fix(authz): protect purpose-bound runtime integrity - #65
Conversation
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
@opencode-agent Please review the current unchanged head against protected |
|
@coderabbitai review Please review exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Exact revision =='
git rev-parse HEAD
git status --short
printf '%s\n' '== Merge base with develop =='
git merge-base HEAD develop
printf '%s\n' '== Changed files =='
git diff --name-status develop...HEAD
printf '%s\n' '== Python structure candidates =='
fd -e py . | xargs -r ast-grep outline --items all --type class,function --match 'AuthorizationDecision|Authorization|Decision' 2>/dev/null || true
printf '%s\n' '== Focused diff =='
git diff --find-renames --unified=80 develop...HEAD -- '*.py'Length of output: 44422 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Authorization module, complete numbered source =='
cat -n packages/keyverse-adapter/src/orgmetra_keyverse_adapter/authorization.py
printf '%s\n' '== Direct constructors and consumer references =='
rg -n -C 8 --glob '*.py' \
'(AuthorizationDecision\s*\(|\bAuthorizationDecision\b)' \
packages services
printf '%s\n' '== Existing adapter authorization tests =='
cat -n packages/keyverse-adapter/tests/test_authorization.py
printf '%s\n' '== Persistence-boundary authorization validation =='
sed -n '150,230p' services/people-api/src/orgmetra_people_api/postgres_hire.py
sed -n '1,260p' services/people-api/src/orgmetra_people_api/postgres_mutations.py
printf '%s\n' '== Decision construction test map =='
rg -n -C 5 --glob 'test_*.py' \
'(AuthorizationDecision\s*\(|_decision\s*\(|allowed=False|authorized_fields)' \
packages/keyverse-adapter/tests services/people-api/tests services/job-analysis-api/testsLength of output: 169233
High: Prevent
|
|
@coderabbitai review Please review exact head |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='39b6a3f96534dfecf1d2accbbf852f305a908027'
base='ef1b143368cb6249c9520ca8cae10ebe844a5aa1'
red_prefix='a0260ae'
test_successor_prefix='cb0b999'
prod_prefix='5660fc6'
printf '%s\n' '== Exact revision, base, and worktree =='
printf 'HEAD='; git rev-parse HEAD
printf 'MERGE_BASE='; git merge-base HEAD develop
git status --short
test "$(git rev-parse HEAD)" = "$head"
test "$(git merge-base HEAD develop)" = "$base"
printf '%s\n' '== Resolve stated commits and verify sequence =='
red="$(git rev-parse "$red_prefix")"
test_successor="$(git rev-parse "$test_successor_prefix")"
production="$(git rev-parse "$prod_prefix")"
printf 'RED=%s\nTEST_SUCCESSOR=%s\nPRODUCTION=%s\n' "$red" "$test_successor" "$production"
git merge-base --is-ancestor "$red" "$test_successor"
git merge-base --is-ancestor "$test_successor" "$production"
git merge-base --is-ancestor "$production" "$head"
git log --reverse --format='%H %P %s' --ancestry-path "$red..$head"
printf 'TEST_SUCCESSOR_PARENT='; git rev-parse "${test_successor}^"
printf 'PRODUCTION_PARENT='; git rev-parse "${production}^"
printf 'HEAD_PARENT='; git rev-parse "${head}^"
printf '%s\n' '== Changed files and exact commit deltas =='
git diff --name-status "$base...$head"
for commit in "$red" "$test_successor" "$production" "$head"; do
printf '\n== %s ==\n' "$commit"
git show --no-patch --format='%H%nParents: %P%nSubject: %s%n%b' "$commit"
git show --format= --name-status "$commit"
done
printf '%s\n' '== Net delta from first production commit to head =='
git diff --name-status "$production...$head"
