fix(resolver): enforce terminal Git trailer block and noreply recipient safety

- Require Signed-off-by to be in the terminal Git trailer block, rejecting sign-offs followed by later body text
- Never resolve recipient email solely from matching contributor-controlled names when commit author uses @users.noreply.github.com
- Preserve exact noreply DCO attribution (dcoVerified: true) while keeping recipient unresolved (resolvedEmail: null)
- Add regression tests for terminal trailer block parsing and noreply spoofing prevention

Signed-off-by: Parth Gartan <parthgartan26feb@gmail.com>

Author: PARTH-TUSSLE

utils/identity-resolver.js

@@ -36,25 +36,57 @@ function maskEmail(email) {
 }
 
 /**
- * Extracts all valid Signed-off-by trailers from a commit message.
+ * Extracts all valid Signed-off-by trailers from the terminal Git trailer block of a commit message.
  * Formats supported: "Signed-off-by: First Last <email@domain.com>"
- * Strictly validates trailer syntax and email format.
+ *
+ * Terminal Trailer Block Rules (Git interpret-trailers specification):
+ * 1. Must be located in the terminal paragraph at the end of the commit message.
+ * 2. Every line in the terminal block must be a valid trailer line ("Token: Value").
+ * 3. No subsequent body text may follow the trailer block.
+ * 4. Strictly validates trailer syntax and email format.
  *
  * @param {string} message Commit message
  * @returns {Array<{ name: string, email: string }>}
  */
 function extractDcoTrailers(message) {
   if (!message || typeof message !== 'string') return [];
+
+  // Normalize line breaks and trim trailing whitespace
+  const normalized = message.replace(/\r\n/g, '\n').replace(/\r/g, '\n').trimEnd();
+  if (!normalized) return [];
+
+  // Split into paragraphs separated by one or more blank lines
+  const paragraphs = normalized.split(/\n[ \t]*\n+/);
+  const terminalParagraph = paragraphs[paragraphs.length - 1].trim();
+  if (!terminalParagraph) return [];
+
+  const lines = terminalParagraph.split('\n');
+
+  // Verify that EVERY line in the terminal paragraph is a valid trailer line
+  // (e.g. "Signed-off-by: ...", "Co-authored-by: ...", "Fixes: ...", "Token: Value")
+  const genericTrailerRegex = /^[ \t]*[A-Za-z0-9-_]+:[ \t]*.*$/;
+  for (const line of lines) {
+    if (!genericTrailerRegex.test(line)) {
+      // If there is regular body text in the terminal block, it is not a valid trailer block
+      return [];
+    }
+  }
+
+  // Parse Signed-off-by trailers from the terminal trailer block
+  const dcoTrailerRegex = /^[ \t]*Signed-off-by:[ \t]*([^<\r\n]+)<([^>\r\n]+)>[ \t]*$/i;
   const trailers = [];
-  const regex = /^[ \t]*Signed-off-by:[ \t]*([^<\r\n]+)<([^>\r\n]+)>[ \t]*$/gim;
-  let match;
-  while ((match = regex.exec(message)) !== null) {
-    const name = match[1].trim();
-    const rawEmail = match[2].trim();
-    if (name && isValidEmail(rawEmail)) {
-      trailers.push({ name, email: rawEmail.toLowerCase() });
+
+  for (const line of lines) {
+    const match = dcoTrailerRegex.exec(line);
+    if (match) {
+      const name = match[1].trim();
+      const rawEmail = match[2].trim();
+      if (name && isValidEmail(rawEmail)) {
+        trailers.push({ name, email: rawEmail.toLowerCase() });
+      }
     }
   }
+
   return trailers;
 }
 
@@ -107,6 +139,12 @@ function isTrailerAttributableToAuthor(trailer, gitAuthor) {
  * → DCO Signed-off-by trailer deterministically attributable to that commit author
  * → verified RFC-compliant email
  *
+ * Security & Anti-Spoofing Invariant:
+ * When a commit author uses a GitHub noreply email (@users.noreply.github.com),
+ * a real recipient email is NEVER resolved solely from matching contributor-controlled names.
+ * Exact noreply DCO attribution is preserved (dcoVerified: true), but resolvedEmail
+ * remains null.
+ *
  * Privacy Invariant:
  * The returned reason string NEVER contains plaintext contributor email addresses.
  *
@@ -148,13 +186,18 @@ function resolveIdentity(prAuthor, commits) {
   }
 
   const commitEmails = [];
+  let hasNoreplyAuthor = false;
 
   for (let idx = 0; idx < authorCommits.length; idx++) {
     const item = authorCommits[idx];
     const sha = (item && item.sha ? item.sha.slice(0, 7) : `commit-${idx + 1}`);
 
     // Git commit author metadata
     const gitAuthor = item.commit && item.commit.author ? item.commit.author : {};
+    const gitEmail = (gitAuthor.email || '').trim().toLowerCase();
+    if (gitEmail.endsWith('@users.noreply.github.com')) {
+      hasNoreplyAuthor = true;
+    }
 
     // Extract DCO trailers
     const message = item.commit ? item.commit.message : (item.message || '');
@@ -204,12 +247,23 @@ function resolveIdentity(prAuthor, commits) {
 
   const verifiedEmail = distinctEmails[0];
 
