Security review: authorization boundaries for standard users (no admin access, no privilege escalation, no server-side code execution)

kayg commented

2026-09-26 15:49:08 +00:00

Owner

Owner 2026-09-26: before calternal is public, review our own server as a standard (non-admin) user on a local test instance and close every gap. Defensive review of our code only; nothing runs against o2 or any other host.
Areas to review, each with a regression test in tests/ or the crate that owns the route:

Every admin route and admin-only setting (Users, Invitations, Sign-in, Server configuration, Backups, instance plugin toggles, AI provider keys): a standard session gets 403 for reads and writes, including through alternate paths (WebMCP tools, CLI routes, CalDAV/WebDAV, collab rooms, search, share and public-link routes, batch or bulk endpoints). One action = one route (DESIGN §41): authorization lives on the route.
Session scopes (§21): account/admin/data scopes, fresh-assertion requirements for authority changes, agent tokens data-only; role changes and disable revoke sessions; invitation role cannot be raised by the invitee; OIDC group mapping never grants owner.
Cross-user isolation: one user's Home, notes, photos, shares, reminders, settings and index rows are never readable or writable by another user (IDs, paths, share slugs, search, thumbnails, previews, versions, trash).
Server-side execution surfaces: file conversions and media processing (thumbnails, HEIF/video via external tools, PDF text extraction), Markdown/HTML rendering, import paths, template features, plugin loading, agent containers: no user-controlled input reaches a shell, an interpreter, or a tool option; subprocess arguments are fixed lists; paths go only through calternal-fs (openat2 RESOLVE_BENEATH).
Web security: CSP (#118), inline file serving sandbox (#107), CSRF on cookie routes, open redirects, cookie flags.
Extend tests/adversarial with a standard-user authorization matrix (every OpenAPI operation × {anonymous, standard, guest link, admin}) that fails on any unexpected success. Fix each finding with its test, one commit per fix. Report a table of routes checked and findings fixed; do not paste exploit steps into the issue.

Owner 2026-09-26: before calternal is public, review our own server as a standard (non-admin) user on a local test instance and close every gap. Defensive review of our code only; nothing runs against o2 or any other host. Areas to review, each with a regression test in tests/ or the crate that owns the route: - Every admin route and admin-only setting (Users, Invitations, Sign-in, Server configuration, Backups, instance plugin toggles, AI provider keys): a standard session gets 403 for reads and writes, including through alternate paths (WebMCP tools, CLI routes, CalDAV/WebDAV, collab rooms, search, share and public-link routes, batch or bulk endpoints). One action = one route (DESIGN §41): authorization lives on the route. - Session scopes (§21): account/admin/data scopes, fresh-assertion requirements for authority changes, agent tokens data-only; role changes and disable revoke sessions; invitation role cannot be raised by the invitee; OIDC group mapping never grants owner. - Cross-user isolation: one user's Home, notes, photos, shares, reminders, settings and index rows are never readable or writable by another user (IDs, paths, share slugs, search, thumbnails, previews, versions, trash). - Server-side execution surfaces: file conversions and media processing (thumbnails, HEIF/video via external tools, PDF text extraction), Markdown/HTML rendering, import paths, template features, plugin loading, agent containers: no user-controlled input reaches a shell, an interpreter, or a tool option; subprocess arguments are fixed lists; paths go only through calternal-fs (openat2 RESOLVE_BENEATH). - Web security: CSP (#118), inline file serving sandbox (#107), CSRF on cookie routes, open redirects, cookie flags. Extend tests/adversarial with a standard-user authorization matrix (every OpenAPI operation × {anonymous, standard, guest link, admin}) that fails on any unexpected success. Fix each finding with its test, one commit per fix. Report a table of routes checked and findings fixed; do not paste exploit steps into the issue.

kayg commented

2026-09-26 15:50:08 +00:00

Author

Owner

Starting #195 on branch job/authz-review, based on dev at e976bff6c7. I am building the OpenAPI authorization matrix first, then I will review the requested authorization boundaries against a local instance started from this worktree.

Starting #195 on branch job/authz-review, based on dev at e976bff6c74b3131266b3baeb33ab318edccd46e. I am building the OpenAPI authorization matrix first, then I will review the requested authorization boundaries against a local instance started from this worktree.

kayg referenced this issue

2026-09-26 15:56:35 +00:00

Owner test tracker: every request and when it is testable on o2 #203

kayg commented

2026-09-26 16:25:55 +00:00

Author

Owner

The shell response enforces only SHELL_POLICY; the full hashed script policy is emitted as Content-Security-Policy-Report-Only. The browser therefore does not enforce the script allowlist. API/DAV and user-byte policies remain enforced. I am extending the existing local browser probe and will verify the shell policy in enforced mode.

