fix(security): require signed tenant claims on admin endpoints - #268

Draft

seonghobae wants to merge 53 commits into

fix/pii-logging-16240128950440010639from

fix/admin-endpoint-auth-clean

Commits on Aug 5, 2026

fix: rebuild tenant-scoped administrator authorization on current parent
seonghobae
committed
4f96b69
docs: align connector secret configuration
seonghobae
committed
9c66efc
docs: document config-tree tenant claim secret
seonghobae
committed
7b7feef
docs: align agent secret guidance
seonghobae
committed
f4ae8dd
test: require tenant-scoped administrative listing
seonghobae
committed
ea57a47
test: define tenant-scoped repository contract
seonghobae
committed
885bc85
test: define tenant-scoped service listing contract
seonghobae
committed
b87f28e
feat: add fail-closed tenant-scoped job query
seonghobae
committed
42463f9
feat: enforce tenant predicate before listing jobs
seonghobae
committed
9eb342f
feat: add fail-closed tenant-scoped service listing
seonghobae
committed
1689e09
feat: delegate administrative lists to tenant query
seonghobae
committed
7e3c0b7
fix(security): enforce tenant scope before admin list materialization
seonghobae
committed
c335862
test(security): require tenant-aware defaults to fail closed
seonghobae
committed
d355782
fix(security): fail closed for unscoped adapter mutations
seonghobae
committed
8fbf2d1
docs(security): define fail-closed adapter mutation defaults
seonghobae
committed
e29b39f
docs(changelog): record fail-closed tenant mutation defaults
seonghobae
committed
5bf134e
test(security): align retry contract with fail-closed defaults
seonghobae
committed
8d717dc
test(security): require atomic tenant-scoped mutations
seonghobae
committed
5409117
feat(security): add atomic tenant-scoped delete contract
seonghobae
committed
274eed4
feat(security): add atomic tenant-scoped retry contract
seonghobae
committed
cf68487
fix(security): make in-memory tenant mutations atomic
seonghobae
committed
c63d3bc
fix(security): route admin mutations through atomic tenant scope
seonghobae
committed
e5ea572
test(security): cover atomic in-memory tenant mutations
seonghobae
committed
62571c3
test(security): cover fail-closed repository adapter default
seonghobae
committed
650e5de
docs(security): specify atomic tenant mutation evidence
seonghobae
committed
3292630
docs(changelog): record atomic tenant mutation boundary
seonghobae
committed
774f684
test(security): reject stale tenant index and mutation observations
seonghobae
committed
1440b8b
fix(security): invalidate stale tenant content indexes
seonghobae
committed
5a557c5
fix(security): make stale index recovery collision-safe
seonghobae
committed
a1949a9
test(security): cover fail-closed job identifier collisions
seonghobae
committed
59107cf
refactor(security): keep job identifier collisions fail closed
seonghobae
committed
0abea27
docs(security): define tenant-bound secondary index invariant
seonghobae
committed
cafb891
docs(changelog): record stale tenant index defenses
seonghobae
committed
d4eb774
refactor(coverage): preserve stale-index validation without unreachable branches
seonghobae
committed
201e85e
test: expose tenant index replacement race
seonghobae
committed
b47464f
fix: keep tenant content index atomic during replacement
seonghobae
committed
e059824
docs: record atomic tenant index updates
seonghobae
committed
e3d9079
docs: define atomic tenant index invariant
seonghobae
committed
310b2ee
test(concurrency): require deterministic replacement lock contention
seonghobae
committed
d6103aa
test(security): require missing scoped job IDs to fail closed
seonghobae
committed
6f522f1
ci(test): prove missing scoped job ID regression
seonghobae
committed
4161ad0
ci(test): run scoped missing-ID RED proof after reopen
seonghobae
committed
03f1ee6
fix(security): conceal missing scoped lookup identifiers
seonghobae
committed
3db2377
fix(security): fail closed on missing scoped mutation IDs
seonghobae
committed
60518a8
chore(ci): remove one-shot missing-ID RED proof
seonghobae
committed
17d9d66
docs(security): define missing scoped identifier behavior
seonghobae
committed
3e519b2
docs(changelog): record missing scoped ID concealment
seonghobae
committed
7737503
test(security): require scoped lookup adapters to fail closed
seonghobae
committed
1fc6da2
fix(security): fail closed in scoped repository adapter default
seonghobae
committed
5dfbb9f
test(security): require concrete tenant-scoped identifier lookup
seonghobae
committed
aef159b
fix(security): implement scoped identifier lookup in adapter
seonghobae
committed
2ed7cf9
test(security): require all scoped lookup defaults to fail closed
seonghobae
committed
8dcf76f
fix(security): make content-hash scoped adapter default fail closed
seonghobae
committed
808e57d