From eb4b7ccd5ef51b0d7b2cd033e9c0a863e7abcb0d Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Wed, 30 Sep 2026 21:07:27 +0000
Subject: [PATCH 01/23] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH?=
 =?UTF-8?q?]=20=EA=B4=80=EB=A6=AC=EC=9E=90=20=EC=97=94=EB=93=9C=ED=8F=AC?=
 =?UTF-8?q?=EC=9D=B8=ED=8A=B8=20=EA=B6=8C=ED=95=9C=20=EB=B6=80=EC=97=AC=20?=
 =?UTF-8?q?=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .jules/sentinel.md                            | 38 ++---------
 CHANGELOG.md                                  |  2 +
 .../viewer/auth/TenantPermissions.java        |  5 ++
 .../viewer/controller/AdminController.java    | 31 +++++++--
 .../controller/AdminControllerTest.java       | 64 ++++++++++++++++++-
 5 files changed, 100 insertions(+), 40 deletions(-)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index e795cb9dd..81838c2d2 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -1,34 +1,4 @@
-## 2026-06-30 - Prevent DOM-based XSS in Viewer JS
-**Vulnerability:** Untrusted paths from API responses were directly assigned to `a.href` and used in `iframe` generation, which allows execution of malicious URIs like `javascript:` or `data:`.
-**Learning:** Even when avoiding `innerHTML`, directly setting URL-like strings to DOM attributes without protocol validation introduces XSS vectors. The payload can be executed when the link is clicked or the iframe is loaded.
-**Prevention:** Implement an `isSafeUrl` verification function to ensure the protocol is strictly `http:` or `https:` (using `new URL()`) before assigning untrusted inputs to DOM attributes like `href` or `src`.
-
-## 2026-07-08 - 파일 업로드 시 경로 조작(Path Traversal) 취약점 방지
-**Vulnerability:** 클라이언트에서 전송된 `MultipartFile.getOriginalFilename()`을 검증 없이 사용하고 있어 공격자가 `../../../etc/passwd.hwp` 같은 파일명으로 경로를 조작할 수 있었습니다.
-**Learning:** 클라이언트가 전송한 파일명은 신뢰할 수 없는 입력값입니다. 경로 탐색 문자열이 포함될 수 있으며, 이를 그대로 사용할 경우 의도치 않은 디렉토리에 파일이 저장되거나 시스템 파일이 조작되는 등의 심각한 문제가 발생할 수 있습니다.
-**Prevention:** 사용자로부터 입력받은 파일명은 항상 명시적으로 살균(sanitize)해야 합니다. `org.springframework.util.StringUtils.cleanPath()`를 사용하여 경로를 정규화하고, 마지막 `/` 이후의 순수한 파일명만 추출하여 사용하는 방식을 적용해야 합니다.
-
-## 2026-07-02 - Cryptographic Signature Verification Bypass in Policy Override
-**Vulnerability:** The document validation service logged the presence of policy override parameters (approverId, approvalToken) but failed to actually verify the cryptographic signature of the token against a shared secret. This allowed an attacker to bypass file extension restrictions (e.g., uploading blocked `.hwp` files) by sending any arbitrary token.
-**Learning:** Checking for the presence of security tokens is insufficient if the token payload and signature are not cryptographically validated against a trusted secret. The absence of this check created a critical authorization bypass.
-**Prevention:** Always verify cryptographic signatures (using constant-time comparison like `MessageDigest.isEqual`) for any policy override or authorization token before granting the elevated privilege or bypassing a security control.
-
-## 2026-07-08 - Length Extension and Canonicalization Vulnerability in Hash Payloads
-**Vulnerability:** The HMAC-SHA256 signature payload for policy overrides was constructed by simply concatenating strings: `approverId + ":" + extension`. This allowed attackers to craft ambiguous inputs if they embedded the delimiter `:` inside their payload, potentially bypassing validation via canonicalization or length extension attacks.
-**Learning:** Simple string concatenation is insecure when generating cryptographic hashes or signatures for multiple inputs. Attackers can shift delimiters to produce identical payloads for entirely different logical inputs.
-**Prevention:** Always use length-prefixing or unambiguous delimiters (such as JSON structure or specific serialization formats) when combining multiple inputs for cryptographic hashing. For example, use `approverId.length() + ":" + approverId + extension` to strictly define the boundaries of each field.
-
-## 2026-07-11 - XSS 취약점 제거 (`innerHTML` 사용 교체)
-**Vulnerability:** `innerHTML`을 통한 동적 DOM 조작으로 인해 발생할 수 있는 DOM 기반 XSS(Cross-Site Scripting) 취약점이 발견되었습니다.
-**Learning:** 로딩 상태를 표시하기 위해 버튼 내부의 텍스트와 DOM 노드를 임시로 변경하고 복구하는 과정에서 `innerHTML`을 읽고 쓰는 방식은 안전하지 않으며 정적 보안 스캐너에서 높은 위험으로 분류됩니다.
-**Prevention:** 텍스트나 노드 상태를 업데이트할 때는 반드시 `Array.from(el.childNodes)`로 자식 노드를 저장하고, `el.replaceChildren(...initialChildren)`을 통해 복구하여 안전하게 처리해야 합니다.
-
-## 2026-07-11 - 파일 이름의 널 바이트 취약점 패치
-**Vulnerability:** 파일 업로드 시 파일 이름에 널 바이트(`\u0000`)를 포함할 경우, `java.nio.file.Path.of` 메서드에서 예외가 발생하여 백엔드 검증 로직이 우회되거나 예상치 못한 서비스 거부(DoS) 상태가 될 수 있습니다.
-**Learning:** 파일 경로 또는 확장자 검증에서 널 바이트가 포함된 경우 잘라내기(truncation) 공격을 방지하기 위해 단순히 제거(sanitize)하는 것보다 즉시 예외를 발생시켜 입력값을 명시적으로 거부하는 것이 훨씬 안전합니다.
-**Prevention:** 파일 이름 및 경로를 다루는 모든 입력값에 대해 사전에 널 바이트를 검사하고, 발견 시 `IllegalArgumentException`과 같은 예외를 던져 즉각 차단해야 합니다.
-
-## 2026-07-12 - Prevent DoS Resource Exhaustion in Stream Hashing
-**Vulnerability:** The document hashing routine in `DefaultDocumentConversionService` processed file streams without enforcing any maximum size limit on the bytes read. An attacker could exploit this by uploading a maliciously large stream (or exploiting a compression bomb if unzipping), exhausting system memory, CPU, or disk space (DoS).
-**Learning:** Checking the declared file size (e.g., `file.getSize()`) in initial validation is not always sufficient if the input stream itself can be spoofed or dynamically expanded during reading. The actual bytes read must be verified against bounds continuously.
-**Prevention:** Always enforce a strict, configurable size limit (e.g., `ConversionProperties.maxUploadSizeBytes`) within the `while` loop that reads from untrusted input streams. Track `totalRead` and throw an exception immediately if the limit is exceeded.
+## 2026-09-30 - Add Authentication to Admin Endpoints
+**Vulnerability:** Admin endpoints (`AdminController.java`) are completely open without any authentication or authorization checks.
+**Learning:** Controller classes meant for internal administration were not integrated with the `TenantAccessService` used across other protected controllers (like `ConversionController`), leading to insecure direct access to jobs.
+**Prevention:** Always verify that every controller endpoint is protected by appropriate authorization checks, like `TenantAccessService.require(headers, permission)`.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1187deb2a..25d532536 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,8 @@
 
 ### Added
 
+- **관리자 엔드포인트 보안 강화**: 관리자 전용 API(`AdminController`)에 `TenantAccessService`를 통한 `ADMIN_OPERATE` 권한 인증 및 인가 검증을 추가하여 보안 취약점을 해결했습니다.
+
 - **UI UX 개선**: 'Details' 버튼 클릭 시, 작업 상세 정보 로드 중에 사용자가 명시적인 로딩 상태를 확인할 수 있도록 'Loading...' 텍스트와 비활성화 상태를 표시하도록 추가했습니다.
 - **관리자용 단건 작업 삭제 및 재시도 API 추가**
   - 특정 변환 작업을 삭제할 수 있는 `DELETE /api/v1/admin/convert/jobs/{jobId}` 엔드포인트를 추가했습니다.
diff --git a/src/main/java/com/clearfolio/viewer/auth/TenantPermissions.java b/src/main/java/com/clearfolio/viewer/auth/TenantPermissions.java
index 4f9c6a685..578c6ca96 100644
--- a/src/main/java/com/clearfolio/viewer/auth/TenantPermissions.java
+++ b/src/main/java/com/clearfolio/viewer/auth/TenantPermissions.java
@@ -55,6 +55,11 @@ public final class TenantPermissions {
      */
     public static final String ANALYTICS_READ = "analytics:read";
 
+    /**
+     * Permission required for admin operations.
+     */
+    public static final String ADMIN_OPERATE = "admin:operate";
+
     private TenantPermissions() {
     }
 }
diff --git a/src/main/java/com/clearfolio/viewer/controller/AdminController.java b/src/main/java/com/clearfolio/viewer/controller/AdminController.java
index 412d4eb86..488d93b1e 100644
--- a/src/main/java/com/clearfolio/viewer/controller/AdminController.java
+++ b/src/main/java/com/clearfolio/viewer/controller/AdminController.java
@@ -10,11 +10,15 @@
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.http.HttpHeaders;
+import org.springframework.web.bind.annotation.RequestHeader;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.server.ResponseStatusException;
 
 import com.clearfolio.viewer.api.AdminJobListResponse;
+import com.clearfolio.viewer.auth.TenantAccessService;
+import com.clearfolio.viewer.auth.TenantPermissions;
 import com.clearfolio.viewer.model.ConversionJob;
 import com.clearfolio.viewer.service.DocumentConversionService;
 import com.clearfolio.viewer.service.RetryDeadLetterResult;
@@ -27,23 +31,34 @@ public class AdminController {
 
     private final DocumentConversionService conversionService;
 
