forgedock 1.21.0 → 1.23.0

package/scripts/review-roster.sh

@@ -183,7 +183,20 @@ if [ "$CHURN" = "true" ] || [ "$DANGER" = "true" ]; then
     for d in $(top_domains 1); do add_agent "$d"; trig churn-or-danger-zone; done
 fi
 hit() { printf '%s\n' "$FILES" | grep -qiE "$1"; }
-hit '(^|[/_.-])(auth([^o]|o[^r]|$)|authori[sz]|oauth|session|jwt|login|logout|passw(or)?d|permission|rbac|acl([/_.-]|$)|tokens?([/_.-]|$)|api[-_]?keys?|credential|trust[-_]?filter|trusted[-_a-z]*)|(^|/)deps\.py$' && { add_agent Auth; trig auth-path; }
+# Auth path gate (forge#4071). Docs and prose are never auth by path (the content gate still applies). Strong names match
+# any path segment; weak names (session, login, permission, token) only as a whole word in a code file outside design-system
+# and asset dirs, so design-tokens/, SessionTimeline.tsx, LoginButton.tsx and cursor-token files do not spawn Auth. A CamelCase
+# weak name, leading or after a CamelCase prefix (LoginController.java, RefreshTokenService.java), still counts outside UI
+# component files and dirs.
+AUTH_FILES=$(printf '%s\n' "$FILES" | grep -viE '(^|/)docs?/|\.(md|mdx|markdown|rst|adoc|txt)$' || true)
+AUTH_CODE=$(printf '%s\n' "$AUTH_FILES" | grep -iE '\.(py|pyi|ts|tsx|js|jsx|mjs|cjs|go|rb|java|kt|kts|scala|rs|php|cs|ex|exs|swift|c|cc|cpp|h|hpp|sh|bash|lua|dart|groovy|pl|vue|svelte)$' \
+    | grep -viE '(^|/)(design[-_]?(system|tokens?)|assets?|static|images?|icons?|fonts?|styles?|themes?)/' || true)
+if printf '%s\n' "$AUTH_FILES" | grep -qiE '(^|[/_.-])(auth([^o]|o[^r]|$)|authori[sz]|oauth|jwt|passw(or)?d|rbac|acl([/_.-]|$)|api[-_]?keys?|credential|trust[-_]?filter|trusted[-_a-z]*)|(^|/)deps\.py$' \
+    || printf '%s\n' "$AUTH_CODE" | grep -qiE '(^|[/_])(sessions?|login|logout|permissions?|tokens?)([/_.-]|$)' \
+    || printf '%s\n' "$AUTH_CODE" | grep -viE '\.(tsx|jsx|vue|svelte)$|(^|/)(components?|pages|views|ui|widgets)/' \
+        | grep -qE '((^|[/_])([Ss]essions?|[Ll]ogin|[Ll]ogout|[Pp]ermissions?|[Tt]okens?)|[a-z0-9](Sessions?|Login|Logout|Permissions?|Tokens?))([A-Z]|[/_.-]|$)'; then
+    add_agent Auth; trig auth-path
+fi
 hit '^\.github/|(^|/)Dockerfile|docker-compose|(^|/)(docker-)?compose[^/]*\.ya?ml$|(^|/)deploy[^/]*\.sh$|(^|/)docker-entrypoint[^/]*$|(^|/)(deploy|infra|traefik|nginx|k8s|helm|terraform)/|\.tf$' && { add_agent Infra; trig infra-path; }
 hit 'migration|\.sql$' && { add_agent Database; trig migration-path; }
 hit '^sdk/|openapi.*\.json$|openapi-versions/' && { add_agent API; trig sdk-path; }

