stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 3 Releases Wiki Activity
Files
8e69cdc416cedd6bc9a5cebde59d01f024ff8b6f
git.stella-ops.org/src/Authority/StellaOps.Authority/TASKS.completed.md
master b1e78fe412
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
Details
feat: Implement vulnerability token signing and verification utilities 
- Added VulnTokenSigner for signing JWT tokens with specified algorithms and keys.
- Introduced VulnTokenUtilities for resolving tenant and subject claims, and sanitizing context dictionaries.
- Created VulnTokenVerificationUtilities for parsing tokens, verifying signatures, and deserializing payloads.
- Developed VulnWorkflowAntiForgeryTokenIssuer for issuing anti-forgery tokens with configurable options.
- Implemented VulnWorkflowAntiForgeryTokenVerifier for verifying anti-forgery tokens and validating payloads.
- Added AuthorityVulnerabilityExplorerOptions to manage configuration for vulnerability explorer features.
- Included tests for FilesystemPackRunDispatcher to ensure proper job handling under egress policy restrictions.
2025-11-03 10:04:10 +02:00

10 KiB
Raw Blame History

Completed Tasks

ID Status Owner(s) Depends on Description Exit Criteria
AUTH-AOC-19-001 DONE (2025-10-26) Authority Core & Security Guild — Introduce scopes advisory:read, advisory:ingest, vex:read, vex:ingest, aoc:verify with configuration binding, migrations, and offline kit defaults. Scopes published in metadata/OpenAPI, configuration validates scope lists, tests cover token issuance + enforcement.
AUTH-AOC-19-002 DONE (2025-10-27) Authority Core & Security Guild AUTH-AOC-19-001 Propagate tenant claim + scope enforcement for ingestion identities; ensure cross-tenant writes/read blocked and audit logs capture tenant context. Tenant claim injected into downstream services; forbidden cross-tenant access rejected; audit/log fixtures updated.
AUTH-AOC-22-001 DONE (2025-10-29) Authority Core Guild AUTH-AOC-19-001 Roll out new advisory/vex ingest/read scopes. Legacy scopes rejected; metadata/docs/configs updated; integration tests cover advisory/vex scope enforcement for Link-Not-Merge APIs.
AUTH-POLICY-20-001 DONE (2025-10-26) Authority Core & Security Guild AUTH-AOC-19-001 Add scopes policy:write, policy:submit, policy:approve, policy:run, findings:read, effective:write with configuration binding and issuer policy updates. Scopes available in metadata; token issuance validated; offline kit defaults updated; tests cover scope combinations.
AUTH-POLICY-20-002 DONE (2025-10-26) Authority Core & Security Guild AUTH-POLICY-20-001, AUTH-AOC-19-002 Enforce Policy Engine service identity with effective:write and ensure API gateway enforces scopes/tenant claims for new endpoints. Gateway policies updated; unauthorized requests rejected in tests; audit logs capture scope usage.
AUTH-GRAPH-21-001 DONE (2025-10-26) Authority Core & Security Guild AUTH-POLICY-20-001 Define scopes graph:write, graph:read, graph:export, graph:simulate, update metadata/OpenAPI, and add OFFLINE kit defaults. Scopes exposed via discovery docs; smoke tests ensure enforcement; offline kit updated.
AUTH-GRAPH-21-002 DONE (2025-10-26) Authority Core & Security Guild AUTH-GRAPH-21-001, AUTH-AOC-19-002 Wire gateway enforcement for new graph scopes, Cartographer service identity, and tenant propagation across graph APIs. Gateway config updated; unauthorized access blocked in integration tests; audit logs include graph scope usage.
AUTH-GRAPH-21-003 DONE (2025-10-26) Authority Core & Docs Guild AUTH-GRAPH-21-001 Update security docs and samples describing graph access roles, least privilege guidance, and service identities. Docs merged with compliance checklist; examples refreshed; release notes prepared.
