admin/c0py
3
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(api): deterministic scan worker + AUD0 wire + tenant binding
CI (SIAX Cloud) / security (pull_request) Successful in 14s
Details
CI (SIAX Cloud) / security (push) Successful in 14s
Details
CI (SIAX Cloud) / contracts (pull_request) Successful in 15s
Details
CI (SIAX Cloud) / contracts (push) Successful in 17s
Details
CI (SIAX Cloud) / quality (push) Successful in 1m9s
Details
CI (SIAX Cloud) / quality (pull_request) Successful in 1m10s
Details

Browse Source 
- scan worker: atomic claim (FOR UPDATE SKIP LOCKED), Playwright-core + system
  chromium capture → typed EvidenceRecords (runtime-html/dom/computed-style/
  stylesheet/asset/network-request/screenshot), confidence=measured
- AUD0 emitter (fire-and-forget, advisory): c0py.registry_created/.scan_created/
  .scan_completed/.scan_failed, tenant_id = Zitadel resourceowner (org)
- tenant binding: resourceowner claim from introspection (deny-by-default 403),
  migration 002 tenant_id on registries+scans, all queries tenant+owner scoped
- evidence gaps stay explicit (screenshot miss → no screenshot record)
- 30/30 tests, canonical validator OK
This commit is contained in:
admin
2026-09-16 22:53:55 +02:00
parent 7fb6043e34
commit 12f6a65b80
13 changed files with 757 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+2 -1
View File
@@ -13,7 +13,8 @@ RUN pnpm install --frozen-lockfile
FROM node:22-alpine AS runtime
WORKDIR /app
RUN apk add --no-cache wget
# chromium: deterministic browser capture (scan worker, playwright-core)
RUN apk add --no-cache wget chromium
COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
COPY packages ./packages