mirror of
https://github.com/block/buzz.git
synced 2026-10-31 06:21:34 +00:00
12686a6cd9
Three IMPORTANT findings fixed:
1. Drop effective_at monotonicity from policy revision guard
identity_enrollment_policy_revision_guard_v1() now enforces only
strict-greater policy_revision per community. The effective_at check
had no NIP-FI basis (FI-INV-06 defines assertion_policy_id stability,
not revision chronology) and would reject legitimately-sequenced
revisions — the downstream constructor stamps every immediately-
effective revision with Unix epoch, so revision 2 would fail after
revision 1 under the old guard.
2. Bind semantic coordinates in denial attempt guard
authorization_authentication_denial_attempts gains attempt_id UUID
NOT NULL with a deferred FK to authorization_events on
(community_id, operation_id, event_kind, attempt_id). The guard
authorization_denial_attempt_guard_v1() now additionally compares
correlation_id and reason_code between the event and its denial
attempt row, raising check_violation (23514) with named constraint
authorization_denial_attempt_semantic_binding on mismatch. This
closes the Carl finding 3 gap: a kind-9 event for correlation A /
reason X can no longer be paired with a denial row carrying
correlation B / reason Y.
3. Rewrite regression tests to prove the contracts
- Policy test: seeds a gap (100->101) then inserts unused revision 99
and asserts 23514 from the named guard (not 23505, which would
fire on a PK duplicate and not prove the monotonic comparison).
Adds a two-transaction concurrency regression: two distinct forward
revisions (102, 103) race through separate connections; both commit
because the advisory lock serializes them and each is valid.
- Denial test: replaces the ambiguous negative-B (23503 OR 23514)
with three single-coordinate-mismatch cases attributed to the named
guard: B1 correlation_id mismatch (23514), B2 reason_code mismatch
(23514), B3 attempt_id mismatch (23503 via deferred FK).
- Admission test: adds negative C -- mismatched request_fingerprint
rejected by the immediate composite FK (23503) at INSERT, proving
the coordinate binding half of Carl finding 2.
All four changed files byte-identical between migration files and
schema/schema.sql (verified by extraction+cmp). All 5 NIP-FI tests,
admin_schema_parity, and 2 unit tests pass.
Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Hayt <9e1c23a3fd83f61da34420e4e88ff1b16e45cafcc0cd9019eb07d4ecfa8ca9b0@buzz.block.builderlab.xyz>