List of issues Needing Fixed #1

New issue

Open

opened 2024-10-25 00:44:23 +00:00 by lost-rob0t · 3 comments

lost-rob0t commented

2024-10-25 00:44:23 +00:00

(Migrated from github.com)

Security

No Auth Currently
Fix from json
sec for couchdb via design documents (ie check ownership of document)

Just bad

the number of random issues that i have yet to go back and look at.

# Security - No Auth Currently - Fix from json - sec for couchdb via design documents (ie check ownership of document) # Just bad the number of random issues that i have yet to go back and look at.

lost-rob0t commented

2025-03-05 04:32:28 +00:00

(Migrated from github.com)

TODO: maybe some sort of script to take all the TODOS/FIXME/HACKS into issues
Again do not use this project as it is APLHA QUALITY

TODO: maybe some sort of script to take all the TODOS/FIXME/HACKS into issues Again do not use this project as it is APLHA QUALITY

lost-rob0t commented

2026-07-22 00:23:16 +00:00

(Migrated from github.com)

The July 21, 2026 dev/master audit has been decomposed into the ordered roadmap in #9, with granular implementation issues #10 through #53. This legacy catch-all remains useful as historical context, but new work should follow #9 rather than adding more unrelated bullets here. No branches were moved or merged during the audit.

The July 21, 2026 `dev`/`master` audit has been decomposed into the ordered roadmap in #9, with granular implementation issues #10 through #53. This legacy catch-all remains useful as historical context, but new work should follow #9 rather than adding more unrelated bullets here. No branches were moved or merged during the audit.

lost-rob0t commented

2026-07-26 00:40:48 +00:00

(Migrated from github.com)

Implementation is blocked because #1 is now explicitly a historical catch-all, not an actionable implementation unit.

Repository evidence:

The July 22 owner comment on this issue says new work must follow the ordered roadmap in #9 and granular issues #10–#53.
#9 requires one active implementation issue at a time and ordered execution. Only #10 is complete; #11 is the next open P0 item.
“Fix from json” is decomposed into #11 (shared conformance fixtures), #12 (remove the duplicate server codec), and the cross-repository dependency in #13 (repair and pin the canonical star-cl codec).
“No Auth Currently” and document ownership are decomposed into #26 (threat model and principal/capability contract), #27 (authenticated request context and API-key lifecycle, explicitly dependent on #26), and #28 (capability/tenant/dataset/actor/target authorization).
Current dev confirms the defects but supplies no missing policy: HTTP routes have no auth context, CORS is wildcard, couchdb-auth-database is unused, CouchDB is accessed through one server credential, and the duplicate from-json implementation remains. A CouchDB validate_doc_update ownership rule cannot safely infer an API principal from that shared server credential.

Implementing all of those concerns on the issue-1 branch would bypass the declared dependencies, duplicate the granular work, and require speculative security decisions (principal types, credential lifecycle, scope semantics, ownership fields, trusted internal callers, and enforcement boundaries).

Please retarget this implementation run to the next ordered granular issue (#11), or provide explicit acceptance criteria that supersede #9 and state which granular issues #1 is intended to complete. No repository changes were made.

Implementation is blocked because #1 is now explicitly a historical catch-all, not an actionable implementation unit. Repository evidence: - The July 22 owner comment on this issue says new work must follow the ordered roadmap in #9 and granular issues #10–#53. - #9 requires one active implementation issue at a time and ordered execution. Only #10 is complete; #11 is the next open P0 item. - “Fix from json” is decomposed into #11 (shared conformance fixtures), #12 (remove the duplicate server codec), and the cross-repository dependency in #13 (repair and pin the canonical star-cl codec). - “No Auth Currently” and document ownership are decomposed into #26 (threat model and principal/capability contract), #27 (authenticated request context and API-key lifecycle, explicitly dependent on #26), and #28 (capability/tenant/dataset/actor/target authorization). - Current dev confirms the defects but supplies no missing policy: HTTP routes have no auth context, CORS is wildcard, *couchdb-auth-database* is unused, CouchDB is accessed through one server credential, and the duplicate from-json implementation remains. A CouchDB validate_doc_update ownership rule cannot safely infer an API principal from that shared server credential. Implementing all of those concerns on the issue-1 branch would bypass the declared dependencies, duplicate the granular work, and require speculative security decisions (principal types, credential lifecycle, scope semantics, ownership fields, trusted internal callers, and enforcement boundaries). Please retarget this implementation run to the next ordered granular issue (#11), or provide explicit acceptance criteria that supersede #9 and state which granular issues #1 is intended to complete. No repository changes were made.