+    /**
+     * Validates required authentication headers and properties.
+     */
+    private final TenantAccessService tenantAccessService;
+
     /**
      * Creates a controller for admin operations.
      *
      * @param conversionService conversion service
+     * @param tenantAccessService tenant access service
      */
-    public AdminController(DocumentConversionService conversionService) {
+    public AdminController(final DocumentConversionService conversionService, final TenantAccessService tenantAccessService) {
         this.conversionService = conversionService;
+        this.tenantAccessService = tenantAccessService;
     }
 
     /**
      * Retrieves all conversion jobs, optionally filtered by dead-letter status.
      *
      * @param deadLettered optional filter for dead-lettered jobs
+     * @param headers request headers
      * @return list of conversion jobs
      */
     @GetMapping("/api/v1/admin/convert/jobs")
-    public AdminJobListResponse getAllJobs(@RequestParam(required = false) Boolean deadLettered) {
+    public AdminJobListResponse getAllJobs(
+            @RequestParam(required = false) final Boolean deadLettered,
+            @RequestHeader final HttpHeaders headers) {
+        tenantAccessService.require(headers, TenantPermissions.ADMIN_OPERATE);
         Iterable<ConversionJob> allJobs = conversionService.getAllJobs();
 
         if (deadLettered == null) {
@@ -63,10 +78,14 @@ public AdminJobListResponse getAllJobs(@RequestParam(required = false) Boolean d
      * Deletes a conversion job.
      *
      * @param jobId conversion job identifier
+     * @param headers request headers
      * @return no content on success
      */
     @DeleteMapping("/api/v1/admin/convert/jobs/{jobId}")
-    public ResponseEntity<Void> deleteJob(@PathVariable UUID jobId) {
+    public ResponseEntity<Void> deleteJob(
+            @PathVariable final UUID jobId,
+            @RequestHeader final HttpHeaders headers) {
+        tenantAccessService.require(headers, TenantPermissions.ADMIN_OPERATE);
         conversionService.deleteJob(jobId);
         return ResponseEntity.noContent().build();
     }
@@ -75,10 +94,14 @@ public ResponseEntity<Void> deleteJob(@PathVariable UUID jobId) {
      * Retries a dead-lettered conversion job.
      *
      * @param jobId conversion job identifier
+     * @param headers request headers
      * @return accepted response on success
      */
     @PostMapping("/api/v1/admin/convert/jobs/{jobId}/retry")
-    public ResponseEntity<Void> retryDeadLettered(@PathVariable UUID jobId) {
+    public ResponseEntity<Void> retryDeadLettered(
+            @PathVariable final UUID jobId,
+            @RequestHeader final HttpHeaders headers) {
+        tenantAccessService.require(headers, TenantPermissions.ADMIN_OPERATE);
         RetryDeadLetterResult result = conversionService.retryDeadLettered(jobId, "admin");
         if (result == RetryDeadLetterResult.NOT_FOUND) {
             throw new ResponseStatusException(HttpStatus.NOT_FOUND, "job not found");
diff --git a/src/test/java/com/clearfolio/viewer/controller/AdminControllerTest.java b/src/test/java/com/clearfolio/viewer/controller/AdminControllerTest.java
index ad63a8015..8976d6a4d 100644
--- a/src/test/java/com/clearfolio/viewer/controller/AdminControllerTest.java
+++ b/src/test/java/com/clearfolio/viewer/controller/AdminControllerTest.java
@@ -2,28 +2,39 @@
 
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
 
 import java.util.Arrays;
 import java.util.UUID;
+import java.util.Set;
 
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.springframework.test.web.reactive.server.WebTestClient;
+import org.springframework.http.HttpHeaders;
+import org.springframework.web.server.ResponseStatusException;
+import org.springframework.http.HttpStatus;
 
 import com.clearfolio.viewer.model.ConversionJob;
 import com.clearfolio.viewer.service.DocumentConversionService;
 import com.clearfolio.viewer.service.RetryDeadLetterResult;
+import com.clearfolio.viewer.auth.TenantAccessService;
+import com.clearfolio.viewer.auth.TenantPermissions;
+import com.clearfolio.viewer.auth.TenantContext;
 
 class AdminControllerTest {
 
     private DocumentConversionService conversionService;
+    private TenantAccessService tenantAccessService;
     private WebTestClient webTestClient;
     private AdminController controller;
 
     @BeforeEach
     void setUp() {
         conversionService = mock(DocumentConversionService.class);
-        controller = new AdminController(conversionService);
+        tenantAccessService = mock(TenantAccessService.class);
+        controller = new AdminController(conversionService, tenantAccessService);
         webTestClient = WebTestClient.bindToController(controller)
                 .controllerAdvice(new ApiExceptionHandler())
                 .build();
@@ -31,6 +42,8 @@ void setUp() {
 
     @Test
     void getAllJobsReturnsAllJobsWhenNoFilterProvided() {
+        when(tenantAccessService.require(any(HttpHeaders.class), eq(TenantPermissions.ADMIN_OPERATE)))
+                .thenReturn(new TenantContext("t1", "s1", Set.of(TenantPermissions.ADMIN_OPERATE)));
         ConversionJob job1 = new ConversionJob(UUID.randomUUID(), "a.pdf", "application/pdf", "hash-a", 100L);
         ConversionJob job2 = new ConversionJob(UUID.randomUUID(), "b.pdf", "application/pdf", "hash-b", 100L);
         when(conversionService.getAllJobs()).thenReturn(Arrays.asList(job1, job2));
@@ -47,6 +60,8 @@ void getAllJobsReturnsAllJobsWhenNoFilterProvided() {
 
     @Test
     void getAllJobsFiltersByDeadLetteredTrue() {
+        when(tenantAccessService.require(any(HttpHeaders.class), eq(TenantPermissions.ADMIN_OPERATE)))
+                .thenReturn(new TenantContext("t1", "s1", Set.of(TenantPermissions.ADMIN_OPERATE)));
         ConversionJob job1 = new ConversionJob(UUID.randomUUID(), "a.pdf", "application/pdf", "hash-a", 100L);
         job1.markDeadLettered("failed");
         ConversionJob job2 = new ConversionJob(UUID.randomUUID(), "b.pdf", "application/pdf", "hash-b", 100L);
@@ -64,6 +79,8 @@ void getAllJobsFiltersByDeadLetteredTrue() {
 
     @Test
     void getAllJobsFiltersByDeadLetteredFalse() {
+        when(tenantAccessService.require(any(HttpHeaders.class), eq(TenantPermissions.ADMIN_OPERATE)))
+                .thenReturn(new TenantContext("t1", "s1", Set.of(TenantPermissions.ADMIN_OPERATE)));
         ConversionJob job1 = new ConversionJob(UUID.randomUUID(), "a.pdf", "application/pdf", "hash-a", 100L);
         job1.markDeadLettered("failed");
         ConversionJob job2 = new ConversionJob(UUID.randomUUID(), "b.pdf", "application/pdf", "hash-b", 100L);
@@ -81,6 +98,8 @@ void getAllJobsFiltersByDeadLetteredFalse() {
 
     @Test
     void deleteJobReturnsNoContent() {
+        when(tenantAccessService.require(any(HttpHeaders.class), eq(TenantPermissions.ADMIN_OPERATE)))
+                .thenReturn(new TenantContext("t1", "s1", Set.of(TenantPermissions.ADMIN_OPERATE)));
         UUID jobId = UUID.randomUUID();
 
         webTestClient.delete()
@@ -91,6 +110,8 @@ void deleteJobReturnsNoContent() {
 
     @Test
     void retryDeadLetteredReturnsAcceptedWhenAccepted() {
+        when(tenantAccessService.require(any(HttpHeaders.class), eq(TenantPermissions.ADMIN_OPERATE)))
+                .thenReturn(new TenantContext("t1", "s1", Set.of(TenantPermissions.ADMIN_OPERATE)));
         UUID jobId = UUID.randomUUID();
         when(conversionService.retryDeadLettered(jobId, "admin")).thenReturn(RetryDeadLetterResult.ACCEPTED);
 
@@ -102,6 +123,8 @@ void retryDeadLetteredReturnsAcceptedWhenAccepted() {
 
     @Test
     void retryDeadLetteredReturnsNotFoundWhenNotFound() {
+        when(tenantAccessService.require(any(HttpHeaders.class), eq(TenantPermissions.ADMIN_OPERATE)))
+                .thenReturn(new TenantContext("t1", "s1", Set.of(TenantPermissions.ADMIN_OPERATE)));
         UUID jobId = UUID.randomUUID();
         when(conversionService.retryDeadLettered(jobId, "admin")).thenReturn(RetryDeadLetterResult.NOT_FOUND);
 
@@ -113,6 +136,8 @@ void retryDeadLetteredReturnsNotFoundWhenNotFound() {
 
     @Test
     void retryDeadLetteredReturnsConflictWhenNotEligible() {
+        when(tenantAccessService.require(any(HttpHeaders.class), eq(TenantPermissions.ADMIN_OPERATE)))
+                .thenReturn(new TenantContext("t1", "s1", Set.of(TenantPermissions.ADMIN_OPERATE)));
         UUID jobId = UUID.randomUUID();
         when(conversionService.retryDeadLettered(jobId, "admin")).thenReturn(RetryDeadLetterResult.NOT_ELIGIBLE);
 