git diff --check "$red...$head"
printf '%s\n' '== Find Authorization parsing sources and tests =='
fd -e py . packages services | while IFS= read -r file; do
if rg -q '(Authorization|authorization|Bearer|bearer|split\s*\()' "$file"; then
printf '%s\n' "$file"
fi
done
printf '%s\n' '== Authorization header length gates and parsing order =='
rg -n -A80 -B20 --glob '*.py' \
'(authorization.{0,20}(header|Header)|Authorization|Bearer|bearer|\.split\s*\(|8192|8199|8200|header.*length|length.*header)' \
packages services
printf '%s\n' '== Focused source/test changes in stated sequence =='
git diff --find-renames --unified=100 "$red^" "$head" -- '*.py'
printf '%s\n' '== Dedicated `#210` tests and token-length compatibility assertions =='
rg -n -A120 -B20 --glob 'test_*.py' \
'(8192|8199|8200|Authorization|authorization.*header|Bearer|bearer|too long|header.*length|token.*length)' \
packages services
printf '%s\n' '== Static parser statement order in candidate production files =='
python3 - <<'PY'
from pathlib import Path
import ast
for path in Path(".").glob("**/*.py"):
text = path.read_text(encoding="utf-8")
if not any(term in text for term in ("Authorization", "authorization", "Bearer", "bearer")):
continue
try:
tree = ast.parse(text, filename=str(path))
except SyntaxError:
continue
matches = []
for node in ast.walk(tree):
if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
source = ast.get_source_segment(text, node) or ""
if ("split(" in source and
any(term in source for term in ("Authorization", "authorization", "Bearer", "bearer"))):
matches.append(node)
if matches:
print(f"\n== {path} ==")
for fn in matches:
print(f"{fn.name}: Lines {fn.lineno}-{fn.end_lineno}")
for stmt in fn.body:
rendered = ast.unparse(stmt).splitlines()[0]
if any(term in rendered for term in ("split(", "len(", "8192", "8199", "8200", "authorization", "Authorization", "Bearer", "bearer")):
print(f" Line {stmt.lineno}: {rendered}")
PYLength of output: 204266 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='39b6a3f96534dfecf1d2accbbf852f305a908027'
red="$(git rev-parse a0260ae)"
test_successor="$(git rev-parse cb0b999)"
production="$(git rev-parse 5660fc6)"
people_auth='services/people-api/src/orgmetra_people_api/auth.py'
job_auth='services/job-analysis-api/src/orgmetra_job_analysis_api/auth.py'
people_test='services/people-api/tests/test_bearer_header_budget.py'
job_test='services/job-analysis-api/tests/test_bearer_header_budget.py'
test "$(git rev-parse HEAD)" = "$head"
printf '%s\n' '== Direct parent relationships =='
for commit in "$red" "$test_successor" "$production" "$head"; do
printf '\nCOMMIT='; git rev-parse "$commit"
printf 'PARENT='; git rev-parse "${commit}^"
git show --no-patch --format='SUBJECT=%s%nFILES:' "$commit"
git diff-tree --no-commit-id --name-status -r "$commit"
done
printf '%s\n' '== Exact source for both parsers =='
for file in "$people_auth" "$job_auth"; do
printf '\n== %s ==\n' "$file"
rg -n -A45 -B10 --glob '*.py' \
'^_MAX_(AUTHORIZATION_HEADER_LENGTH|BEARER_TOKEN_LENGTH)\s*=|^def extract_bearer_token\s*\(' \
"$file"
done
printf '%s\n' '== Exact `#210` regression files =='
for file in "$people_test" "$job_test"; do
printf '\n== %s ==\n' "$file"
cat -n "$file"
done
printf '%s\n' '== Test-first and production patches =='
for commit in "$red" "$test_successor" "$production" "$head"; do
printf '\n== PATCH %s ==\n' "$commit"
git show --format='%H %s' --find-renames --unified=80 "$commit" -- \
"$people_auth" "$job_auth" "$people_test" "$job_test"
