fix(security): consume tenant-claim signing key through credential registry by seonghobae · Pull Request #433 · ContextualWisdomLab/clearfolio

seonghobae · 2026-08-13T05:24:28Z

Objective

Advance issue #319 on the exact credential-registry stack by removing tenant-claim signing key authority from raw Spring secret injection. This child is intentionally stacked on #354 (DirectoryCredentialRegistry) and remains Draft.

Exact stack identity

parent feat(security): add standalone directory credential registry #354 exact head/base: d7321e0c29c38553f6e0fa089a9e659d91d08b8a;
test-only RED head: 85ad5285075432ce1cdee9fd37299cbbeb0d44b8;
registry-backed implementation head: 4071808854b98731542f44f724242f95f2fcb4c7;
exact current head: 7a6a1722d15c7e985ed1fb29dc025ee97b6a01a8;
changed paths: TenantAccessService, its registry-focused regression, and the existing null-secret compatibility test made overload-explicit;
emitted stacked-head CI and fuzz: terminal-success;
unresolved inline findings: zero;
Security Scan/SAST are not inferred because this stacked-base event did not emit them.

RED → implementation → compile repair

The RED regression required TenantAccessService to accept the provider-neutral CredentialRegistry, resolve the server-owned tenant-claims-signing reference for TENANT_CLAIMS_SIGNING, consume opaque snapshot bytes for HMAC verification, and reject credential identity or purpose mismatch.

The implementation added that constructor and exact identity/purpose checks. Exact-head CI on 4071808854b98731542f44f724242f95f2fcb4c7 then exposed one deterministic Java compile failure: the existing new TenantAccessService(null, ...) fixture became ambiguous between the String and CredentialRegistry overloads. Current head keeps production behavior unchanged and casts the legacy null-secret fixture explicitly to String. Exact current-head CI and fuzz now pass.

Contract

Registry-backed tenant verification fails closed unless the returned snapshot has credential identifier tenant-claims-signing and purpose TENANT_CLAIMS_SIGNING. Secret bytes are converted only at the HMAC boundary and the local copy is cleared after constructor initialization. Existing direct-string constructors remain bounded compatibility surfaces for tests and legacy demo wiring; production Spring authority migration remains part of the ordered issue-#319 stack.

Scope boundary

Tenant-claims runtime consumption only. Artifact-token signing, production registry bootstrap, rotation compatibility windows, KMS custody, distributed adapters, and ProductionAuthReadinessConfig migration remain follow-on work. No raw credential material enters PR metadata, logs, telemetry, browser code, or exceptions.

Merge gate

Keep Draft while #354/#344 remain unmerged. Child CI/fuzz success is review evidence, not protected-main merge evidence. After the parent stack reaches protected main, rebuild or retarget this bounded delta onto the new exact protected base and regenerate main-targeted CI, Security Scan, SAST, fuzz, current-head reviews, and qualifying independent approval. No predecessor evidence transfers.

coderabbitai · 2026-08-13T05:24:37Z

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: adc4a4d7-e4eb-4e2f-9156-269e26be02dd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

seonghobae · 2026-08-15T10:14:24Z

@opencode-agent review
@coderabbitai review
@cwl-noema-review review
@strix review

Review exact stacked head 7a6a1722d15c7e985ed1fb29dc025ee97b6a01a8 only. Emitted CI and fuzz are terminal-success and unresolved inline findings are zero. Validate exact credential name/purpose binding, defensive byte handling, and the explicit legacy String-null constructor fixture. Do not infer main-targeted Security/SAST evidence or approve protected merge while #354/#344 remain unmerged.

Review read-only; preserve independent reviewer identity. Do not mutate the branch, synthesize author approval, weaken protection, or merge.

coderabbitai · 2026-08-15T10:14:31Z

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 19 minutes and 28 seconds before sending another message.

opencode-agent · 2026-08-19T11:41:01Z

Queued @opencode-agent ; Already queued @cwl-noema-review on this exact request for PR #433 at head 7a6a1722d15c7e985ed1fb29dc025ee97b6a01a8. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

opencode-agent · 2026-08-20T03:30:52Z