cesnimda
0954876295
Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.
23 lines
1.7 KiB
JSON
23 lines
1.7 KiB
JSON
{
|
|
"ticket": "B04",
|
|
"date": "2026-09-08",
|
|
"boundary": "Real local API, authentication, endpoint authorization, partitioned rate limiter, B02 middleware and synthetic SQLite data",
|
|
"before": {
|
|
"accountAStatuses": [200, 200],
|
|
"accountBStatusesOnSameIP": [429, 429],
|
|
"safeAssertionFailed": true
|
|
},
|
|
"after": {
|
|
"aFirst": { "A": { "admitted": 2, "rejected": 1 }, "B": { "admitted": 2, "rejected": 1 } },
|
|
"bFirst": { "A": { "admitted": 2, "rejected": 1 }, "B": { "admitted": 2, "rejected": 1 } },
|
|
"concurrent": { "sessionsPerAccount": 2, "auth": ["cookie", "bearer"], "admitted": 4, "subsequentRejectedAcrossOtherIPs": 4 },
|
|
"craftedEmailSendOwner": { "B": { "chargedAttempts": 10, "rejectedByRateLimit": 1 }, "A": { "chargedAttempts": 10, "rejectedByRateLimit": 1 }, "emailsSent": 0, "staleOrForgedContextStatusBeforeExhaustion": 409 },
|
|
"invalidCredentials": { "categories": 7, "protectedAccountEndpointStatus": 401, "accountPartitionReached": false, "anonymousLoginScope": "IP; 10 admitted validation attempts then 429 per IP" },
|
|
"untrustedProxyHeaders": { "source": "127.0.0.2", "admittedValidationAttempts": 10, "changedForwardedHeadersCannotEvade429": true, "secondSource127_0_0_3Status": 400 },
|
|
"rateResponse": { "status": 429, "retryAfterSeconds": "positive fixed-window lease metadata", "cacheControl": "no-store", "code": "rate_limit_exceeded" }
|
|
},
|
|
"finalOrder": "Existing CSRF, authentication, endpoint authorization, rate limiting, B02 session context, controller",
|
|
"scopeLimits": "Process-local policy counters; live external OAuth and production ingress not exercised. IP security policies and B03 global rendering admission remain distinct.",
|
|
"originalEvidencePreserved": true
|
|
}
|