coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Scope the read path by tenant (AUDIT-WP-0008-T04).
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
_read gated on may_read alone and never called permits_tenant, so any reader
credential could read every tenant through /v1/events, /v1/events/<id>,
/v1/dead-letters and /v1/secret-findings. Deployment bounded the exposure --
the only production sender holds may_read: false -- but the boundary was not in
the code, which is the difference between E2 and E1 on the tenancy posture
enforcement ladder.

Two rules, because the surfaces divide cleanly. Event reads are filtered to the
tenants the credential may act for. Surfaces with no tenant key to filter on --
stats, integrity, dead letters, secret findings -- require full tenant scope and
are refused rather than served instance-wide facts to a scoped reader.

A cross-tenant fetch returns 404 rather than 403. A distinguishable forbidden
would confirm that an event id exists and which tenant holds it, turning the
read surface into an existence oracle. Correlation lookup is filtered rather
than refused, since a correlation id legitimately spans tenants.

_readable_by fails closed: a record with no tenant is readable only at full
scope. Three existing tests read instance-wide surfaces with a scoped
credential, which this makes a 403; bound_app now carries an unrestricted
operator identity and those reads use it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-17 22:05:52 +02:00
parent 26defd9bec
commit aaa2b4c50b
6 changed files with 196 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

4
workplans/AUDIT-WP-0008-tenancy-posture-alignment.md
View file

@ -266,7 +266,7 @@ surface alongside `recoverable_days`.
```task
id: AUDIT-WP-0008-T02
status: todo
status: done
priority: high
state_hub_task_id: "224a12c0-d646-4c7f-9215-120e1ede4691"
```
@ -303,7 +303,7 @@ with the dependency open; it is not publishable with the dependency hidden.
```task
id: AUDIT-WP-0008-T04
status: todo
status: done
priority: high
state_hub_task_id: "e4440db3-6eb0-49f6-9aa9-930db8be9d18"
```