24 lines
816 B
Markdown
24 lines
816 B
Markdown
|
# Security Audit Implementation — 2026-09-15
|
||
|
|
|
||
|
|
Fixes needed before adapter PR (brief-2 / brief-3) per AGENTS.md rule 7.
|
||
|
|
|
||
|
|
## 1. L2: AccessGrant join (AuthZ / IDOR)
|
||
|
|
|
||
|
|
Add `AccessGrant` join to `requireAccess` query pattern. Every protected resource must verify:
|
||
|
|
```sql
|
||
|
|
SELECT ... FROM resource r
|
||
|
|
LEFT JOIN access_grants ag ON ag.resource_id = r.id AND ag.user_id = ?
|
||
|
|
WHERE r.id = ? AND (ag.status = 'granted' OR r.owner_id = ?)
|
||
|
|
```
|
||
|
|
|
||
|
|
Files to edit:
|
||
|
|
- `lib/auth/requireAccess.ts`
|
||
|
|
- `tests/lib/auth/idor.spec.ts` (add regression assertions)
|
||
|
|
|
||
|
|
## 2. L5: Adapter isolation (disconnect-route)
|
||
|
|
|
||
|
|
Create / fix adapter-route so provider ref stays inside adapter:
|
||
|
|
- Route: `pages/api/auth/disconnect/route.ts`
|
||
|
|
- Adapter: `lib/auth-adapter/disconnect-adapter.js`
|
||
|
|
- Route must import ONLY adapter; adapter holds provider reference.
|