gamertan
5905fe6fb2
Publish the reviewed Web Foundations v0.1.0-preview.3 snapshot with cryptographic temporary credentials, explicit forced-rotation state, atomic password replacement and session revocation, additive SQLite migration, tests, and application-boundary documentation. Exported from reviewed private source b8fb4ff3cd012859f2d307dfb2a1cc783a38f6db after trusted CI run 257 and exact Go 1.26.6 verification. Material implementation assistance provided by OpenAI Codex; reviewed and verified through the maintainer workflow. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
2.6 KiB
Threat model
The toolkit treats the public network, forwarding headers, request targets, cookies, credentials, and stored request records as untrusted. Application code, the configured trusted-proxy set, server filesystem permissions, and explicitly selected storage adapters are trusted.
Controls include explicit proxy trust, bounded parsing, cryptographic request and session identifiers, digest-only session storage, Argon2id passwords, constant-time comparisons, same-origin and CSRF primitives, fail-closed storage errors, separate safe/sensitive analytics projections, organization-scoped bindings, single-use invitation digests, and short-lived audited break-glass grants.
An application may create an account with a cryptographically generated
temporary credential and RequirePasswordChange. Successful rotation compares
the current credential, replaces its Argon2id hash, clears the requirement, and
revokes every session in one repository transaction. The application must
restrict such a principal to password change and logout until rotation succeeds;
the library does not infer route policy. Temporary credentials must be written
to a private channel or mode-0600 file and must never be printed into logs,
manifests, process arguments, or deployment state.
Unsafe methods without an exact Origin or trustworthy same-origin Fetch
Metadata fail the origin check. Authentication middleware fails closed when its
service or __Host- cookie policy is invalid. Imported request records have
bounded byte and duration fields before analytics sums them.
The toolkit does not sandbox application handlers, secure an incorrectly configured reverse proxy, authorize application routes automatically, encrypt a compromised host, or decide how long an operator may lawfully retain personal request evidence.
Applications must pass the authenticated user and requested resource hierarchy
to access.Authorize; possessing a platform-level auth role does not bypass
that decision. Team membership is resolved by the repository rather than
accepted from request input. Break-glass access lasts at most one hour and is
not a substitute for ordinary role policy.
Local storage adapters assume the parent directory and host account are trusted. They reject a symlink at the configured final path and apply private file modes, but they do not defend against a concurrent privileged actor replacing path ancestors during an open. The synchronous JSONL adapter deliberately favors durable, bounded evidence over maximum request throughput; the application owns rotation, retention, disk monitoring, and health escalation.