security: fail closed on either organization tenant signal

[seonghobae]

Purpose

Close a fail-open organization-tenant authorization gap: organization authority must be required when either the destination account scope is organization-owned or the canonical organization-sensitive review reason is present. Contradictory/missing attributes and requires_review = false must never make an organization-sensitive candidate less restrictive.

Test-first implementation

The existing branch preserves the TypeScript authorization regressions, public durable Rust transfer-gate regressions, narrow production fix, fixture alignment, doctoring, and changelog evidence from the reviewed security slice. CodeRabbit's prior request for the valid organization-only approval path was addressed before this reconciliation.

Current evidence identity

Current exact source head: d0c32637fa808afa1052c95451ca25e9a6402b6a.

Current independently resolved protected main tip and branch merge base: 63e931aa6b55873797091f4bc0cd2b96f0a66703.

The reconciliation commit is a non-forced two-parent merge that preserves the prior tenant-authority head while integrating protected main's #146 Tauri CSP change. Its tree is current protected main plus only the eight tenant-authority files. CHANGELOG.md explicitly preserves both security entries. No predecessor check/review/approval evidence transfers to this head.

Current bounded diff remains:

• CHANGELOG.md;
• docs/architecture/cloud-review-tenant-authority.md;
• src-tauri/src/cloud_eviction.rs;
• src-tauri/src/cloud_transfer.rs;
• src-tauri/src/naruon_lineage.rs;
• src-tauri/tests/cloud_transfer_tenant_authority_gate.rs;
• src/lib/cloudReviewQueue.authorization.test.ts;
• src/lib/cloudReviewQueue.ts.

Security invariant

organization destination scope
OR organization-sensitive tenant review reason
=> explicit organization-tenant authority attestation required

Only a candidate with neither signal uses the ordinary approval contract. Approved decisions still require exact fingerprints, human attribution, rationale, the backend-defined organization-tenant marker, copy-approval freshness, destination/provider/account binding, and the exact confirmation phrase.

Required before merge

Merge only after the unchanged current head receives fresh current-base Test, Release, Security Scan, SAST and all actually applicable repository/governance evidence, with zero valid unresolved current-head findings. Cancelled, queued, pending, stale-head/base, predecessor, synthetic-only, rate-limited, or failed evidence is not success. Code-owner approval gates remain on hold per protected-main repository governance and must not be manufactured.

No database migration, version bump, or release is introduced.

Summary by CodeRabbit

• 보안 강화

  • 조직 계정 또는 조직 관련 검토 사유가 있는 클라우드 항목은 명시적인 테넌트 권한 확인 없이는 승인·전송되지 않습니다.
  • 필요한 권한 증명이 없으면 검토 필요 여부와 관계없이 항목이 차단됩니다.
  • 개인 계정 항목에는 기존 검증 동작이 유지됩니다.

• 문서

  • 클라우드 리뷰의 테넌트 권한 정책, 보안 기준 및 승인 절차를 문서화했습니다.

• 테스트

  • 조직 권한 신호와 검토 상태가 충돌하는 다양한 상황에 대한 검증을 추가했습니다.

[coderabbitai]

📝 Walkthrough

Walkthrough

조직 계정 범위 또는 조직 검토 사유가 있는 후보에 테넌트 권한 증명 검증을 추가했습니다. TypeScript 리뷰 큐와 Rust 전송 게이트가 증명 누락 또는 모순된 신호를 차단합니다. 회귀 테스트와 정책 문서를 추가했습니다.

Changes

조직 테넌트 권한 검증

Layer / File(s)	Summary
프론트엔드 리뷰 큐 게이트 src/lib/cloudReviewQueue.ts, src/lib/cloudReviewQueue.authorization.test.ts	조직 계정 범위 또는 조직 검토 사유가 있으면 테넌트 권한 확인을 요구합니다. 증명이 없으면 일반 검토 플래그와 관계없이 blocked 또는 unreviewed 상태를 유지합니다.
Rust 영속 전송 게이트와 통합 검증 src-tauri/src/cloud_transfer.rs, src-tauri/src/cloud_eviction.rs, src-tauri/tests/cloud_transfer_tenant_authority_gate.rs	Rust 전송 단계에서 조직 테넌트 권한 확인 마커를 검증합니다. 조직 신호와 증명 누락 조합을 통합 테스트로 검증합니다. 기존 테스트 데이터는 개인 계정 범위를 사용하도록 조정했습니다.
정책 문서와 권한 근거 기록 docs/architecture/cloud-review-tenant-authority.md, CHANGELOG.md, src-tauri/src/naruon_lineage.rs	테넌트 권한 결정 계약과 fail-closed 규칙을 문서화했습니다. 변경 이력과 produced_receipt 검증 근거에 조직 권한 확인 마커를 반영했습니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Candidate
  participant CloudReviewQueue
  participant RustTransferGate
  participant TenantAuthority
  Candidate->>CloudReviewQueue: 계정 범위와 검토 사유 제출
  CloudReviewQueue->>TenantAuthority: 테넌트 권한 증명 확인
  TenantAuthority-->>CloudReviewQueue: 확인 마커 반환
  CloudReviewQueue->>RustTransferGate: 승인 결정 전달
  RustTransferGate->>TenantAuthority: 영속 전송 권한 재검증
  TenantAuthority-->>RustTransferGate: 유효성 결과 반환
  RustTransferGate-->>Candidate: 전송 허용 또는 차단

Loading

Possibly related PRs

• ContextualWisdomLab/disksage#137: 동일한 테넌트 권한 로직과 테스트를 변경하며, 이번 변경은 조직 신호 검증을 확장합니다.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 두 조직 테넌트 신호 중 하나라도 있으면 권한 검증을 요구하는 주요 변경 사항을 정확하고 간결하게 설명합니다.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/tenant-authority-fail-closed-v2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src-tauri/tests/cloud_transfer_tenant_authority_gate.rs`:
- Around line 95-148: Add a test case for an organization-scoped candidate with
a valid attestation marker and an explicit Approved decision, then pass that
decision to candidate_blockers_with_review. Assert that the resulting blockers
do not include organization-tenant-authority-attestation-required, verifying the
organization-only approval path does not require an additional canonical review
reason.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5c85e1b8-f92b-4138-a71a-4cb54282a782

📥 Commits

Reviewing files that changed from the base of the PR and between 4b2f5d3 and 0ff788e.

📒 Files selected for processing (8)

• CHANGELOG.md
• docs/architecture/cloud-review-tenant-authority.md
• src-tauri/src/cloud_eviction.rs
• src-tauri/src/cloud_transfer.rs
• src-tauri/src/naruon_lineage.rs
• src-tauri/tests/cloud_transfer_tenant_authority_gate.rs
• src/lib/cloudReviewQueue.authorization.test.ts
• src/lib/cloudReviewQueue.ts