Repository navigation
security: harden trust-bearing principal runtime storage at API authentication boundary #175
Description
Finding
People API and Job Analysis API AuthenticatedPrincipal are tuple subclasses, so direct tuple.__new__(AuthenticatedPrincipal, ...) can bypass the public constructor. The owner contract therefore requires ordinary public principal behavior to revalidate complete trust-bearing raw storage instead of treating construction provenance as authority.
This remains a service-TCB evidence-integrity boundary. It does not claim to constrain arbitrary same-interpreter code that deliberately invokes low-level base primitives; hostile executable code belongs outside the service TCB.
RED → repair chain in #65
Earlier RED/fix pairs established exact UUID/string/frozenset/scope types, subclass sealing, caller-owned UUID detachment, no writable instance slots, strict principal-only equality/inequality, fresh UUID reconstruction, raw tuple-slot revalidation, and guarded index/slice/iteration/list/tuple views.
The #175 refinement is test-first and non-force:
- People RED
5755c4dc5b81b7fc2153922242b637642743f402: malformed exact-class storage must fail throughlen, membership,count,index, concat/reflected concat, repeat/reflected repeat and rich ordering; structurally valid storage remains tuple-compatible. - Job Analysis RED
39208dfb108253e21e29bd444dbf44f5da7f8291: mirrors the same contract. - People fix
e7aff6af7c89ba37ce7960e673a5ba8a1df0643eand Job Analysis fix43821d812089fa4bc3c228a2f759ce7abe849471revalidate complete stored principal evidence before those public operations.
Those commits remain unchanged ancestors of current #65 head cf14ca8e06f788d905be59f76a987282c1c24395 on protected develop@ef1b143368cb6249c9520ca8cae10ebe844a5aa1; later #176–#178 change durable Job Analysis command/identity boundaries rather than principal implementation.
Acceptance state
Historical CodeRabbit review of 43821d8120... remains causal predecessor evidence only. Current cf14ca8e... has no qualifying exact-head approval or substantive independent review covering the complete tree.
Exact-head Job-Analysis API Quality run 33791230759 has API contract/100%-coverage 100768049957 and PostgreSQL integration 100768050354, both queued before checkout with runner_id=null, steps=[] and protected-tree ubuntu-latest. Hosted GREEN is not claimed. #161 remains the canonical repository-owned explicit-ubuntu-24.04 prerequisite; its workflow delta must not be copied into this owner branch.
Keep #175 open until exact-head hosted evidence, required current-head review and ordinary protected integration complete. Do not copy this repair into #163/#165 or consume mutable #65 source as a released dependency.
Activity
seonghobae commentedon Sep 3, 2026
Fresh #175 repair extension on canonical PR #65 found a representation-level validation gap that remains after subclass sealing and UUID alias detachment: because
AuthenticatedPrincipalis atuplesubclass, directtuple.__new__(AuthenticatedPrincipal, (...))can create an exact runtime-class instance without invokingAuthenticatedPrincipal.__new__. The prior public properties and tuple-backed equality/hash therefore trusted raw slots solely because the class was exact.Test-first regressions:
1d13d6d3a90c05ad9d924aac0b1219f1cdfaf4c11d2eec5a7ba774c4ebe9081f2b2fdc0827e8d74bThey construct exact-class tuple instances with actor/scope runtime subtypes and malformed arity and require public field access plus value semantics to reject malformed storage. They also preserve a control showing structurally valid tuple storage remains value-compatible; this does not treat Python construction provenance as an unforgeable capability.
Causal fixes:
3fcbe7634d9af359334b2b8ed0a8d384b7fd0e1b7e5fc43806f6fe94a77dfcbd8bffd1bf61ab0439Both services now revalidate the raw built-in tuple slots on public principal access, repr, exact-principal comparison, hashing, and pickle reconstruction. Tenant storage must be an exact operational integer, actor evidence an exact canonical string, and scopes an exact non-empty frozenset of exact canonical scope strings. This closes malformed storage publication through a base-type constructor while retaining the existing service-TCB boundary: valid-shaped same-process values are data, not cryptographic capabilities.
Canonical #65 current head is
7e5fc43806f6fe94a77dfcbd8bffd1bf61ab0439on protected basedevelop@ef1b143368cb6249c9520ca8cae10ebe844a5aa1. A fresh CodeRabbit exact-head review has been requested. Hosted GREEN is not claimed until the new head's People/Job Analysis and required central jobs actually execute.[-]security: reject trust-bearing principal runtime subtypes at API authentication boundary[/-][+]security: harden trust-bearing principal runtime storage at API authentication boundary[/+]