fix(security): reconcile administrative audit on current main - #434
fix(security): reconcile administrative audit on current main#434seonghobae wants to merge 7 commits into
Conversation
|
Warning Review limit reached
Next review available in: 112 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Exact-current-head review request for @opencode-agent review |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== checked-out commit and base relation =='
git rev-parse HEAD
git merge-base HEAD 961f44a19c4ced87f8062b3ab9842a9a08d05235
git diff --stat 961f44a19c4ced87f8062b3ab9842a9a08d05235...HEAD
git diff --name-status 961f44a19c4ced87f8062b3ab9842a9a08d05235...HEAD
printf '%s\n' '== pull request metadata and checks =='
gh pr view 434 --repo ContextualWisdomLab/clearfolio \
--json number,title,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup
printf '%s\n' '== exact diff =='
git diff --find-renames --find-copies --no-ext-diff \
961f44a19c4ced87f8062b3ab9842a9a08d05235...HEADLength of output: 33361 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== changed class outlines =='
ast-grep outline src/main/java/com/clearfolio/viewer/audit/AdministrativeAuditLogger.java --items all
ast-grep outline src/main/java/com/clearfolio/viewer/security/AuditPseudonymizer.java --items all
printf '%s\n' '== administrative audit logger usages =='
rg -n -C 4 \
'(new\s+AdministrativeAuditLogger\b|AdministrativeAuditLogger\b|\.(recordHeaders|record|actorFingerprint)\s*\()' \
src/main/java src/test/java || true
printf '%s\n' '== administrative conversion-job operation candidates =='
rg -n -i -C 5 \
'(list.*job|job.*list|delete.*job|job.*delete|retry.*job|job.*retry|dead.?letter)' \
src/main/java/com/clearfolio/viewer
printf '%s\n' '== configuration and pseudonymizer implementation =='
config_file=$(fd -a '^ConversionProperties\.java$' src/main/java | head -n 1)
printf 'ConversionProperties: %s\n' "$config_file"
if [ -n "$config_file" ]; then
ast-grep outline "$config_file" --items all
rg -n -C 3 '(auditPseudonym|AuditPseudonym)' "$config_file"
fi
sed -n '1,260p' src/main/java/com/clearfolio/viewer/security/AuditPseudonymizer.javaLength of output: 143040
Add the logger to each administrative operation. Record allowed, denied, not-found, not-eligible, and failure outcomes. Add endpoint-level tests that assert the records. The exact head and base match the request. The check runs shown are successful. GitHub currently reports
|
|
@opencode-agent review Review exact head Review read-only; preserve independent reviewer identity. Do not wire this primitive into #440, mutate the branch, synthesize author approval, weaken protection, or merge. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='961f44a19c4ced87f8062b3ab9842a9a08d05235'
head='f0d275749811ceaf9f0d9fe0a300b15c86a853ad'
printf '%s\n' '== exact revisions =='
printf 'HEAD: '; git rev-parse HEAD
printf 'expected head: %s\n' "$head"
printf 'merge base: '; git merge-base HEAD "$base"
printf '%s\n' '== changed paths =='
git diff --name-status "$base...$head"
printf '%s\n' '== changed Java outlines =='
for f in \
src/main/java/com/clearfolio/viewer/audit/AdministrativeAuditLogger.java \
src/main/java/com/clearfolio/viewer/security/AuditPseudonymizer.java \
src/test/java/com/clearfolio/viewer/audit/AdministrativeAuditLoggerTest.java
do
if [ -f "$f" ]; then
printf '\n-- %s --\n' "$f"
ast-grep outline "$f" --items all || true
fi
done
printf '%s\n' '== exact patch =='
git diff --no-ext-diff --unified=80 "$base...$head" -- \
src/main/java/com/clearfolio/viewer/audit/AdministrativeAuditLogger.java \
src/main/java/com/clearfolio/viewer/security/AuditPseudonymizer.java \
src/test/java/com/clearfolio/viewer/audit/AdministrativeAuditLoggerTest.java
printf '%s\n' '== sensitive logging candidates in changed production files =='
rg -n -i -C 3 \
'(logger|log)\.(trace|debug|info|warn|error)\s*\(|StructuredArguments|keyValue|addKeyValue|MDC|headers?|token|filename|message|document|subject|tenant|job)' \
src/main/java/com/clearfolio/viewer/audit/AdministrativeAuditLogger.java \
src/main/java/com/clearfolio/viewer/security/AuditPseudonymizer.java || true
