fix: use codes to represent signin errors - #11
Merged
Conversation
This change switches the auth redirection to use error codes instead of error messages. This prevents potential content spoofing attacks because error messages in the URL represent arbitrary content that an attacker can control to inject malicious content (like urls) and send to victims.
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
simplesagar
approved these changes
Aug 7, 2025
qstearns
added a commit
that referenced
this pull request
May 5, 2026
Stand up server/internal/remotesessions/ mirroring the usersessions skeleton: stubs for remoteSessionIssuers, remoteSessionClients, and remoteSessions services per spike §6.2. One Service struct implements all three Goa interfaces; per-resource Attach* helpers are wired in start.go. All handler bodies return oops.CodeNotImplemented. Audit, RBAC, and real SQLc queries land in tickets #9-#11. Adds URN types for each resource and the sqlc.yaml stanza.
qstearns
added a commit
that referenced
this pull request
May 5, 2026
Ticket #9 of Milestone #1. Implements remoteSessionIssuers.{discover, create,update,list,get,delete} per spike §6.2. discover hits the upstream /.well-known/oauth-authorization-server (RFC 8414), validates outbound destinations through guardian.Policy, parses the metadata, and returns a RemoteSessionIssuerDraft with discovery_warnings for any RFC 8414 deviations. No persistence. delete is blocked (CodeConflict) when remote_session_clients still reference the issuer. Adds two new dependencies on the remotesessions Service struct: encryption.Client (for ticket #10's client_secret_encrypted) and guardian.Policy (for outbound HTTP validation in discover and DCR). start.go is updated to plumb them through. Audit subjects (remote_session_issuer + remote_session for #11's cascade reuse), RBAC scope checks, mv/remotesessionissuer.go view builder, and per-method tests wired. 17 tests pass in this package.
qstearns
added a commit
that referenced
this pull request
May 6, 2026
Stand up server/internal/remotesessions/ mirroring the usersessions skeleton: stubs for remoteSessionIssuers, remoteSessionClients, and remoteSessions services per spike §6.2. One Service struct implements all three Goa interfaces; per-resource Attach* helpers are wired in start.go. All handler bodies return oops.CodeNotImplemented. Audit, RBAC, and real SQLc queries land in tickets #9-#11. Adds URN types for each resource and the sqlc.yaml stanza.
qstearns
added a commit
that referenced
this pull request
May 6, 2026
Ticket #9 of Milestone #1. Implements remoteSessionIssuers.{discover, create,update,list,get,delete} per spike §6.2. discover hits the upstream /.well-known/oauth-authorization-server (RFC 8414), validates outbound destinations through guardian.Policy, parses the metadata, and returns a RemoteSessionIssuerDraft with discovery_warnings for any RFC 8414 deviations. No persistence. delete is blocked (CodeConflict) when remote_session_clients still reference the issuer. Adds two new dependencies on the remotesessions Service struct: encryption.Client (for ticket #10's client_secret_encrypted) and guardian.Policy (for outbound HTTP validation in discover and DCR). start.go is updated to plumb them through. Audit subjects (remote_session_issuer + remote_session for #11's cascade reuse), RBAC scope checks, mv/remotesessionissuer.go view builder, and per-method tests wired. 17 tests pass in this package.
qstearns
added a commit
that referenced
this pull request
May 6, 2026
Stand up server/internal/remotesessions/ mirroring the usersessions skeleton: stubs for remoteSessionIssuers, remoteSessionClients, and remoteSessions services per spike §6.2. One Service struct implements all three Goa interfaces; per-resource Attach* helpers are wired in start.go. All handler bodies return oops.CodeNotImplemented. Audit, RBAC, and real SQLc queries land in tickets #9-#11. Adds URN types for each resource and the sqlc.yaml stanza.
qstearns
added a commit
that referenced
this pull request
May 6, 2026
Ticket #9 of Milestone #1. Implements remoteSessionIssuers.{discover, create,update,list,get,delete} per spike §6.2. discover hits the upstream /.well-known/oauth-authorization-server (RFC 8414), validates outbound destinations through guardian.Policy, parses the metadata, and returns a RemoteSessionIssuerDraft with discovery_warnings for any RFC 8414 deviations. No persistence. delete is blocked (CodeConflict) when remote_session_clients still reference the issuer. Adds two new dependencies on the remotesessions Service struct: encryption.Client (for ticket #10's client_secret_encrypted) and guardian.Policy (for outbound HTTP validation in discover and DCR). start.go is updated to plumb them through. Audit subjects (remote_session_issuer + remote_session for #11's cascade reuse), RBAC scope checks, mv/remotesessionissuer.go view builder, and per-method tests wired. 17 tests pass in this package.