done
printf '%s\n' '== Net source changes after first production commit =='
git diff --name-status "$production...$head"
git diff --find-renames --unified=80 "$production...$head" -- \
"$people_auth" "$job_auth" "$people_test" "$job_test"
printf '%s\n' '== Changed non-test files against protected base =='
git diff --name-only "$(git merge-base HEAD develop)...HEAD" |
while IFS= read -r file; do
case "$file" in
*/tests/*|*/test_*.py) ;;
*) printf '%s\n' "$file" ;;
esac
done
printf '%s\n' '== Static Python syntax check for reviewed files =='
python3 - <<'PY'
from pathlib import Path
import ast
for filename in (
"services/people-api/src/orgmetra_people_api/auth.py",
"services/job-analysis-api/src/orgmetra_job_analysis_api/auth.py",
"services/people-api/tests/test_bearer_header_budget.py",
"services/job-analysis-api/tests/test_bearer_header_budget.py",
):
ast.parse(Path(filename).read_text(encoding="utf-8"), filename=filename)
print(f"ast_parse=ok {filename}")
PYLength of output: 48328
I found no static issue in the requested The test-first sequence is direct:
Both services define: _MAX_BEARER_TOKEN_LENGTH = 8192
_MAX_AUTHORIZATION_HEADER_LENGTH = 8199Both
Therefore, an exact built-in header of 8,200 characters raises The 8,199-character header limit preserves the 8,192-character bearer-token limit because
The
The focused source and regression files pass static Python parsing. I found no unrelated source change in the I did not run repository tests or hosted workflows. I do not transfer predecessor findings, approval, or GREEN evidence. You are interacting with an AI system. |
Adopt protected develop@eb9757f after #161 integrated, preserving the purpose-bound authorization/runtime-integrity branch as first parent and the protected workflow consolidation as second parent. Workflow-owned paths use protected truth; service auth/runtime source remains on the canonical #65 writer branch. This merge intentionally leaves the foundation manifest to be resealed against the combined tree by the repository validation lane rather than copying stale per-workflow evidence.
|
@coderabbitai review Please review exact current head |
|
Oops, something went wrong! Please try again later. 🐰 💔 |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='47059d82011973855d7a540788500533859cc96a'
base='eb9757f8649aaad026a9865508d9aad50c1a7a4f'
printf '%s\n' '== Exact revision and protected base =='
printf 'HEAD='; git rev-parse HEAD
printf 'MERGE_BASE='; git merge-base HEAD develop
git status --short
test "$(git rev-parse HEAD)" = "$head"
test "$(git merge-base HEAD develop)" = "$base"
printf '%s\n' '== Ancestry and files changed against protected develop =='
git log --reverse --format='%H %P %s' --ancestry-path "$base..$head"
git diff --name-status "$base...$head"
printf '%s\n' '== Current head and parent delta =='
parent="$(git rev-parse "${head}^")"
printf 'PARENT=%s\n' "$parent"
git show --no-patch --format='HEAD=%H%nPARENTS=%P%nSUBJECT=%s%n%B' "$head"
git diff --name-status "$parent" "$head"
git diff --check "$parent" "$head"
git diff --find-renames --unified=100 "$parent" "$head" -- '*.py' '*.toml' '*.md'
printf '%s\n' '== `#211` candidates in history and source/tests =='
git log --all --format='%H %P %s' --grep='`#211`\|211' -i
rg -n -A80 -B20 --glob '*.py' --glob '*.md' --glob '*.toml' \
'(`#211`|downstream acceptance|shared.kernel|shared_kernel|hostile.*(timezone|text)|ZoneInfo|tzinfo|timezone|AuthorizationDecision)' \
.