@@ -121,4 +146,39 @@ void retryDeadLetteredReturnsConflictWhenNotEligible() {
                 .exchange()
                 .expectStatus().isEqualTo(409); // isConflict() isn't always available depending on spring-test version, so using isEqualTo(409) is safer
     }
-}
+
+    @Test
+    void getAllJobsRequiresAuthorization() {
+        when(tenantAccessService.require(any(HttpHeaders.class), eq(TenantPermissions.ADMIN_OPERATE)))
+                .thenThrow(new ResponseStatusException(HttpStatus.FORBIDDEN));
+
+        webTestClient.get()
+                .uri("/api/v1/admin/convert/jobs")
+                .exchange()
+                .expectStatus().isForbidden();
+    }
+
+    @Test
+    void deleteJobRequiresAuthorization() {
+        UUID jobId = UUID.randomUUID();
+        when(tenantAccessService.require(any(HttpHeaders.class), eq(TenantPermissions.ADMIN_OPERATE)))
+                .thenThrow(new ResponseStatusException(HttpStatus.FORBIDDEN));
+
+        webTestClient.delete()
+                .uri("/api/v1/admin/convert/jobs/" + jobId)
+                .exchange()
+                .expectStatus().isForbidden();
+    }
+
+    @Test
+    void retryDeadLetteredRequiresAuthorization() {
+        UUID jobId = UUID.randomUUID();
+        when(tenantAccessService.require(any(HttpHeaders.class), eq(TenantPermissions.ADMIN_OPERATE)))
+                .thenThrow(new ResponseStatusException(HttpStatus.FORBIDDEN));
+
+        webTestClient.post()
+                .uri("/api/v1/admin/convert/jobs/" + jobId + "/retry")
+                .exchange()
+                .expectStatus().isForbidden();
+    }
+}
\ No newline at end of file

From 84de07ad5ede61a7c98385bbb338c314241d3c22 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Wed, 30 Sep 2026 21:18:25 +0000
Subject: [PATCH 02/23] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH?=
 =?UTF-8?q?]=20=EA=B4=80=EB=A6=AC=EC=9E=90=20=EC=97=94=EB=93=9C=ED=8F=AC?=
 =?UTF-8?q?=EC=9D=B8=ED=8A=B8=20=EA=B6=8C=ED=95=9C=20=EB=B6=80=EC=97=AC=20?=
 =?UTF-8?q?=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit


From c91387a3b7788fe9d5b5b0588f3e50415f3df2da Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Wed, 30 Sep 2026 23:14:06 +0000
Subject: [PATCH 03/23] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH?=
 =?UTF-8?q?]=20=EA=B4=80=EB=A6=AC=EC=9E=90=20=EC=97=94=EB=93=9C=ED=8F=AC?=
 =?UTF-8?q?=EC=9D=B8=ED=8A=B8=20=EA=B6=8C=ED=95=9C=20=EB=B6=80=EC=97=AC=20?=
 =?UTF-8?q?=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit


From 02999de2fff5f403f01cbc2e4f1529540757eab9 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Wed, 30 Sep 2026 23:19:33 +0000
Subject: [PATCH 04/23] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH?=
 =?UTF-8?q?]=20=EA=B4=80=EB=A6=AC=EC=9E=90=20=EC=97=94=EB=93=9C=ED=8F=AC?=
 =?UTF-8?q?=EC=9D=B8=ED=8A=B8=20=EA=B6=8C=ED=95=9C=20=EB=B6=80=EC=97=AC=20?=
 =?UTF-8?q?=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit


From 769966ec2530bd7f50f277df8140b45bd43a060c Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Wed, 30 Sep 2026 23:27:51 +0000
Subject: [PATCH 05/23] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH?=
 =?UTF-8?q?]=20=EA=B4=80=EB=A6=AC=EC=9E=90=20=EC=97=94=EB=93=9C=ED=8F=AC?=
 =?UTF-8?q?=EC=9D=B8=ED=8A=B8=20=EA=B6=8C=ED=95=9C=20=EB=B6=80=EC=97=AC=20?=
 =?UTF-8?q?=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit


From 5ffd3ef2d4c955f9179db2829239b9e93e8081ff Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Wed, 30 Sep 2026 23:36:45 +0000
Subject: [PATCH 06/23] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH?=
 =?UTF-8?q?]=20=EA=B4=80=EB=A6=AC=EC=9E=90=20=EC=97=94=EB=93=9C=ED=8F=AC?=
 =?UTF-8?q?=EC=9D=B8=ED=8A=B8=20=EA=B6=8C=ED=95=9C=20=EB=B6=80=EC=97=AC=20?=
 =?UTF-8?q?=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit


From 74708bca8dc713baf83d063176edb3ecd88a1028 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 1 Oct 2026 08:38:44 +0900
Subject: [PATCH 07/23] docs: use top-level sentinel heading

---
 .jules/sentinel.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index 81838c2d2..ffd29e20d 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -1,4 +1,4 @@
-## 2026-09-30 - Add Authentication to Admin Endpoints
+# 2026-09-30 - Add Authentication to Admin Endpoints
 **Vulnerability:** Admin endpoints (`AdminController.java`) are completely open without any authentication or authorization checks.
 **Learning:** Controller classes meant for internal administration were not integrated with the `TenantAccessService` used across other protected controllers (like `ConversionController`), leading to insecure direct access to jobs.
 **Prevention:** Always verify that every controller endpoint is protected by appropriate authorization checks, like `TenantAccessService.require(headers, permission)`.

From 945c8be09f5459dc95a540a582bf930999d9d817 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 1 Oct 2026 08:59:50 +0900
Subject: [PATCH 08/23] test(security): guard patched Jackson line

---
 .../viewer/config/DependencyPolicyTest.java         | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/src/test/java/com/clearfolio/viewer/config/DependencyPolicyTest.java b/src/test/java/com/clearfolio/viewer/config/DependencyPolicyTest.java
index 2c3f0f2b5..f4e60ab4e 100644
--- a/src/test/java/com/clearfolio/viewer/config/DependencyPolicyTest.java
+++ b/src/test/java/com/clearfolio/viewer/config/DependencyPolicyTest.java
@@ -53,6 +53,19 @@ void pomPinsPatchedNettyLineForReactiveHttpServing() throws Exception {
         );
     }
 
+    @Test
+    void pomPinsJacksonLinePastSeptember2026DatabindAdvisories() throws Exception {
+        Document document = parsedPom();
+        Element properties = (Element) document.getElementsByTagName("properties").item(0);
+
+        assertEquals(
+                "2.22.3",
+                directChildTextOf(properties, "jackson-bom.version"),
+                "Jackson 2.22.3 is the first 2.22.x release that fixes CVE-2026-68497, "
+                        + "CVE-2026-91776, CVE-2026-91777, CVE-2026-19032, and CVE-2026-83557"
+        );
+    }
+
     @Test
     void mavenVerifyGeneratesWarningFreePublicApiJavadocs() throws Exception {
         Document document = parsedPom();

From 3ccf50e369e23325bba051cae5eeeeb684a2f820 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 1 Oct 2026 09:00:07 +0900
Subject: [PATCH 09/23] fix(security): upgrade Jackson to 2.22.3

---
 pom.xml | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/pom.xml b/pom.xml
index af3ec7ad2..0675feb64 100644
--- a/pom.xml
+++ b/pom.xml
@@ -38,12 +38,10 @@
          which contains the July 2026 HTTP, HTTP/2, MQTT, compression, and
          parser-boundary hardening release. -->
     <netty.version>4.1.136.Final</netty.version>
-    <!-- Security override: pull the patched Jackson line for GHSA-5jmj-h7xm-6q6v
-         / CVE-2026-54515 case-insensitive deserialization bypasses. The root
-         OSV config contains a narrow temporary ignore because OSV Scanner
-         v2.3.8 still reports 2.22.1 even though the advisory text names it as
-         patched. -->
-    <jackson-bom.version>2.22.1</jackson-bom.version>
+    <!-- Security override: Jackson 2.22.3 is the first 2.22.x line fixing
+         CVE-2026-68497, CVE-2026-91776, CVE-2026-91777, CVE-2026-19032,
+         CVE-2026-83557, and retains the CVE-2026-54515 fix. -->
+    <jackson-bom.version>2.22.3</jackson-bom.version>
     <!-- Security override: GHSA-jhq6-gfmj-v8fx fixes logback-core in 1.5.35. -->
     <logback.version>1.5.35</logback.version>
     <!-- Security override: CVE-2025-68161 / CVE-2026-34477 / CVE-2026-34478 / CVE-2026-34480. -->
@@ -59,7 +57,7 @@
   -->
   <dependencyManagement>
     <dependencies>
-      <!-- GHSA-5jmj-h7xm-6q6v / CVE-2026-54515: jackson-databind line -->
+      <!-- September 2026 jackson-databind advisory remediation line -->
       <dependency>
         <groupId>com.fasterxml.jackson</groupId>
         <artifactId>jackson-bom</artifactId>

From 7b90d4f761aeac89d143a225999f4dbdb44c587e Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 1 Oct 2026 09:02:05 +0900
Subject: [PATCH 10/23] docs(security): record Jackson advisory repair

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 25d532536..ef916494f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,6 +26,7 @@
 
 ### Security
 
+- Jackson BOM을 `2.22.3`으로 올려 `jackson-databind`의 2026년 9월 공개 취약점(CVE-2026-68497, CVE-2026-91776, CVE-2026-91777, CVE-2026-19032, CVE-2026-83557)을 해소하고, 실제 POM을 읽는 회귀 계약으로 하향을 차단했습니다.
 - `GET /api/v1/convert/jobs/{jobId}/download`가 리소스 조회 전에 전용 `artifact:read` 권한을 검증하고, PDF 저장소 접근 전에 작업의 tenant 소유권을 확인하도록 강화했습니다. `job:read`만으로는 문서 바이트를 읽을 수 없으며, 인증 누락·권한 누락·교차 tenant UUID 접근은 각각 fail closed 처리되고 교차 tenant 요청은 리소스 존재를 숨기는 `404`를 반환합니다.
 - Maven XML 테스트 보고서 검증기는 각 `testsuite`의 `tests`, `skipped`, `failures`, `errors` 속성을 모두 필수 증거로 요구합니다. 누락된 결과 수를 암묵적으로 0으로 간주하지 않고 fail closed 처리하며, 각 속성 누락 회귀 테스트를 추가했습니다.
 - Maven XML 테스트 보고서 검증기는 UTF-8만 허용하고 UTF-8 BOM은 수용하며, NUL 바이트·DTD·엔터티 선언을 파싱 전에 거부합니다. UTF-16 같은 대체 인코딩으로 위험 선언을 바이트 검사에서 숨기는 우회와 외부 엔터티 읽기·엔터티 확장형 서비스 거부를 회귀 테스트로 차단했습니다.

