[HLR] Address bsv-x402 security audit findings

[sgbett]

Problem

The white-hat security audit of PR #194 (bsv-x402 gem) identified three medium-severity findings that should be remediated. None are blocking for merge, but all represent hardening that should land before production use.

Audit report: #194 (comment)

Findings

M-1: Unbounded MemoryChallengeStore (memory DoS)

File: lib/bsv/x402/challenge_store.rb

Any unauthenticated client can hammer a protected endpoint, causing the in-memory challenge store to grow without bound. No rate limit or eviction is applied before challenge issuance.

Remediation: Add TTL-based eviction keyed off expires_at, which Challenge objects already carry. Evict expired entries on each store or fetch call (lazy eviction), or run periodic cleanup.

M-2: No explicit size limit on decoded transaction bytes

File: lib/bsv/x402/verifier.rb

The outer 64 KiB header cap provides an implicit upper bound (~48 KiB decoded), but there is no explicit assertion on decoded transaction bytes before they are passed to the SDK deserialiser.

Remediation: Add an explicit byte-size cap (e.g. 100 KiB) on decoded transaction bytes in the verifier's transaction decode step, making the boundary intentional rather than incidental.

M-3: Non-constant-time challenge hash comparison

File: lib/bsv/x402/verifier.rb

String#== short-circuits on the first differing byte. The challenge_sha256 and txid comparisons should use OpenSSL.fixed_length_secure_compare to prevent timing side-channels.

Remediation: Replace == with OpenSSL.fixed_length_secure_compare for all security-sensitive string comparisons (challenge_sha256, txid). Note: OpenSSL.fixed_length_secure_compare is available from Ruby 2.7+.

Acceptance Criteria

• MemoryChallengeStore evicts expired challenges (lazy or periodic)
• MemoryChallengeStore has a configurable maximum size cap
• Decoded transaction bytes checked against explicit size limit before deserialisation
• All security-sensitive comparisons (challenge_sha256, txid) use constant-time comparison
• Existing specs still pass
• New specs cover eviction behaviour, size limit rejection, and comparison timing safety

References

• PR feat(x402): implement BSV x402 protocol middleware gem #194: feat(x402): implement BSV x402 protocol middleware gem
• HLR [HLR] BSV x402 protocol middleware gem #97: BSV x402 protocol middleware gem
• Security audit comment: feat(x402): implement BSV x402 protocol middleware gem #194 (comment)