domverse/photoanalyzer
1
0
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

US07-02 — Harden API Authorization and Path Boundaries #39

New Issue
Closed
opened 2026-07-13 13:10:52 +02:00 by domverse · 3 comments
domverse commented 2026-07-13 13:10:52 +02:00
Owner
Copy Link

Source specification: delivery_backlog/stories/US07-02-security-hardening.md

US07-02 — Harden API Authorization and Path Boundaries

Epic: E07

As an operator, I want the local application resistant to cross-origin and path attacks
so another process or webpage cannot access photos or trigger mutations.

Acceptance criteria

  • Session authentication, Origin/Host checks, SameSite cookies, CSRF protection, and
    restrictive CORS/default headers cover all mutation and media endpoints.
  • Asset IDs, repeated root validation, symlink defense, upload limits, and schema
    validation prevent raw-path and race escapes.
  • Errors reveal no secrets, filesystem internals, or private metadata unnecessarily.

Automated tests

  • Black-box security tests cover missing/invalid auth, CSRF, hostile origins/hosts,
    traversal, symlink races, malformed/oversized requests, and information leakage.

Dependencies

  • US07-01
Source specification: [delivery_backlog/stories/US07-02-security-hardening.md](https://git.domverse-berlin.eu/domverse/photoanalyzer/src/branch/main/delivery_backlog/stories/US07-02-security-hardening.md) # US07-02 — Harden API Authorization and Path Boundaries Epic: [E07](https://git.domverse-berlin.eu/domverse/photoanalyzer/src/branch/main/delivery_backlog/E07-hardening-release.md) As an operator, I want the local application resistant to cross-origin and path attacks so another process or webpage cannot access photos or trigger mutations. ## Acceptance criteria - Session authentication, Origin/Host checks, SameSite cookies, CSRF protection, and restrictive CORS/default headers cover all mutation and media endpoints. - Asset IDs, repeated root validation, symlink defense, upload limits, and schema validation prevent raw-path and race escapes. - Errors reveal no secrets, filesystem internals, or private metadata unnecessarily. ## Automated tests - Black-box security tests cover missing/invalid auth, CSRF, hostile origins/hosts, traversal, symlink races, malformed/oversized requests, and information leakage. ## Dependencies - US07-01
domverse added this to the E07 — Hardening and Release milestone 2026-07-13 13:10:52 +02:00
domverse added the type/hardeningpriority/criticalarea/filesystemarea/backend labels 2026-07-13 13:10:52 +02:00
domverse added a new dependency 2026-07-13 13:11:32 +02:00
#41 US07-04 — Prove Concurrency and Crash Recovery
domverse added a new dependency 2026-07-13 13:11:34 +02:00
#44 US07-07 — Automate Full Release Acceptance
domverse added this to the Photo Analyzer Delivery project 2026-07-13 13:19:47 +02:00
domverse added the status/backlog label 2026-07-13 13:52:56 +02:00
domverse added status/in-progress and removed status/backlog labels 2026-08-16 21:55:15 +02:00
domverse self-assigned this 2026-08-16 21:55:16 +02:00
domverse commented 2026-08-16 21:55:16 +02:00
Author
Owner
Copy Link

Claimed for implementation on branch us/US07-02-harden-api-authorization-and-path-boundaries.

Claimed for implementation on branch `us/US07-02-harden-api-authorization-and-path-boundaries`.
domverse added status/review and removed status/in-progress labels 2026-08-16 23:07:11 +02:00
domverse commented 2026-08-16 23:07:11 +02:00
Author
Owner
Copy Link

Submitted for review: #84

Tests passed:

  • work_item/scripts/python -m unittest discover -s work_item/tests -v
  • work_item/scripts/python -m pytest tests -q
  • work_item/scripts/python -m pytest tests/unit/test_security_policy.py tests/integration/test_security_boundaries.py tests/e2e/test_security.py -q
Submitted for review: https://git.domverse-berlin.eu/domverse/photoanalyzer/pulls/84 Tests passed: - `work_item/scripts/python -m unittest discover -s work_item/tests -v` - `work_item/scripts/python -m pytest tests -q` - `work_item/scripts/python -m pytest tests/unit/test_security_policy.py tests/integration/test_security_boundaries.py tests/e2e/test_security.py -q`
domverse added status/done and removed status/review labels 2026-08-16 23:07:39 +02:00
domverse commented 2026-08-16 23:07:40 +02:00
Author
Owner
Copy Link

Completed and merged via PR #84.

Completed and merged via PR #84.
domverse moved this to Done in Photo Analyzer Delivery on 2026-08-16 23:08:00 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/backend
Backend services, jobs, or API
 area/database
Schema, persistence, migration, or queries
 area/filesystem
Filesystem identity, mutation, or storage
 area/frontend
Browser UI and client-side application
 area/integration
External tools or provider integrations
 area/testing
Automated test suites, fixtures, and tooling
 priority/critical
Release-blocking safety or correctness
 priority/high
Important phase outcome
 priority/normal
Normal planned work
 status/backlog
Awaiting dependency eligibility or prioritization
 status/blocked
Cannot proceed without an explicit resolution
 status/done
Merged, tested, and completed
 status/in-progress
Currently being implemented
 status/ready
Eligible to be claimed
 status/review
Submitted in a pull request for review
 type/feature
User-facing or domain capability
 type/hardening
Security, resilience, operations, or release hardening
 type/migration
Donor extraction, migration, or legacy consolidation
 type/test
Automated test infrastructure or acceptance coverage
No Label area/backend area/filesystem priority/critical status/done type/hardening
Milestone
No items
No Milestone E07 — Hardening and Release
Projects
Clear projects
No project Photo Analyzer Delivery
Assignees
Clear assignees
domverse
No Assignees domverse
1 Participants
Notifications
Due Date
No due date set.
Blocks
#41 US07-04 — Prove Concurrency and Crash Recovery
domverse/photoanalyzer
#44 US07-07 — Automate Full Release Acceptance
domverse/photoanalyzer
Depends on
#38 US07-01 — Complete Donor Migration and Freeze the CLI Archive
domverse/photoanalyzer
Reference: domverse/photoanalyzer#39
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?