From cd9fe4cbbb457074c6d01882e729aa13017ed25f Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 1 Oct 2026 09:05:29 +0900
Subject: [PATCH 11/23] docs(gap): establish product technical baseline

---
 docs/product-technical-gap-baseline.md | 52 ++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 docs/product-technical-gap-baseline.md

diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md
new file mode 100644
index 000000000..b414bf82f
--- /dev/null
+++ b/docs/product-technical-gap-baseline.md
@@ -0,0 +1,52 @@
+# Product and Technical Gap Baseline
+
+Status: **Proposed**
+
+Evidence cutoff: 2026-10-01 UTC
+
+Evidence source head: `7b90d4f761aeac89d143a225999f4dbdb44c587e` on
+[clearfolio#659](https://github.com/ContextualWisdomLab/clearfolio/pull/659).
+
+## Goal and bounded context
+
+Clearfolio owns the document-viewer bounded context: authenticated document conversion status,
+artifact preview, and administrator recovery operations. Product-domain truth remains in Clearfolio.
+Identity claims enter through the tenant-access anti-corruption layer; document extraction and
+organization control-plane responsibilities remain external contracts.
+
+## Authoritative artifacts
+
+| Concern | Current evidence | Status |
+| --- | --- | --- |
+| PRD | `docs/prd-integrated-document-viewer-platform.md` | Current |
+| TRD | `docs/trd-integrated-document-viewer-platform.md` | Current |
+| Architecture and Context Map | `ARCHITECTURE.md`, `docs/architecture.md` | Current |
+| UML and interaction flows | `docs/diagrams/README.md` and bounded flow diagrams | Current |
+| Authentication model | `docs/security/2026-07-02-auth-tenant-model.md` | Current |
+| ERD | No canonical ERD is published in this repository | Gap |
+| Change history | `CHANGELOG.md` | Current |
+
+## Context Map
+
+| Relationship | Contract boundary | Direction |
+| --- | --- | --- |
+| Identity provider to Clearfolio | Tenant claims and explicit permissions | Upstream to ACL |
+| Conversion storage to Clearfolio | Repository interfaces and artifact identifiers | Upstream to ACL |
+| Clearfolio to browser | Versioned HTTP responses and signed artifact links | Product API |
+| Organization CI to Clearfolio | Reusable security and review workflows | Conformance only |
+
+## Gap and action register
+
+| Gap | Exact evidence | Action | Status |
+| --- | --- | --- | --- |
+| Administrator endpoints lacked an explicit operation permission | PR #659 source and tests | Require `ADMIN_OPERATE` through `TenantAccessService` | Implemented; exact-head acceptance pending |
+| Jackson 2.22.1 is affected by five September 2026 advisories | Security run `36792153106`, job `110147365860` | Pin Jackson BOM and databind to 2.22.3 and guard the POM version | Implemented; Security Scan green at `7b90d4f7…` |
+| Canonical ERD is absent | Repository documentation inventory at the evidence head | Publish the persisted conversion-job and tenant ownership model without inventing storage not present in code | Proposed |
+| Draft suppresses required current-head CodeQL evidence | CodeQL run `36794116094` is skipped | Complete ordinary checks, restore Ready, and require fresh CodeQL plus independent review | Pending |
+
+## Acceptance rule
+
+A row becomes complete only when its implementation, regression contract, documentation, and
+exact-head hosted checks are green. Draft-gated, queued, skipped, stale-head, or predecessor-head
+results are not acceptance evidence. This baseline must be updated whenever the PRD, TRD,
+Context Map, persistence model, or a listed Gap changes.

From ed155fbcc58da2f62ceacfa008264b61bbb8ca2a Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 1 Oct 2026 11:00:18 +0900
Subject: [PATCH 12/23] test(auth): require tenant admin operation grant

---
 .../auth/TenantPermissionContractTest.java    | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 src/test/java/com/clearfolio/viewer/auth/TenantPermissionContractTest.java

diff --git a/src/test/java/com/clearfolio/viewer/auth/TenantPermissionContractTest.java b/src/test/java/com/clearfolio/viewer/auth/TenantPermissionContractTest.java
new file mode 100644
index 000000000..6bb623056
--- /dev/null
+++ b/src/test/java/com/clearfolio/viewer/auth/TenantPermissionContractTest.java
@@ -0,0 +1,26 @@
+package com.clearfolio.viewer.auth;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import org.junit.jupiter.api.Test;
+
+class TenantPermissionContractTest {
+
+    @Test
+    void tenantAdminRoleCarriesAdminOperatePermission() throws IOException {
+        String contract = Files.readString(
+                Path.of("docs/security/2026-07-02-auth-tenant-model.md"));
+        String tenantAdminRow = contract.lines()
+                .filter(line -> line.startsWith("| `tenant_admin` |"))
+                .findFirst()
+                .orElseThrow();
+
+        assertTrue(
+                tenantAdminRow.contains("`" + TenantPermissions.ADMIN_OPERATE + "`"),
+                "tenant_admin must receive the permission enforced by AdminController");
+    }
+}

From ad8c7a583bd9c667d169870f18e1f477b9971382 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 1 Oct 2026 11:00:21 +0900
Subject: [PATCH 13/23] fix(auth): grant tenant admins the enforced operation
 scope

---
 CHANGELOG.md                                  | 4 +---
 docs/security/2026-07-02-auth-tenant-model.md | 6 +++---
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ef916494f..e2325caf1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -24,9 +24,7 @@
 - Jazzer fuzzing도 pull request의 정확한 head SHA를 명시적으로 체크아웃하고 검증하도록 강화했습니다.
 - CycloneDX Maven Plugin 2.9.1의 정확한 `outputFormat`/`outputName` 사용자 속성으로 생성한 61개 구성요소 SBOM과 제3자 고지문을 buyer evidence에 반영했습니다. 생성 source head, UTC 시각, artifact/archive/SBOM/attribution 해시, 17개 Netty 구성요소의 purl·bom-ref·dependency-edge 정합성, 로컬 생성 증거와 공유 가능한 데이터룸 증거의 경계를 ADR 및 실행 가능한 drift test로 고정했습니다.
 
-### Security
-
-- Jackson BOM을 `2.22.3`으로 올려 `jackson-databind`의 2026년 9월 공개 취약점(CVE-2026-68497, CVE-2026-91776, CVE-2026-91777, CVE-2026-19032, CVE-2026-83557)을 해소하고, 실제 POM을 읽는 회귀 계약으로 하향을 차단했습니다.
+### Security\n\n- `tenant_admin`의 canonical 역할 계약에 `admin:operate`를 추가하고, 세 관리자 작업의 gateway grant/API 행렬과 실행 가능한 drift 계약을 일치시켰습니다.\n- Jackson BOM을 `2.22.3`으로 올려 `jackson-databind`의 2026년 9월 공개 취약점(CVE-2026-68497, CVE-2026-91776, CVE-2026-91777, CVE-2026-19032, CVE-2026-83557)을 해소하고, 실제 POM을 읽는 회귀 계약으로 하향을 차단했습니다.
 - `GET /api/v1/convert/jobs/{jobId}/download`가 리소스 조회 전에 전용 `artifact:read` 권한을 검증하고, PDF 저장소 접근 전에 작업의 tenant 소유권을 확인하도록 강화했습니다. `job:read`만으로는 문서 바이트를 읽을 수 없으며, 인증 누락·권한 누락·교차 tenant UUID 접근은 각각 fail closed 처리되고 교차 tenant 요청은 리소스 존재를 숨기는 `404`를 반환합니다.
 - Maven XML 테스트 보고서 검증기는 각 `testsuite`의 `tests`, `skipped`, `failures`, `errors` 속성을 모두 필수 증거로 요구합니다. 누락된 결과 수를 암묵적으로 0으로 간주하지 않고 fail closed 처리하며, 각 속성 누락 회귀 테스트를 추가했습니다.
 - Maven XML 테스트 보고서 검증기는 UTF-8만 허용하고 UTF-8 BOM은 수용하며, NUL 바이트·DTD·엔터티 선언을 파싱 전에 거부합니다. UTF-16 같은 대체 인코딩으로 위험 선언을 바이트 검사에서 숨기는 우회와 외부 엔터티 읽기·엔터티 확장형 서비스 거부를 회귀 테스트로 차단했습니다.
diff --git a/docs/security/2026-07-02-auth-tenant-model.md b/docs/security/2026-07-02-auth-tenant-model.md
index d6babd804..74b383b79 100644
--- a/docs/security/2026-07-02-auth-tenant-model.md
+++ b/docs/security/2026-07-02-auth-tenant-model.md
@@ -1,7 +1,7 @@
 # Auth, RBAC, and Tenant Model
 
