coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Build authorization-gated tenancy evidence harness

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0260c-4067-7052-9647-ad000d576e38
This commit is contained in:
tegwick 2026-08-21 23:53:27 +02:00
parent 2c8e1d41ad
commit beab2a04d1
32 changed files with 1816 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

41
probe-packs/audit-core-e2.json Normal file
View file

@ -0,0 +1,41 @@
{
"schema_version": "whitehat-probe-pack/v1",
"target": "audit-core",
"posture_claim": "E2",
"attacker_model": "docs/attacker-model.md#3-e2--authenticated-tenant-a-at-the-service-boundary",
"notes": [
"Use two read-enabled scoped sender identities, each restricted to its fixture tenant.",
"A correlation id deliberately spans services; the expected result is the caller's readable tenant slice.",
"Instance-wide stats, integrity, dead-letter and secret-finding routes are excluded because their contract is operator-only, not tenant-scoped."
],
"probes": [
{
"id": "audit-event-by-id",
"operation": "read",
"route": "GET /v1/events/{tenant_b_event_id}",
"owner": "tenant B sender reads tenant B fixture event",
"attacker": "tenant A sender substitutes tenant B fixture event id",
"absent": "tenant A sender reads a reserved absent event id",
"finding": "tenant B fixture marker is returned or existence differs from absent"
},
{
"id": "audit-correlation-slice",
"operation": "read",
"route": "GET /v1/events?correlation_id={shared_correlation_id}",
"owner": "tenant B sender queries correlation shared by A and B fixture events",
"attacker": "tenant A sender queries the same correlation",
"absent": "tenant A sender queries a reserved correlation with no events",
"finding": "tenant B fixture marker appears in tenant A's readable slice"
},
{
"id": "audit-append-as-b",
"operation": "create",
"route": "POST /v1/events",
"owner": "tenant B sender appends a tenant B control event",
"attacker": "tenant A sender submits a new event claiming tenant B",
"absent": "tenant A sender submits an otherwise equivalent disallowed-tenant control",
"finding": "append succeeds or subsequent tenant B state contains the attacker event"
}
]
}