Scott.Idem/OSIT-AE-API-FastAPI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Serious notes about security updates.

Browse Source
This commit is contained in:
Scott Idem
2026-02-13 19:22:33 -05:00
parent aca15aab91
commit 577d784fb8
2 changed files with 22 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
documentation/AGENT_TODO.md
View File

@@ -1,19 +1,27 @@
# Backend Agent Task List # Backend Agent Task List
> Use this file to track steps for complex features or bug fixes. > Use this file to track steps for complex features or bug fixes.
> **Status:** 🔵 Active - ID Vision Phase 2 complete. > **Status:** 🟢 STABLE - Security Hardening Complete.
## 📋 Active Task: ID Vision Audit & Compliance ## 📋 Active Tasks
- [ ] **Step 1:** Audit remaining MariaDB models for ID Vision compliance. - [x] **Core Isolation:** Harden `apply_forced_account_filter` to Fail-Closed.
- [ ] **Step 2:** Harden `root_validator(pre=True)` on remaining models to prevent integer leakage. - [x] **IDAA Baseline:** Remove `public_read` from Event, CMS, and Archive objects.
- [ ] **Step 3:** Refactor `api_crud_v2.py` and `person_methods.py` (Reduce file size < 800 lines). - [x] **Detailed Feedback:** Implement descriptive 403 Forbidden reasons.
- [ ] **Step 4:** Coordination (Handshake with Frontend regarding "Badge Rendering" corrupted IDs). - [x] **Audit Suite:** Establish `test_e2e_v3_security_audit.py` as a permanent safeguard.
- [ ] **Step 5:** Finalize & Commit. - [ ] **Step 1:** Audit low-priority MariaDB models for ID Vision parity.
- [ ] **Step 2:** Refactor `api_crud_v2.py` (Reduce file size < 800 lines).
- [ ] **Step 3:** Coordination (Verify Frontend uses `x-account-id` instead of token).
## 🛡️ Security & Privacy Baseline (IDAA)
- **Status:** **ENFORCED**.
- **Principle:** Every object requires an Account Context except `site_domain`.
- **Maintenance:** Run `tests/e2e/test_e2e_v3_security_audit.py` after ANY router or registry change.
## 🚧 Upcoming Strategic Goals ## 🚧 Upcoming Strategic Goals
- **Zoom Events Integration:** Implement cron synchronization for OAuth2 ticket retrieval. - **Zoom Events Integration:** Implement cron synchronization for OAuth2 ticket retrieval.
- **Aether V4 Architecture:** Migration to V4 core standards (Lifecycle fields). - **Aether V4 Architecture:** Migration to V4 core standards (Lifecycle fields).
## 📝 Session Notes (Feb 11, 2026) ## 📝 Session Notes (Feb 13, 2026)
- **Resolved:** Finalized 'Heal-on-Read' fallback resolution for relational IDs. - **Resolved:** Critical "Fail Open" search leak where missing context returned all records.
- **Verification:** `test_e2e_v3_demo_parity.py` verified at 100% pass rate. - **Hardened:** Removed `public_read` from Events, Presentations, Posts, and Files.
- **Optimization:** Refactored `api_crud.py` and `hosted_file.py` to Registry pattern. - **Standardized:** Updated 10+ core models with Vision Transformer pattern.
- **Verification:** Security Audit Suite verified at 100% pass rate.

3
documentation/ARCH__V3_CRUD_LEARNINGS.md
View File

@@ -65,7 +65,10 @@ Implemented in Jan 2026, the V3 architecture enforces strict data isolation and
- **Role Scoping**: These flags are used to bypass account isolation for support and system maintenance tasks. - **Role Scoping**: These flags are used to bypass account isolation for support and system maintenance tasks.
### Multi-Tenant Isolation ### Multi-Tenant Isolation
- **Fail-Closed Strategy (Feb 2026)**: The API enforces a strict "Fail-Closed" mindset. If an authentication context or account ID is missing, the system defaults to a blocking filter (e.g., `account_id IS NULL`). It no longer allows "Fail-Open" behavior where missing context returns all records.
- **IDAA Privacy Baseline**: Based on the International Drunk Doctors Anonymous requirement, the system defaults to **Maximum Isolation**. No object (Events, Files, Posts, Meetings) is public by default. Every object requires an `x-account-id` context, with the sole exception of `site_domain` used for bootstrapping.
- **Forced Account Filtering**: For all non-super users, the API automatically injects an `account_id` filter into every list and search query. This is enforced at the SQL level via `apply_forced_account_filter`. - **Forced Account Filtering**: For all non-super users, the API automatically injects an `account_id` filter into every list and search query. This is enforced at the SQL level via `apply_forced_account_filter`.
- **Detailed 403 Feedback**: Security failures now return descriptive error messages (e.g., "API Key expired", "Account context required") to assist developers in debugging header/context issues while maintaining strict isolation.
- **Post-Retrieval Verification**: Single object retrievals (`GET`), updates (`PATCH`), and deletions (`DELETE`) include a secondary ownership check (`check_account_access`). If a user attempts to access an ID belonging to another account, they receive a `403 Forbidden` response. - **Post-Retrieval Verification**: Single object retrievals (`GET`), updates (`PATCH`), and deletions (`DELETE`) include a secondary ownership check (`check_account_access`). If a user attempts to access an ID belonging to another account, they receive a `403 Forbidden` response.
- **Hierarchical Verification**: Child/Nested endpoints verify the ownership of the parent object before allowing operations on children, preventing cross-tenant "sideways" traversal. - **Hierarchical Verification**: Child/Nested endpoints verify the ownership of the parent object before allowing operations on children, preventing cross-tenant "sideways" traversal.
- **Creation Guard**: When creating records (`POST`), the user's `account_id` is automatically forced onto the new record, preventing a user from creating data for another account. - **Creation Guard**: When creating records (`POST`), the user's `account_id` is automatically forced onto the new record, preventing a user from creating data for another account.