21 lines
1.5 KiB
Markdown
21 lines
1.5 KiB
Markdown
|
# Security Audit Fan-out — 2026-09-15
|
||
|
|
|
||
|
|
Layers executed: L1 (auth boundary), L2 (AuthZ / IDOR), L3 (input / prompt-injection), L4 (secrets / AES-GCM), L5 (adapter isolation), L6 (provenance / logging).
|
||
|
|
|
||
|
|
Status: L1 OK (13 protected routes), L2 PARTIAL (`requireAccess` drafted; `AccessGrant` join MISSING — prevents brief-2/brief-3 adapter PRs per AGENTS.md rule 7), L3 OK, L4 OK, L5 FINDING (`disconnect-route` direct provider ref outside adapter — isolation broken), L6 OK (`logCollectionActivity` + `actorType` verified).
|
||
|
|
|
||
|
|
## L2: AuthZ / IDOR — AccessGrant join MISSING
|
||
|
|
- `requireAccess`: helper drafted (tests/lib/auth/idor.spec.ts)
|
||
|
|
- DB query missing `LEFT JOIN collection_permissions cp ...` on `AccessGrant` table for resource-level authorization
|
||
|
|
- Fix: add join to `withCollectionPermission` / `getUserFromRequest` queries before brief-2/3 adapter PRs merge
|
||
|
|
|
||
|
|
## L5: Adapter isolation — disconnect-route MISSING
|
||
|
|
- `pages/api/auth/disconnect/route.ts` (or equivalent adapter-route) must contain ONLY adapter-layer imports (`../../lib/auth-adapter/*`)
|
||
|
|
- Current: direct provider import (`import { AuthentikProvider } from '@auth/core/providers/authentik';`) outside adapter — breaks isolation
|
||
|
|
- Fix: extract provider call to adapter layer; route calls adapter only
|
||
|
|
|
||
|
|
## Files requiring changes before adapter PR merge
|
||
|
|
- `pages/api/auth/disconnect/route.ts` (L5 isolation)
|
||
|
|
- `lib/auth/requireAccess.ts` (L2 `AccessGrant` join)
|
||
|
|
- `tests/lib/auth/idor.spec.ts` (regression locks)
|