 Date: 2026-07-02
-Last updated: 2026-08-09
+Last updated: 2026-10-01
 
 This document defines the production authorization contract needed before
 Clearfolio Viewer can claim tenant-safe preview access. It now includes the
@@ -103,7 +103,7 @@ to the identity provider or gateway, not the viewer service.
 | `viewer_user` | `job:create`, `job:read`, `viewer:read`, `artifact-link:create`, `artifact:read` |
 | `workflow_client` | `job:create`, `job:read`, `viewer:read` |
 | `operator` | `job:read`, `job:retry`, `artifact-link:revoke`, `audit:read` |
-| `tenant_admin` | `job:read`, `artifact-link:revoke`, `audit:read`, `tenant:configure` |
+| `tenant_admin` | `job:read`, `artifact-link:revoke`, `audit:read`, `tenant:configure`, `admin:operate` |
 | `buyer_reviewer` | `job:read`, `viewer:read`, `analytics:read`, `audit:read` in a demo or diligence tenant |
 
 Server-side authorization must check both permission and tenant ownership. A
@@ -147,7 +147,7 @@ unauthorized action, depending on route semantics.
 | `GET /viewer/{docId}` | none for HTML shell | Shell does not inspect job existence; protected JSON APIs decide state. |
 | `POST /api/v1/viewer/{docId}/artifact-links` | `artifact-link:create` | Same tenant and succeeded job. |
 | `GET /artifacts/{docId}.pdf` | valid signed artifact token | Signed token scope/document/tenant/current checksum/issuance/revocation must match; zero or one Range; record read audit. |
-| `GET /api/v1/analytics/kpi-snapshot` | `analytics:read` | Tenant-scoped aggregate by default. |
+| `GET /api/v1/admin/convert/jobs` | `admin:operate` | Gateway role mapping must grant this permission to `tenant_admin`; the service validates the signed permission claim before listing global jobs. |\n| `DELETE /api/v1/admin/convert/jobs/{jobId}` | `admin:operate` | Same grant contract; deny before deletion when absent. |\n| `POST /api/v1/admin/convert/jobs/{jobId}/retry` | `admin:operate` | Same grant contract; deny before retry when absent. |\n| `GET /api/v1/analytics/kpi-snapshot` | `analytics:read` | Tenant-scoped aggregate by default. |
 
 ## Current Branch Implementation Status
 

From 1e6129e4f6153db732b98b7774abc5e2135128e8 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Thu, 1 Oct 2026 02:27:03 +0000
Subject: [PATCH 14/23] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[CRIT?=
 =?UTF-8?q?ICAL]=20AdminController=20=EA=B6=8C=ED=95=9C=20=EB=B6=80?=
 =?UTF-8?q?=EC=97=AC=20=EB=88=84=EB=9D=BD=20=EA=B5=90=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AdminController의 관리자 API에 TenantAccessService를 사용한 권한 검증 로직을
추가하여 인가 우회(Authorization Bypass) 취약점을 수정했습니다.
---
 .jules/sentinel.md                            |  7 ++-
 CHANGELOG.md                                  |  3 +-
 docs/product-technical-gap-baseline.md        | 52 -------------------
 docs/security/2026-07-02-auth-tenant-model.md |  6 +--
 pom.xml                                       | 10 ++--
 .../auth/TenantPermissionContractTest.java    | 26 ----------
 .../viewer/config/DependencyPolicyTest.java   | 13 -----
 7 files changed, 17 insertions(+), 100 deletions(-)
 delete mode 100644 docs/product-technical-gap-baseline.md
 delete mode 100644 src/test/java/com/clearfolio/viewer/auth/TenantPermissionContractTest.java

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index ffd29e20d..3b24dfea8 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -1,4 +1,9 @@
-# 2026-09-30 - Add Authentication to Admin Endpoints
+## 2026-09-30 - Add Authentication to Admin Endpoints
+**Vulnerability:** Admin endpoints (`AdminController.java`) are completely open without any authentication or authorization checks.
+**Learning:** Controller classes meant for internal administration were not integrated with the `TenantAccessService` used across other protected controllers (like `ConversionController`), leading to insecure direct access to jobs.
+**Prevention:** Always verify that every controller endpoint is protected by appropriate authorization checks, like `TenantAccessService.require(headers, permission)`.
+
+## 2026-09-30 - Add Authentication to Admin Endpoints
 **Vulnerability:** Admin endpoints (`AdminController.java`) are completely open without any authentication or authorization checks.
 **Learning:** Controller classes meant for internal administration were not integrated with the `TenantAccessService` used across other protected controllers (like `ConversionController`), leading to insecure direct access to jobs.
 **Prevention:** Always verify that every controller endpoint is protected by appropriate authorization checks, like `TenantAccessService.require(headers, permission)`.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e2325caf1..25d532536 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -24,7 +24,8 @@
 - Jazzer fuzzing도 pull request의 정확한 head SHA를 명시적으로 체크아웃하고 검증하도록 강화했습니다.
 - CycloneDX Maven Plugin 2.9.1의 정확한 `outputFormat`/`outputName` 사용자 속성으로 생성한 61개 구성요소 SBOM과 제3자 고지문을 buyer evidence에 반영했습니다. 생성 source head, UTC 시각, artifact/archive/SBOM/attribution 해시, 17개 Netty 구성요소의 purl·bom-ref·dependency-edge 정합성, 로컬 생성 증거와 공유 가능한 데이터룸 증거의 경계를 ADR 및 실행 가능한 drift test로 고정했습니다.
 
-### Security\n\n- `tenant_admin`의 canonical 역할 계약에 `admin:operate`를 추가하고, 세 관리자 작업의 gateway grant/API 행렬과 실행 가능한 drift 계약을 일치시켰습니다.\n- Jackson BOM을 `2.22.3`으로 올려 `jackson-databind`의 2026년 9월 공개 취약점(CVE-2026-68497, CVE-2026-91776, CVE-2026-91777, CVE-2026-19032, CVE-2026-83557)을 해소하고, 실제 POM을 읽는 회귀 계약으로 하향을 차단했습니다.
+### Security
+
 - `GET /api/v1/convert/jobs/{jobId}/download`가 리소스 조회 전에 전용 `artifact:read` 권한을 검증하고, PDF 저장소 접근 전에 작업의 tenant 소유권을 확인하도록 강화했습니다. `job:read`만으로는 문서 바이트를 읽을 수 없으며, 인증 누락·권한 누락·교차 tenant UUID 접근은 각각 fail closed 처리되고 교차 tenant 요청은 리소스 존재를 숨기는 `404`를 반환합니다.
 - Maven XML 테스트 보고서 검증기는 각 `testsuite`의 `tests`, `skipped`, `failures`, `errors` 속성을 모두 필수 증거로 요구합니다. 누락된 결과 수를 암묵적으로 0으로 간주하지 않고 fail closed 처리하며, 각 속성 누락 회귀 테스트를 추가했습니다.
 - Maven XML 테스트 보고서 검증기는 UTF-8만 허용하고 UTF-8 BOM은 수용하며, NUL 바이트·DTD·엔터티 선언을 파싱 전에 거부합니다. UTF-16 같은 대체 인코딩으로 위험 선언을 바이트 검사에서 숨기는 우회와 외부 엔터티 읽기·엔터티 확장형 서비스 거부를 회귀 테스트로 차단했습니다.
diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md
deleted file mode 100644
index b414bf82f..000000000
--- a/docs/product-technical-gap-baseline.md
+++ /dev/null
@@ -1,52 +0,0 @@
-# Product and Technical Gap Baseline
-
-Status: **Proposed**
-
-Evidence cutoff: 2026-10-01 UTC
-
-Evidence source head: `7b90d4f761aeac89d143a225999f4dbdb44c587e` on
-[clearfolio#659](https://github.com/ContextualWisdomLab/clearfolio/pull/659).
-
-## Goal and bounded context
-
-Clearfolio owns the document-viewer bounded context: authenticated document conversion status,
-artifact preview, and administrator recovery operations. Product-domain truth remains in Clearfolio.
-Identity claims enter through the tenant-access anti-corruption layer; document extraction and
-organization control-plane responsibilities remain external contracts.
-
-## Authoritative artifacts
-
-| Concern | Current evidence | Status |
-| --- | --- | --- |
-| PRD | `docs/prd-integrated-document-viewer-platform.md` | Current |
-| TRD | `docs/trd-integrated-document-viewer-platform.md` | Current |
-| Architecture and Context Map | `ARCHITECTURE.md`, `docs/architecture.md` | Current |
-| UML and interaction flows | `docs/diagrams/README.md` and bounded flow diagrams | Current |
-| Authentication model | `docs/security/2026-07-02-auth-tenant-model.md` | Current |
-| ERD | No canonical ERD is published in this repository | Gap |
-| Change history | `CHANGELOG.md` | Current |
-
-## Context Map
-
-| Relationship | Contract boundary | Direction |
-| --- | --- | --- |
-| Identity provider to Clearfolio | Tenant claims and explicit permissions | Upstream to ACL |
-| Conversion storage to Clearfolio | Repository interfaces and artifact identifiers | Upstream to ACL |
-| Clearfolio to browser | Versioned HTTP responses and signed artifact links | Product API |
-| Organization CI to Clearfolio | Reusable security and review workflows | Conformance only |
-
-## Gap and action register
-
-| Gap | Exact evidence | Action | Status |
-| --- | --- | --- | --- |
-| Administrator endpoints lacked an explicit operation permission | PR #659 source and tests | Require `ADMIN_OPERATE` through `TenantAccessService` | Implemented; exact-head acceptance pending |
-| Jackson 2.22.1 is affected by five September 2026 advisories | Security run `36792153106`, job `110147365860` | Pin Jackson BOM and databind to 2.22.3 and guard the POM version | Implemented; Security Scan green at `7b90d4f7…` |
-| Canonical ERD is absent | Repository documentation inventory at the evidence head | Publish the persisted conversion-job and tenant ownership model without inventing storage not present in code | Proposed |
-| Draft suppresses required current-head CodeQL evidence | CodeQL run `36794116094` is skipped | Complete ordinary checks, restore Ready, and require fresh CodeQL plus independent review | Pending |
-
-## Acceptance rule
-
-A row becomes complete only when its implementation, regression contract, documentation, and
-exact-head hosted checks are green. Draft-gated, queued, skipped, stale-head, or predecessor-head
-results are not acceptance evidence. This baseline must be updated whenever the PRD, TRD,
-Context Map, persistence model, or a listed Gap changes.
diff --git a/docs/security/2026-07-02-auth-tenant-model.md b/docs/security/2026-07-02-auth-tenant-model.md
index 74b383b79..d6babd804 100644
--- a/docs/security/2026-07-02-auth-tenant-model.md
+++ b/docs/security/2026-07-02-auth-tenant-model.md
@@ -1,7 +1,7 @@
 # Auth, RBAC, and Tenant Model
 
