stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Bind background push delivery to upstream operator identity #1374

New Issue
Closed
opened 2026-08-25 02:00:47 +00:00 by rockachopa · 0 comments
rockachopa commented 2026-08-25 02:00:47 +00:00
Member
Copy Link

Problem

Managed browser sessions are bound to an upstream Gitea principal for protected HTTP requests, but background push workers authorize only session liveness. After the process credential changes to a different Gitea account, a prior operator device can continue receiving unread, Following, deadline, and start-day metadata until session expiry.

Vertical slice

Bind batched push authorization to the current upstream principal across every push channel. Preserve delivery for same-user token rotation, fail closed without deleting subscriptions when identity lookup is unavailable, and retire subscriptions for sessions bound to a different or legacy-unbound principal.

Acceptance tests

  • Batched session status accepts an expected principal and marks mismatched or legacy-unbound sessions non-active in one query.
  • Matching-principal subscriptions deliver for all four push channels.
  • Mismatched and legacy-unbound subscriptions do not deliver and are retired.
  • Identity lookup failure sends nothing but preserves subscriptions for retry.
  • Existing session expiry/revocation and push failure-isolation behavior remains green.

Evidence

src/main.py enforces session.principal_id for protected requests, while push workers receive dashboard_auth.managed_session_statuses; src/session_store.py currently selects no principal_id in that batch lookup. No open/closed issue title or recent commit covers identity-bound background push delivery.

## Problem Managed browser sessions are bound to an upstream Gitea principal for protected HTTP requests, but background push workers authorize only session liveness. After the process credential changes to a different Gitea account, a prior operator device can continue receiving unread, Following, deadline, and start-day metadata until session expiry. ## Vertical slice Bind batched push authorization to the current upstream principal across every push channel. Preserve delivery for same-user token rotation, fail closed without deleting subscriptions when identity lookup is unavailable, and retire subscriptions for sessions bound to a different or legacy-unbound principal. ## Acceptance tests - Batched session status accepts an expected principal and marks mismatched or legacy-unbound sessions non-active in one query. - Matching-principal subscriptions deliver for all four push channels. - Mismatched and legacy-unbound subscriptions do not deliver and are retired. - Identity lookup failure sends nothing but preserves subscriptions for retry. - Existing session expiry/revocation and push failure-isolation behavior remains green. ## Evidence `src/main.py` enforces `session.principal_id` for protected requests, while push workers receive `dashboard_auth.managed_session_statuses`; `src/session_store.py` currently selects no `principal_id` in that batch lookup. No open/closed issue title or recent commit covers identity-bound background push delivery.
timmy was assigned by rockachopa 2026-08-25 02:00:47 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#1374
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?