cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

docs(security): trace attachment owner filters to relational proof

Browse Source
This commit is contained in:
cesnimda
2026-11-02 23:10:27 +01:00
parent 0a17a33db7
commit 88bcd6d91c
3 changed files with 17 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/security/ENDPOINT_AUTH_MATRIX.csv
+4 -3
View File
@@ -1,7 +1,8 @@
method,route,source,declared_auth,control_observed,sensitive_asset_or_effect,candidate_test_suite,audit_execution
GET,/api/attachments/{jobId:int},AttachmentsController.cs:87,local scheme,job query before attachment listing; filter audit pending,attachment metadata,AttachmentsControllerTests,NOT RUN
GET,/api/attachments/download/{id:int},AttachmentsController.cs:103,local scheme,owned helper and managed path checks,attachment bytes,AttachmentsControllerTests,NOT RUN
PATCH,/api/attachments/{id:int},AttachmentsController.cs:125,local scheme,owned helper; mutation review pending,metadata and AI-use flag,AttachmentsControllerTests,NOT RUN
GET,/api/attachments/{jobId:int},AttachmentsController.cs:87,local scheme,parent owner-filtered existence check before child listing,attachment metadata,AttachmentConsistencyTests,source reviewed; negative list and HTTP NOT RUN
GET,/api/attachments/download/{id:int},AttachmentsController.cs:103,local scheme,parent Include ownership filter and managed path checks,attachment bytes,AttachmentConsistencyTests,PASSED foreign-owner controller rejection; HTTP NOT RUN
PATCH,/api/attachments/{id:int},AttachmentsController.cs:125,local scheme,parent Include ownership filter via shared helper,metadata and AI-use flag,AttachmentConsistencyTests,PASSED foreign-owner controller rejection; HTTP NOT RUN
DELETE,/api/attachments/{id:int},AttachmentsController.cs:170,local scheme,parent Include ownership filter via shared helper,attachment removal,AttachmentConsistencyTests,PASSED foreign-owner controller rejection with row/file retained; HTTP NOT RUN
GET,/api/billing/status,BillingController.cs:42,local scheme,method declares local authentication,entitlement status,BillingControllerTests,NOT RUN
POST,/api/billing/checkout,BillingController.cs:58,local scheme,method declares local authentication; provider mocked only,checkout session,BillingControllerTests,NOT RUN
POST,/api/billing/portal,BillingController.cs:104,local scheme,method declares local authentication; provider mocked only,billing portal,BillingControllerTests,NOT RUN
1 method route source declared_auth control_observed sensitive_asset_or_effect candidate_test_suite audit_execution
2 GET /api/attachments/{jobId:int} AttachmentsController.cs:87 local scheme job query before attachment listing; filter audit pending parent owner-filtered existence check before child listing attachment metadata AttachmentsControllerTests AttachmentConsistencyTests NOT RUN source reviewed; negative list and HTTP NOT RUN
3 GET /api/attachments/download/{id:int} AttachmentsController.cs:103 local scheme owned helper and managed path checks parent Include ownership filter and managed path checks attachment bytes AttachmentsControllerTests AttachmentConsistencyTests NOT RUN PASSED foreign-owner controller rejection; HTTP NOT RUN
4 PATCH /api/attachments/{id:int} AttachmentsController.cs:125 local scheme owned helper; mutation review pending parent Include ownership filter via shared helper metadata and AI-use flag AttachmentsControllerTests AttachmentConsistencyTests NOT RUN PASSED foreign-owner controller rejection; HTTP NOT RUN
5 DELETE /api/attachments/{id:int} AttachmentsController.cs:170 local scheme parent Include ownership filter via shared helper attachment removal AttachmentConsistencyTests PASSED foreign-owner controller rejection with row/file retained; HTTP NOT RUN
6 GET /api/billing/status BillingController.cs:42 local scheme method declares local authentication entitlement status BillingControllerTests NOT RUN
7 POST /api/billing/checkout BillingController.cs:58 local scheme method declares local authentication; provider mocked only checkout session BillingControllerTests NOT RUN
8 POST /api/billing/portal BillingController.cs:104 local scheme method declares local authentication; provider mocked only billing portal BillingControllerTests NOT RUN