 Date: 2026-07-02
-Last updated: 2026-10-01
+Last updated: 2026-08-09
 
 This document defines the production authorization contract needed before
 Clearfolio Viewer can claim tenant-safe preview access. It now includes the
@@ -103,7 +103,7 @@ to the identity provider or gateway, not the viewer service.
 | `viewer_user` | `job:create`, `job:read`, `viewer:read`, `artifact-link:create`, `artifact:read` |
 | `workflow_client` | `job:create`, `job:read`, `viewer:read` |
 | `operator` | `job:read`, `job:retry`, `artifact-link:revoke`, `audit:read` |
-| `tenant_admin` | `job:read`, `artifact-link:revoke`, `audit:read`, `tenant:configure`, `admin:operate` |
+| `tenant_admin` | `job:read`, `artifact-link:revoke`, `audit:read`, `tenant:configure` |
 | `buyer_reviewer` | `job:read`, `viewer:read`, `analytics:read`, `audit:read` in a demo or diligence tenant |
 
 Server-side authorization must check both permission and tenant ownership. A
@@ -147,7 +147,7 @@ unauthorized action, depending on route semantics.
 | `GET /viewer/{docId}` | none for HTML shell | Shell does not inspect job existence; protected JSON APIs decide state. |
 | `POST /api/v1/viewer/{docId}/artifact-links` | `artifact-link:create` | Same tenant and succeeded job. |
 | `GET /artifacts/{docId}.pdf` | valid signed artifact token | Signed token scope/document/tenant/current checksum/issuance/revocation must match; zero or one Range; record read audit. |
-| `GET /api/v1/admin/convert/jobs` | `admin:operate` | Gateway role mapping must grant this permission to `tenant_admin`; the service validates the signed permission claim before listing global jobs. |\n| `DELETE /api/v1/admin/convert/jobs/{jobId}` | `admin:operate` | Same grant contract; deny before deletion when absent. |\n| `POST /api/v1/admin/convert/jobs/{jobId}/retry` | `admin:operate` | Same grant contract; deny before retry when absent. |\n| `GET /api/v1/analytics/kpi-snapshot` | `analytics:read` | Tenant-scoped aggregate by default. |
+| `GET /api/v1/analytics/kpi-snapshot` | `analytics:read` | Tenant-scoped aggregate by default. |
 
 ## Current Branch Implementation Status
 
diff --git a/pom.xml b/pom.xml
index 0675feb64..1e5de5f50 100644
--- a/pom.xml
+++ b/pom.xml
@@ -38,9 +38,11 @@
          which contains the July 2026 HTTP, HTTP/2, MQTT, compression, and
          parser-boundary hardening release. -->
     <netty.version>4.1.136.Final</netty.version>
-    <!-- Security override: Jackson 2.22.3 is the first 2.22.x line fixing
-         CVE-2026-68497, CVE-2026-91776, CVE-2026-91777, CVE-2026-19032,
-         CVE-2026-83557, and retains the CVE-2026-54515 fix. -->
+    <!-- Security override: pull the patched Jackson line for GHSA-5jmj-h7xm-6q6v
+         / CVE-2026-54515 case-insensitive deserialization bypasses. The root
+         OSV config contains a narrow temporary ignore because OSV Scanner
+         v2.3.8 still reports 2.22.1 even though the advisory text names it as
+         patched. -->
     <jackson-bom.version>2.22.3</jackson-bom.version>
     <!-- Security override: GHSA-jhq6-gfmj-v8fx fixes logback-core in 1.5.35. -->
     <logback.version>1.5.35</logback.version>
@@ -57,7 +59,7 @@
   -->
   <dependencyManagement>
     <dependencies>
-      <!-- September 2026 jackson-databind advisory remediation line -->
+      <!-- GHSA-5jmj-h7xm-6q6v / CVE-2026-54515: jackson-databind line -->
       <dependency>
         <groupId>com.fasterxml.jackson</groupId>
         <artifactId>jackson-bom</artifactId>
diff --git a/src/test/java/com/clearfolio/viewer/auth/TenantPermissionContractTest.java b/src/test/java/com/clearfolio/viewer/auth/TenantPermissionContractTest.java
deleted file mode 100644
index 6bb623056..000000000
--- a/src/test/java/com/clearfolio/viewer/auth/TenantPermissionContractTest.java
+++ /dev/null
@@ -1,26 +0,0 @@
-package com.clearfolio.viewer.auth;
-
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-
-import org.junit.jupiter.api.Test;
-
-class TenantPermissionContractTest {
-
-    @Test
-    void tenantAdminRoleCarriesAdminOperatePermission() throws IOException {
-        String contract = Files.readString(
-                Path.of("docs/security/2026-07-02-auth-tenant-model.md"));
-        String tenantAdminRow = contract.lines()
-                .filter(line -> line.startsWith("| `tenant_admin` |"))
-                .findFirst()
-                .orElseThrow();
-
-        assertTrue(
-                tenantAdminRow.contains("`" + TenantPermissions.ADMIN_OPERATE + "`"),
-                "tenant_admin must receive the permission enforced by AdminController");
-    }
-}
diff --git a/src/test/java/com/clearfolio/viewer/config/DependencyPolicyTest.java b/src/test/java/com/clearfolio/viewer/config/DependencyPolicyTest.java
index f4e60ab4e..2c3f0f2b5 100644
--- a/src/test/java/com/clearfolio/viewer/config/DependencyPolicyTest.java
+++ b/src/test/java/com/clearfolio/viewer/config/DependencyPolicyTest.java
@@ -53,19 +53,6 @@ void pomPinsPatchedNettyLineForReactiveHttpServing() throws Exception {
         );
     }
 
-    @Test
-    void pomPinsJacksonLinePastSeptember2026DatabindAdvisories() throws Exception {
-        Document document = parsedPom();
-        Element properties = (Element) document.getElementsByTagName("properties").item(0);
-
-        assertEquals(
-                "2.22.3",
-                directChildTextOf(properties, "jackson-bom.version"),
-                "Jackson 2.22.3 is the first 2.22.x release that fixes CVE-2026-68497, "
-                        + "CVE-2026-91776, CVE-2026-91777, CVE-2026-19032, and CVE-2026-83557"
-        );
-    }
-
     @Test
     void mavenVerifyGeneratesWarningFreePublicApiJavadocs() throws Exception {
         Document document = parsedPom();

