MechaCat02 27bda66be6 test(services): pin that the per-value byte caps reject before authz ...

CLAUDE.md calls the KV/docs/pubsub/queue value-size caps an anti-DoS rail:
oversized payloads are rejected "before authz so anonymous public scripts can't
DoS Postgres." Only queue had a test, and it used an allow-all authz + anon cx —
which catches a DROPPED cap but not a REORDERED one, because an anon cx passes
script_gate regardless.

Each service now has an ordering-proof test: a DENYING authz repo + an
AUTHENTICATED member cx, so a size-check-first service returns *TooLarge while an
authz-first one would return Forbidden. Each pairs it with an under-cap control
through the same denied cx (returns Forbidden) to prove the cx really is denied,
so the *TooLarge case genuinely bypassed authz. Queue's pre-existing test is
upgraded to the same shape (+ a shared member_cx helper).

Mutation-verified: moving the KV size check after authz flips its result to
Forbidden and the test fails.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-15 19:38:51 +02:00

..

abandoned_repo.rs

feat(v1.1.1-triggers): triggers + outbox schema + repos

2026-06-01 21:46:45 +02:00

admin_session_repo.rs

fix(security): server-authoritative approval gate + auth/session/file hardening

2026-07-11 23:47:35 +02:00

admin_user_repo.rs

feat(manager-core,picloud): accept email on admin create + patch

2026-05-27 19:27:52 +02:00

admin_users_api.rs

fix(audit-2026-06-11/revocation-lag): evict PrincipalCache on credential change

2026-06-12 18:12:54 +02:00

api_key_repo.rs

style: cargo fmt across Phase 3.5 changes

2026-05-26 22:21:37 +02:00

api_keys_api.rs

fix(security): server-authoritative approval gate + auth/session/file hardening

2026-07-11 23:47:35 +02:00

api.rs

feat(scripts): group-owned script admin API + pic scripts … --group

2026-06-25 20:10:20 +02:00

app_bootstrap.rs

feat(sealed): author + persist sealed group templates (§11 tail M2)

2026-07-01 19:32:20 +02:00

app_domain_repo.rs

feat(manager-core,orchestrator-core): multi-app scoping (Phase 3b)

2026-05-25 21:03:05 +02:00

app_members_api.rs

fix(api): make app_members POST and PATCH atomic

2026-05-27 22:00:04 +02:00

app_members_repo.rs

feat(groups): tree repos, hierarchy-aware RBAC, admin API

2026-06-24 19:59:00 +02:00

app_repo.rs

feat(groups): tree repos, hierarchy-aware RBAC, admin API

2026-06-24 19:59:00 +02:00

app_secrets_repo.rs

fix(audit-2026-06-11/H-D1): bind AES-GCM AAD on secrets + realtime signing key

2026-06-12 17:15:09 +02:00

app_user_invitation_repo.rs

feat(v1.1.8): invitations flow (migration 0030 + accept_invite returns session)

2026-06-06 12:10:32 +02:00

app_user_password_reset_repo.rs

chore(v1.1.8): clippy --all-targets clean (F2)

2026-06-06 18:03:51 +02:00

app_user_repo.rs

fix(manager-core): F-P-012 keyset cursor on app_user_repo::list (created_at, id) tiebreaker

2026-06-07 20:50:25 +02:00

app_user_role_repo.rs

fix(manager-core): F-P-001 batch app_user_roles lookups in users::list (N+1 → 1)

2026-06-07 20:09:31 +02:00

app_user_session_repo.rs

feat(v1.1.8): app_user_sessions table + repo with sliding TTL

2026-06-05 23:17:24 +02:00

app_user_verification_repo.rs

feat(v1.1.8): email verification flow (migration 0028 + SDK)

2026-06-06 12:04:09 +02:00

apply_api.rs

fix(security): server-authoritative approval gate + auth/session/file hardening

2026-07-11 23:47:35 +02:00

apply_service.rs

feat(interceptors): §9.4 service interceptors — thin KV allow/deny slice

2026-07-13 20:44:50 +02:00

apps_api.rs

fix(core): cron double-fire, materialize warnings, group quota fast path, SSE channel cap

