fix(security): trust forwarding IPs only from configured proxies - #587

Draft

seonghobae wants to merge 121 commits into

fix/trusted-rate-limit-client-ip

Commits on Aug 23, 2026

test: reject spoofed forwarding IPs in rate limiter
seonghobae
committed
c4a3b2f
fix(security): anchor rate limiting to trusted network peers
seonghobae
committed
7e6daab
test: cover trusted proxy client-IP boundary
seonghobae
committed
8a867cd
test: keep route core in owned coverage
seonghobae
committed
4125cc1
docs: define trusted reverse-proxy rate-limit contract
seonghobae
committed
7f893f9
docs: trace trusted proxy client-IP boundary
seonghobae
committed
172ac1d
test: keep SaaS serve-path assertion across security envelope
seonghobae
committed
62e5406
test(security): cover cross-client rate-limit poisoning
seonghobae
committed
dc2fe13
fix(security): prevent duplicate proxy rate-limit buckets
seonghobae
committed
fb98f87
docs(security): trace proxy bucket-poisoning regression
seonghobae
committed
8b144b2
test(rate-limit): bound client bucket cardinality
seonghobae
committed
b4aa4a3
fix(rate-limit): bound client bucket state
seonghobae
committed
bf20414
test(rate-limit): reject unsafe limiter config
seonghobae
committed
2c6da6f
fix(rate-limit): fail closed on unsafe config
seonghobae
committed
a86f845
docs(rate-limit): document bounded state and config
seonghobae
committed
fb64472
test(security): cover IPv4-mapped trusted proxy peers
seonghobae
committed
19da673
fix(security): canonicalize IPv4-mapped proxy peers
seonghobae
committed
dec4e7a
docs(security): record mapped proxy peer normalization
seonghobae
committed
a751633
docs(ops): explain dual-stack proxy address normalization
seonghobae
committed
dcbabf8
test: reproduce unsigned Stripe webhook plan escalation
seonghobae
committed
ba7554e
fix: authenticate Stripe webhooks before entitlement handling
seonghobae
committed
042830d
test(billing): keep Stripe webhook behind abuse controls
seonghobae
committed
cc0c6ed
fix(billing): keep Stripe verification inside app controls
seonghobae
committed
1f5c2b2
test(ci): align public-route contract with Stripe repair
seonghobae
committed
4488ab9
fix(billing): retire unsigned Stripe plan-upgrade handler
seonghobae
committed
dce2424
test(security): reject equivalent IPv6 proxy spelling mismatch
seonghobae
committed
c5e85d0
fix(security): canonicalize equivalent IPv6 proxy addresses
seonghobae
committed
f69ad0d
test(server): prove toast route is unique
seonghobae
committed
5e30072
test(a11y): exercise shipped toast asset route
seonghobae
committed
4ae65a6
test(security): bind invites to intended identity
seonghobae
committed
87d34bd
fix(security): bind invite redemption to email
seonghobae
committed
eaab3f8
test(ci): match secured route composition
seonghobae
committed
5dc72e7
test(security): fail closed when OIDC is unconfigured
seonghobae
committed
a1ad3bc
fix(security): require explicit development for mock OIDC
seonghobae
committed
7b19b86
ci: run owned-production coverage in server gate
seonghobae
committed
2d39860
test(security): require invite safety in protected route graph
seonghobae
committed
77406a9
test(security): cover shared OIDC fail-closed boundary
seonghobae
committed
d611894
fix(security): secure shared application boundary
seonghobae
committed
7c1f08c
fix(security): align OIDC regression and trust docs
seonghobae
committed
394e3cc
test(security): expose invite core bypass regression
seonghobae
committed
7ef64d2
test(security): bind invite guard to live sessions
seonghobae
committed
36c1037
fix(security): reject revoked sessions before invite binding
seonghobae
committed
bc50cc9
test(security): keep guard rejections behind abuse controls
seonghobae
committed
40eb4d1
test(security): register guard abuse-control regression
seonghobae
committed
ab7c7fe
fix(security): account rejected guards in abuse controls
seonghobae
committed
72f6acc
test(stripe): preserve literal signature timestamp
seonghobae
committed
de0a053
fix(stripe): verify literal signed timestamp
seonghobae
committed
131d79e
test(security): preserve guard rejection method evidence
seonghobae
committed
cf67f2a
fix(observability): retain original guard request method
seonghobae
committed
177996e
fix(observability): carry original guard method safely
seonghobae
committed
04363c0
test(security): require core OIDC fail-closed
seonghobae
committed
25b95ed
test(security): require core invite fail-closed behavior
seonghobae
committed
5807225
fix(security): harden internal invite and OIDC boundaries
seonghobae
committed
03cbe9f

Commits on Aug 24, 2026

test(rate-limit): require metrics for blocked requests
seonghobae
committed
c7baef2
fix(rate-limit): retain blocked request observability
seonghobae
committed
d3f8d4d

