Jason Woltje
73074932f6
Implement explicit deny-lists in QueryService and CommandService to prevent user credentials from leaking across federation boundaries. ## Changes ### Core Implementation - QueryService: Block all credential-related queries with keyword detection - CommandService: Block all credential operations (create/update/delete/read) - Case-insensitive keyword matching for both queries and commands ### Security Features - Deny-list includes: credential, api_key, secret, token, password, oauth - Errors returned for blocked operations - No impact on existing allowed operations (tasks, events, projects, agent commands) ### Testing - Added 2 unit tests to query.service.spec.ts - Added 3 unit tests to command.service.spec.ts - Added 8 integration tests in credential-isolation.integration.spec.ts - All 377 federation tests passing ### Documentation - Created comprehensive security doc at docs/security/federation-credential-isolation.md - Documents 4 security guarantees (G1-G4) - Includes testing strategy and incident response procedures ## Security Guarantees 1. G1: Credential Confidentiality - Credentials never leave instance in plaintext 2. G2: Cross-Instance Isolation - Compromised key on one instance doesn't affect others 3. G3: Query/Command Isolation - Federated instances cannot query/modify credentials 4. G4: Accidental Exposure Prevention - Credentials cannot leak via messages ## Defense-in-Depth This implementation adds application-layer protection on top of existing: - Transit key separation (mosaic-credentials vs mosaic-federation) - Per-instance OpenBao servers - Workspace-scoped credential access Fixes #360 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Mosaic Stack Documentation
Complete documentation for Mosaic Stack, organized in Bookstack-compatible shelf/book/chapter/page structure.
📚 Books
1. Getting Started
Essential guides to get Mosaic Stack installed and configured.
- Quick Start — Get up and running in 5 minutes
- Installation
- Configuration
2. Development
Developer guides for contributing to Mosaic Stack.
- Workflow
- Database
- Schema, migrations, and Prisma guides (to be added)
- Type Sharing
3. Architecture
Technical architecture and design decisions.
- Overview — System design (to be added)
- Authentication — BetterAuth and OIDC (to be added)
- Design Principles
4. API Reference
Complete API endpoint documentation.
📝 Scratchpads
Development notes and implementation details for specific issues:
- Issue #1: Project Scaffold
- Issue #2: PostgreSQL Schema
- Issue #3: Prisma ORM Setup
- Issue #4: Authentik OIDC Integration
🔍 Quick Links
For New Users
For Developers
For Architects
- PDA-Friendly Design
- Authentication Flow (to be added)
- System Overview (to be added)
For API Consumers
📋 Documentation Standards
File Organization
docs/
├── {N}-{book-name}/ # Book (numbered)
│ ├── README.md # Book overview
│ ├── {N}-{chapter-name}/ # Chapter (numbered)
│ │ ├── {N}-{page-name}.md # Page (numbered)
│ │ └── ...
│ └── ...
└── scratchpads/ # Development notes (unnumbered)
Numbering Convention
- Books:
1-getting-started,2-development,3-architecture,4-api - Chapters:
1-quick-start,2-installation,3-configuration - Pages:
1-overview.md,2-local-setup.md,3-docker-setup.md
Numbers maintain order in file systems and Bookstack.
Writing Style
- Concise — No unnecessary verbosity
- Action-oriented — Use imperative mood ("Run the command", not "You should run")
- Example-heavy — Show, don't just tell
- Code blocks — Always include working examples
- Links — Cross-reference related topics
- PDA-friendly — Follow design principles
Code Examples
Always include:
- Language identifier for syntax highlighting
- Complete, runnable examples
- Expected output when relevant
- Error cases and troubleshooting
🛠️ Contributing to Docs
Adding New Pages
- Identify the appropriate book/chapter
- Create numbered markdown file
- Add to chapter's parent README
- Link from related pages
- Test all links and code examples
Updating Existing Pages
- Keep formatting consistent
- Update last-modified date
- Test all examples
- Check cross-references
Creating New Books
- Number sequentially (
5-{new-book}) - Create
README.mdoverview - Add chapter directories
- Update this index
📊 Documentation Status
| Book | Completion |
|---|---|
| Getting Started | 🟢 Complete |
| Development | 🟡 Partial |
| Architecture | 🟡 Partial |
| API Reference | 🟡 Partial |
Legend:
- 🟢 Complete
- 🟡 Partial
- 🔵 Planned
- ⚪ Not started
🔗 External Resources
- Project Repository: https://git.mosaicstack.dev/mosaic/stack
- Issue Tracker: https://git.mosaicstack.dev/mosaic/stack/issues
- Google Style Guides: https://github.com/google/styleguide
- BetterAuth Docs: https://www.better-auth.com
- Prisma Docs: https://www.prisma.io/docs
- NestJS Docs: https://docs.nestjs.com
📧 Support
- Issues: Create an issue
- Discussions: Project discussions
Last Updated: 2026-01-28 Version: 0.0.1 (Pre-MVP)