audit: cross-tenant tenancy audit — report, seed regression test, probe invariants - #93
Conversation
🤖 CodeAnt AI — Review Status
|
✅ Deploy Preview for moderaty ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Warning Review limit reached
Next review available in: 7 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
codeant-ai
Bot
added
the
size:L
Sequence DiagramThis PR adds a two tenant regression test proving session renewal and organization repair update only the requesting user's session, plus read only database probes that detect invalid tenant state and orphaned channel records. sequenceDiagram
participant Test Runner
participant Session Handler
participant Database
participant Tenancy Probe
Test Runner->>Database: Seed two tenant sessions
Test Runner->>Session Handler: Renew and repair user A session
Session Handler->>Database: Update session A by token
Database-->>Session Handler: Return repaired session
Test Runner->>Database: Verify session B is unchanged
Tenancy Probe->>Database: Check session membership invariants
Tenancy Probe->>Database: Check channel ownership and row references
Database-->>Tenancy Probe: Return zero violations
Generated by CodeAnt AI |
🏁 CodeAnt Quality Gate ResultsCommit: ✅ Overall Status: PASSEDQuality Gate Details
|
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR implements a thorough cross-tenant security audit with comprehensive coverage across documentation, runtime verification, and regression tests. The changes successfully address the reported session management concern with a strong verdict (NOT PRESENT on main) backed by executable tests.
Key Strengths:
- All 6 new tenancy invariants have corresponding behavior tests that verify both pass and fail scenarios
- The verification script includes proper error containment (broken queries fail loudly rather than aborting)
- Test coverage includes edge cases like legacy probe IDs, missing tables, and wrong constraint names
- The new session regression test validates isolation by checking byte-identical state preservation
Verification Confirmed:
- All 468 tests passing (per PR description)
- Build and type checks clean
- Live probe against dev database: ALL 15 CHECKS PASSED
The implementation is merge-ready.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | ✅ 4 (≤ 100 complexity) |
| Duplication | ✅ 0 (≤ 1 duplication) |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
PR Summary by QodoAudit cross-tenant tenancy: report, session regression test, probe invariants
AI Description
Diagram
High-Level Assessment
Files changed (4)
|
Code Review by Qodo
1.
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
… rows only on violation
codeant-ai
Bot
added
size:L
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
Triage of all bot reviews on this PR:
Post-fix verification: 468/468 tests green, probe behavior tests 11/11, live dev-DB run passes all 15 checks. |
|
|
Tip For best results, initiate chat on the files or code changes.
You are interacting with an AI system. |
Triage looks complete. Both Qodo findings are implemented: finding 1 (tab indentation) and finding 2 ( |
|
Question: - @qodo-code-review[bot] — both findings valid, fixed in c295a14 (tab indentation in
post-fix verification: 468/468 tests green, probe behavior tests 11/11, live dev-db run passes all 15 checks. Answer:
One scope clarification: the new orphan checks verify that rows reference an existing channel, not that every row’s channel belongs to the acting tenant. That ownership guarantee is provided by the handler-level |
1 participant
User description
Summary
Cross-tenant audit triggered by the reported finding: "session renewal/repair UPDATEs without their WHERE (cross-tenant session rewrite)".
Seed verdict: NOT present on main. Both session UPDATEs (
session.ts:124,128) carry.where(eq(sessions.id, token)). A two-tenant regression test now proves renewing/repairing user A's session never touches user B's row (passes on current code — documented as the verdict).Full handler inventory: no breaches found. Every handler boundary scopes by
ownedChannel(org match → 404) or membership/role checks; the id-only UPDATEs in queue/log actions are safe because a channel-scoped claim/pair-select precedes them in the same action. Existing tests already cover cross-tenant 404s everywhere. Details and edge notes indocs/tenancy-audit.md.What ships
src/lib/server/session.test.ts— seed regression test for the reported finding.docs/tenancy-audit.md— audit report: tenancy key model, per-surface verdicts, edge notes, runbook, handoff recommendations (FK oncomments.channel_id→ DB agent; CI wiring → maintainer).scripts/verify-tenancy.mjs— 6 new read-only invariants: sessions never act in an org the user isn't a member of; zero orphanedchannel_idrows in comments/moderation_actions/audit_log/rules; zero channels in memberless orgs. Each has a failing behavior test inverify-tenancy.test.mjs.Verification
npm run test— 468/468 green (11 probe tests incl. new ones)npm run check— 0 errors, 0 warningsnpm run build— cleanCodeAnt-AI Description
Add cross-tenant safety checks and verify session isolation
What Changed
Impact
✅ Prevents cross-tenant session changes✅ Detects orphaned tenant data✅ Flags inaccessible organization channels✅ Faster healthy-database verification💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.