The shell response enforces only `SHELL_POLICY`; the full hashed script policy is emitted as `Content-Security-Policy-Report-Only`. The browser therefore does not enforce the script allowlist. API/DAV and user-byte policies remain enforced. I am extending the existing local browser probe and will verify the shell policy in enforced mode.

kayg commented

2026-09-26 16:35:08 +00:00

Author

Owner

Decision: the AI credential routes operate on each User's own subscription credential (account_user and user_id-keyed rows), as specified in DESIGN §§10 and 19. The matrix therefore expects a standard User to manage only that User's own credential; instance-wide provider settings remain admin-only.

Decision: the AI credential routes operate on each User's own subscription credential (`account_user` and `user_id`-keyed rows), as specified in DESIGN §§10 and 19. The matrix therefore expects a standard User to manage only that User's own credential; instance-wide provider settings remain admin-only.

kayg commented

2026-09-26 16:47:02 +00:00

Author

Owner

Local-run finding: the adversarial runner persisted server output before extracting the first setup credential, so its server log could contain a live setup URL. The runner now redacts the credential as output is captured and stores it in a mode-0600 file for setup. The redaction path was checked with a synthetic token; the log contains only the redacted form.

kayg commented

2026-09-26 20:31:05 +00:00

Author

Owner

Local matrix evidence after merging dev: the Note WebSocket operations returned HTTP 500 for anonymous and Public link visitors. The handlers require a PluginRequestContext extension, so an unauthenticated handshake fails in extraction before the route can reject it. I will make the principal optional and return 403 before room lookup, with a real WebSocket regression test.

kayg commented

2026-09-26 20:31:09 +00:00

Author

Owner

Local matrix evidence after merging dev: GET /api/v1/search?q=x returned HTTP 200 for anonymous and Public link visitors. The route passes an optional principal to search providers without checking data scope. I will require data scope on search results and add a route regression test. GET /api/v1/search/parse also returned 200, which is expected: it only parses caller input and reads no User data. I will record that public behavior in the matrix policy.

kayg commented

2026-09-26 21:01:49 +00:00

Author

Owner

Resolved local matrix findings after merging dev:

GET /api/v1/search now returns 401 without a User and 403 without data scope or User Home roots. Query parsing stays public because it reads no User data. Regression coverage checks anonymous, account-only, data-scoped and parser requests.
Note collaboration WebSocket routes now return 403 when the request has no plugin principal, before room lookup. A real WebSocket handshake test covers both the User room and shared room routes.
The local matrix passed: 222 OpenAPI operations × four identities = 888 requests; 18 public, 9 Public link, 174 User data and 21 admin operations. The fixture now sends the same-origin Origin header for cookie-authenticated writes.

Resolved local matrix findings after merging dev: - `GET /api/v1/search` now returns 401 without a User and 403 without data scope or User Home roots. Query parsing stays public because it reads no User data. Regression coverage checks anonymous, account-only, data-scoped and parser requests. - Note collaboration WebSocket routes now return 403 when the request has no plugin principal, before room lookup. A real WebSocket handshake test covers both the User room and shared room routes. - The local matrix passed: 222 OpenAPI operations × four identities = 888 requests; 18 public, 9 Public link, 174 User data and 21 admin operations. The fixture now sends the same-origin Origin header for cookie-authenticated writes.

kayg commented

2026-09-26 21:37:21 +00:00

Author

Owner

Full local adversarial round completed after the route fixes. The server stayed alive. The OpenAPI matrix passed 222 operations × four identities (888 requests). The standard HTTP probe ended with 40 findings, all SLOW successful responses. Round two ended with 51 findings: 37 SLOW operations and thumbnail assertions that depended on a photo thumbnail the worker did not generate within the 30-second fixture window. The restart probe reported zero findings.

I updated the share probe so it marks a missing generated thumbnail as SLOW and skips only assertions that require thumbnail bytes. It still runs the link permission, password, upload, path, download, preview, and expiry checks. The media thumbnail header check was also skipped by its existing 10-second worker guard. No additional server authorization defect was confirmed in this round.

