This repository was archived by the owner on Jul 6, 2026. It is now read-only.
fix(security): enforce project-member visibility + lock down /metrics#92
Merged
Merged
Conversation
…+ lock down /metrics
FR-4.7 says project data is invited-only, enforced backend, but three
project-scoped GET handlers only required authentication and filtered by
ProjectId — letting any signed-in user read another project's private
standups, standup CSV export, and commit history by guessing a project id:
- GetStandupFeedQueryHandler
- ExportStandupsCsvQueryHandler (previously only checked the project exists)
- GetProjectCommitsQueryHandler
Apply the same owner-or-accepted-member guard the sibling handlers
(GetProjectDashboard/GetProjectSummaries) already use, throwing
ForbiddenException (-> 403) for non-members. Document 403/404 on the
endpoints. Adds ProjectVisibilityGuardTests covering outsider/owner/member
for all three (6 tests).
Also closes public exposure of the Prometheus /metrics endpoint. The prod
nginx ingress has snippet directives disabled cluster-wide, so block by Host
in-app: MapMetrics("/metrics").RequireHost(Metrics:AllowedHosts). In-cluster
Prometheus scrapes the pod directly as 'loopless-backend:8080' (allow-listed)
while the public api host is not, returning 404 to the internet without
breaking scraping. Wired via Helm values config.backend.Metrics__AllowedHosts__0.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Two security fixes surfaced by the PRD gap analysis.
1. FR-4.7 — project visibility was not enforced backend
PRD FR-4.7 requires project data to be invited-only, enforced on the backend. Three project-scoped GET handlers only called
.RequireAuthorization()(any signed-in user) and filtered byProjectId, so any authenticated user could read another project's private data by guessing/iterating a project GUID:GetStandupFeedQueryHandler— full standup feed (incl. blocker text)ExportStandupsCsvQueryHandler— only verified the project existed, not membershipGetProjectCommitsQueryHandler— commit historyFix applies the same owner-or-accepted-member guard the sibling handlers (
GetProjectDashboard,GetProjectSummaries) already use, throwingForbiddenException(→ 403) for non-members. 8 of 11 project-scoped read handlers already had this; these were the 3 gaps.2. /metrics was exposed to the public internet
https://api.project-01.gjirafa.dev/metricsreturned 200 publicly (full Prometheus histograms), violating PRD 6.3 ("all endpoints behind JWT except /auth/* and /health/*").The prod ingress has snippet directives disabled cluster-wide (verified: the admission webhook rejects
server-snippet), so path-blocking at the ingress isn't possible. Instead the endpoint is restricted by Host in-app:app.MapMetrics("/metrics").RequireHost(Metrics:AllowedHosts). In-cluster Prometheus scrapes the pod directly asloopless-backend:8080(allow-listed → 200); public traffic arrives as the ingress hostapi.project-01.gjirafa.dev(not listed → 404). Monitoring keeps working; the internet gets nothing. Wired via Helmconfig.backend.Metrics__AllowedHosts__0; unset in dev/local leaves /metrics open.Tests
ProjectVisibilityGuardTests(6): outsider→403, owner→data, member→data, for all three handlers.dotnet buildclean;helm templaterenders;helm upgrade --dry-run=serveragainst project-01 shows only the expected configmap key added.Verification notes for reviewer
Host: loopless-backend:8080(Prometheus default for a static target). After this deploys, confirm the loopless-api Prometheus target stays UP and /metrics on the public api host returns 404.🤖 Generated with Claude Code