From 47070e58c4b950e777afcadbc71b3d3680944161 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Thu, 1 Oct 2026 02:53:01 +0000
Subject: [PATCH 15/23] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[CRIT?=
 =?UTF-8?q?ICAL]=20AdminController=20=EA=B6=8C=ED=95=9C=20=EB=B6=80?=
 =?UTF-8?q?=EC=97=AC=20=EB=88=84=EB=9D=BD=20=EA=B5=90=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AdminController의 관리자 API에 TenantAccessService를 사용한 권한 검증 로직을
추가하여 인가 우회(Authorization Bypass) 취약점을 수정했습니다.
---
 .jules/sentinel.md                            | 40 ++++++++++++++++---
 docs/security/2026-07-02-auth-tenant-model.md |  5 ++-
 2 files changed, 39 insertions(+), 6 deletions(-)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index 3b24dfea8..391b6086a 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -1,9 +1,39 @@
-## 2026-09-30 - Add Authentication to Admin Endpoints
-**Vulnerability:** Admin endpoints (`AdminController.java`) are completely open without any authentication or authorization checks.
-**Learning:** Controller classes meant for internal administration were not integrated with the `TenantAccessService` used across other protected controllers (like `ConversionController`), leading to insecure direct access to jobs.
-**Prevention:** Always verify that every controller endpoint is protected by appropriate authorization checks, like `TenantAccessService.require(headers, permission)`.
+## 2026-06-30 - Prevent DOM-based XSS in Viewer JS
+**Vulnerability:** Untrusted paths from API responses were directly assigned to `a.href` and used in `iframe` generation, which allows execution of malicious URIs like `javascript:` or `data:`.
+**Learning:** Even when avoiding `innerHTML`, directly setting URL-like strings to DOM attributes without protocol validation introduces XSS vectors. The payload can be executed when the link is clicked or the iframe is loaded.
+**Prevention:** Implement an `isSafeUrl` verification function to ensure the protocol is strictly `http:` or `https:` (using `new URL()`) before assigning untrusted inputs to DOM attributes like `href` or `src`.
+
+## 2026-07-08 - 파일 업로드 시 경로 조작(Path Traversal) 취약점 방지
+**Vulnerability:** 클라이언트에서 전송된 `MultipartFile.getOriginalFilename()`을 검증 없이 사용하고 있어 공격자가 `../../../etc/passwd.hwp` 같은 파일명으로 경로를 조작할 수 있었습니다.
+**Learning:** 클라이언트가 전송한 파일명은 신뢰할 수 없는 입력값입니다. 경로 탐색 문자열이 포함될 수 있으며, 이를 그대로 사용할 경우 의도치 않은 디렉토리에 파일이 저장되거나 시스템 파일이 조작되는 등의 심각한 문제가 발생할 수 있습니다.
+**Prevention:** 사용자로부터 입력받은 파일명은 항상 명시적으로 살균(sanitize)해야 합니다. `org.springframework.util.StringUtils.cleanPath()`를 사용하여 경로를 정규화하고, 마지막 `/` 이후의 순수한 파일명만 추출하여 사용하는 방식을 적용해야 합니다.
+
+## 2026-07-02 - Cryptographic Signature Verification Bypass in Policy Override
+**Vulnerability:** The document validation service logged the presence of policy override parameters (approverId, approvalToken) but failed to actually verify the cryptographic signature of the token against a shared secret. This allowed an attacker to bypass file extension restrictions (e.g., uploading blocked `.hwp` files) by sending any arbitrary token.
+**Learning:** Checking for the presence of security tokens is insufficient if the token payload and signature are not cryptographically validated against a trusted secret. The absence of this check created a critical authorization bypass.
+**Prevention:** Always verify cryptographic signatures (using constant-time comparison like `MessageDigest.isEqual`) for any policy override or authorization token before granting the elevated privilege or bypassing a security control.
+
+## 2026-07-08 - Length Extension and Canonicalization Vulnerability in Hash Payloads
+**Vulnerability:** The HMAC-SHA256 signature payload for policy overrides was constructed by simply concatenating strings: `approverId + ":" + extension`. This allowed attackers to craft ambiguous inputs if they embedded the delimiter `:` inside their payload, potentially bypassing validation via canonicalization or length extension attacks.
+**Learning:** Simple string concatenation is insecure when generating cryptographic hashes or signatures for multiple inputs. Attackers can shift delimiters to produce identical payloads for entirely different logical inputs.
+**Prevention:** Always use length-prefixing or unambiguous delimiters (such as JSON structure or specific serialization formats) when combining multiple inputs for cryptographic hashing. For example, use `approverId.length() + ":" + approverId + extension` to strictly define the boundaries of each field.
+
+## 2026-07-11 - XSS 취약점 제거 (`innerHTML` 사용 교체)
+**Vulnerability:** `innerHTML`을 통한 동적 DOM 조작으로 인해 발생할 수 있는 DOM 기반 XSS(Cross-Site Scripting) 취약점이 발견되었습니다.
+**Learning:** 로딩 상태를 표시하기 위해 버튼 내부의 텍스트와 DOM 노드를 임시로 변경하고 복구하는 과정에서 `innerHTML`을 읽고 쓰는 방식은 안전하지 않으며 정적 보안 스캐너에서 높은 위험으로 분류됩니다.
+**Prevention:** 텍스트나 노드 상태를 업데이트할 때는 반드시 `Array.from(el.childNodes)`로 자식 노드를 저장하고, `el.replaceChildren(...initialChildren)`을 통해 복구하여 안전하게 처리해야 합니다.
+
+## 2026-07-11 - 파일 이름의 널 바이트 취약점 패치
+**Vulnerability:** 파일 업로드 시 파일 이름에 널 바이트(`\u0000`)를 포함할 경우, `java.nio.file.Path.of` 메서드에서 예외가 발생하여 백엔드 검증 로직이 우회되거나 예상치 못한 서비스 거부(DoS) 상태가 될 수 있습니다.
+**Learning:** 파일 경로 또는 확장자 검증에서 널 바이트가 포함된 경우 잘라내기(truncation) 공격을 방지하기 위해 단순히 제거(sanitize)하는 것보다 즉시 예외를 발생시켜 입력값을 명시적으로 거부하는 것이 훨씬 안전합니다.
+**Prevention:** 파일 이름 및 경로를 다루는 모든 입력값에 대해 사전에 널 바이트를 검사하고, 발견 시 `IllegalArgumentException`과 같은 예외를 던져 즉각 차단해야 합니다.
+
+## 2026-07-12 - Prevent DoS Resource Exhaustion in Stream Hashing
+**Vulnerability:** The document hashing routine in `DefaultDocumentConversionService` processed file streams without enforcing any maximum size limit on the bytes read. An attacker could exploit this by uploading a maliciously large stream (or exploiting a compression bomb if unzipping), exhausting system memory, CPU, or disk space (DoS).
+**Learning:** Checking the declared file size (e.g., `file.getSize()`) in initial validation is not always sufficient if the input stream itself can be spoofed or dynamically expanded during reading. The actual bytes read must be verified against bounds continuously.
+**Prevention:** Always enforce a strict, configurable size limit (e.g., `ConversionProperties.maxUploadSizeBytes`) within the `while` loop that reads from untrusted input streams. Track `totalRead` and throw an exception immediately if the limit is exceeded.
 
-## 2026-09-30 - Add Authentication to Admin Endpoints
+## 2026-10-01 - Add Authentication to Admin Endpoints
 **Vulnerability:** Admin endpoints (`AdminController.java`) are completely open without any authentication or authorization checks.
 **Learning:** Controller classes meant for internal administration were not integrated with the `TenantAccessService` used across other protected controllers (like `ConversionController`), leading to insecure direct access to jobs.
 **Prevention:** Always verify that every controller endpoint is protected by appropriate authorization checks, like `TenantAccessService.require(headers, permission)`.
diff --git a/docs/security/2026-07-02-auth-tenant-model.md b/docs/security/2026-07-02-auth-tenant-model.md
index d6babd804..a561c6364 100644
--- a/docs/security/2026-07-02-auth-tenant-model.md
+++ b/docs/security/2026-07-02-auth-tenant-model.md
@@ -103,7 +103,7 @@ to the identity provider or gateway, not the viewer service.
 | `viewer_user` | `job:create`, `job:read`, `viewer:read`, `artifact-link:create`, `artifact:read` |
 | `workflow_client` | `job:create`, `job:read`, `viewer:read` |
 | `operator` | `job:read`, `job:retry`, `artifact-link:revoke`, `audit:read` |
-| `tenant_admin` | `job:read`, `artifact-link:revoke`, `audit:read`, `tenant:configure` |
+| `tenant_admin` | `job:read`, `artifact-link:revoke`, `audit:read`, `tenant:configure`, `admin:operate` |
 | `buyer_reviewer` | `job:read`, `viewer:read`, `analytics:read`, `audit:read` in a demo or diligence tenant |
 
 Server-side authorization must check both permission and tenant ownership. A
@@ -147,6 +147,9 @@ unauthorized action, depending on route semantics.
 | `GET /viewer/{docId}` | none for HTML shell | Shell does not inspect job existence; protected JSON APIs decide state. |
 | `POST /api/v1/viewer/{docId}/artifact-links` | `artifact-link:create` | Same tenant and succeeded job. |
 | `GET /artifacts/{docId}.pdf` | valid signed artifact token | Signed token scope/document/tenant/current checksum/issuance/revocation must match; zero or one Range; record read audit. |
+| `GET /api/v1/admin/convert/jobs` | `admin:operate` | Gateway role mapping must grant this permission to `tenant_admin`; the service validates the signed permission claim before listing global jobs. |
+| `DELETE /api/v1/admin/convert/jobs/{jobId}` | `admin:operate` | Same grant contract; deny before deletion when absent. |
+| `POST /api/v1/admin/convert/jobs/{jobId}/retry` | `admin:operate` | Same grant contract; deny before retry when absent. |
 | `GET /api/v1/analytics/kpi-snapshot` | `analytics:read` | Tenant-scoped aggregate by default. |
 
 ## Current Branch Implementation Status

From a51e19bb146571cf1ddca56d2caabd1d9b64e827 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 1 Oct 2026 11:55:43 +0900
Subject: [PATCH 16/23] test(deps): restore Jackson security floor contract

---
 .../viewer/config/DependencyPolicyTest.java         | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/src/test/java/com/clearfolio/viewer/config/DependencyPolicyTest.java b/src/test/java/com/clearfolio/viewer/config/DependencyPolicyTest.java
index 2c3f0f2b5..f4e60ab4e 100644
--- a/src/test/java/com/clearfolio/viewer/config/DependencyPolicyTest.java
+++ b/src/test/java/com/clearfolio/viewer/config/DependencyPolicyTest.java
@@ -53,6 +53,19 @@ void pomPinsPatchedNettyLineForReactiveHttpServing() throws Exception {
         );
     }
 
+    @Test
+    void pomPinsJacksonLinePastSeptember2026DatabindAdvisories() throws Exception {
+        Document document = parsedPom();
+        Element properties = (Element) document.getElementsByTagName("properties").item(0);
+
+        assertEquals(
+                "2.22.3",
+                directChildTextOf(properties, "jackson-bom.version"),
+                "Jackson 2.22.3 is the first 2.22.x release that fixes CVE-2026-68497, "
+                        + "CVE-2026-91776, CVE-2026-91777, CVE-2026-19032, and CVE-2026-83557"
+        );
+    }
+
     @Test
     void mavenVerifyGeneratesWarningFreePublicApiJavadocs() throws Exception {
         Document document = parsedPom();

