hyperscale-stack / security / 39679290958

98%

Build Type

push

github

Committed by web-flow

Commit Message

fix(stores)!: close the 2026-10-21 security audit findings of the stores

Close the store findings of the security audit of 2026-10-21.

- MySQL DDL of the oauth2, oidc/client and saml/sp SQL stores names
  ENGINE=InnoDB DEFAULT CHARSET=utf8mb4; on MyISAM a cut-short refresh
  rotation lost the replacement token. Migrate creates under a named
  lock (GET_LOCK) and ends with CheckDeployment (F-18).
- CheckDeployment / ErrDeploymentRequirement: MySQL InnoDB, VARBINARY
  keys and strict sql_mode; Redis >= 6.0, noeviction, no cluster mode.
  The oauth2 Redis store refuses ClusterClient and Ring (I-24).
- SAML Redis replay marks expire on the SP's clock (durations, WithClock)
  (F-19).
- oauth2/storetest compares full token records and pins retention, with
  a self-test over lying stores (F-23); the SQL concurrency cases race on
  real backends (F-24).
- oidcclient.ValidateStoreKey: every OIDC TransactionStore validates its
  keys before Consume (I-23).
- The three locking layers of a SQL rotation are each tested (I-25).
- PurgeExpired on the oauth2 and saml/sp SQL stores; the remaining
  operational gaps are documented (D-25).

Breaking changes and migration steps: MIGRATION.md.

Audit: F-18, F-19, F-23, F-24, I-23, I-24, I-25, D-25.

Coverage Stats

576 of 646 new or added lines in 25 files covered. (89.16%)

8 existing lines in 1 file now uncovered.

15410 of 15699 relevant lines covered (98.16%)

4962.26 hits per line