mosaicstack/stack
1
0
Fork 1
Code Issues 151 Pull Requests 6 Actions Packages Projects Releases 15 Wiki Activity
682 Commits 78 Branches 17 Tags
1f4c7c0d37988faffcc6a50aa0b6b194b190433f
Commit Graph
5 Commits
Author SHA1 Message Date
jason.woltje 86e106fcc9 feat(#462): add federation list verb (#682)
ci/woodpecker/push/publish Pipeline was successful
Details
ci/woodpecker/push/ci Pipeline was successful
Details
2026-06-25 02:15:17 +00:00
jason.woltje c739256a2c feat(#462): add federation scope enforcement service (#672)
ci/woodpecker/push/ci Pipeline was successful
Details
ci/woodpecker/push/publish Pipeline was successful
Details
2026-06-24 23:22:46 +00:00
jason.woltje 6b94d014a8 feat(#462): add federation capabilities verb (#674)
ci/woodpecker/push/ci Pipeline is pending
Details
ci/woodpecker/push/publish Pipeline is pending
Details
2026-06-24 21:39:56 +00:00
jarvisandClaude Sonnet 4.6 0af3e218a1 fix(federation/auth-guard): remediate CRIT-1/CRIT-2 + HIGH-1..4 review findings
ci/woodpecker/pr/ci Pipeline was successful
Details
ci/woodpecker/push/ci Pipeline was successful
Details 
- CRIT-1: Validate cert subjectUserId against grant.subjectUserId from DB;
  use authoritative DB value in FederationContext
- CRIT-2: Add @Inject(GrantsService) decorator (tsx/esbuild requirement)
- HIGH-1: Validate UTF8String TLV tag, length, and bounds in OID parser
- HIGH-2: Collapse all 403 wire messages to a generic string to prevent
  grant enumeration; keep internal logger detail
- HIGH-3: Assert federation wire envelope shape in all guard tests
- HIGH-4: Regression test for subjectUserId cert/DB mismatch

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
 2026-04-25 06:33:37 -05:00
jarvisandClaude Sonnet 4.6 b01c9b3bb0 feat(federation): mTLS AuthGuard with OID-based grant resolution (FED-M3-03) 
Adds FederationAuthGuard that validates inbound mTLS client certs on
federation API routes. Extracts custom OIDs (grantId, subjectUserId),
loads the grant+peer from DB in one query, asserts active status, and
validates cert serial as defense-in-depth. Attaches FederationContext
to requests on success and uses federation wire-format error envelopes
(not raw NestJS exceptions) for 401/403 responses.

New files:
- apps/gateway/src/federation/oid.util.ts — shared OID extraction (no dupe ASN.1 logic)
- apps/gateway/src/federation/server/federation-auth.guard.ts — guard impl
- apps/gateway/src/federation/server/federation-context.ts — FederationContext type + module augment
- apps/gateway/src/federation/server/index.ts — barrel export
- apps/gateway/src/federation/server/__tests__/federation-auth.guard.spec.ts — 11 unit tests

Modified:
- apps/gateway/src/federation/grants.service.ts — adds getGrantWithPeer() with join
- apps/gateway/src/federation/federation.module.ts — registers FederationAuthGuard as provider

Closes #462

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
 2026-04-25 06:33:37 -05:00