@delegance/claude-autopilot 7.4.3 → 7.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +100 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,106 @@
|
|
|
2
2
|
|
|
3
3
|
- v5.6 Phase 7 (docs reconciliation) — pending.
|
|
4
4
|
|
|
5
|
+
## 7.5.0 (2026-05-10)
|
|
6
|
+
|
|
7
|
+
**v7.5.0 — route-sensitivity-tiered membership revocation.** Minor
|
|
8
|
+
release. Closes W4 from the v7.4.1 codex strategic review without
|
|
9
|
+
adding infrastructure (Redis / Realtime / KV all rejected — see
|
|
10
|
+
`docs/specs/v7.5.0-route-sensitivity.md` for the trade-off analysis).
|
|
11
|
+
|
|
12
|
+
**Problem.** v7.0 Phase 6 caches `check_membership_status` for 60s
|
|
13
|
+
in an HMAC-signed cookie. Worst-case revocation window = 60s for
|
|
14
|
+
EVERY dashboard request, including admin-class mutations and
|
|
15
|
+
sensitive reads where ≤1-request revocation is the bar.
|
|
16
|
+
|
|
17
|
+
**Solution.** Split the policy by route sensitivity instead of
|
|
18
|
+
tightening globally:
|
|
19
|
+
|
|
20
|
+
| Tier | Revocation window | Behavior |
|
|
21
|
+
|---|---|---|
|
|
22
|
+
| LOW (default) | ≤60s | v7.0 cookie cache (no change) |
|
|
23
|
+
| HIGH (mutations + sensitive reads) | ≤1 request | Skip cookie, always RPC |
|
|
24
|
+
|
|
25
|
+
HIGH list (locked in code, codex-reviewed): mutations on any
|
|
26
|
+
`/api/dashboard/*` route + GETs under
|
|
27
|
+
`/api/dashboard/orgs/:id/{audit,cost,cost.csv,sso/**,members/**,billing/**}`
|
|
28
|
+
+ all `/api/dashboard/api-keys/*` (including GET — codex pass-2 W4
|
|
29
|
+
flagged the listing as sensitive).
|
|
30
|
+
|
|
31
|
+
**Defense in depth (codex pass-2 CRITICAL #3).** Middleware regex
|
|
32
|
+
matching is brittle — a new sensitive handler that's not yet in
|
|
33
|
+
`HIGH_SENSITIVITY_PATTERNS` would default to LOW. Mitigation: every
|
|
34
|
+
high-sensitivity route handler now calls
|
|
35
|
+
`assertActiveMembershipForOrg()` at the top as the inner correctness
|
|
36
|
+
gate. Middleware is the outer optimization (skips the cookie cache);
|
|
37
|
+
the handler call is the inner gate (doesn't depend on the regex
|
|
38
|
+
list staying in sync).
|
|
39
|
+
|
|
40
|
+
**Path-vs-active-org assertion (codex pass-2 CRITICAL #2).** For
|
|
41
|
+
high-sensitivity org-scoped routes the middleware also extracts
|
|
42
|
+
`:orgId` from the request path and asserts it matches the
|
|
43
|
+
`cao_active_org` cookie. A user active in Org A reaching an Org B
|
|
44
|
+
URL gets a 403/302 immediately — defense against a sloppy
|
|
45
|
+
downstream handler.
|
|
46
|
+
|
|
47
|
+
**New files:**
|
|
48
|
+
|
|
49
|
+
- `apps/web/lib/middleware/route-sensitivity.ts` (~85 LOC) —
|
|
50
|
+
`HIGH_SENSITIVITY_PATTERNS` + `isHighSensitivityRoute()`.
|
|
51
|
+
- `apps/web/lib/dashboard/assert-active-membership-for-org.ts`
|
|
52
|
+
(~165 LOC) — defense-in-depth helper + `respondToMembershipError()`
|
|
53
|
+
response builder.
|
|
54
|
+
- `apps/web/__tests__/middleware/route-sensitivity.test.ts` (24
|
|
55
|
+
cases — spec list of 7 + non-GET coverage + boundary regex tests
|
|
56
|
+
for codex pass-2 W4/W5).
