docs: resolve tenant security audit

2026-07-10 03:05:58 +08:00
parent 5e412761d2
commit 682bc70563
11 changed files with 368 additions and 2 deletions
@@ -1,7 +1,7 @@
 # Audit tenant, authentication, and request security boundaries

 Type: research
-Status: open
+Status: resolved

 ## Question

@@ -10,3 +10,31 @@ Organization boundary, bypass the intended platform/org/project authorization
 seams, expose secrets, or accept unbounded hostile input in the initial
 production topology?

+## Answer
+
+Yes. Basic org-admin HTTP/Prisma scoping is correctly enforced and its 28
+targeted integration tests pass, but the agent inherits service secrets and can
+read sibling files, MCP file/context tools accept real targets outside the run
+objects, queued/card actions do not consistently bind or reauthorize their
+target, non-ACTIVE tenants can still trigger agents, and Feishu/provider
+credentials remain global instead of ADR-0021 org-scoped encrypted secrets.
+Current Node and Rust dependency audits also fail on high/vulnerability/unsound
+advisories.
+
+The complete contract mapping, reproductions, positive evidence, advisory
+inventory, and required release proofs are in the
+[tenant, authentication, and request security audit](../assets/tenant-auth-security-audit.md).
+
+The newly-clear implementation and decision frontier is:
+
+- [Confine the agent runtime and protect service credentials](16-confine-agent-and-protect-credentials.md)
+- [Close MCP context and file-delivery escape paths](17-close-mcp-data-egress-escapes.md)
+- [Bind and reauthorize deferred and card actions](18-bind-and-reauthorize-deferred-actions.md)
+- [Design the org-scoped secret and connection control plane](19-design-org-scoped-secret-control-plane.md)
+- [Design the production browser and session boundary](20-design-production-web-session-boundary.md)
+- [Clear dependency advisories and gate releases](21-clear-dependency-security-advisories.md)
+- [Enforce Organization status at the shared authorization seam](22-enforce-organization-status.md)
+
+Inbound Feishu file count/size/MIME and request-rate policy remain owned by
+[Define initial abuse and capacity controls](05-define-abuse-capacity-controls.md)
+rather than being guessed in this audit.
@@ -2,7 +2,7 @@

 Type: task
 Status: open
-Blocked by: 01, 02, 03, 04, 05, 06, 07, 09, 10, 11, 12, 13, 14, 15
+Blocked by: 01, 02, 03, 04, 05, 06, 07, 09, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22

 ## Question

@@ -0,0 +1,12 @@
+# Confine the agent runtime and protect service credentials
+
+Type: task
+Status: open
+
+## Question
+
+Make the real Claude SDK/Bash execution surface uphold `AgentFileOp.Authorized`:
+deny sibling tenant workspaces and service files, expose only the minimum safe
+process environment, use SDK credential protection for secrets, and add an
+actual Linux sandbox test proving another workspace and every non-provider
+credential are unreadable while required tools still work.
@@ -0,0 +1,11 @@
+# Close MCP context and file-delivery escape paths
+
+Type: task
+Status: open
+
+## Question
+
+Restrict file delivery to a realpath/no-follow target inside the current project
+workspace, remove Git-root access, make inbound Hub writes symlink-safe, and
+validate every Feishu message/thread result against the run's bound chat before
+returning data to the model.
@@ -0,0 +1,11 @@
+# Bind and reauthorize deferred and card actions
+
+Type: task
+Status: open
+
+## Question
+
+At execution time, reauthorize queued/batched triggers and validate one
+actor/chat/organization/project/run-or-pending-action tuple for interrupt,
+approval, and onboarding card actions so revoked permissions and mismatched
+object IDs cannot affect another project.
@@ -0,0 +1,12 @@
+# Design the org-scoped secret and connection control plane
+
+Type: grilling
+Status: open
+
+## Question
+
+Which key-management, envelope-encryption, rotation, connection identity, and
+runtime resolver design will implement ADR-0021's org-scoped Feishu and model
+provider credentials, support one customer-owned Feishu app per tenant, and
+ensure plaintext credentials never reach business records, logs, or agent
+tools?
@@ -0,0 +1,11 @@
+# Design the production browser and session boundary
+
+Type: grilling
+Status: open
+
+## Question
+
+What same-origin/CSRF, proxy/TLS, security-header, session lifetime,
+revocation, secret rotation, and request-timeout contract should the initial
+org-admin web surface enforce, and which parts require server-side session state
+rather than the current seven-day stateless cookie?
@@ -0,0 +1,11 @@
+# Clear dependency advisories and gate releases
+
+Type: task
+Status: open
+
+## Question
+
+Remove every current `npm audit --omit=dev` high finding and every `cargo audit`
+vulnerability/unsound finding through tested upgrades, compatible overrides or
+upstream fixes—not ignores—and add reproducible Node and Rust security-audit
+gates to CI and the production release evidence.
@@ -0,0 +1,11 @@
+# Enforce Organization status at the shared authorization seam
+
+Type: task
+Status: open
+
+## Question
+
+Make non-ACTIVE Organizations fail closed for project authorization,
+onboarding, queued execution, and Feishu triggers through one shared seam, with
+negative tests proving a SUSPENDED or ARCHIVED tenant cannot create, bind,
+trigger, resume, or mutate work while operator recovery remains explicit.