Repository navigation
test: exercise invoice tenant regression - #172
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b0e7ff8f25
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| path = environ.get("PATH_INFO", "") | ||
| invoice = INVOICES.get(path.removeprefix(prefix)) if path.startswith(prefix) else None | ||
| if invoice is None or invoice["tenant"] != tenant: | ||
| if invoice is None: |
There was a problem hiding this comment.
When any authenticated caller supplies another tenant's invoice ID, this condition now accepts the record without comparing invoice["tenant"] to the tenant derived from the bearer session, so session-amber receives Violet's /invoices/1002 data with HTTP 200. This directly violates the access-control contract in examples/invoice-service/SECURITY.md:3-5 and README.md:7-9; retain the ownership comparison so inaccessible records continue to return 404.
Useful? React with 👍 / 👎.
Temporarily removes the tenant check from the standalone invoice example to exercise continuous security scanning. This is an authorized test using fake sessions and invoice records. The example is not connected to the CLI or plugins.
Verified locally: an Amber session can now read Violet's synthetic invoice (HTTP 200), while authentication and missing-record handling still work. The safe baseline returned 404 for that request.
The tenant check will be restored after the scan finishes. This is test data, not a proposed application change.