-  // If the verified trailer is a GitHub noreply address, DCO is valid but recipient cannot be mapped to a Layer5 user
-  if (verifiedEmail.endsWith('@users.noreply.github.com')) {
+  // If the commit author used a GitHub noreply address (@users.noreply.github.com),
+  // never resolve a real recipient email solely from contributor-controlled names.
+  // Exact noreply DCO attribution is preserved (dcoVerified: true), but recipient
+  // remains unresolved (resolvedEmail: null).
+  if (hasNoreplyAuthor || verifiedEmail.endsWith('@users.noreply.github.com')) {
+    if (verifiedEmail.endsWith('@users.noreply.github.com')) {
+      return {
+        resolvedEmail: null,
+        dcoVerified: true,
+        reason: `Verified ${authorCommits.length} commit(s) by @${prAuthor} with DCO Signed-off-by trailer, but recipient uses a GitHub noreply address (@users.noreply.github.com) which cannot be mapped to a Layer5 award recipient`
+      };
+    }
+
     return {
       resolvedEmail: null,
       dcoVerified: true,
-      reason: `Verified ${authorCommits.length} commit(s) by @${prAuthor} with DCO Signed-off-by trailer, but recipient uses a GitHub noreply address (@users.noreply.github.com) which cannot be mapped to a Layer5 award recipient`
+      reason: `Verified ${authorCommits.length} commit(s) by @${prAuthor} with DCO Signed-off-by trailer, but commit author uses a GitHub noreply address (@users.noreply.github.com); recipient cannot be resolved from contributor-controlled names`
     };
   }
 

utils/identity-resolver.test.js

@@ -64,6 +64,38 @@ test('extractDcoTrailers rejects unanchored and prefixed trailer lines', () => {
   assert.equal(trailers[0].email, 'lee@layer5.io');
 });
 
+test('extractDcoTrailers rejects Signed-off-by followed by later body text (terminal trailer block invariant)', () => {
+  // 1. Later body text in a subsequent paragraph
+  const msgWithLaterParagraph = `feat(api): update endpoints\n\nSigned-off-by: Lee Calcote <lee@layer5.io>\n\nNote: This commit was later amended and should not be credited.`;
+  assert.equal(extractDcoTrailers(msgWithLaterParagraph).length, 0);
+
+  // 2. Later body text in the same paragraph
+  const msgWithSameParagraphBody = `feat(api): update endpoints\n\nSigned-off-by: Lee Calcote <lee@layer5.io>\nAdditional explanatory body text here.`;
+  assert.equal(extractDcoTrailers(msgWithSameParagraphBody).length, 0);
+
+  // 3. Body text before Signed-off-by in the same paragraph without blank line
+  const msgWithPrecedingParagraphBody = `feat(api): update endpoints\n\nSome body text without empty line separation\nSigned-off-by: Lee Calcote <lee@layer5.io>`;
+  assert.equal(extractDcoTrailers(msgWithPrecedingParagraphBody).length, 0);
+});
+
+test('resolveIdentity fails closed when Signed-off-by is not in terminal trailer block', () => {
+  const commits = [
+    {
+      sha: 'terminal1234567',
+      author: { login: 'leecalcote' },
+      commit: {
+        author: { name: 'Lee Calcote', email: 'lee@layer5.io' },
+        message: 'fix: update configuration\n\nSigned-off-by: Lee Calcote <lee@layer5.io>\n\nLater text explaining the change'
+      }
+    }
+  ];
+
+  const result = resolveIdentity('leecalcote', commits);
+  assert.equal(result.dcoVerified, false);
+  assert.equal(result.resolvedEmail, null);
+  assert.ok(result.reason.includes('missing a valid DCO Signed-off-by trailer'));
+});
+
 test('isTrailerAttributableToAuthor handles direct matches and noreply requirements', () => {
   // Direct email match
   assert.equal(
@@ -144,7 +176,7 @@ test('resolveIdentity: normal author + matching sign-off', () => {
   assert.equal(result.resolvedEmail, 'lee@layer5.io');
 });
 
-test('resolveIdentity: GitHub noreply commit author with matching trailer name', () => {
+test('resolveIdentity: GitHub noreply commit author with matching trailer name preserves DCO but keeps recipient unresolved', () => {
   const commits = [
     {
       sha: 'noreply12345678',
@@ -157,8 +189,30 @@ test('resolveIdentity: GitHub noreply commit author with matching trailer name',
   ];
 
   const result = resolveIdentity('octocat', commits);
-  assert.equal(result.dcoVerified, true);
-  assert.equal(result.resolvedEmail, 'mona@example.com');
+  assert.equal(result.dcoVerified, true, 'DCO attribution is preserved for matching trailer name');
+  assert.equal(result.resolvedEmail, null, 'Must never resolve recipient email solely from matching contributor-controlled name on noreply author');
+  assert.ok(result.reason.includes('cannot be resolved from contributor-controlled names'));
+});
+
+test('resolveIdentity: spoofing regression - attacker using noreply author cannot claim victim email via matching trailer name', () => {
+  const victimEmail = 'victim@layer5.io';
+  const commits = [
+    {
+      sha: 'spoof12345678',
+      author: { login: 'attacker' },
+      commit: {
+        // Attacker sets their git author name to victim's name, but author email is attacker's GitHub noreply
+        author: { name: 'Victim User', email: '99999+attacker@users.noreply.github.com' },
+        message: `feat: malicious change\n\nSigned-off-by: Victim User <${victimEmail}>`
+      }
+    }
+  ];
+
+  const result = resolveIdentity('attacker', commits);
+  assert.equal(result.resolvedEmail, null, 'Must never resolve spoofed victim email from noreply commit author');
+  assert.equal(result.dcoVerified, true, 'DCO trailer name match preserves DCO attribution');
+  assert.ok(result.reason.includes('cannot be resolved from contributor-controlled names'));
+  assert.equal(result.reason.includes(victimEmail), false, 'Reason must not leak victim email');
 });
 
 test('resolveIdentity: GitHub noreply commit author who signs off with noreply address (CASE B)', () => {