ilpanich / axiam-typescript-sdk / 30858686698

94%

push

github

test: pin CONTRACT §10.1 rule 8 against regression (§15.3.1) (#39)

Rule 8 — the decision is about the caller's credential and no other — was
enforced here only by inspection. SEC-085 satisfied rules 1-7 and was still an
authentication bypass, so the missing guardrail is the condition that let it
survive three security reviews.

Worth stating what the audit actually found: this SDK is structurally safe from
that shape. VerifiableSession carries a verifier and a tenant, not a logged-in
session, so there is no second credential in scope for the guard to substitute.
PHP was uniquely exposed because AxiamClient bundles a stateful Session and the
guard called a helper that reached into it.

So the useful guardrail is not "healthy session plus bad token" — there is no
session to make healthy — it is a test that the property stays true. One test
asserts the verifier is invoked with the caller's token and nothing else; the
other asserts the guard's input exposes no session/client/refresh/accessToken
surface. Both fail if anyone threads a stateful client session into the guard's
inputs, which is exactly how the PHP bug became reachable.

520 tests pass, tsc --noEmit clean.


Claude-Session: https://claude.ai/code/session_01SkTHvZQMV47t3UwkEtmB1D

Co-authored-by: Claude <noreply@anthropic.com>

730 of 790 branches covered (92.41%)

Branch coverage included in aggregate %.

1222 of 1258 relevant lines covered (97.14%)

33.37 hits per line