printf '%s\n' '== Changed Python structure =='
git diff --name-only "$parent" "$head" -- '*.py' |
while IFS= read -r file; do
printf '\n== %s ==\n' "$file"
ast-grep outline "$file" --items all --type class,function \
--match 'accept|shared|kernel|timezone|text|snapshot|authorization|integrity' || true
done
printf '%s\n' '== Relevant shared-kernel and consumer package inventory =='
fd -e py . packages services | while IFS= read -r file; do
if rg -q '(ZoneInfo|tzinfo|timezone|hostile|runtime.integrity|snapshot_from_document|AuthorizationDecision)' "$file"; then
printf '%s\n' "$file"
fi
doneLength of output: 202385 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='47059d82011973855d7a540788500533859cc96a'
parent="$(git rev-parse "${head}^")"
test_file='services/job-analysis-api/tests/test_postgres_audit_scalar_time_integrity.py'
test "$(git rev-parse HEAD)" = "$head"
printf '%s\n' '== Focused commit scope =='
git show --no-patch --format='HEAD=%H%nPARENTS=%P%nSUBJECT=%s%n%B' "$head"
git diff-tree --no-commit-id --name-status -r "$head"
git diff --find-renames --unified=140 "$parent" "$head" -- "$test_file"
git diff --name-only "$parent" "$head" -- 'packages/hris-kernel/**' 'services/job-analysis-api/src/**'
printf '%s\n' '== Complete `#211` downstream acceptance test =='
cat -n "$test_file"
printf '%s\n' '== Focused imports and referenced symbols =='
rg -n -C 8 --glob '*.py' \
'(AuditOutboxEvent|_validate.*audit|audit.*scalar|occurred_at|content_digest|to_cloudevent|timezone|tzinfo)' \
services/job-analysis-api/src services/job-analysis-api/tests/test_postgres_audit_scalar_time_integrity.py \
packages/hris-kernel/src/orgmetra_hris_kernel/audit.py
printf '%s\n' '== Consumer package dependency declaration =='
for file in \
services/job-analysis-api/pyproject.toml \
packages/hris-kernel/pyproject.toml
do
printf '\n== %s ==\n' "$file"
cat -n "$file"
done
printf '%s\n' '== Shared-kernel audit API surface and static boundary order =='
ast-grep outline packages/hris-kernel/src/orgmetra_hris_kernel/audit.py \
--items all --type class,function --match 'AuditOutboxEvent|audit|validate|time|text'
rg -n -A150 -B20 --glob '*.py' \
'^(class AuditOutboxEvent|def _.*(?:time|text|validate)| def (to_cloudevent|canonical_json|content_digest))\b|type\s*\(|tzinfo|utcoffset|astimezone|isoformat|strip\(|split\(|encode\(' \
packages/hris-kernel/src/orgmetra_hris_kernel/audit.py \
services/job-analysis-api/src/orgmetra_job_analysis_api/postgres.py
printf '%s\n' '== Static test assertions for callback non-dispatch =='
rg -n -A50 -B12 --glob '*.py' \
'(test_durable_audit_rejects_executable_occurred_at_timezone_before_callback|callback|calls|AssertionError|Executable|Hostile|tzinfo|text)' \
"$test_file"Length of output: 191040
I found no static issue in the The commit changes only The test imports the public The test preserves
Each case supplies The current checked-out shared-kernel source is not yet the protected I did not transfer predecessor findings, approval, or GREEN evidence. I did not execute repository or hosted tests. You are interacting with an AI system. |
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
| type(self).calls += 1 | ||
| raise AssertionError("durable integer comparison executed before exact validation") | ||
|
|
||
| def __le__(self, other: object) -> bool: |
| type(self).calls += 1 | ||
| raise AssertionError("durable integer comparison executed before exact validation") | ||
|
|
||
| def __lt__(self, other: object) -> bool: |
| type(self).calls += 1 | ||
| raise AssertionError("durable integer comparison executed before exact validation") | ||
|
|
||
| def __gt__(self, other: object) -> bool: |
| class _ExecutableRowCollection(list[object]): | ||
| """Fail if database collection hooks run before the durable boundary.""" | ||
|
|
||
| def __bool__(self) -> bool: |
| def __len__(self) -> int: | ||
| raise AssertionError("row collection length executed") | ||
|
|
||
| def __getitem__(self, index: object) -> object: |
1 participant
Scope
Canonical Orgmetra purpose-bound authorization/runtime-integrity lane. Keyverse remains identity/credential/scope authority; Orgmetra remains HR policy/evidence authority. #65 does not copy mutable #63/#64/#141/Assignment source.
