zeekayandHanzo Dev 5a88593ea8 ci: scope on the verified org, not on a query parameter ...

This service shipped with /v1/runs answering 200 to anyone on the
internet, disclosing repo names, workflow names, branches, commit SHAs,
actor logins and pass/fail across EVERY org. The cause was a category
error, not a missing check: `?org=` narrowed what was rendered and read
like tenancy, so it looked like the surface had one. A query parameter
is a request for a view. It can never be the authority for one.

The authority is now X-Org-Id, minted by admin-guard from the
IAM-verified `owner` claim and written onto the request by the ingress
middleware's authResponseHeaders (Traefik overwrites any client-sent
value, so it cannot be forged on the wired path).

Three properties, each with a test that fails without it:

  - ABSENCE IS FATAL. No X-Org-Id => 403, never "no filter". Defaulting
    an absent scope to "everything" is precisely the bug; absence means
    the request did not come through the gate, so refusing is the only
    honest answer. The refusal body carries no repo names.
  - THE PARAMETER CAN ONLY NARROW. Permission is applied first, then
    `?org=` selects within it. A lux viewer asking ?org=hanzo gets an
    empty list, not hanzo's builds.
  - THE ORG LIST IS SCOPED TOO. A tenant sees only its own org in the
    nav. Hiding the runs but listing every org still discloses the set of
    orgs that build on the platform.

The admin org keeps the cross-tenant fleet view, matched to
admin-guard's IAM_ADMIN_ORG via CI_ADMIN_ORG — the guard decides who
gets in, this decides who sees everything, and the two must name the
same org or the fleet view silently collapses (or, set too wide,
promotes a tenant into it).

renderDashboard now takes the viewer and is handed only rows that
already passed v.visible. A template that can see everything is one edit
away from showing it.

Mutation-verified: restoring `visible` to the old filter-as-gate
behaviour fails TestTenantCannotWidenWithQueryParam and the end-to-end
handler test.

Co-authored-by: Hanzo Dev <[email protected]>

2026-07-27 23:37:17 -07:00

12 MiB

Executable File

Raw History

The file is too large to be shown. View Raw