alkhttp/tasks/server/review-001-schema-internal-visibility.md at cc34c08e4e7215ff7a7e70105b6aacf04e86e43b

Files

T

glm-5.3-flash 12b35e2c5f docs(tasks): decompose review 001 remediation Units 1-5 into taskgraph tasks

21 review-001 tasks across server/adapters/client/gateway/websocket/infra,
chunked from the 7-unit remediation plan in
docs/reviews/001-initial-implementation-review.md.

- Scope split by mechanism, not one-per-finding: 15 tasks in generation 1
  (parallelizable), 6 sequenced after their file-sharing precursors
- Deliberately deferred until dependent fixes land: projection/doc
  fidelity partial (Unit 6 beyond dependency hygiene), coverage backfills
  (COV-01..07 via in-task acceptance for forward.rs), and per-finding
  minors (OAI-06/07, HY-02/04/06/10/11, CON-08)
- Cross-crate WS-12 (alkcall demux 4 GiB discard alloc) noted for filing
  in alkcall, not here

taskgraph: validate clean, no cycles, 6 generations

2026-08-29 07:10:15 +00:00

2.5 KiB

Raw Blame History

id, name, status, depends_on, scope, risk, impact, level, tags

name

status

depends_on

scope

risk

impact

level

Description

Review 001 findings SRV-02 + PRJ-06 + GW-02 — three faces of one visibility gap on the discovery axis:

SRV-02 (src/gateway/routes.rs:120-137): schema_handler runs only access_check_for_op; it skips the is_internal_op pre-check that /call, /batch, /subscribe, /publish all apply. Internal ops carry AccessControl::default(), so an unauthenticated caller can fetch the full spec (visibility, schemas, access_control) of an op it cannot call. POST /call on the same op correctly 404s (tested); GET /schema does not — the invisibility invariant (ADR-015 §2) is defeated on the discovery axis.
PRJ-06 (src/adapters/to_mcp.rs:148-174): the MCP schema tool has the identical gap — no per-op pre-check, full spec including required_scopes returned for forbidden ops. The test schema_returns_full_operation_spec enshrines the leak.
GW-02: /search and /schema are per-identity GETs with no Cache-Control: no-store / Vary: Authorization, so shared caches may serve caller A's filtered response to caller B.

Fix all three in one pass since they share the pre-check logic and test fixtures: add the 404 guard to schema_handler; run the same access_check_for_op pre-check in the MCP schema tool (or filter the returned spec per identity) and fix the enshrining test; add cache headers to the two per-identity GETs.

Acceptance Criteria

GET /schema?name=<internal> → 404 unauthenticated, for an unauthorized identity, and for an anonymous identity (test)
MCP schema tool denies/404s unauthorized ops symmetrically with HTTP /schema (test); enshrining test fixed
/search + /schema responses carry Cache-Control: no-store (and Vary: Authorization where a token can change the body)
cargo test and cargo clippy --all-targets -- -D warnings pass
cargo test --all-features passes (the MCP half is feature-gated)

References

docs/reviews/001-initial-implementation-review.md (SRV-02, PRJ-06, GW-02)
docs/architecture/decisions/015-privilege-model-and-authority-context.md
docs/architecture/decisions/041-mcp-tool-gateway-pattern.md

Notes

Agent fills during implementation.

Summary

Filled on completion.

2.5 KiB Raw Blame History