printf '%s\n' '== live PR metadata and checks =='
gh pr view 434 --repo ContextualWisdomLab/clearfolio \
--json headRefOid,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup,reviewsLength of output: 42030 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== AuditPseudonymizer remainder =='
sed -n '150,260p' src/main/java/com/clearfolio/viewer/security/AuditPseudonymizer.java
printf '%s\n' '== ConversionProperties audit configuration =='
config=$(fd -a '^ConversionProperties\.java$' src/main/java | head -n 1)
printf 'file: %s\n' "$config"
if [ -n "$config" ]; then
ast-grep outline "$config" --items all
rg -n -C 5 'AuditPseudonym|auditPseudonym' "$config"
fi
printf '%s\n' '== AdministrativeAuditLogger production and test references =='
rg -n -C 4 '\bAdministrativeAuditLogger\b|\.recordHeaders\s*\(|\.actorFingerprint\s*\(' \
src/main/java src/test/java || true
printf '%s\n' '== all logging calls and sensitive-value symbols in changed production code =='
rg -n -i -C 3 \
'(LOGGER\.(trace|debug|info|warn|error)\s*\(|LoggerFactory|getFirst\s*\(|tenantId|subjectId|jobId|headers|token|filename|message|document)' \
src/main/java/com/clearfolio/viewer/audit/AdministrativeAuditLogger.java \
src/main/java/com/clearfolio/viewer/security/AuditPseudonymizer.java
printf '%s\n' '== tests covering pseudonymizer contract =='
test=$(fd -a '^AuditPseudonymizerTest\.java$' src/test/java | head -n 1)
printf 'file: %s\n' "$test"
if [ -n "$test" ]; then
ast-grep outline "$test" --items all
rg -n -C 3 '(keyVersion|unavailable|absent|Administrative|fingerprint|domain)' "$test"
fiLength of output: 36545
I found no valid unresolved finding in this PR’s primitive-only scope.
The earlier request to wire GitHub still reports You are interacting with an AI system. |
|
Exact-current-head independent review request for The three-file administrative-audit foundation is mergeable; CI, Security Scan, SAST Semgrep, and fuzz are terminal-success; unresolved inline findings are zero. Actor, tenant, and job authority use separate keyed HMAC domains; raw headers, identifiers, tokens, filenames, messages, and document content never enter the fixed structured log template. Protected @opencode-agent review Review this exact head read-only. Do not mutate the branch, synthesize author approval, weaken protection, or merge. |
Rate Limit Exceeded
|
1 participant
Objective
Reconcile stale PR #363's privacy-safe administrative-audit primitive directly on the protected-main line, without importing divergent ancestry or racing the separate AdminController authorization slice #440.
Exact current-head evidence
961f44a19c4ced87f8062b3ab9842a9a08d05235;f0d275749811ceaf9f0d9fe0a300b15c86a853ad;AdministrativeAuditLogger.java, administrative-domain factories inAuditPseudonymizer.java, and the focused logger regression only;Privacy contract
Administrative actor, tenant, and conversion-job identifiers are transformed through separate keyed HMAC domains before structured logging. Raw claim headers, tenant/subject/job identifiers, tokens, filenames, job messages, and document content are never rendered. Missing identifiers and unavailable pseudonym authority use controlled markers; key-version metadata remains non-secret and bounded by the existing pseudonymizer contract.
Scope boundary
This PR establishes the reusable audit primitive only. It does not modify or authorize AdminController routes, change the documented
tenant:configureRBAC contract, persist an audit ledger, replace the broader privacy/telemetry architecture, or close the administrative-authorization gap. #440 owns controller authorization and tenant-safe operation semantics; subsequent wiring must consume this primitive in a separately reviewable slice after both foundations integrate.Merge gate
Keep this exact head unchanged. Auto-merge may act only after all live required checks remain successful, zero valid unresolved findings remain, and a qualifying independent non-author approval is attached to this exact head. If live protection requires an updated base, rebuild or update against protected
mainand regenerate all base-sensitive checks and reviews. No predecessor evidence transfers.