AUTH-POLICY-23-001 DONE (2025-10-29) Authority Core & Security Guild AUTH-POLICY-20-001 Introduce fine-grained scopes policy:read, policy:edit, policy:approve, policy:activate, policy:simulate; update issuer templates and metadata. Scopes exposed; integration tests confirm enforcement; offline kit updated.
AUTH-VULN-24-001 DONE (2025-10-29) Authority Core & Security Guild AUTH-GRAPH-21-001 Extend Vuln Explorer scopes (vuln:view, vuln:investigate, vuln:operate, vuln:audit) and signed permalinks with scoped claims for Vuln Explorer; update metadata. Scopes published; permalinks validated; integration tests cover RBAC.
AUTH-ORCH-32-001 DONE (2025-10-31) Authority Core & Security Guild — Define orch:read scope, register Orch.Viewer role, update discovery metadata, and seed offline defaults. Scope/role available in metadata; integration tests confirm read-only enforcement; offline kit updated.
AUTH-CONSOLE-23-001 DONE (2025-10-29) Authority Core & Security Guild AUTH-POLICY-20-001 Register StellaOps Console confidential client with OIDC PKCE support, short-lived ID/access tokens, console:* audience claims, and SPA-friendly refresh (token exchange endpoint). Publish discovery metadata + offline kit defaults. Client registration committed; configuration templates updated; integration tests validate PKCE + scope issuance; security review recorded.
AUTH-POLICY-27-001 DONE (2025-10-31) Authority Core & Security Guild AUTH-POLICY-20-001, AUTH-CONSOLE-23-001 Define Policy Studio roles (policy:author, policy:review, policy:approve, policy:operate, policy:audit) with tenant-scoped claims, update issuer metadata, and seed offline kit defaults. Scopes/roles exposed via discovery docs; tokens issued with correct claims; integration tests cover role combinations; docs updated.
AUTH-EXC-25-001 DONE (2025-10-29) Authority Core & Security Guild AUTH-POLICY-23-001 Introduce exception scopes (exceptions:read, exceptions:write, exceptions:approve) and approval routing configuration with MFA gating. Scopes published in metadata; routing matrix validated; integration tests enforce scope + MFA rules.
AUTH-SIG-26-001 DONE (2025-10-29) Authority Core & Security Guild AUTH-EXC-25-001 Add signals:read, signals:write, signals:admin scopes, issue SignalsUploader role template, and enforce AOC for sensor identities. Scopes exposed; configuration validated; integration tests ensure RBAC + AOC enforcement.
AUTH-EXPORT-35-001 DONE (2025-10-28) Authority Core & Security Guild AUTH-AOC-19-001 Introduce Export.Viewer, Export.Operator, Export.Admin scopes, configure issuer templates, and update discovery metadata/offline defaults. Scopes available; metadata updated; tests ensure enforcement; offline kit defaults refreshed.
AUTH-EXPORT-37-001 DONE (2025-10-28) Authority Core & Security Guild AUTH-EXPORT-35-001, WEB-EXPORT-37-001 Enforce admin-only access for scheduling, retention, encryption key references, and verify endpoints with audit reason capture. Admin scope required; audit logs include reason/ticket; integration tests cover denial cases; docs updated.
AUTH-TEN-47-001 DONE (2025-10-30) Authority Core & Security Guild AUTH-AOC-19-001 Align Authority with OIDC/JWT claims (tenants, projects, scopes), implement JWKS caching/rotation, publish scope grammar, and enforce required claims on tokens. Tokens include tenant/project claims; JWKS cache validated; docs updated; imposed rule noted.
2025-10-30: Introduced in-memory JWKS cache with configurable signing.jwksCacheLifetime, emitted cache-control/ETag headers on /jwks, invalidated cache on rotations, and expanded docs to detail scope grammar + claim catalogue.