qstearns
added a commit
that referenced
this pull request
May 6, 2026
Stand up server/internal/remotesessions/ mirroring the usersessions skeleton: stubs for remoteSessionIssuers, remoteSessionClients, and remoteSessions services per spike §6.2. One Service struct implements all three Goa interfaces; per-resource Attach* helpers are wired in start.go. All handler bodies return oops.CodeNotImplemented. Audit, RBAC, and real SQLc queries land in tickets #9-#11. Adds URN types for each resource and the sqlc.yaml stanza.
qstearns
added a commit
that referenced
this pull request
May 6, 2026
Ticket #9 of Milestone #1. Implements remoteSessionIssuers.{discover, create,update,list,get,delete} per spike §6.2. discover hits the upstream /.well-known/oauth-authorization-server (RFC 8414), validates outbound destinations through guardian.Policy, parses the metadata, and returns a RemoteSessionIssuerDraft with discovery_warnings for any RFC 8414 deviations. No persistence. delete is blocked (CodeConflict) when remote_session_clients still reference the issuer. Adds two new dependencies on the remotesessions Service struct: encryption.Client (for ticket #10's client_secret_encrypted) and guardian.Policy (for outbound HTTP validation in discover and DCR). start.go is updated to plumb them through. Audit subjects (remote_session_issuer + remote_session for #11's cascade reuse), RBAC scope checks, mv/remotesessionissuer.go view builder, and per-method tests wired. 17 tests pass in this package.
qstearns
added a commit
that referenced
this pull request
May 6, 2026
Stand up server/internal/remotesessions/ mirroring the usersessions skeleton: stubs for remoteSessionIssuers, remoteSessionClients, and remoteSessions services per spike §6.2. One Service struct implements all three Goa interfaces; per-resource Attach* helpers are wired in start.go. All handler bodies return oops.CodeNotImplemented. Audit, RBAC, and real SQLc queries land in tickets #9-#11. Adds URN types for each resource and the sqlc.yaml stanza.
qstearns
added a commit
that referenced
this pull request
May 6, 2026
Ticket #9 of Milestone #1. Implements remoteSessionIssuers.{discover, create,update,list,get,delete} per spike §6.2. discover hits the upstream /.well-known/oauth-authorization-server (RFC 8414), validates outbound destinations through guardian.Policy, parses the metadata, and returns a RemoteSessionIssuerDraft with discovery_warnings for any RFC 8414 deviations. No persistence. delete is blocked (CodeConflict) when remote_session_clients still reference the issuer. Adds two new dependencies on the remotesessions Service struct: encryption.Client (for ticket #10's client_secret_encrypted) and guardian.Policy (for outbound HTTP validation in discover and DCR). start.go is updated to plumb them through. Audit subjects (remote_session_issuer + remote_session for #11's cascade reuse), RBAC scope checks, mv/remotesessionissuer.go view builder, and per-method tests wired. 17 tests pass in this package.
qstearns
added a commit
that referenced
this pull request
May 7, 2026
Stand up server/internal/remotesessions/ mirroring the usersessions skeleton: stubs for remoteSessionIssuers, remoteSessionClients, and remoteSessions services per spike §6.2. One Service struct implements all three Goa interfaces; per-resource Attach* helpers are wired in start.go. All handler bodies return oops.CodeNotImplemented. Audit, RBAC, and real SQLc queries land in tickets #9-#11. Adds URN types for each resource and the sqlc.yaml stanza.