2026-07-11 23:47:47 +02:00

atomic_write.rs

fix(files): check the quota BEFORE the destructive blob write

2026-07-14 21:11:49 +02:00

auth_api.rs

fix(security): server-authoritative approval gate + auth/session/file hardening

2026-07-11 23:47:35 +02:00

auth_bootstrap.rs

feat(manager-core,picloud): accept email on admin create + patch

2026-05-27 19:27:52 +02:00

auth_middleware.rs

fix(security): server-authoritative approval gate + auth/session/file hardening

2026-07-11 23:47:35 +02:00

auth.rs

feat(v1.1.8): app_users table + repo (migration 0026)

2026-06-05 23:15:47 +02:00

authz.rs

refactor(authz): route users_service through the shared authz-verdict mapper

2026-07-13 19:46:22 +02:00

config_api.rs

feat(secrets): group-secrets admin API, masked read, config/effective

2026-06-24 22:00:32 +02:00

config_resolver.rs

feat(modules): owner-aware module lookup — lexical chain walk (Phase 4b C1)

2026-06-26 07:07:04 +02:00

cron_scheduler.rs

feat(stateful-templates): schema + dispatch guards + allow cron/queue on group (M5.1)

2026-07-01 21:34:14 +02:00

dead_letter_repo.rs

feat(v1.1.1-triggers): triggers + outbox schema + repos

2026-06-01 21:46:45 +02:00

dead_letter_service.rs

feat(v1.1.1-dead-letters): service + Rhai SDK + admin endpoints

2026-06-01 22:17:25 +02:00

dead_letters_api.rs

fix(admin-api): accept slug or UUID on per-app endpoints

2026-06-09 18:34:42 +02:00

dev_email_api.rs

feat: E2E #2 (Stash) gap remediation + S6 hardening

2026-06-13 15:01:04 +02:00

dispatcher.rs

fix(outbox): reclaim stale claims — a crash mid-dispatch stranded events forever

2026-07-14 20:38:29 +02:00

docs_filter.rs

feat(v1.1.2-docs): manager-core docs service + repo + query DSL parser

2026-06-02 19:55:14 +02:00

docs_repo.rs

feat(quota): add per-app storage ceilings

2026-07-14 20:32:32 +02:00

docs_service.rs

test(services): pin that the per-value byte caps reject before authz

2026-07-15 19:38:51 +02:00

email_inbound_api.rs

feat(secrets): AAD-bind email-trigger inbound secrets v0->v1 (Track A M3)

2026-07-11 14:58:35 +02:00

email_service.rs

style(email): wrap over-width lines (cargo fmt)

2026-06-24 19:06:52 +02:00

extension_point_repo.rs

feat(modules): no-provider plan check + read-only extension-points ls (§5.5 C4)

2026-06-29 20:31:14 +02:00

files_api.rs

fix(security): server-authoritative approval gate + auth/session/file hardening

2026-07-11 23:47:35 +02:00

files_repo.rs

fix(files): check the quota BEFORE the destructive blob write

2026-07-14 21:11:49 +02:00

files_service.rs

feat(quota): add per-app storage ceilings

2026-07-14 20:32:32 +02:00

files_sweep.rs

test(modules): pin orphan-sweep coverage of group-shared blobs (§11.6 files review)

2026-06-30 20:04:09 +02:00

gc.rs

chore(v1.1.8): GC sweep for app-user sessions + tokens

2026-06-06 15:02:21 +02:00

group_blobs_api.rs

fix(security): server-authoritative approval gate + auth/session/file hardening

2026-07-11 23:47:35 +02:00

group_collection_repo.rs

fix(files): make file writes transactional and close a quota bypass

2026-07-14 20:09:03 +02:00

group_dead_letter_repo.rs

feat(queue): dead-letter store for group shared queues (§11.6 D3 / Track A M2)