Current exact head remains
1caf8f760e81f1cb6954fdf1d0d13a46dbb6c0b1on protecteddevelop@eb9757f8649aaad026a9865508d9aad50c1a7a4f, open · Draft · mechanically mergeable. Its retained #182–#210 authorization hardening and package-rootvalidate_authorization_decision(...)flow remain valid delta.Current hosted RED and owner RCA
Foundation
33932302769, Repository quality101213236190, is a real exact-head RED. Checkout, runner, Foundation validation and dependency hygiene passed. All 118keyverse-adaptertests passed at 100% statement/branch coverage. The first failing consumer wasservices/job-analysis-api/tests/test_postgres_audit_scalar_time_integrity.py: three tests prove this branch's older sharedAuditEventimplementation executes caller-defined timezoneutcoffset()behavior duringcanonical_json()before rejecting invalid durable-audit evidence. The service suite ended 196 passed / 3 failed at 97.70%; PostgreSQL contracts were correctly skipped after the RED.This is the shared-kernel defect already owned and repaired by #63. #65 must not cherry-pick or copy #63's mutable source. Preserve this RED until #63 reaches protected
develop, then non-force adopt protected shared-kernel truth and reacquire exact-head acceptance. No PYTHONPATH workaround, test deletion, callback relaxation, coverage weakening, or mutable-source copy is valid.Owner prerequisites
#63 shared HRIS-kernel owner remains exact
72070cb4b8d636825ce5b1a326df4c296596ed7e. Foundation33936088421, Security33936088403, and SAST33936088456are terminal success. CodeQL33936088409remains non-passing in the central exact-head dispatch/handoff state, and qualifying approval is absent. #63 therefore remains Draft/unmerged.#64 generic People/hire owner is exact
4be7f1681959e43d32c8e85a8f2660da36ff6d9c. It preserves #229 result-integrity hardening, #230 direct-PostgreSQL command detachment, #231 pre-authorization command detachment, #232 exact allocation-ratio text, #233 the authoritative(0, 1.0000]parser/OpenAPI contract, #246 idempotent-replay reconciliation, the three wrong-width projection coverage regressions, and later protocol-conformant hostile-test tripwires.#64 now has terminal exact-head GREEN for Foundation
33981039419, Security Scan33981039429, and SAST Semgrep33981039445. Foundation includes People API 239/239 passing tests, 1472 statements / 482 branches at 100.00%, all other owned suites, isolated PostgreSQL contracts, dependency checks and read-only validation. CodeQL PR33981039424is terminal failure only in the central compatibility-handoff stage: language detection succeeded; both actions and python compatibility jobs successfully requested current-head scan dispatch and then failed atRelease runner or enforce current-head CodeQL verdict, with no terminalcodeql-dispatch/<language>status exposed. This remains non-passing, not a source-vulnerability verdict and not a reason for an Orgmetra no-op push.#64 is still mutable owner source, not protected truth. Formal reviews remain COMMENTED-only with no qualifying
APPROVEDreview, so #64 stays Draft/unmerged despite its deterministic/security GREEN lanes.#64 and #65 overlap on
hire.py,mutations.py,postgres_hire.py, andpostgres_mutations.py. After #63 integrates and then #64 integrates normally, #65 must non-force adopt the protected #64 state while preserving #229–#233, #246, its acceptance regressions/test contracts, and #65's own detached/revalidatedAuthorizationDecisionsemantics. Do not copy from mutable #64 or retarget onto its head.#141 retains a valid employing-legal-Organization feature but is Draft on an old owner base and overlaps #64/#65 on People, authorization, and OpenAPI files. It follows #65: after #65 becomes protected truth, #141 must non-force adopt that protected owner state and preserve only its valid legal-employer feature delta. Assignment #163/#165 remain downstream consumers.
docs/product-technical-gap-baseline.mdremains single-writer-owned by #100; volatile SHAs/run IDs stay in PR/Issue metadata.Canonical order remains #63 normal protected integration as gates allow → #64 normal integration after terminal required workflows and qualifying review → #65 non-force protected adoption/reconciliation + fresh exact-head acceptance → #141 non-force protected adoption/reconciliation + fresh acceptance → Assignment descendants. The independent #235 Workforce Validation lane may progress from protected
developwhile these owner gates run. No self-approval, administrator bypass, gate weakening, force-push, destructive rebase, mutable-owner source copy, no-op retrigger, or predecessor-evidence transfer.