package/scripts/review-roster.test.sh

@@ -130,6 +130,19 @@ run "docs/author.md" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
 expect_not "no auth path docs/author.md" auth
 run "svc/tokenizer.py" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
 expect_not "no-auth-path-svc/tokenizer.py" auth
+# forge#4071: weak names (session, token, permission, login) select Auth only as whole words in code files; docs never
+for f in design-tokens/colors.json src/SessionTimeline.tsx docs/permissions.md src/components/LoginButton.tsx src/editor/cursor-token.ts docs/auth.md \
+    src/components/LoginForm.ts svc/tokenizer.py src/JsonTokenizer.java src/components/UserSessionBadge.ts; do
+  run "$f" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+  expect_not "no-auth-path-$f" auth
+done
+for f in src/auth/session.py api/tokens.py middleware/permissions.ts lib/jwt.go src/session/store.ts svc/login_handler.go \
+    src/main/java/com/x/LoginController.java src/main/java/com/x/SessionManager.java src/TokenService.kt src/PermissionChecker.cs middleware/PermissionGuard.ts \
+    src/main/java/com/x/RefreshTokenService.java src/AccessTokenValidator.kt src/main/java/com/x/UserSessionManager.java \
+    src/CsrfTokenFilter.java src/AdminPermissionChecker.cs src/OtpLoginHandler.ts src/main/java/com/x/RefreshToken.java; do
+  run "$f" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+  expect_has "auth-path-$f" auth
+done
 run "commands/review-pr.md" --scores "AUTH=3 INFRA=0 DATABASE=0 BILLING=0 CONCURRENCY=0" --changed-lines 20 --changed-files 1
 expect_not "auth-from-prose-score-alone" auth
 run "commands/review-pr.md" --scores "AUTH=3 INFRA=3 DATABASE=0 BILLING=0 CONCURRENCY=0" --changed-lines 120

package/bin/lean/risk.mjs

@@ -1,49 +0,0 @@
-// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
-// SPDX-License-Identifier: AGPL-3.0-or-later
-/** Lean path (#4081): deterministic path/keyword helpers. Pure, codebase-agnostic, no model calls. */
-
-const RISK_PATH = /(^|[/._-])(auth|authn|authz|oauth|login|session|crypto|cipher|secret|secrets|credential|credentials|token|permission|permissions|acl|rbac|migration|migrations|payment|payments|billing|stripe)([/._-]|$)|^\.github\/workflows\//i;
-const RISK_KEYWORD = /\b(auth\w*|crypto\w*|secret\w*|permission\w*|migration\w*|payment\w*)\b/i;
-
-/** @returns {{tier:"high"|"low", reasons:string[]}} */
-export function riskTier(files = [], text = "") {
-  const reasons = [];
-  for (const f of files) if (RISK_PATH.test(f)) reasons.push(`path:${f}`);
-  const kw = RISK_KEYWORD.exec(String(text));
-  if (kw) reasons.push(`keyword:${kw[1].toLowerCase()}`);
-  return { tier: reasons.length ? "high" : "low", reasons };
-}
-
-const DOC_FILE = /(\.(md|mdx|rst|txt|adoc)$)|(^|\/)(docs?|documentation)\//i;
-export const isDocsOnly = (files) => files.length > 0 && files.every((f) => DOC_FILE.test(f));
-
-const TEST_FILE = /(^|\/)(tests?|__tests__|spec|specs|e2e)\/|\.(test|spec)\.[a-z0-9]+$|_(test|spec)\.[a-z0-9]+$|(^|\/)test_[^/]+\.[a-z0-9]+$|Tests?\.(java|kt|cs|swift|scala)$/i;
-export const isTestFile = (f) => TEST_FILE.test(f);
-
-export const LARGE_DIFF = { files: 15, lines: 400 };
-export const isLargeDiff = ({ files = 0, lines = 0 } = {}) => files >= LARGE_DIFF.files || lines >= LARGE_DIFF.lines;
-
-/** `auto` goes full only when risk is high AND the diff is large; lean otherwise. */
-export function choosePath(requested, risk, stats) {
-  if (requested === "lean" || requested === "full") return requested;
-  return risk?.tier === "high" && isLargeDiff(stats) ? "full" : "lean";
-}
-
-/** Blocking = CRITICAL/HIGH, or CONFIRMED MEDIUM in introduced code. */
-export function isBlocking(f) {
-  const sev = String(f?.severity ?? "").toUpperCase();
-  if (sev === "CRITICAL" || sev === "HIGH") return true;
-  return sev === "MEDIUM" && String(f?.confidence ?? "").toUpperCase() === "CONFIRMED"
-    && String(f?.scope ?? "introduced").toLowerCase() === "introduced";
-}
-
-/** Extract the findings array from a reviewer reply (last json fence, else first [...]). null when unparseable. */
-export function parseFindings(text) {
-  const s = String(text ?? "");
-  const fences = [...s.matchAll(/```(?:json)?\s*([\s\S]*?)```/g)].map((m) => m[1]);
-  const cands = [...fences.reverse(), s.slice(s.indexOf("["), s.lastIndexOf("]") + 1)];
-  for (const c of cands) {
-    try { const v = JSON.parse(c.trim()); if (Array.isArray(v)) return v.filter((x) => x && typeof x === "object"); } catch { /* next */ }
-  }
-  return null;
-}