[si1k]

Fixes #1490

Summary

/register currently accepts correlation IDs that the callback handlers cannot recognize. For example, a 20-character ID containing w registers successfully, but subsequent callbacks are silently dropped because w is outside the xid alphabet. Uppercase registration IDs also create unusable storage keys: callback handlers lowercase DNS names before looking them up.

Validate the registered ID's configured length, xid alphabet, and lowercase storage-key form before creating storage or incrementing session metrics. Return HTTP 400 with the expected format when it is incompatible. Reuse the prefix predicate in callback recognition so registration and delivery use the same length/alphabet definition. The existing callback alphabets, case-insensitive DNS handling, nonce validation, and custom-length behavior remain unchanged.

Document the format and add regression tests for rejected registrations, unchanged storage/metrics, valid default and custom lengths, uppercase callback hostnames, and both HTTP/HTTPS handlers. Registration does not receive the per-callback nonce, so it cannot validate that future value; the documentation and tests retain that distinction.

Related: #1373, which tightened callback recognition. The separate ZAP client fix uses the native alphabets; this server fix makes incompatible registrations fail visibly rather than loosening callback recognition.

Validation

• All seven invalid-registration cases fail on original dev and pass with this fix.
• go build ./... passes, including the example package.
• All packages pass race-enabled tests, run in two non-overlapping groups: server/storage/client first, then the remaining packages (307 passing test/subtest events total).
• An independent loopback fixture using the patched ZAP service delivers, polls, decrypts, and correlates all 18 HTTP/DNS/SMTP callbacks on this server: both payload APIs and bare/adjacent abc/extra-label a. prefixes. Consumed callbacks are not replayed. The same client also passes against original Interactsh 1.3.1 and 1.4.1.

go build ./...
go test -race -count=1 ./...

The full matrix was run locally on macOS; upstream CI provides the additional platform checks. This PR does not change SMTP listeners, TLS, or client token generation.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 07f4c8ac-2687-4219-b4cf-d67e7c838b92

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}