admin/c0py
3
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity
51 Commits 1 Branch 0 Tags
f5839b260a0617542ff148ece60f2d61517bd217
Commit Graph
2 Commits
Author SHA1 Message Date
admin 12f6a65b80 feat(api): deterministic scan worker + AUD0 wire + tenant binding
CI (SIAX Cloud) / security (pull_request) Successful in 14s
Details
CI (SIAX Cloud) / security (push) Successful in 14s
Details
CI (SIAX Cloud) / contracts (pull_request) Successful in 15s
Details
CI (SIAX Cloud) / contracts (push) Successful in 17s
Details
CI (SIAX Cloud) / quality (push) Successful in 1m9s
Details
CI (SIAX Cloud) / quality (pull_request) Successful in 1m10s
Details 
- scan worker: atomic claim (FOR UPDATE SKIP LOCKED), Playwright-core + system
  chromium capture → typed EvidenceRecords (runtime-html/dom/computed-style/
  stylesheet/asset/network-request/screenshot), confidence=measured
- AUD0 emitter (fire-and-forget, advisory): c0py.registry_created/.scan_created/
  .scan_completed/.scan_failed, tenant_id = Zitadel resourceowner (org)
- tenant binding: resourceowner claim from introspection (deny-by-default 403),
  migration 002 tenant_id on registries+scans, all queries tenant+owner scoped
- evidence gaps stay explicit (screenshot miss → no screenshot record)
- 30/30 tests, canonical validator OK
 2026-09-16 22:53:55 +02:00
admin 495050752a feat(api): real Zitadel token introspection (fail-closed) + expected-audience enforcement
CI (SIAX Cloud) / security (push) Successful in 12s
Details
CI (SIAX Cloud) / contracts (push) Successful in 30s
Details
CI (SIAX Cloud) / quality (push) Successful in 1m33s
Details 
- preHandler: Bearer tokens are introspected against Zitadel (RFC 7662)
- any introspection failure (unreachable, non-200, bad JSON, inactive) = 401
- asserted aud must include ZITADEL_EXPECTED_AUDIENCE (project id); absent aud accepted per RFC 7662
- config: ZITADEL_INTROSPECTION_CLIENT_ID/SECRET + ZITADEL_EXPECTED_AUDIENCE (optional; Bearer-presence fallback logs warn in prod)
- 13 new tests (introspection fail-closed matrix + preHandler flow)
 2026-09-16 22:06:46 +02:00