stack/apps/api/src/federation at c5b028932c63584878e36a69a376a090b53dd571 - stack - Mosaic Gitea

mosaicstack/stack

Files

T

History

jason.woltjeandClaude Opus 4.6 73074932f6 feat(#360 ): Add federation credential isolation

Implement explicit deny-lists in QueryService and CommandService to prevent
user credentials from leaking across federation boundaries.

## Changes

### Core Implementation
- QueryService: Block all credential-related queries with keyword detection
- CommandService: Block all credential operations (create/update/delete/read)
- Case-insensitive keyword matching for both queries and commands

### Security Features
- Deny-list includes: credential, api_key, secret, token, password, oauth
- Errors returned for blocked operations
- No impact on existing allowed operations (tasks, events, projects, agent commands)

### Testing
- Added 2 unit tests to query.service.spec.ts
- Added 3 unit tests to command.service.spec.ts
- Added 8 integration tests in credential-isolation.integration.spec.ts
- All 377 federation tests passing

### Documentation
- Created comprehensive security doc at docs/security/federation-credential-isolation.md
- Documents 4 security guarantees (G1-G4)
- Includes testing strategy and incident response procedures

## Security Guarantees

1. G1: Credential Confidentiality - Credentials never leave instance in plaintext
2. G2: Cross-Instance Isolation - Compromised key on one instance doesn't affect others
3. G3: Query/Command Isolation - Federated instances cannot query/modify credentials
4. G4: Accidental Exposure Prevention - Credentials cannot leak via messages

## Defense-in-Depth

This implementation adds application-layer protection on top of existing:
- Transit key separation (mosaic-credentials vs mosaic-federation)
- Per-instance OpenBao servers
- Workspace-scoped credential access

Fixes #360

Co-Authored-By: Claude Opus 4.6 <[email protected]>

2026-02-07 16:55:49 -06:00

..

feat(#295 ): validate FederationCapabilities structure

2026-02-03 22:02:08 -06:00

Fix QA validation issues and add M7.1 security fixes (#318 )

2026-02-04 03:08:09 +00:00

feat(#273 ): Implement capability-based authorization for federation

2026-02-03 19:53:09 -06:00

feat(#93 ): implement agent spawn via federation

2026-02-03 14:37:06 -06:00

fix: Resolve unhandled promise rejection in retry.spec.ts

2026-02-06 12:51:37 -06:00

audit.service.ts

fix(#279 ): Validate orchestrator URL configuration (SSRF risk)

2026-02-03 20:47:41 -06:00

command.controller.spec.ts

feat(#89 ): implement COMMAND message type for federation

2026-02-03 13:30:16 -06:00

command.controller.ts

feat(#89 ): implement COMMAND message type for federation

2026-02-03 13:30:16 -06:00

command.service.spec.ts

feat(#360 ): Add federation credential isolation

2026-02-07 16:55:49 -06:00

command.service.ts

feat(#360 ): Add federation credential isolation

2026-02-07 16:55:49 -06:00

connection.service.spec.ts

feat(#292 ): implement protocol version checking

2026-02-03 22:00:43 -06:00

connection.service.ts

feat(#293 ): implement retry logic with exponential backoff

2026-02-03 22:07:55 -06:00

constants.ts

feat(#292 ): implement protocol version checking

2026-02-03 22:00:43 -06:00

credential-isolation.integration.spec.ts

feat(#360 ): Add federation credential isolation

2026-02-07 16:55:49 -06:00

crypto.service.spec.ts

fix(#289 ): Prevent private key decryption error data leaks

2026-02-03 21:35:15 -06:00

crypto.service.ts

feat(#352 ): Encrypt existing plaintext Account tokens

2026-02-07 13:16:43 -06:00

event.controller.spec.ts

feat(#90 ): implement EVENT subscriptions for federation

2026-02-03 13:45:00 -06:00

event.controller.ts

feat(#90 ): implement EVENT subscriptions for federation

2026-02-03 13:45:00 -06:00

event.service.spec.ts

feat(#90 ): implement EVENT subscriptions for federation

2026-02-03 13:45:00 -06:00

event.service.ts

feat(#90 ): implement EVENT subscriptions for federation

2026-02-03 13:45:00 -06:00

federation-agent.service.spec.ts

Fix QA validation issues and add M7.1 security fixes (#318 )

