Skip to content

fix(strix): include search authorization context in PR scans #695

Open
Open
fix(strix): include search authorization context in PR scans#695
Labels
area: apiAPI, protocol, event, or external contractarea: authAuthentication, authorization, identity, or tenant isolationarea: dataDatabase, schema, migration, ETL, or lineagearea: ui-uxFrontend, interaction, design, or user experiencebugSomething isn't workingpriority: mediumNormal-priority or P2 workstatus: triagedOpen issue has an organization taxonomy assignmenttype: bugDefect or incorrect behavior

Description

@seonghobae
seonghobae
opened on Aug 1, 2026

Problem

ContextualWisdomLab/naruon#1210 current head bccd1b1e6a722fa286e92f63fc2571b296f5388f failed central Strix run 30684197947 with four findings after the report explicitly limited itself to one frontend component and did not verify backend validation. Static current-head triage showed:

  • relationship reads require signed-session AuthContext and SQL user_id plus organization_id filters
  • capture-source resolves the email with Email.owner_filters before reading or writing
  • state-changing BFF requests reject cross-site Origin/Referer and use a Secure, HttpOnly, SameSite=Lax session cookie
  • the AI answer is a React text child, not an HTML sink
  • sender addresses remain on the authenticated owner-scoped surface

The central context selector already supplies backend auth context for selected email frontend components, but it does not recognize frontend/src/components/SearchLayout.tsx or provide the ontology/search/BFF/session files needed to assess this path.

Acceptance criteria

  • Map SearchLayout and the search route shell to a bounded cross-layer search/auth context.
  • Include ontology/search authorization, owner-filter model, BFF same-origin guard, session-cookie, and API-client context without widening findings beyond changed files.
  • Preserve trusted-base context for unchanged files and PR-head blobs for files changed in the same PR.
  • Add a functional regression proving the expected context is present and unrelated files remain excluded.
  • Pass focused/full Strix gate tests, shellcheck, actionlint, and diff hygiene.
  • After merge, rerun exact-head Strix for 🎨 Palette: [UX 개선] 검색 결과 빈 화면 및 로딩 상태 시각적 피드백 강화 naruon#1210 and verify the metadata-only aggregate recovers only if the current-head Strix gate succeeds.

Agent: Codex
Started: 2026-08-01T14:00:00+09:00
Phase: Ops

Activity

  1. seonghobae
    added this to naruon Platform Roadmapon Aug 1, 2026
  2. seonghobae
    moved this to In Progress in naruon Platform Roadmapon Aug 1, 2026
  3. opencode-agent
    added
    area: apiAPI, protocol, event, or external contract
    area: authAuthentication, authorization, identity, or tenant isolation
    area: dataDatabase, schema, migration, ETL, or lineage
    area: ui-uxFrontend, interaction, design, or user experience
    priority: mediumNormal-priority or P2 work
    status: triagedOpen issue has an organization taxonomy assignment
    type: bugDefect or incorrect behavior
    on Aug 22, 2026
  4. seonghobae
    added
    bugSomething isn't working
    on Sep 8, 2026

  5. seonghobae commented on Sep 9, 2026

    @seonghobae
    seonghobae
    on Sep 9, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    Fresh Orgmetra Strix canary shows the same bounded-context-selection defect on a domain/application authorization boundary, not a frontend/search boundary.

    Consumer: ContextualWisdomLab/Orgmetra#63@d88800a5ca3ca15df332e8def5e25064c46e4005; required Strix 34294884985, job 102289341649; retained artifact 10083683583 (sha256:0936587636b5689136fb28221d55b84982fa8241950d087cb52818cb2299887f).

    Strix reports HIGH CWE-863 IDOR in JobAnalysisSnapshot tenant/job scope enforcement against packages/hris-kernel/src/orgmetra_hris_kernel/job_analysis.py. Its claimed exploit is direct construction of JobAnalysisSnapshot with a victim tenant/job and its remediation asks the domain value object's __post_init__() to perform user authorization.

    Current authoritative code contradicts that boundary model:

    • the kernel module documents JobAnalysisSnapshot as immutable job-analysis evidence, not an employment decision or persistence/authorization endpoint;
    • services/job-analysis-api/src/orgmetra_job_analysis_api/snapshot.py explicitly states authorization occurs before write/read port invocation and invokes authorize_resource_fields(...) for the job_analysis_snapshot:<id> resource;
    • the posted tenant is rebuilt against the authorized route tenant before the domain snapshot is constructed;
    • existing API regression coverage denies unauthorized persistence and asserts port.calls == [];
    • the finding's own PoC supplies empty tasks, ksao_requirements, and task_ksao_links, so it does not satisfy the constructor's non-empty evidence invariants anyway;
    • most importantly, direct construction of the pure domain value has no authoritative persistence side effect.

    Do not add authentication/session dependencies to the HRIS kernel constructor merely to satisfy this finding; that would invert the DDD dependency direction and couple a pure domain value to application authorization context. The central Strix scope should instead supply the narrow trusted-base job-analysis API authorization/persistence context whenever a PR changes the kernel job-analysis contract, then require a claimed IDOR to demonstrate a path that reaches an authoritative port while bypassing that application boundary.

    Please generalize the #695/#697 approach with a focused fixture for packages/hris-kernel/src/orgmetra_hris_kernel/job_analysis.py → bounded services/job-analysis-api auth/snapshot/persistence context. Preserve PR-head trust only for changed files, trusted-base context for unchanged files, and do not globally suppress CWE-863/IDOR findings.

  6. seonghobae commented on Sep 26, 2026

    @seonghobae
    seonghobae
    on Sep 26, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    Canonical owner update for Orgmetra #63's Job Analysis false-positive scope gap: .github#2291 now carries source-first RED 1fd22f4e… and exact GREEN/traceability head b90d873e67860944308d5cef919a1f95243ef98f (tree 03c09bdf…). The executable fixture requires the changed PR-head kernel module plus exactly auth.py, authorization.py, http.py, postgres.py, and snapshot.py from the authenticated trusted base, and proves an unrelated administration module is excluded. Full Strix harness PASS; full repository suite 3388 passed, 28 skipped, 40 subtests. Hosted exact-head checks and protected-main integration remain pending, so this Issue stays open and no consumer acceptance transfers yet.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area: apiAPI, protocol, event, or external contractarea: authAuthentication, authorization, identity, or tenant isolationarea: dataDatabase, schema, migration, ETL, or lineagearea: ui-uxFrontend, interaction, design, or user experiencebugSomething isn't workingpriority: mediumNormal-priority or P2 workstatus: triagedOpen issue has an organization taxonomy assignmenttype: bugDefect or incorrect behavior

    Type

    No type

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions