1 files changed, 78 insertions, 26 deletions

diff --git a/src/zencompute/httpcomputeservice.cpp b/src/zencompute/httpcomputeservice.cpp
index bdfd9d197..bd3f4e70e 100644
--- a/src/zencompute/httpcomputeservice.cpp
+++ b/src/zencompute/httpcomputeservice.cpp
@@ -93,13 +93,14 @@ struct HttpComputeService::Impl
 		uint64_t NewBytes = 0;
 	};
 
-	IngestStats IngestPackageAttachments(const CbPackage& Package);
-	bool		CheckAttachments(const CbObject& ActionObj, std::vector<IoHash>& NeedList);
-	void		HandleWorkersGet(HttpServerRequest& HttpReq);
-	void		HandleWorkersAllGet(HttpServerRequest& HttpReq);
-	void		WriteQueueDescription(CbWriter& Cbo, int QueueId, const ComputeServiceSession::QueueStatus& Status);
-	void		HandleWorkerRequest(HttpServerRequest& HttpReq, const IoHash& WorkerId);
-	void		HandleSubmitAction(HttpServerRequest& HttpReq, int QueueId, int Priority, const WorkerDesc* Worker);
+	bool IngestPackageAttachments(HttpServerRequest& HttpReq, const CbPackage& Package, IngestStats& OutStats);
+	bool CheckAttachments(const CbObject& ActionObj, std::vector<IoHash>& NeedList);
+	bool ValidateAttachmentHash(HttpServerRequest& HttpReq, const CbAttachment& Attachment);
+	void HandleWorkersGet(HttpServerRequest& HttpReq);
+	void HandleWorkersAllGet(HttpServerRequest& HttpReq);
+	void WriteQueueDescription(CbWriter& Cbo, int QueueId, const ComputeServiceSession::QueueStatus& Status);
+	void HandleWorkerRequest(HttpServerRequest& HttpReq, const IoHash& WorkerId);
+	void HandleSubmitAction(HttpServerRequest& HttpReq, int QueueId, int Priority, const WorkerDesc* Worker);
 
 	// WebSocket / observer
 	void OnWebSocketOpen(Ref<WebSocketConnection> Connection);
@@ -373,7 +374,7 @@ HttpComputeService::Impl::RegisterRoutes()
 			if (HttpResponseCode ResponseCode = m_ComputeService.FindActionResult(ActionId, /* out */ Output);
 				ResponseCode != HttpResponseCode::OK)
 			{
-				ZEN_TRACE("jobs/{}/{}: {}", Req.GetCapture(1), Req.GetCapture(2), ToString(ResponseCode))
+				ZEN_DEBUG("jobs/{}/{}: {}", Req.GetCapture(1), Req.GetCapture(2), ToString(ResponseCode))
 
 				if (ResponseCode == HttpResponseCode::NotFound)
 				{
@@ -1167,35 +1168,81 @@ HttpComputeService::Impl::ResolveQueueRef(HttpServerRequest& HttpReq, std::strin
 	return ParseInt<int>(Capture).value_or(0);
 }
 
-HttpComputeService::Impl::IngestStats
-HttpComputeService::Impl::IngestPackageAttachments(const CbPackage& Package)
+bool
+HttpComputeService::Impl::ValidateAttachmentHash(HttpServerRequest& HttpReq, const CbAttachment& Attachment)
 {
-	IngestStats Stats;
+	const IoHash	 ClaimedHash = Attachment.GetHash();
+	CompressedBuffer Buffer		 = Attachment.AsCompressedBinary();
+	const IoHash	 HeaderHash	 = Buffer.DecodeRawHash();
+
+	if (HeaderHash != ClaimedHash)
+	{
+		ZEN_WARN("attachment header hash mismatch: claimed {} but header contains {}", ClaimedHash, HeaderHash);
+		HttpReq.WriteResponse(HttpResponseCode::BadRequest);
+		return false;
+	}
+
+	IoHashStream Hasher;
+
+	bool DecompressOk = Buffer.DecompressToStream(
+		0,
+		Buffer.DecodeRawSize(),
+		[&](uint64_t /*SourceOffset*/, uint64_t /*SourceSize*/, uint64_t /*Offset*/, const CompositeBuffer& Range) -> bool {
+			for (const SharedBuffer& Segment : Range.GetSegments())
+			{
+				Hasher.Append(Segment.GetView());
+			}
+			return true;
+		});
+
+	if (!DecompressOk)
+	{
+		ZEN_WARN("attachment {}: failed to decompress", ClaimedHash);
+		HttpReq.WriteResponse(HttpResponseCode::BadRequest);
+		return false;
+	}
+
+	const IoHash ActualHash = Hasher.GetHash();
+
+	if (ActualHash != ClaimedHash)
+	{
+		ZEN_WARN("attachment hash mismatch: claimed {} but decompressed data hashes to {}", ClaimedHash, ActualHash);
+		HttpReq.WriteResponse(HttpResponseCode::BadRequest);
+		return false;
+	}
+
+	return true;
+}
 
