rstillwell/deckhearth
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
deckhearth/docs/project/security-audit-fanout-20260915.md
Randall Stillwell 45f823a84e
Some checks failed
CI / Lint (pull_request) Has been cancelled
Details
CI / Schema map up to date (pull_request) Has been cancelled
Details
CI / Forbidden patterns (9 checks) (pull_request) Has been cancelled
Details
CI / Migrations apply (node-pg-migrate) (pull_request) Has been cancelled
Details
CI / Unit tests (vitest) (pull_request) Has been cancelled
Details
Convoy metrics gate / Require role-event telemetry on convoy PRs (pull_request) Has been cancelled
Details
PR Health rollup / Aggregate gate status (pull_request) Has been cancelled
Details
Preview smoke / Should run? (pull_request) Has been cancelled
Details
Preview smoke / Playwright smoke (pull_request) Has been cancelled
Details
feat(pricing): wire Lorcast (Lorcana) + TCGdex (Pokemon) + docs 
- lib/card-import/lorcana-bulk.js: Lorcast per-card pricing via api.lorcast.com/v0/cards/search (10 req/sec, 110ms delay, 429 retry) as cross-check to Foilio feed
- lib/card-import/pokemon-bulk.js: TCGdex pricing (already wired via lib/pricing/tcgdex-client.js)
- test/lib/card-import-lorcana-bulk.test.js: new price fields in mapper
- docs/project/pricing-api-research-20260915.md: final verified source matrix
- docs/DOKPLOY_DEPLOY.md: pricing API env vars
2026-09-16 16:24:43 -05:00

1.5 KiB
Raw Blame History

Security Audit Fan-out — 2026-09-15

Layers executed: L1 (auth boundary), L2 (AuthZ / IDOR), L3 (input / prompt-injection), L4 (secrets / AES-GCM), L5 (adapter isolation), L6 (provenance / logging).

Status: L1 OK (13 protected routes), L2 PARTIAL (requireAccess drafted; AccessGrant join MISSING — prevents brief-2/brief-3 adapter PRs per AGENTS.md rule 7), L3 OK, L4 OK, L5 FINDING (disconnect-route direct provider ref outside adapter — isolation broken), L6 OK (logCollectionActivity + actorType verified).

L2: AuthZ / IDOR — AccessGrant join MISSING

  • requireAccess: helper drafted (tests/lib/auth/idor.spec.ts)
  • DB query missing LEFT JOIN collection_permissions cp ... on AccessGrant table for resource-level authorization
  • Fix: add join to withCollectionPermission / getUserFromRequest queries before brief-2/3 adapter PRs merge

L5: Adapter isolation — disconnect-route MISSING

  • pages/api/auth/disconnect/route.ts (or equivalent adapter-route) must contain ONLY adapter-layer imports (../../lib/auth-adapter/*)
  • Current: direct provider import (import { AuthentikProvider } from '@auth/core/providers/authentik';) outside adapter — breaks isolation
  • Fix: extract provider call to adapter layer; route calls adapter only

Files requiring changes before adapter PR merge

  • pages/api/auth/disconnect/route.ts (L5 isolation)
  • lib/auth/requireAccess.ts (L2 AccessGrant join)
  • tests/lib/auth/idor.spec.ts (regression locks)