2026-07-11 14:41:04 +02:00

group_docs_repo.rs

fix(docs): make docs writes transactional and the group quota a bound

2026-07-14 19:45:26 +02:00

group_docs_service.rs

fix(groups): don't let with_events silently downgrade a transactional writer

2026-07-14 21:12:01 +02:00

group_files_repo.rs

fix(files): make file writes transactional and close a quota bypass

2026-07-14 20:09:03 +02:00

group_files_service.rs

fix(groups): don't let with_events silently downgrade a transactional writer

2026-07-14 21:12:01 +02:00

group_kv_repo.rs

fix(quota): make the per-group ceiling a bound, not a hint

2026-07-14 19:37:11 +02:00

group_kv_service.rs

fix(groups): don't let with_events silently downgrade a transactional writer

2026-07-14 21:12:01 +02:00

group_members_repo.rs

feat(groups): tree repos, hierarchy-aware RBAC, admin API

2026-06-24 19:59:00 +02:00

group_pubsub_service.rs

test(groups): pin the anon + isolation gates on the queue and pubsub services

2026-07-15 07:27:53 +02:00

group_queue_repo.rs

fix(queue): don't count never-executed transient releases against max_attempts

2026-07-13 22:05:32 +02:00

group_queue_service.rs

test(groups): pin the anon + isolation gates on the queue and pubsub services

2026-07-15 07:27:53 +02:00

group_repo.rs

feat(apply): §6 M2 — structural-divergence detection + declarative reparent

2026-07-07 20:23:10 +02:00

group_scripts_api.rs

fix(modules): validate group module create per kind (Phase 4b review)

2026-06-29 19:32:34 +02:00

groups_api.rs

fix(core): cron double-fire, materialize warnings, group quota fast path, SSE channel cap

2026-07-11 23:47:47 +02:00

http_service.rs

fix(stage-1): audit High-severity backend correctness + CI unblocker

2026-06-10 21:03:10 +02:00

interceptor_repo.rs

fix(interceptors): harden the §9.4 slice — seal, fail-closed, re-entrancy, shared coverage

2026-07-13 21:20:20 +02:00

interceptor_service.rs

fix(interceptors): harden the §9.4 slice — seal, fail-closed, re-entrancy, shared coverage

2026-07-13 21:20:20 +02:00

invoke_service.rs

fix(outbox): reclaim stale claims — a crash mid-dispatch stranded events forever

2026-07-14 20:38:29 +02:00

kv_api.rs

feat: E2E #2 (Stash) gap remediation + S6 hardening

2026-06-13 15:01:04 +02:00

kv_repo.rs

fix(files): check the quota BEFORE the destructive blob write

2026-07-14 21:11:49 +02:00

kv_service.rs

test(services): pin that the per-value byte caps reject before authz

2026-07-15 19:38:51 +02:00

lib.rs

feat(quota): add per-app storage ceilings

2026-07-14 20:32:32 +02:00

log_sink.rs

feat: E2E #2 (Stash) gap remediation + S6 hardening

2026-06-13 15:01:04 +02:00

login_rate_limit.rs

fix(audit-2026-06-11/H-B1): login rate limit + Argon2 concurrency cap

2026-06-11 20:42:51 +02:00

materialize.rs

fix(materialize): take the per-(app,queue) lock so a consumer slot can't double-fill

2026-07-13 22:31:42 +02:00

migrations.rs

feat: versioning scheme — lockstep crates + four independent surfaces

2026-05-23 00:31:08 +02:00

module_source.rs

feat(modules): extension-point-aware resolver policy (§5.5 C2)

2026-06-29 20:07:59 +02:00

outbox_event_emitter.rs

refactor(outbox): make the trigger fan-out connection-scoped

2026-07-14 19:20:41 +02:00

outbox_repo.rs

fix(outbox): never resurrect a synchronous row on reclaim

2026-07-14 21:12:01 +02:00

principal_resolver.rs

feat(v1.1.1-dispatcher): dispatcher loop + retry + depth limit + outbox emitter

2026-06-01 22:01:42 +02:00

project_repo.rs

fix(security): server-authoritative approval gate + auth/session/file hardening

2026-07-11 23:47:35 +02:00

projects_api.rs

feat(cli): pic projects ls + §7 M3/track-complete docs

2026-07-06 21:26:10 +02:00

pubsub_repo.rs

feat(shared-topics): GroupPubsubService + shared publish fan-out + SDK handle (D2)

