test: parent /changes leaks restricted descendant composition changelog - #353
test: parent /changes leaks restricted descendant composition changelog#353patricebender wants to merge 4 commits into
Conversation
![hyperspace-pr-bot[bot]](https://avatars.githubusercontent.com/u/2531208?s=60&v=4){kind=small}
There was a problem hiding this comment.
The PR adds a well-structured failing test that documents a real authorization boundary leak. Two issues were flagged: the write-setup calls implicitly depend on the module-level defaults.auth making the test fragile if that default ever changes, and the core assertion is vacuously true if /changes returns nothing at all — a guard assertion that parent rows exist would prevent false positives.
PR Bot Information
Version: 1.29.2
- Event Trigger:
pull_request.opened - Correlation ID:
4ed1ca10-8749-11f1-8d33-11770c8ae420 - LLM:
anthropic--claude-4.6-sonnet - File Content Strategy: Full file content
- Experiment Variant:
control
f516456 to
74d53c6
Compare
A child entity is @restrict'ed to admin within a support-scoped service; auto-exposure carries the entity-level restriction, so a support user is 403 on the child both directly and via composition navigation. The change-tracking plugin still surfaces the child's changelog rows through the parent's hierarchical /changes, whose ON condition is OR-expanded across maxDisplayHierarchyDepth into a SELECT * service ChangeView with no descendant authorization. Test asserts the parent history carries no restricted-child rows for such a reader; currently fails on the leaked rows.
74d53c6 to
1f7e46a
Compare
SummaryThe following content is AI-generated and provides a summary of the pull request: Test: Parent
|
There was a problem hiding this comment.
The PR introduces a test that documents a security bug where @restrict-ed composition child changelog rows are exposed via the parent's /changes navigation. The test setup has a few correctness issues: the data-creation requests rely implicitly on module-level admin credentials rather than being explicit about why they need them, and the tracked entities are missing the @changelog annotations (entity-level and on the composition field) that are needed for the hierarchical /changes machinery to actually emit child rows — without those, the "no child rows" assertion may pass vacuously because tracking never fires, not because access control blocked anything. Please address the previously raised comments and the new ones before merging.
PR Bot Information
Version: 1.29.2
- Experiment Variant:
control - LLM:
anthropic--claude-4.6-sonnet - Correlation ID:
9fd4b700-89c0-11f1-98a9-c827e0f6bebc - File Content Strategy: Full file content
- Event Trigger:
pull_request.ready_for_review
2 participants
A change-tracked composition child that is
@restrict'ed within the same service is still exposed through the parent's hierarchical/changesnavigation, crossing the authorization boundary.No fix included, the remediation your call.