Repository navigation
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The oversized fixture never exercises the final byte-limit check, and the new encoder lacks tests confirming rejection of credential-shaped values outside provider.
1 open issue
What changed in this PR
Preserves canonical provider keys in Hub’s identity audits so credential-shaped keys no longer cause identity or provider-revision transactions to roll back. This follows up on the identity transaction foundation in #163.
Changes:
- Carries a branded provider-key type from parsing into typed audit events.
- Adds provider-specific context encoding while retaining context limits and generic credential protections.
- Adds regression coverage for exact key preservation, successful transactions, and post-rollback failure audits.
| File | Description |
|---|---|
hub/server/utils/parse-provider-key/index.ts |
Brands validated provider keys without changing acceptance rules. |
hub/server/utils/parse-provider-key/index.test.ts |
Covers a credential-shaped canonical key. |
hub/server/repositories/security-audits/parse-security-audit-event/types.ts |
Defines parsed events with branded provider keys. |
hub/server/repositories/security-audits/parse-security-audit-event/index.ts |
Returns the branded event type. |
hub/server/repositories/security-audits/get-security-audit-data/index.ts |
Uses provider-specific encoding for identity audits. |
hub/server/repositories/security-audits/create-security-audit/index.test.ts |
Checks exact key preservation through the public audit boundary. |
hub/server/repositories/security-audits/create-security-audit-context/index.ts |
Adds bounded encoding for canonical provider keys. |
hub/server/repositories/security-audits/create-security-audit-context/index.test.ts |
Covers credential rejection and context limits. |
hub/server/domains/identity/validate-and-persist-provider-revision/index.db.test.ts |
Exercises provider-key preservation across selection and rollback audits. |
hub/server/domains/identity/resolve-or-create-external-identity/index.db.test.ts |
Exercises credential-shaped keys in creation and rollback audits. |
Review effort: Max (auto)
Comment on lines
+53
to
+70
|
|
||
| it("retains context bounds for a canonically parsed provider key", () => { | ||
| const provider = parseProviderKey("secret:workforce") | ||
|
|
||
| expect(() => | ||
| createSecurityAuditContextWithProviderKey({ | ||
| provider, | ||
| first: "界".repeat(500), | ||
| second: "界".repeat(500), | ||
| third: "界".repeat(500), | ||
| fourth: "界".repeat(500), | ||
| fifth: "界".repeat(500), | ||
| sixth: "界".repeat(500), | ||
| seventh: "界".repeat(500), | ||
| }), | ||
| ).toThrow("cannot exceed 4096 bytes") | ||
| }) | ||
| }) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
A provider key accepted by Hub's canonical parser could still be rejected while building a typed security audit when its opaque value resembled credential text, such as
secret:workforce. Identity creation and provider revision operations could then roll back, and their terminal failure audit could fail for the same reason. This is a focused follow-up to #163.What changes
Canonical provider keys now carry a branded type from
parseProviderKey()into the audit layer. Typed identity audit events use a narrow provider-key encoder that preserves the exact key for correlation and retains the existing string, byte, entry, and context limits, while bypassing only the generic credential-value heuristic that is inappropriate for this already-validated field. Generic untyped audit context still rejects credential-shaped values, secret-bearing fields, bearer tokens, and private-key material.Regression coverage exercises representative opaque and Unicode provider keys through the public audit boundary, identity creation and provider revision success, post-rollback failure audits, invalid keys, generic credential rejection, context limits, and raw-error leakage. This changes no provider-key acceptance rules, database schema or migrations, product behavior outside identity auditing, or UI.