Claude Fable 5
4c7f001cab
Some checks failed
CI / Lint, typecheck, test (pull_request) Successful in 6m44s
CI / Build container images (pull_request) Successful in 4m42s
CI / Auth e2e pack (pull_request) Successful in 9m15s
CI / Import/export fidelity gate (pull_request) Successful in 59s
CD / Deploy to Test (push) Blocked by required conditions
CD / Smoke tests against Test (push) Blocked by required conditions
CD / Promote to Int (push) Blocked by required conditions
CI / Auth e2e pack (push) Blocked by required conditions
CI / Import/export fidelity gate (push) Blocked by required conditions
CI / Build container images (push) Blocked by required conditions
CD / Build and push images (push) Has been cancelled
CI / Lint, typecheck, test (push) Has been cancelled
For perimeters that authenticate before the application (ADR 0021 §4). Off unless BOTH AUTH_PROXY_HEADER and AUTH_PROXY_TRUSTED_PEERS are set — nothing about the header is guessed. The peer check runs against the TCP peer address only (a forwarded header is attacker-influenced): a request carrying the header from any other peer is rejected outright and audited as auth.proxy_rejected (catalogue v1.4) — that is a spoof attempt, not a misconfiguration — even when a valid session cookie rides along. From a trusted peer the header IS the identity; a session cookie never escalates beyond it; with the feature off the header is inert. Mapping is explicit (AUTH_PROXY_MAP: username or e-mail); deliberately no just-in-time creation — the header carries no verified address. The mTLS variant (AUTH_PROXY_MODE=mtls-dn) maps the configured attribute (default CN) out of the certificate subject DN the TLS terminator forwards, under the same peer rules. Session-less proxy requests key the read trail per user (user:<id>). The trust boundary is stated in security.md (the section an assessor reads closest), the VS-NfD security documentation and the hardening guide's deploy table. Tests cover all four decisions: off = inert, trusted peer authenticates (username and DN mapping), untrusted peer rejected + audited, no escalation past a session cookie. Refs #215. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8
23 lines
849 B
TypeScript
23 lines
849 B
TypeScript
import type { ReadActor } from './read-trail.service';
|
|
|
|
/**
|
|
* Resolves the {@link ReadActor} of a cookie-session request (issue #222).
|
|
* Structural parameter instead of `AuthedRequest` so the read-trail module
|
|
* never imports the auth guard. PAT requests build their key directly
|
|
* (`token:<id>`, public-api controller).
|
|
*/
|
|
export function readActorOf(request: {
|
|
user?: { id: string } | null;
|
|
sessionId?: string;
|
|
}): ReadActor {
|
|
// Session-less authenticated requests (trusted-proxy identity, #215) key
|
|
// per user — the proxy re-authenticates every request, so the user is
|
|
// the closest thing to a session the channel has.
|
|
const sessionKey = request.sessionId
|
|
? `session:${request.sessionId}`
|
|
: request.user
|
|
? `user:${request.user.id}`
|
|
: 'anon';
|
|
return { actorId: request.user?.id ?? null, sessionKey };
|
|
}
|