glm-5.3-flash
12b35e2c5f
21 review-001 tasks across server/adapters/client/gateway/websocket/infra, chunked from the 7-unit remediation plan in docs/reviews/001-initial-implementation-review.md. - Scope split by mechanism, not one-per-finding: 15 tasks in generation 1 (parallelizable), 6 sequenced after their file-sharing precursors - Deliberately deferred until dependent fixes land: projection/doc fidelity partial (Unit 6 beyond dependency hygiene), coverage backfills (COV-01..07 via in-task acceptance for forward.rs), and per-finding minors (OAI-06/07, HY-02/04/06/10/11, CON-08) - Cross-crate WS-12 (alkcall demux 4 GiB discard alloc) noted for filing in alkcall, not here taskgraph: validate clean, no cycles, 6 generations
52 lines
2.0 KiB
Markdown
52 lines
2.0 KiB
Markdown
---
|
|
id: review-001-extra-routes-auth
|
|
name: Mount extra_routes under the bearer-auth middleware (SRV-01)
|
|
status: pending
|
|
depends_on: []
|
|
scope: narrow
|
|
risk: medium
|
|
impact: component
|
|
level: implementation
|
|
tags: [server, review-001, security]
|
|
---
|
|
|
|
## Description
|
|
|
|
Review 001 finding SRV-01 (`docs/reviews/001-initial-implementation-review.md`,
|
|
empirically verified): `build_router`
|
|
(`src/server/adapter.rs:170-183`) applies `bearer_auth_middleware` via
|
|
`route_layer` **before** merging `extra_routes`, so assembly-layer custom
|
|
routes are mounted without auth — contradicting ADR-046 §4 ("custom routes
|
|
carry the same auth middleware by default"). Amplified by
|
|
`ResolvedIdentity` extraction being infallible: a custom handler silently
|
|
receives `None` on every request.
|
|
|
|
Fix: apply the auth layer **after** merging extra routes so the documented
|
|
default holds. Per-route opt-out remains the deployment's explicit choice
|
|
(extras may carry their own inner layers). Also decide and document the
|
|
SRV-06 interaction: a same-method collision on a reserved path panics in
|
|
axum's `merge` (sanctioned), but a different-method merge (e.g. custom
|
|
`POST /search`) silently serves on a reserved path — enforce
|
|
`RESERVED_PATHS` or document the behavior; the exported constant currently
|
|
has no reader.
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [ ] A test mounts an extra route and asserts `ResolvedIdentity` is resolved from the bearer token (auth applies)
|
|
- [ ] A test shows an extra route carrying its own layer can still opt out (documented escape hatch)
|
|
- [ ] SRV-06 decision landed: per-method reserved-path merges rejected/documented; `RESERVED_PATHS` enforced or un-exported
|
|
- [ ] ADR-046 §4 language matches the implemented default after the fix
|
|
- [ ] `cargo test` and `cargo clippy --all-targets -- -D warnings` pass
|
|
|
|
## References
|
|
|
|
- docs/reviews/001-initial-implementation-review.md (Part A, SRV-01, SRV-06)
|
|
- docs/architecture/decisions/046-assembly-layer-custom-http-routes.md
|
|
|
|
## Notes
|
|
|
|
> Agent fills during implementation.
|
|
|
|
## Summary
|
|
|
|
> Filled on completion. |