fix(security): scope document actions to organization by seonghobae · Pull Request #1114 · ContextualWisdomLab/naruon

seonghobae · 2026-07-21T01:35:02Z

Summary

require organization scope when document action endpoints resolve a workspace document
add a same-workspace, different-organization regression case so the tenant boundary is exercised directly
make the document-session test double enforce the organization predicate used by production queries

Validation

uv run --project backend pytest -q — 1536 passed, 33 skipped
uv run --project backend pytest -q backend/tests/test_data_api.py — 15 passed, 1 skipped
uv run --project backend ruff check backend/api/data.py backend/tests/test_data_api.py
git diff --check

Security and review evidence

The prior OpenCode change request was caused by the central review sandbox missing Naruon runtime imports such as fastapi; fix(review): offline coverage deps for naruon backend and keyverse service .github#612 addresses that trusted offline dependency set.
The seven repository-wide Strix findings from the earlier run are covered by fix(security): close Strix tenant and connector boundaries #1123. This PR remains narrowly focused on the distinct organization predicate for document action lookup.

Originally created automatically by Jules for task 2322487146893694111 started by @seonghobae; scope corrected to match the current diff.

google-labs-jules · 2026-07-21T01:35:04Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

github-actions · 2026-07-21T04:00:55Z

PR governance metadata gate is not ready for a10c5f8b5b96c46c3accb944b0087b5495b0b647:

Review decision is CHANGES_REQUESTED; address requested changes before merge.
5 unresolved current review thread(s) remain.

opencode-agent

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.
Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.
Result: REQUEST_CHANGES
Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 0f7302d51036b6d67e908aadc26744ba9d69f29b.
Head SHA: 0f7302d51036b6d67e908aadc26744ba9d69f29b
Workflow run: 29881595686
Workflow attempt: 1

Coverage evidence

Coverage Decision

Result: FAIL
Test evidence: not proven passing
Docstring evidence: not proven passing when configured
Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Backend: data.py"]
  S1 --> I1["API and service runtime"]
  I1 --> R1["Review risk: Backend: data.py"]
  R1 --> V1["backend tests"]

opencode-agent · 2026-07-22T06:42:37Z

OpenCode Review Overview

Head SHA: 0f7302d51036b6d67e908aadc26744ba9d69f29b
Workflow run: 29881595686
Workflow attempt: 1
Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.
Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.
Result: REQUEST_CHANGES
Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 0f7302d51036b6d67e908aadc26744ba9d69f29b.
Head SHA: 0f7302d51036b6d67e908aadc26744ba9d69f29b
Workflow run: 29881595686
Workflow attempt: 1

Coverage evidence

Coverage Decision

Result: FAIL
Test evidence: not proven passing
Docstring evidence: not proven passing when configured
Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Backend: data.py"]
  S1 --> I1["API and service runtime"]
  I1 --> R1["Review risk: Backend: data.py"]
  R1 --> V1["backend tests"]

Copilot

Pull request overview

This PR tightens workspace document scoping in the Data API by adding an organization_id predicate to _get_workspace_document, and updates the Data API test suite/mocks to account for organization-scoped documents.

Changes:

Add organization_id filtering (or IS NULL for personal scope) when fetching a single workspace document in backend/api/data.py.
Update backend/tests/test_data_api.py mock DB query emulation and test fixtures to include organization_id on Document rows and to validate cross-organization isolation behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
backend/api/data.py	Enforces organization scoping when resolving a specific workspace document by ID.
backend/tests/test_data_api.py	Updates mock DB filtering and test fixtures to include/validate `organization_id` scoping for workspace documents.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+            organization_ids = [
+                value
+                for key, value in params.items()
+                if key.startswith("organization_id")
+            ]
+            organization_is_null = (
+                "workspace_documents.organization_id is null" in rendered_query_lower
+            )
            rows = [
                document
                for document in self.documents
                if (document_id is None or document.document_id == document_id)
                and (workspace_id is None or document.workspace_id == workspace_id)
+                and (
+                    (
+                        organization_ids
+                        and document.organization_id == organization_ids[0]
+                    )
+                    or (organization_is_null and document.organization_id is None)
+                    or (not organization_ids and not organization_is_null)
+                )
            ]


