feat: add strict typed identity model v2 - #85
Conversation
Co-Authored-By: Codex <noreply@openai.com>
🤖 Codex PR Review🚫 Merge blocked: 1 serious issue(s) found in high-risk files 🚫 Blocking IssuesThese issues must be fixed before this PR can be merged: 1. 🟠 [HIGH] Logic in
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 943a3ca345
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if kind == "secret_ref": | ||
| ref = _obj(token["value"], {"type", "role", "position"}) | ||
| typ, role, position = ref["type"], ref["role"], ref["position"] | ||
| if typ not in SECRET_TYPES or role not in SECRET_ROLES or isinstance(position, bool) or not isinstance(position, int) or not 0 <= position <= 1024: |
There was a problem hiding this comment.
When a JSON payload supplies a secret_ref whose type or role is an array/object, this membership test hashes the untrusted value and raises TypeError instead of the module’s IdentityError. That leaks an unexpected exception path from validate_identity/verify_identity_record for malformed identity data, unlike the surrounding validators; check these fields are bounded strings before testing them against the finite sets.
Useful? React with 👍 / 👎.
Co-Authored-By: Codex <noreply@openai.com>
|
Superseded by merged PR #87. This PR remains unmerged; its implementation is not imported. |
1 participant
Summary
structured_tokens.v2canonical identity modelsecret_refas the only credential representationScope
Fresh R1c replacement for frozen PR #84. Pure model and tests only; no runtime, history, evidence, reviewer adapter, or R2 integration.
Validation
python3 -m unittest tests.test_canonical_typed_identity_r1cpython3 -m unittest tests.test_run_codex_pr_reviewpython3 -m unittest discover testspython3 -m ruff check .python3 -m compileall -q service scripts testsactionlint .github/workflows/*.ymlgit diff --check origin/main...HEAD