2026-02-04 03:08:09 +00:00

federation-agent.service.ts

Fix QA validation issues and add M7.1 security fixes (#318 )

2026-02-04 03:08:09 +00:00

federation-auth.controller.spec.ts

fix(#271 ): implement OIDC token validation (authentication bypass)

2026-02-03 16:50:06 -06:00

federation-auth.controller.ts

fix: resolve TypeScript errors in orchestrator and API

2026-02-03 20:07:49 -06:00

federation.config.spec.ts

fix(#338 ): Validate DEFAULT_WORKSPACE_ID as UUID

2026-02-05 16:55:48 -06:00

federation.config.ts

fix(#338 ): Validate DEFAULT_WORKSPACE_ID as UUID

2026-02-05 16:55:48 -06:00

federation.controller.spec.ts

fix(tests): Resolve pipeline #243 test failures

2026-02-06 12:15:21 -06:00

federation.controller.ts

fix(#338 ): Validate DEFAULT_WORKSPACE_ID as UUID

2026-02-05 16:55:48 -06:00

federation.module.ts

fix(#338 ): Validate DEFAULT_WORKSPACE_ID as UUID

2026-02-05 16:55:48 -06:00

federation.service.spec.ts

fix(tests): Resolve pipeline #243 test failures

2026-02-06 12:15:21 -06:00

federation.service.ts

fix(#288 ): Upgrade RSA key size to 4096 bits

2026-02-03 21:33:57 -06:00

http-timeout.spec.ts

Fix QA validation issues and add M7.1 security fixes (#318 )

2026-02-04 03:08:09 +00:00

identity-linking.controller.spec.ts

fix(#290 ): Secure identity verification endpoint

2026-02-03 21:36:31 -06:00

identity-linking.controller.ts

fix(#290 ): Secure identity verification endpoint

2026-02-03 21:36:31 -06:00

identity-linking.service.spec.ts

feat(#87 ): implement cross-instance identity linking for federation

2026-02-03 12:55:37 -06:00

identity-linking.service.ts

fix(#271 ): implement OIDC token validation (authentication bypass)

2026-02-03 16:50:06 -06:00

identity-resolution.service.spec.ts

feat(#87 ): implement cross-instance identity linking for federation

2026-02-03 12:55:37 -06:00

identity-resolution.service.ts

feat(#87 ): implement cross-instance identity linking for federation

2026-02-03 12:55:37 -06:00

index.ts

feat(#273 ): Implement capability-based authorization for federation

2026-02-03 19:53:09 -06:00

oidc.service.spec.ts

fix(#337 ): Replace hardcoded OIDC values in federation with env vars

2026-02-05 16:03:09 -06:00

oidc.service.ts

fix(#337 ): Replace hardcoded OIDC values in federation with env vars

2026-02-05 16:03:09 -06:00

query.controller.spec.ts

feat(#88 ): implement QUERY message type for federation

2026-02-03 13:12:12 -06:00

query.controller.ts

feat(#88 ): implement QUERY message type for federation

2026-02-03 13:12:12 -06:00

query.service.spec.ts

feat(#360 ): Add federation credential isolation

2026-02-07 16:55:49 -06:00

query.service.ts

feat(#360 ): Add federation credential isolation

2026-02-07 16:55:49 -06:00

signature.service.spec.ts

feat(#284 ): Reduce timestamp validation window to 60s with replay attack prevention

2026-02-03 21:43:01 -06:00

signature.service.ts

feat(#284 ): Reduce timestamp validation window to 60s with replay attack prevention

2026-02-03 21:43:01 -06:00

workspace-access.integration.spec.ts

feat(#286 ): Add workspace access validation to federation endpoints

2026-02-03 21:50:13 -06:00