+    organization_filter = (
+        Document.organization_id == auth_context.organization_id
+        if auth_context.organization_id is not None
+        else Document.organization_id.is_(None)
+    )


+    organization_filter = (
+        Document.organization_id == auth_context.organization_id
+        if auth_context.organization_id is not None
+        else Document.organization_id.is_(None)
+    )
    result = await db.execute(
        select(Document).where(
            Document.document_id == document_id,
            Document.workspace_id == auth_context.workspace_id,
+            organization_filter,
        )


Copilot

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

frontend/pnpm-lock.yaml: Generated file

 overrides:
  postcss: ^8.5.15
+  sharp: "0.35.0"
  undici: 7.28.0


+    organization_filter = (
+        Document.organization_id == auth_context.organization_id
+        if auth_context.organization_id is not None
+        else Document.organization_id.is_(None)
+    )


seonghobae · 2026-07-31T12:54:25Z

Superseded by #1206 on current develop (document organization_id scope and/or SMTP CRLF header rejection reimplemented with tests).

google-labs-jules · 2026-07-31T12:56:49Z

Superseded by #1206 on current develop (document organization_id scope and/or SMTP CRLF header rejection reimplemented with tests).

Understood. Acknowledging that this work is now obsolete and stopping work on this task.

⚡ Bolt: Optimize threading ID flattening with set comprehension

d4979f7

🛡️ Sentinel: High Fix document retrieval multi-tenant isolation

0f7302d

seonghobae mentioned this pull request Jul 22, 2026

fix(security): close Strix tenant and connector boundaries #1123

Closed

opencode-agent Bot requested changes Jul 22, 2026

View reviewed changes

test(security): cover document organization scope

f004ba0

Copilot AI review requested due to automatic review settings July 22, 2026 23:27

Copilot started reviewing on behalf of seonghobae July 22, 2026 23:28 View session

seonghobae changed the title ~~⚡ Bolt: Optimize existing thread ID mapping performance~~ fix(security): scope document actions to organization Jul 22, 2026

Copilot AI reviewed Jul 22, 2026

View reviewed changes

seonghobae added 2 commits July 23, 2026 10:37

fix(security): upgrade sharp past GHSA-f88m-g3jw-g9cj

09d97c3

fix: keep sharp override single-sourced

a10c5f8

Copilot AI review requested due to automatic review settings July 23, 2026 01:37

Copilot started reviewing on behalf of seonghobae July 23, 2026 01:38 View session

Copilot AI reviewed Jul 23, 2026

View reviewed changes

seonghobae closed this Jul 31, 2026

Navigation Menu

Uh oh!

fix(security): scope document actions to organization - #1114

fix(security): scope document actions to organization#1114
seonghobae wants to merge 5 commits into
developfrom
bolt-thread-id-optimization-2322487146893694111

seonghobae commented Jul 21, 2026 •

edited

Loading

Uh oh!

google-labs-jules Bot commented Jul 21, 2026

Uh oh!

github-actions Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

opencode-agent Bot left a comment

Uh oh!

opencode-agent Bot commented Jul 22, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

seonghobae commented Jul 31, 2026

Uh oh!

google-labs-jules Bot commented Jul 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

seonghobae commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Security and review evidence

Uh oh!

google-labs-jules Bot commented Jul 21, 2026

Uh oh!

github-actions Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

opencode-agent Bot left a comment

Choose a reason for hiding this comment

Pull request overview

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Coverage evidence

Coverage Decision

Changed-File Evidence Map

Uh oh!

opencode-agent Bot commented Jul 22, 2026

OpenCode Review Overview

Pull request overview

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Coverage evidence

Coverage Decision

Changed-File Evidence Map

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

seonghobae commented Jul 31, 2026

Uh oh!

google-labs-jules Bot commented Jul 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

seonghobae commented Jul 21, 2026 •

edited

Loading

github-actions Bot commented Jul 21, 2026 •

edited

Loading