mosaic/stack
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Federation credential isolation #360

New Issue
Closed
opened 2026-02-07 17:12:42 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-02-07 17:12:42 +00:00
Owner
Copy Link

Phase 5b - Federation Credential Isolation

Problem

User credentials must never leak across federation boundaries. The federation module allows querying and commanding across instances, and we need to ensure credential data is explicitly excluded from all federation pathways.

Requirements

  1. Add explicit deny-list in federation QueryService to prevent UserCredential entities from appearing in federated query results
  2. Verify existing federation message payloads never include credential data
  3. Ensure federation CommandService cannot create/modify/delete credentials on remote instances
  4. Document federation credential isolation guarantees

Implementation Notes

  • QueryService at apps/api/src/federation/query.service.ts handles incoming federated queries
  • CommandService at apps/api/src/federation/command.service.ts handles incoming federated commands
  • FederationMessage.payload must never contain credential values
  • Transit key isolation: mosaic-credentials key is separate from mosaic-federation key
  • Each federated instance runs its own OpenBao (or falls back to its own ENCRYPTION_KEY)
  • Even if a Transit key were compromised on one instance, it cannot decrypt credentials from another

Files

  • apps/api/src/federation/query.service.ts (modify - deny-list UserCredential entity type)
  • apps/api/src/federation/command.service.ts (modify - deny-list credential operations)
  • apps/api/src/federation/federation.service.ts (verify - no credential data in federation messages)

Acceptance Criteria

  • Federated queries cannot return UserCredential data
  • Federated commands cannot create/modify/delete credentials
  • No credential plaintext in federation message payloads
  • Integration test: federated query for credentials returns empty/denied
  • Documentation of isolation guarantees

Dependencies

  • Depends on: UserCredential model (Phase 3a)
  • Depends on: Credential CRUD API (Phase 3b)

Refs #346

## Phase 5b - Federation Credential Isolation ### Problem User credentials must never leak across federation boundaries. The federation module allows querying and commanding across instances, and we need to ensure credential data is explicitly excluded from all federation pathways. ### Requirements 1. Add explicit deny-list in federation QueryService to prevent UserCredential entities from appearing in federated query results 2. Verify existing federation message payloads never include credential data 3. Ensure federation CommandService cannot create/modify/delete credentials on remote instances 4. Document federation credential isolation guarantees ### Implementation Notes - QueryService at apps/api/src/federation/query.service.ts handles incoming federated queries - CommandService at apps/api/src/federation/command.service.ts handles incoming federated commands - FederationMessage.payload must never contain credential values - Transit key isolation: mosaic-credentials key is separate from mosaic-federation key - Each federated instance runs its own OpenBao (or falls back to its own ENCRYPTION_KEY) - Even if a Transit key were compromised on one instance, it cannot decrypt credentials from another ### Files - apps/api/src/federation/query.service.ts (modify - deny-list UserCredential entity type) - apps/api/src/federation/command.service.ts (modify - deny-list credential operations) - apps/api/src/federation/federation.service.ts (verify - no credential data in federation messages) ### Acceptance Criteria - [ ] Federated queries cannot return UserCredential data - [ ] Federated commands cannot create/modify/delete credentials - [ ] No credential plaintext in federation message payloads - [ ] Integration test: federated query for credentials returns empty/denied - [ ] Documentation of isolation guarantees ### Dependencies - Depends on: UserCredential model (Phase 3a) - Depends on: Credential CRUD API (Phase 3b) Refs #346
jason.woltje added this to the M9-CredentialSecurity (0.0.9) milestone 2026-02-07 17:12:42 +00:00
jason.woltje added the securityapiapip1 labels 2026-02-07 17:12:43 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
ai
AI/LLM integration
 api
Backend/API work
 api
auth
Authentication
 database
database
Database/schema work
 devops
Docker/deployment
 docs
Documentation
 frontend
graph
knowledge-module
migration
Data migration
 orchestrator
Orchestrator service (apps/orchestrator/)
 p0
Critical priority
 p1
High priority
 p2
Medium priority
 p3
Low priority
 performance
Performance work
 phase-1
phase-2
phase-3
phase-4
phase-5
plugin
MoltBot plugin work
 search
security
Security-related
 setup
Initial setup
 testing
Testing/QA
 web
Frontend work
No Label api api p1 security
Milestone
No items
No Milestone M9-CredentialSecurity (0.0.9)
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaic/stack#360
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?