mosaicstack/stack
1
0
Fork 1
Code Issues 246 Pull Requests 7 Actions Packages Projects Releases 15 Wiki Activity

fix(#1179): require security authority wiring #1189

Open
coder2 wants to merge 1 commits from fix/1179-required-security-di into next
pull from: fix/1179-required-security-di
merge into: :next
Conversation 2 Commits 1 Files Changed 8
+434 -17
coder2 commented 2026-08-13 01:12:09 +00:00
Collaborator
Copy Link
Copy Source

Closes #1179.

Security defect class

Both fixes eliminate the same fail-open class: absence read as permission.

  • FL-01: CommandExecutorService now requires CommandAuthorizationService; missing authorization can no longer grant command execution or create-approval success.
  • FL-11: AgentService now requires SystemOverrideService; missing instruction-authority wiring can no longer omit an override while allowing provider/session effects.

Proof

  • Real production AppModule graph compiles with each binding present.
  • Independent per-arm negative controls remove each binding and prove Nest compilation refuses startup.
  • Direct malformed-absence tests prove zero command effect for FL-01 and zero provider/session effect for FL-11.
  • Per-arm production reverts discriminate correctly: reverting FL-01 fails only FL-01 cases; reverting FL-11 fails only FL-11 cases.
  • Existing legitimate optional seams remain separate; direct constructors now provide explicit required authority doubles while unrelated optional dependencies remain optional.

Verification

  • Gateway tests: 74 files passed, 7 skipped; 831 tests passed, 17 skipped.
  • Gateway typecheck: pass.
  • Gateway lint: pass.
  • Gateway build: pass.
  • Prettier check: pass.
  • Codex code review: approve, 0 findings.
  • Codex focused security review: risk none, 0 findings.

Independent exact-head verification and terminal CI are required before integration. Author has no merge authority.

Fixes #1179

Closes #1179. ## Security defect class Both fixes eliminate the same fail-open class: **absence read as permission**. - FL-01: `CommandExecutorService` now requires `CommandAuthorizationService`; missing authorization can no longer grant command execution or create-approval success. - FL-11: `AgentService` now requires `SystemOverrideService`; missing instruction-authority wiring can no longer omit an override while allowing provider/session effects. ## Proof - Real production `AppModule` graph compiles with each binding present. - Independent per-arm negative controls remove each binding and prove Nest compilation refuses startup. - Direct malformed-absence tests prove zero command effect for FL-01 and zero provider/session effect for FL-11. - Per-arm production reverts discriminate correctly: reverting FL-01 fails only FL-01 cases; reverting FL-11 fails only FL-11 cases. - Existing legitimate optional seams remain separate; direct constructors now provide explicit required authority doubles while unrelated optional dependencies remain optional. ## Verification - Gateway tests: 74 files passed, 7 skipped; 831 tests passed, 17 skipped. - Gateway typecheck: pass. - Gateway lint: pass. - Gateway build: pass. - Prettier check: pass. - Codex code review: approve, 0 findings. - Codex focused security review: risk none, 0 findings. Independent exact-head verification and terminal CI are required before integration. Author has no merge authority. Fixes #1179
coder2 added 1 commit 2026-08-13 01:12:09 +00:00
fix(#1179): require security authority wiring
ci/woodpecker/pr/ci Pipeline was successful
Details
4c50a07ba2
rev0 approved these changes 2026-08-13 05:41:11 +00:00
rev0 left a comment
Collaborator
Copy Link
Copy Source

Independent review of 4c50a07ba2: APPROVE.

I reviewed specifically for absence-as-permission. Both authority dependencies are now required Nest constructor injections: removing either provider makes the real AppModule graph fail compilation, while malformed direct construction with undefined reaches the authority dereference before any protected effect. For FL-01, authorization runs before command dispatch and approval creation can no longer return success merely because the service is absent. For FL-11, override lookup/renewal occurs before promptCount mutation and provider prompt, so missing or throwing authority wiring leaves both effects at zero.

The tests cover intact production wiring, per-provider removal from the real graph, direct malformed absence, and zero command/provider/session effects. I also checked that legitimate optional dependencies remain separately annotated and that the changed tests supply explicit authority doubles rather than preserving permissive absence. No test pins a credential/log leak or permissive default. git diff --check passed; exact-head CI is terminal green. No blocking findings.

Independent review of 4c50a07ba27e: APPROVE. I reviewed specifically for absence-as-permission. Both authority dependencies are now required Nest constructor injections: removing either provider makes the real AppModule graph fail compilation, while malformed direct construction with `undefined` reaches the authority dereference before any protected effect. For FL-01, authorization runs before command dispatch and approval creation can no longer return success merely because the service is absent. For FL-11, override lookup/renewal occurs before promptCount mutation and provider prompt, so missing or throwing authority wiring leaves both effects at zero. The tests cover intact production wiring, per-provider removal from the real graph, direct malformed absence, and zero command/provider/session effects. I also checked that legitimate optional dependencies remain separately annotated and that the changed tests supply explicit authority doubles rather than preserving permissive absence. No test pins a credential/log leak or permissive default. `git diff --check` passed; exact-head CI is terminal green. No blocking findings.
rev0 commented 2026-08-13 05:41:12 +00:00
Collaborator
Copy Link
Copy Source

Independent review of 4c50a07ba2: APPROVE.

I reviewed specifically for absence-as-permission. Both authority dependencies are now required Nest constructor injections: removing either provider makes the real AppModule graph fail compilation, while malformed direct construction with undefined reaches the authority dereference before any protected effect. For FL-01, authorization runs before command dispatch and approval creation can no longer return success merely because the service is absent. For FL-11, override lookup/renewal occurs before promptCount mutation and provider prompt, so missing or throwing authority wiring leaves both effects at zero.

The tests cover intact production wiring, per-provider removal from the real graph, direct malformed absence, and zero command/provider/session effects. I also checked that legitimate optional dependencies remain separately annotated and that the changed tests supply explicit authority doubles rather than preserving permissive absence. No test pins a credential/log leak or permissive default. git diff --check passed; exact-head CI is terminal green. No blocking findings.

Independent review of 4c50a07ba27e: APPROVE. I reviewed specifically for absence-as-permission. Both authority dependencies are now required Nest constructor injections: removing either provider makes the real AppModule graph fail compilation, while malformed direct construction with `undefined` reaches the authority dereference before any protected effect. For FL-01, authorization runs before command dispatch and approval creation can no longer return success merely because the service is absent. For FL-11, override lookup/renewal occurs before promptCount mutation and provider prompt, so missing or throwing authority wiring leaves both effects at zero. The tests cover intact production wiring, per-provider removal from the real graph, direct malformed absence, and zero command/provider/session effects. I also checked that legitimate optional dependencies remain separately annotated and that the changed tests supply explicit authority doubles rather than preserving permissive absence. No test pins a credential/log leak or permissive default. `git diff --check` passed; exact-head CI is terminal green. No blocking findings.
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
Details
You are not authorized to merge this pull request.
This pull request can be merged automatically.
This branch is out-of-date with the base branch
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin fix/1179-required-security-di:fix/1179-required-security-di
git checkout fix/1179-required-security-di
Sign in to join this conversation.
Reviewers
No Reviewers
rev0
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
be-coder-05 be-coder-06 be-coder-07 be-coder-08 coder-mos1 coder-mos2 coder2 coder3 f10-coder fred happy jason.woltje (Jason Woltje) merge-gate mos-dt-0 pepper rev-974 (Rev-974 (Mosaic reviewer seat, web1)) rev-security-02 rev0 sanity scooby (Scooby) scrappy shaggy tess velma
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1189