60 lines
3.9 KiB
Markdown
60 lines
3.9 KiB
Markdown
# Tenant Isolation Report
|
|
|
|
<!-- Generated by scripts/tenant-isolation-report.ts. Do not edit by hand. -->
|
|
|
|
## Scope
|
|
|
|
This report summarizes committed Tenant Isolation tenant-isolation tests and S04 evidence using categorical labels only. Fixture identifiers, credentials, row IDs, relationship IDs, tenant IDs, emails, tokens, and source snippets are intentionally redacted from this document.
|
|
|
|
## Source Evidence
|
|
|
|
- apps/api/src/isolation/api-key-entity-rows.test.ts
|
|
- apps/api/src/isolation/api-key-fixtures.test.ts
|
|
- apps/api/src/isolation/api-key-relationships.test.ts
|
|
- apps/api/src/isolation/api-key-service-boundaries.test.ts
|
|
- apps/web/app/test/isolation/admin-routes.test.ts
|
|
- apps/web/app/test/isolation/fixtures/user-session-isolation.test.ts
|
|
- docs/security/tenant-isolation-s04-summary.md
|
|
|
|
## Boundary Matrix
|
|
|
|
| Source | Test count | Checked access boundaries | Deny-path evidence |
|
|
| --- | ---: | --- | --- |
|
|
| apps/api/src/isolation/api-key-entity-rows.test.ts | 15 | tenant and user scoped resolver | 403 response for unauthorized tenant access; denied path skips data mutation or lookup |
|
|
| apps/api/src/isolation/api-key-fixtures.test.ts | 4 | tenant and user scoped resolver | none observed |
|
|
| apps/api/src/isolation/api-key-relationships.test.ts | 12 | relationship parent/child authorization; tenant and user scoped resolver | 403 response for unauthorized tenant access; denied credentials stop downstream access; denied path skips data mutation or lookup |
|
|
| apps/api/src/isolation/api-key-service-boundaries.test.ts | 10 | tenant and user scoped resolver | 403 response for unauthorized tenant access; denied path skips data mutation or lookup |
|
|
| apps/web/app/test/isolation/admin-routes.test.ts | 4 | admin permission gate; tenant and user scoped resolver | 403 response for unauthorized tenant access; denied credentials stop downstream access; denied path skips data mutation or lookup; foreign tenant resource denied; skips cross-tenant API-key access when admin permission is denied; skips cross-tenant API-log access when admin auth is denied |
|
|
| apps/web/app/test/isolation/fixtures/user-session-isolation.test.ts | 6 | API-key status logging boundary; tenant and user scoped resolver; tenant-scoped usage reporting | 403 response for unauthorized tenant access; denied credentials stop downstream access; foreign tenant resource denied; resets shared mocks and supports denied access status assertions |
|
|
|
|
## Prior Slice Evidence
|
|
|
|
- Source: docs/security/tenant-isolation-s04-summary.md
|
|
- Verification status: passed
|
|
- Summary: Slice S04 complete. Admin-uebergreifende API-Flaechen und gesperrte Zugangsdaten sind durch fokussierte Isolationstests abgesichert.
|
|
- Established patterns:
|
|
- Abweisungspruefungen kontrollieren Status, Fehlermeldung und ausbleibende nachgelagerte Datenzugriffe.
|
|
- Gemeinsame Isolationstestdaten fuer Admin-, Mandanten- und gesperrte Zugangsszenarien.
|
|
- Negativtests pruefen, dass nach fehlender Berechtigung keine [redacted token] Datenquellen aufgerufen werden.
|
|
|
|
## Deny-Path Coverage
|
|
|
|
The boundary matrix records denial outcomes for unauthorized credentials, foreign tenant resources, skipped downstream mutations/lookups, and 403 responses. These entries are derived from test names and assertion patterns rather than concrete fixture values.
|
|
|
|
## Redaction Rules
|
|
|
|
The renderer reports tenant A, tenant B, admin, user session, API credential, row record, and relationship record categories instead of concrete fixture values.
|
|
|
|
## Verification Commands
|
|
|
|
```sh
|
|
pnpm exec eslint scripts/tenant-isolation-report.ts scripts/tenant-isolation-report.test.ts --max-warnings=0
|
|
pnpm exec vitest run scripts/tenant-isolation-report.test.ts
|
|
pnpm exec tsx scripts/tenant-isolation-report.ts --check
|
|
pnpm exec tsx scripts/docs-link-check.ts
|
|
```
|
|
|
|
## Redaction Contract
|
|
|
|
The renderer reports tenant A, tenant B, admin, user session, API credential, row record, and relationship record categories instead of concrete fixture values.
|