ilpanich / axiam-typescript-sdk / 30851818101

94%

push

github

fix(security): diagnose the slug-vs-UUID tenant comparand (§13.4 observation 6) (#36)

AXIAM access tokens carry the tenant UUID in tenant_id, while this SDK's client
is commonly configured with a tenant slug. A guard handed that slug rejects 100%
of traffic: fail-closed and safe, so not a vulnerability, but it presents as
"every token is invalid" with nothing pointing at the cause.

assertTenantClaim now emits one console.warn naming the real problem. The
diagnostic is deliberately narrow:

- once per process, so a stream of bad tokens cannot turn it into a log flood;
- keyed on the shape of the operator-configured value, never on anything a
  caller supplies, so it is not attacker-triggerable;
- emitted after the rejection is already decided, so the verification outcome
  is byte-for-byte unchanged.

A UUID-vs-UUID mismatch is a genuine cross-tenant rejection and stays silent —
pinned by its own test, alongside one asserting a correctly-configured guard
still accepts and still says nothing.

Also syncs CONTRACT.md §10.1 rule 8 (subject of the decision) from the server.

Gates: 518 tests pass across 53 files, tsc --noEmit clean.


Claude-Session: https://claude.ai/code/session_01SkTHvZQMV47t3UwkEtmB1D

Co-authored-by: Claude <noreply@anthropic.com>

730 of 790 branches covered (92.41%)

Branch coverage included in aggregate %.

1222 of 1258 relevant lines covered (97.14%)

33.35 hits per line