Validate every Domain Store metadata row

crates/lazaret-host-coordinator/src/domain_store.rs

@@ -223,10 +223,7 @@ impl HostCoordinatorDomainStore {
             TableError::TableDoesNotExist(_) => DomainStoreError::MissingMetadata,
             other => DomainStoreError::Table(other),
         })?;
-        let value = table
+        read_metadata(&table)?;
-            .get(SINGLETON_KEY)?
-            .ok_or(DomainStoreError::MissingMetadata)?;
-        let _: DomainStoreMetadata = decode(value.value())?;
         Ok(())
     }
 
@@ -318,6 +315,23 @@ fn read_domain(table: &redb::ReadOnlyTable<u8, &[u8]>) -> Result<Domain, DomainS
     domain.ok_or(DomainStoreError::MissingRow("Domain"))
 }
 
+fn read_metadata(
+    table: &redb::ReadOnlyTable<u8, &[u8]>,
+) -> Result<DomainStoreMetadata, DomainStoreError> {
+    let mut metadata = None;
+    for entry in table.iter()? {
+        let (key, value) = entry?;
+        let record: DomainStoreMetadata = decode(value.value())?;
+        if key.value() != SINGLETON_KEY {
+            return Err(DomainStoreError::InvalidRow("StoreMetadata key"));
+        }
+        if metadata.replace(record).is_some() {
+            return Err(DomainStoreError::DuplicateRow("StoreMetadata"));
+        }
+    }
+    metadata.ok_or(DomainStoreError::MissingMetadata)
+}
+
 fn read_participants(
     table: &redb::ReadOnlyTable<&[u8; 9], &[u8]>,
 ) -> Result<Vec<Participant>, DomainStoreError> {

crates/lazaret-host-coordinator/src/domain_store/tests.rs

@@ -226,6 +226,27 @@ fn metadata_and_typed_row_validation_fail_closed() {
         Err(DomainStoreError::Codec(_))
     ));
 
+    let extra_metadata_directory = TestDirectory::new("extra-metadata-row");
+    drop(open_store(&extra_metadata_directory));
+    let database = Database::open(extra_metadata_directory.path("domain.redb")).unwrap();
+    let write = database.begin_write().unwrap();
+    {
+        let mut table = write.open_table(METADATA).unwrap();
+        table.insert(1, &[0xff, 0xff][..]).unwrap();
+    }
+    write.commit().unwrap();
+    drop(database);
+    let lock =
+        try_exclusive_flock(lock_file(&extra_metadata_directory.path("domain.lock"))).unwrap();
+    assert!(matches!(
+        HostCoordinatorDomainStore::open(
+            lock,
+            &extra_metadata_directory.path("domain.redb"),
+            &domain(),
+        ),
+        Err(DomainStoreError::Codec(_))
+    ));
+
     let row_directory = TestDirectory::new("row-key");
     let store = open_store(&row_directory);
     store