Full local adversarial round completed after the route fixes. The server stayed alive. The OpenAPI matrix passed 222 operations × four identities (888 requests). The standard HTTP probe ended with 40 findings, all `SLOW` successful responses. Round two ended with 51 findings: 37 `SLOW` operations and thumbnail assertions that depended on a photo thumbnail the worker did not generate within the 30-second fixture window. The restart probe reported zero findings. I updated the share probe so it marks a missing generated thumbnail as `SLOW` and skips only assertions that require thumbnail bytes. It still runs the link permission, password, upload, path, download, preview, and expiry checks. The media thumbnail header check was also skipped by its existing 10-second worker guard. No additional server authorization defect was confirmed in this round.

kayg commented

2026-09-26 21:37:40 +00:00

Author

Owner

Correction to my previous comment's count: the executed round-two script reported 51 findings: 36 explicitly marked SLOW and 15 thumbnail-dependent assertions. With the harness fix now committed, the 30-second thumbnail fixture timeout is itself reported as SLOW, and those dependent assertions are skipped when the fixture has no thumbnail.

Correction to my previous comment's count: the executed round-two script reported 51 findings: 36 explicitly marked `SLOW` and 15 thumbnail-dependent assertions. With the harness fix now committed, the 30-second thumbnail fixture timeout is itself reported as `SLOW`, and those dependent assertions are skipped when the fixture has no thumbnail.

kayg commented

2026-09-26 22:22:53 +00:00

Author

Owner

Completed Forgejo #195 on job/authz-review.

Head SHA: c67710771284c03ffbec38462f7aaacb775096d3.

Changes

Search results now require a signed-in User, data scope, and nonempty User Home roots. Query parsing remains public.
Note collaboration WebSocket routes reject requests without a plugin principal before room lookup.
Updated OpenAPI responses and generated TypeScript types.
Expanded the authorization matrix and stabilized its fixtures, cookie-origin headers, event-stream cleanup, and media-thumbnail timeout handling.

Files changed:

contracts/openapi.json
crates/calternal-collab/src/session.rs
crates/calternal-collab/tests/hostile_clients.rs
crates/calternal-server/src/main.rs
crates/calternal-server/src/security.rs
packages/api-client/src/generated.ts
tests/adversarial/attack2.py
tests/adversarial/authz_matrix.py
tests/adversarial/hostile_bytes.mjs
tests/adversarial/run.sh
tests/adversarial/server_log.py
tests/adversarial/setup.mjs

Evidence

Authorization matrix passed 222 OpenAPI operations against four identities (888 requests): 18 public, 9 Public link, 174 User data, and 21 admin operations.
Focused regression tests cover anonymous/account-only/data-scoped search and real unauthenticated WebSocket handshakes.
The restart probe reported zero findings.
The first adversarial probe reported 40 findings, all explicitly SLOW successful responses. Round two reported 36 SLOW operations and 15 assertions requiring a thumbnail that the media worker did not generate within the 30-second fixture window.
After that run, the share probe was changed to report the missing thumbnail fixture as SLOW and skip only assertions requiring thumbnail bytes. Permission, password, upload, path, download, preview, and expiry checks still run. The full adversarial round was not rerun after this harness-only change. No other non-SLOW server defect was confirmed beyond the search and WebSocket authorization defects fixed here.

Gates

cargo fmt --all --check produced no output; exit_code=0.

cargo clippy --all-targets -- -D warnings:

Finished `dev` profile [unoptimized + debuginfo] target(s) in 18m 15s
exit_code=0

cargo test: all 67 result groups completed; 1,195 passed, 0 failed, 12 ignored; exit_code=0. Verbatim representative result:

test result: ok. 476 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.61s

bun run check:

svelte-check found 0 errors and 0 warnings
exit_code=0

bun run test:

 Test Files  55 passed (55)
      Tests  432 passed (432)
exit_code=0

OpenAPI TypeScript generation also passed:

✨ openapi-typescript 7.13.0
🚀 ../../contracts/openapi.json → src/generated.ts [1.5s]

cargo clean removed 21,157 files (18.4 GiB). apps/web/build and apps/web/.svelte-kit were removed. The worktree is clean.

Decisions not covered by the design docs

Search requires a User principal plus the data scope and at least one User Home root; the input-only query parser stays public.
An unauthenticated collaboration WebSocket request receives 403 before any room lookup.
A thumbnail fixture timeout is classified as SLOW, and only byte assertions that need the absent thumbnail are skipped.

