone // number, checks and returns which of the provided credentials were generated diff --git a/service/src/main/proto/org/signal/chat/device.proto b/service/src/main/proto/org/signal/chat/device.proto index 90eeb7ca1..06ad70d59 100644 --- a/service/src/main/proto/org/signal/chat/device.proto +++ b/service/src/main/proto/org/signal/chat/device.proto @@ -18,6 +18,8 @@ import "org/signal/chat/tag.proto"; // Provides methods for working with devices attached to a Signal account. service Devices { + option (require.auth) = AUTH_ONLY_AUTHENTICATED; + // Returns a list of devices associated with the caller's account. rpc GetDevices(GetDevicesRequest) returns (GetDevicesResponse) {} diff --git a/service/src/main/proto/org/signal/chat/keys.proto b/service/src/main/proto/org/signal/chat/keys.proto index cbc2b9bd9..ad4c97431 100644 --- a/service/src/main/proto/org/signal/chat/keys.proto +++ b/service/src/main/proto/org/signal/chat/keys.proto @@ -18,6 +18,7 @@ import "org/signal/chat/tag.proto"; // Provides methods for working with pre-keys. service Keys { + option (require.auth) = AUTH_ONLY_AUTHENTICATED; // Retrieves an approximate count of the number of the various kinds of // pre-keys stored for the authenticated device. @@ -57,6 +58,7 @@ service Keys { // Provides methods for working with pre-keys using "unidentified access" // credentials. service KeysAnonymous { + option (require.auth) = AUTH_ONLY_ANONYMOUS; // Retrieves a set of pre-keys for establishing a session with the targeted // device or devices. Callers must not submit any self-identifying credentials diff --git a/service/src/main/proto/org/signal/chat/payments.proto b/service/src/main/proto/org/signal/chat/payments.proto index 901f746fb..79e94550b 100644 --- a/service/src/main/proto/org/signal/chat/payments.proto +++ b/service/src/main/proto/org/signal/chat/payments.proto @@ -9,9 +9,13 @@ option java_multiple_files = true; package org.signal.chat.payments; +import "org/signal/chat/require.proto"; + // Provides methods for working with payments. service Payments { - + option (require.auth) = AUTH_ONLY_AUTHENTICATED; + + rpc GetCurrencyConversions(GetCurrencyConversionsRequest) returns (GetCurrencyConversionsResponse) {} } diff --git a/service/src/main/proto/org/signal/chat/profile.proto b/service/src/main/proto/org/signal/chat/profile.proto index 86655c066..d458b9b93 100644 --- a/service/src/main/proto/org/signal/chat/profile.proto +++ b/service/src/main/proto/org/signal/chat/profile.proto @@ -18,6 +18,8 @@ import "org/signal/chat/tag.proto"; // Provides methods for working with profiles and profile-related data. service Profile { + option (require.auth) = AUTH_ONLY_AUTHENTICATED; + // Sets profile data and, if needed, returns credentials used by clients to upload a v1 avatar. rpc SetProfile(SetProfileRequest) returns (SetProfileResponse) {} @@ -42,6 +44,8 @@ service Profile { // without an unidentified access key should use the equivalent, authenticated // methods in `Profile` instead. service ProfileAnonymous { + option (require.auth) = AUTH_ONLY_ANONYMOUS; + // Retrieves versioned profile data. rpc GetVersionedProfile(GetVersionedProfileAnonymousRequest) returns (GetVersionedProfileAnonymousResponse) {} // Retrieves unversioned profile data.