feat(session): Validate MLS Add Proposals Against Known Users

[thomas-vilte]

Overview

This Pull Request introduces a critical security enhancement to the MLS session management by implementing validation for "add" proposals. Previously, any well-formed "add" proposal would be processed by the MLS client. With this change, the system now verifies that any user proposed for addition to an MLS group is a pre-approved, known user within the session's context.

Key Changes

• Add Proposal Validation Logic: I've modified the processProposalBatchLocked function in session/mls.go to include a new validation step. Before processing an Add proposal, the system now extracts the UserID from the proposal's KeyPackage.
• Known User Check: The extracted UserID is then checked against the session's internal list of known users (s.users). If the UserID is not found in this list, the Add proposal is explicitly ignored, preventing unauthorized additions.
• Robust Error Handling for Identity Parsing: A new helper function, addProposalUserID, was introduced to safely extract the UserID from an Add proposal. This function includes robust error handling for cases where the identity bytes cannot be parsed into a UserID (e.g., malformed credentials), ensuring such proposals are rejected.
• Conditional Commit for Proposals: The processProposalBatchLocked function now returns a boolean indicating whether any append proposals were successfully accepted. This allows processAndCommitProposalBatchLocked to skip the commit phase if no valid append proposals were processed, optimizing group state updates.
• Comprehensive Test Coverage: I've added a new test file, session/proposal_validation_test.go, which includes dedicated unit tests to verify the new validation logic. These tests cover scenarios for ignoring unexpected adds, accepting expected adds, and rejecting adds with unparseable identities.
• Dependency Update: Updated the mls-go dependency to v1.5.0 in go.mod and examples/voice/go.mod.

Technical Impact

• Enhanced Security: This change significantly improves the security posture of MLS groups by preventing malicious or accidental additions of unknown users. Only users explicitly designated as "known" by the DAVE system can be added to a group.
• Increased System Robustness: By validating incoming Add proposals, the system becomes more resilient to malformed or unauthorized proposals, reducing the risk of unexpected group state changes or potential attack vectors.
• Improved Efficiency: The conditional commit logic ensures that the expensive MLS commit operation is only performed when actual append proposals have been successfully processed, leading to more efficient group management.
• Maintainability: The new addProposalUserID helper centralizes the logic for extracting user IDs from add proposals, improving code clarity and maintainability.

🧪 Test Plan & Evidence

Suggested Manual Verification

• Unit Tests: Run go test ./... and ensure all tests pass
• No Regressions: Verify that related features still work as expected