mosaic/stack
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

[BLOCKER] Add authentication to coordinator integration endpoints #184

New Issue
Closed
opened 2026-02-02 17:23:38 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-02-02 17:23:38 +00:00
Owner
Copy Link

Problem

All 6 coordinator integration endpoints are completely unauthenticated, allowing external systems to create, modify, and fail jobs without any authorization.

Vulnerable Endpoints

  • POST /coordinator/jobs (create jobs)
  • PATCH /coordinator/jobs/:id/status (update status)
  • POST /coordinator/jobs/:id/complete (mark complete)
  • POST /coordinator/jobs/:id/fail (mark failed)
  • PATCH /coordinator/jobs/:id/progress (update progress)
  • POST /coordinator/jobs/:id/retry (retry job)

Location

apps/api/src/coordinator-integration/coordinator-integration.controller.ts

Attack Vectors

  1. Create arbitrary jobs for any workspace (bypass workspace isolation)
  2. Mark legitimate jobs as failed with fake error messages
  3. Inject malicious data into job results
  4. Cause denial of service by creating thousands of jobs
  5. Access job details across all workspaces
  6. No audit trail of who modified jobs

Impact

  • CRITICAL: External attack surface completely unprotected
  • Blocks M4.2-Infrastructure milestone completion
  • Blocks production deployment
  • Violates multi-tenant isolation
  • No accountability for job modifications

Acceptance Criteria

  • Implement CoordinatorAuthGuard with API key validation
  • Apply guard to all coordinator endpoints
  • Validate workspaceId against coordinator's allowed workspaces
  • Add rate limiting (max 100 req/min per coordinator)
  • Log all coordinator actions to audit trail
  • Add coordinator registration endpoint (admin-only)
  • Document coordinator authentication setup
  • Add tests for auth failures

Implementation Notes

@Controller("coordinator")
@UseGuards(CoordinatorAuthGuard)  // NEW: Require API key
export class CoordinatorIntegrationController {
  @Post("jobs")
  @RequirePermission(Permission.SYSTEM_ADMIN)  // NEW: System-level auth
  async createJob(@Body() dto: CreateCoordinatorJobDto) {
    // Validate workspaceId belongs to authenticated coordinator
    // Log all coordinator actions with source identifier
  }
}

References

M4.2-Infrastructure verification report (2026-02-02)
Security review agent ID: a1b8b3f

## Problem All 6 coordinator integration endpoints are completely unauthenticated, allowing external systems to create, modify, and fail jobs without any authorization. ## Vulnerable Endpoints - POST /coordinator/jobs (create jobs) - PATCH /coordinator/jobs/:id/status (update status) - POST /coordinator/jobs/:id/complete (mark complete) - POST /coordinator/jobs/:id/fail (mark failed) - PATCH /coordinator/jobs/:id/progress (update progress) - POST /coordinator/jobs/:id/retry (retry job) ## Location apps/api/src/coordinator-integration/coordinator-integration.controller.ts ## Attack Vectors 1. Create arbitrary jobs for any workspace (bypass workspace isolation) 2. Mark legitimate jobs as failed with fake error messages 3. Inject malicious data into job results 4. Cause denial of service by creating thousands of jobs 5. Access job details across all workspaces 6. No audit trail of who modified jobs ## Impact - **CRITICAL**: External attack surface completely unprotected - Blocks M4.2-Infrastructure milestone completion - Blocks production deployment - Violates multi-tenant isolation - No accountability for job modifications ## Acceptance Criteria - [ ] Implement CoordinatorAuthGuard with API key validation - [ ] Apply guard to all coordinator endpoints - [ ] Validate workspaceId against coordinator's allowed workspaces - [ ] Add rate limiting (max 100 req/min per coordinator) - [ ] Log all coordinator actions to audit trail - [ ] Add coordinator registration endpoint (admin-only) - [ ] Document coordinator authentication setup - [ ] Add tests for auth failures ## Implementation Notes ```typescript @Controller("coordinator") @UseGuards(CoordinatorAuthGuard) // NEW: Require API key export class CoordinatorIntegrationController { @Post("jobs") @RequirePermission(Permission.SYSTEM_ADMIN) // NEW: System-level auth async createJob(@Body() dto: CreateCoordinatorJobDto) { // Validate workspaceId belongs to authenticated coordinator // Log all coordinator actions with source identifier } } ``` ## References M4.2-Infrastructure verification report (2026-02-02) Security review agent ID: a1b8b3f
jason.woltje added this to the M4.2-Infrastructure (0.0.4) milestone 2026-02-02 17:23:38 +00:00
jason.woltje added the securityapiapip0 labels 2026-02-02 17:23:38 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
ai
AI/LLM integration
 api
Backend/API work
 api
auth
Authentication
 database
database
Database/schema work
 devops
Docker/deployment
 docs
Documentation
 frontend
graph
knowledge-module
migration
Data migration
 orchestrator
Orchestrator service (apps/orchestrator/)
 p0
Critical priority
 p1
High priority
 p2
Medium priority
 p3
Low priority
 performance
Performance work
 phase-1
phase-2
phase-3
phase-4
phase-5
plugin
MoltBot plugin work
 search
security
Security-related
 setup
Initial setup
 testing
Testing/QA
 web
Frontend work
No Label api api p0 security
Milestone
No items
No Milestone M4.2-Infrastructure (0.0.4)
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaic/stack#184
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?