+bool
+HttpComputeService::Impl::IngestPackageAttachments(HttpServerRequest& HttpReq, const CbPackage& Package, IngestStats& OutStats)
+{
 	for (const CbAttachment& Attachment : Package.GetAttachments())
 	{
 		ZEN_ASSERT(Attachment.IsCompressedBinary());
 
-		const IoHash	 DataHash = Attachment.GetHash();
-		CompressedBuffer DataView = Attachment.AsCompressedBinary();
-
-		ZEN_UNUSED(DataHash);
+		if (!ValidateAttachmentHash(HttpReq, Attachment))
+		{
+			return false;
+		}
 
-		const uint64_t CompressedSize = DataView.GetCompressedSize();
+		const IoHash	 DataHash		= Attachment.GetHash();
+		CompressedBuffer DataView		= Attachment.AsCompressedBinary();
+		const uint64_t	 CompressedSize = DataView.GetCompressedSize();
 
-		Stats.Bytes += CompressedSize;
-		++Stats.Count;
+		OutStats.Bytes += CompressedSize;
+		++OutStats.Count;
 
 		const CidStore::InsertResult InsertResult = m_CidStore.AddChunk(DataView.GetCompressed().Flatten().AsIoBuffer(), DataHash);
 
 		if (InsertResult.New)
 		{
-			Stats.NewBytes += CompressedSize;
-			++Stats.NewCount;
+			OutStats.NewBytes += CompressedSize;
+			++OutStats.NewCount;
 		}
 	}
 
-	return Stats;
+	return true;
 }
 
 bool
@@ -1253,7 +1300,10 @@ HttpComputeService::Impl::HandleSubmitAction(HttpServerRequest& HttpReq, int Que
 			{
 				CbPackage Package = HttpReq.ReadPayloadPackage();
 				Body			  = Package.GetObject();
-				Stats			  = IngestPackageAttachments(Package);
+				if (!IngestPackageAttachments(HttpReq, Package, Stats))
+				{
+					return;	 // validation failed, response already written
+				}
 				break;
 			}
 
@@ -1268,8 +1318,7 @@ HttpComputeService::Impl::HandleSubmitAction(HttpServerRequest& HttpReq, int Que
 	{
 		// --- Batch path ---
 
-		// For CbObject payloads, check all attachments upfront before enqueuing anything
-		if (HttpReq.RequestContentType() == HttpContentType::kCbObject)
+		// Verify all action attachment references exist in the store
 		{
 			std::vector<IoHash> NeedList;
 
@@ -1345,7 +1394,6 @@ HttpComputeService::Impl::HandleSubmitAction(HttpServerRequest& HttpReq, int Que
 
 	// --- Single-action path: Body is the action itself ---
 
-	if (HttpReq.RequestContentType() == HttpContentType::kCbObject)
 	{
 		std::vector<IoHash> NeedList;
 
@@ -1491,10 +1539,14 @@ HttpComputeService::Impl::HandleWorkerRequest(HttpServerRequest& HttpReq, const
 							{
 								ZEN_ASSERT(Attachment.IsCompressedBinary());
 
+								if (!ValidateAttachmentHash(HttpReq, Attachment))
+								{
+									return;
+								}
+
 								const IoHash	 DataHash = Attachment.GetHash();
 								CompressedBuffer Buffer	  = Attachment.AsCompressedBinary();
 
-								ZEN_UNUSED(DataHash);
 								TotalAttachmentBytes += Buffer.GetCompressedSize();
 								++AttachmentCount;