stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Require fresh authorization and audit comment deletion #779

New Issue
Closed
opened 2026-08-13 22:50:10 +00:00 by timmy · 0 comments
timmy commented 2026-08-13 22:50:10 +00:00
Owner
Copy Link

User problem

Permanent deletion of an authored conversation comment currently relies only on the ambient dashboard session and browser confirmation. A stolen unlocked session can irreversibly remove comments without a biometric/token challenge or durable Security activity evidence.

Scope

  • Require a single-use fresh-authorization grant bound to the exact repository, issue, and comment before deletion from assigned issues, assigned pull requests, or unread-update conversations.
  • Reserve and finalize a privacy-bounded comment_deleted Security activity event around the upstream deletion.
  • Preserve truthful outcomes: reject before deletion when journaling cannot start; discard on definite upstream failure; retain pending evidence when deletion succeeds but finalization fails.
  • Label the event in Security activity and document the protected action.

Acceptance tests

  1. All three delete surfaces return 428 step_up_required in operator mode without a grant and make no upstream delete call.
  2. A valid exact-target grant permits deletion; grants for another comment fail and grants remain single-use.
  3. Journal reservation failure leaves the comment untouched; definite upstream failure discards the reservation.
  4. Confirmed deletion succeeds even when finalization fails, leaving pending evidence.
  5. Security activity stores only owner/repo#number:comment_id, never comment text or credentials.
  6. Existing browser passkey-first/token-fallback retry handles DELETE and the full test suite stays green.

Non-duplication evidence

Current origin/main (9d14fa5) exposes direct deletion in src/main.py without _require_step_up or SecurityEventStore use. Historical #575 shipped comment edit/delete itself; #341/#493/#497 established authorization and journaling for other high-impact actions. No open issue, historical title, or recent commit covers fresh-authorized audited comment deletion.

## User problem Permanent deletion of an authored conversation comment currently relies only on the ambient dashboard session and browser confirmation. A stolen unlocked session can irreversibly remove comments without a biometric/token challenge or durable Security activity evidence. ## Scope - Require a single-use fresh-authorization grant bound to the exact repository, issue, and comment before deletion from assigned issues, assigned pull requests, or unread-update conversations. - Reserve and finalize a privacy-bounded `comment_deleted` Security activity event around the upstream deletion. - Preserve truthful outcomes: reject before deletion when journaling cannot start; discard on definite upstream failure; retain pending evidence when deletion succeeds but finalization fails. - Label the event in Security activity and document the protected action. ## Acceptance tests 1. All three delete surfaces return `428 step_up_required` in operator mode without a grant and make no upstream delete call. 2. A valid exact-target grant permits deletion; grants for another comment fail and grants remain single-use. 3. Journal reservation failure leaves the comment untouched; definite upstream failure discards the reservation. 4. Confirmed deletion succeeds even when finalization fails, leaving pending evidence. 5. Security activity stores only `owner/repo#number:comment_id`, never comment text or credentials. 6. Existing browser passkey-first/token-fallback retry handles DELETE and the full test suite stays green. ## Non-duplication evidence Current `origin/main` (`9d14fa5`) exposes direct deletion in `src/main.py` without `_require_step_up` or SecurityEventStore use. Historical #575 shipped comment edit/delete itself; #341/#493/#497 established authorization and journaling for other high-impact actions. No open issue, historical title, or recent commit covers fresh-authorized audited comment deletion.
timmy self-assigned this 2026-08-13 22:50:10 +00:00
timmy closed this issue 2026-08-13 22:58:02 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#779
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?