Jarvis 71c7b85026 fix(federation/auth-guard): remediate CRIT-1/CRIT-2 + HIGH-1..4 review findings ...

- CRIT-1: Validate cert subjectUserId against grant.subjectUserId from DB;
  use authoritative DB value in FederationContext
- CRIT-2: Add @Inject(GrantsService) decorator (tsx/esbuild requirement)
- HIGH-1: Validate UTF8String TLV tag, length, and bounds in OID parser
- HIGH-2: Collapse all 403 wire messages to a generic string to prevent
  grant enumeration; keep internal logger detail
- HIGH-3: Assert federation wire envelope shape in all guard tests
- HIGH-4: Regression test for subjectUserId cert/DB mismatch

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-23 22:45:35 -05:00

..

src

fix(federation/auth-guard): remediate CRIT-1/CRIT-2 + HIGH-1..4 review findings

2026-04-23 22:45:35 -05:00

package.json

feat(federation): Step-CA client service for grant certs (FED-M2-04) (#494)

2026-04-22 03:34:37 +00:00

tsconfig.json

fix: add vitest.config.ts to eslint allowDefaultProject (#440 build fix) (#441)

2026-04-05 22:01:57 +00:00

tsconfig.typecheck.json

fix: rename all packages from @mosaic/* to @mosaicstack/*

2026-04-04 21:43:23 -05:00

vitest.config.ts

fix: bootstrap hotfix — DTO erasure, wizard failure, port prefill, Pi SDK copy (mosaic-v0.0.26) (#440)

2026-04-05 21:43:30 +00:00