2026-07-02 21:48:59 +02:00

pubsub_service.rs

test(services): pin that the per-value byte caps reject before authz

2026-07-15 19:38:51 +02:00

queue_repo.rs

fix(queue): don't count never-executed transient releases against max_attempts

2026-07-13 22:05:32 +02:00

queue_service.rs

test(services): pin that the per-value byte caps reject before authz

2026-07-15 19:38:51 +02:00

queues_api.rs

fix: post-review followups on slug-vs-UUID refactor

2026-06-09 20:03:10 +02:00

quota.rs

feat(quota): add per-app storage ceilings

2026-07-14 20:32:32 +02:00

realtime_authority.rs

feat(realtime): external SSE subscription for group shared topics (§11.6 D2 / Track A M6)

2026-07-11 15:33:39 +02:00

repo.rs

fix(apply): resolve inherited-bound triggers in diff, state-token, and prune

2026-06-25 21:11:59 +02:00

route_admin.rs

fix(suppress): don't over-decline a nearer descendant's own route/trigger

2026-07-13 22:17:01 +02:00

route_repo.rs

fix(suppress): don't over-decline a nearer descendant's own route/trigger

2026-07-13 22:17:01 +02:00

sandbox.rs

feat: per-script Rhai sandbox overrides with admin ceiling

2026-05-23 16:26:12 +02:00

scheduler.rs

chore: initial scaffold — workspace, docs, blueprint

2026-05-22 23:16:32 +02:00

secrets_api.rs

feat(secrets): group-secrets admin API, masked read, config/effective

2026-06-24 22:00:32 +02:00

secrets_repo.rs

fix(secrets): composite keyset for group-secret admin list pagination

2026-06-24 22:13:00 +02:00

secrets_service.rs

feat(secrets): AAD-bind email-trigger inbound secrets v0->v1 (Track A M3)

2026-07-11 14:58:35 +02:00

ssrf.rs

feat(v1.1.4): outbound HTTP SDK + cron triggers

2026-06-03 20:23:18 +02:00

suppression_repo.rs

feat(suppress): owner-polymorphic suppression repo + reconcile (M1.2)

2026-07-01 20:04:32 +02:00

topic_repo.rs

feat(v1.1.8): F3 realtime auth_mode = 'session' (migration 0033)

2026-06-06 15:00:47 +02:00

topics_api.rs

feat(groups): tree repos, hierarchy-aware RBAC, admin API

2026-06-24 19:59:00 +02:00

trigger_config.rs

fix(outbox): reclaim stale claims — a crash mid-dispatch stranded events forever

2026-07-14 20:38:29 +02:00

trigger_repo.rs

refactor(outbox): make the trigger fan-out connection-scoped

2026-07-14 19:20:41 +02:00

triggers_api.rs

feat(secrets): AAD-bind email-trigger inbound secrets v0->v1 (Track A M3)

2026-07-11 14:58:35 +02:00

users_admin_api.rs

fix(manager-core): F-P-012 keyset cursor on app_user_repo::list (created_at, id) tiebreaker

2026-06-07 20:50:25 +02:00

users_service.rs

docs(users): warn against wiring a users trigger to the non-transactional emit

2026-07-14 20:47:58 +02:00

vars_api.rs

feat(vars): admin CRUD API + pic vars CLI

2026-06-24 21:11:46 +02:00

vars_repo.rs

feat(vars): admin CRUD API + pic vars CLI

2026-06-24 21:11:46 +02:00

vars_service.rs

feat(vars): VarsService + vars:: SDK + config capabilities

2026-06-24 20:59:23 +02:00

workflow_expr.rs

fix(workflows): close review gaps — pull round-trip, dup-names, reclaim budget

2026-07-12 18:56:44 +02:00

workflow_orchestrator.rs

feat(workflows): M4 — nested sub-workflows (start_child, parent-park, depth ceiling)

2026-07-12 17:30:16 +02:00

workflow_repo.rs

fix(workflows): close review gaps — pull round-trip, dup-names, reclaim budget

2026-07-12 18:56:44 +02:00

workflow_service.rs

feat(workflows): M5 — SDK workflow::start + admin run API + pic CLI

2026-07-12 17:48:38 +02:00

workflow_template.rs

feat(workflows): M1 — schema + definition validation + declarative reconcile

2026-07-12 16:46:32 +02:00

workflows_api.rs

fix(workflows): close review gaps — pull round-trip, dup-names, reclaim budget

2026-07-12 18:56:44 +02:00