cgalo5758
5829091881
The contained runner that drove the 2026-09 security audit, the README review and four rounds of design ideation lived only inside the ignored notebook. It moves to scripts/agent-runner/: the prepare, tools, audit, ideation and teardown scripts, the compose and container files, the allowlist proxy and the prompt templates, with the paths that assumed the notebook fixed and findings written to a caller-named directory. Run outputs, transcripts and the round-specific sheet scripts stay behind. docs/agent-runner.md states the method: the disposable git archive copy and the fail-closed proxy, how a task is shaped, union rather than intersection of findings across models, separate adjudication of every finding against the source, and the evidence a finding must carry.
1.1 KiB
1.1 KiB
T01 — Session lifecycle
Threat model. An attacker with no session, or with a session that should have ended, tries to act as a signed-in person.
Slice. internal/auth/auth.go (Middleware, bounceToLogin,
sessionPersonExists, endSession, LogoutHandler, LogoutCallbackHandler,
GetUserSession and the accessors), the session store wiring in
internal/server/server.go, and internal/middleware/csrf.go for cookie
attributes.
Questions.
- Is the session identifier rotated when a person signs in, so a pre-authentication session id cannot be reused after login?
- Does signing out destroy server-side session state, or only clear a cookie? Can the pre-logout session id still authenticate afterwards?
- What are the session and CSRF cookie attributes actually set in production configuration, and can either be sent over plain HTTP?
- Do the session cookie and the CSRF token expire together? If one outlives the other, what breaks?
- Can any authenticated route be reached without the per-request person lookup running?
Not in scope. Role checks (T02). OIDC token handling (T06).