coulomb/test-driver
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Constrain authenticated HTTP origins and verify realization surfaces

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e76f-be98-7ae3-965d-e0b31290a4c4
This commit is contained in:
tegwick 2026-09-28 14:12:31 +02:00
parent 0f8559f442
commit e419bfe029
9 changed files with 273 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

27
docs/TestDriverGeneralisationReview.md
View file

@ -292,3 +292,30 @@ isolation guards before and during runs. Sixteen failed before implementation;
the focused suite passed 69 tests afterward. Decision: `2ecac1c5-5254-4ce9-b092-b47c3e1283a9`.
Full-suite validation: **363 tests passed** in 153.10 seconds.
## Authenticated HTTP and surface boundaries (2026-09-28)
Authenticated HTTP now stays on the configured scheme, host and effective port.
Absolute and protocol-relative targets are validated before adding credentials;
redirects are validated before forwarding a request. Userinfo and unsupported
schemes are rejected. Same-origin relative/absolute URLs and redirects continue
to work. Browser sessions turn origin violations into existing surface findings.
The generator embeds the same stdlib helper definitions in standalone descendants;
the checked-in descendant is updated too. No runtime framework dependency is
introduced into generated tests, and no package dependency is added.
Runner also validates the realization's reported surface against the original
scheduled action, so a driver that forgets its check cannot certify forbidden
surface substitution. This is a post-call guard: drivers must still check before
acting, and an actual side effect cannot be undone by the runner. It does not
attest a dishonest driver's report. Origin restrictions likewise do not claim
path-level authorization or protect against an already compromised allowed host.
Tests use synthetic bearer credentials and local HTTP servers to verify that
rejected targets/redirects receive no requests, across sessions, freshly generated
modules and the checked-in descendant. Coverage includes five redirect codes,
protocol-relative targets, scheme/userinfo rejection, normal origin equivalence,
same-origin redirect chains and driver omission blocking acceptance/freezing.
The focused subset passed **107 tests**. Decision: `88490ee8-839d-40dc-affa-b00a1c68e3c5`.
Full-suite validation: **398 tests passed** in 165.81 seconds.