tmk241/hemx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(saas): enforce strict response policy

Browse Source 
req: security/006

req: operations/006

req: operations/008
This commit is contained in:
slhx agent
2026-07-14 00:59:06 +02:00
parent 4fc5e53adf
commit 6f58453aae
5 changed files with 47 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
PLAN.md
+5 -5
View File
@@ -59,19 +59,19 @@ encryption, retention, backup, and deployment policy remain host concerns.
## Slice 6 — production integration reference
- [ ] **User value:** adopters can copy a proven boundary for durable storage, auth, transactions, security controls, observability, and restart recovery without hemx owning vendor policy.
- **State:** In progress — the requirements audit corrected stale namespace aliases and found one missing production-reference control: stable request/session/user correlation. The mutation now returns a generated request ID and emits typed request/session/user diagnostic correlation without accepting caller-controlled identifiers or secrets.
- [x] **User value:** adopters can copy a proven boundary for durable storage, auth, transactions, security controls, observability, and restart recovery without hemx owning vendor policy.
- **State:** Complete — the corrected audit found and closed two production-reference gaps: stable request/session/user correlation and strict deployable response policy. The app returns generated request IDs, emits typed secret-free correlation, and applies a no-inline/no-eval CSP plus nosniff and referrer policy to every response.
- **Build:** evolve one existing reference app using ordinary integration adapters; add durable app storage, authenticated/authorized allowed and denied mutations, CSRF/origin checks, transaction rollback, bounded input, structured failures, health/readiness, tracing/metrics hooks, and restart/deploy recovery.
- **Refusals:** no built-in database/auth provider, compliance claim, telemetry vendor, deployment system, or repository framework.
- **Requirements:** `security/001-009`, `operations/001-008`, `v1_release/003`, and the existing `auth/*`, `axum/*`, `failure/*`, and `diag/*` contracts (the former `adapter/*`, `integration/*`, and `diagnostics/*` cursor names do not exist in `REQUIREMENTS.md`).
- **Requirements:** `operations/001-008`, `security/003-004`, `security/006`, `security/009`, `v1_release/003`, and the applicable existing `auth/*` and `failure/004` contracts. The audit removed stale/nonexistent `adapter/*`, `integration/*`, and `diagnostics/*` aliases; `axum/*` and `diag/*` are adapter/editor contracts already owned by their focused slices, while the release-only advisory/license/unsafe-code audit in `security/008` remains a Slice 7 gate.
- **Proof:** end-to-end test survives process restart and mixed deployment, proves allowed/denied/rolled-back mutations and redacted diagnostics, and maps each framework-owned ASVS-relevant control to a failing/passing case.
`cargo test -p hemx-saas-example --test production_reference` proves current bearer authentication, origin/CSRF denial, bounded input, atomic durable commit, rollback, restart recovery, live-vs-ready dependency failure, redacted structured problem responses, aggregate metrics, stale-fingerprint rejection followed by current-build recovery, and generated request correlation on allowed, denied, mismatch, and failed mutations. The typed diagnostic hook carries only generated request ID, fixed session/user IDs, outcome, and duration, preventing request secrets from entering framework-owned records. Execution cursor: finish the corrected `security/*`, `operations/*`, `auth/*`, `axum/*`, `failure/*`, and `diag/*` citation audit; add only any remaining missing end-to-end control, then close Slice 6 if clean.
`cargo test -p hemx-saas-example --test production_reference` proves current bearer authentication, origin/CSRF denial, bounded input, strict CSP/security headers, atomic durable commit, rollback, restart recovery, live-vs-ready dependency failure, redacted structured problem responses, aggregate metrics, stale-fingerprint rejection followed by current-build recovery, and generated request correlation on allowed, denied, mismatch, and failed mutations. The typed diagnostic hook carries only generated request ID, fixed session/user IDs, outcome, and duration. Existing focused Kanban backpressure proof covers `operations/004`; the production-reference mismatch and restart proofs explicitly cover `operations/006` and `operations/008`. Slice 6 is complete.
## Slice 7 — v1 compatibility and closure
- [ ] **User value:** maintainers and adopters receive a reproducible, migration-aware v1 with no known material contradiction and no hidden publication side effect.
- **State:** Blocked by Slices 1-6 and explicit authority for any missing local audit tool installation.
- **State:** Active; Slices 1-6 are complete, and publishing remains separately authorized.
- **Build:** freeze the supported Rust/browser/WASM/integration matrix; reconcile public/generated/Surface/symbol/wire/runtime/persisted-schema compatibility; add migration fixtures; make canonical examples compatibility tests; update the progressive tutorial path; run all local release gates and disposition every P0/P1, advisory, unsafe-code, license, performance, accessibility, and documentation finding.
- **Refusals:** no publish, deploy, upload, store submission, speculative feature, or weakening a gate to make it pass.
- **Requirements:** `v1_release/001-010`, `versioning/*`, `test/*`, `diag/*`, `performance/*`, `security/008`, and all requirements changed by the preceding slices.