qstearns
added a commit
that referenced
this pull request
May 7, 2026
Ticket #9 of Milestone #1. Implements remoteSessionIssuers.{discover, create,update,list,get,delete} per spike §6.2. discover hits the upstream /.well-known/oauth-authorization-server (RFC 8414), validates outbound destinations through guardian.Policy, parses the metadata, and returns a RemoteSessionIssuerDraft with discovery_warnings for any RFC 8414 deviations. No persistence. delete is blocked (CodeConflict) when remote_session_clients still reference the issuer. Adds two new dependencies on the remotesessions Service struct: encryption.Client (for ticket #10's client_secret_encrypted) and guardian.Policy (for outbound HTTP validation in discover and DCR). start.go is updated to plumb them through. Audit subjects (remote_session_issuer + remote_session for #11's cascade reuse), RBAC scope checks, mv/remotesessionissuer.go view builder, and per-method tests wired. 17 tests pass in this package.
qstearns
added a commit
that referenced
this pull request
May 12, 2026
Stand up server/internal/remotesessions/ mirroring the usersessions skeleton: stubs for remoteSessionIssuers, remoteSessionClients, and remoteSessions services per spike §6.2. One Service struct implements all three Goa interfaces; per-resource Attach* helpers are wired in start.go. All handler bodies return oops.CodeNotImplemented. Audit, RBAC, and real SQLc queries land in tickets #9-#11. Adds URN types for each resource and the sqlc.yaml stanza.
qstearns
added a commit
that referenced
this pull request
May 12, 2026
Ticket #9 of Milestone #1. Implements remoteSessionIssuers.{discover, create,update,list,get,delete} per spike §6.2. discover hits the upstream /.well-known/oauth-authorization-server (RFC 8414), validates outbound destinations through guardian.Policy, parses the metadata, and returns a RemoteSessionIssuerDraft with discovery_warnings for any RFC 8414 deviations. No persistence. delete is blocked (CodeConflict) when remote_session_clients still reference the issuer. Adds two new dependencies on the remotesessions Service struct: encryption.Client (for ticket #10's client_secret_encrypted) and guardian.Policy (for outbound HTTP validation in discover and DCR). start.go is updated to plumb them through. Audit subjects (remote_session_issuer + remote_session for #11's cascade reuse), RBAC scope checks, mv/remotesessionissuer.go view builder, and per-method tests wired. 17 tests pass in this package.
qstearns
added a commit
that referenced
this pull request
May 12, 2026
…dings Security: - Sec #1: Auth-code redemption is now atomic via Redis GETDEL (new Cache.GetAndDelete). Two clients racing on the same code can't both win. - Sec #14: Consent-state consumption uses the same GETDEL primitive, preventing parallel POSTs from minting multiple grants per /authorize. - Sec #13: ValidateBearer fails closed on revocation-cache errors (Redis outage → tokens reject, not admit). - Sec #4: /revoke verifies the presented token belongs to the authenticated client (RFC 7009 §2.1). Ownership mismatches look like the "unknown token" silent-no-op per §2.2. New GetUserSessionByJTI and GetUserSessionByRefreshTokenHash peek queries support this. - Sec #9: JWT audience is now urn.NewToolset(toolset.ID) — globally unique even when slugs collide across projects. No cross-project token replay. - Sec #11: JWT iss claim honours custom domains (matches the AS metadata document's issuer). Correctness: - Bug #2: Access-token lifetime is hardcoded (1h). issuer.SessionDuration is now the refresh-token (i.e. total session) lifetime — the value the IDP-driven session window was meant to control. - Bug #5: HandleIDPCallback forwards IDP error responses back to the MCP client's redirect_uri instead of swallowing them as a generic 400. - Bug #6: Consent POST refuses to mint an anonymous session for a private toolset — IDP authentication is required first. - Bug #8: Consent approve path requires action=approve explicitly. Missing or unknown values 400, not fail-open into the approval branch. - Bug #10: HandleToken now calls requireUserSessionIssuer like the other authn-dance handlers. - Bug #15: Consent POST → GET redirects use 303 See Other (was 302 Found, which leaves the verb implementation-defined). Hardening: - Hard #3: isUniqueViolation uses errors.As + *pgconn.PgError.Code instead of strings.Contains on the error message. - Hard #7: Migrate the remaining "jwt-signing-key" literal callsites (chatsessions/assistanttokens/assets) to usersessions.JWTSigningKeyFlag.
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This change switches the auth redirection to use error codes instead of error messages. This prevents potential content spoofing attacks because error messages in the URL represent arbitrary content that an attacker can control to inject malicious content (like urls) and send to victims.
Now we send back simple error codes and the client side maps the ones it recognizes to fixed error messages that are shown to the user.