stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Require fresh authorization and audit CI job reruns #1481

New Issue
Closed
opened 2026-08-27 19:59:43 +00:00 by timmy · 0 comments
timmy commented 2026-08-27 19:59:43 +00:00
Owner
Copy Link

Problem

The dashboard can rerun failed pull-request and post-merge release jobs using only an active browser session. Unlike adjacent merge, close, Human Gate, and rollback actions, these mutations are neither fresh-authorized nor written to Security activity. A stolen active session can therefore trigger deployment-capable workflow jobs without possession of a passkey/access token and without durable operator evidence.

Vertical slice

Require a single-use fresh-authorization grant for both CI rerun routes, bound to repository, pull, exact SHA, run ID, and job index. Fail closed if the Security activity reservation is unavailable; discard reservations when revalidation rejects the rerun; finalize a principal-scoped ci_job_retried event after Gitea queues it. Render the event as CI job retried in Security Center. Existing session fetch retry behavior supplies the fresh-authorization UI.

Acceptance tests

  • Missing or target-mismatched grants return 428 before any Gitea mutation.
  • An exact grant queues one rerun; replay cannot queue another.
  • Security-journal reservation failure returns 503 before contacting Gitea.
  • Stale/non-failed jobs discard the pending reservation.
  • Successful pull-check and release-check reruns finalize one principal-scoped event with the exact target.
  • Security Center labels the event CI job retried.
  • Focused tests and the full suite pass.

Non-duplication evidence

Audited all 744 issue titles (8 open, 736 closed) and the latest 300 commits at origin/main 1484c57. No issue or recent commit covers fresh-authorizing or auditing CI job reruns; prior fresh-authorization issues cover other mutations.

## Problem The dashboard can rerun failed pull-request and post-merge release jobs using only an active browser session. Unlike adjacent merge, close, Human Gate, and rollback actions, these mutations are neither fresh-authorized nor written to Security activity. A stolen active session can therefore trigger deployment-capable workflow jobs without possession of a passkey/access token and without durable operator evidence. ## Vertical slice Require a single-use fresh-authorization grant for both CI rerun routes, bound to repository, pull, exact SHA, run ID, and job index. Fail closed if the Security activity reservation is unavailable; discard reservations when revalidation rejects the rerun; finalize a principal-scoped `ci_job_retried` event after Gitea queues it. Render the event as `CI job retried` in Security Center. Existing session fetch retry behavior supplies the fresh-authorization UI. ## Acceptance tests - Missing or target-mismatched grants return 428 before any Gitea mutation. - An exact grant queues one rerun; replay cannot queue another. - Security-journal reservation failure returns 503 before contacting Gitea. - Stale/non-failed jobs discard the pending reservation. - Successful pull-check and release-check reruns finalize one principal-scoped event with the exact target. - Security Center labels the event `CI job retried`. - Focused tests and the full suite pass. ## Non-duplication evidence Audited all 744 issue titles (8 open, 736 closed) and the latest 300 commits at origin/main `1484c57`. No issue or recent commit covers fresh-authorizing or auditing CI job reruns; prior fresh-authorization issues cover other mutations.
timmy self-assigned this 2026-08-27 19:59:43 +00:00
timmy closed this issue 2026-08-27 20:20:51 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#1481
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?