hyperscale-stack / security / 38351244129

98%

push

github

fix: harden the authorization core and the transport adapters

Harden the transport-agnostic core and the HTTP, gRPC and ConnectRPC
adapters (internal security audit of 2026-10-12).

- Voters compare attribute values; Authenticated() / Anonymous() vote on
  security.IsAuthenticated / IsAnonymous; Decide denies an attribute no
  voter supports and a decision without attributes or voters whatever
  the fallback; And is strict; Not never grants an unauthenticated
  principal; FullyAuthenticated() is removed.
- Roles live under ROLE_, scopes under scope: (one per authority); the
  voter constructors refuse names they could never match.
- Carriers read header fields only; the session comes from its cookie
  (CookiesNamed / session.CookieReader); a repeated Authorization field
  is refused (security.SingleValue: 400 / InvalidArgument).
- One error taxonomy, security.ErrorClass, for the core spans and the
  three default mappers: challenges with a realm (RFC 6750, RFC 7617,
  RFC 9110), RFC 6750 codes only for bearer requests, a challenge on
  every Bearer refusal, 401 for anonymous denials, ErrUnavailable ->
  503 / Unavailable, no sentinel -> 500 / Internal, generic messages.
- Engine and Manager return and store Anonymous() on failure; typed nils
  and contract violations fail closed; nil engines, managers, voters,
  decision managers and attributes panic at construction.
- Spans record error classes, never error text; http.route is a route
  template; the carriers redact under every fmt verb; Authorities()
  returns a copy.
- grpcsec sends staged metadata; ServerOptions / AuthorizeServerOptions
  cover unary and streaming RPCs (the grpc-bearer example served
  Health.Watch without authentication).

Audit: CORE-01, CORE-02, CORE-05, CORE-07, CORE-10, CORE-13, CORE-15, CORE-I1, CORE-I2, CORE-I3, CORE-I4, CORE-I5, CORE-I6, CORE-I10, CORE-I11.

627 of 627 new or added lines in 42 files covered. (100.0%)

12124 of 12422 relevant lines covered (97.6%)

2637.27 hits per line