Commits on Aug 25, 2026

merge security hotfix into trusted rate-limit lane
seonghobae
committed
e8ef4fd
docs(deploy): align fail-closed identity and AI configuration
seonghobae
committed
3b3d4a3
test(security): expose shared-boundary limiter gaps
seonghobae
committed
7d09220
test(security): run shared-boundary limiter regression
seonghobae
committed
8944945
refactor(security): share trusted rate-limit policy
seonghobae
committed
2f3f8e8
fix(security): rate-limit the shared boundary before guards
seonghobae
committed
ad19c9d
test(rate-limit): cover blocked Prometheus metrics
seonghobae
committed
264bcbf
test(rate-limit): register Prometheus observability regression
seonghobae
committed
d6463ec
test(rate-limit): remove overflow timing dependency
seonghobae
committed
d0f92c0
test(rate-limit): require one shared limiter implementation
seonghobae
committed
1fcb863
fix(rate-limit): share authoritative limiter implementation
seonghobae
committed
7f963b4
test(coverage): require shared limiter instrumentation
seonghobae
committed
062fec8
fix(coverage): instrument shared rate limiter
seonghobae
committed
865f540
test(ci): reject duplicate API execution
seonghobae
committed
f378e1d
ci: avoid duplicate API suite execution
seonghobae
committed
0811a4f
test(security): reproduce forged OIDC identity token acceptance
seonghobae
committed
26ca25c
fix(security): verify production OIDC identities before session minting
seonghobae
committed
a26ff22
test(security): prove signed OIDC identity validation contract
seonghobae
committed
c673acc
test(ci): require exact PR head checkout
seonghobae
committed
1ada93f
ci: bind server tests to exact PR head
seonghobae
committed
f9e87d0
test(ci): require exact dependency review revisions
seonghobae
committed
1533e07
ci: bind dependency review to live exact revisions
seonghobae
committed
204cbda
test(ci): preserve slashed dependency-review bases
seonghobae
committed
4c8b682
fix(ci): support slashed live base refs
seonghobae
committed
fe01284
test(security): bound abandoned OIDC authorization state
seonghobae
committed
5a7393e
fix(security): bound transient auth state storage
seonghobae
committed
55951ea
fix(security): cap production OIDC state
seonghobae
committed
789d968
test(ci): restore coverage producer guards
seonghobae
committed
fad52de

Commits on Aug 28, 2026

fix: share trusted rate limiter with core routes
seonghobae
committed
1f93371
test: reproduce rate-limit import-order bypass
seonghobae
committed
886caf5
fix: preserve shared limiter across import order
seonghobae
committed
75b7caf
fix: redact bearer tokens from rate-limit logs
seonghobae
committed
dcf37e8
test: fail closed on direct core production OIDC
seonghobae
committed
74d41d1
test: run core production OIDC fail-closed regression
seonghobae
committed
c2a3811
fix: fail closed direct core production OIDC
seonghobae
committed
8e79805
test: preserve moved core security contracts
seonghobae
committed
c53c87b
fix(auth): preserve guard rejection observability
seonghobae
committed
58695e4
test(auth): reuse mixed-case OIDC accounts
seonghobae
committed
4bc5fc3
fix(auth): reuse case-variant OIDC accounts
seonghobae
committed
efd9280
docs: clarify orchestrator token mapping
seonghobae
committed
c542615
test(ci): require dependency review merge-base scope
seonghobae
committed
50c74dd
test(ci): run dependency merge-base regression
seonghobae
committed
67fd3fe
fix(ci): scope dependency review to PR merge base
seonghobae
committed
199b811
test(rate-limit): preserve metrics response on fold failure
seonghobae
committed
e98cae8
test(rate-limit): run observability failure regression
seonghobae
committed
f6bd5ea

Commits on Aug 29, 2026

fix(rate-limit): isolate metrics folding failures
seonghobae
committed
d3ea2b2
test(auth): define canonical email identity contract
seonghobae
committed
0c38ee4
test(auth): run canonical email identity contract
seonghobae
committed
f4ceb08
fix(auth): migrate canonical email identities
seonghobae
committed
8c1f666
fix(auth): canonicalize password identities at shared boundary
seonghobae
committed
4a47e15
test(auth): compare legacy rows by value
seonghobae
committed
ede4d13
test(security): reproduce current identity and OIDC review findings
seonghobae
committed
b251c6c
fix: close security boundary regressions
seonghobae
committed
81797d3
fix: isolate shared signup metrics
seonghobae
committed
a154cf1
fix: count mock SSO signups
seonghobae
committed
7430bb2
test: reject private OIDC metadata endpoints
seonghobae
committed
f074b41
feat: add pinned public HTTPS transport
seonghobae
committed
b5af769
test: cover pinned public HTTPS transport
seonghobae
committed
d46ac47
fix: pin OIDC outbound HTTPS destinations
seonghobae
committed
474595a
test: inject bounded OIDC HTTPS seam
seonghobae
committed
f3c925e
test: inject OIDC HTTPS transport in production regression
seonghobae
committed
b8283b5
test: gate public HTTPS transport coverage
seonghobae
committed
660d272
test(runtime): reject unsupported Node 23.4
seonghobae
committed
d7575ce
fix(runtime): exclude Node 23.4 from SQLite support
seonghobae
committed
70928aa
test(security): prove guarded invite rate-limit ordering
seonghobae
committed
08d328b
fix(auth): unify Unicode identity and OIDC form boundaries
seonghobae
committed
f36eb24