feat(api): deterministic scan worker + AUD0 wire + tenant binding · 12f6a65b80 - c0py

feat(api): deterministic scan worker + AUD0 wire + tenant binding

CI (SIAX Cloud) / security (pull_request) Successful in 14s

Details

CI (SIAX Cloud) / security (push) Successful in 14s

Details

CI (SIAX Cloud) / contracts (pull_request) Successful in 15s

Details

CI (SIAX Cloud) / contracts (push) Successful in 17s

Details

CI (SIAX Cloud) / quality (push) Successful in 1m9s

Details

CI (SIAX Cloud) / quality (pull_request) Successful in 1m10s

Details

- scan worker: atomic claim (FOR UPDATE SKIP LOCKED), Playwright-core + system
  chromium capture → typed EvidenceRecords (runtime-html/dom/computed-style/
  stylesheet/asset/network-request/screenshot), confidence=measured
- AUD0 emitter (fire-and-forget, advisory): c0py.registry_created/.scan_created/
  .scan_completed/.scan_failed, tenant_id = Zitadel resourceowner (org)
- tenant binding: resourceowner claim from introspection (deny-by-default 403),
  migration 002 tenant_id on registries+scans, all queries tenant+owner scoped
- evidence gaps stay explicit (screenshot miss → no screenshot record)
- 30/30 tests, canonical validator OK

This commit is contained in:

admin

2026-09-16 22:53:55 +02:00

parent 7fb6043e34

commit 12f6a65b80

13 changed files with 757 additions and 52 deletions

									
										apps/api/package.json
									
		+1
		
												View File
												
				@@ -16,6 +16,7 @@

				    "@siax/c0py-types": "workspace:*",

				    "fastify": "^5.12.0",

				    "pg": "^8.23.0",

				    "playwright-core": "^1.63.0",

				    "zod": "^3.24.0"

				  },

				  "devDependencies": {