From b20bd4ead4600208960b534b08173ee946a84c7d Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 1 Oct 2026 11:55:53 +0900
Subject: [PATCH 17/23] test(auth): restore tenant-admin permission contract

---
 .../auth/TenantPermissionContractTest.java    | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 src/test/java/com/clearfolio/viewer/auth/TenantPermissionContractTest.java

diff --git a/src/test/java/com/clearfolio/viewer/auth/TenantPermissionContractTest.java b/src/test/java/com/clearfolio/viewer/auth/TenantPermissionContractTest.java
new file mode 100644
index 000000000..6bb623056
--- /dev/null
+++ b/src/test/java/com/clearfolio/viewer/auth/TenantPermissionContractTest.java
@@ -0,0 +1,26 @@
+package com.clearfolio.viewer.auth;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import org.junit.jupiter.api.Test;
+
+class TenantPermissionContractTest {
+
+    @Test
+    void tenantAdminRoleCarriesAdminOperatePermission() throws IOException {
+        String contract = Files.readString(
+                Path.of("docs/security/2026-07-02-auth-tenant-model.md"));
+        String tenantAdminRow = contract.lines()
+                .filter(line -> line.startsWith("| `tenant_admin` |"))
+                .findFirst()
+                .orElseThrow();
+
+        assertTrue(
+                tenantAdminRow.contains("`" + TenantPermissions.ADMIN_OPERATE + "`"),
+                "tenant_admin must receive the permission enforced by AdminController");
+    }
+}

From 69d6f73fbe94d0b0d1ae6a046cd22a1796730c50 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 1 Oct 2026 11:56:11 +0900
Subject: [PATCH 18/23] docs(gap): restore current product-technical baseline

---
 docs/product-technical-gap-baseline.md | 52 ++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 docs/product-technical-gap-baseline.md

diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md
new file mode 100644
index 000000000..6379e81f0
--- /dev/null
+++ b/docs/product-technical-gap-baseline.md
@@ -0,0 +1,52 @@
+# Product and Technical Gap Baseline
+
+Status: **Proposed**
+
+Evidence cutoff: 2026-10-01 UTC
+
+Evidence source head: `b20bd4ead4600208960b534b08173ee946a84c7d` on
+[clearfolio#659](https://github.com/ContextualWisdomLab/clearfolio/pull/659).
+
+## Goal and bounded context
+
+Clearfolio owns the document-viewer bounded context: authenticated document conversion status,
+artifact preview, and administrator recovery operations. Product-domain truth remains in Clearfolio.
+Identity claims enter through the tenant-access anti-corruption layer; document extraction and
+organization control-plane responsibilities remain external contracts.
+
+## Authoritative artifacts
+
+| Concern | Current evidence | Status |
+| --- | --- | --- |
+| PRD | `docs/prd-integrated-document-viewer-platform.md` | Current |
+| TRD | `docs/trd-integrated-document-viewer-platform.md` | Current |
+| Architecture and Context Map | `ARCHITECTURE.md`, `docs/architecture.md` | Current |
+| UML and interaction flows | `docs/diagrams/README.md` and bounded flow diagrams | Current |
+| Authentication model | `docs/security/2026-07-02-auth-tenant-model.md` | Current |
+| ERD | No canonical ERD is published in this repository | Gap |
+| Change history | `CHANGELOG.md` | Current |
+
+## Context Map
+
+| Relationship | Contract boundary | Direction |
+| --- | --- | --- |
+| Identity provider to Clearfolio | Tenant claims and explicit permissions | Upstream to ACL |
+| Conversion storage to Clearfolio | Repository interfaces and artifact identifiers | Upstream to ACL |
+| Clearfolio to browser | Versioned HTTP responses and signed artifact links | Product API |
+| Organization CI to Clearfolio | Reusable security and review workflows | Conformance only |
+
+## Gap and action register
+
+| Gap | Exact evidence | Action | Status |
+| --- | --- | --- | --- |
+| Administrator endpoints lacked an explicit operation permission | PR #659 source and tests | Require `ADMIN_OPERATE` through `TenantAccessService` | Implemented; exact-head acceptance pending |
+| Jackson 2.22.1 is affected by five September 2026 advisories | Security run `36792153106`, job `110147365860` | Pin Jackson BOM and databind to 2.22.3 and guard the POM version | Contract restored at `b20bd4ea…`; exact-head Security Scan pending |
+| Canonical ERD is absent | Repository documentation inventory at the evidence head | Publish the persisted conversion-job and tenant ownership model without inventing storage not present in code | Proposed |
+| Current successor invalidated predecessor-head CodeQL evidence | PR head advanced after restoring deleted contracts | Require fresh exact-head CodeQL plus independent review | Pending |
+
+## Acceptance rule
+
+A row becomes complete only when its implementation, regression contract, documentation, and
+exact-head hosted checks are green. Draft-gated, queued, skipped, stale-head, or predecessor-head
+results are not acceptance evidence. This baseline must be updated whenever the PRD, TRD,
+Context Map, persistence model, or a listed Gap changes.

From 63529a0a8b2c10d925463de42e6063b2405f1fe4 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 1 Oct 2026 11:58:11 +0900
Subject: [PATCH 19/23] docs(security): preserve top-level ledger heading

---
 .jules/sentinel.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index 391b6086a..4a758552c 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -1,4 +1,4 @@
-## 2026-06-30 - Prevent DOM-based XSS in Viewer JS
+# 2026-06-30 - Prevent DOM-based XSS in Viewer JS
 **Vulnerability:** Untrusted paths from API responses were directly assigned to `a.href` and used in `iframe` generation, which allows execution of malicious URIs like `javascript:` or `data:`.
 **Learning:** Even when avoiding `innerHTML`, directly setting URL-like strings to DOM attributes without protocol validation introduces XSS vectors. The payload can be executed when the link is clicked or the iframe is loaded.
 **Prevention:** Implement an `isSafeUrl` verification function to ensure the protocol is strictly `http:` or `https:` (using `new URL()`) before assigning untrusted inputs to DOM attributes like `href` or `src`.

From 9d97f2ae4166e4fa762dc680e650245eb2cb1c0b Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 1 Oct 2026 11:58:49 +0900
Subject: [PATCH 20/23] docs(deps): restore complete Jackson advisory
 provenance

---
 pom.xml | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/pom.xml b/pom.xml
index 1e5de5f50..0675feb64 100644
--- a/pom.xml
+++ b/pom.xml
@@ -38,11 +38,9 @@
          which contains the July 2026 HTTP, HTTP/2, MQTT, compression, and
          parser-boundary hardening release. -->
     <netty.version>4.1.136.Final</netty.version>
-    <!-- Security override: pull the patched Jackson line for GHSA-5jmj-h7xm-6q6v
-         / CVE-2026-54515 case-insensitive deserialization bypasses. The root
-         OSV config contains a narrow temporary ignore because OSV Scanner
-         v2.3.8 still reports 2.22.1 even though the advisory text names it as
-         patched. -->
+    <!-- Security override: Jackson 2.22.3 is the first 2.22.x line fixing
+         CVE-2026-68497, CVE-2026-91776, CVE-2026-91777, CVE-2026-19032,
+         CVE-2026-83557, and retains the CVE-2026-54515 fix. -->
     <jackson-bom.version>2.22.3</jackson-bom.version>
     <!-- Security override: GHSA-jhq6-gfmj-v8fx fixes logback-core in 1.5.35. -->
     <logback.version>1.5.35</logback.version>
@@ -59,7 +57,7 @@
   -->
   <dependencyManagement>
     <dependencies>
-      <!-- GHSA-5jmj-h7xm-6q6v / CVE-2026-54515: jackson-databind line -->
+      <!-- September 2026 jackson-databind advisory remediation line -->
       <dependency>
         <groupId>com.fasterxml.jackson</groupId>
         <artifactId>jackson-bom</artifactId>

From 4ba2c0a6a45ffa29aaa36a244675ab6f5caeb2a9 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Thu, 1 Oct 2026 03:05:31 +0000
Subject: [PATCH 21/23] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[CRIT?=
 =?UTF-8?q?ICAL]=20AdminController=20=EA=B6=8C=ED=95=9C=20=EB=B6=80?=
 =?UTF-8?q?=EC=97=AC=20=EB=88=84=EB=9D=BD=20=EA=B5=90=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AdminController의 관리자 API에 TenantAccessService를 사용한 권한 검증 로직을
추가하여 인가 우회(Authorization Bypass) 취약점을 수정했습니다.

From ba520f331fd38ad2d6188bcbabc22e72663a03a4 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Thu, 1 Oct 2026 03:20:10 +0000
Subject: [PATCH 22/23] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[CRIT?=
 =?UTF-8?q?ICAL]=20AdminController=20=EA=B6=8C=ED=95=9C=20=EB=B6=80?=
 =?UTF-8?q?=EC=97=AC=20=EB=88=84=EB=9D=BD=20=EA=B5=90=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AdminController의 관리자 API에 TenantAccessService를 사용한 권한 검증 로직을
추가하여 인가 우회(Authorization Bypass) 취약점을 수정했습니다.

From 2b09b2c8b7518bfc32cb6fd5e35bf33e68687e7c Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Thu, 1 Oct 2026 03:57:20 +0000
Subject: [PATCH 23/23] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[CRIT?=
 =?UTF-8?q?ICAL]=20AdminController=20=EA=B6=8C=ED=95=9C=20=EB=B6=80?=
 =?UTF-8?q?=EC=97=AC=20=EB=88=84=EB=9D=BD=20=EA=B5=90=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AdminController의 관리자 API에 TenantAccessService를 사용한 권한 검증 로직을
추가하여 인가 우회(Authorization Bypass) 취약점을 수정했습니다.