Completed Forgejo #195 on `job/authz-review`. Head SHA: `c67710771284c03ffbec38462f7aaacb775096d3`. ### Changes - Search results now require a signed-in User, `data` scope, and nonempty User Home roots. Query parsing remains public. - Note collaboration WebSocket routes reject requests without a plugin principal before room lookup. - Updated OpenAPI responses and generated TypeScript types. - Expanded the authorization matrix and stabilized its fixtures, cookie-origin headers, event-stream cleanup, and media-thumbnail timeout handling. Files changed: - `contracts/openapi.json` - `crates/calternal-collab/src/session.rs` - `crates/calternal-collab/tests/hostile_clients.rs` - `crates/calternal-server/src/main.rs` - `crates/calternal-server/src/security.rs` - `packages/api-client/src/generated.ts` - `tests/adversarial/attack2.py` - `tests/adversarial/authz_matrix.py` - `tests/adversarial/hostile_bytes.mjs` - `tests/adversarial/run.sh` - `tests/adversarial/server_log.py` - `tests/adversarial/setup.mjs` ### Evidence - Authorization matrix passed 222 OpenAPI operations against four identities (888 requests): 18 public, 9 Public link, 174 User data, and 21 admin operations. - Focused regression tests cover anonymous/account-only/data-scoped search and real unauthenticated WebSocket handshakes. - The restart probe reported zero findings. - The first adversarial probe reported 40 findings, all explicitly SLOW successful responses. Round two reported 36 SLOW operations and 15 assertions requiring a thumbnail that the media worker did not generate within the 30-second fixture window. - After that run, the share probe was changed to report the missing thumbnail fixture as SLOW and skip only assertions requiring thumbnail bytes. Permission, password, upload, path, download, preview, and expiry checks still run. The full adversarial round was not rerun after this harness-only change. No other non-SLOW server defect was confirmed beyond the search and WebSocket authorization defects fixed here. ### Gates `cargo fmt --all --check` produced no output; `exit_code=0`. `cargo clippy --all-targets -- -D warnings`: ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 18m 15s exit_code=0 ``` `cargo test`: all 67 result groups completed; 1,195 passed, 0 failed, 12 ignored; `exit_code=0`. Verbatim representative result: ``` test result: ok. 476 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.61s ``` `bun run check`: ``` svelte-check found 0 errors and 0 warnings exit_code=0 ``` `bun run test`: ``` Test Files 55 passed (55) Tests 432 passed (432) exit_code=0 ``` OpenAPI TypeScript generation also passed: ``` ✨ openapi-typescript 7.13.0 🚀 ../../contracts/openapi.json → src/generated.ts [1.5s] ``` `cargo clean` removed 21,157 files (18.4 GiB). `apps/web/build` and `apps/web/.svelte-kit` were removed. The worktree is clean. ### Decisions not covered by the design docs - Search requires a User principal plus the `data` scope and at least one User Home root; the input-only query parser stays public. - An unauthenticated collaboration WebSocket request receives 403 before any room lookup. - A thumbnail fixture timeout is classified as SLOW, and only byte assertions that need the absent thumbnail are skipped.

kayg referenced this issue from a commit

2026-09-26 22:27:56 +00:00

Merge job/authz-review (#195)

kayg commented

2026-09-26 22:27:57 +00:00

Author

Owner

Merged into dev at f6418fc7 (search requires User + data scope; unauthenticated collab handshakes rejected before room lookup; 888-request authorization matrix passes). Claude judged the Luna Max review adequate; the optional Sol rerun is not needed now. Deploy status on #203.

Merged into dev at f6418fc7 (search requires User + data scope; unauthenticated collab handshakes rejected before room lookup; 888-request authorization matrix passes). Claude judged the Luna Max review adequate; the optional Sol rerun is not needed now. Deploy status on #203.

kayg closed this issue

2026-09-26 22:27:58 +00:00

kayg referenced this issue

2026-09-27 10:17:19 +00:00

Search full view: photo grid tiles show no thumbnails (e2e search fails consistently) #224

kayg referenced this issue

2026-09-27 10:23:51 +00:00

Owner test tracker: every request and when it is testable on o2 #203

kayg referenced this issue

2026-10-02 13:06:53 +00:00

BLOCKER: Re-enrolment must preserve the owner authority boundary #734

kayg referenced this issue