admin/0pt
5
0
Fork 0
Code Issues 9 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

fix(auth): P0 tenant-isolering för internal-token (verifierad tenant) #494

Merged
admin merged 3 commits from fix/internal-token-tenant-20261107 into main 2026-11-07 15:55:12 +00:00
Conversation 2 Commits 3 Files Changed 6
+438 -4
3 Commits
Author SHA1 Message Date
SIAX Agent 1a581fde29 fix(auth): en (1) tenant per intern serviceprincipal — multi-tenant nekas
CI (SIAX Cloud) / sonar (pull_request) Skipped
Details
masterplan-lock / check (push) Successful in 4s
Details
masterplan-lock / check (pull_request) Successful in 8s
Details
CI (SIAX Cloud) / security (pull_request) Successful in 35s
Details
Security Scan (SIAX Cloud) / security (pull_request) Successful in 44s
Details
CI (SIAX Cloud) / integration (pull_request) Successful in 9m48s
Details
CI (SIAX Cloud) / quality (pull_request) Successful in 10m14s
Details 
Den delade X-Internal-Token identifierar EN tjänsteprocess, inte flera
oberoende principaler. En allowlist med flera tenants skulle låta varje
tokeninnehavare välja mellan dem — samma klientstyrda auktoritet som guarden
ska ta bort. Multi-tenant-tjänsteåtkomst kräver verifierad
workload-identity-binding (CL0UD-delegation); tills den finns failar en
ambig konfiguration stängt (401) och ingen identitet forwardas.

Tester: multi-tenant nekas utan side effect, en tenant fungerar, 75/75 i
auth+ cross-tenant-sviterna, tsc ren.
 2026-11-07 16:39:48 +01:00
SIAX Agent b97ad0b2f4 fix(auth): bind internal-service tenant authority to server config
CI (SIAX Cloud) / sonar (pull_request) Skipped
Details
masterplan-lock / check (push) Successful in 4s
Details
masterplan-lock / check (pull_request) Successful in 4s
Details
CI (SIAX Cloud) / security (pull_request) Successful in 16s
Details
Security Scan (SIAX Cloud) / security (pull_request) Successful in 16s
Details
CI (SIAX Cloud) / integration (pull_request) Successful in 36s
Details
CI (SIAX Cloud) / quality (pull_request) Successful in 10m24s
Details 
The first revision of this fix copied a CLIENT header (X-0pt-Internal-Tenant)
or a single INTERNAL_TENANT_ID into x-0pt-verified-tenant. That is not an
authorization source: any holder of the shared internal token could still name
any tenant, leaving the original cross-tenant write reachable through a
different header.

- INTERNAL_SERVICE_TENANTS (server env) is now the only tenant authority for
  the X-Internal-Token principal; empty => no authority (fail closed, 403).
- Middleware strips inbound x-0pt-verified-{tenant,sub} and the service scope
  header on every path, including the dev escape hatch.
- x-0pt-verified-service-tenants carries the allowlist; the tenant guard checks
  membership and denies anything outside it.
- POST /api/0pt/quality/bridge-run now runs the same tenant guard as
  canonical/facts (it auto-provisions tenant-scoped rules).
- 16 new regression tests; auth + cross-tenant + canonical + bridge suites
  87/87; tsc --noEmit clean.
 2026-11-07 15:32:51 +01:00
admin 849e7ae802 fix(auth): internal-token requests får verifierad tenant (P0 tenant-isolering)
masterplan-lock / check (push) Successful in 4s
Details
CI (SIAX Cloud) / sonar (pull_request) Skipped
Details
masterplan-lock / check (pull_request) Successful in 5s
Details
CI (SIAX Cloud) / security (pull_request) Successful in 15s
Details
Security Scan (SIAX Cloud) / security (pull_request) Successful in 43s
Details
CI (SIAX Cloud) / integration (pull_request) Successful in 10m3s
Details
CI (SIAX Cloud) / quality (pull_request) Successful in 10m15s
Details 
Bevisat: POST /api/0pt/canonical/facts med X-Internal-Token och tenant_id
999999999999999999 returnerade 201 och skrev data i annan tenant. Orsak:
internal-token-grenen returnerade next() utan x-0pt-verified-tenant, så
assertTenantMatchesVerified blev no-op.

Fix: INTERNAL_TENANT_ID (eller X-0pt-Internal-Tenant) sätts som verifierad
tenant, vilket gör guard-enforcement identisk med verifierad Bearer. Varnar
om variabeln saknas.
 2026-11-07 14:55:59 +01:00