|
|
57
|
+
- `apps/web/__tests__/middleware/revocation-integration.test.ts`
|
|
58
|
+
(8 cases — disabled-with-fresh-cookie + low-tier cache-still-wins
|
|
59
|
+
+ helper error-mapping integration).
|
|
60
|
+
- `apps/web/__tests__/lib/dashboard/assert-active-membership-for-org.test.ts`
|
|
61
|
+
(16 cases — 4 error codes + happy path + UUID validation +
|
|
62
|
+
respondToMembershipError variants).
|
|
63
|
+
|
|
64
|
+
**Modified files:**
|
|
65
|
+
|
|
66
|
+
- `apps/web/middleware.ts` — sensitivity branch BEFORE cookie verify;
|
|
67
|
+
parseOrgIdFromPath check on high-sensitivity routes; skip cookie
|
|
68
|
+
mint on high-sensitivity success.
|
|
69
|
+
- 10 route handlers wired with `assertActiveMembershipForOrg()` as
|
|
70
|
+
the first authorization step (members CRUD + invite + enable +
|
|
71
|
+
disable; org PATCH; audit; cost JSON + CSV; SSO disconnect +
|
|
72
|
+
required + setup + domains + verify).
|
|
73
|
+
|
|
74
|
+
**Test regressions promoted to v7.5.0 expectations:** 8 existing
|
|
75
|
+
tests that asserted the OLD pre-helper behavior (non-member → 404
|
|
76
|
+
via RPC's `not_admin`, disabled-user → `not_owner`/`not_admin`) now
|
|
77
|
+
assert the NEW uniform helper behavior (non-member → 403
|
|
78
|
+
`no_membership`; disabled-user → 403 `member_disabled`). Status
|
|
79
|
+
codes unchanged for the disabled-user cases; status code for
|
|
80
|
+
non-member shifted from 404 → 403 with a non-enumerating body code.
|
|
81
|
+
Comments inline in each updated test point at this v7.5.0 trade-off.
|
|
82
|
+
|
|
83
|
+
**Test count:** 621 → 669 (+48 web). CLI suite unchanged at 1606
|
|
84
|
+
(no CLI changes).
|
|
85
|
+
|
|
86
|
+
**Codex traceability:**
|
|
87
|
+
|
|
88
|
+
| Finding | Resolution |
|
|
89
|
+
|---|---|
|
|
90
|
+
| Pass-1 C1 (W4 not closed) | Reframed: route-tier closes the security/compliance subset of W4. |
|
|
91
|
+
| Pass-1 C2 (Vercel/ECS confusion) | False positive — explicit deployment-context section in spec. |
|
|
92
|
+
| Pass-1 W1 (Redis ROI) | False positive — autopilot.dev has no Redis. |
|
|
93
|
+
| Pass-1 W3 (route-sensitivity split) | **Adopted as the central design.** |
|
|
94
|
+
| Pass-2 CRITICAL #2 (path-vs-activeOrg) | `parseOrgIdFromPath` + middleware assertion. |
|
|
95
|
+
| Pass-2 CRITICAL #3 (regex bypass risk) | `assertActiveMembershipForOrg()` defense-in-depth helper called at top of every HIGH handler. |
|
|
96
|
+
| Pass-2 W4 (api-keys GET sensitivity) | `/api/dashboard/api-keys/*` (including GET) added to HIGH list. |
|
|
97
|
+
| Pass-2 W5 (boundary pattern correctness) | Anchored regex with explicit `/`/`$` terminator; tests cover `/costume`, `/auditor`, trailing-slash, nested-path. |
|
|
98
|
+
|
|
99
|
+
**Out of scope.** Vercel KV / Realtime websocket (deferred), JWT-
|
|
100
|
+
side revocation (v7.1 already collapses ingest to ≤1 request),
|
|
101
|
+
configurable sensitivity classification (locked in code on purpose),
|
|
102
|
+
wrapper `withActiveMembershipRequired()` decorator (deferred to
|
|
103
|
+
v7.6+ refactor; the explicit call is sufficient for v7.5.0).
|
|
104
|
+
|
|
5
105
|
## 7.4.3 (2026-05-11)
|
|
6
106
|
|
|
7
107
|
**v7.4.3 — FastAPI scaffold respects spec-derived package name.**
|