AUTH-OAS-61-001 DONE (2025-10-28) Authority Core & Security Guild, API Contracts Guild OAS-61-001 Document Authority authentication/token endpoints in OAS with scopes, examples, and error envelopes. Spec complete with security schemes; lint passes.
AUTH-AOC-19-003 DONE (2025-10-27) Authority Core & Docs Guild AUTH-AOC-19-001 Update Authority docs and sample configs to describe new scopes, tenancy enforcement, and verify endpoints. Docs and examples refreshed; release notes prepared; smoke tests confirm new scopes required.
AUTH-AOC-19-004 DONE (2025-10-31) Authority Core & Security Guild AUTH-AOC-19-002 Enforce AOC scope pairings: require aoc:verify alongside advisory/vex read scopes and for any signals:* requests; emit deterministic errors and telemetry. Client/token issuance rejects missing pairings with structured errors; logs/metrics capture violations; tests and docs updated.
AUTH-POLICY-20-003 DONE (2025-10-26) Authority Core & Docs Guild AUTH-POLICY-20-001 Update Authority configuration/docs with policy scopes, service identities, and approval workflows; include compliance checklist. Docs refreshed; samples updated; release notes prepared; doc lint passes.
AUTH-POLICY-23-004 DONE (2025-10-27) Authority Core & DevOps Guild AUTH-POLICY-23-001 Migrate default Authority client registrations/offline kit templates to the new policy scope set and provide migration guidance for existing tokens. Updated configs committed (Authority, CLI, CI samples); migration note added to release docs; verification script confirms scopes.
AUTH-ORCH-33-001 DONE (2025-10-30) Authority Core & Security Guild AUTH-ORCH-32-001 Add Orch.Operator role/scopes for control actions, require reason/ticket attributes, and update issuer templates. Operator tokens issued; action endpoints enforce scope + reason; audit logs capture operator info; docs refreshed.
2025-10-30: Operator token flow now stamps stellaops:operator_reason/stellaops:operator_ticket claims, enforces claim presence on issuance, extends audit records, and refreshes config/docs (authority.yaml, security guides, CLI prompts).
AUTH-CONSOLE-23-002 DONE (2025-10-31) Authority Core & Security Guild AUTH-CONSOLE-23-001, AUTH-AOC-19-002 Expose tenant catalog, user profile, and token introspection endpoints required by Console (fresh-auth prompts, scope checks); enforce tenant header requirements and audit logging with correlation IDs. Endpoints ship with RBAC enforcement, audit logs include tenant+scope, integration tests cover unauthorized/tenant-mismatch scenarios.
AUTH-CONSOLE-23-003 DONE (2025-10-31) Authority Core & Docs Guild AUTH-CONSOLE-23-001, AUTH-CONSOLE-23-002 Update security docs/config samples for Console flows (PKCE, tenant badge, fresh-auth for admin actions, session inactivity timeouts) with compliance checklist. Docs merged, config samples validated, release notes updated, ops runbook references new flows.
AUTH-CONSOLE-23-004 DONE (2025-10-31) Authority Core & Security Guild AUTH-CONSOLE-23-003, DOCS-CONSOLE-23-012 Validate console security guide assumptions (120 s OpTok TTL, 300 s fresh-auth window, scope bundles) against Authority implementation and update configs/audit fixtures if needed. Confirmation recorded in sprint log; Authority config samples/tests updated when adjustments required; /fresh-auth behaviour documented in release notes.
AUTH-EXC-25-002 DONE (2025-10-31) Authority Core & Docs Guild AUTH-EXC-25-001 Update documentation/samples for exception roles, routing matrix, MFA requirements, and audit trail references. Docs merged with compliance checklist; samples verified.
AUTH-OAS-61-002 DONE (2025-10-28) Authority Core & Security Guild AUTH-OAS-61-001 Implement /.well-known/openapi with scope metadata, supported grant types, and build version. Endpoint deployed; contract tests cover discovery.